block/qcow2.c

   1 /*
   2  * Block driver for the QCOW version 2 format
   3  *
   4  * Copyright (c) 2004-2006 Fabrice Bellard
   5  *
   6  * Permission is hereby granted, free of charge, to any person obtaining a copy
   7  * of this software and associated documentation files (the "Software"), to deal
   8  * in the Software without restriction, including without limitation the rights
   9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10  * copies of the Software, and to permit persons to whom the Software is
  11  * furnished to do so, subject to the following conditions:
  12  *
  13  * The above copyright notice and this permission notice shall be included in
  14  * all copies or substantial portions of the Software.
  15  *
  16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22  * THE SOFTWARE.
  23  */
  24 #include "qemu/osdep.h"
  25 #include "block/block_int.h"
  26 #include "sysemu/block-backend.h"
  27 #include "qemu/module.h"
  28 #include <zlib.h>
  29 #include "block/qcow2.h"
  30 #include "qemu/error-report.h"
  31 #include "qapi/qmp/qerror.h"
  32 #include "qapi/qmp/qbool.h"
  33 #include "qapi/util.h"
  34 #include "qapi/qmp/types.h"
  35 #include "qapi-event.h"
  36 #include "trace.h"
  37 #include "qemu/option_int.h"
  38 #include "qemu/cutils.h"
  39 #include "qemu/bswap.h"
  40 #include "qapi/opts-visitor.h"
  41 #include "qapi-visit.h"
  42 #include "block/crypto.h"
  43
  44 /*
  45   Differences with QCOW:
  46
  47   - Support for multiple incremental snapshots.
  48   - Memory management by reference counts.
  49   - Clusters which have a reference count of one have the bit
  50     QCOW_OFLAG_COPIED to optimize write performance.
  51   - Size of compressed clusters is stored in sectors to reduce bit usage
  52     in the cluster offsets.
  53   - Support for storing additional data (such as the VM state) in the
  54     snapshots.
  55   - If a backing store is used, the cluster size is not constrained
  56     (could be backported to QCOW).
  57   - L2 tables have always a size of one cluster.
  58 */
  59
  60
  61 typedef struct {
  62     uint32_t magic;
  63     uint32_t len;
  64 } QEMU_PACKED QCowExtension;
  65
  66 #define  QCOW2_EXT_MAGIC_END 0
  67 #define  QCOW2_EXT_MAGIC_BACKING_FORMAT 0xE2792ACA
  68 #define  QCOW2_EXT_MAGIC_FEATURE_TABLE 0x6803f857
  69 #define  QCOW2_EXT_MAGIC_CRYPTO_HEADER 0x0537be77
  70 #define  QCOW2_EXT_MAGIC_BITMAPS 0x23852875
  71
  72 static int qcow2_probe(const uint8_t *buf, int buf_size, const char *filename)
  73 {
  74     const QCowHeader *cow_header = (const void *)buf;
  75
  76     if (buf_size >= sizeof(QCowHeader) &&
  77         be32_to_cpu(cow_header->magic) == QCOW_MAGIC &&
  78         be32_to_cpu(cow_header->version) >= 2)
  79         return 100;
  80     else
  81         return 0;
  82 }
  83
  84
  85 static ssize_t qcow2_crypto_hdr_read_func(QCryptoBlock *block, size_t offset,
  86                                           uint8_t *buf, size_t buflen,
  87                                           void *opaque, Error **errp)
  88 {
  89     BlockDriverState *bs = opaque;
  90     BDRVQcow2State *s = bs->opaque;
  91     ssize_t ret;
  92
  93     if ((offset + buflen) > s->crypto_header.length) {
  94         error_setg(errp, "Request for data outside of extension header");
  95         return -1;
  96     }
  97
  98     ret = bdrv_pread(bs->file,
  99                      s->crypto_header.offset + offset, buf, buflen);
 100     if (ret < 0) {
 101         error_setg_errno(errp, -ret, "Could not read encryption header");
 102         return -1;
 103     }
 104     return ret;
 105 }
 106
 107
 108 static ssize_t qcow2_crypto_hdr_init_func(QCryptoBlock *block, size_t headerlen,
 109                                           void *opaque, Error **errp)
 110 {
 111     BlockDriverState *bs = opaque;
 112     BDRVQcow2State *s = bs->opaque;
 113     int64_t ret;
 114     int64_t clusterlen;
 115
 116     ret = qcow2_alloc_clusters(bs, headerlen);
 117     if (ret < 0) {
 118         error_setg_errno(errp, -ret,
 119                          "Cannot allocate cluster for LUKS header size %zu",
 120                          headerlen);
 121         return -1;
 122     }
 123
 124     s->crypto_header.length = headerlen;
 125     s->crypto_header.offset = ret;
 126
 127     /* Zero fill remaining space in cluster so it has predictable
 128      * content in case of future spec changes */
 129     clusterlen = size_to_clusters(s, headerlen) * s->cluster_size;
 130     ret = bdrv_pwrite_zeroes(bs->file,
 131                              ret + headerlen,
 132                              clusterlen - headerlen, 0);
 133     if (ret < 0) {
 134         error_setg_errno(errp, -ret, "Could not zero fill encryption header");
 135         return -1;
 136     }
 137
 138     return ret;
 139 }
 140
 141
 142 static ssize_t qcow2_crypto_hdr_write_func(QCryptoBlock *block, size_t offset,
 143                                            const uint8_t *buf, size_t buflen,
 144                                            void *opaque, Error **errp)
 145 {
 146     BlockDriverState *bs = opaque;
 147     BDRVQcow2State *s = bs->opaque;
 148     ssize_t ret;
 149
 150     if ((offset + buflen) > s->crypto_header.length) {
 151         error_setg(errp, "Request for data outside of extension header");
 152         return -1;
 153     }
 154
 155     ret = bdrv_pwrite(bs->file,
 156                       s->crypto_header.offset + offset, buf, buflen);
 157     if (ret < 0) {
 158         error_setg_errno(errp, -ret, "Could not read encryption header");
 159         return -1;
 160     }
 161     return ret;
 162 }
 163
 164
 165 /*
 166  * read qcow2 extension and fill bs
 167  * start reading from start_offset
 168  * finish reading upon magic of value 0 or when end_offset reached
 169  * unknown magic is skipped (future extension this version knows nothing about)
 170  * return 0 upon success, non-0 otherwise
 171  */
 172 static int qcow2_read_extensions(BlockDriverState *bs, uint64_t start_offset,
 173                                  uint64_t end_offset, void **p_feature_table,
 174                                  int flags, bool *need_update_header,
 175                                  Error **errp)
 176 {
 177     BDRVQcow2State *s = bs->opaque;
 178     QCowExtension ext;
 179     uint64_t offset;
 180     int ret;
 181     Qcow2BitmapHeaderExt bitmaps_ext;
 182
 183     if (need_update_header != NULL) {
 184         *need_update_header = false;
 185     }
 186
 187 #ifdef DEBUG_EXT
 188     printf("qcow2_read_extensions: start=%ld end=%ld\n", start_offset, end_offset);
 189 #endif
 190     offset = start_offset;
 191     while (offset < end_offset) {
 192
 193 #ifdef DEBUG_EXT
 194         /* Sanity check */
 195         if (offset > s->cluster_size)
 196             printf("qcow2_read_extension: suspicious offset %lu\n", offset);
 197
 198         printf("attempting to read extended header in offset %lu\n", offset);
 199 #endif
 200
 201         ret = bdrv_pread(bs->file, offset, &ext, sizeof(ext));
 202         if (ret < 0) {
 203             error_setg_errno(errp, -ret, "qcow2_read_extension: ERROR: "
 204                              "pread fail from offset %" PRIu64, offset);
 205             return 1;
 206         }
 207         be32_to_cpus(&ext.magic);
 208         be32_to_cpus(&ext.len);
 209         offset += sizeof(ext);
 210 #ifdef DEBUG_EXT
 211         printf("ext.magic = 0x%x\n", ext.magic);
 212 #endif
 213         if (offset > end_offset || ext.len > end_offset - offset) {
 214             error_setg(errp, "Header extension too large");
 215             return -EINVAL;
 216         }
 217
 218         switch (ext.magic) {
 219         case QCOW2_EXT_MAGIC_END:
 220             return 0;
 221
 222         case QCOW2_EXT_MAGIC_BACKING_FORMAT:
 223             if (ext.len >= sizeof(bs->backing_format)) {
 224                 error_setg(errp, "ERROR: ext_backing_format: len=%" PRIu32
 225                            " too large (>=%zu)", ext.len,
 226                            sizeof(bs->backing_format));
 227                 return 2;
 228             }
 229             ret = bdrv_pread(bs->file, offset, bs->backing_format, ext.len);
 230             if (ret < 0) {
 231                 error_setg_errno(errp, -ret, "ERROR: ext_backing_format: "
 232                                  "Could not read format name");
 233                 return 3;
 234             }
 235             bs->backing_format[ext.len] = '\0';
 236             s->image_backing_format = g_strdup(bs->backing_format);
 237 #ifdef DEBUG_EXT
 238             printf("Qcow2: Got format extension %s\n", bs->backing_format);
 239 #endif
 240             break;
 241
 242         case QCOW2_EXT_MAGIC_FEATURE_TABLE:
 243             if (p_feature_table != NULL) {
 244                 void* feature_table = g_malloc0(ext.len + 2 * sizeof(Qcow2Feature));
 245                 ret = bdrv_pread(bs->file, offset , feature_table, ext.len);
 246                 if (ret < 0) {
 247                     error_setg_errno(errp, -ret, "ERROR: ext_feature_table: "
 248                                      "Could not read table");
 249                     return ret;
 250                 }
 251
 252                 *p_feature_table = feature_table;
 253             }
 254             break;
 255
 256         case QCOW2_EXT_MAGIC_CRYPTO_HEADER: {
 257             unsigned int cflags = 0;
 258             if (s->crypt_method_header != QCOW_CRYPT_LUKS) {
 259                 error_setg(errp, "CRYPTO header extension only "
 260                            "expected with LUKS encryption method");
 261                 return -EINVAL;
 262             }
 263             if (ext.len != sizeof(Qcow2CryptoHeaderExtension)) {
 264                 error_setg(errp, "CRYPTO header extension size %u, "
 265                            "but expected size %zu", ext.len,
 266                            sizeof(Qcow2CryptoHeaderExtension));
 267                 return -EINVAL;
 268             }
 269
 270             ret = bdrv_pread(bs->file, offset, &s->crypto_header, ext.len);
 271             if (ret < 0) {
 272                 error_setg_errno(errp, -ret,
 273                                  "Unable to read CRYPTO header extension");
 274                 return ret;
 275             }
 276             be64_to_cpus(&s->crypto_header.offset);
 277             be64_to_cpus(&s->crypto_header.length);
 278
 279             if ((s->crypto_header.offset % s->cluster_size) != 0) {
 280                 error_setg(errp, "Encryption header offset '%" PRIu64 "' is "
 281                            "not a multiple of cluster size '%u'",
 282                            s->crypto_header.offset, s->cluster_size);
 283                 return -EINVAL;
 284             }
 285
 286             if (flags & BDRV_O_NO_IO) {
 287                 cflags |= QCRYPTO_BLOCK_OPEN_NO_IO;
 288             }
 289             s->crypto = qcrypto_block_open(s->crypto_opts, "encrypt.",
 290                                            qcow2_crypto_hdr_read_func,
 291                                            bs, cflags, errp);
 292             if (!s->crypto) {
 293                 return -EINVAL;
 294             }
 295         }   break;
 296
 297         case QCOW2_EXT_MAGIC_BITMAPS:
 298             if (ext.len != sizeof(bitmaps_ext)) {
 299                 error_setg_errno(errp, -ret, "bitmaps_ext: "
 300                                  "Invalid extension length");
 301                 return -EINVAL;
 302             }
 303
 304             if (!(s->autoclear_features & QCOW2_AUTOCLEAR_BITMAPS)) {
 305                 error_report("WARNING: a program lacking bitmap support "
 306                              "modified this file, so all bitmaps are now "
 307                              "considered inconsistent. Some clusters may be "
 308                              "leaked, run 'qemu-img check -r' on the image "
 309                              "file to fix.");
 310                 if (need_update_header != NULL) {
 311                     /* Updating is needed to drop invalid bitmap extension. */
 312                     *need_update_header = true;
 313                 }
 314                 break;
 315             }
 316
 317             ret = bdrv_pread(bs->file, offset, &bitmaps_ext, ext.len);
 318             if (ret < 0) {
 319                 error_setg_errno(errp, -ret, "bitmaps_ext: "
 320                                  "Could not read ext header");
 321                 return ret;
 322             }
 323
 324             if (bitmaps_ext.reserved32 != 0) {
 325                 error_setg_errno(errp, -ret, "bitmaps_ext: "
 326                                  "Reserved field is not zero");
 327                 return -EINVAL;
 328             }
 329
 330             be32_to_cpus(&bitmaps_ext.nb_bitmaps);
 331             be64_to_cpus(&bitmaps_ext.bitmap_directory_size);
 332             be64_to_cpus(&bitmaps_ext.bitmap_directory_offset);
 333
 334             if (bitmaps_ext.nb_bitmaps > QCOW2_MAX_BITMAPS) {
 335                 error_setg(errp,
 336                            "bitmaps_ext: Image has %" PRIu32 " bitmaps, "
 337                            "exceeding the QEMU supported maximum of %d",
 338                            bitmaps_ext.nb_bitmaps, QCOW2_MAX_BITMAPS);
 339                 return -EINVAL;
 340             }
 341
 342             if (bitmaps_ext.nb_bitmaps == 0) {
 343                 error_setg(errp, "found bitmaps extension with zero bitmaps");
 344                 return -EINVAL;
 345             }
 346
 347             if (bitmaps_ext.bitmap_directory_offset & (s->cluster_size - 1)) {
 348                 error_setg(errp, "bitmaps_ext: "
 349                                  "invalid bitmap directory offset");
 350                 return -EINVAL;
 351             }
 352
 353             if (bitmaps_ext.bitmap_directory_size >
 354                 QCOW2_MAX_BITMAP_DIRECTORY_SIZE) {
 355                 error_setg(errp, "bitmaps_ext: "
 356                                  "bitmap directory size (%" PRIu64 ") exceeds "
 357                                  "the maximum supported size (%d)",
 358                                  bitmaps_ext.bitmap_directory_size,
 359                                  QCOW2_MAX_BITMAP_DIRECTORY_SIZE);
 360                 return -EINVAL;
 361             }
 362
 363             s->nb_bitmaps = bitmaps_ext.nb_bitmaps;
 364             s->bitmap_directory_offset =
 365                     bitmaps_ext.bitmap_directory_offset;
 366             s->bitmap_directory_size =
 367                     bitmaps_ext.bitmap_directory_size;
 368
 369 #ifdef DEBUG_EXT
 370             printf("Qcow2: Got bitmaps extension: "
 371                    "offset=%" PRIu64 " nb_bitmaps=%" PRIu32 "\n",
 372                    s->bitmap_directory_offset, s->nb_bitmaps);
 373 #endif
 374             break;
 375
 376         default:
 377             /* unknown magic - save it in case we need to rewrite the header */
 378             {
 379                 Qcow2UnknownHeaderExtension *uext;
 380
 381                 uext = g_malloc0(sizeof(*uext)  + ext.len);
 382                 uext->magic = ext.magic;
 383                 uext->len = ext.len;
 384                 QLIST_INSERT_HEAD(&s->unknown_header_ext, uext, next);
 385
 386                 ret = bdrv_pread(bs->file, offset , uext->data, uext->len);
 387                 if (ret < 0) {
 388                     error_setg_errno(errp, -ret, "ERROR: unknown extension: "
 389                                      "Could not read data");
 390                     return ret;
 391                 }
 392             }
 393             break;
 394         }
 395
 396         offset += ((ext.len + 7) & ~7);
 397     }
 398
 399     return 0;
 400 }
 401
 402 static void cleanup_unknown_header_ext(BlockDriverState *bs)
 403 {
 404     BDRVQcow2State *s = bs->opaque;
 405     Qcow2UnknownHeaderExtension *uext, *next;
 406
 407     QLIST_FOREACH_SAFE(uext, &s->unknown_header_ext, next, next) {
 408         QLIST_REMOVE(uext, next);
 409         g_free(uext);
 410     }
 411 }
 412
 413 static void report_unsupported_feature(Error **errp, Qcow2Feature *table,
 414                                        uint64_t mask)
 415 {
 416     char *features = g_strdup("");
 417     char *old;
 418
 419     while (table && table->name[0] != '\0') {
 420         if (table->type == QCOW2_FEAT_TYPE_INCOMPATIBLE) {
 421             if (mask & (1ULL << table->bit)) {
 422                 old = features;
 423                 features = g_strdup_printf("%s%s%.46s", old, *old ? ", " : "",
 424                                            table->name);
 425                 g_free(old);
 426                 mask &= ~(1ULL << table->bit);
 427             }
 428         }
 429         table++;
 430     }
 431
 432     if (mask) {
 433         old = features;
 434         features = g_strdup_printf("%s%sUnknown incompatible feature: %" PRIx64,
 435                                    old, *old ? ", " : "", mask);
 436         g_free(old);
 437     }
 438
 439     error_setg(errp, "Unsupported qcow2 feature(s): %s", features);
 440     g_free(features);
 441 }
 442
 443 /*
 444  * Sets the dirty bit and flushes afterwards if necessary.
 445  *
 446  * The incompatible_features bit is only set if the image file header was
 447  * updated successfully.  Therefore it is not required to check the return
 448  * value of this function.
 449  */
 450 int qcow2_mark_dirty(BlockDriverState *bs)
 451 {
 452     BDRVQcow2State *s = bs->opaque;
 453     uint64_t val;
 454     int ret;
 455
 456     assert(s->qcow_version >= 3);
 457
 458     if (s->incompatible_features & QCOW2_INCOMPAT_DIRTY) {
 459         return 0; /* already dirty */
 460     }
 461
 462     val = cpu_to_be64(s->incompatible_features | QCOW2_INCOMPAT_DIRTY);
 463     ret = bdrv_pwrite(bs->file, offsetof(QCowHeader, incompatible_features),
 464                       &val, sizeof(val));
 465     if (ret < 0) {
 466         return ret;
 467     }
 468     ret = bdrv_flush(bs->file->bs);
 469     if (ret < 0) {
 470         return ret;
 471     }
 472
 473     /* Only treat image as dirty if the header was updated successfully */
 474     s->incompatible_features |= QCOW2_INCOMPAT_DIRTY;
 475     return 0;
 476 }
 477
 478 /*
 479  * Clears the dirty bit and flushes before if necessary.  Only call this
 480  * function when there are no pending requests, it does not guard against
 481  * concurrent requests dirtying the image.
 482  */
 483 static int qcow2_mark_clean(BlockDriverState *bs)
 484 {
 485     BDRVQcow2State *s = bs->opaque;
 486
 487     if (s->incompatible_features & QCOW2_INCOMPAT_DIRTY) {
 488         int ret;
 489
 490         s->incompatible_features &= ~QCOW2_INCOMPAT_DIRTY;
 491
 492         ret = bdrv_flush(bs);
 493         if (ret < 0) {
 494             return ret;
 495         }
 496
 497         return qcow2_update_header(bs);
 498     }
 499     return 0;
 500 }
 501
 502 /*
 503  * Marks the image as corrupt.
 504  */
 505 int qcow2_mark_corrupt(BlockDriverState *bs)
 506 {
 507     BDRVQcow2State *s = bs->opaque;
 508
 509     s->incompatible_features |= QCOW2_INCOMPAT_CORRUPT;
 510     return qcow2_update_header(bs);
 511 }
 512
 513 /*
 514  * Marks the image as consistent, i.e., unsets the corrupt bit, and flushes
 515  * before if necessary.
