block/vvfat.c

   1 /* vim:set shiftwidth=4 ts=4: */
   2 /*
   3  * QEMU Block driver for virtual VFAT (shadows a local directory)
   4  *
   5  * Copyright (c) 2004,2005 Johannes E. Schindelin
   6  *
   7  * Permission is hereby granted, free of charge, to any person obtaining a copy
   8  * of this software and associated documentation files (the "Software"), to deal
   9  * in the Software without restriction, including without limitation the rights
  10  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  11  * copies of the Software, and to permit persons to whom the Software is
  12  * furnished to do so, subject to the following conditions:
  13  *
  14  * The above copyright notice and this permission notice shall be included in
  15  * all copies or substantial portions of the Software.
  16  *
  17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  20  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  23  * THE SOFTWARE.
  24  */
  25 #include "qemu/osdep.h"
  26 #include <dirent.h>
  27 #include "qapi/error.h"
  28 #include "block/block_int.h"
  29 #include "qemu/module.h"
  30 #include "qemu/bswap.h"
  31 #include "migration/blocker.h"
  32 #include "qapi/qmp/qbool.h"
  33 #include "qapi/qmp/qstring.h"
  34 #include "qemu/cutils.h"
  35
  36 #ifndef S_IWGRP
  37 #define S_IWGRP 0
  38 #endif
  39 #ifndef S_IWOTH
  40 #define S_IWOTH 0
  41 #endif
  42
  43 /* TODO: add ":bootsector=blabla.img:" */
  44 /* LATER TODO: add automatic boot sector generation from
  45     BOOTEASY.ASM and Ranish Partition Manager
  46     Note that DOS assumes the system files to be the first files in the
  47     file system (test if the boot sector still relies on that fact)! */
  48 /* MAYBE TODO: write block-visofs.c */
  49 /* TODO: call try_commit() only after a timeout */
  50
  51 /* #define DEBUG */
  52
  53 #ifdef DEBUG
  54
  55 #define DLOG(a) a
  56
  57 static void checkpoint(void);
  58
  59 #ifdef __MINGW32__
  60 void nonono(const char* file, int line, const char* msg) {
  61     fprintf(stderr, "Nonono! %s:%d %s\n", file, line, msg);
  62     exit(-5);
  63 }
  64 #undef assert
  65 #define assert(a) do {if (!(a)) nonono(__FILE__, __LINE__, #a);}while(0)
  66 #endif
  67
  68 #else
  69
  70 #define DLOG(a)
  71
  72 #endif
  73
  74 /* dynamic array functions */
  75 typedef struct array_t {
  76     char* pointer;
  77     unsigned int size,next,item_size;
  78 } array_t;
  79
  80 static inline void array_init(array_t* array,unsigned int item_size)
  81 {
  82     array->pointer = NULL;
  83     array->size=0;
  84     array->next=0;
  85     array->item_size=item_size;
  86 }
  87
  88 static inline void array_free(array_t* array)
  89 {
  90     g_free(array->pointer);
  91     array->size=array->next=0;
  92 }
  93
  94 /* does not automatically grow */
  95 static inline void* array_get(array_t* array,unsigned int index) {
  96     assert(index < array->next);
  97     return array->pointer + index * array->item_size;
  98 }
  99
 100 static inline int array_ensure_allocated(array_t* array, int index)
 101 {
 102     if((index + 1) * array->item_size > array->size) {
 103         int new_size = (index + 32) * array->item_size;
 104         array->pointer = g_realloc(array->pointer, new_size);
 105         if (!array->pointer)
 106             return -1;
 107         array->size = new_size;
 108         array->next = index + 1;
 109     }
 110
 111     return 0;
 112 }
 113
 114 static inline void* array_get_next(array_t* array) {
 115     unsigned int next = array->next;
 116
 117     if (array_ensure_allocated(array, next) < 0)
 118         return NULL;
 119
 120     array->next = next + 1;
 121     return array_get(array, next);
 122 }
 123
 124 static inline void* array_insert(array_t* array,unsigned int index,unsigned int count) {
 125     if((array->next+count)*array->item_size>array->size) {
 126         int increment=count*array->item_size;
 127         array->pointer=g_realloc(array->pointer,array->size+increment);
 128         if(!array->pointer)
 129             return NULL;
 130         array->size+=increment;
 131     }
 132     memmove(array->pointer+(index+count)*array->item_size,
 133                 array->pointer+index*array->item_size,
 134                 (array->next-index)*array->item_size);
 135     array->next+=count;
 136     return array->pointer+index*array->item_size;
 137 }
 138
 139 /* this performs a "roll", so that the element which was at index_from becomes
 140  * index_to, but the order of all other elements is preserved. */
 141 static inline int array_roll(array_t* array,int index_to,int index_from,int count)
 142 {
 143     char* buf;
 144     char* from;
 145     char* to;
 146     int is;
 147
 148     if(!array ||
 149             index_to<0 || index_to>=array->next ||
 150             index_from<0 || index_from>=array->next)
 151         return -1;
 152
 153     if(index_to==index_from)
 154         return 0;
 155
 156     is=array->item_size;
 157     from=array->pointer+index_from*is;
 158     to=array->pointer+index_to*is;
 159     buf=g_malloc(is*count);
 160     memcpy(buf,from,is*count);
 161
 162     if(index_to<index_from)
 163         memmove(to+is*count,to,from-to);
 164     else
 165         memmove(from,from+is*count,to-from);
 166
 167     memcpy(to,buf,is*count);
 168
 169     g_free(buf);
 170
 171     return 0;
 172 }
 173
 174 static inline int array_remove_slice(array_t* array,int index, int count)
 175 {
 176     assert(index >=0);
 177     assert(count > 0);
 178     assert(index + count <= array->next);
 179     if(array_roll(array,array->next-1,index,count))
 180         return -1;
 181     array->next -= count;
 182     return 0;
 183 }
 184
 185 static int array_remove(array_t* array,int index)
 186 {
 187     return array_remove_slice(array, index, 1);
 188 }
 189
 190 /* return the index for a given member */
 191 static int array_index(array_t* array, void* pointer)
 192 {
 193     size_t offset = (char*)pointer - array->pointer;
 194     assert((offset % array->item_size) == 0);
 195     assert(offset/array->item_size < array->next);
 196     return offset/array->item_size;
 197 }
 198
 199 /* These structures are used to fake a disk and the VFAT filesystem.
 200  * For this reason we need to use QEMU_PACKED. */
 201
 202 typedef struct bootsector_t {
 203     uint8_t jump[3];
 204     uint8_t name[8];
 205     uint16_t sector_size;
 206     uint8_t sectors_per_cluster;
 207     uint16_t reserved_sectors;
 208     uint8_t number_of_fats;
 209     uint16_t root_entries;
 210     uint16_t total_sectors16;
 211     uint8_t media_type;
 212     uint16_t sectors_per_fat;
 213     uint16_t sectors_per_track;
 214     uint16_t number_of_heads;
 215     uint32_t hidden_sectors;
 216     uint32_t total_sectors;
 217     union {
 218         struct {
 219             uint8_t drive_number;
 220             uint8_t reserved1;
 221             uint8_t signature;
 222             uint32_t id;
 223             uint8_t volume_label[11];
 224             uint8_t fat_type[8];
 225             uint8_t ignored[0x1c0];
 226         } QEMU_PACKED fat16;
 227         struct {
 228             uint32_t sectors_per_fat;
 229             uint16_t flags;
 230             uint8_t major,minor;
 231             uint32_t first_cluster_of_root_dir;
 232             uint16_t info_sector;
 233             uint16_t backup_boot_sector;
 234             uint8_t reserved[12];
 235             uint8_t drive_number;
 236             uint8_t reserved1;
 237             uint8_t signature;
 238             uint32_t id;
 239             uint8_t volume_label[11];
 240             uint8_t fat_type[8];
 241             uint8_t ignored[0x1a4];
 242         } QEMU_PACKED fat32;
 243     } u;
 244     uint8_t magic[2];
 245 } QEMU_PACKED bootsector_t;
 246
 247 typedef struct {
 248     uint8_t head;
 249     uint8_t sector;
 250     uint8_t cylinder;
 251 } mbr_chs_t;
 252
 253 typedef struct partition_t {
 254     uint8_t attributes; /* 0x80 = bootable */
 255     mbr_chs_t start_CHS;
 256     uint8_t   fs_type; /* 0x1 = FAT12, 0x6 = FAT16, 0xe = FAT16_LBA, 0xb = FAT32, 0xc = FAT32_LBA */
 257     mbr_chs_t end_CHS;
 258     uint32_t start_sector_long;
 259     uint32_t length_sector_long;
 260 } QEMU_PACKED partition_t;
 261
 262 typedef struct mbr_t {
 263     uint8_t ignored[0x1b8];
 264     uint32_t nt_id;
 265     uint8_t ignored2[2];
 266     partition_t partition[4];
 267     uint8_t magic[2];
 268 } QEMU_PACKED mbr_t;
 269
 270 typedef struct direntry_t {
 271     uint8_t name[8 + 3];
 272     uint8_t attributes;
 273     uint8_t reserved[2];
 274     uint16_t ctime;
 275     uint16_t cdate;
 276     uint16_t adate;
 277     uint16_t begin_hi;
 278     uint16_t mtime;
 279     uint16_t mdate;
 280     uint16_t begin;
 281     uint32_t size;
 282 } QEMU_PACKED direntry_t;
 283
 284 /* this structure are used to transparently access the files */
 285
 286 typedef struct mapping_t {
 287     /* begin is the first cluster, end is the last+1 */
 288     uint32_t begin,end;
 289     /* as s->directory is growable, no pointer may be used here */
 290     unsigned int dir_index;
 291     /* the clusters of a file may be in any order; this points to the first */
 292     int first_mapping_index;
 293     union {
 294         /* offset is
 295          * - the offset in the file (in clusters) for a file, or
 296          * - the next cluster of the directory for a directory
 297          */
 298         struct {
 299             uint32_t offset;
 300         } file;
 301         struct {
 302             int parent_mapping_index;
 303             int first_dir_index;
 304         } dir;
 305     } info;
 306     /* path contains the full path, i.e. it always starts with s->path */
 307     char* path;
 308
 309     enum {
 310         MODE_UNDEFINED = 0,
 311         MODE_NORMAL = 1,
 312         MODE_MODIFIED = 2,
 313         MODE_DIRECTORY = 4,
 314         MODE_DELETED = 8,
 315     } mode;
 316     int read_only;
 317 } mapping_t;
 318
 319 #ifdef DEBUG
 320 static void print_direntry(const struct direntry_t*);
 321 static void print_mapping(const struct mapping_t* mapping);
 322 #endif
 323
 324 /* here begins the real VVFAT driver */
 325
 326 typedef struct BDRVVVFATState {
 327     CoMutex lock;
 328     BlockDriverState* bs; /* pointer to parent */
 329     unsigned char first_sectors[0x40*0x200];
 330
 331     int fat_type; /* 16 or 32 */
 332     array_t fat,directory,mapping;
 333     char volume_label[11];
 334
 335     uint32_t offset_to_bootsector; /* 0 for floppy, 0x3f for disk */
 336
 337     unsigned int cluster_size;
 338     unsigned int sectors_per_cluster;
 339     unsigned int sectors_per_fat;
 340     uint32_t last_cluster_of_root_directory;
 341     /* how many entries are available in root directory (0 for FAT32) */
 342     uint16_t root_entries;
 343     uint32_t sector_count; /* total number of sectors of the partition */
 344     uint32_t cluster_count; /* total number of clusters of this partition */
 345     uint32_t max_fat_value;
 346     uint32_t offset_to_fat;
 347     uint32_t offset_to_root_dir;
 348
 349     int current_fd;
 350     mapping_t* current_mapping;
 351     unsigned char* cluster; /* points to current cluster */
 352     unsigned char* cluster_buffer; /* points to a buffer to hold temp data */
 353     unsigned int current_cluster;
 354
 355     /* write support */
 356     char* qcow_filename;
 357     BdrvChild* qcow;
 358     void* fat2;
 359     char* used_clusters;
 360     array_t commits;
 361     const char* path;
 362     int downcase_short_names;
 363
 364     Error *migration_blocker;
 365 } BDRVVVFATState;
 366
 367 /* take the sector position spos and convert it to Cylinder/Head/Sector position
 368  * if the position is outside the specified geometry, fill maximum value for CHS
 369  * and return 1 to signal overflow.
 370  */
 371 static int sector2CHS(mbr_chs_t *chs, int spos, int cyls, int heads, int secs)
 372 {
 373     int head,sector;
 374     sector   = spos % secs;  spos /= secs;
 375     head     = spos % heads; spos /= heads;
 376     if (spos >= cyls) {
 377         /* Overflow,
 378         it happens if 32bit sector positions are used, while CHS is only 24bit.