 516  */
 517 int qcow2_mark_consistent(BlockDriverState *bs)
 518 {
 519     BDRVQcow2State *s = bs->opaque;
 520
 521     if (s->incompatible_features & QCOW2_INCOMPAT_CORRUPT) {
 522         int ret = bdrv_flush(bs);
 523         if (ret < 0) {
 524             return ret;
 525         }
 526
 527         s->incompatible_features &= ~QCOW2_INCOMPAT_CORRUPT;
 528         return qcow2_update_header(bs);
 529     }
 530     return 0;
 531 }
 532
 533 static int qcow2_check(BlockDriverState *bs, BdrvCheckResult *result,
 534                        BdrvCheckMode fix)
 535 {
 536     int ret = qcow2_check_refcounts(bs, result, fix);
 537     if (ret < 0) {
 538         return ret;
 539     }
 540
 541     if (fix && result->check_errors == 0 && result->corruptions == 0) {
 542         ret = qcow2_mark_clean(bs);
 543         if (ret < 0) {
 544             return ret;
 545         }
 546         return qcow2_mark_consistent(bs);
 547     }
 548     return ret;
 549 }
 550
 551 static int validate_table_offset(BlockDriverState *bs, uint64_t offset,
 552                                  uint64_t entries, size_t entry_len)
 553 {
 554     BDRVQcow2State *s = bs->opaque;
 555     uint64_t size;
 556
 557     /* Use signed INT64_MAX as the maximum even for uint64_t header fields,
 558      * because values will be passed to qemu functions taking int64_t. */
 559     if (entries > INT64_MAX / entry_len) {
 560         return -EINVAL;
 561     }
 562
 563     size = entries * entry_len;
 564
 565     if (INT64_MAX - size < offset) {
 566         return -EINVAL;
 567     }
 568
 569     /* Tables must be cluster aligned */
 570     if (offset_into_cluster(s, offset) != 0) {
 571         return -EINVAL;
 572     }
 573
 574     return 0;
 575 }
 576
 577 static QemuOptsList qcow2_runtime_opts = {
 578     .name = "qcow2",
 579     .head = QTAILQ_HEAD_INITIALIZER(qcow2_runtime_opts.head),
 580     .desc = {
 581         {
 582             .name = QCOW2_OPT_LAZY_REFCOUNTS,
 583             .type = QEMU_OPT_BOOL,
 584             .help = "Postpone refcount updates",
 585         },
 586         {
 587             .name = QCOW2_OPT_DISCARD_REQUEST,
 588             .type = QEMU_OPT_BOOL,
 589             .help = "Pass guest discard requests to the layer below",
 590         },
 591         {
 592             .name = QCOW2_OPT_DISCARD_SNAPSHOT,
 593             .type = QEMU_OPT_BOOL,
 594             .help = "Generate discard requests when snapshot related space "
 595                     "is freed",
 596         },
 597         {
 598             .name = QCOW2_OPT_DISCARD_OTHER,
 599             .type = QEMU_OPT_BOOL,
 600             .help = "Generate discard requests when other clusters are freed",
 601         },
 602         {
 603             .name = QCOW2_OPT_OVERLAP,
 604             .type = QEMU_OPT_STRING,
 605             .help = "Selects which overlap checks to perform from a range of "
 606                     "templates (none, constant, cached, all)",
 607         },
 608         {
 609             .name = QCOW2_OPT_OVERLAP_TEMPLATE,
 610             .type = QEMU_OPT_STRING,
 611             .help = "Selects which overlap checks to perform from a range of "
 612                     "templates (none, constant, cached, all)",
 613         },
 614         {
 615             .name = QCOW2_OPT_OVERLAP_MAIN_HEADER,
 616             .type = QEMU_OPT_BOOL,
 617             .help = "Check for unintended writes into the main qcow2 header",
 618         },
 619         {
 620             .name = QCOW2_OPT_OVERLAP_ACTIVE_L1,
 621             .type = QEMU_OPT_BOOL,
 622             .help = "Check for unintended writes into the active L1 table",
 623         },
 624         {
 625             .name = QCOW2_OPT_OVERLAP_ACTIVE_L2,
 626             .type = QEMU_OPT_BOOL,
 627             .help = "Check for unintended writes into an active L2 table",
 628         },
 629         {
 630             .name = QCOW2_OPT_OVERLAP_REFCOUNT_TABLE,
 631             .type = QEMU_OPT_BOOL,
 632             .help = "Check for unintended writes into the refcount table",
 633         },
 634         {
 635             .name = QCOW2_OPT_OVERLAP_REFCOUNT_BLOCK,
 636             .type = QEMU_OPT_BOOL,
 637             .help = "Check for unintended writes into a refcount block",
 638         },
 639         {
 640             .name = QCOW2_OPT_OVERLAP_SNAPSHOT_TABLE,
 641             .type = QEMU_OPT_BOOL,
 642             .help = "Check for unintended writes into the snapshot table",
 643         },
 644         {
 645             .name = QCOW2_OPT_OVERLAP_INACTIVE_L1,
 646             .type = QEMU_OPT_BOOL,
 647             .help = "Check for unintended writes into an inactive L1 table",
 648         },
 649         {
 650             .name = QCOW2_OPT_OVERLAP_INACTIVE_L2,
 651             .type = QEMU_OPT_BOOL,
 652             .help = "Check for unintended writes into an inactive L2 table",
 653         },
 654         {
 655             .name = QCOW2_OPT_CACHE_SIZE,
 656             .type = QEMU_OPT_SIZE,
 657             .help = "Maximum combined metadata (L2 tables and refcount blocks) "
 658                     "cache size",
 659         },
 660         {
 661             .name = QCOW2_OPT_L2_CACHE_SIZE,
 662             .type = QEMU_OPT_SIZE,
 663             .help = "Maximum L2 table cache size",
 664         },
 665         {
 666             .name = QCOW2_OPT_REFCOUNT_CACHE_SIZE,
 667             .type = QEMU_OPT_SIZE,
 668             .help = "Maximum refcount block cache size",
 669         },
 670         {
 671             .name = QCOW2_OPT_CACHE_CLEAN_INTERVAL,
 672             .type = QEMU_OPT_NUMBER,
 673             .help = "Clean unused cache entries after this time (in seconds)",
 674         },
 675         BLOCK_CRYPTO_OPT_DEF_KEY_SECRET("encrypt.",
 676             "ID of secret providing qcow2 AES key or LUKS passphrase"),
 677         { /* end of list */ }
 678     },
 679 };
 680
 681 static const char *overlap_bool_option_names[QCOW2_OL_MAX_BITNR] = {
 682     [QCOW2_OL_MAIN_HEADER_BITNR]    = QCOW2_OPT_OVERLAP_MAIN_HEADER,
 683     [QCOW2_OL_ACTIVE_L1_BITNR]      = QCOW2_OPT_OVERLAP_ACTIVE_L1,
 684     [QCOW2_OL_ACTIVE_L2_BITNR]      = QCOW2_OPT_OVERLAP_ACTIVE_L2,
 685     [QCOW2_OL_REFCOUNT_TABLE_BITNR] = QCOW2_OPT_OVERLAP_REFCOUNT_TABLE,
 686     [QCOW2_OL_REFCOUNT_BLOCK_BITNR] = QCOW2_OPT_OVERLAP_REFCOUNT_BLOCK,
 687     [QCOW2_OL_SNAPSHOT_TABLE_BITNR] = QCOW2_OPT_OVERLAP_SNAPSHOT_TABLE,
 688     [QCOW2_OL_INACTIVE_L1_BITNR]    = QCOW2_OPT_OVERLAP_INACTIVE_L1,
 689     [QCOW2_OL_INACTIVE_L2_BITNR]    = QCOW2_OPT_OVERLAP_INACTIVE_L2,
 690 };
 691
 692 static void cache_clean_timer_cb(void *opaque)
 693 {
 694     BlockDriverState *bs = opaque;
 695     BDRVQcow2State *s = bs->opaque;
 696     qcow2_cache_clean_unused(bs, s->l2_table_cache);
 697     qcow2_cache_clean_unused(bs, s->refcount_block_cache);
 698     timer_mod(s->cache_clean_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) +
 699               (int64_t) s->cache_clean_interval * 1000);
 700 }
 701
 702 static void cache_clean_timer_init(BlockDriverState *bs, AioContext *context)
 703 {
 704     BDRVQcow2State *s = bs->opaque;
 705     if (s->cache_clean_interval > 0) {
 706         s->cache_clean_timer = aio_timer_new(context, QEMU_CLOCK_VIRTUAL,
 707                                              SCALE_MS, cache_clean_timer_cb,
 708                                              bs);
 709         timer_mod(s->cache_clean_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) +
 710                   (int64_t) s->cache_clean_interval * 1000);
 711     }
 712 }
 713
 714 static void cache_clean_timer_del(BlockDriverState *bs)
 715 {
 716     BDRVQcow2State *s = bs->opaque;
 717     if (s->cache_clean_timer) {
 718         timer_del(s->cache_clean_timer);
 719         timer_free(s->cache_clean_timer);
 720         s->cache_clean_timer = NULL;
 721     }
 722 }
 723
 724 static void qcow2_detach_aio_context(BlockDriverState *bs)
 725 {
 726     cache_clean_timer_del(bs);
 727 }
 728
 729 static void qcow2_attach_aio_context(BlockDriverState *bs,
 730                                      AioContext *new_context)
 731 {
 732     cache_clean_timer_init(bs, new_context);
 733 }
 734
 735 static void read_cache_sizes(BlockDriverState *bs, QemuOpts *opts,
 736                              uint64_t *l2_cache_size,
 737                              uint64_t *refcount_cache_size, Error **errp)
 738 {
 739     BDRVQcow2State *s = bs->opaque;
 740     uint64_t combined_cache_size;
 741     bool l2_cache_size_set, refcount_cache_size_set, combined_cache_size_set;
 742
 743     combined_cache_size_set = qemu_opt_get(opts, QCOW2_OPT_CACHE_SIZE);
 744     l2_cache_size_set = qemu_opt_get(opts, QCOW2_OPT_L2_CACHE_SIZE);
 745     refcount_cache_size_set = qemu_opt_get(opts, QCOW2_OPT_REFCOUNT_CACHE_SIZE);
 746
 747     combined_cache_size = qemu_opt_get_size(opts, QCOW2_OPT_CACHE_SIZE, 0);
 748     *l2_cache_size = qemu_opt_get_size(opts, QCOW2_OPT_L2_CACHE_SIZE, 0);
 749     *refcount_cache_size = qemu_opt_get_size(opts,
 750                                              QCOW2_OPT_REFCOUNT_CACHE_SIZE, 0);
 751
 752     if (combined_cache_size_set) {
 753         if (l2_cache_size_set && refcount_cache_size_set) {
 754             error_setg(errp, QCOW2_OPT_CACHE_SIZE ", " QCOW2_OPT_L2_CACHE_SIZE
 755                        " and " QCOW2_OPT_REFCOUNT_CACHE_SIZE " may not be set "
 756                        "the same time");
 757             return;
 758         } else if (*l2_cache_size > combined_cache_size) {
 759             error_setg(errp, QCOW2_OPT_L2_CACHE_SIZE " may not exceed "
 760                        QCOW2_OPT_CACHE_SIZE);
 761             return;
 762         } else if (*refcount_cache_size > combined_cache_size) {
 763             error_setg(errp, QCOW2_OPT_REFCOUNT_CACHE_SIZE " may not exceed "
 764                        QCOW2_OPT_CACHE_SIZE);
 765             return;
 766         }
 767
 768         if (l2_cache_size_set) {
 769             *refcount_cache_size = combined_cache_size - *l2_cache_size;
 770         } else if (refcount_cache_size_set) {
 771             *l2_cache_size = combined_cache_size - *refcount_cache_size;
 772         } else {
 773             *refcount_cache_size = combined_cache_size
 774                                  / (DEFAULT_L2_REFCOUNT_SIZE_RATIO + 1);
 775             *l2_cache_size = combined_cache_size - *refcount_cache_size;
 776         }
 777     } else {
 778         if (!l2_cache_size_set && !refcount_cache_size_set) {
 779             *l2_cache_size = MAX(DEFAULT_L2_CACHE_BYTE_SIZE,
 780                                  (uint64_t)DEFAULT_L2_CACHE_CLUSTERS
 781                                  * s->cluster_size);
 782             *refcount_cache_size = *l2_cache_size
 783                                  / DEFAULT_L2_REFCOUNT_SIZE_RATIO;
 784         } else if (!l2_cache_size_set) {
 785             *l2_cache_size = *refcount_cache_size
 786                            * DEFAULT_L2_REFCOUNT_SIZE_RATIO;
 787         } else if (!refcount_cache_size_set) {
 788             *refcount_cache_size = *l2_cache_size
 789                                  / DEFAULT_L2_REFCOUNT_SIZE_RATIO;
 790         }
 791     }
 792 }
 793
 794 typedef struct Qcow2ReopenState {
 795     Qcow2Cache *l2_table_cache;
 796     Qcow2Cache *refcount_block_cache;
 797     bool use_lazy_refcounts;
 798     int overlap_check;
 799     bool discard_passthrough[QCOW2_DISCARD_MAX];
 800     uint64_t cache_clean_interval;
 801     QCryptoBlockOpenOptions *crypto_opts; /* Disk encryption runtime options */
 802 } Qcow2ReopenState;
 803
 804 static int qcow2_update_options_prepare(BlockDriverState *bs,
 805                                         Qcow2ReopenState *r,
 806                                         QDict *options, int flags,
 807                                         Error **errp)
 808 {
 809     BDRVQcow2State *s = bs->opaque;
 810     QemuOpts *opts = NULL;
 811     const char *opt_overlap_check, *opt_overlap_check_template;
 812     int overlap_check_template = 0;
 813     uint64_t l2_cache_size, refcount_cache_size;
 814     int i;
 815     const char *encryptfmt;
 816     QDict *encryptopts = NULL;
 817     Error *local_err = NULL;
 818     int ret;
 819
 820     qdict_extract_subqdict(options, &encryptopts, "encrypt.");
 821     encryptfmt = qdict_get_try_str(encryptopts, "format");
 822
 823     opts = qemu_opts_create(&qcow2_runtime_opts, NULL, 0, &error_abort);
 824     qemu_opts_absorb_qdict(opts, options, &local_err);
 825     if (local_err) {
 826         error_propagate(errp, local_err);
 827         ret = -EINVAL;
 828         goto fail;
 829     }
 830
 831     /* get L2 table/refcount block cache size from command line options */
 832     read_cache_sizes(bs, opts, &l2_cache_size, &refcount_cache_size,
 833                      &local_err);
 834     if (local_err) {
 835         error_propagate(errp, local_err);
 836         ret = -EINVAL;
 837         goto fail;
 838     }
 839
 840     l2_cache_size /= s->cluster_size;
 841     if (l2_cache_size < MIN_L2_CACHE_SIZE) {
 842         l2_cache_size = MIN_L2_CACHE_SIZE;
 843     }
 844     if (l2_cache_size > INT_MAX) {
 845         error_setg(errp, "L2 cache size too big");
 846         ret = -EINVAL;
 847         goto fail;
 848     }
 849
 850     refcount_cache_size /= s->cluster_size;
 851     if (refcount_cache_size < MIN_REFCOUNT_CACHE_SIZE) {
 852         refcount_cache_size = MIN_REFCOUNT_CACHE_SIZE;
 853     }
 854     if (refcount_cache_size > INT_MAX) {
 855         error_setg(errp, "Refcount cache size too big");
 856         ret = -EINVAL;
 857         goto fail;
 858     }
 859
 860     /* alloc new L2 table/refcount block cache, flush old one */
 861     if (s->l2_table_cache) {
 862         ret = qcow2_cache_flush(bs, s->l2_table_cache);
 863         if (ret) {
 864             error_setg_errno(errp, -ret, "Failed to flush the L2 table cache");
 865             goto fail;
 866         }
 867     }
 868
 869     if (s->refcount_block_cache) {
 870         ret = qcow2_cache_flush(bs, s->refcount_block_cache);
 871         if (ret) {
 872             error_setg_errno(errp, -ret,
 873                              "Failed to flush the refcount block cache");
 874             goto fail;
 875         }
 876     }
 877
 878     r->l2_table_cache = qcow2_cache_create(bs, l2_cache_size);
 879     r->refcount_block_cache = qcow2_cache_create(bs, refcount_cache_size);
 880     if (r->l2_table_cache == NULL || r->refcount_block_cache == NULL) {
 881         error_setg(errp, "Could not allocate metadata caches");
 882         ret = -ENOMEM;
 883         goto fail;
 884     }
 885
 886     /* New interval for cache cleanup timer */
 887     r->cache_clean_interval =
 888         qemu_opt_get_number(opts, QCOW2_OPT_CACHE_CLEAN_INTERVAL,
 889                             s->cache_clean_interval);
 890 #ifndef CONFIG_LINUX
 891     if (r->cache_clean_interval != 0) {
 892         error_setg(errp, QCOW2_OPT_CACHE_CLEAN_INTERVAL
 893                    " not supported on this host");
 894         ret = -EINVAL;
 895         goto fail;
 896     }
 897 #endif
 898     if (r->cache_clean_interval > UINT_MAX) {
 899         error_setg(errp, "Cache clean interval too big");
 900         ret = -EINVAL;
 901         goto fail;
 902     }
 903
 904     /* lazy-refcounts; flush if going from enabled to disabled */
 905     r->use_lazy_refcounts = qemu_opt_get_bool(opts, QCOW2_OPT_LAZY_REFCOUNTS,
 906         (s->compatible_features & QCOW2_COMPAT_LAZY_REFCOUNTS));
 907     if (r->use_lazy_refcounts && s->qcow_version < 3) {
 908         error_setg(errp, "Lazy refcounts require a qcow2 image with at least "
 909                    "qemu 1.1 compatibility level");
 910         ret = -EINVAL;
 911         goto fail;
 912     }
 913
 914     if (s->use_lazy_refcounts && !r->use_lazy_refcounts) {
 915         ret = qcow2_mark_clean(bs);
 916         if (ret < 0) {
 917             error_setg_errno(errp, -ret, "Failed to disable lazy refcounts");
 918             goto fail;
 919         }
 920     }
 921
 922     /* Overlap check options */
 923     opt_overlap_check = qemu_opt_get(opts, QCOW2_OPT_OVERLAP);
 924     opt_overlap_check_template = qemu_opt_get(opts, QCOW2_OPT_OVERLAP_TEMPLATE);
 925     if (opt_overlap_check_template && opt_overlap_check &&
 926         strcmp(opt_overlap_check_template, opt_overlap_check))
 927     {
 928         error_setg(errp, "Conflicting values for qcow2 options '"
 929                    QCOW2_OPT_OVERLAP "' ('%s') and '" QCOW2_OPT_OVERLAP_TEMPLATE
 930                    "' ('%s')", opt_overlap_check, opt_overlap_check_template);
 931         ret = -EINVAL;
 932         goto fail;
 933     }
 934     if (!opt_overlap_check) {
 935         opt_overlap_check = opt_overlap_check_template ?: "cached";
 936     }
 937
 938     if (!strcmp(opt_overlap_check, "none")) {
 939         overlap_check_template = 0;
 940     } else if (!strcmp(opt_overlap_check, "constant")) {
 941         overlap_check_template = QCOW2_OL_CONSTANT;
 942     } else if (!strcmp(opt_overlap_check, "cached")) {
 943         overlap_check_template = QCOW2_OL_CACHED;
 944     } else if (!strcmp(opt_overlap_check, "all")) {
 945         overlap_check_template = QCOW2_OL_ALL;
 946     } else {
 947         error_setg(errp, "Unsupported value '%s' for qcow2 option "
 948                    "'overlap-check'. Allowed are any of the following: "
 949                    "none, constant, cached, all", opt_overlap_check);
 950         ret = -EINVAL;
 951         goto fail;
 952     }
 953
 954     r->overlap_check = 0;
 955     for (i = 0; i < QCOW2_OL_MAX_BITNR; i++) {
 956         /* overlap-check defines a template bitmask, but every flag may be
 957          * overwritten through the associated boolean option */
 958         r->overlap_check |=
 959             qemu_opt_get_bool(opts, overlap_bool_option_names[i],
 960                               overlap_check_template & (1 << i)) << i;
 961     }
 962
 963     r->discard_passthrough[QCOW2_DISCARD_NEVER] = false;
 964     r->discard_passthrough[QCOW2_DISCARD_ALWAYS] = true;
 965     r->discard_passthrough[QCOW2_DISCARD_REQUEST] =
 966         qemu_opt_get_bool(opts, QCOW2_OPT_DISCARD_REQUEST,
 967                           flags & BDRV_O_UNMAP);
 968     r->discard_passthrough[QCOW2_DISCARD_SNAPSHOT] =
 969         qemu_opt_get_bool(opts, QCOW2_OPT_DISCARD_SNAPSHOT, true);
 970     r->discard_passthrough[QCOW2_DISCARD_OTHER] =
 971         qemu_opt_get_bool(opts, QCOW2_OPT_DISCARD_OTHER, false);
 972
 973     switch (s->crypt_method_header) {
 974     case QCOW_CRYPT_NONE:
 975         if (encryptfmt) {
 976             error_setg(errp, "No encryption in image header, but options "