 379         Windows/Dos is said to take 1023/255/63 as nonrepresentable CHS */
 380         chs->head     = 0xFF;
 381         chs->sector   = 0xFF;
 382         chs->cylinder = 0xFF;
 383         return 1;
 384     }
 385     chs->head     = (uint8_t)head;
 386     chs->sector   = (uint8_t)( (sector+1) | ((spos>>8)<<6) );
 387     chs->cylinder = (uint8_t)spos;
 388     return 0;
 389 }
 390
 391 static void init_mbr(BDRVVVFATState *s, int cyls, int heads, int secs)
 392 {
 393     /* TODO: if the files mbr.img and bootsect.img exist, use them */
 394     mbr_t* real_mbr=(mbr_t*)s->first_sectors;
 395     partition_t* partition = &(real_mbr->partition[0]);
 396     int lba;
 397
 398     memset(s->first_sectors,0,512);
 399
 400     /* Win NT Disk Signature */
 401     real_mbr->nt_id= cpu_to_le32(0xbe1afdfa);
 402
 403     partition->attributes=0x80; /* bootable */
 404
 405     /* LBA is used when partition is outside the CHS geometry */
 406     lba  = sector2CHS(&partition->start_CHS, s->offset_to_bootsector,
 407                      cyls, heads, secs);
 408     lba |= sector2CHS(&partition->end_CHS,   s->bs->total_sectors - 1,
 409                      cyls, heads, secs);
 410
 411     /*LBA partitions are identified only by start/length_sector_long not by CHS*/
 412     partition->start_sector_long  = cpu_to_le32(s->offset_to_bootsector);
 413     partition->length_sector_long = cpu_to_le32(s->bs->total_sectors
 414                                                 - s->offset_to_bootsector);
 415
 416     /* FAT12/FAT16/FAT32 */
 417     /* DOS uses different types when partition is LBA,
 418        probably to prevent older versions from using CHS on them */
 419     partition->fs_type = s->fat_type == 12 ? 0x1 :
 420                          s->fat_type == 16 ? (lba ? 0xe : 0x06) :
 421                        /*s->fat_type == 32*/ (lba ? 0xc : 0x0b);
 422
 423     real_mbr->magic[0]=0x55; real_mbr->magic[1]=0xaa;
 424 }
 425
 426 /* direntry functions */
 427
 428 static direntry_t *create_long_filename(BDRVVVFATState *s, const char *filename)
 429 {
 430     int number_of_entries, i;
 431     glong length;
 432     direntry_t *entry;
 433
 434     gunichar2 *longname = g_utf8_to_utf16(filename, -1, NULL, &length, NULL);
 435     if (!longname) {
 436         fprintf(stderr, "vvfat: invalid UTF-8 name: %s\n", filename);
 437         return NULL;
 438     }
 439
 440     number_of_entries = (length * 2 + 25) / 26;
 441
 442     for(i=0;i<number_of_entries;i++) {
 443         entry=array_get_next(&(s->directory));
 444         entry->attributes=0xf;
 445         entry->reserved[0]=0;
 446         entry->begin=0;
 447         entry->name[0]=(number_of_entries-i)|(i==0?0x40:0);
 448     }
 449     for(i=0;i<26*number_of_entries;i++) {
 450         int offset=(i%26);
 451         if(offset<10) offset=1+offset;
 452         else if(offset<22) offset=14+offset-10;
 453         else offset=28+offset-22;
 454         entry=array_get(&(s->directory),s->directory.next-1-(i/26));
 455         if (i >= 2 * length + 2) {
 456             entry->name[offset] = 0xff;
 457         } else if (i % 2 == 0) {
 458             entry->name[offset] = longname[i / 2] & 0xff;
 459         } else {
 460             entry->name[offset] = longname[i / 2] >> 8;
 461         }
 462     }
 463     g_free(longname);
 464     return array_get(&(s->directory),s->directory.next-number_of_entries);
 465 }
 466
 467 static char is_free(const direntry_t* direntry)
 468 {
 469     return direntry->name[0]==0xe5 || direntry->name[0]==0x00;
 470 }
 471
 472 static char is_volume_label(const direntry_t* direntry)
 473 {
 474     return direntry->attributes == 0x28;
 475 }
 476
 477 static char is_long_name(const direntry_t* direntry)
 478 {
 479     return direntry->attributes == 0xf;
 480 }
 481
 482 static char is_short_name(const direntry_t* direntry)
 483 {
 484     return !is_volume_label(direntry) && !is_long_name(direntry)
 485         && !is_free(direntry);
 486 }
 487
 488 static char is_directory(const direntry_t* direntry)
 489 {
 490     return direntry->attributes & 0x10 && direntry->name[0] != 0xe5;
 491 }
 492
 493 static inline char is_dot(const direntry_t* direntry)
 494 {
 495     return is_short_name(direntry) && direntry->name[0] == '.';
 496 }
 497
 498 static char is_file(const direntry_t* direntry)
 499 {
 500     return is_short_name(direntry) && !is_directory(direntry);
 501 }
 502
 503 static inline uint32_t begin_of_direntry(const direntry_t* direntry)
 504 {
 505     return le16_to_cpu(direntry->begin)|(le16_to_cpu(direntry->begin_hi)<<16);
 506 }
 507
 508 static inline uint32_t filesize_of_direntry(const direntry_t* direntry)
 509 {
 510     return le32_to_cpu(direntry->size);
 511 }
 512
 513 static void set_begin_of_direntry(direntry_t* direntry, uint32_t begin)
 514 {
 515     direntry->begin = cpu_to_le16(begin & 0xffff);
 516     direntry->begin_hi = cpu_to_le16((begin >> 16) & 0xffff);
 517 }
 518
 519 static uint8_t to_valid_short_char(gunichar c)
 520 {
 521     c = g_unichar_toupper(c);
 522     if ((c >= '0' && c <= '9') ||
 523         (c >= 'A' && c <= 'Z') ||
 524         strchr("$%'-_@~`!(){}^#&", c) != 0) {
 525         return c;
 526     } else {
 527         return 0;
 528     }
 529 }
 530
 531 static direntry_t *create_short_filename(BDRVVVFATState *s,
 532                                          const char *filename,
 533                                          unsigned int directory_start)
 534 {
 535     int i, j = 0;
 536     direntry_t *entry = array_get_next(&(s->directory));
 537     const gchar *p, *last_dot = NULL;
 538     gunichar c;
 539     bool lossy_conversion = false;
 540     char tail[11];
 541
 542     if (!entry) {
 543         return NULL;
 544     }
 545     memset(entry->name, 0x20, sizeof(entry->name));
 546
 547     /* copy filename and search last dot */
 548     for (p = filename; ; p = g_utf8_next_char(p)) {
 549         c = g_utf8_get_char(p);
 550         if (c == '\0') {
 551             break;
 552         } else if (c == '.') {
 553             if (j == 0) {
 554                 /* '.' at start of filename */
 555                 lossy_conversion = true;
 556             } else {
 557                 if (last_dot) {
 558                     lossy_conversion = true;
 559                 }
 560                 last_dot = p;
 561             }
 562         } else if (!last_dot) {
 563             /* first part of the name; copy it */
 564             uint8_t v = to_valid_short_char(c);
 565             if (j < 8 && v) {
 566                 entry->name[j++] = v;
 567             } else {
 568                 lossy_conversion = true;
 569             }
 570         }
 571     }
 572
 573     /* copy extension (if any) */
 574     if (last_dot) {
 575         j = 0;
 576         for (p = g_utf8_next_char(last_dot); ; p = g_utf8_next_char(p)) {
 577             c = g_utf8_get_char(p);
 578             if (c == '\0') {
 579                 break;
 580             } else {
 581                 /* extension; copy it */
 582                 uint8_t v = to_valid_short_char(c);
 583                 if (j < 3 && v) {
 584                     entry->name[8 + (j++)] = v;
 585                 } else {
 586                     lossy_conversion = true;
 587                 }
 588             }
 589         }
 590     }
 591
 592     if (entry->name[0] == 0xe5) {
 593         entry->name[0] = 0x05;
 594     }
 595
 596     /* numeric-tail generation */
 597     for (j = 0; j < 8; j++) {
 598         if (entry->name[j] == ' ') {
 599             break;
 600         }
 601     }
 602     for (i = lossy_conversion ? 1 : 0; i < 999999; i++) {
 603         direntry_t *entry1;
 604         if (i > 0) {
 605             int len = sprintf(tail, "~%d", i);
 606             memcpy(entry->name + MIN(j, 8 - len), tail, len);
 607         }
 608         for (entry1 = array_get(&(s->directory), directory_start);
 609              entry1 < entry; entry1++) {
 610             if (!is_long_name(entry1) &&
 611                 !memcmp(entry1->name, entry->name, 11)) {
 612                 break; /* found dupe */
 613             }
 614         }
 615         if (entry1 == entry) {
 616             /* no dupe found */
 617             return entry;
 618         }
 619     }
 620     return NULL;
 621 }
 622
 623 /* fat functions */
 624
 625 static inline uint8_t fat_chksum(const direntry_t* entry)
 626 {
 627     uint8_t chksum=0;
 628     int i;
 629
 630     for (i = 0; i < ARRAY_SIZE(entry->name); i++) {
 631         chksum = (((chksum & 0xfe) >> 1) |
 632                   ((chksum & 0x01) ? 0x80 : 0)) + entry->name[i];
 633     }
 634
 635     return chksum;
 636 }
 637
 638 /* if return_time==0, this returns the fat_date, else the fat_time */
 639 static uint16_t fat_datetime(time_t time,int return_time) {
 640     struct tm* t;
 641     struct tm t1;
 642     t = &t1;
 643     localtime_r(&time,t);
 644     if(return_time)
 645         return cpu_to_le16((t->tm_sec/2)|(t->tm_min<<5)|(t->tm_hour<<11));
 646     return cpu_to_le16((t->tm_mday)|((t->tm_mon+1)<<5)|((t->tm_year-80)<<9));
 647 }
 648
 649 static inline void fat_set(BDRVVVFATState* s,unsigned int cluster,uint32_t value)
 650 {
 651     if(s->fat_type==32) {
 652         uint32_t* entry=array_get(&(s->fat),cluster);
 653         *entry=cpu_to_le32(value);
 654     } else if(s->fat_type==16) {
 655         uint16_t* entry=array_get(&(s->fat),cluster);
 656         *entry=cpu_to_le16(value&0xffff);
 657     } else {
 658         int offset = (cluster*3/2);
 659         unsigned char* p = array_get(&(s->fat), offset);
 660         switch (cluster&1) {
 661         case 0:
 662                 p[0] = value&0xff;
 663                 p[1] = (p[1]&0xf0) | ((value>>8)&0xf);
 664                 break;
 665         case 1:
 666                 p[0] = (p[0]&0xf) | ((value&0xf)<<4);
 667                 p[1] = (value>>4);
 668                 break;
 669         }
 670     }
 671 }
 672
 673 static inline uint32_t fat_get(BDRVVVFATState* s,unsigned int cluster)
 674 {
 675     if(s->fat_type==32) {
 676         uint32_t* entry=array_get(&(s->fat),cluster);
 677         return le32_to_cpu(*entry);
 678     } else if(s->fat_type==16) {
 679         uint16_t* entry=array_get(&(s->fat),cluster);
 680         return le16_to_cpu(*entry);
 681     } else {
 682         const uint8_t* x=(uint8_t*)(s->fat.pointer)+cluster*3/2;
 683         return ((x[0]|(x[1]<<8))>>(cluster&1?4:0))&0x0fff;
 684     }
 685 }
 686
 687 static inline int fat_eof(BDRVVVFATState* s,uint32_t fat_entry)
 688 {
 689     if(fat_entry>s->max_fat_value-8)
 690         return -1;
 691     return 0;
 692 }
 693
 694 static inline void init_fat(BDRVVVFATState* s)
 695 {
 696     if (s->fat_type == 12) {
 697         array_init(&(s->fat),1);
 698         array_ensure_allocated(&(s->fat),
 699                 s->sectors_per_fat * 0x200 * 3 / 2 - 1);
 700     } else {
 701         array_init(&(s->fat),(s->fat_type==32?4:2));
 702         array_ensure_allocated(&(s->fat),
 703                 s->sectors_per_fat * 0x200 / s->fat.item_size - 1);
 704     }
 705     memset(s->fat.pointer,0,s->fat.size);
 706
 707     switch(s->fat_type) {
 708         case 12: s->max_fat_value=0xfff; break;
 709         case 16: s->max_fat_value=0xffff; break;
 710         case 32: s->max_fat_value=0x0fffffff; break;
 711         default: s->max_fat_value=0; /* error... */
 712     }
 713
 714 }
 715
 716 static inline direntry_t* create_short_and_long_name(BDRVVVFATState* s,
 717         unsigned int directory_start, const char* filename, int is_dot)
 718 {
 719     int long_index = s->directory.next;
 720     direntry_t* entry = NULL;
 721     direntry_t* entry_long = NULL;
 722
 723     if(is_dot) {
 724         entry=array_get_next(&(s->directory));
 725         memset(entry->name, 0x20, sizeof(entry->name));
 726         memcpy(entry->name,filename,strlen(filename));
 727         return entry;
 728     }
 729
 730     entry_long=create_long_filename(s,filename);
 731     entry = create_short_filename(s, filename, directory_start);
 732
 733     /* calculate checksum; propagate to long name */
 734     if(entry_long) {
 735         uint8_t chksum=fat_chksum(entry);
 736
 737         /* calculate anew, because realloc could have taken place */
 738         entry_long=array_get(&(s->directory),long_index);
 739         while(entry_long<entry && is_long_name(entry_long)) {
 740             entry_long->reserved[1]=chksum;
 741             entry_long++;
 742         }
 743     }
 744
 745     return entry;
 746 }
 747
 748 /*
 749  * Read a directory. (the index of the corresponding mapping must be passed).
 750  */
 751 static int read_directory(BDRVVVFATState* s, int mapping_index)
 752 {
 753     mapping_t* mapping = array_get(&(s->mapping), mapping_index);
 754     direntry_t* direntry;
 755     const char* dirname = mapping->path;
 756     int first_cluster = mapping->begin;
 757     int parent_index = mapping->info.dir.parent_mapping_index;
 758     mapping_t* parent_mapping = (mapping_t*)
 759         (parent_index >= 0 ? array_get(&(s->mapping), parent_index) : NULL);
 760     int first_cluster_of_parent = parent_mapping ? parent_mapping->begin : -1;
 761
 762     DIR* dir=opendir(dirname);
 763     struct dirent* entry;
 764     int i;
 765
 766     assert(mapping->mode & MODE_DIRECTORY);
 767
 768     if(!dir) {
 769         mapping->end = mapping->begin;
 770         return -1;
 771     }
 772
 773     i = mapping->info.dir.first_dir_index =
 774             first_cluster == 0 ? 0 : s->directory.next;
 775
 776     if (first_cluster != 0) {
 777         /* create the top entries of a subdirectory */
 778         (void)create_short_and_long_name(s, i, ".", 1);
 779         (void)create_short_and_long_name(s, i, "..", 1);
 780     }
 781
 782     /* actually read the directory, and allocate the mappings */
 783     while((entry=readdir(dir))) {
 784         unsigned int length=strlen(dirname)+2+strlen(entry->d_name);
 785         char* buffer;
 786         direntry_t* direntry;
 787         struct stat st;
 788         int is_dot=!strcmp(entry->d_name,".");
 789         int is_dotdot=!strcmp(entry->d_name,"..");
 790
 791         if (first_cluster == 0 && s->directory.next >= s->root_entries - 1) {
 792             fprintf(stderr, "Too many entries in root directory\n");
 793             closedir(dir);
 794             return -2;
 795         }
 796
 797         if(first_cluster == 0 && (is_dotdot || is_dot))
 798             continue;
 799
 800         buffer = g_malloc(length);
 801         snprintf(buffer,length,"%s/%s",dirname,entry->d_name);
 802
 803         if(stat(buffer,&st)<0) {
 804             g_free(buffer);
 805             continue;
 806         }
 807
 808         /* create directory entry for this file */
 809         if (!is_dot && !is_dotdot) {
 810             direntry = create_short_and_long_name(s, i, entry->d_name, 0);
 811         } else {
 812             direntry = array_get(&(s->directory), is_dot ? i : i + 1);
 813         }
 814         direntry->attributes=(S_ISDIR(st.st_mode)?0x10:0x20);
 815         direntry->reserved[0]=direntry->reserved[1]=0;
 816         direntry->ctime=fat_datetime(st.st_ctime,1);
 817         direntry->cdate=fat_datetime(st.st_ctime,0);
 818         direntry->adate=fat_datetime(st.st_atime,0);
 819         direntry->begin_hi=0;
 820         direntry->mtime=fat_datetime(st.st_mtime,1);
 821         direntry->mdate=fat_datetime(st.st_mtime,0);
 822         if(is_dotdot)
 823             set_begin_of_direntry(direntry, first_cluster_of_parent);
 824         else if(is_dot)
 825             set_begin_of_direntry(direntry, first_cluster);
 826         else
 827             direntry->begin=0; /* do that later */
 828         if (st.st_size > 0x7fffffff) {
 829             fprintf(stderr, "File %s is larger than 2GB\n", buffer);
 830             g_free(buffer);
 831             closedir(dir);
 832             return -2;
 833         }
 834         direntry->size=cpu_to_le32(S_ISDIR(st.st_mode)?0:st.st_size);
 835
 836         /* create mapping for this file */
 837         if(!is_dot && !is_dotdot && (S_ISDIR(st.st_mode) || st.st_size)) {
 838             s->current_mapping = array_get_next(&(s->mapping));
 839             s->current_mapping->begin=0;
 840             s->current_mapping->end=st.st_size;
 841             /*
 842              * we get the direntry of the most recent direntry, which
 843              * contains the short name and all the relevant information.