 977                        "specified format '%s'", encryptfmt);
 978             ret = -EINVAL;
 979             goto fail;
 980         }
 981         break;
 982
 983     case QCOW_CRYPT_AES:
 984         if (encryptfmt && !g_str_equal(encryptfmt, "aes")) {
 985             error_setg(errp,
 986                        "Header reported 'aes' encryption format but "
 987                        "options specify '%s'", encryptfmt);
 988             ret = -EINVAL;
 989             goto fail;
 990         }
 991         qdict_del(encryptopts, "format");
 992         r->crypto_opts = block_crypto_open_opts_init(
 993             Q_CRYPTO_BLOCK_FORMAT_QCOW, encryptopts, errp);
 994         break;
 995
 996     case QCOW_CRYPT_LUKS:
 997         if (encryptfmt && !g_str_equal(encryptfmt, "luks")) {
 998             error_setg(errp,
 999                        "Header reported 'luks' encryption format but "
1000                        "options specify '%s'", encryptfmt);
1001             ret = -EINVAL;
1002             goto fail;
1003         }
1004         qdict_del(encryptopts, "format");
1005         r->crypto_opts = block_crypto_open_opts_init(
1006             Q_CRYPTO_BLOCK_FORMAT_LUKS, encryptopts, errp);
1007         break;
1008
1009     default:
1010         error_setg(errp, "Unsupported encryption method %d",
1011                    s->crypt_method_header);
1012         break;
1013     }
1014     if (s->crypt_method_header != QCOW_CRYPT_NONE && !r->crypto_opts) {
1015         ret = -EINVAL;
1016         goto fail;
1017     }
1018
1019     ret = 0;
1020 fail:
1021     QDECREF(encryptopts);
1022     qemu_opts_del(opts);
1023     opts = NULL;
1024     return ret;
1025 }
1026
1027 static void qcow2_update_options_commit(BlockDriverState *bs,
1028                                         Qcow2ReopenState *r)
1029 {
1030     BDRVQcow2State *s = bs->opaque;
1031     int i;
1032
1033     if (s->l2_table_cache) {
1034         qcow2_cache_destroy(bs, s->l2_table_cache);
1035     }
1036     if (s->refcount_block_cache) {
1037         qcow2_cache_destroy(bs, s->refcount_block_cache);
1038     }
1039     s->l2_table_cache = r->l2_table_cache;
1040     s->refcount_block_cache = r->refcount_block_cache;
1041
1042     s->overlap_check = r->overlap_check;
1043     s->use_lazy_refcounts = r->use_lazy_refcounts;
1044
1045     for (i = 0; i < QCOW2_DISCARD_MAX; i++) {
1046         s->discard_passthrough[i] = r->discard_passthrough[i];
1047     }
1048
1049     if (s->cache_clean_interval != r->cache_clean_interval) {
1050         cache_clean_timer_del(bs);
1051         s->cache_clean_interval = r->cache_clean_interval;
1052         cache_clean_timer_init(bs, bdrv_get_aio_context(bs));
1053     }
1054
1055     qapi_free_QCryptoBlockOpenOptions(s->crypto_opts);
1056     s->crypto_opts = r->crypto_opts;
1057 }
1058
1059 static void qcow2_update_options_abort(BlockDriverState *bs,
1060                                        Qcow2ReopenState *r)
1061 {
1062     if (r->l2_table_cache) {
1063         qcow2_cache_destroy(bs, r->l2_table_cache);
1064     }
1065     if (r->refcount_block_cache) {
1066         qcow2_cache_destroy(bs, r->refcount_block_cache);
1067     }
1068     qapi_free_QCryptoBlockOpenOptions(r->crypto_opts);
1069 }
1070
1071 static int qcow2_update_options(BlockDriverState *bs, QDict *options,
1072                                 int flags, Error **errp)
1073 {
1074     Qcow2ReopenState r = {};
1075     int ret;
1076
1077     ret = qcow2_update_options_prepare(bs, &r, options, flags, errp);
1078     if (ret >= 0) {
1079         qcow2_update_options_commit(bs, &r);
1080     } else {
1081         qcow2_update_options_abort(bs, &r);
1082     }
1083
1084     return ret;
1085 }
1086
1087 static int qcow2_do_open(BlockDriverState *bs, QDict *options, int flags,
1088                          Error **errp)
1089 {
1090     BDRVQcow2State *s = bs->opaque;
1091     unsigned int len, i;
1092     int ret = 0;
1093     QCowHeader header;
1094     Error *local_err = NULL;
1095     uint64_t ext_end;
1096     uint64_t l1_vm_state_index;
1097     bool update_header = false;
1098
1099     ret = bdrv_pread(bs->file, 0, &header, sizeof(header));
1100     if (ret < 0) {
1101         error_setg_errno(errp, -ret, "Could not read qcow2 header");
1102         goto fail;
1103     }
1104     be32_to_cpus(&header.magic);
1105     be32_to_cpus(&header.version);
1106     be64_to_cpus(&header.backing_file_offset);
1107     be32_to_cpus(&header.backing_file_size);
1108     be64_to_cpus(&header.size);
1109     be32_to_cpus(&header.cluster_bits);
1110     be32_to_cpus(&header.crypt_method);
1111     be64_to_cpus(&header.l1_table_offset);
1112     be32_to_cpus(&header.l1_size);
1113     be64_to_cpus(&header.refcount_table_offset);
1114     be32_to_cpus(&header.refcount_table_clusters);
1115     be64_to_cpus(&header.snapshots_offset);
1116     be32_to_cpus(&header.nb_snapshots);
1117
1118     if (header.magic != QCOW_MAGIC) {
1119         error_setg(errp, "Image is not in qcow2 format");
1120         ret = -EINVAL;
1121         goto fail;
1122     }
1123     if (header.version < 2 || header.version > 3) {
1124         error_setg(errp, "Unsupported qcow2 version %" PRIu32, header.version);
1125         ret = -ENOTSUP;
1126         goto fail;
1127     }
1128
1129     s->qcow_version = header.version;
1130
1131     /* Initialise cluster size */
1132     if (header.cluster_bits < MIN_CLUSTER_BITS ||
1133         header.cluster_bits > MAX_CLUSTER_BITS) {
1134         error_setg(errp, "Unsupported cluster size: 2^%" PRIu32,
1135                    header.cluster_bits);
1136         ret = -EINVAL;
1137         goto fail;
1138     }
1139
1140     s->cluster_bits = header.cluster_bits;
1141     s->cluster_size = 1 << s->cluster_bits;
1142     s->cluster_sectors = 1 << (s->cluster_bits - 9);
1143
1144     /* Initialise version 3 header fields */
1145     if (header.version == 2) {
1146         header.incompatible_features    = 0;
1147         header.compatible_features      = 0;
1148         header.autoclear_features       = 0;
1149         header.refcount_order           = 4;
1150         header.header_length            = 72;
1151     } else {
1152         be64_to_cpus(&header.incompatible_features);
1153         be64_to_cpus(&header.compatible_features);
1154         be64_to_cpus(&header.autoclear_features);
1155         be32_to_cpus(&header.refcount_order);
1156         be32_to_cpus(&header.header_length);
1157
1158         if (header.header_length < 104) {
1159             error_setg(errp, "qcow2 header too short");
1160             ret = -EINVAL;
1161             goto fail;
1162         }
1163     }
1164
1165     if (header.header_length > s->cluster_size) {
1166         error_setg(errp, "qcow2 header exceeds cluster size");
1167         ret = -EINVAL;
1168         goto fail;
1169     }
1170
1171     if (header.header_length > sizeof(header)) {
1172         s->unknown_header_fields_size = header.header_length - sizeof(header);
1173         s->unknown_header_fields = g_malloc(s->unknown_header_fields_size);
1174         ret = bdrv_pread(bs->file, sizeof(header), s->unknown_header_fields,
1175                          s->unknown_header_fields_size);
1176         if (ret < 0) {
1177             error_setg_errno(errp, -ret, "Could not read unknown qcow2 header "
1178                              "fields");
1179             goto fail;
1180         }
1181     }
1182
1183     if (header.backing_file_offset > s->cluster_size) {
1184         error_setg(errp, "Invalid backing file offset");
1185         ret = -EINVAL;
1186         goto fail;
1187     }
1188
1189     if (header.backing_file_offset) {
1190         ext_end = header.backing_file_offset;
1191     } else {
1192         ext_end = 1 << header.cluster_bits;
1193     }
1194
1195     /* Handle feature bits */
1196     s->incompatible_features    = header.incompatible_features;
1197     s->compatible_features      = header.compatible_features;
1198     s->autoclear_features       = header.autoclear_features;
1199
1200     if (s->incompatible_features & ~QCOW2_INCOMPAT_MASK) {
1201         void *feature_table = NULL;
1202         qcow2_read_extensions(bs, header.header_length, ext_end,
1203                               &feature_table, flags, NULL, NULL);
1204         report_unsupported_feature(errp, feature_table,
1205                                    s->incompatible_features &
1206                                    ~QCOW2_INCOMPAT_MASK);
1207         ret = -ENOTSUP;
1208         g_free(feature_table);
1209         goto fail;
1210     }
1211
1212     if (s->incompatible_features & QCOW2_INCOMPAT_CORRUPT) {
1213         /* Corrupt images may not be written to unless they are being repaired
1214          */
1215         if ((flags & BDRV_O_RDWR) && !(flags & BDRV_O_CHECK)) {
1216             error_setg(errp, "qcow2: Image is corrupt; cannot be opened "
1217                        "read/write");
1218             ret = -EACCES;
1219             goto fail;
1220         }
1221     }
1222
1223     /* Check support for various header values */
1224     if (header.refcount_order > 6) {
1225         error_setg(errp, "Reference count entry width too large; may not "
1226                    "exceed 64 bits");
1227         ret = -EINVAL;
1228         goto fail;
1229     }
1230     s->refcount_order = header.refcount_order;
1231     s->refcount_bits = 1 << s->refcount_order;
1232     s->refcount_max = UINT64_C(1) << (s->refcount_bits - 1);
1233     s->refcount_max += s->refcount_max - 1;
1234
1235     s->crypt_method_header = header.crypt_method;
1236     if (s->crypt_method_header) {
1237         if (bdrv_uses_whitelist() &&
1238             s->crypt_method_header == QCOW_CRYPT_AES) {
1239             error_setg(errp,
1240                        "Use of AES-CBC encrypted qcow2 images is no longer "
1241                        "supported in system emulators");
1242             error_append_hint(errp,
1243                               "You can use 'qemu-img convert' to convert your "
1244                               "image to an alternative supported format, such "
1245                               "as unencrypted qcow2, or raw with the LUKS "
1246                               "format instead.\n");
1247             ret = -ENOSYS;
1248             goto fail;
1249         }
1250
1251         if (s->crypt_method_header == QCOW_CRYPT_AES) {
1252             s->crypt_physical_offset = false;
1253         } else {
1254             /* Assuming LUKS and any future crypt methods we
1255              * add will all use physical offsets, due to the
1256              * fact that the alternative is insecure...  */
1257             s->crypt_physical_offset = true;
1258         }
1259
1260         bs->encrypted = true;
1261     }
1262
1263     s->l2_bits = s->cluster_bits - 3; /* L2 is always one cluster */
1264     s->l2_size = 1 << s->l2_bits;
1265     /* 2^(s->refcount_order - 3) is the refcount width in bytes */
1266     s->refcount_block_bits = s->cluster_bits - (s->refcount_order - 3);
1267     s->refcount_block_size = 1 << s->refcount_block_bits;
1268     bs->total_sectors = header.size / 512;
1269     s->csize_shift = (62 - (s->cluster_bits - 8));
1270     s->csize_mask = (1 << (s->cluster_bits - 8)) - 1;
1271     s->cluster_offset_mask = (1LL << s->csize_shift) - 1;
1272
1273     s->refcount_table_offset = header.refcount_table_offset;
1274     s->refcount_table_size =
1275         header.refcount_table_clusters << (s->cluster_bits - 3);
1276
1277     if (header.refcount_table_clusters > qcow2_max_refcount_clusters(s)) {
1278         error_setg(errp, "Reference count table too large");
1279         ret = -EINVAL;
1280         goto fail;
1281     }
1282
1283     ret = validate_table_offset(bs, s->refcount_table_offset,
1284                                 s->refcount_table_size, sizeof(uint64_t));
1285     if (ret < 0) {
1286         error_setg(errp, "Invalid reference count table offset");
1287         goto fail;
1288     }
1289
1290     /* Snapshot table offset/length */
1291     if (header.nb_snapshots > QCOW_MAX_SNAPSHOTS) {
1292         error_setg(errp, "Too many snapshots");
1293         ret = -EINVAL;
1294         goto fail;
1295     }
1296
1297     ret = validate_table_offset(bs, header.snapshots_offset,
1298                                 header.nb_snapshots,
1299                                 sizeof(QCowSnapshotHeader));
1300     if (ret < 0) {
1301         error_setg(errp, "Invalid snapshot table offset");
1302         goto fail;
1303     }
1304
1305     /* read the level 1 table */
1306     if (header.l1_size > QCOW_MAX_L1_SIZE / sizeof(uint64_t)) {
1307         error_setg(errp, "Active L1 table too large");
1308         ret = -EFBIG;
1309         goto fail;
1310     }
1311     s->l1_size = header.l1_size;
1312
1313     l1_vm_state_index = size_to_l1(s, header.size);
1314     if (l1_vm_state_index > INT_MAX) {
1315         error_setg(errp, "Image is too big");
1316         ret = -EFBIG;
1317         goto fail;
1318     }
1319     s->l1_vm_state_index = l1_vm_state_index;
1320
1321     /* the L1 table must contain at least enough entries to put
1322        header.size bytes */
1323     if (s->l1_size < s->l1_vm_state_index) {
1324         error_setg(errp, "L1 table is too small");
1325         ret = -EINVAL;
1326         goto fail;
1327     }
1328
1329     ret = validate_table_offset(bs, header.l1_table_offset,
1330                                 header.l1_size, sizeof(uint64_t));
1331     if (ret < 0) {
1332         error_setg(errp, "Invalid L1 table offset");
1333         goto fail;
1334     }
1335     s->l1_table_offset = header.l1_table_offset;
1336
1337
1338     if (s->l1_size > 0) {
1339         s->l1_table = qemu_try_blockalign(bs->file->bs,
1340             align_offset(s->l1_size * sizeof(uint64_t), 512));
1341         if (s->l1_table == NULL) {
1342             error_setg(errp, "Could not allocate L1 table");
1343             ret = -ENOMEM;
1344             goto fail;
1345         }
1346         ret = bdrv_pread(bs->file, s->l1_table_offset, s->l1_table,
1347                          s->l1_size * sizeof(uint64_t));
1348         if (ret < 0) {
1349             error_setg_errno(errp, -ret, "Could not read L1 table");
1350             goto fail;
1351         }
1352         for(i = 0;i < s->l1_size; i++) {
1353             be64_to_cpus(&s->l1_table[i]);
1354         }
1355     }
1356
1357     /* Parse driver-specific options */
1358     ret = qcow2_update_options(bs, options, flags, errp);
1359     if (ret < 0) {
1360         goto fail;
1361     }
1362
1363     s->cluster_cache = g_malloc(s->cluster_size);
1364     /* one more sector for decompressed data alignment */
1365     s->cluster_data = qemu_try_blockalign(bs->file->bs, QCOW_MAX_CRYPT_CLUSTERS
1366                                                     * s->cluster_size + 512);
1367     if (s->cluster_data == NULL) {
1368         error_setg(errp, "Could not allocate temporary cluster buffer");
1369         ret = -ENOMEM;
1370         goto fail;
1371     }
1372
1373     s->cluster_cache_offset = -1;
1374     s->flags = flags;
1375
1376     ret = qcow2_refcount_init(bs);
1377     if (ret != 0) {
1378         error_setg_errno(errp, -ret, "Could not initialize refcount handling");
1379         goto fail;
1380     }
1381
1382     QLIST_INIT(&s->cluster_allocs);
1383     QTAILQ_INIT(&s->discards);
1384
1385     /* read qcow2 extensions */
1386     if (qcow2_read_extensions(bs, header.header_length, ext_end, NULL,
1387                               flags, &update_header, &local_err)) {
1388         error_propagate(errp, local_err);
1389         ret = -EINVAL;
1390         goto fail;
1391     }
1392
1393     /* qcow2_read_extension may have set up the crypto context
1394      * if the crypt method needs a header region, some methods
1395      * don't need header extensions, so must check here
1396      */
1397     if (s->crypt_method_header && !s->crypto) {
1398         if (s->crypt_method_header == QCOW_CRYPT_AES) {
1399             unsigned int cflags = 0;
1400             if (flags & BDRV_O_NO_IO) {
1401                 cflags |= QCRYPTO_BLOCK_OPEN_NO_IO;
1402             }
1403             s->crypto = qcrypto_block_open(s->crypto_opts, "encrypt.",
1404                                            NULL, NULL, cflags, errp);
1405             if (!s->crypto) {
1406                 ret = -EINVAL;
1407                 goto fail;
1408             }
1409         } else if (!(flags & BDRV_O_NO_IO)) {
1410             error_setg(errp, "Missing CRYPTO header for crypt method %d",
1411                        s->crypt_method_header);
1412             ret = -EINVAL;
1413             goto fail;
1414         }
1415     }
1416
1417     /* read the backing file name */
1418     if (header.backing_file_offset != 0) {
1419         len = header.backing_file_size;
1420         if (len > MIN(1023, s->cluster_size - header.backing_file_offset) ||
1421             len >= sizeof(bs->backing_file)) {
1422             error_setg(errp, "Backing file name too long");
1423             ret = -EINVAL;
1424             goto fail;
1425         }
1426         ret = bdrv_pread(bs->file, header.backing_file_offset,
1427                          bs->backing_file, len);
1428         if (ret < 0) {
1429             error_setg_errno(errp, -ret, "Could not read backing file name");
1430             goto fail;
1431         }
1432         bs->backing_file[len] = '\0';
1433         s->image_backing_file = g_strdup(bs->backing_file);
1434     }
1435
1436     /* Internal snapshots */
1437     s->snapshots_offset = header.snapshots_offset;
1438     s->nb_snapshots = header.nb_snapshots;
1439
1440     ret = qcow2_read_snapshots(bs);
1441     if (ret < 0) {
1442         error_setg_errno(errp, -ret, "Could not read snapshots");
1443         goto fail;
1444     }
1445
1446     /* Clear unknown autoclear feature bits */
1447     update_header |= s->autoclear_features & ~QCOW2_AUTOCLEAR_MASK;
1448     update_header =
1449         update_header && !bs->read_only && !(flags & BDRV_O_INACTIVE);
1450     if (update_header) {
1451         s->autoclear_features &= QCOW2_AUTOCLEAR_MASK;
1452     }
1453
1454     if (qcow2_load_autoloading_dirty_bitmaps(bs, &local_err)) {
1455         update_header = false;
1456     }
1457     if (local_err != NULL) {
1458         error_propagate(errp, local_err);
1459         ret = -EINVAL;
1460         goto fail;
1461     }
1462
1463     if (update_header) {
1464         ret = qcow2_update_header(bs);
1465         if (ret < 0) {
1466             error_setg_errno(errp, -ret, "Could not update qcow2 header");
1467             goto fail;
1468         }
1469     }
1470
1471     /* Initialise locks */
1472     qemu_co_mutex_init(&s->lock);
1473     bs->supported_zero_flags = BDRV_REQ_MAY_UNMAP;
1474
1475     /* Repair image if dirty */
1476     if (!(flags & (BDRV_O_CHECK | BDRV_O_INACTIVE)) && !bs->read_only &&
1477         (s->incompatible_features & QCOW2_INCOMPAT_DIRTY)) {
1478         BdrvCheckResult result = {0};
1479
1480         ret = qcow2_check(bs, &result, BDRV_FIX_ERRORS | BDRV_FIX_LEAKS);
1481         if (ret < 0) {
1482             error_setg_errno(errp, -ret, "Could not repair dirty image");
1483             goto fail;
1484         }
1485     }
1486
1487 #ifdef DEBUG_ALLOC
1488     {
1489         BdrvCheckResult result = {0};
1490         qcow2_check_refcounts(bs, &result, 0);
1491     }
1492 #endif
1493     return ret;
1494
1495  fail:
1496     g_free(s->unknown_header_fields);
1497     cleanup_unknown_header_ext(bs);
1498     qcow2_free_snapshots(bs);
1499     qcow2_refcount_close(bs);
1500     qemu_vfree(s->l1_table);
1501     /* else pre-write overlap checks in cache_destroy may crash */
1502     s->l1_table = NULL;
1503     cache_clean_timer_del(bs);
1504     if (s->l2_table_cache) {
1505         qcow2_cache_destroy(bs, s->l2_table_cache);
1506     }
1507     if (s->refcount_block_cache) {
1508         qcow2_cache_destroy(bs, s->refcount_block_cache);
1509     }
1510     g_free(s->cluster_cache);
1511     qemu_vfree(s->cluster_data);
1512     qcrypto_block_free(s->crypto);
1513     qapi_free_QCryptoBlockOpenOptions(s->crypto_opts);
1514     return ret;
1515 }
1516
1517 static int qcow2_open(BlockDriverState *bs, QDict *options, int flags,
1518                       Error **errp)
1519 {
1520     bs->file = bdrv_open_child(NULL, options, "file", bs, &child_file,
1521                                false, errp);
1522     if (!bs->file) {
1523         return -EINVAL;
1524     }
1525
1526     return qcow2_do_open(bs, options, flags, errp);
1527 }
1528
1529 static void qcow2_refresh_limits(BlockDriverState *bs, Error **errp)
1530 {
1531     BDRVQcow2State *s = bs->opaque;
1532
1533     if (bs->encrypted) {
1534         /* Encryption works on a sector granularity */
1535         bs->bl.request_alignment = BDRV_SECTOR_SIZE;
1536     }
1537     bs->bl.pwrite_zeroes_alignment = s->cluster_size;
1538     bs->bl.pdiscard_alignment = s->cluster_size;
1539 }
1540
1541 static int qcow2_reopen_prepare(BDRVReopenState *state,
1542                                 BlockReopenQueue *queue, Error **errp)
1543 {
1544     Qcow2ReopenState *r;
1545     int ret;
1546
1547     r = g_new0(Qcow2ReopenState, 1);
1548     state->opaque = r;
1549
1550     ret = qcow2_update_options_prepare(state->bs, r, state->options,
1551                                        state->flags, errp);
1552     if (ret < 0) {
1553         goto fail;
1554     }
1555
1556     /* We need to write out any unwritten data if we reopen read-only. */
1557     if ((state->flags & BDRV_O_RDWR) == 0) {
1558         ret = qcow2_reopen_bitmaps_ro(state->bs, errp);
1559         if (ret < 0) {
1560             goto fail;
1561         }
1562
1563         ret = bdrv_flush(state->bs);
1564         if (ret < 0) {
1565             goto fail;
1566         }
1567
1568         ret = qcow2_mark_clean(state->bs);
1569         if (ret < 0) {
1570             goto fail;
1571         }
1572     }
1573
1574     return 0;
1575
1576 fail:
1577     qcow2_update_options_abort(state->bs, r);
1578     g_free(r);
1579     return ret;
1580 }
1581
1582 static void qcow2_reopen_commit(BDRVReopenState *state)
1583 {
1584     qcow2_update_options_commit(state->bs, state->opaque);
1585     g_free(state->opaque);
1586 }
1587
1588 static void qcow2_reopen_abort(BDRVReopenState *state)
1589 {
1590     qcow2_update_options_abort(state->bs, state->opaque);
1591     g_free(state->opaque);
1592 }
1593
1594 static void qcow2_join_options(QDict *options, QDict *old_options)
1595 {
1596     bool has_new_overlap_template =
1597         qdict_haskey(options, QCOW2_OPT_OVERLAP) ||
1598         qdict_haskey(options, QCOW2_OPT_OVERLAP_TEMPLATE);
1599     bool has_new_total_cache_size =
1600         qdict_haskey(options, QCOW2_OPT_CACHE_SIZE);
1601     bool has_all_cache_options;
1602
1603     /* New overlap template overrides all old overlap options */
1604     if (has_new_overlap_template) {
1605         qdict_del(old_options, QCOW2_OPT_OVERLAP);
1606         qdict_del(old_options, QCOW2_OPT_OVERLAP_TEMPLATE);
1607         qdict_del(old_options, QCOW2_OPT_OVERLAP_MAIN_HEADER);
1608         qdict_del(old_options, QCOW2_OPT_OVERLAP_ACTIVE_L1);
1609         qdict_del(old_options, QCOW2_OPT_OVERLAP_ACTIVE_L2);
1610         qdict_del(old_options, QCOW2_OPT_OVERLAP_REFCOUNT_TABLE);
1611         qdict_del(old_options, QCOW2_OPT_OVERLAP_REFCOUNT_BLOCK);
1612         qdict_del(old_options, QCOW2_OPT_OVERLAP_SNAPSHOT_TABLE);
1613         qdict_del(old_options, QCOW2_OPT_OVERLAP_INACTIVE_L1);
1614         qdict_del(old_options, QCOW2_OPT_OVERLAP_INACTIVE_L2);
1615     }
1616
1617     /* New total cache size overrides all old options */
1618     if (qdict_haskey(options, QCOW2_OPT_CACHE_SIZE)) {
1619         qdict_del(old_options, QCOW2_OPT_L2_CACHE_SIZE);
1620         qdict_del(old_options, QCOW2_OPT_REFCOUNT_CACHE_SIZE);
1621     }
1622
1623     qdict_join(options, old_options, false);
1624
1625     /*
1626      * If after merging all cache size options are set, an old total size is
1627      * overwritten. Do keep all options, however, if all three are new. The
1628      * resulting error message is what we want to happen.
1629      */
1630     has_all_cache_options =
1631         qdict_haskey(options, QCOW2_OPT_CACHE_SIZE) ||
1632         qdict_haskey(options, QCOW2_OPT_L2_CACHE_SIZE) ||
1633         qdict_haskey(options, QCOW2_OPT_REFCOUNT_CACHE_SIZE);
1634
1635     if (has_all_cache_options && !has_new_total_cache_size) {
1636         qdict_del(options, QCOW2_OPT_CACHE_SIZE);
1637     }
1638 }
1639
1640 static int64_t coroutine_fn qcow2_co_get_block_status(BlockDriverState *bs,
1641         int64_t sector_num, int nb_sectors, int *pnum, BlockDriverState **file)
1642 {
1643     BDRVQcow2State *s = bs->opaque;
1644     uint64_t cluster_offset;
1645     int index_in_cluster, ret;
1646     unsigned int bytes;
1647     int64_t status = 0;
1648
1649     bytes = MIN(INT_MAX, nb_sectors * BDRV_SECTOR_SIZE);
1650     qemu_co_mutex_lock(&s->lock);
1651     ret = qcow2_get_cluster_offset(bs, sector_num << 9, &bytes,
1652                                    &cluster_offset);
1653     qemu_co_mutex_unlock(&s->lock);
1654     if (ret < 0) {
1655         return ret;
1656     }
1657
1658     *pnum = bytes >> BDRV_SECTOR_BITS;
1659
1660     if (cluster_offset != 0 && ret != QCOW2_CLUSTER_COMPRESSED &&
1661         !s->crypto) {
1662         index_in_cluster = sector_num & (s->cluster_sectors - 1);
1663         cluster_offset |= (index_in_cluster << BDRV_SECTOR_BITS);
1664         *file = bs->file->bs;
1665         status |= BDRV_BLOCK_OFFSET_VALID | cluster_offset;
1666     }
1667     if (ret == QCOW2_CLUSTER_ZERO_PLAIN || ret == QCOW2_CLUSTER_ZERO_ALLOC) {
1668         status |= BDRV_BLOCK_ZERO;
1669     } else if (ret != QCOW2_CLUSTER_UNALLOCATED) {
1670         status |= BDRV_BLOCK_DATA;
1671     }
1672     return status;
1673 }
1674
1675 /* handle reading after the end of the backing file */
1676 int qcow2_backing_read1(BlockDriverState *bs, QEMUIOVector *qiov,
1677                         int64_t offset, int bytes)
1678 {
1679     uint64_t bs_size = bs->total_sectors * BDRV_SECTOR_SIZE;
1680     int n1;
1681
1682     if ((offset + bytes) <= bs_size) {
1683         return bytes;
1684     }
1685
1686     if (offset >= bs_size) {
1687         n1 = 0;
1688     } else {
1689         n1 = bs_size - offset;
1690     }
1691
1692     qemu_iovec_memset(qiov, n1, 0, bytes - n1);
1693
1694     return n1;
1695 }
1696
1697 static coroutine_fn int qcow2_co_preadv(BlockDriverState *bs, uint64_t offset,
1698                                         uint64_t bytes, QEMUIOVector *qiov,
1699                                         int flags)
1700 {
1701     BDRVQcow2State *s = bs->opaque;
1702     int offset_in_cluster, n1;
1703     int ret;
1704     unsigned int cur_bytes; /* number of bytes in current iteration */
1705     uint64_t cluster_offset = 0;
1706     uint64_t bytes_done = 0;
1707     QEMUIOVector hd_qiov;
1708     uint8_t *cluster_data = NULL;
1709
1710     qemu_iovec_init(&hd_qiov, qiov->niov);
1711
1712     qemu_co_mutex_lock(&s->lock);
1713
1714     while (bytes != 0) {
1715
1716         /* prepare next request */
1717         cur_bytes = MIN(bytes, INT_MAX);
1718         if (s->crypto) {
1719             cur_bytes = MIN(cur_bytes,
1720                             QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size);
1721         }
1722
1723         ret = qcow2_get_cluster_offset(bs, offset, &cur_bytes, &cluster_offset);
1724         if (ret < 0) {
1725             goto fail;
1726         }
1727
1728         offset_in_cluster = offset_into_cluster(s, offset);
1729
1730         qemu_iovec_reset(&hd_qiov);
1731         qemu_iovec_concat(&hd_qiov, qiov, bytes_done, cur_bytes);
1732
1733         switch (ret) {
1734         case QCOW2_CLUSTER_UNALLOCATED:
1735
1736             if (bs->backing) {
1737                 /* read from the base image */
1738                 n1 = qcow2_backing_read1(bs->backing->bs, &hd_qiov,
1739                                          offset, cur_bytes);
1740                 if (n1 > 0) {
1741                     QEMUIOVector local_qiov;
1742
1743                     qemu_iovec_init(&local_qiov, hd_qiov.niov);
1744                     qemu_iovec_concat(&local_qiov, &hd_qiov, 0, n1);
1745
1746                     BLKDBG_EVENT(bs->file, BLKDBG_READ_BACKING_AIO);
1747                     qemu_co_mutex_unlock(&s->lock);
1748                     ret = bdrv_co_preadv(bs->backing, offset, n1,
1749                                          &local_qiov, 0);
1750                     qemu_co_mutex_lock(&s->lock);
1751
1752                     qemu_iovec_destroy(&local_qiov);
1753
1754                     if (ret < 0) {
1755                         goto fail;
1756                     }
1757                 }
1758             } else {
1759                 /* Note: in this case, no need to wait */
1760                 qemu_iovec_memset(&hd_qiov, 0, 0, cur_bytes);
1761             }
1762             break;
1763
1764         case QCOW2_CLUSTER_ZERO_PLAIN:
1765         case QCOW2_CLUSTER_ZERO_ALLOC:
1766             qemu_iovec_memset(&hd_qiov, 0, 0, cur_bytes);
1767             break;
1768
1769         case QCOW2_CLUSTER_COMPRESSED:
1770             /* add AIO support for compressed blocks ? */
1771             ret = qcow2_decompress_cluster(bs, cluster_offset);
1772             if (ret < 0) {
1773                 goto fail;
1774             }
1775
1776             qemu_iovec_from_buf(&hd_qiov, 0,
1777                                 s->cluster_cache + offset_in_cluster,
1778                                 cur_bytes);
1779             break;
1780
1781         case QCOW2_CLUSTER_NORMAL:
1782             if ((cluster_offset & 511) != 0) {
1783                 ret = -EIO;
1784                 goto fail;
1785             }
1786
1787             if (bs->encrypted) {
1788                 assert(s->crypto);
1789
1790                 /*
1791                  * For encrypted images, read everything into a temporary
1792                  * contiguous buffer on which the AES functions can work.
1793                  */
1794                 if (!cluster_data) {
1795                     cluster_data =
1796                         qemu_try_blockalign(bs->file->bs,
1797                                             QCOW_MAX_CRYPT_CLUSTERS
1798                                             * s->cluster_size);
1799                     if (cluster_data == NULL) {
1800                         ret = -ENOMEM;
1801                         goto fail;
1802                     }
1803                 }
1804
1805                 assert(cur_bytes <= QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size);
1806                 qemu_iovec_reset(&hd_qiov);
1807                 qemu_iovec_add(&hd_qiov, cluster_data, cur_bytes);
1808             }
1809
1810             BLKDBG_EVENT(bs->file, BLKDBG_READ_AIO);
1811             qemu_co_mutex_unlock(&s->lock);
1812             ret = bdrv_co_preadv(bs->file,
1813                                  cluster_offset + offset_in_cluster,
1814                                  cur_bytes, &hd_qiov, 0);
1815             qemu_co_mutex_lock(&s->lock);
1816             if (ret < 0) {
1817                 goto fail;
1818             }
1819             if (bs->encrypted) {
1820                 assert(s->crypto);
1821                 assert((offset & (BDRV_SECTOR_SIZE - 1)) == 0);
1822                 assert((cur_bytes & (BDRV_SECTOR_SIZE - 1)) == 0);
1823                 Error *err = NULL;
1824                 if (qcrypto_block_decrypt(s->crypto,
1825                                           (s->crypt_physical_offset ?
1826                                            cluster_offset + offset_in_cluster :
1827                                            offset) >> BDRV_SECTOR_BITS,
1828                                           cluster_data,
1829                                           cur_bytes,
1830                                           &err) < 0) {
1831                     error_free(err);
1832                     ret = -EIO;
1833                     goto fail;
1834                 }
1835                 qemu_iovec_from_buf(qiov, bytes_done, cluster_data, cur_bytes);
1836             }
1837             break;
1838
1839         default:
1840             g_assert_not_reached();
1841             ret = -EIO;
1842             goto fail;
1843         }
1844
1845         bytes -= cur_bytes;
1846         offset += cur_bytes;
1847         bytes_done += cur_bytes;
1848     }
1849     ret = 0;
1850
1851 fail:
1852     qemu_co_mutex_unlock(&s->lock);
1853
1854     qemu_iovec_destroy(&hd_qiov);
1855     qemu_vfree(cluster_data);
1856
1857     return ret;
1858 }
1859
1860 /* Check if it's possible to merge a write request with the writing of
1861  * the data from the COW regions */
1862 static bool merge_cow(uint64_t offset, unsigned bytes,
1863                       QEMUIOVector *hd_qiov, QCowL2Meta *l2meta)
1864 {
1865     QCowL2Meta *m;
1866
1867     for (m = l2meta; m != NULL; m = m->next) {
1868         /* If both COW regions are empty then there's nothing to merge */
1869         if (m->cow_start.nb_bytes == 0 && m->cow_end.nb_bytes == 0) {
1870             continue;
1871         }
1872
1873         /* The data (middle) region must be immediately after the
1874          * start region */
1875         if (l2meta_cow_start(m) + m->cow_start.nb_bytes != offset) {
1876             continue;
1877         }
1878
1879         /* The end region must be immediately after the data (middle)
1880          * region */
1881         if (m->offset + m->cow_end.offset != offset + bytes) {
1882             continue;
1883         }
1884
1885         /* Make sure that adding both COW regions to the QEMUIOVector
1886          * does not exceed IOV_MAX */
1887         if (hd_qiov->niov > IOV_MAX - 2) {
1888             continue;
1889         }
1890
1891         m->data_qiov = hd_qiov;
1892         return true;
1893     }
1894
1895     return false;
1896 }
1897
1898 static coroutine_fn int qcow2_co_pwritev(BlockDriverState *bs, uint64_t offset,
1899                                          uint64_t bytes, QEMUIOVector *qiov,
1900                                          int flags)
1901 {
1902     BDRVQcow2State *s = bs->opaque;
1903     int offset_in_cluster;
1904     int ret;
1905     unsigned int cur_bytes; /* number of sectors in current iteration */
1906     uint64_t cluster_offset;
1907     QEMUIOVector hd_qiov;
1908     uint64_t bytes_done = 0;
1909     uint8_t *cluster_data = NULL;
1910     QCowL2Meta *l2meta = NULL;
1911
1912     trace_qcow2_writev_start_req(qemu_coroutine_self(), offset, bytes);
1913
1914     qemu_iovec_init(&hd_qiov, qiov->niov);
1915
1916     s->cluster_cache_offset = -1; /* disable compressed cache */
1917
1918     qemu_co_mutex_lock(&s->lock);
1919
1920     while (bytes != 0) {
1921
1922         l2meta = NULL;
1923
1924         trace_qcow2_writev_start_part(qemu_coroutine_self());
1925         offset_in_cluster = offset_into_cluster(s, offset);
1926         cur_bytes = MIN(bytes, INT_MAX);
1927         if (bs->encrypted) {
1928             cur_bytes = MIN(cur_bytes,
1929                             QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size
1930                             - offset_in_cluster);
1931         }
1932
1933         ret = qcow2_alloc_cluster_offset(bs, offset, &cur_bytes,
1934                                          &cluster_offset, &l2meta);
1935         if (ret < 0) {
1936             goto fail;
1937         }
1938
1939         assert((cluster_offset & 511) == 0);
1940
1941         qemu_iovec_reset(&hd_qiov);
1942         qemu_iovec_concat(&hd_qiov, qiov, bytes_done, cur_bytes);
1943
1944         if (bs->encrypted) {
1945             Error *err = NULL;
1946             assert(s->crypto);
1947             if (!cluster_data) {
1948                 cluster_data = qemu_try_blockalign(bs->file->bs,
1949                                                    QCOW_MAX_CRYPT_CLUSTERS
1950                                                    * s->cluster_size);
1951                 if (cluster_data == NULL) {
1952                     ret = -ENOMEM;
1953                     goto fail;
1954                 }
1955             }
1956
1957             assert(hd_qiov.size <=
1958                    QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size);
1959             qemu_iovec_to_buf(&hd_qiov, 0, cluster_data, hd_qiov.size);
1960
1961             if (qcrypto_block_encrypt(s->crypto,
1962                                       (s->crypt_physical_offset ?
1963                                        cluster_offset + offset_in_cluster :
1964                                        offset) >> BDRV_SECTOR_BITS,
1965                                       cluster_data,
1966                                       cur_bytes, &err) < 0) {
1967                 error_free(err);
1968                 ret = -EIO;
1969                 goto fail;
1970             }
1971
1972             qemu_iovec_reset(&hd_qiov);
1973             qemu_iovec_add(&hd_qiov, cluster_data, cur_bytes);
1974         }
1975
1976         ret = qcow2_pre_write_overlap_check(bs, 0,
1977                 cluster_offset + offset_in_cluster, cur_bytes);
1978         if (ret < 0) {
1979             goto fail;
1980         }
1981
1982         /* If we need to do COW, check if it's possible to merge the
1983          * writing of the guest data together with that of the COW regions.