 844              */
 845             s->current_mapping->dir_index=s->directory.next-1;
 846             s->current_mapping->first_mapping_index = -1;
 847             if (S_ISDIR(st.st_mode)) {
 848                 s->current_mapping->mode = MODE_DIRECTORY;
 849                 s->current_mapping->info.dir.parent_mapping_index =
 850                     mapping_index;
 851             } else {
 852                 s->current_mapping->mode = MODE_UNDEFINED;
 853                 s->current_mapping->info.file.offset = 0;
 854             }
 855             s->current_mapping->path=buffer;
 856             s->current_mapping->read_only =
 857                 (st.st_mode & (S_IWUSR | S_IWGRP | S_IWOTH)) == 0;
 858         } else {
 859             g_free(buffer);
 860         }
 861     }
 862     closedir(dir);
 863
 864     /* fill with zeroes up to the end of the cluster */
 865     while(s->directory.next%(0x10*s->sectors_per_cluster)) {
 866         direntry_t* direntry=array_get_next(&(s->directory));
 867         memset(direntry,0,sizeof(direntry_t));
 868     }
 869
 870     if (s->fat_type != 32 &&
 871         mapping_index == 0 &&
 872         s->directory.next < s->root_entries) {
 873         /* root directory */
 874         int cur = s->directory.next;
 875         array_ensure_allocated(&(s->directory), s->root_entries - 1);
 876         s->directory.next = s->root_entries;
 877         memset(array_get(&(s->directory), cur), 0,
 878                 (s->root_entries - cur) * sizeof(direntry_t));
 879     }
 880
 881     /* re-get the mapping, since s->mapping was possibly realloc()ed */
 882     mapping = array_get(&(s->mapping), mapping_index);
 883     first_cluster += (s->directory.next - mapping->info.dir.first_dir_index)
 884         * 0x20 / s->cluster_size;
 885     mapping->end = first_cluster;
 886
 887     direntry = array_get(&(s->directory), mapping->dir_index);
 888     set_begin_of_direntry(direntry, mapping->begin);
 889
 890     return 0;
 891 }
 892
 893 static inline uint32_t sector2cluster(BDRVVVFATState* s,off_t sector_num)
 894 {
 895     return (sector_num - s->offset_to_root_dir) / s->sectors_per_cluster;
 896 }
 897
 898 static inline off_t cluster2sector(BDRVVVFATState* s, uint32_t cluster_num)
 899 {
 900     return s->offset_to_root_dir + s->sectors_per_cluster * cluster_num;
 901 }
 902
 903 static int init_directories(BDRVVVFATState* s,
 904                             const char *dirname, int heads, int secs,
 905                             Error **errp)
 906 {
 907     bootsector_t* bootsector;
 908     mapping_t* mapping;
 909     unsigned int i;
 910     unsigned int cluster;
 911
 912     memset(&(s->first_sectors[0]),0,0x40*0x200);
 913
 914     s->cluster_size=s->sectors_per_cluster*0x200;
 915     s->cluster_buffer=g_malloc(s->cluster_size);
 916
 917     /*
 918      * The formula: sc = spf+1+spf*spc*(512*8/fat_type),
 919      * where sc is sector_count,
 920      * spf is sectors_per_fat,
 921      * spc is sectors_per_clusters, and
 922      * fat_type = 12, 16 or 32.
 923      */
 924     i = 1+s->sectors_per_cluster*0x200*8/s->fat_type;
 925     s->sectors_per_fat=(s->sector_count+i)/i; /* round up */
 926
 927     s->offset_to_fat = s->offset_to_bootsector + 1;
 928     s->offset_to_root_dir = s->offset_to_fat + s->sectors_per_fat * 2;
 929
 930     array_init(&(s->mapping),sizeof(mapping_t));
 931     array_init(&(s->directory),sizeof(direntry_t));
 932
 933     /* add volume label */
 934     {
 935         direntry_t* entry=array_get_next(&(s->directory));
 936         entry->attributes=0x28; /* archive | volume label */
 937         memcpy(entry->name, s->volume_label, sizeof(entry->name));
 938     }
 939
 940     /* Now build FAT, and write back information into directory */
 941     init_fat(s);
 942
 943     /* TODO: if there are more entries, bootsector has to be adjusted! */
 944     s->root_entries = 0x02 * 0x10 * s->sectors_per_cluster;
 945     s->cluster_count=sector2cluster(s, s->sector_count);
 946
 947     mapping = array_get_next(&(s->mapping));
 948     mapping->begin = 0;
 949     mapping->dir_index = 0;
 950     mapping->info.dir.parent_mapping_index = -1;
 951     mapping->first_mapping_index = -1;
 952     mapping->path = g_strdup(dirname);
 953     i = strlen(mapping->path);
 954     if (i > 0 && mapping->path[i - 1] == '/')
 955         mapping->path[i - 1] = '\0';
 956     mapping->mode = MODE_DIRECTORY;
 957     mapping->read_only = 0;
 958     s->path = mapping->path;
 959
 960     for (i = 0, cluster = 0; i < s->mapping.next; i++) {
 961         /* MS-DOS expects the FAT to be 0 for the root directory
 962          * (except for the media byte). */
 963         /* LATER TODO: still true for FAT32? */
 964         int fix_fat = (i != 0);
 965         mapping = array_get(&(s->mapping), i);
 966
 967         if (mapping->mode & MODE_DIRECTORY) {
 968             mapping->begin = cluster;
 969             if(read_directory(s, i)) {
 970                 error_setg(errp, "Could not read directory %s",
 971                            mapping->path);
 972                 return -1;
 973             }
 974             mapping = array_get(&(s->mapping), i);
 975         } else {
 976             assert(mapping->mode == MODE_UNDEFINED);
 977             mapping->mode=MODE_NORMAL;
 978             mapping->begin = cluster;
 979             if (mapping->end > 0) {
 980                 direntry_t* direntry = array_get(&(s->directory),
 981                         mapping->dir_index);
 982
 983                 mapping->end = cluster + 1 + (mapping->end-1)/s->cluster_size;
 984                 set_begin_of_direntry(direntry, mapping->begin);
 985             } else {
 986                 mapping->end = cluster + 1;
 987                 fix_fat = 0;
 988             }
 989         }
 990
 991         assert(mapping->begin < mapping->end);
 992
 993         /* next free cluster */
 994         cluster = mapping->end;
 995
 996         if(cluster > s->cluster_count) {
 997             error_setg(errp,
 998                        "Directory does not fit in FAT%d (capacity %.2f MB)",
 999                        s->fat_type, s->sector_count / 2000.0);
1000             return -1;
1001         }
1002
1003         /* fix fat for entry */
1004         if (fix_fat) {
1005             int j;
1006             for(j = mapping->begin; j < mapping->end - 1; j++)
1007                 fat_set(s, j, j+1);
1008             fat_set(s, mapping->end - 1, s->max_fat_value);
1009         }
1010     }
1011
1012     mapping = array_get(&(s->mapping), 0);
1013     s->last_cluster_of_root_directory = mapping->end;
1014
1015     /* the FAT signature */
1016     fat_set(s,0,s->max_fat_value);
1017     fat_set(s,1,s->max_fat_value);
1018
1019     s->current_mapping = NULL;
1020
1021     bootsector = (bootsector_t *)(s->first_sectors
1022                                   + s->offset_to_bootsector * 0x200);
1023     bootsector->jump[0]=0xeb;
1024     bootsector->jump[1]=0x3e;
1025     bootsector->jump[2]=0x90;
1026     memcpy(bootsector->name, "MSWIN4.1", 8);
1027     bootsector->sector_size=cpu_to_le16(0x200);
1028     bootsector->sectors_per_cluster=s->sectors_per_cluster;
1029     bootsector->reserved_sectors=cpu_to_le16(1);
1030     bootsector->number_of_fats=0x2; /* number of FATs */
1031     bootsector->root_entries = cpu_to_le16(s->root_entries);
1032     bootsector->total_sectors16=s->sector_count>0xffff?0:cpu_to_le16(s->sector_count);
1033     /* media descriptor: hard disk=0xf8, floppy=0xf0 */
1034     bootsector->media_type = (s->offset_to_bootsector > 0 ? 0xf8 : 0xf0);
1035     s->fat.pointer[0] = bootsector->media_type;
1036     bootsector->sectors_per_fat=cpu_to_le16(s->sectors_per_fat);
1037     bootsector->sectors_per_track = cpu_to_le16(secs);
1038     bootsector->number_of_heads = cpu_to_le16(heads);
1039     bootsector->hidden_sectors = cpu_to_le32(s->offset_to_bootsector);
1040     bootsector->total_sectors=cpu_to_le32(s->sector_count>0xffff?s->sector_count:0);
1041
1042     /* LATER TODO: if FAT32, this is wrong */
1043     /* drive_number: fda=0, hda=0x80 */
1044     bootsector->u.fat16.drive_number = s->offset_to_bootsector == 0 ? 0 : 0x80;
1045     bootsector->u.fat16.signature=0x29;
1046     bootsector->u.fat16.id=cpu_to_le32(0xfabe1afd);
1047
1048     memcpy(bootsector->u.fat16.volume_label, s->volume_label,
1049            sizeof(bootsector->u.fat16.volume_label));
1050     memcpy(bootsector->u.fat16.fat_type,
1051            s->fat_type == 12 ? "FAT12   " : "FAT16   ", 8);
1052     bootsector->magic[0]=0x55; bootsector->magic[1]=0xaa;
1053
1054     return 0;
1055 }
1056
1057 #ifdef DEBUG
1058 static BDRVVVFATState *vvv = NULL;
1059 #endif
1060
1061 static int enable_write_target(BlockDriverState *bs, Error **errp);
1062 static int is_consistent(BDRVVVFATState *s);
1063
1064 static QemuOptsList runtime_opts = {
1065     .name = "vvfat",
1066     .head = QTAILQ_HEAD_INITIALIZER(runtime_opts.head),
1067     .desc = {
1068         {
1069             .name = "dir",
1070             .type = QEMU_OPT_STRING,
1071             .help = "Host directory to map to the vvfat device",
1072         },
1073         {
1074             .name = "fat-type",
1075             .type = QEMU_OPT_NUMBER,
1076             .help = "FAT type (12, 16 or 32)",
1077         },
1078         {
1079             .name = "floppy",
1080             .type = QEMU_OPT_BOOL,
1081             .help = "Create a floppy rather than a hard disk image",
1082         },
1083         {
1084             .name = "label",
1085             .type = QEMU_OPT_STRING,
1086             .help = "Use a volume label other than QEMU VVFAT",
1087         },
1088         {
1089             .name = "rw",
1090             .type = QEMU_OPT_BOOL,
1091             .help = "Make the image writable",
1092         },
1093         { /* end of list */ }
1094     },
1095 };
1096
1097 static void vvfat_parse_filename(const char *filename, QDict *options,
1098                                  Error **errp)
1099 {
1100     int fat_type = 0;
1101     bool floppy = false;
1102     bool rw = false;
1103     int i;
1104
1105     if (!strstart(filename, "fat:", NULL)) {
1106         error_setg(errp, "File name string must start with 'fat:'");
1107         return;
1108     }
1109
1110     /* Parse options */
1111     if (strstr(filename, ":32:")) {
1112         fat_type = 32;
1113     } else if (strstr(filename, ":16:")) {
1114         fat_type = 16;
1115     } else if (strstr(filename, ":12:")) {
1116         fat_type = 12;
1117     }
1118
1119     if (strstr(filename, ":floppy:")) {
1120         floppy = true;
1121     }
1122
1123     if (strstr(filename, ":rw:")) {
1124         rw = true;
1125     }
1126
1127     /* Get the directory name without options */
1128     i = strrchr(filename, ':') - filename;
1129     assert(i >= 3);
1130     if (filename[i - 2] == ':' && qemu_isalpha(filename[i - 1])) {
1131         /* workaround for DOS drive names */
1132         filename += i - 1;
1133     } else {
1134         filename += i + 1;
1135     }
1136
1137     /* Fill in the options QDict */
1138     qdict_put_str(options, "dir", filename);
1139     qdict_put_int(options, "fat-type", fat_type);
1140     qdict_put_bool(options, "floppy", floppy);
1141     qdict_put_bool(options, "rw", rw);
1142 }
1143
1144 static int vvfat_open(BlockDriverState *bs, QDict *options, int flags,
1145                       Error **errp)
1146 {
1147     BDRVVVFATState *s = bs->opaque;
1148     int cyls, heads, secs;
1149     bool floppy;
1150     const char *dirname, *label;
1151     QemuOpts *opts;
1152     Error *local_err = NULL;
1153     int ret;
1154
1155 #ifdef DEBUG
1156     vvv = s;
1157 #endif
1158
1159     opts = qemu_opts_create(&runtime_opts, NULL, 0, &error_abort);
1160     qemu_opts_absorb_qdict(opts, options, &local_err);
1161     if (local_err) {
1162         error_propagate(errp, local_err);
1163         ret = -EINVAL;
1164         goto fail;
1165     }
1166
1167     dirname = qemu_opt_get(opts, "dir");
1168     if (!dirname) {
1169         error_setg(errp, "vvfat block driver requires a 'dir' option");
1170         ret = -EINVAL;
1171         goto fail;
1172     }
1173
1174     s->fat_type = qemu_opt_get_number(opts, "fat-type", 0);
1175     floppy = qemu_opt_get_bool(opts, "floppy", false);
1176
1177     memset(s->volume_label, ' ', sizeof(s->volume_label));
1178     label = qemu_opt_get(opts, "label");
1179     if (label) {
1180         size_t label_length = strlen(label);
1181         if (label_length > 11) {
1182             error_setg(errp, "vvfat label cannot be longer than 11 bytes");
1183             ret = -EINVAL;
1184             goto fail;
1185         }
1186         memcpy(s->volume_label, label, label_length);
1187     } else {
1188         memcpy(s->volume_label, "QEMU VVFAT", 10);
1189     }
1190
1191     if (floppy) {
1192         /* 1.44MB or 2.88MB floppy.  2.88MB can be FAT12 (default) or FAT16. */
1193         if (!s->fat_type) {
1194             s->fat_type = 12;
1195             secs = 36;
1196             s->sectors_per_cluster = 2;
1197         } else {
1198             secs = s->fat_type == 12 ? 18 : 36;
1199             s->sectors_per_cluster = 1;
1200         }
1201         cyls = 80;
1202         heads = 2;
1203     } else {
1204         /* 32MB or 504MB disk*/
1205         if (!s->fat_type) {
1206             s->fat_type = 16;
1207         }
1208         s->offset_to_bootsector = 0x3f;
1209         cyls = s->fat_type == 12 ? 64 : 1024;