1984          * If it's not possible (or not necessary) then write the
1985          * guest data now. */
1986         if (!merge_cow(offset, cur_bytes, &hd_qiov, l2meta)) {
1987             qemu_co_mutex_unlock(&s->lock);
1988             BLKDBG_EVENT(bs->file, BLKDBG_WRITE_AIO);
1989             trace_qcow2_writev_data(qemu_coroutine_self(),
1990                                     cluster_offset + offset_in_cluster);
1991             ret = bdrv_co_pwritev(bs->file,
1992                                   cluster_offset + offset_in_cluster,
1993                                   cur_bytes, &hd_qiov, 0);
1994             qemu_co_mutex_lock(&s->lock);
1995             if (ret < 0) {
1996                 goto fail;
1997             }
1998         }
1999
2000         while (l2meta != NULL) {
2001             QCowL2Meta *next;
2002
2003             ret = qcow2_alloc_cluster_link_l2(bs, l2meta);
2004             if (ret < 0) {
2005                 goto fail;
2006             }
2007
2008             /* Take the request off the list of running requests */
2009             if (l2meta->nb_clusters != 0) {
2010                 QLIST_REMOVE(l2meta, next_in_flight);
2011             }
2012
2013             qemu_co_queue_restart_all(&l2meta->dependent_requests);
2014
2015             next = l2meta->next;
2016             g_free(l2meta);
2017             l2meta = next;
2018         }
2019
2020         bytes -= cur_bytes;
2021         offset += cur_bytes;
2022         bytes_done += cur_bytes;
2023         trace_qcow2_writev_done_part(qemu_coroutine_self(), cur_bytes);
2024     }
2025     ret = 0;
2026
2027 fail:
2028     qemu_co_mutex_unlock(&s->lock);
2029
2030     while (l2meta != NULL) {
2031         QCowL2Meta *next;
2032
2033         if (l2meta->nb_clusters != 0) {
2034             QLIST_REMOVE(l2meta, next_in_flight);
2035         }
2036         qemu_co_queue_restart_all(&l2meta->dependent_requests);
2037
2038         next = l2meta->next;
2039         g_free(l2meta);
2040         l2meta = next;
2041     }
2042
2043     qemu_iovec_destroy(&hd_qiov);
2044     qemu_vfree(cluster_data);
2045     trace_qcow2_writev_done_req(qemu_coroutine_self(), ret);
2046
2047     return ret;
2048 }
2049
2050 static int qcow2_inactivate(BlockDriverState *bs)
2051 {
2052     BDRVQcow2State *s = bs->opaque;
2053     int ret, result = 0;
2054     Error *local_err = NULL;
2055
2056     ret = qcow2_cache_flush(bs, s->l2_table_cache);
2057     if (ret) {
2058         result = ret;
2059         error_report("Failed to flush the L2 table cache: %s",
2060                      strerror(-ret));
2061     }
2062
2063     ret = qcow2_cache_flush(bs, s->refcount_block_cache);
2064     if (ret) {
2065         result = ret;
2066         error_report("Failed to flush the refcount block cache: %s",
2067                      strerror(-ret));
2068     }
2069
2070     qcow2_store_persistent_dirty_bitmaps(bs, &local_err);
2071     if (local_err != NULL) {
2072         result = -EINVAL;
2073         error_report_err(local_err);
2074         error_report("Persistent bitmaps are lost for node '%s'",
2075                      bdrv_get_device_or_node_name(bs));
2076     }
2077
2078     if (result == 0) {
2079         qcow2_mark_clean(bs);
2080     }
2081
2082     return result;
2083 }
2084
2085 static void qcow2_close(BlockDriverState *bs)
2086 {
2087     BDRVQcow2State *s = bs->opaque;
2088     qemu_vfree(s->l1_table);
2089     /* else pre-write overlap checks in cache_destroy may crash */
2090     s->l1_table = NULL;
2091
2092     if (!(s->flags & BDRV_O_INACTIVE)) {
2093         qcow2_inactivate(bs);
2094     }
2095
2096     cache_clean_timer_del(bs);
2097     qcow2_cache_destroy(bs, s->l2_table_cache);
2098     qcow2_cache_destroy(bs, s->refcount_block_cache);
2099
2100     qcrypto_block_free(s->crypto);
2101     s->crypto = NULL;
2102
2103     g_free(s->unknown_header_fields);
2104     cleanup_unknown_header_ext(bs);
2105
2106     g_free(s->image_backing_file);
2107     g_free(s->image_backing_format);
2108
2109     g_free(s->cluster_cache);
2110     qemu_vfree(s->cluster_data);
2111     qcow2_refcount_close(bs);
2112     qcow2_free_snapshots(bs);
2113 }
2114
2115 static void qcow2_invalidate_cache(BlockDriverState *bs, Error **errp)
2116 {
2117     BDRVQcow2State *s = bs->opaque;
2118     int flags = s->flags;
2119     QCryptoBlock *crypto = NULL;
2120     QDict *options;
2121     Error *local_err = NULL;
2122     int ret;
2123
2124     /*
2125      * Backing files are read-only which makes all of their metadata immutable,
2126      * that means we don't have to worry about reopening them here.
2127      */
2128
2129     crypto = s->crypto;
2130     s->crypto = NULL;
2131
2132     qcow2_close(bs);
2133
2134     memset(s, 0, sizeof(BDRVQcow2State));
2135     options = qdict_clone_shallow(bs->options);
2136
2137     flags &= ~BDRV_O_INACTIVE;
2138     ret = qcow2_do_open(bs, options, flags, &local_err);
2139     QDECREF(options);
2140     if (local_err) {
2141         error_propagate(errp, local_err);
2142         error_prepend(errp, "Could not reopen qcow2 layer: ");
2143         bs->drv = NULL;
2144         return;
2145     } else if (ret < 0) {
2146         error_setg_errno(errp, -ret, "Could not reopen qcow2 layer");
2147         bs->drv = NULL;
2148         return;
2149     }
2150
2151     s->crypto = crypto;
2152 }
2153
2154 static size_t header_ext_add(char *buf, uint32_t magic, const void *s,
2155     size_t len, size_t buflen)
2156 {
2157     QCowExtension *ext_backing_fmt = (QCowExtension*) buf;
2158     size_t ext_len = sizeof(QCowExtension) + ((len + 7) & ~7);
2159
2160     if (buflen < ext_len) {
2161         return -ENOSPC;
2162     }
2163
2164     *ext_backing_fmt = (QCowExtension) {
2165         .magic  = cpu_to_be32(magic),
2166         .len    = cpu_to_be32(len),
2167     };
2168
2169     if (len) {
2170         memcpy(buf + sizeof(QCowExtension), s, len);
2171     }
2172
2173     return ext_len;
2174 }
2175
2176 /*
2177  * Updates the qcow2 header, including the variable length parts of it, i.e.
2178  * the backing file name and all extensions. qcow2 was not designed to allow
2179  * such changes, so if we run out of space (we can only use the first cluster)
2180  * this function may fail.
2181  *
2182  * Returns 0 on success, -errno in error cases.
2183  */
2184 int qcow2_update_header(BlockDriverState *bs)
2185 {
2186     BDRVQcow2State *s = bs->opaque;
2187     QCowHeader *header;
2188     char *buf;
2189     size_t buflen = s->cluster_size;
2190     int ret;
2191     uint64_t total_size;
2192     uint32_t refcount_table_clusters;
2193     size_t header_length;
2194     Qcow2UnknownHeaderExtension *uext;
2195
2196     buf = qemu_blockalign(bs, buflen);
2197
2198     /* Header structure */
2199     header = (QCowHeader*) buf;
2200
2201     if (buflen < sizeof(*header)) {
2202         ret = -ENOSPC;
2203         goto fail;
2204     }
2205
2206     header_length = sizeof(*header) + s->unknown_header_fields_size;
2207     total_size = bs->total_sectors * BDRV_SECTOR_SIZE;
2208     refcount_table_clusters = s->refcount_table_size >> (s->cluster_bits - 3);
2209
2210     *header = (QCowHeader) {
2211         /* Version 2 fields */
2212         .magic                  = cpu_to_be32(QCOW_MAGIC),
2213         .version                = cpu_to_be32(s->qcow_version),
2214         .backing_file_offset    = 0,
2215         .backing_file_size      = 0,
2216         .cluster_bits           = cpu_to_be32(s->cluster_bits),
2217         .size                   = cpu_to_be64(total_size),
2218         .crypt_method           = cpu_to_be32(s->crypt_method_header),
2219         .l1_size                = cpu_to_be32(s->l1_size),
2220         .l1_table_offset        = cpu_to_be64(s->l1_table_offset),
2221         .refcount_table_offset  = cpu_to_be64(s->refcount_table_offset),
2222         .refcount_table_clusters = cpu_to_be32(refcount_table_clusters),
2223         .nb_snapshots           = cpu_to_be32(s->nb_snapshots),
2224         .snapshots_offset       = cpu_to_be64(s->snapshots_offset),
2225
2226         /* Version 3 fields */
2227         .incompatible_features  = cpu_to_be64(s->incompatible_features),
2228         .compatible_features    = cpu_to_be64(s->compatible_features),
2229         .autoclear_features     = cpu_to_be64(s->autoclear_features),
2230         .refcount_order         = cpu_to_be32(s->refcount_order),
2231         .header_length          = cpu_to_be32(header_length),
2232     };
2233
2234     /* For older versions, write a shorter header */
2235     switch (s->qcow_version) {
2236     case 2:
2237         ret = offsetof(QCowHeader, incompatible_features);
2238         break;
2239     case 3:
2240         ret = sizeof(*header);
2241         break;
2242     default:
2243         ret = -EINVAL;
2244         goto fail;
2245     }
2246
2247     buf += ret;
2248     buflen -= ret;
2249     memset(buf, 0, buflen);
2250
2251     /* Preserve any unknown field in the header */
2252     if (s->unknown_header_fields_size) {
2253         if (buflen < s->unknown_header_fields_size) {
2254             ret = -ENOSPC;
2255             goto fail;
2256         }
2257
2258         memcpy(buf, s->unknown_header_fields, s->unknown_header_fields_size);
2259         buf += s->unknown_header_fields_size;
2260         buflen -= s->unknown_header_fields_size;
2261     }
2262
2263     /* Backing file format header extension */
2264     if (s->image_backing_format) {
2265         ret = header_ext_add(buf, QCOW2_EXT_MAGIC_BACKING_FORMAT,
2266                              s->image_backing_format,
2267                              strlen(s->image_backing_format),
2268                              buflen);
2269         if (ret < 0) {
2270             goto fail;
2271         }
2272
2273         buf += ret;
2274         buflen -= ret;
2275     }
2276
2277     /* Full disk encryption header pointer extension */
2278     if (s->crypto_header.offset != 0) {
2279         cpu_to_be64s(&s->crypto_header.offset);
2280         cpu_to_be64s(&s->crypto_header.length);
2281         ret = header_ext_add(buf, QCOW2_EXT_MAGIC_CRYPTO_HEADER,
2282                              &s->crypto_header, sizeof(s->crypto_header),
2283                              buflen);
2284         be64_to_cpus(&s->crypto_header.offset);
2285         be64_to_cpus(&s->crypto_header.length);
2286         if (ret < 0) {
2287             goto fail;
2288         }
2289         buf += ret;
2290         buflen -= ret;
2291     }
2292
2293     /* Feature table */
2294     if (s->qcow_version >= 3) {
2295         Qcow2Feature features[] = {
2296             {
2297                 .type = QCOW2_FEAT_TYPE_INCOMPATIBLE,
2298                 .bit  = QCOW2_INCOMPAT_DIRTY_BITNR,
2299                 .name = "dirty bit",
2300             },
2301             {
2302                 .type = QCOW2_FEAT_TYPE_INCOMPATIBLE,
2303                 .bit  = QCOW2_INCOMPAT_CORRUPT_BITNR,
2304                 .name = "corrupt bit",
2305             },
2306             {
2307                 .type = QCOW2_FEAT_TYPE_COMPATIBLE,
2308                 .bit  = QCOW2_COMPAT_LAZY_REFCOUNTS_BITNR,
2309                 .name = "lazy refcounts",
2310             },
2311         };
2312
2313         ret = header_ext_add(buf, QCOW2_EXT_MAGIC_FEATURE_TABLE,
2314                              features, sizeof(features), buflen);
2315         if (ret < 0) {
2316             goto fail;
2317         }
2318         buf += ret;
2319         buflen -= ret;
2320     }
2321
2322     /* Bitmap extension */
2323     if (s->nb_bitmaps > 0) {
2324         Qcow2BitmapHeaderExt bitmaps_header = {
2325             .nb_bitmaps = cpu_to_be32(s->nb_bitmaps),
2326             .bitmap_directory_size =
2327                     cpu_to_be64(s->bitmap_directory_size),
2328             .bitmap_directory_offset =
2329                     cpu_to_be64(s->bitmap_directory_offset)
2330         };
2331         ret = header_ext_add(buf, QCOW2_EXT_MAGIC_BITMAPS,
2332                              &bitmaps_header, sizeof(bitmaps_header),
2333                              buflen);
2334         if (ret < 0) {
2335             goto fail;
2336         }
2337         buf += ret;
2338         buflen -= ret;
2339     }
2340
2341     /* Keep unknown header extensions */
2342     QLIST_FOREACH(uext, &s->unknown_header_ext, next) {
2343         ret = header_ext_add(buf, uext->magic, uext->data, uext->len, buflen);
2344         if (ret < 0) {
2345             goto fail;
2346         }
2347
2348         buf += ret;
2349         buflen -= ret;
2350     }
2351
2352     /* End of header extensions */
2353     ret = header_ext_add(buf, QCOW2_EXT_MAGIC_END, NULL, 0, buflen);
2354     if (ret < 0) {
2355         goto fail;
2356     }
2357
2358     buf += ret;
2359     buflen -= ret;
2360
2361     /* Backing file name */
2362     if (s->image_backing_file) {
2363         size_t backing_file_len = strlen(s->image_backing_file);
2364
2365         if (buflen < backing_file_len) {
2366             ret = -ENOSPC;
2367             goto fail;
2368         }
2369
2370         /* Using strncpy is ok here, since buf is not NUL-terminated. */
2371         strncpy(buf, s->image_backing_file, buflen);
2372
2373         header->backing_file_offset = cpu_to_be64(buf - ((char*) header));
2374         header->backing_file_size   = cpu_to_be32(backing_file_len);
2375     }
2376
2377     /* Write the new header */
2378     ret = bdrv_pwrite(bs->file, 0, header, s->cluster_size);
2379     if (ret < 0) {
2380         goto fail;
2381     }
2382
2383     ret = 0;
2384 fail:
2385     qemu_vfree(header);
2386     return ret;
2387 }
2388
2389 static int qcow2_change_backing_file(BlockDriverState *bs,
2390     const char *backing_file, const char *backing_fmt)
2391 {
2392     BDRVQcow2State *s = bs->opaque;
2393
2394     if (backing_file && strlen(backing_file) > 1023) {
2395         return -EINVAL;
2396     }
2397
2398     pstrcpy(bs->backing_file, sizeof(bs->backing_file), backing_file ?: "");
2399     pstrcpy(bs->backing_format, sizeof(bs->backing_format), backing_fmt ?: "");
2400
2401     g_free(s->image_backing_file);
2402     g_free(s->image_backing_format);
2403
2404     s->image_backing_file = backing_file ? g_strdup(bs->backing_file) : NULL;
2405     s->image_backing_format = backing_fmt ? g_strdup(bs->backing_format) : NULL;
2406
2407     return qcow2_update_header(bs);
2408 }
2409
2410 static int qcow2_crypt_method_from_format(const char *encryptfmt)
2411 {
2412     if (g_str_equal(encryptfmt, "luks")) {
2413         return QCOW_CRYPT_LUKS;
2414     } else if (g_str_equal(encryptfmt, "aes")) {
2415         return QCOW_CRYPT_AES;
2416     } else {
2417         return -EINVAL;
2418     }
2419 }
2420
2421 static int qcow2_set_up_encryption(BlockDriverState *bs, const char *encryptfmt,
2422                                    QemuOpts *opts, Error **errp)
2423 {
2424     BDRVQcow2State *s = bs->opaque;
2425     QCryptoBlockCreateOptions *cryptoopts = NULL;
2426     QCryptoBlock *crypto = NULL;
2427     int ret = -EINVAL;
2428     QDict *options, *encryptopts;
2429     int fmt;
2430
2431     options = qemu_opts_to_qdict(opts, NULL);
2432     qdict_extract_subqdict(options, &encryptopts, "encrypt.");
2433     QDECREF(options);
2434
2435     fmt = qcow2_crypt_method_from_format(encryptfmt);
2436
2437     switch (fmt) {
2438     case QCOW_CRYPT_LUKS:
2439         cryptoopts = block_crypto_create_opts_init(
2440             Q_CRYPTO_BLOCK_FORMAT_LUKS, encryptopts, errp);
2441         break;
2442     case QCOW_CRYPT_AES:
2443         cryptoopts = block_crypto_create_opts_init(
2444             Q_CRYPTO_BLOCK_FORMAT_QCOW, encryptopts, errp);
2445         break;
2446     default:
2447         error_setg(errp, "Unknown encryption format '%s'", encryptfmt);
2448         break;
2449     }
2450     if (!cryptoopts) {
2451         ret = -EINVAL;
2452         goto out;
2453     }
2454     s->crypt_method_header = fmt;
2455
2456     crypto = qcrypto_block_create(cryptoopts, "encrypt.",
2457                                   qcow2_crypto_hdr_init_func,
2458                                   qcow2_crypto_hdr_write_func,
2459                                   bs, errp);
2460     if (!crypto) {
2461         ret = -EINVAL;
2462         goto out;
2463     }
2464
2465     ret = qcow2_update_header(bs);
2466     if (ret < 0) {
2467         error_setg_errno(errp, -ret, "Could not write encryption header");
2468         goto out;
2469     }
2470
2471  out:
2472     QDECREF(encryptopts);
2473     qcrypto_block_free(crypto);
2474     qapi_free_QCryptoBlockCreateOptions(cryptoopts);
2475     return ret;
2476 }
2477
2478
2479 static int preallocate(BlockDriverState *bs)
2480 {
2481     uint64_t bytes;
2482     uint64_t offset;
2483     uint64_t host_offset = 0;
2484     unsigned int cur_bytes;
2485     int ret;
2486     QCowL2Meta *meta;
2487
2488     bytes = bdrv_getlength(bs);
2489     offset = 0;
2490
2491     while (bytes) {
2492         cur_bytes = MIN(bytes, INT_MAX);
2493         ret = qcow2_alloc_cluster_offset(bs, offset, &cur_bytes,
2494                                          &host_offset, &meta);
2495         if (ret < 0) {
2496             return ret;
2497         }
2498
2499         while (meta) {
2500             QCowL2Meta *next = meta->next;
2501
2502             ret = qcow2_alloc_cluster_link_l2(bs, meta);
2503             if (ret < 0) {
2504                 qcow2_free_any_clusters(bs, meta->alloc_offset,
2505                                         meta->nb_clusters, QCOW2_DISCARD_NEVER);
2506                 return ret;
2507             }
2508
2509             /* There are no dependent requests, but we need to remove our
2510              * request from the list of in-flight requests */
2511             QLIST_REMOVE(meta, next_in_flight);
2512
2513             g_free(meta);
2514             meta = next;
2515         }
2516
2517         /* TODO Preallocate data if requested */
2518
2519         bytes -= cur_bytes;
2520         offset += cur_bytes;
2521     }
2522
2523     /*
2524      * It is expected that the image file is large enough to actually contain
2525      * all of the allocated clusters (otherwise we get failing reads after
2526      * EOF). Extend the image to the last allocated sector.
2527      */
2528     if (host_offset != 0) {
2529         uint8_t data = 0;
2530         ret = bdrv_pwrite(bs->file, (host_offset + cur_bytes) - 1,
2531                           &data, 1);
2532         if (ret < 0) {
2533             return ret;
2534         }
2535     }
2536
2537     return 0;
2538 }
2539
2540 static int qcow2_create2(const char *filename, int64_t total_size,
2541                          const char *backing_file, const char *backing_format,
2542                          int flags, size_t cluster_size, PreallocMode prealloc,
2543                          QemuOpts *opts, int version, int refcount_order,
2544                          const char *encryptfmt, Error **errp)
2545 {
2546     int cluster_bits;
2547     QDict *options;
2548
2549     /* Calculate cluster_bits */
2550     cluster_bits = ctz32(cluster_size);
2551     if (cluster_bits < MIN_CLUSTER_BITS || cluster_bits > MAX_CLUSTER_BITS ||
2552         (1 << cluster_bits) != cluster_size)
2553     {
2554         error_setg(errp, "Cluster size must be a power of two between %d and "
2555                    "%dk", 1 << MIN_CLUSTER_BITS, 1 << (MAX_CLUSTER_BITS - 10));
2556         return -EINVAL;
2557     }
2558
2559     /*
2560      * Open the image file and write a minimal qcow2 header.