1210         heads = 16;
1211         secs = 63;
1212     }
1213
1214     switch (s->fat_type) {
1215     case 32:
1216             fprintf(stderr, "Big fat greek warning: FAT32 has not been tested. "
1217                 "You are welcome to do so!\n");
1218         break;
1219     case 16:
1220     case 12:
1221         break;
1222     default:
1223         error_setg(errp, "Valid FAT types are only 12, 16 and 32");
1224         ret = -EINVAL;
1225         goto fail;
1226     }
1227
1228
1229     s->bs = bs;
1230
1231     /* LATER TODO: if FAT32, adjust */
1232     s->sectors_per_cluster=0x10;
1233
1234     s->current_cluster=0xffffffff;
1235
1236     s->qcow = NULL;
1237     s->qcow_filename = NULL;
1238     s->fat2 = NULL;
1239     s->downcase_short_names = 1;
1240
1241     fprintf(stderr, "vvfat %s chs %d,%d,%d\n",
1242             dirname, cyls, heads, secs);
1243
1244     s->sector_count = cyls * heads * secs - s->offset_to_bootsector;
1245
1246     if (qemu_opt_get_bool(opts, "rw", false)) {
1247         if (!bdrv_is_read_only(bs)) {
1248             ret = enable_write_target(bs, errp);
1249             if (ret < 0) {
1250                 goto fail;
1251             }
1252         } else {
1253             ret = -EPERM;
1254             error_setg(errp,
1255                        "Unable to set VVFAT to 'rw' when drive is read-only");
1256             goto fail;
1257         }
1258     } else  {
1259         /* read only is the default for safety */
1260         ret = bdrv_set_read_only(bs, true, &local_err);
1261         if (ret < 0) {
1262             error_propagate(errp, local_err);
1263             goto fail;
1264         }
1265     }
1266
1267     bs->total_sectors = cyls * heads * secs;
1268
1269     if (init_directories(s, dirname, heads, secs, errp)) {
1270         ret = -EIO;
1271         goto fail;
1272     }
1273
1274     s->sector_count = s->offset_to_root_dir
1275                     + s->sectors_per_cluster * s->cluster_count;
1276
1277     /* Disable migration when vvfat is used rw */
1278     if (s->qcow) {
1279         error_setg(&s->migration_blocker,
1280                    "The vvfat (rw) format used by node '%s' "
1281                    "does not support live migration",
1282                    bdrv_get_device_or_node_name(bs));
1283         ret = migrate_add_blocker(s->migration_blocker, &local_err);
1284         if (local_err) {
1285             error_propagate(errp, local_err);
1286             error_free(s->migration_blocker);
1287             goto fail;
1288         }
1289     }
1290
1291     if (s->offset_to_bootsector > 0) {
1292         init_mbr(s, cyls, heads, secs);
1293     }
1294
1295     qemu_co_mutex_init(&s->lock);
1296
1297     ret = 0;
1298 fail:
1299     qemu_opts_del(opts);
1300     return ret;
1301 }
1302
1303 static void vvfat_refresh_limits(BlockDriverState *bs, Error **errp)
1304 {
1305     bs->bl.request_alignment = BDRV_SECTOR_SIZE; /* No sub-sector I/O */
1306 }
1307
1308 static inline void vvfat_close_current_file(BDRVVVFATState *s)
1309 {
1310     if(s->current_mapping) {
1311         s->current_mapping = NULL;
1312         if (s->current_fd) {
1313                 qemu_close(s->current_fd);
1314                 s->current_fd = 0;
1315         }
1316     }
1317     s->current_cluster = -1;
1318 }
1319
1320 /* mappings between index1 and index2-1 are supposed to be ordered
1321  * return value is the index of the last mapping for which end>cluster_num
1322  */
1323 static inline int find_mapping_for_cluster_aux(BDRVVVFATState* s,int cluster_num,int index1,int index2)
1324 {
1325     while(1) {
1326         int index3;
1327         mapping_t* mapping;
1328         index3=(index1+index2)/2;
1329         mapping=array_get(&(s->mapping),index3);
1330         assert(mapping->begin < mapping->end);
1331         if(mapping->begin>=cluster_num) {
1332             assert(index2!=index3 || index2==0);
1333             if(index2==index3)
1334                 return index1;
1335             index2=index3;
1336         } else {
1337             if(index1==index3)
1338                 return mapping->end<=cluster_num ? index2 : index1;
1339             index1=index3;
1340         }
1341         assert(index1<=index2);
1342         DLOG(mapping=array_get(&(s->mapping),index1);
1343         assert(mapping->begin<=cluster_num);
1344         assert(index2 >= s->mapping.next ||
1345                 ((mapping = array_get(&(s->mapping),index2)) &&
1346                 mapping->end>cluster_num)));
1347     }
1348 }
1349
1350 static inline mapping_t* find_mapping_for_cluster(BDRVVVFATState* s,int cluster_num)
1351 {
1352     int index=find_mapping_for_cluster_aux(s,cluster_num,0,s->mapping.next);
1353     mapping_t* mapping;
1354     if(index>=s->mapping.next)
1355         return NULL;
1356     mapping=array_get(&(s->mapping),index);
1357     if(mapping->begin>cluster_num)
1358         return NULL;
1359     assert(mapping->begin<=cluster_num && mapping->end>cluster_num);
1360     return mapping;
1361 }
1362
1363 static int open_file(BDRVVVFATState* s,mapping_t* mapping)
1364 {
1365     if(!mapping)
1366         return -1;
1367     if(!s->current_mapping ||
1368             strcmp(s->current_mapping->path,mapping->path)) {
1369         /* open file */
1370         int fd = qemu_open(mapping->path, O_RDONLY | O_BINARY | O_LARGEFILE);
1371         if(fd<0)
1372             return -1;
1373         vvfat_close_current_file(s);
1374         s->current_fd = fd;
1375         s->current_mapping = mapping;
1376     }
1377     return 0;
1378 }
1379
1380 static inline int read_cluster(BDRVVVFATState *s,int cluster_num)
1381 {
1382     if(s->current_cluster != cluster_num) {
1383         int result=0;
1384         off_t offset;
1385         assert(!s->current_mapping || s->current_fd || (s->current_mapping->mode & MODE_DIRECTORY));
1386         if(!s->current_mapping
1387                 || s->current_mapping->begin>cluster_num
1388                 || s->current_mapping->end<=cluster_num) {
1389             /* binary search of mappings for file */
1390             mapping_t* mapping=find_mapping_for_cluster(s,cluster_num);
1391
1392             assert(!mapping || (cluster_num>=mapping->begin && cluster_num<mapping->end));
1393
1394             if (mapping && mapping->mode & MODE_DIRECTORY) {
1395                 vvfat_close_current_file(s);
1396                 s->current_mapping = mapping;
1397 read_cluster_directory:
1398                 offset = s->cluster_size*(cluster_num-s->current_mapping->begin);
1399                 s->cluster = (unsigned char*)s->directory.pointer+offset
1400                         + 0x20*s->current_mapping->info.dir.first_dir_index;
1401                 assert(((s->cluster-(unsigned char*)s->directory.pointer)%s->cluster_size)==0);
1402                 assert((char*)s->cluster+s->cluster_size <= s->directory.pointer+s->directory.next*s->directory.item_size);
1403                 s->current_cluster = cluster_num;
1404                 return 0;
1405             }
1406
1407             if(open_file(s,mapping))
1408                 return -2;
1409         } else if (s->current_mapping->mode & MODE_DIRECTORY)
1410             goto read_cluster_directory;
1411
1412         assert(s->current_fd);
1413
1414         offset=s->cluster_size*(cluster_num-s->current_mapping->begin)+s->current_mapping->info.file.offset;
1415         if(lseek(s->current_fd, offset, SEEK_SET)!=offset)
1416             return -3;
1417         s->cluster=s->cluster_buffer;
1418         result=read(s->current_fd,s->cluster,s->cluster_size);
1419         if(result<0) {
1420             s->current_cluster = -1;
1421             return -1;
1422         }
1423         s->current_cluster = cluster_num;
1424     }
1425     return 0;
1426 }
1427
1428 #ifdef DEBUG
1429 static void print_direntry(const direntry_t* direntry)
1430 {
1431     int j = 0;
1432     char buffer[1024];
1433
1434     fprintf(stderr, "direntry %p: ", direntry);
1435     if(!direntry)
1436         return;
1437     if(is_long_name(direntry)) {
1438         unsigned char* c=(unsigned char*)direntry;
1439         int i;
1440         for(i=1;i<11 && c[i] && c[i]!=0xff;i+=2)
1441 #define ADD_CHAR(c) {buffer[j] = (c); if (buffer[j] < ' ') buffer[j] = 0xb0; j++;}
1442             ADD_CHAR(c[i]);
1443         for(i=14;i<26 && c[i] && c[i]!=0xff;i+=2)
1444             ADD_CHAR(c[i]);
1445         for(i=28;i<32 && c[i] && c[i]!=0xff;i+=2)
1446             ADD_CHAR(c[i]);
1447         buffer[j] = 0;
1448         fprintf(stderr, "%s\n", buffer);
1449     } else {
1450         int i;
1451         for(i=0;i<11;i++)
1452             ADD_CHAR(direntry->name[i]);
1453         buffer[j] = 0;
1454         fprintf(stderr,"%s attributes=0x%02x begin=%d size=%d\n",
1455                 buffer,
1456                 direntry->attributes,
1457                 begin_of_direntry(direntry),le32_to_cpu(direntry->size));
1458     }
1459 }
1460
1461 static void print_mapping(const mapping_t* mapping)
1462 {
1463     fprintf(stderr, "mapping (%p): begin, end = %d, %d, dir_index = %d, "
1464         "first_mapping_index = %d, name = %s, mode = 0x%x, " ,
1465         mapping, mapping->begin, mapping->end, mapping->dir_index,
1466         mapping->first_mapping_index, mapping->path, mapping->mode);
1467
1468     if (mapping->mode & MODE_DIRECTORY)
1469         fprintf(stderr, "parent_mapping_index = %d, first_dir_index = %d\n", mapping->info.dir.parent_mapping_index, mapping->info.dir.first_dir_index);
1470     else
1471         fprintf(stderr, "offset = %d\n", mapping->info.file.offset);
1472 }
1473 #endif
1474
1475 static int vvfat_read(BlockDriverState *bs, int64_t sector_num,
1476                     uint8_t *buf, int nb_sectors)
1477 {
1478     BDRVVVFATState *s = bs->opaque;
1479     int i;
1480
1481     for(i=0;i<nb_sectors;i++,sector_num++) {
1482         if (sector_num >= bs->total_sectors)
1483            return -1;
1484         if (s->qcow) {
1485             int64_t n;
1486             int ret;
1487             ret = bdrv_is_allocated(s->qcow->bs, sector_num * BDRV_SECTOR_SIZE,
1488                                     (nb_sectors - i) * BDRV_SECTOR_SIZE, &n);
1489             if (ret < 0) {
1490                 return ret;
1491             }
1492             if (ret) {
1493                 DLOG(fprintf(stderr, "sectors %" PRId64 "+%" PRId64
1494                              " allocated\n", sector_num,
1495                              n >> BDRV_SECTOR_BITS));
1496                 if (bdrv_read(s->qcow, sector_num, buf + i * 0x200,
1497                               n >> BDRV_SECTOR_BITS)) {
1498                     return -1;
1499                 }
1500                 i += (n >> BDRV_SECTOR_BITS) - 1;
1501                 sector_num += (n >> BDRV_SECTOR_BITS) - 1;
1502                 continue;
1503             }
1504             DLOG(fprintf(stderr, "sector %" PRId64 " not allocated\n",
1505                          sector_num));
1506         }
1507         if (sector_num < s->offset_to_root_dir) {
1508             if (sector_num < s->offset_to_fat) {
1509                 memcpy(buf + i * 0x200,
1510                        &(s->first_sectors[sector_num * 0x200]),
1511                        0x200);
1512             } else if (sector_num < s->offset_to_fat + s->sectors_per_fat) {
1513                 memcpy(buf + i * 0x200,
1514                        &(s->fat.pointer[(sector_num
1515                                        - s->offset_to_fat) * 0x200]),
1516                        0x200);
1517             } else if (sector_num < s->offset_to_root_dir) {
1518                 memcpy(buf + i * 0x200,
1519                        &(s->fat.pointer[(sector_num - s->offset_to_fat
1520                                        - s->sectors_per_fat) * 0x200]),
1521                        0x200);
1522             }
1523         } else {
1524             uint32_t sector = sector_num - s->offset_to_root_dir,
1525             sector_offset_in_cluster=(sector%s->sectors_per_cluster),
1526             cluster_num=sector/s->sectors_per_cluster;
1527             if(cluster_num > s->cluster_count || read_cluster(s, cluster_num) != 0) {
1528                 /* LATER TODO: strict: return -1; */
1529                 memset(buf+i*0x200,0,0x200);
1530                 continue;
1531             }
1532             memcpy(buf+i*0x200,s->cluster+sector_offset_in_cluster*0x200,0x200);
1533         }
1534     }
1535     return 0;
1536 }
1537
1538 static int coroutine_fn
1539 vvfat_co_preadv(BlockDriverState *bs, uint64_t offset, uint64_t bytes,
1540                 QEMUIOVector *qiov, int flags)
1541 {
1542     int ret;
1543     BDRVVVFATState *s = bs->opaque;
1544     uint64_t sector_num = offset >> BDRV_SECTOR_BITS;
1545     int nb_sectors = bytes >> BDRV_SECTOR_BITS;
1546     void *buf;
1547
1548     assert((offset & (BDRV_SECTOR_SIZE - 1)) == 0);
1549     assert((bytes & (BDRV_SECTOR_SIZE - 1)) == 0);
1550
1551     buf = g_try_malloc(bytes);
1552     if (bytes && buf == NULL) {
1553         return -ENOMEM;
1554     }
1555
1556     qemu_co_mutex_lock(&s->lock);
1557     ret = vvfat_read(bs, sector_num, buf, nb_sectors);
1558     qemu_co_mutex_unlock(&s->lock);
1559
1560     qemu_iovec_from_buf(qiov, 0, buf, bytes);
1561     g_free(buf);
1562
1563     return ret;
1564 }
1565
1566 /* LATER TODO: statify all functions */
1567
1568 /*
1569  * Idea of the write support (use snapshot):
1570  *
1571  * 1. check if all data is consistent, recording renames, modifications,
1572  *    new files and directories (in s->commits).
1573  *
1574  * 2. if the data is not consistent, stop committing
1575  *
1576  * 3. handle renames, and create new files and directories (do not yet
1577  *    write their contents)
1578  *
1579  * 4. walk the directories, fixing the mapping and direntries, and marking
1580  *    the handled mappings as not deleted
1581  *
1582  * 5. commit the contents of the files
1583  *
1584  * 6. handle deleted files and directories
1585  *
1586  */
1587
1588 typedef struct commit_t {
1589     char* path;
1590     union {
1591         struct { uint32_t cluster; } rename;
1592         struct { int dir_index; uint32_t modified_offset; } writeout;
1593         struct { uint32_t first_cluster; } new_file;
1594         struct { uint32_t cluster; } mkdir;
1595     } param;
1596     /* DELETEs and RMDIRs are handled differently: see handle_deletes() */
1597     enum {
1598         ACTION_RENAME, ACTION_WRITEOUT, ACTION_NEW_FILE, ACTION_MKDIR
1599     } action;
1600 } commit_t;
1601
1602 static void clear_commits(BDRVVVFATState* s)
1603 {
1604     int i;
1605 DLOG(fprintf(stderr, "clear_commits (%d commits)\n", s->commits.next));
1606     for (i = 0; i < s->commits.next; i++) {
1607         commit_t* commit = array_get(&(s->commits), i);
1608         assert(commit->path || commit->action == ACTION_WRITEOUT);
1609         if (commit->action != ACTION_WRITEOUT) {
1610             assert(commit->path);
1611             g_free(commit->path);
1612         } else
1613             assert(commit->path == NULL);
1614     }
1615     s->commits.next = 0;
1616 }
1617
1618 static void schedule_rename(BDRVVVFATState* s,
1619         uint32_t cluster, char* new_path)
1620 {
1621     commit_t* commit = array_get_next(&(s->commits));
1622     commit->path = new_path;
1623     commit->param.rename.cluster = cluster;
1624     commit->action = ACTION_RENAME;
1625 }
1626
1627 static void schedule_writeout(BDRVVVFATState* s,
1628         int dir_index, uint32_t modified_offset)
1629 {
1630     commit_t* commit = array_get_next(&(s->commits));
1631     commit->path = NULL;
1632     commit->param.writeout.dir_index = dir_index;
1633     commit->param.writeout.modified_offset = modified_offset;
1634     commit->action = ACTION_WRITEOUT;
1635 }
1636
1637 static void schedule_new_file(BDRVVVFATState* s,
1638         char* path, uint32_t first_cluster)
1639 {
1640     commit_t* commit = array_get_next(&(s->commits));
1641     commit->path = path;
1642     commit->param.new_file.first_cluster = first_cluster;
1643     commit->action = ACTION_NEW_FILE;
1644 }
1645
1646 static void schedule_mkdir(BDRVVVFATState* s, uint32_t cluster, char* path)
1647 {
1648     commit_t* commit = array_get_next(&(s->commits));
1649     commit->path = path;
1650     commit->param.mkdir.cluster = cluster;
1651     commit->action = ACTION_MKDIR;
1652 }
1653
1654 typedef struct {
1655     /*
1656      * Since the sequence number is at most 0x3f, and the filename
1657      * length is at most 13 times the sequence number, the maximal
1658      * filename length is 0x3f * 13 bytes.
1659      */
1660     unsigned char name[0x3f * 13 + 1];
1661     int checksum, len;
1662     int sequence_number;
1663 } long_file_name;
1664
1665 static void lfn_init(long_file_name* lfn)
1666 {
1667    lfn->sequence_number = lfn->len = 0;
1668    lfn->checksum = 0x100;
1669 }
1670
1671 /* return 0 if parsed successfully, > 0 if no long name, < 0 if error */
1672 static int parse_long_name(long_file_name* lfn,
1673         const direntry_t* direntry)
1674 {
1675     int i, j, offset;
1676     const unsigned char* pointer = (const unsigned char*)direntry;
1677
1678     if (!is_long_name(direntry))
1679         return 1;
1680
1681     if (pointer[0] & 0x40) {
1682         lfn->sequence_number = pointer[0] & 0x3f;
1683         lfn->checksum = pointer[13];
1684         lfn->name[0] = 0;
1685         lfn->name[lfn->sequence_number * 13] = 0;
1686     } else if ((pointer[0] & 0x3f) != --lfn->sequence_number)
1687         return -1;
1688     else if (pointer[13] != lfn->checksum)
1689         return -2;
1690     else if (pointer[12] || pointer[26] || pointer[27])
1691         return -3;
1692
1693     offset = 13 * (lfn->sequence_number - 1);
1694     for (i = 0, j = 1; i < 13; i++, j+=2) {
1695         if (j == 11)
1696             j = 14;
1697         else if (j == 26)
1698             j = 28;
1699
1700         if (pointer[j+1] == 0)
1701             lfn->name[offset + i] = pointer[j];
1702         else if (pointer[j+1] != 0xff || (pointer[0] & 0x40) == 0)
1703             return -4;
1704         else
1705             lfn->name[offset + i] = 0;
1706     }
1707
1708     if (pointer[0] & 0x40)
1709         lfn->len = offset + strlen((char*)lfn->name + offset);
1710
1711     return 0;
1712 }
1713
1714 /* returns 0 if successful, >0 if no short_name, and <0 on error */
1715 static int parse_short_name(BDRVVVFATState* s,
1716         long_file_name* lfn, direntry_t* direntry)
1717 {
1718     int i, j;
1719
1720     if (!is_short_name(direntry))
1721         return 1;
1722
1723     for (j = 7; j >= 0 && direntry->name[j] == ' '; j--);
1724     for (i = 0; i <= j; i++) {
1725         if (direntry->name[i] <= ' ' || direntry->name[i] > 0x7f)
1726             return -1;
1727         else if (s->downcase_short_names)
1728             lfn->name[i] = qemu_tolower(direntry->name[i]);
1729         else
1730             lfn->name[i] = direntry->name[i];
1731     }
1732
1733     for (j = 2; j >= 0 && direntry->name[8 + j] == ' '; j--) {
1734     }
1735     if (j >= 0) {
1736         lfn->name[i++] = '.';
1737         lfn->name[i + j + 1] = '\0';
1738         for (;j >= 0; j--) {
1739             uint8_t c = direntry->name[8 + j];
1740             if (c <= ' ' || c > 0x7f) {
1741                 return -2;
1742             } else if (s->downcase_short_names) {
1743                 lfn->name[i + j] = qemu_tolower(c);
1744             } else {
1745                 lfn->name[i + j] = c;
1746             }
1747         }
1748     } else
1749         lfn->name[i + j + 1] = '\0';
1750
1751     if (lfn->name[0] == 0x05) {
1752         lfn->name[0] = 0xe5;
1753     }
1754     lfn->len = strlen((char*)lfn->name);
1755
1756     return 0;
1757 }
1758
1759 static inline uint32_t modified_fat_get(BDRVVVFATState* s,
1760         unsigned int cluster)
1761 {
1762     if (cluster < s->last_cluster_of_root_directory) {
1763         if (cluster + 1 == s->last_cluster_of_root_directory)
1764             return s->max_fat_value;
1765         else
1766             return cluster + 1;
1767     }
1768
1769     if (s->fat_type==32) {
1770         uint32_t* entry=((uint32_t*)s->fat2)+cluster;
1771         return le32_to_cpu(*entry);
1772     } else if (s->fat_type==16) {
1773         uint16_t* entry=((uint16_t*)s->fat2)+cluster;
1774         return le16_to_cpu(*entry);
1775     } else {
1776         const uint8_t* x=s->fat2+cluster*3/2;
1777         return ((x[0]|(x[1]<<8))>>(cluster&1?4:0))&0x0fff;
1778     }
1779 }
1780
1781 static inline bool cluster_was_modified(BDRVVVFATState *s,
1782                                         uint32_t cluster_num)
1783 {
1784     int was_modified = 0;
1785     int i;
1786
1787     if (s->qcow == NULL) {
1788         return 0;
1789     }
1790
1791     for (i = 0; !was_modified && i < s->sectors_per_cluster; i++) {
1792         was_modified = bdrv_is_allocated(s->qcow->bs,
1793                                          (cluster2sector(s, cluster_num) +
1794                                           i) * BDRV_SECTOR_SIZE,
1795                                          BDRV_SECTOR_SIZE, NULL);
1796     }
1797
1798     /*
1799      * Note that this treats failures to learn allocation status the
1800      * same as if an allocation has occurred.  It's as safe as
1801      * anything else, given that a failure to learn allocation status
1802      * will probably result in more failures.
1803      */
1804     return !!was_modified;
1805 }
1806
1807 static const char* get_basename(const char* path)
1808 {
1809     char* basename = strrchr(path, '/');
1810     if (basename == NULL)
1811         return path;
1812     else
1813         return basename + 1; /* strip '/' */
1814 }
1815
1816 /*
1817  * The array s->used_clusters holds the states of the clusters. If it is
1818  * part of a file, it has bit 2 set, in case of a directory, bit 1. If it
1819  * was modified, bit 3 is set.
1820  * If any cluster is allocated, but not part of a file or directory, this
1821  * driver refuses to commit.
1822  */
1823 typedef enum {
1824      USED_DIRECTORY = 1, USED_FILE = 2, USED_ANY = 3, USED_ALLOCATED = 4
1825 } used_t;
1826
1827 /*
1828  * get_cluster_count_for_direntry() not only determines how many clusters
1829  * are occupied by direntry, but also if it was renamed or modified.
1830  *
1831  * A file is thought to be renamed *only* if there already was a file with
1832  * exactly the same first cluster, but a different name.
1833  *
1834  * Further, the files/directories handled by this function are
1835  * assumed to be *not* deleted (and *only* those).
1836  */
1837 static uint32_t get_cluster_count_for_direntry(BDRVVVFATState* s,
1838         direntry_t* direntry, const char* path)
1839 {
1840     /*
1841      * This is a little bit tricky:
1842      * IF the guest OS just inserts a cluster into the file chain,
1843      * and leaves the rest alone, (i.e. the original file had clusters
1844      * 15 -> 16, but now has 15 -> 32 -> 16), then the following happens:
1845      *
1846      * - do_commit will write the cluster into the file at the given
1847      *   offset, but
1848      *
1849      * - the cluster which is overwritten should be moved to a later
1850      *   position in the file.
1851      *
1852      * I am not aware that any OS does something as braindead, but this
1853      * situation could happen anyway when not committing for a long time.
1854      * Just to be sure that this does not bite us, detect it, and copy the
1855      * contents of the clusters to-be-overwritten into the qcow.
1856      */
1857     int copy_it = 0;
1858     int was_modified = 0;
1859     int32_t ret = 0;
1860
1861     uint32_t cluster_num = begin_of_direntry(direntry);
1862     uint32_t offset = 0;
1863     int first_mapping_index = -1;
1864     mapping_t* mapping = NULL;
1865     const char* basename2 = NULL;
1866
1867     vvfat_close_current_file(s);
1868
1869     /* the root directory */
1870     if (cluster_num == 0)
1871         return 0;
1872
1873     /* write support */
1874     if (s->qcow) {
1875         basename2 = get_basename(path);
1876
1877         mapping = find_mapping_for_cluster(s, cluster_num);
1878
1879         if (mapping) {
1880             const char* basename;
1881
1882             assert(mapping->mode & MODE_DELETED);
1883             mapping->mode &= ~MODE_DELETED;
1884
1885             basename = get_basename(mapping->path);
1886
1887             assert(mapping->mode & MODE_NORMAL);
1888
1889             /* rename */
1890             if (strcmp(basename, basename2))
1891                 schedule_rename(s, cluster_num, g_strdup(path));
1892         } else if (is_file(direntry))
1893             /* new file */
1894             schedule_new_file(s, g_strdup(path), cluster_num);
1895         else {
1896             abort();
1897             return 0;
1898         }
1899     }
1900
1901     while(1) {
1902         if (s->qcow) {
1903             if (!copy_it && cluster_was_modified(s, cluster_num)) {
1904                 if (mapping == NULL ||
1905                         mapping->begin > cluster_num ||
1906                         mapping->end <= cluster_num)
1907                 mapping = find_mapping_for_cluster(s, cluster_num);
1908
1909
1910                 if (mapping &&
1911                         (mapping->mode & MODE_DIRECTORY) == 0) {
1912
1913                     /* was modified in qcow */
1914                     if (offset != mapping->info.file.offset + s->cluster_size
1915                             * (cluster_num - mapping->begin)) {
1916                         /* offset of this cluster in file chain has changed */
1917                         abort();
1918                         copy_it = 1;
1919                     } else if (offset == 0) {
1920                         const char* basename = get_basename(mapping->path);
1921
1922                         if (strcmp(basename, basename2))
1923                             copy_it = 1;
1924                         first_mapping_index = array_index(&(s->mapping), mapping);
1925                     }
1926
1927                     if (mapping->first_mapping_index != first_mapping_index
1928                             && mapping->info.file.offset > 0) {
1929                         abort();
1930                         copy_it = 1;
1931                     }
1932
1933                     /* need to write out? */
1934                     if (!was_modified && is_file(direntry)) {
1935                         was_modified = 1;
1936                         schedule_writeout(s, mapping->dir_index, offset);
1937                     }
1938                 }
1939             }
1940
1941             if (copy_it) {
1942                 int i;
1943                 /*
1944                  * This is horribly inefficient, but that is okay, since
1945                  * it is rarely executed, if at all.