2561      *
2562      * We keep things simple and start with a zero-sized image. We also
2563      * do without refcount blocks or a L1 table for now. We'll fix the
2564      * inconsistency later.
2565      *
2566      * We do need a refcount table because growing the refcount table means
2567      * allocating two new refcount blocks - the seconds of which would be at
2568      * 2 GB for 64k clusters, and we don't want to have a 2 GB initial file
2569      * size for any qcow2 image.
2570      */
2571     BlockBackend *blk;
2572     QCowHeader *header;
2573     uint64_t* refcount_table;
2574     Error *local_err = NULL;
2575     int ret;
2576
2577     if (prealloc == PREALLOC_MODE_FULL || prealloc == PREALLOC_MODE_FALLOC) {
2578         /* Note: The following calculation does not need to be exact; if it is a
2579          * bit off, either some bytes will be "leaked" (which is fine) or we
2580          * will need to increase the file size by some bytes (which is fine,
2581          * too, as long as the bulk is allocated here). Therefore, using
2582          * floating point arithmetic is fine. */
2583         int64_t meta_size = 0;
2584         uint64_t nreftablee, nrefblocke, nl1e, nl2e, refblock_count;
2585         int64_t aligned_total_size = align_offset(total_size, cluster_size);
2586         int refblock_bits, refblock_size;
2587         /* refcount entry size in bytes */
2588         double rces = (1 << refcount_order) / 8.;
2589
2590         /* see qcow2_open() */
2591         refblock_bits = cluster_bits - (refcount_order - 3);
2592         refblock_size = 1 << refblock_bits;
2593
2594         /* header: 1 cluster */
2595         meta_size += cluster_size;
2596
2597         /* total size of L2 tables */
2598         nl2e = aligned_total_size / cluster_size;
2599         nl2e = align_offset(nl2e, cluster_size / sizeof(uint64_t));
2600         meta_size += nl2e * sizeof(uint64_t);
2601
2602         /* total size of L1 tables */
2603         nl1e = nl2e * sizeof(uint64_t) / cluster_size;
2604         nl1e = align_offset(nl1e, cluster_size / sizeof(uint64_t));
2605         meta_size += nl1e * sizeof(uint64_t);
2606
2607         /* total size of refcount blocks
2608          *
2609          * note: every host cluster is reference-counted, including metadata
2610          * (even refcount blocks are recursively included).
2611          * Let:
2612          *   a = total_size (this is the guest disk size)
2613          *   m = meta size not including refcount blocks and refcount tables
2614          *   c = cluster size
2615          *   y1 = number of refcount blocks entries
2616          *   y2 = meta size including everything
2617          *   rces = refcount entry size in bytes
2618          * then,
2619          *   y1 = (y2 + a)/c
2620          *   y2 = y1 * rces + y1 * rces * sizeof(u64) / c + m
2621          * we can get y1:
2622          *   y1 = (a + m) / (c - rces - rces * sizeof(u64) / c)
2623          */
2624         nrefblocke = (aligned_total_size + meta_size + cluster_size)
2625                    / (cluster_size - rces - rces * sizeof(uint64_t)
2626                                                  / cluster_size);
2627         refblock_count = DIV_ROUND_UP(nrefblocke, refblock_size);
2628         meta_size += refblock_count * cluster_size;
2629
2630         /* total size of refcount tables */
2631         nreftablee = align_offset(refblock_count,
2632                                   cluster_size / sizeof(uint64_t));
2633         meta_size += nreftablee * sizeof(uint64_t);
2634
2635         qemu_opt_set_number(opts, BLOCK_OPT_SIZE,
2636                             aligned_total_size + meta_size, &error_abort);
2637         qemu_opt_set(opts, BLOCK_OPT_PREALLOC, PreallocMode_lookup[prealloc],
2638                      &error_abort);
2639     }
2640
2641     ret = bdrv_create_file(filename, opts, &local_err);
2642     if (ret < 0) {
2643         error_propagate(errp, local_err);
2644         return ret;
2645     }
2646
2647     blk = blk_new_open(filename, NULL, NULL,
2648                        BDRV_O_RDWR | BDRV_O_RESIZE | BDRV_O_PROTOCOL,
2649                        &local_err);
2650     if (blk == NULL) {
2651         error_propagate(errp, local_err);
2652         return -EIO;
2653     }
2654
2655     blk_set_allow_write_beyond_eof(blk, true);
2656
2657     /* Write the header */
2658     QEMU_BUILD_BUG_ON((1 << MIN_CLUSTER_BITS) < sizeof(*header));
2659     header = g_malloc0(cluster_size);
2660     *header = (QCowHeader) {
2661         .magic                      = cpu_to_be32(QCOW_MAGIC),
2662         .version                    = cpu_to_be32(version),
2663         .cluster_bits               = cpu_to_be32(cluster_bits),
2664         .size                       = cpu_to_be64(0),
2665         .l1_table_offset            = cpu_to_be64(0),
2666         .l1_size                    = cpu_to_be32(0),
2667         .refcount_table_offset      = cpu_to_be64(cluster_size),
2668         .refcount_table_clusters    = cpu_to_be32(1),
2669         .refcount_order             = cpu_to_be32(refcount_order),
2670         .header_length              = cpu_to_be32(sizeof(*header)),
2671     };
2672
2673     /* We'll update this to correct value later */
2674     header->crypt_method = cpu_to_be32(QCOW_CRYPT_NONE);
2675
2676     if (flags & BLOCK_FLAG_LAZY_REFCOUNTS) {
2677         header->compatible_features |=
2678             cpu_to_be64(QCOW2_COMPAT_LAZY_REFCOUNTS);
2679     }
2680
2681     ret = blk_pwrite(blk, 0, header, cluster_size, 0);
2682     g_free(header);
2683     if (ret < 0) {
2684         error_setg_errno(errp, -ret, "Could not write qcow2 header");
2685         goto out;
2686     }
2687
2688     /* Write a refcount table with one refcount block */
2689     refcount_table = g_malloc0(2 * cluster_size);
2690     refcount_table[0] = cpu_to_be64(2 * cluster_size);
2691     ret = blk_pwrite(blk, cluster_size, refcount_table, 2 * cluster_size, 0);
2692     g_free(refcount_table);
2693
2694     if (ret < 0) {
2695         error_setg_errno(errp, -ret, "Could not write refcount table");
2696         goto out;
2697     }
2698
2699     blk_unref(blk);
2700     blk = NULL;
2701
2702     /*
2703      * And now open the image and make it consistent first (i.e. increase the
2704      * refcount of the cluster that is occupied by the header and the refcount
2705      * table)
2706      */
2707     options = qdict_new();
2708     qdict_put_str(options, "driver", "qcow2");
2709     blk = blk_new_open(filename, NULL, options,
2710                        BDRV_O_RDWR | BDRV_O_RESIZE | BDRV_O_NO_FLUSH,
2711                        &local_err);
2712     if (blk == NULL) {
2713         error_propagate(errp, local_err);
2714         ret = -EIO;
2715         goto out;
2716     }
2717
2718     ret = qcow2_alloc_clusters(blk_bs(blk), 3 * cluster_size);
2719     if (ret < 0) {
2720         error_setg_errno(errp, -ret, "Could not allocate clusters for qcow2 "
2721                          "header and refcount table");
2722         goto out;
2723
2724     } else if (ret != 0) {
2725         error_report("Huh, first cluster in empty image is already in use?");
2726         abort();
2727     }
2728
2729     /* Create a full header (including things like feature table) */
2730     ret = qcow2_update_header(blk_bs(blk));
2731     if (ret < 0) {
2732         error_setg_errno(errp, -ret, "Could not update qcow2 header");
2733         goto out;
2734     }
2735
2736     /* Okay, now that we have a valid image, let's give it the right size */
2737     ret = blk_truncate(blk, total_size, errp);
2738     if (ret < 0) {
2739         error_prepend(errp, "Could not resize image: ");
2740         goto out;
2741     }
2742
2743     /* Want a backing file? There you go.*/
2744     if (backing_file) {
2745         ret = bdrv_change_backing_file(blk_bs(blk), backing_file, backing_format);
2746         if (ret < 0) {
2747             error_setg_errno(errp, -ret, "Could not assign backing file '%s' "
2748                              "with format '%s'", backing_file, backing_format);
2749             goto out;
2750         }
2751     }
2752
2753     /* Want encryption? There you go. */
2754     if (encryptfmt) {
2755         ret = qcow2_set_up_encryption(blk_bs(blk), encryptfmt, opts, errp);
2756         if (ret < 0) {
2757             goto out;
2758         }
2759     }
2760
2761     /* And if we're supposed to preallocate metadata, do that now */
2762     if (prealloc != PREALLOC_MODE_OFF) {
2763         BDRVQcow2State *s = blk_bs(blk)->opaque;
2764         qemu_co_mutex_lock(&s->lock);
2765         ret = preallocate(blk_bs(blk));
2766         qemu_co_mutex_unlock(&s->lock);
2767         if (ret < 0) {
2768             error_setg_errno(errp, -ret, "Could not preallocate metadata");
2769             goto out;
2770         }
2771     }
2772
2773     blk_unref(blk);
2774     blk = NULL;
2775
2776     /* Reopen the image without BDRV_O_NO_FLUSH to flush it before returning.
2777      * Using BDRV_O_NO_IO, since encryption is now setup we don't want to
2778      * have to setup decryption context. We're not doing any I/O on the top
2779      * level BlockDriverState, only lower layers, where BDRV_O_NO_IO does
2780      * not have effect.
2781      */
2782     options = qdict_new();
2783     qdict_put_str(options, "driver", "qcow2");
2784     blk = blk_new_open(filename, NULL, options,
2785                        BDRV_O_RDWR | BDRV_O_NO_BACKING | BDRV_O_NO_IO,
2786                        &local_err);
2787     if (blk == NULL) {
2788         error_propagate(errp, local_err);
2789         ret = -EIO;
2790         goto out;
2791     }
2792
2793     ret = 0;
2794 out:
2795     if (blk) {
2796         blk_unref(blk);
2797     }
2798     return ret;
2799 }
2800
2801 static int qcow2_create(const char *filename, QemuOpts *opts, Error **errp)
2802 {
2803     char *backing_file = NULL;
2804     char *backing_fmt = NULL;
2805     char *buf = NULL;
2806     uint64_t size = 0;
2807     int flags = 0;
2808     size_t cluster_size = DEFAULT_CLUSTER_SIZE;
2809     PreallocMode prealloc;
2810     int version = 3;
2811     uint64_t refcount_bits = 16;
2812     int refcount_order;
2813     const char *encryptfmt = NULL;
2814     Error *local_err = NULL;
2815     int ret;
2816
2817     /* Read out options */
2818     size = ROUND_UP(qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0),
2819                     BDRV_SECTOR_SIZE);
2820     backing_file = qemu_opt_get_del(opts, BLOCK_OPT_BACKING_FILE);
2821     backing_fmt = qemu_opt_get_del(opts, BLOCK_OPT_BACKING_FMT);
2822     encryptfmt = qemu_opt_get_del(opts, BLOCK_OPT_ENCRYPT_FORMAT);
2823     if (encryptfmt) {
2824         if (qemu_opt_get_del(opts, BLOCK_OPT_ENCRYPT)) {
2825             error_setg(errp, "Options " BLOCK_OPT_ENCRYPT " and "
2826                        BLOCK_OPT_ENCRYPT_FORMAT " are mutually exclusive");
2827             ret = -EINVAL;
2828             goto finish;
2829         }
2830     } else if (qemu_opt_get_bool_del(opts, BLOCK_OPT_ENCRYPT, false)) {
2831         encryptfmt = "aes";
2832     }
2833     cluster_size = qemu_opt_get_size_del(opts, BLOCK_OPT_CLUSTER_SIZE,
2834                                          DEFAULT_CLUSTER_SIZE);
2835     buf = qemu_opt_get_del(opts, BLOCK_OPT_PREALLOC);
2836     prealloc = qapi_enum_parse(PreallocMode_lookup, buf,
2837                                PREALLOC_MODE__MAX, PREALLOC_MODE_OFF,
2838                                &local_err);
2839     if (local_err) {
2840         error_propagate(errp, local_err);
2841         ret = -EINVAL;
2842         goto finish;
2843     }
2844     g_free(buf);
2845     buf = qemu_opt_get_del(opts, BLOCK_OPT_COMPAT_LEVEL);
2846     if (!buf) {
2847         /* keep the default */
2848     } else if (!strcmp(buf, "0.10")) {
2849         version = 2;
2850     } else if (!strcmp(buf, "1.1")) {
2851         version = 3;
2852     } else {
2853         error_setg(errp, "Invalid compatibility level: '%s'", buf);
2854         ret = -EINVAL;
2855         goto finish;
2856     }
2857
2858     if (qemu_opt_get_bool_del(opts, BLOCK_OPT_LAZY_REFCOUNTS, false)) {
2859         flags |= BLOCK_FLAG_LAZY_REFCOUNTS;
2860     }
2861
2862     if (backing_file && prealloc != PREALLOC_MODE_OFF) {
2863         error_setg(errp, "Backing file and preallocation cannot be used at "
2864                    "the same time");
2865         ret = -EINVAL;
2866         goto finish;
2867     }
2868
2869     if (version < 3 && (flags & BLOCK_FLAG_LAZY_REFCOUNTS)) {
2870         error_setg(errp, "Lazy refcounts only supported with compatibility "
2871                    "level 1.1 and above (use compat=1.1 or greater)");
2872         ret = -EINVAL;
2873         goto finish;
2874     }
2875
2876     refcount_bits = qemu_opt_get_number_del(opts, BLOCK_OPT_REFCOUNT_BITS,
2877                                             refcount_bits);
2878     if (refcount_bits > 64 || !is_power_of_2(refcount_bits)) {
2879         error_setg(errp, "Refcount width must be a power of two and may not "
2880                    "exceed 64 bits");
2881         ret = -EINVAL;
2882         goto finish;
2883     }
2884
2885     if (version < 3 && refcount_bits != 16) {
2886         error_setg(errp, "Different refcount widths than 16 bits require "
2887                    "compatibility level 1.1 or above (use compat=1.1 or "
2888                    "greater)");
2889         ret = -EINVAL;
2890         goto finish;
2891     }
2892
2893     refcount_order = ctz32(refcount_bits);
2894
2895     ret = qcow2_create2(filename, size, backing_file, backing_fmt, flags,
2896                         cluster_size, prealloc, opts, version, refcount_order,
2897                         encryptfmt, &local_err);
2898     error_propagate(errp, local_err);
2899
2900 finish:
2901     g_free(backing_file);
2902     g_free(backing_fmt);
2903     g_free(buf);
2904     return ret;
2905 }
2906
2907
2908 static bool is_zero_sectors(BlockDriverState *bs, int64_t start,
2909                             uint32_t count)
2910 {
2911     int nr;
2912     BlockDriverState *file;
2913     int64_t res;
2914
2915     if (start + count > bs->total_sectors) {
2916         count = bs->total_sectors - start;
2917     }
2918
2919     if (!count) {
2920         return true;
2921     }
2922     res = bdrv_get_block_status_above(bs, NULL, start, count,
2923                                       &nr, &file);
2924     return res >= 0 && (res & BDRV_BLOCK_ZERO) && nr == count;
2925 }
2926
2927 static coroutine_fn int qcow2_co_pwrite_zeroes(BlockDriverState *bs,
2928     int64_t offset, int bytes, BdrvRequestFlags flags)
2929 {
2930     int ret;
2931     BDRVQcow2State *s = bs->opaque;
2932
2933     uint32_t head = offset % s->cluster_size;
2934     uint32_t tail = (offset + bytes) % s->cluster_size;
2935
2936     trace_qcow2_pwrite_zeroes_start_req(qemu_coroutine_self(), offset, bytes);
2937     if (offset + bytes == bs->total_sectors * BDRV_SECTOR_SIZE) {
2938         tail = 0;
2939     }
2940
2941     if (head || tail) {
2942         int64_t cl_start = (offset - head) >> BDRV_SECTOR_BITS;
2943         uint64_t off;
2944         unsigned int nr;
2945
2946         assert(head + bytes <= s->cluster_size);
2947
2948         /* check whether remainder of cluster already reads as zero */
2949         if (!(is_zero_sectors(bs, cl_start,
2950                               DIV_ROUND_UP(head, BDRV_SECTOR_SIZE)) &&
2951               is_zero_sectors(bs, (offset + bytes) >> BDRV_SECTOR_BITS,
2952                               DIV_ROUND_UP(-tail & (s->cluster_size - 1),
2953                                            BDRV_SECTOR_SIZE)))) {
2954             return -ENOTSUP;
2955         }
2956
2957         qemu_co_mutex_lock(&s->lock);
2958         /* We can have new write after previous check */
2959         offset = cl_start << BDRV_SECTOR_BITS;
2960         bytes = s->cluster_size;
2961         nr = s->cluster_size;
2962         ret = qcow2_get_cluster_offset(bs, offset, &nr, &off);
2963         if (ret != QCOW2_CLUSTER_UNALLOCATED &&
2964             ret != QCOW2_CLUSTER_ZERO_PLAIN &&
2965             ret != QCOW2_CLUSTER_ZERO_ALLOC) {
2966             qemu_co_mutex_unlock(&s->lock);
2967             return -ENOTSUP;
2968         }
2969     } else {
2970         qemu_co_mutex_lock(&s->lock);
2971     }
2972
2973     trace_qcow2_pwrite_zeroes(qemu_coroutine_self(), offset, bytes);
2974
2975     /* Whatever is left can use real zero clusters */
2976     ret = qcow2_cluster_zeroize(bs, offset, bytes, flags);
2977     qemu_co_mutex_unlock(&s->lock);
2978
2979     return ret;
2980 }
2981
2982 static coroutine_fn int qcow2_co_pdiscard(BlockDriverState *bs,
2983                                           int64_t offset, int bytes)
2984 {
2985     int ret;
2986     BDRVQcow2State *s = bs->opaque;
2987
2988     if (!QEMU_IS_ALIGNED(offset | bytes, s->cluster_size)) {
2989         assert(bytes < s->cluster_size);
2990         /* Ignore partial clusters, except for the special case of the
2991          * complete partial cluster at the end of an unaligned file */
2992         if (!QEMU_IS_ALIGNED(offset, s->cluster_size) ||
2993             offset + bytes != bs->total_sectors * BDRV_SECTOR_SIZE) {
2994             return -ENOTSUP;
2995         }
2996     }
2997
2998     qemu_co_mutex_lock(&s->lock);
2999     ret = qcow2_cluster_discard(bs, offset, bytes, QCOW2_DISCARD_REQUEST,
3000                                 false);
3001     qemu_co_mutex_unlock(&s->lock);
3002     return ret;
3003 }
3004
3005 static int qcow2_truncate(BlockDriverState *bs, int64_t offset, Error **errp)
3006 {
3007     BDRVQcow2State *s = bs->opaque;
3008     int64_t new_l1_size;
3009     int ret;
3010
3011     if (offset & 511) {
3012         error_setg(errp, "The new size must be a multiple of 512");
3013         return -EINVAL;
3014     }