1946                  */
1947                 int64_t offset = cluster2sector(s, cluster_num);
1948
1949                 vvfat_close_current_file(s);
1950                 for (i = 0; i < s->sectors_per_cluster; i++) {
1951                     int res;
1952
1953                     res = bdrv_is_allocated(s->qcow->bs,
1954                                             (offset + i) * BDRV_SECTOR_SIZE,
1955                                             BDRV_SECTOR_SIZE, NULL);
1956                     if (res < 0) {
1957                         return -1;
1958                     }
1959                     if (!res) {
1960                         res = vvfat_read(s->bs, offset, s->cluster_buffer, 1);
1961                         if (res) {
1962                             return -1;
1963                         }
1964                         res = bdrv_write(s->qcow, offset, s->cluster_buffer, 1);
1965                         if (res) {
1966                             return -2;
1967                         }
1968                     }
1969                 }
1970             }
1971         }
1972
1973         ret++;
1974         if (s->used_clusters[cluster_num] & USED_ANY)
1975             return 0;
1976         s->used_clusters[cluster_num] = USED_FILE;
1977
1978         cluster_num = modified_fat_get(s, cluster_num);
1979
1980         if (fat_eof(s, cluster_num))
1981             return ret;
1982         else if (cluster_num < 2 || cluster_num > s->max_fat_value - 16)
1983             return -1;
1984
1985         offset += s->cluster_size;
1986     }
1987 }
1988
1989 /*
1990  * This function looks at the modified data (qcow).
1991  * It returns 0 upon inconsistency or error, and the number of clusters
1992  * used by the directory, its subdirectories and their files.
1993  */
1994 static int check_directory_consistency(BDRVVVFATState *s,
1995         int cluster_num, const char* path)
1996 {
1997     int ret = 0;
1998     unsigned char* cluster = g_malloc(s->cluster_size);
1999     direntry_t* direntries = (direntry_t*)cluster;
2000     mapping_t* mapping = find_mapping_for_cluster(s, cluster_num);
2001
2002     long_file_name lfn;
2003     int path_len = strlen(path);
2004     char path2[PATH_MAX + 1];
2005
2006     assert(path_len < PATH_MAX); /* len was tested before! */
2007     pstrcpy(path2, sizeof(path2), path);
2008     path2[path_len] = '/';
2009     path2[path_len + 1] = '\0';
2010
2011     if (mapping) {
2012         const char* basename = get_basename(mapping->path);
2013         const char* basename2 = get_basename(path);
2014
2015         assert(mapping->mode & MODE_DIRECTORY);
2016
2017         assert(mapping->mode & MODE_DELETED);
2018         mapping->mode &= ~MODE_DELETED;
2019
2020         if (strcmp(basename, basename2))
2021             schedule_rename(s, cluster_num, g_strdup(path));
2022     } else
2023         /* new directory */
2024         schedule_mkdir(s, cluster_num, g_strdup(path));
2025
2026     lfn_init(&lfn);
2027     do {
2028         int i;
2029         int subret = 0;
2030
2031         ret++;
2032
2033         if (s->used_clusters[cluster_num] & USED_ANY) {
2034             fprintf(stderr, "cluster %d used more than once\n", (int)cluster_num);
2035             goto fail;
2036         }
2037         s->used_clusters[cluster_num] = USED_DIRECTORY;
2038
2039 DLOG(fprintf(stderr, "read cluster %d (sector %d)\n", (int)cluster_num, (int)cluster2sector(s, cluster_num)));
2040         subret = vvfat_read(s->bs, cluster2sector(s, cluster_num), cluster,
2041                 s->sectors_per_cluster);
2042         if (subret) {
2043             fprintf(stderr, "Error fetching direntries\n");
2044         fail:
2045             g_free(cluster);
2046             return 0;
2047         }
2048
2049         for (i = 0; i < 0x10 * s->sectors_per_cluster; i++) {
2050             int cluster_count = 0;
2051
2052 DLOG(fprintf(stderr, "check direntry %d:\n", i); print_direntry(direntries + i));
2053             if (is_volume_label(direntries + i) || is_dot(direntries + i) ||
2054                     is_free(direntries + i))
2055                 continue;
2056
2057             subret = parse_long_name(&lfn, direntries + i);
2058             if (subret < 0) {
2059                 fprintf(stderr, "Error in long name\n");
2060                 goto fail;
2061             }
2062             if (subret == 0 || is_free(direntries + i))
2063                 continue;
2064
2065             if (fat_chksum(direntries+i) != lfn.checksum) {
2066                 subret = parse_short_name(s, &lfn, direntries + i);
2067                 if (subret < 0) {
2068                     fprintf(stderr, "Error in short name (%d)\n", subret);
2069                     goto fail;
2070                 }
2071                 if (subret > 0 || !strcmp((char*)lfn.name, ".")
2072                         || !strcmp((char*)lfn.name, ".."))
2073                     continue;
2074             }
2075             lfn.checksum = 0x100; /* cannot use long name twice */
2076
2077             if (path_len + 1 + lfn.len >= PATH_MAX) {
2078                 fprintf(stderr, "Name too long: %s/%s\n", path, lfn.name);
2079                 goto fail;
2080             }
2081             pstrcpy(path2 + path_len + 1, sizeof(path2) - path_len - 1,
2082                     (char*)lfn.name);
2083
2084             if (is_directory(direntries + i)) {
2085                 if (begin_of_direntry(direntries + i) == 0) {
2086                     DLOG(fprintf(stderr, "invalid begin for directory: %s\n", path2); print_direntry(direntries + i));
2087                     goto fail;
2088                 }
2089                 cluster_count = check_directory_consistency(s,
2090                         begin_of_direntry(direntries + i), path2);
2091                 if (cluster_count == 0) {
2092                     DLOG(fprintf(stderr, "problem in directory %s:\n", path2); print_direntry(direntries + i));
2093                     goto fail;
2094                 }
2095             } else if (is_file(direntries + i)) {
2096                 /* check file size with FAT */
2097                 cluster_count = get_cluster_count_for_direntry(s, direntries + i, path2);
2098                 if (cluster_count !=
2099             DIV_ROUND_UP(le32_to_cpu(direntries[i].size), s->cluster_size)) {
2100                     DLOG(fprintf(stderr, "Cluster count mismatch\n"));
2101                     goto fail;
2102                 }
2103             } else
2104                 abort(); /* cluster_count = 0; */
2105
2106             ret += cluster_count;
2107         }
2108
2109         cluster_num = modified_fat_get(s, cluster_num);
2110     } while(!fat_eof(s, cluster_num));
2111
2112     g_free(cluster);
2113     return ret;
2114 }
2115
2116 /* returns 1 on success */
2117 static int is_consistent(BDRVVVFATState* s)
2118 {
2119     int i, check;
2120     int used_clusters_count = 0;
2121
2122 DLOG(checkpoint());
2123     /*
2124      * - get modified FAT
2125      * - compare the two FATs (TODO)
2126      * - get buffer for marking used clusters
2127      * - recurse direntries from root (using bs->bdrv_read to make
2128      *    sure to get the new data)
2129      *   - check that the FAT agrees with the size
2130      *   - count the number of clusters occupied by this directory and
2131      *     its files
2132      * - check that the cumulative used cluster count agrees with the
2133      *   FAT
2134      * - if all is fine, return number of used clusters
2135      */
2136     if (s->fat2 == NULL) {
2137         int size = 0x200 * s->sectors_per_fat;
2138         s->fat2 = g_malloc(size);
2139         memcpy(s->fat2, s->fat.pointer, size);
2140     }
2141     check = vvfat_read(s->bs,
2142             s->offset_to_fat, s->fat2, s->sectors_per_fat);
2143     if (check) {
2144         fprintf(stderr, "Could not copy fat\n");
2145         return 0;
2146     }
2147     assert (s->used_clusters);
2148     for (i = 0; i < sector2cluster(s, s->sector_count); i++)
2149         s->used_clusters[i] &= ~USED_ANY;
2150
2151     clear_commits(s);
2152
2153     /* mark every mapped file/directory as deleted.
2154      * (check_directory_consistency() will unmark those still present). */
2155     if (s->qcow)
2156         for (i = 0; i < s->mapping.next; i++) {
2157             mapping_t* mapping = array_get(&(s->mapping), i);
2158             if (mapping->first_mapping_index < 0)
2159                 mapping->mode |= MODE_DELETED;
2160         }
2161
2162     used_clusters_count = check_directory_consistency(s, 0, s->path);
2163     if (used_clusters_count <= 0) {
2164         DLOG(fprintf(stderr, "problem in directory\n"));
2165         return 0;
2166     }
2167
2168     check = s->last_cluster_of_root_directory;
2169     for (i = check; i < sector2cluster(s, s->sector_count); i++) {
2170         if (modified_fat_get(s, i)) {
2171             if(!s->used_clusters[i]) {
2172                 DLOG(fprintf(stderr, "FAT was modified (%d), but cluster is not used?\n", i));
2173                 return 0;
2174             }
2175             check++;
2176         }
2177
2178         if (s->used_clusters[i] == USED_ALLOCATED) {
2179             /* allocated, but not used... */
2180             DLOG(fprintf(stderr, "unused, modified cluster: %d\n", i));
2181             return 0;
2182         }
2183     }
2184
2185     if (check != used_clusters_count)
2186         return 0;
2187
2188     return used_clusters_count;
2189 }
2190
2191 static inline void adjust_mapping_indices(BDRVVVFATState* s,
2192         int offset, int adjust)
2193 {
2194     int i;
2195
2196     for (i = 0; i < s->mapping.next; i++) {
2197         mapping_t* mapping = array_get(&(s->mapping), i);
2198
2199 #define ADJUST_MAPPING_INDEX(name) \
2200         if (mapping->name >= offset) \
2201             mapping->name += adjust
2202
2203         ADJUST_MAPPING_INDEX(first_mapping_index);
2204         if (mapping->mode & MODE_DIRECTORY)
2205             ADJUST_MAPPING_INDEX(info.dir.parent_mapping_index);
2206     }
2207 }
2208
2209 /* insert or update mapping */
2210 static mapping_t* insert_mapping(BDRVVVFATState* s,
2211         uint32_t begin, uint32_t end)
2212 {
2213     /*
2214      * - find mapping where mapping->begin >= begin,
2215      * - if mapping->begin > begin: insert
2216      *   - adjust all references to mappings!
2217      * - else: adjust
2218      * - replace name
2219      */
2220     int index = find_mapping_for_cluster_aux(s, begin, 0, s->mapping.next);
2221     mapping_t* mapping = NULL;
2222     mapping_t* first_mapping = array_get(&(s->mapping), 0);
2223
2224     if (index < s->mapping.next && (mapping = array_get(&(s->mapping), index))
2225             && mapping->begin < begin) {
2226         mapping->end = begin;
2227         index++;
2228         mapping = array_get(&(s->mapping), index);
2229     }
2230     if (index >= s->mapping.next || mapping->begin > begin) {
2231         mapping = array_insert(&(s->mapping), index, 1);
2232         mapping->path = NULL;
2233         adjust_mapping_indices(s, index, +1);
2234     }
2235
2236     mapping->begin = begin;
2237     mapping->end = end;
2238
2239 DLOG(mapping_t* next_mapping;
2240 assert(index + 1 >= s->mapping.next ||
2241 ((next_mapping = array_get(&(s->mapping), index + 1)) &&
2242  next_mapping->begin >= end)));
2243
2244     if (s->current_mapping && first_mapping != (mapping_t*)s->mapping.pointer)
2245         s->current_mapping = array_get(&(s->mapping),
2246                 s->current_mapping - first_mapping);
2247
2248     return mapping;
2249 }
2250
2251 static int remove_mapping(BDRVVVFATState* s, int mapping_index)
2252 {
2253     mapping_t* mapping = array_get(&(s->mapping), mapping_index);
2254     mapping_t* first_mapping = array_get(&(s->mapping), 0);
2255
2256     /* free mapping */
2257     if (mapping->first_mapping_index < 0) {
2258         g_free(mapping->path);
2259     }
2260
2261     /* remove from s->mapping */
2262     array_remove(&(s->mapping), mapping_index);
2263
2264     /* adjust all references to mappings */
2265     adjust_mapping_indices(s, mapping_index, -1);
2266
2267     if (s->current_mapping && first_mapping != (mapping_t*)s->mapping.pointer)
2268         s->current_mapping = array_get(&(s->mapping),
2269                 s->current_mapping - first_mapping);
2270
2271     return 0;
2272 }
2273
2274 static void adjust_dirindices(BDRVVVFATState* s, int offset, int adjust)
2275 {
2276     int i;
2277     for (i = 0; i < s->mapping.next; i++) {
2278         mapping_t* mapping = array_get(&(s->mapping), i);
2279         if (mapping->dir_index >= offset)
2280             mapping->dir_index += adjust;
2281         if ((mapping->mode & MODE_DIRECTORY) &&
2282                 mapping->info.dir.first_dir_index >= offset)
2283             mapping->info.dir.first_dir_index += adjust;
2284     }
2285 }
2286
2287 static direntry_t* insert_direntries(BDRVVVFATState* s,
2288         int dir_index, int count)
2289 {
2290     /*
2291      * make room in s->directory,
2292      * adjust_dirindices
2293      */
2294     direntry_t* result = array_insert(&(s->directory), dir_index, count);
2295     if (result == NULL)
2296         return NULL;
2297     adjust_dirindices(s, dir_index, count);
2298     return result;
2299 }
2300
2301 static int remove_direntries(BDRVVVFATState* s, int dir_index, int count)
2302 {
2303     int ret = array_remove_slice(&(s->directory), dir_index, count);
2304     if (ret)
2305         return ret;
2306     adjust_dirindices(s, dir_index, -count);
2307     return 0;
2308 }
2309
2310 /*
2311  * Adapt the mappings of the cluster chain starting at first cluster
2312  * (i.e. if a file starts at first_cluster, the chain is followed according
2313  * to the modified fat, and the corresponding entries in s->mapping are
2314  * adjusted)
2315  */
2316 static int commit_mappings(BDRVVVFATState* s,
2317         uint32_t first_cluster, int dir_index)
2318 {
2319     mapping_t* mapping = find_mapping_for_cluster(s, first_cluster);
2320     direntry_t* direntry = array_get(&(s->directory), dir_index);
2321     uint32_t cluster = first_cluster;
2322
2323     vvfat_close_current_file(s);
2324
2325     assert(mapping);
2326     assert(mapping->begin == first_cluster);
2327     mapping->first_mapping_index = -1;
2328     mapping->dir_index = dir_index;
2329     mapping->mode = (dir_index <= 0 || is_directory(direntry)) ?