3015
3016     /* cannot proceed if image has snapshots */
3017     if (s->nb_snapshots) {
3018         error_setg(errp, "Can't resize an image which has snapshots");
3019         return -ENOTSUP;
3020     }
3021
3022     /* cannot proceed if image has bitmaps */
3023     if (s->nb_bitmaps) {
3024         /* TODO: resize bitmaps in the image */
3025         error_setg(errp, "Can't resize an image which has bitmaps");
3026         return -ENOTSUP;
3027     }
3028
3029     /* shrinking is currently not supported */
3030     if (offset < bs->total_sectors * 512) {
3031         error_setg(errp, "qcow2 doesn't support shrinking images yet");
3032         return -ENOTSUP;
3033     }
3034
3035     new_l1_size = size_to_l1(s, offset);
3036     ret = qcow2_grow_l1_table(bs, new_l1_size, true);
3037     if (ret < 0) {
3038         error_setg_errno(errp, -ret, "Failed to grow the L1 table");
3039         return ret;
3040     }
3041
3042     /* write updated header.size */
3043     offset = cpu_to_be64(offset);
3044     ret = bdrv_pwrite_sync(bs->file, offsetof(QCowHeader, size),
3045                            &offset, sizeof(uint64_t));
3046     if (ret < 0) {
3047         error_setg_errno(errp, -ret, "Failed to update the image size");
3048         return ret;
3049     }
3050
3051     s->l1_vm_state_index = new_l1_size;
3052     return 0;
3053 }
3054
3055 /* XXX: put compressed sectors first, then all the cluster aligned
3056    tables to avoid losing bytes in alignment */
3057 static coroutine_fn int
3058 qcow2_co_pwritev_compressed(BlockDriverState *bs, uint64_t offset,
3059                             uint64_t bytes, QEMUIOVector *qiov)
3060 {
3061     BDRVQcow2State *s = bs->opaque;
3062     QEMUIOVector hd_qiov;
3063     struct iovec iov;
3064     z_stream strm;
3065     int ret, out_len;
3066     uint8_t *buf, *out_buf;
3067     uint64_t cluster_offset;
3068
3069     if (bytes == 0) {
3070         /* align end of file to a sector boundary to ease reading with
3071            sector based I/Os */
3072         cluster_offset = bdrv_getlength(bs->file->bs);
3073         return bdrv_truncate(bs->file, cluster_offset, NULL);
3074     }
3075
3076     buf = qemu_blockalign(bs, s->cluster_size);
3077     if (bytes != s->cluster_size) {
3078         if (bytes > s->cluster_size ||
3079             offset + bytes != bs->total_sectors << BDRV_SECTOR_BITS)
3080         {
3081             qemu_vfree(buf);
3082             return -EINVAL;
3083         }
3084         /* Zero-pad last write if image size is not cluster aligned */
3085         memset(buf + bytes, 0, s->cluster_size - bytes);
3086     }
3087     qemu_iovec_to_buf(qiov, 0, buf, bytes);
3088
3089     out_buf = g_malloc(s->cluster_size);
3090
3091     /* best compression, small window, no zlib header */
3092     memset(&strm, 0, sizeof(strm));
3093     ret = deflateInit2(&strm, Z_DEFAULT_COMPRESSION,
3094                        Z_DEFLATED, -12,
3095                        9, Z_DEFAULT_STRATEGY);
3096     if (ret != 0) {
3097         ret = -EINVAL;
3098         goto fail;
3099     }
3100
3101     strm.avail_in = s->cluster_size;
3102     strm.next_in = (uint8_t *)buf;
3103     strm.avail_out = s->cluster_size;
3104     strm.next_out = out_buf;
3105
3106     ret = deflate(&strm, Z_FINISH);
3107     if (ret != Z_STREAM_END && ret != Z_OK) {
3108         deflateEnd(&strm);
3109         ret = -EINVAL;
3110         goto fail;
3111     }
3112     out_len = strm.next_out - out_buf;
3113
3114     deflateEnd(&strm);
3115
3116     if (ret != Z_STREAM_END || out_len >= s->cluster_size) {
3117         /* could not compress: write normal cluster */
3118         ret = qcow2_co_pwritev(bs, offset, bytes, qiov, 0);
3119         if (ret < 0) {
3120             goto fail;
3121         }
3122         goto success;
3123     }
3124
3125     qemu_co_mutex_lock(&s->lock);
3126     cluster_offset =
3127         qcow2_alloc_compressed_cluster_offset(bs, offset, out_len);
3128     if (!cluster_offset) {
3129         qemu_co_mutex_unlock(&s->lock);
3130         ret = -EIO;
3131         goto fail;
3132     }
3133     cluster_offset &= s->cluster_offset_mask;
3134
3135     ret = qcow2_pre_write_overlap_check(bs, 0, cluster_offset, out_len);
3136     qemu_co_mutex_unlock(&s->lock);
3137     if (ret < 0) {
3138         goto fail;
3139     }
3140
3141     iov = (struct iovec) {
3142         .iov_base   = out_buf,
3143         .iov_len    = out_len,
3144     };
3145     qemu_iovec_init_external(&hd_qiov, &iov, 1);
3146
3147     BLKDBG_EVENT(bs->file, BLKDBG_WRITE_COMPRESSED);
3148     ret = bdrv_co_pwritev(bs->file, cluster_offset, out_len, &hd_qiov, 0);
3149     if (ret < 0) {
3150         goto fail;
3151     }
3152 success:
3153     ret = 0;
3154 fail:
3155     qemu_vfree(buf);
3156     g_free(out_buf);
3157     return ret;
3158 }
3159
3160 static int make_completely_empty(BlockDriverState *bs)
3161 {
3162     BDRVQcow2State *s = bs->opaque;
3163     Error *local_err = NULL;
3164     int ret, l1_clusters;
3165     int64_t offset;
3166     uint64_t *new_reftable = NULL;
3167     uint64_t rt_entry, l1_size2;
3168     struct {
3169         uint64_t l1_offset;
3170         uint64_t reftable_offset;
3171         uint32_t reftable_clusters;
3172     } QEMU_PACKED l1_ofs_rt_ofs_cls;
3173
3174     ret = qcow2_cache_empty(bs, s->l2_table_cache);
3175     if (ret < 0) {
3176         goto fail;
3177     }
3178
3179     ret = qcow2_cache_empty(bs, s->refcount_block_cache);
3180     if (ret < 0) {
3181         goto fail;
3182     }
3183
3184     /* Refcounts will be broken utterly */
3185     ret = qcow2_mark_dirty(bs);
3186     if (ret < 0) {
3187         goto fail;
3188     }
3189
3190     BLKDBG_EVENT(bs->file, BLKDBG_L1_UPDATE);
3191
3192     l1_clusters = DIV_ROUND_UP(s->l1_size, s->cluster_size / sizeof(uint64_t));
3193     l1_size2 = (uint64_t)s->l1_size * sizeof(uint64_t);
3194
3195     /* After this call, neither the in-memory nor the on-disk refcount
3196      * information accurately describe the actual references */
3197
3198     ret = bdrv_pwrite_zeroes(bs->file, s->l1_table_offset,
3199                              l1_clusters * s->cluster_size, 0);
3200     if (ret < 0) {
3201         goto fail_broken_refcounts;
3202     }
3203     memset(s->l1_table, 0, l1_size2);
3204
3205     BLKDBG_EVENT(bs->file, BLKDBG_EMPTY_IMAGE_PREPARE);
3206
3207     /* Overwrite enough clusters at the beginning of the sectors to place
3208      * the refcount table, a refcount block and the L1 table in; this may
3209      * overwrite parts of the existing refcount and L1 table, which is not
3210      * an issue because the dirty flag is set, complete data loss is in fact
3211      * desired and partial data loss is consequently fine as well */
3212     ret = bdrv_pwrite_zeroes(bs->file, s->cluster_size,
3213                              (2 + l1_clusters) * s->cluster_size, 0);
3214     /* This call (even if it failed overall) may have overwritten on-disk
3215      * refcount structures; in that case, the in-memory refcount information
3216      * will probably differ from the on-disk information which makes the BDS
3217      * unusable */
3218     if (ret < 0) {
3219         goto fail_broken_refcounts;
3220     }
3221
3222     BLKDBG_EVENT(bs->file, BLKDBG_L1_UPDATE);
3223     BLKDBG_EVENT(bs->file, BLKDBG_REFTABLE_UPDATE);
3224
3225     /* "Create" an empty reftable (one cluster) directly after the image
3226      * header and an empty L1 table three clusters after the image header;
3227      * the cluster between those two will be used as the first refblock */
3228     l1_ofs_rt_ofs_cls.l1_offset = cpu_to_be64(3 * s->cluster_size);
3229     l1_ofs_rt_ofs_cls.reftable_offset = cpu_to_be64(s->cluster_size);
3230     l1_ofs_rt_ofs_cls.reftable_clusters = cpu_to_be32(1);
3231     ret = bdrv_pwrite_sync(bs->file, offsetof(QCowHeader, l1_table_offset),
3232                            &l1_ofs_rt_ofs_cls, sizeof(l1_ofs_rt_ofs_cls));
3233     if (ret < 0) {
3234         goto fail_broken_refcounts;
3235     }
3236
3237     s->l1_table_offset = 3 * s->cluster_size;
3238
3239     new_reftable = g_try_new0(uint64_t, s->cluster_size / sizeof(uint64_t));
3240     if (!new_reftable) {
3241         ret = -ENOMEM;
3242         goto fail_broken_refcounts;
3243     }
3244
3245     s->refcount_table_offset = s->cluster_size;
3246     s->refcount_table_size   = s->cluster_size / sizeof(uint64_t);
3247     s->max_refcount_table_index = 0;
3248
3249     g_free(s->refcount_table);
3250     s->refcount_table = new_reftable;
3251     new_reftable = NULL;
3252
3253     /* Now the in-memory refcount information again corresponds to the on-disk
3254      * information (reftable is empty and no refblocks (the refblock cache is
3255      * empty)); however, this means some clusters (e.g. the image header) are
3256      * referenced, but not refcounted, but the normal qcow2 code assumes that
3257      * the in-memory information is always correct */
3258
3259     BLKDBG_EVENT(bs->file, BLKDBG_REFBLOCK_ALLOC);
3260
3261     /* Enter the first refblock into the reftable */
3262     rt_entry = cpu_to_be64(2 * s->cluster_size);
3263     ret = bdrv_pwrite_sync(bs->file, s->cluster_size,
3264                            &rt_entry, sizeof(rt_entry));
3265     if (ret < 0) {
3266         goto fail_broken_refcounts;
3267     }
3268     s->refcount_table[0] = 2 * s->cluster_size;
3269
3270     s->free_cluster_index = 0;
3271     assert(3 + l1_clusters <= s->refcount_block_size);
3272     offset = qcow2_alloc_clusters(bs, 3 * s->cluster_size + l1_size2);
3273     if (offset < 0) {
3274         ret = offset;
3275         goto fail_broken_refcounts;
3276     } else if (offset > 0) {
3277         error_report("First cluster in emptied image is in use");
3278         abort();
3279     }
3280
3281     /* Now finally the in-memory information corresponds to the on-disk
3282      * structures and is correct */
3283     ret = qcow2_mark_clean(bs);
3284     if (ret < 0) {
3285         goto fail;
3286     }
3287
3288     ret = bdrv_truncate(bs->file, (3 + l1_clusters) * s->cluster_size,
3289                         &local_err);
3290     if (ret < 0) {
3291         error_report_err(local_err);
3292         goto fail;
3293     }
3294
3295     return 0;
3296
3297 fail_broken_refcounts:
3298     /* The BDS is unusable at this point. If we wanted to make it usable, we
3299      * would have to call qcow2_refcount_close(), qcow2_refcount_init(),
3300      * qcow2_check_refcounts(), qcow2_refcount_close() and qcow2_refcount_init()
3301      * again. However, because the functions which could have caused this error
3302      * path to be taken are used by those functions as well, it's very likely
3303      * that that sequence will fail as well. Therefore, just eject the BDS. */
3304     bs->drv = NULL;
3305
3306 fail:
3307     g_free(new_reftable);
3308     return ret;
3309 }
3310
3311 static int qcow2_make_empty(BlockDriverState *bs)
3312 {
3313     BDRVQcow2State *s = bs->opaque;
3314     uint64_t offset, end_offset;
3315     int step = QEMU_ALIGN_DOWN(INT_MAX, s->cluster_size);
3316     int l1_clusters, ret = 0;
3317
3318     l1_clusters = DIV_ROUND_UP(s->l1_size, s->cluster_size / sizeof(uint64_t));
3319
3320     if (s->qcow_version >= 3 && !s->snapshots &&
3321         3 + l1_clusters <= s->refcount_block_size) {
3322         /* The following function only works for qcow2 v3 images (it requires
3323          * the dirty flag) and only as long as there are no snapshots (because
3324          * it completely empties the image). Furthermore, the L1 table and three
3325          * additional clusters (image header, refcount table, one refcount
3326          * block) have to fit inside one refcount block. */
3327         return make_completely_empty(bs);
3328     }
3329
3330     /* This fallback code simply discards every active cluster; this is slow,
3331      * but works in all cases */
3332     end_offset = bs->total_sectors * BDRV_SECTOR_SIZE;
3333     for (offset = 0; offset < end_offset; offset += step) {
3334         /* As this function is generally used after committing an external
3335          * snapshot, QCOW2_DISCARD_SNAPSHOT seems appropriate. Also, the
3336          * default action for this kind of discard is to pass the discard,
3337          * which will ideally result in an actually smaller image file, as
3338          * is probably desired. */
3339         ret = qcow2_cluster_discard(bs, offset, MIN(step, end_offset - offset),
3340                                     QCOW2_DISCARD_SNAPSHOT, true);
3341         if (ret < 0) {
3342             break;
3343         }
3344     }
3345
3346     return ret;
3347 }
3348
3349 static coroutine_fn int qcow2_co_flush_to_os(BlockDriverState *bs)
3350 {
3351     BDRVQcow2State *s = bs->opaque;
3352     int ret;
3353
3354     qemu_co_mutex_lock(&s->lock);
3355     ret = qcow2_cache_write(bs, s->l2_table_cache);
3356     if (ret < 0) {
3357         qemu_co_mutex_unlock(&s->lock);
3358         return ret;
3359     }
3360
3361     if (qcow2_need_accurate_refcounts(s)) {
3362         ret = qcow2_cache_write(bs, s->refcount_block_cache);
3363         if (ret < 0) {
3364             qemu_co_mutex_unlock(&s->lock);
3365             return ret;
3366         }
3367     }
3368     qemu_co_mutex_unlock(&s->lock);
3369
3370     return 0;
3371 }
3372
3373 static int qcow2_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
3374 {
3375     BDRVQcow2State *s = bs->opaque;
3376     bdi->unallocated_blocks_are_zero = true;
3377     bdi->can_write_zeroes_with_unmap = (s->qcow_version >= 3);
3378     bdi->cluster_size = s->cluster_size;
3379     bdi->vm_state_offset = qcow2_vm_state_offset(s);
3380     return 0;
3381 }
3382
3383 static ImageInfoSpecific *qcow2_get_specific_info(BlockDriverState *bs)
3384 {
3385     BDRVQcow2State *s = bs->opaque;
3386     ImageInfoSpecific *spec_info;
3387     QCryptoBlockInfo *encrypt_info = NULL;
3388
3389     if (s->crypto != NULL) {
3390         encrypt_info = qcrypto_block_get_info(s->crypto, &error_abort);
3391     }
3392
3393     spec_info = g_new(ImageInfoSpecific, 1);
3394     *spec_info = (ImageInfoSpecific){
3395         .type  = IMAGE_INFO_SPECIFIC_KIND_QCOW2,
3396         .u.qcow2.data = g_new(ImageInfoSpecificQCow2, 1),
3397     };
3398     if (s->qcow_version == 2) {
3399         *spec_info->u.qcow2.data = (ImageInfoSpecificQCow2){
3400             .compat             = g_strdup("0.10"),
3401             .refcount_bits      = s->refcount_bits,
3402         };
3403     } else if (s->qcow_version == 3) {
3404         *spec_info->u.qcow2.data = (ImageInfoSpecificQCow2){
3405             .compat             = g_strdup("1.1"),
3406             .lazy_refcounts     = s->compatible_features &
3407                                   QCOW2_COMPAT_LAZY_REFCOUNTS,
3408             .has_lazy_refcounts = true,
3409             .corrupt            = s->incompatible_features &
3410                                   QCOW2_INCOMPAT_CORRUPT,
3411             .has_corrupt        = true,
3412             .refcount_bits      = s->refcount_bits,
3413         };
3414     } else {
3415         /* if this assertion fails, this probably means a new version was
3416          * added without having it covered here */
3417         assert(false);
3418     }
3419
3420     if (encrypt_info) {
3421         ImageInfoSpecificQCow2Encryption *qencrypt =
3422             g_new(ImageInfoSpecificQCow2Encryption, 1);
3423         switch (encrypt_info->format) {
3424         case Q_CRYPTO_BLOCK_FORMAT_QCOW:
3425             qencrypt->format = BLOCKDEV_QCOW2_ENCRYPTION_FORMAT_AES;
3426             qencrypt->u.aes = encrypt_info->u.qcow;
3427             break;
3428         case Q_CRYPTO_BLOCK_FORMAT_LUKS:
3429             qencrypt->format = BLOCKDEV_QCOW2_ENCRYPTION_FORMAT_LUKS;
3430             qencrypt->u.luks = encrypt_info->u.luks;
3431             break;
3432         default:
3433             abort();
3434         }
3435         /* Since we did shallow copy above, erase any pointers
3436          * in the original info */
3437         memset(&encrypt_info->u, 0, sizeof(encrypt_info->u));
3438         qapi_free_QCryptoBlockInfo(encrypt_info);
3439
3440         spec_info->u.qcow2.data->has_encrypt = true;
3441         spec_info->u.qcow2.data->encrypt = qencrypt;
3442     }
3443
3444     return spec_info;
3445 }
3446
3447 #if 0
3448 static void dump_refcounts(BlockDriverState *bs)
3449 {
3450     BDRVQcow2State *s = bs->opaque;
3451     int64_t nb_clusters, k, k1, size;
3452     int refcount;
3453
3454     size = bdrv_getlength(bs->file->bs);
3455     nb_clusters = size_to_clusters(s, size);
3456     for(k = 0; k < nb_clusters;) {
3457         k1 = k;
3458         refcount = get_refcount(bs, k);
3459         k++;
3460         while (k < nb_clusters && get_refcount(bs, k) == refcount)
3461             k++;
3462         printf("%" PRId64 ": refcount=%d nb=%" PRId64 "\n", k, refcount,
3463                k - k1);
3464     }
3465 }
3466 #endif
3467
3468 static int qcow2_save_vmstate(BlockDriverState *bs, QEMUIOVector *qiov,
3469                               int64_t pos)
3470 {
3471     BDRVQcow2State *s = bs->opaque;
3472
3473     BLKDBG_EVENT(bs->file, BLKDBG_VMSTATE_SAVE);
3474     return bs->drv->bdrv_co_pwritev(bs, qcow2_vm_state_offset(s) + pos,
3475                                     qiov->size, qiov, 0);
3476 }
3477
3478 static int qcow2_load_vmstate(BlockDriverState *bs, QEMUIOVector *qiov,
3479                               int64_t pos)
3480 {
3481     BDRVQcow2State *s = bs->opaque;
3482
3483     BLKDBG_EVENT(bs->file, BLKDBG_VMSTATE_LOAD);
3484     return bs->drv->bdrv_co_preadv(bs, qcow2_vm_state_offset(s) + pos,
3485                                    qiov->size, qiov, 0);
3486 }
3487
3488 /*
3489  * Downgrades an image's version. To achieve this, any incompatible features
3490  * have to be removed.