2330         MODE_DIRECTORY : MODE_NORMAL;
2331
2332     while (!fat_eof(s, cluster)) {
2333         uint32_t c, c1;
2334
2335         for (c = cluster, c1 = modified_fat_get(s, c); c + 1 == c1;
2336                 c = c1, c1 = modified_fat_get(s, c1));
2337
2338         c++;
2339         if (c > mapping->end) {
2340             int index = array_index(&(s->mapping), mapping);
2341             int i, max_i = s->mapping.next - index;
2342             for (i = 1; i < max_i && mapping[i].begin < c; i++);
2343             while (--i > 0)
2344                 remove_mapping(s, index + 1);
2345         }
2346         assert(mapping == array_get(&(s->mapping), s->mapping.next - 1)
2347                 || mapping[1].begin >= c);
2348         mapping->end = c;
2349
2350         if (!fat_eof(s, c1)) {
2351             int i = find_mapping_for_cluster_aux(s, c1, 0, s->mapping.next);
2352             mapping_t* next_mapping = i >= s->mapping.next ? NULL :
2353                 array_get(&(s->mapping), i);
2354
2355             if (next_mapping == NULL || next_mapping->begin > c1) {
2356                 int i1 = array_index(&(s->mapping), mapping);
2357
2358                 next_mapping = insert_mapping(s, c1, c1+1);
2359
2360                 if (c1 < c)
2361                     i1++;
2362                 mapping = array_get(&(s->mapping), i1);
2363             }
2364
2365             next_mapping->dir_index = mapping->dir_index;
2366             next_mapping->first_mapping_index =
2367                 mapping->first_mapping_index < 0 ?
2368                 array_index(&(s->mapping), mapping) :
2369                 mapping->first_mapping_index;
2370             next_mapping->path = mapping->path;
2371             next_mapping->mode = mapping->mode;
2372             next_mapping->read_only = mapping->read_only;
2373             if (mapping->mode & MODE_DIRECTORY) {
2374                 next_mapping->info.dir.parent_mapping_index =
2375                         mapping->info.dir.parent_mapping_index;
2376                 next_mapping->info.dir.first_dir_index =
2377                         mapping->info.dir.first_dir_index +
2378                         0x10 * s->sectors_per_cluster *
2379                         (mapping->end - mapping->begin);
2380             } else
2381                 next_mapping->info.file.offset = mapping->info.file.offset +
2382                         mapping->end - mapping->begin;
2383
2384             mapping = next_mapping;
2385         }
2386
2387         cluster = c1;
2388     }
2389
2390     return 0;
2391 }
2392
2393 static int commit_direntries(BDRVVVFATState* s,
2394         int dir_index, int parent_mapping_index)
2395 {
2396     direntry_t* direntry = array_get(&(s->directory), dir_index);
2397     uint32_t first_cluster = dir_index == 0 ? 0 : begin_of_direntry(direntry);
2398     mapping_t* mapping = find_mapping_for_cluster(s, first_cluster);
2399
2400     int factor = 0x10 * s->sectors_per_cluster;
2401     int old_cluster_count, new_cluster_count;
2402     int current_dir_index = mapping->info.dir.first_dir_index;
2403     int first_dir_index = current_dir_index;
2404     int ret, i;
2405     uint32_t c;
2406
2407 DLOG(fprintf(stderr, "commit_direntries for %s, parent_mapping_index %d\n", mapping->path, parent_mapping_index));
2408
2409     assert(direntry);
2410     assert(mapping);
2411     assert(mapping->begin == first_cluster);
2412     assert(mapping->info.dir.first_dir_index < s->directory.next);
2413     assert(mapping->mode & MODE_DIRECTORY);
2414     assert(dir_index == 0 || is_directory(direntry));
2415
2416     mapping->info.dir.parent_mapping_index = parent_mapping_index;
2417
2418     if (first_cluster == 0) {
2419         old_cluster_count = new_cluster_count =
2420             s->last_cluster_of_root_directory;
2421     } else {
2422         for (old_cluster_count = 0, c = first_cluster; !fat_eof(s, c);
2423                 c = fat_get(s, c))
2424             old_cluster_count++;
2425
2426         for (new_cluster_count = 0, c = first_cluster; !fat_eof(s, c);
2427                 c = modified_fat_get(s, c))
2428             new_cluster_count++;
2429     }
2430
2431     if (new_cluster_count > old_cluster_count) {
2432         if (insert_direntries(s,
2433                 current_dir_index + factor * old_cluster_count,
2434                 factor * (new_cluster_count - old_cluster_count)) == NULL)
2435             return -1;
2436     } else if (new_cluster_count < old_cluster_count)
2437         remove_direntries(s,
2438                 current_dir_index + factor * new_cluster_count,
2439                 factor * (old_cluster_count - new_cluster_count));
2440
2441     for (c = first_cluster; !fat_eof(s, c); c = modified_fat_get(s, c)) {
2442         direntry_t *first_direntry;
2443         void* direntry = array_get(&(s->directory), current_dir_index);
2444         int ret = vvfat_read(s->bs, cluster2sector(s, c), direntry,
2445                 s->sectors_per_cluster);
2446         if (ret)
2447             return ret;
2448
2449         /* The first directory entry on the filesystem is the volume name */
2450         first_direntry = (direntry_t*) s->directory.pointer;
2451         assert(!memcmp(first_direntry->name, s->volume_label, 11));
2452
2453         current_dir_index += factor;
2454     }
2455
2456     ret = commit_mappings(s, first_cluster, dir_index);
2457     if (ret)
2458         return ret;
2459
2460     /* recurse */
2461     for (i = 0; i < factor * new_cluster_count; i++) {
2462         direntry = array_get(&(s->directory), first_dir_index + i);
2463         if (is_directory(direntry) && !is_dot(direntry)) {
2464             mapping = find_mapping_for_cluster(s, first_cluster);
2465             assert(mapping->mode & MODE_DIRECTORY);
2466             ret = commit_direntries(s, first_dir_index + i,
2467                 array_index(&(s->mapping), mapping));
2468             if (ret)
2469                 return ret;
2470         }
2471     }
2472
2473     return 0;
2474 }
2475
2476 /* commit one file (adjust contents, adjust mapping),
2477    return first_mapping_index */
2478 static int commit_one_file(BDRVVVFATState* s,
2479         int dir_index, uint32_t offset)
2480 {
2481     direntry_t* direntry = array_get(&(s->directory), dir_index);
2482     uint32_t c = begin_of_direntry(direntry);
2483     uint32_t first_cluster = c;
2484     mapping_t* mapping = find_mapping_for_cluster(s, c);
2485     uint32_t size = filesize_of_direntry(direntry);
2486     char* cluster = g_malloc(s->cluster_size);
2487     uint32_t i;
2488     int fd = 0;
2489
2490     assert(offset < size);
2491     assert((offset % s->cluster_size) == 0);
2492
2493     for (i = s->cluster_size; i < offset; i += s->cluster_size)
2494         c = modified_fat_get(s, c);
2495
2496     fd = qemu_open(mapping->path, O_RDWR | O_CREAT | O_BINARY, 0666);
2497     if (fd < 0) {
2498         fprintf(stderr, "Could not open %s... (%s, %d)\n", mapping->path,
2499                 strerror(errno), errno);
2500         g_free(cluster);
2501         return fd;
2502     }
2503     if (offset > 0) {
2504         if (lseek(fd, offset, SEEK_SET) != offset) {
2505             qemu_close(fd);
2506             g_free(cluster);
2507             return -3;
2508         }
2509     }
2510
2511     while (offset < size) {
2512         uint32_t c1;
2513         int rest_size = (size - offset > s->cluster_size ?
2514                 s->cluster_size : size - offset);
2515         int ret;
2516
2517         c1 = modified_fat_get(s, c);
2518
2519         assert((size - offset == 0 && fat_eof(s, c)) ||
2520                 (size > offset && c >=2 && !fat_eof(s, c)));
2521
2522         ret = vvfat_read(s->bs, cluster2sector(s, c),
2523             (uint8_t*)cluster, (rest_size + 0x1ff) / 0x200);
2524
2525         if (ret < 0) {
2526             qemu_close(fd);
2527             g_free(cluster);
2528             return ret;
2529         }
2530
2531         if (write(fd, cluster, rest_size) < 0) {
2532             qemu_close(fd);
2533             g_free(cluster);
2534             return -2;
2535         }
2536
2537         offset += rest_size;
2538         c = c1;
2539     }
2540
2541     if (ftruncate(fd, size)) {
2542         perror("ftruncate()");
2543         qemu_close(fd);
2544         g_free(cluster);
2545         return -4;
2546     }
2547     qemu_close(fd);
2548     g_free(cluster);
2549
2550     return commit_mappings(s, first_cluster, dir_index);
2551 }
2552
2553 #ifdef DEBUG
2554 /* test, if all mappings point to valid direntries */
2555 static void check1(BDRVVVFATState* s)
2556 {
2557     int i;
2558     for (i = 0; i < s->mapping.next; i++) {
2559         mapping_t* mapping = array_get(&(s->mapping), i);
2560         if (mapping->mode & MODE_DELETED) {
2561             fprintf(stderr, "deleted\n");
2562             continue;
2563         }
2564         assert(mapping->dir_index < s->directory.next);
2565         direntry_t* direntry = array_get(&(s->directory), mapping->dir_index);
2566         assert(mapping->begin == begin_of_direntry(direntry) || mapping->first_mapping_index >= 0);
2567         if (mapping->mode & MODE_DIRECTORY) {
2568             assert(mapping->info.dir.first_dir_index + 0x10 * s->sectors_per_cluster * (mapping->end - mapping->begin) <= s->directory.next);
2569             assert((mapping->info.dir.first_dir_index % (0x10 * s->sectors_per_cluster)) == 0);
2570         }
2571     }
2572 }
2573
2574 /* test, if all direntries have mappings */
2575 static void check2(BDRVVVFATState* s)
2576 {
2577     int i;
2578     int first_mapping = -1;
2579
2580     for (i = 0; i < s->directory.next; i++) {
2581         direntry_t* direntry = array_get(&(s->directory), i);
2582
2583         if (is_short_name(direntry) && begin_of_direntry(direntry)) {
2584             mapping_t* mapping = find_mapping_for_cluster(s, begin_of_direntry(direntry));
2585             assert(mapping);
2586             assert(mapping->dir_index == i || is_dot(direntry));
2587             assert(mapping->begin == begin_of_direntry(direntry) || is_dot(direntry));
2588         }
2589
2590         if ((i % (0x10 * s->sectors_per_cluster)) == 0) {
2591             /* cluster start */
2592             int j, count = 0;
2593
2594             for (j = 0; j < s->mapping.next; j++) {
2595                 mapping_t* mapping = array_get(&(s->mapping), j);
2596                 if (mapping->mode & MODE_DELETED)
2597                     continue;
2598                 if (mapping->mode & MODE_DIRECTORY) {
2599                     if (mapping->info.dir.first_dir_index <= i && mapping->info.dir.first_dir_index + 0x10 * s->sectors_per_cluster > i) {
2600                         assert(++count == 1);
2601                         if (mapping->first_mapping_index == -1)
2602                             first_mapping = array_index(&(s->mapping), mapping);
2603                         else
2604                             assert(first_mapping == mapping->first_mapping_index);
2605                         if (mapping->info.dir.parent_mapping_index < 0)
2606                             assert(j == 0);
2607                         else {
2608                             mapping_t* parent = array_get(&(s->mapping), mapping->info.dir.parent_mapping_index);
2609                             assert(parent->mode & MODE_DIRECTORY);
2610                             assert(parent->info.dir.first_dir_index < mapping->info.dir.first_dir_index);
2611                         }
2612                     }
2613                 }
2614             }
2615             if (count == 0)
2616                 first_mapping = -1;
2617         }
2618     }
2619 }
2620 #endif
2621
2622 static int handle_renames_and_mkdirs(BDRVVVFATState* s)
2623 {
2624     int i;
2625
2626 #ifdef DEBUG
2627     fprintf(stderr, "handle_renames\n");
2628     for (i = 0; i < s->commits.next; i++) {
2629         commit_t* commit = array_get(&(s->commits), i);
2630         fprintf(stderr, "%d, %s (%d, %d)\n", i, commit->path ? commit->path : "(null)", commit->param.rename.cluster, commit->action);
2631     }
2632 #endif
2633
2634     for (i = 0; i < s->commits.next;) {
2635         commit_t* commit = array_get(&(s->commits), i);
2636         if (commit->action == ACTION_RENAME) {
2637             mapping_t* mapping = find_mapping_for_cluster(s,
2638                     commit->param.rename.cluster);
2639             char* old_path = mapping->path;
2640
2641             assert(commit->path);
2642             mapping->path = commit->path;
2643             if (rename(old_path, mapping->path))
2644                 return -2;
2645
2646             if (mapping->mode & MODE_DIRECTORY) {
2647                 int l1 = strlen(mapping->path);
2648                 int l2 = strlen(old_path);
2649                 int diff = l1 - l2;
2650                 direntry_t* direntry = array_get(&(s->directory),
2651                         mapping->info.dir.first_dir_index);
2652                 uint32_t c = mapping->begin;
2653                 int i = 0;
2654
2655                 /* recurse */
2656                 while (!fat_eof(s, c)) {
2657                     do {
2658                         direntry_t* d = direntry + i;
2659
2660                         if (is_file(d) || (is_directory(d) && !is_dot(d))) {
2661                             mapping_t* m = find_mapping_for_cluster(s,
2662                                     begin_of_direntry(d));
2663                             int l = strlen(m->path);
2664                             char* new_path = g_malloc(l + diff + 1);
2665
2666                             assert(!strncmp(m->path, mapping->path, l2));
2667
2668                             pstrcpy(new_path, l + diff + 1, mapping->path);
2669                             pstrcpy(new_path + l1, l + diff + 1 - l1,
2670                                     m->path + l2);
2671
2672                             schedule_rename(s, m->begin, new_path);
2673                         }