3491  */
3492 static int qcow2_downgrade(BlockDriverState *bs, int target_version,
3493                            BlockDriverAmendStatusCB *status_cb, void *cb_opaque)
3494 {
3495     BDRVQcow2State *s = bs->opaque;
3496     int current_version = s->qcow_version;
3497     int ret;
3498
3499     if (target_version == current_version) {
3500         return 0;
3501     } else if (target_version > current_version) {
3502         return -EINVAL;
3503     } else if (target_version != 2) {
3504         return -EINVAL;
3505     }
3506
3507     if (s->refcount_order != 4) {
3508         error_report("compat=0.10 requires refcount_bits=16");
3509         return -ENOTSUP;
3510     }
3511
3512     /* clear incompatible features */
3513     if (s->incompatible_features & QCOW2_INCOMPAT_DIRTY) {
3514         ret = qcow2_mark_clean(bs);
3515         if (ret < 0) {
3516             return ret;
3517         }
3518     }
3519
3520     /* with QCOW2_INCOMPAT_CORRUPT, it is pretty much impossible to get here in
3521      * the first place; if that happens nonetheless, returning -ENOTSUP is the
3522      * best thing to do anyway */
3523
3524     if (s->incompatible_features) {
3525         return -ENOTSUP;
3526     }
3527
3528     /* since we can ignore compatible features, we can set them to 0 as well */
3529     s->compatible_features = 0;
3530     /* if lazy refcounts have been used, they have already been fixed through
3531      * clearing the dirty flag */
3532
3533     /* clearing autoclear features is trivial */
3534     s->autoclear_features = 0;
3535
3536     ret = qcow2_expand_zero_clusters(bs, status_cb, cb_opaque);
3537     if (ret < 0) {
3538         return ret;
3539     }
3540
3541     s->qcow_version = target_version;
3542     ret = qcow2_update_header(bs);
3543     if (ret < 0) {
3544         s->qcow_version = current_version;
3545         return ret;
3546     }
3547     return 0;
3548 }
3549
3550 typedef enum Qcow2AmendOperation {
3551     /* This is the value Qcow2AmendHelperCBInfo::last_operation will be
3552      * statically initialized to so that the helper CB can discern the first
3553      * invocation from an operation change */
3554     QCOW2_NO_OPERATION = 0,
3555
3556     QCOW2_CHANGING_REFCOUNT_ORDER,
3557     QCOW2_DOWNGRADING,
3558 } Qcow2AmendOperation;
3559
3560 typedef struct Qcow2AmendHelperCBInfo {
3561     /* The code coordinating the amend operations should only modify
3562      * these four fields; the rest will be managed by the CB */
3563     BlockDriverAmendStatusCB *original_status_cb;
3564     void *original_cb_opaque;
3565
3566     Qcow2AmendOperation current_operation;
3567
3568     /* Total number of operations to perform (only set once) */
3569     int total_operations;
3570
3571     /* The following fields are managed by the CB */
3572
3573     /* Number of operations completed */
3574     int operations_completed;
3575
3576     /* Cumulative offset of all completed operations */
3577     int64_t offset_completed;
3578
3579     Qcow2AmendOperation last_operation;
3580     int64_t last_work_size;
3581 } Qcow2AmendHelperCBInfo;
3582
3583 static void qcow2_amend_helper_cb(BlockDriverState *bs,
3584                                   int64_t operation_offset,
3585                                   int64_t operation_work_size, void *opaque)
3586 {
3587     Qcow2AmendHelperCBInfo *info = opaque;
3588     int64_t current_work_size;
3589     int64_t projected_work_size;
3590
3591     if (info->current_operation != info->last_operation) {
3592         if (info->last_operation != QCOW2_NO_OPERATION) {
3593             info->offset_completed += info->last_work_size;
3594             info->operations_completed++;
3595         }
3596
3597         info->last_operation = info->current_operation;
3598     }
3599
3600     assert(info->total_operations > 0);
3601     assert(info->operations_completed < info->total_operations);
3602
3603     info->last_work_size = operation_work_size;
3604
3605     current_work_size = info->offset_completed + operation_work_size;
3606
3607     /* current_work_size is the total work size for (operations_completed + 1)
3608      * operations (which includes this one), so multiply it by the number of
3609      * operations not covered and divide it by the number of operations
3610      * covered to get a projection for the operations not covered */
3611     projected_work_size = current_work_size * (info->total_operations -
3612                                                info->operations_completed - 1)
3613                                             / (info->operations_completed + 1);
3614
3615     info->original_status_cb(bs, info->offset_completed + operation_offset,
3616                              current_work_size + projected_work_size,
3617                              info->original_cb_opaque);
3618 }
3619
3620 static int qcow2_amend_options(BlockDriverState *bs, QemuOpts *opts,
3621                                BlockDriverAmendStatusCB *status_cb,
3622                                void *cb_opaque)
3623 {
3624     BDRVQcow2State *s = bs->opaque;
3625     int old_version = s->qcow_version, new_version = old_version;
3626     uint64_t new_size = 0;
3627     const char *backing_file = NULL, *backing_format = NULL;
3628     bool lazy_refcounts = s->use_lazy_refcounts;
3629     const char *compat = NULL;
3630     uint64_t cluster_size = s->cluster_size;
3631     bool encrypt;
3632     int encformat;
3633     int refcount_bits = s->refcount_bits;
3634     Error *local_err = NULL;
3635     int ret;
3636     QemuOptDesc *desc = opts->list->desc;
3637     Qcow2AmendHelperCBInfo helper_cb_info;
3638
3639     while (desc && desc->name) {
3640         if (!qemu_opt_find(opts, desc->name)) {
3641             /* only change explicitly defined options */
3642             desc++;
3643             continue;
3644         }
3645
3646         if (!strcmp(desc->name, BLOCK_OPT_COMPAT_LEVEL)) {
3647             compat = qemu_opt_get(opts, BLOCK_OPT_COMPAT_LEVEL);
3648             if (!compat) {
3649                 /* preserve default */
3650             } else if (!strcmp(compat, "0.10")) {
3651                 new_version = 2;
3652             } else if (!strcmp(compat, "1.1")) {
3653                 new_version = 3;
3654             } else {
3655                 error_report("Unknown compatibility level %s", compat);
3656                 return -EINVAL;
3657             }
3658         } else if (!strcmp(desc->name, BLOCK_OPT_PREALLOC)) {
3659             error_report("Cannot change preallocation mode");
3660             return -ENOTSUP;
3661         } else if (!strcmp(desc->name, BLOCK_OPT_SIZE)) {
3662             new_size = qemu_opt_get_size(opts, BLOCK_OPT_SIZE, 0);
3663         } else if (!strcmp(desc->name, BLOCK_OPT_BACKING_FILE)) {
3664             backing_file = qemu_opt_get(opts, BLOCK_OPT_BACKING_FILE);
3665         } else if (!strcmp(desc->name, BLOCK_OPT_BACKING_FMT)) {
3666             backing_format = qemu_opt_get(opts, BLOCK_OPT_BACKING_FMT);
3667         } else if (!strcmp(desc->name, BLOCK_OPT_ENCRYPT)) {
3668             encrypt = qemu_opt_get_bool(opts, BLOCK_OPT_ENCRYPT,
3669                                         !!s->crypto);
3670
3671             if (encrypt != !!s->crypto) {
3672                 error_report("Changing the encryption flag is not supported");
3673                 return -ENOTSUP;
3674             }
3675         } else if (!strcmp(desc->name, BLOCK_OPT_ENCRYPT_FORMAT)) {
3676             encformat = qcow2_crypt_method_from_format(
3677                 qemu_opt_get(opts, BLOCK_OPT_ENCRYPT_FORMAT));
3678
3679             if (encformat != s->crypt_method_header) {
3680                 error_report("Changing the encryption format is not supported");
3681                 return -ENOTSUP;
3682             }
3683         } else if (!strcmp(desc->name, BLOCK_OPT_CLUSTER_SIZE)) {
3684             cluster_size = qemu_opt_get_size(opts, BLOCK_OPT_CLUSTER_SIZE,
3685                                              cluster_size);
3686             if (cluster_size != s->cluster_size) {
3687                 error_report("Changing the cluster size is not supported");
3688                 return -ENOTSUP;
3689             }
3690         } else if (!strcmp(desc->name, BLOCK_OPT_LAZY_REFCOUNTS)) {
3691             lazy_refcounts = qemu_opt_get_bool(opts, BLOCK_OPT_LAZY_REFCOUNTS,
3692                                                lazy_refcounts);
3693         } else if (!strcmp(desc->name, BLOCK_OPT_REFCOUNT_BITS)) {
3694             refcount_bits = qemu_opt_get_number(opts, BLOCK_OPT_REFCOUNT_BITS,
3695                                                 refcount_bits);
3696
3697             if (refcount_bits <= 0 || refcount_bits > 64 ||
3698                 !is_power_of_2(refcount_bits))
3699             {
3700                 error_report("Refcount width must be a power of two and may "
3701                              "not exceed 64 bits");
3702                 return -EINVAL;
3703             }
3704         } else {
3705             /* if this point is reached, this probably means a new option was
3706              * added without having it covered here */
3707             abort();
3708         }
3709
3710         desc++;
3711     }
3712
3713     helper_cb_info = (Qcow2AmendHelperCBInfo){
3714         .original_status_cb = status_cb,
3715         .original_cb_opaque = cb_opaque,
3716         .total_operations = (new_version < old_version)
3717                           + (s->refcount_bits != refcount_bits)
3718     };
3719
3720     /* Upgrade first (some features may require compat=1.1) */
3721     if (new_version > old_version) {
3722         s->qcow_version = new_version;
3723         ret = qcow2_update_header(bs);
3724         if (ret < 0) {
3725             s->qcow_version = old_version;
3726             return ret;
3727         }
3728     }
3729
3730     if (s->refcount_bits != refcount_bits) {
3731         int refcount_order = ctz32(refcount_bits);
3732
3733         if (new_version < 3 && refcount_bits != 16) {
3734             error_report("Different refcount widths than 16 bits require "
3735                          "compatibility level 1.1 or above (use compat=1.1 or "
3736                          "greater)");
3737             return -EINVAL;
3738         }
3739
3740         helper_cb_info.current_operation = QCOW2_CHANGING_REFCOUNT_ORDER;
3741         ret = qcow2_change_refcount_order(bs, refcount_order,
3742                                           &qcow2_amend_helper_cb,
3743                                           &helper_cb_info, &local_err);
3744         if (ret < 0) {
3745             error_report_err(local_err);
3746             return ret;
3747         }
3748     }
3749
3750     if (backing_file || backing_format) {
3751         ret = qcow2_change_backing_file(bs,
3752                     backing_file ?: s->image_backing_file,
3753                     backing_format ?: s->image_backing_format);
3754         if (ret < 0) {
3755             return ret;
3756         }
3757     }
3758
3759     if (s->use_lazy_refcounts != lazy_refcounts) {
3760         if (lazy_refcounts) {
3761             if (new_version < 3) {
3762                 error_report("Lazy refcounts only supported with compatibility "
3763                              "level 1.1 and above (use compat=1.1 or greater)");
3764                 return -EINVAL;
3765             }
3766             s->compatible_features |= QCOW2_COMPAT_LAZY_REFCOUNTS;
3767             ret = qcow2_update_header(bs);
3768             if (ret < 0) {
3769                 s->compatible_features &= ~QCOW2_COMPAT_LAZY_REFCOUNTS;
3770                 return ret;
3771             }
3772             s->use_lazy_refcounts = true;
3773         } else {
3774             /* make image clean first */
3775             ret = qcow2_mark_clean(bs);
3776             if (ret < 0) {
3777                 return ret;
3778             }
3779             /* now disallow lazy refcounts */
3780             s->compatible_features &= ~QCOW2_COMPAT_LAZY_REFCOUNTS;
3781             ret = qcow2_update_header(bs);
3782             if (ret < 0) {
3783                 s->compatible_features |= QCOW2_COMPAT_LAZY_REFCOUNTS;
3784                 return ret;
3785             }
3786             s->use_lazy_refcounts = false;
3787         }
3788     }
3789
3790     if (new_size) {
3791         BlockBackend *blk = blk_new(BLK_PERM_RESIZE, BLK_PERM_ALL);
3792         ret = blk_insert_bs(blk, bs, &local_err);
3793         if (ret < 0) {
3794             error_report_err(local_err);
3795             blk_unref(blk);
3796             return ret;
3797         }
3798
3799         ret = blk_truncate(blk, new_size, &local_err);
3800         blk_unref(blk);
3801         if (ret < 0) {
3802             error_report_err(local_err);
3803             return ret;
3804         }
3805     }
3806
3807     /* Downgrade last (so unsupported features can be removed before) */
3808     if (new_version < old_version) {
3809         helper_cb_info.current_operation = QCOW2_DOWNGRADING;
3810         ret = qcow2_downgrade(bs, new_version, &qcow2_amend_helper_cb,
3811                               &helper_cb_info);
3812         if (ret < 0) {
3813             return ret;
3814         }
3815     }
3816
3817     return 0;
3818 }
3819
3820 /*
3821  * If offset or size are negative, respectively, they will not be included in
3822  * the BLOCK_IMAGE_CORRUPTED event emitted.
3823  * fatal will be ignored for read-only BDS; corruptions found there will always
3824  * be considered non-fatal.
3825  */
3826 void qcow2_signal_corruption(BlockDriverState *bs, bool fatal, int64_t offset,
3827                              int64_t size, const char *message_format, ...)
3828 {
3829     BDRVQcow2State *s = bs->opaque;
3830     const char *node_name;
3831     char *message;
3832     va_list ap;
3833
3834     fatal = fatal && !bs->read_only;
3835
3836     if (s->signaled_corruption &&
3837         (!fatal || (s->incompatible_features & QCOW2_INCOMPAT_CORRUPT)))
3838     {
3839         return;
3840     }
3841
3842     va_start(ap, message_format);
3843     message = g_strdup_vprintf(message_format, ap);
3844     va_end(ap);
3845
3846     if (fatal) {
3847         fprintf(stderr, "qcow2: Marking image as corrupt: %s; further "
3848                 "corruption events will be suppressed\n", message);
3849     } else {
3850         fprintf(stderr, "qcow2: Image is corrupt: %s; further non-fatal "
3851                 "corruption events will be suppressed\n", message);
3852     }
3853
3854     node_name = bdrv_get_node_name(bs);
3855     qapi_event_send_block_image_corrupted(bdrv_get_device_name(bs),
3856                                           *node_name != '\0', node_name,
3857                                           message, offset >= 0, offset,
3858                                           size >= 0, size,
3859                                           fatal, &error_abort);
3860     g_free(message);
3861
3862     if (fatal) {
3863         qcow2_mark_corrupt(bs);
3864         bs->drv = NULL; /* make BDS unusable */
3865     }
3866
3867     s->signaled_corruption = true;
3868 }
3869
3870 static QemuOptsList qcow2_create_opts = {
3871     .name = "qcow2-create-opts",
3872     .head = QTAILQ_HEAD_INITIALIZER(qcow2_create_opts.head),
3873     .desc = {
3874         {
3875             .name = BLOCK_OPT_SIZE,
3876             .type = QEMU_OPT_SIZE,
3877             .help = "Virtual disk size"
3878         },
3879         {
3880             .name = BLOCK_OPT_COMPAT_LEVEL,
3881             .type = QEMU_OPT_STRING,
3882             .help = "Compatibility level (0.10 or 1.1)"
3883         },
3884         {
3885             .name = BLOCK_OPT_BACKING_FILE,
3886             .type = QEMU_OPT_STRING,
3887             .help = "File name of a base image"
3888         },
3889         {
3890             .name = BLOCK_OPT_BACKING_FMT,
3891             .type = QEMU_OPT_STRING,
3892             .help = "Image format of the base image"
3893         },
3894         {
3895             .name = BLOCK_OPT_ENCRYPT,
3896             .type = QEMU_OPT_BOOL,
3897             .help = "Encrypt the image with format 'aes'. (Deprecated "
3898                     "in favor of " BLOCK_OPT_ENCRYPT_FORMAT "=aes)",
3899         },
3900         {
3901             .name = BLOCK_OPT_ENCRYPT_FORMAT,
3902             .type = QEMU_OPT_STRING,
3903             .help = "Encrypt the image, format choices: 'aes', 'luks'",
3904         },
3905         BLOCK_CRYPTO_OPT_DEF_KEY_SECRET("encrypt.",
3906             "ID of secret providing qcow AES key or LUKS passphrase"),
3907         BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_ALG("encrypt."),
3908         BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_MODE("encrypt."),
3909         BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_ALG("encrypt."),
3910         BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_HASH_ALG("encrypt."),
3911         BLOCK_CRYPTO_OPT_DEF_LUKS_HASH_ALG("encrypt."),
3912         BLOCK_CRYPTO_OPT_DEF_LUKS_ITER_TIME("encrypt."),
3913         {
3914             .name = BLOCK_OPT_CLUSTER_SIZE,
3915             .type = QEMU_OPT_SIZE,
3916             .help = "qcow2 cluster size",
3917             .def_value_str = stringify(DEFAULT_CLUSTER_SIZE)
3918         },
3919         {
3920             .name = BLOCK_OPT_PREALLOC,
3921             .type = QEMU_OPT_STRING,
3922             .help = "Preallocation mode (allowed values: off, metadata, "
3923                     "falloc, full)"
3924         },
3925         {
3926             .name = BLOCK_OPT_LAZY_REFCOUNTS,
3927             .type = QEMU_OPT_BOOL,
3928             .help = "Postpone refcount updates",
3929             .def_value_str = "off"
3930         },
3931         {
3932             .name = BLOCK_OPT_REFCOUNT_BITS,
3933             .type = QEMU_OPT_NUMBER,
3934             .help = "Width of a reference count entry in bits",
3935             .def_value_str = "16"
3936         },
3937         { /* end of list */ }
3938     }
3939 };
3940
3941 BlockDriver bdrv_qcow2 = {
3942     .format_name        = "qcow2",
3943     .instance_size      = sizeof(BDRVQcow2State),
3944     .bdrv_probe         = qcow2_probe,
3945     .bdrv_open          = qcow2_open,
3946     .bdrv_close         = qcow2_close,
3947     .bdrv_reopen_prepare  = qcow2_reopen_prepare,
3948     .bdrv_reopen_commit   = qcow2_reopen_commit,
3949     .bdrv_reopen_abort    = qcow2_reopen_abort,
3950     .bdrv_join_options    = qcow2_join_options,
3951     .bdrv_child_perm      = bdrv_format_default_perms,
3952     .bdrv_create        = qcow2_create,
3953     .bdrv_has_zero_init = bdrv_has_zero_init_1,
3954     .bdrv_co_get_block_status = qcow2_co_get_block_status,
3955
3956     .bdrv_co_preadv         = qcow2_co_preadv,
3957     .bdrv_co_pwritev        = qcow2_co_pwritev,
3958     .bdrv_co_flush_to_os    = qcow2_co_flush_to_os,
3959
3960     .bdrv_co_pwrite_zeroes  = qcow2_co_pwrite_zeroes,
3961     .bdrv_co_pdiscard       = qcow2_co_pdiscard,
3962     .bdrv_truncate          = qcow2_truncate,
3963     .bdrv_co_pwritev_compressed = qcow2_co_pwritev_compressed,
3964     .bdrv_make_empty        = qcow2_make_empty,
3965
3966     .bdrv_snapshot_create   = qcow2_snapshot_create,
3967     .bdrv_snapshot_goto     = qcow2_snapshot_goto,
3968     .bdrv_snapshot_delete   = qcow2_snapshot_delete,
3969     .bdrv_snapshot_list     = qcow2_snapshot_list,
3970     .bdrv_snapshot_load_tmp = qcow2_snapshot_load_tmp,
3971     .bdrv_get_info          = qcow2_get_info,
3972     .bdrv_get_specific_info = qcow2_get_specific_info,
3973
3974     .bdrv_save_vmstate    = qcow2_save_vmstate,
3975     .bdrv_load_vmstate    = qcow2_load_vmstate,
3976
3977     .supports_backing           = true,
3978     .bdrv_change_backing_file   = qcow2_change_backing_file,
3979
3980     .bdrv_refresh_limits        = qcow2_refresh_limits,
3981     .bdrv_invalidate_cache      = qcow2_invalidate_cache,
3982     .bdrv_inactivate            = qcow2_inactivate,
3983
3984     .create_opts         = &qcow2_create_opts,
3985     .bdrv_check          = qcow2_check,
3986     .bdrv_amend_options  = qcow2_amend_options,
3987
3988     .bdrv_detach_aio_context  = qcow2_detach_aio_context,
3989     .bdrv_attach_aio_context  = qcow2_attach_aio_context,
3990
3991     .bdrv_reopen_bitmaps_rw = qcow2_reopen_bitmaps_rw,
3992     .bdrv_can_store_new_dirty_bitmap = qcow2_can_store_new_dirty_bitmap,
3993     .bdrv_remove_persistent_dirty_bitmap = qcow2_remove_persistent_dirty_bitmap,
3994 };
3995
3996 static void bdrv_qcow2_init(void)
3997 {
3998     bdrv_register(&bdrv_qcow2);
3999 }
4000
4001 block_init(bdrv_qcow2_init);