2674                         i++;
2675                     } while((i % (0x10 * s->sectors_per_cluster)) != 0);
2676                     c = fat_get(s, c);
2677                 }
2678             }
2679
2680             g_free(old_path);
2681             array_remove(&(s->commits), i);
2682             continue;
2683         } else if (commit->action == ACTION_MKDIR) {
2684             mapping_t* mapping;
2685             int j, parent_path_len;
2686
2687 #ifdef __MINGW32__
2688             if (mkdir(commit->path))
2689                 return -5;
2690 #else
2691             if (mkdir(commit->path, 0755))
2692                 return -5;
2693 #endif
2694
2695             mapping = insert_mapping(s, commit->param.mkdir.cluster,
2696                     commit->param.mkdir.cluster + 1);
2697             if (mapping == NULL)
2698                 return -6;
2699
2700             mapping->mode = MODE_DIRECTORY;
2701             mapping->read_only = 0;
2702             mapping->path = commit->path;
2703             j = s->directory.next;
2704             assert(j);
2705             insert_direntries(s, s->directory.next,
2706                     0x10 * s->sectors_per_cluster);
2707             mapping->info.dir.first_dir_index = j;
2708
2709             parent_path_len = strlen(commit->path)
2710                 - strlen(get_basename(commit->path)) - 1;
2711             for (j = 0; j < s->mapping.next; j++) {
2712                 mapping_t* m = array_get(&(s->mapping), j);
2713                 if (m->first_mapping_index < 0 && m != mapping &&
2714                         !strncmp(m->path, mapping->path, parent_path_len) &&
2715                         strlen(m->path) == parent_path_len)
2716                     break;
2717             }
2718             assert(j < s->mapping.next);
2719             mapping->info.dir.parent_mapping_index = j;
2720
2721             array_remove(&(s->commits), i);
2722             continue;
2723         }
2724
2725         i++;
2726     }
2727     return 0;
2728 }
2729
2730 /*
2731  * TODO: make sure that the short name is not matching *another* file
2732  */
2733 static int handle_commits(BDRVVVFATState* s)
2734 {
2735     int i, fail = 0;
2736
2737     vvfat_close_current_file(s);
2738
2739     for (i = 0; !fail && i < s->commits.next; i++) {
2740         commit_t* commit = array_get(&(s->commits), i);
2741         switch(commit->action) {
2742         case ACTION_RENAME: case ACTION_MKDIR:
2743             abort();
2744             fail = -2;
2745             break;
2746         case ACTION_WRITEOUT: {
2747 #ifndef NDEBUG
2748             /* these variables are only used by assert() below */
2749             direntry_t* entry = array_get(&(s->directory),
2750                     commit->param.writeout.dir_index);
2751             uint32_t begin = begin_of_direntry(entry);
2752             mapping_t* mapping = find_mapping_for_cluster(s, begin);
2753 #endif
2754
2755             assert(mapping);
2756             assert(mapping->begin == begin);
2757             assert(commit->path == NULL);
2758
2759             if (commit_one_file(s, commit->param.writeout.dir_index,
2760                         commit->param.writeout.modified_offset))
2761                 fail = -3;
2762
2763             break;
2764         }
2765         case ACTION_NEW_FILE: {
2766             int begin = commit->param.new_file.first_cluster;
2767             mapping_t* mapping = find_mapping_for_cluster(s, begin);
2768             direntry_t* entry;
2769             int i;
2770
2771             /* find direntry */
2772             for (i = 0; i < s->directory.next; i++) {
2773                 entry = array_get(&(s->directory), i);
2774                 if (is_file(entry) && begin_of_direntry(entry) == begin)
2775                     break;
2776             }
2777
2778             if (i >= s->directory.next) {
2779                 fail = -6;
2780                 continue;
2781             }
2782
2783             /* make sure there exists an initial mapping */
2784             if (mapping && mapping->begin != begin) {
2785                 mapping->end = begin;
2786                 mapping = NULL;
2787             }
2788             if (mapping == NULL) {
2789                 mapping = insert_mapping(s, begin, begin+1);
2790             }
2791             /* most members will be fixed in commit_mappings() */
2792             assert(commit->path);
2793             mapping->path = commit->path;
2794             mapping->read_only = 0;
2795             mapping->mode = MODE_NORMAL;
2796             mapping->info.file.offset = 0;
2797
2798             if (commit_one_file(s, i, 0))
2799                 fail = -7;
2800
2801             break;
2802         }
2803         default:
2804             abort();
2805         }
2806     }
2807     if (i > 0 && array_remove_slice(&(s->commits), 0, i))
2808         return -1;
2809     return fail;
2810 }
2811
2812 static int handle_deletes(BDRVVVFATState* s)
2813 {
2814     int i, deferred = 1, deleted = 1;
2815
2816     /* delete files corresponding to mappings marked as deleted */
2817     /* handle DELETEs and unused mappings (modified_fat_get(s, mapping->begin) == 0) */
2818     while (deferred && deleted) {
2819         deferred = 0;
2820         deleted = 0;
2821
2822         for (i = 1; i < s->mapping.next; i++) {
2823             mapping_t* mapping = array_get(&(s->mapping), i);
2824             if (mapping->mode & MODE_DELETED) {
2825                 direntry_t* entry = array_get(&(s->directory),
2826                         mapping->dir_index);
2827
2828                 if (is_free(entry)) {
2829                     /* remove file/directory */
2830                     if (mapping->mode & MODE_DIRECTORY) {
2831                         int j, next_dir_index = s->directory.next,
2832                         first_dir_index = mapping->info.dir.first_dir_index;
2833
2834                         if (rmdir(mapping->path) < 0) {
2835                             if (errno == ENOTEMPTY) {
2836                                 deferred++;
2837                                 continue;
2838                             } else
2839                                 return -5;
2840                         }
2841
2842                         for (j = 1; j < s->mapping.next; j++) {
2843                             mapping_t* m = array_get(&(s->mapping), j);
2844                             if (m->mode & MODE_DIRECTORY &&
2845                                     m->info.dir.first_dir_index >
2846                                     first_dir_index &&
2847                                     m->info.dir.first_dir_index <
2848                                     next_dir_index)
2849                                 next_dir_index =
2850                                     m->info.dir.first_dir_index;
2851                         }
2852                         remove_direntries(s, first_dir_index,
2853                                 next_dir_index - first_dir_index);
2854
2855                         deleted++;
2856                     }
2857                 } else {
2858                     if (unlink(mapping->path))
2859                         return -4;
2860                     deleted++;
2861                 }
2862                 DLOG(fprintf(stderr, "DELETE (%d)\n", i); print_mapping(mapping); print_direntry(entry));
2863                 remove_mapping(s, i);
2864             }
2865         }
2866     }
2867
2868     return 0;
2869 }
2870
2871 /*
2872  * synchronize mapping with new state:
2873  *
2874  * - copy FAT (with bdrv_read)
2875  * - mark all filenames corresponding to mappings as deleted
2876  * - recurse direntries from root (using bs->bdrv_read)
2877  * - delete files corresponding to mappings marked as deleted
2878  */
2879 static int do_commit(BDRVVVFATState* s)
2880 {
2881     int ret = 0;
2882
2883     /* the real meat are the commits. Nothing to do? Move along! */
2884     if (s->commits.next == 0)
2885         return 0;
2886
2887     vvfat_close_current_file(s);
2888
2889     ret = handle_renames_and_mkdirs(s);
2890     if (ret) {
2891         fprintf(stderr, "Error handling renames (%d)\n", ret);
2892         abort();
2893         return ret;
2894     }
2895
2896     /* copy FAT (with bdrv_read) */
2897     memcpy(s->fat.pointer, s->fat2, 0x200 * s->sectors_per_fat);
2898
2899     /* recurse direntries from root (using bs->bdrv_read) */
2900     ret = commit_direntries(s, 0, -1);
2901     if (ret) {
2902         fprintf(stderr, "Fatal: error while committing (%d)\n", ret);
2903         abort();
2904         return ret;
2905     }
2906
2907     ret = handle_commits(s);
2908     if (ret) {
2909         fprintf(stderr, "Error handling commits (%d)\n", ret);
2910         abort();
2911         return ret;
2912     }
2913
2914     ret = handle_deletes(s);
2915     if (ret) {
2916         fprintf(stderr, "Error deleting\n");
2917         abort();
2918         return ret;
2919     }
2920
2921     if (s->qcow->bs->drv->bdrv_make_empty) {
2922         s->qcow->bs->drv->bdrv_make_empty(s->qcow->bs);
2923     }
2924
2925     memset(s->used_clusters, 0, sector2cluster(s, s->sector_count));
2926
2927 DLOG(checkpoint());
2928     return 0;
2929 }
2930
2931 static int try_commit(BDRVVVFATState* s)
2932 {
2933     vvfat_close_current_file(s);
2934 DLOG(checkpoint());
2935     if(!is_consistent(s))
2936         return -1;
2937     return do_commit(s);
2938 }
2939
2940 static int vvfat_write(BlockDriverState *bs, int64_t sector_num,
2941                     const uint8_t *buf, int nb_sectors)
2942 {
2943     BDRVVVFATState *s = bs->opaque;
2944     int i, ret;
2945
2946 DLOG(checkpoint());
2947
2948     /* Check if we're operating in read-only mode */
2949     if (s->qcow == NULL) {
2950         return -EACCES;
2951     }
2952
2953     vvfat_close_current_file(s);
2954
2955     /*
2956      * Some sanity checks:
2957      * - do not allow writing to the boot sector
2958      * - do not allow to write non-ASCII filenames
2959      */
2960
2961     if (sector_num < s->offset_to_fat)
2962         return -1;
2963
2964     for (i = sector2cluster(s, sector_num);
2965             i <= sector2cluster(s, sector_num + nb_sectors - 1);) {
2966         mapping_t* mapping = find_mapping_for_cluster(s, i);
2967         if (mapping) {
2968             if (mapping->read_only) {
2969                 fprintf(stderr, "Tried to write to write-protected file %s\n",
2970                         mapping->path);
2971                 return -1;
2972             }
2973
2974             if (mapping->mode & MODE_DIRECTORY) {
2975                 int begin = cluster2sector(s, i);
2976                 int end = begin + s->sectors_per_cluster, k;
2977                 int dir_index;
2978                 const direntry_t* direntries;
2979                 long_file_name lfn;
2980
2981                 lfn_init(&lfn);
2982
2983                 if (begin < sector_num)
2984                     begin = sector_num;
2985                 if (end > sector_num + nb_sectors)
2986                     end = sector_num + nb_sectors;
2987                 dir_index  = mapping->dir_index +
2988                     0x10 * (begin - mapping->begin * s->sectors_per_cluster);
2989                 direntries = (direntry_t*)(buf + 0x200 * (begin - sector_num));
2990
2991                 for (k = 0; k < (end - begin) * 0x10; k++) {
2992                     /* do not allow non-ASCII filenames */
2993                     if (parse_long_name(&lfn, direntries + k) < 0) {
2994                         fprintf(stderr, "Warning: non-ASCII filename\n");
2995                         return -1;
2996                     }
2997                     /* no access to the direntry of a read-only file */
2998                     else if (is_short_name(direntries+k) &&
2999                             (direntries[k].attributes & 1)) {
3000                         if (memcmp(direntries + k,
3001                                     array_get(&(s->directory), dir_index + k),
3002                                     sizeof(direntry_t))) {
3003                             fprintf(stderr, "Warning: tried to write to write-protected file\n");
3004                             return -1;
3005                         }
3006                     }
3007                 }
3008             }
3009             i = mapping->end;
3010         } else
3011             i++;
3012     }
3013
3014     /*
3015      * Use qcow backend. Commit later.
3016      */
3017 DLOG(fprintf(stderr, "Write to qcow backend: %d + %d\n", (int)sector_num, nb_sectors));
3018     ret = bdrv_write(s->qcow, sector_num, buf, nb_sectors);
3019     if (ret < 0) {
3020         fprintf(stderr, "Error writing to qcow backend\n");
3021         return ret;
3022     }
3023
3024     for (i = sector2cluster(s, sector_num);
3025             i <= sector2cluster(s, sector_num + nb_sectors - 1); i++)
3026         if (i >= 0)
3027             s->used_clusters[i] |= USED_ALLOCATED;
3028
3029 DLOG(checkpoint());
3030     /* TODO: add timeout */
3031     try_commit(s);
3032
3033 DLOG(checkpoint());
3034     return 0;
3035 }
3036
3037 static int coroutine_fn
3038 vvfat_co_pwritev(BlockDriverState *bs, uint64_t offset, uint64_t bytes,
3039                  QEMUIOVector *qiov, int flags)
3040 {
3041     int ret;
3042     BDRVVVFATState *s = bs->opaque;
3043     uint64_t sector_num = offset >> BDRV_SECTOR_BITS;
3044     int nb_sectors = bytes >> BDRV_SECTOR_BITS;
3045     void *buf;
3046
3047     assert((offset & (BDRV_SECTOR_SIZE - 1)) == 0);
3048     assert((bytes & (BDRV_SECTOR_SIZE - 1)) == 0);
3049
3050     buf = g_try_malloc(bytes);
3051     if (bytes && buf == NULL) {
3052         return -ENOMEM;
3053     }
3054     qemu_iovec_to_buf(qiov, 0, buf, bytes);
3055
3056     qemu_co_mutex_lock(&s->lock);
3057     ret = vvfat_write(bs, sector_num, buf, nb_sectors);
3058     qemu_co_mutex_unlock(&s->lock);
3059
3060     g_free(buf);
3061
3062     return ret;
3063 }
3064
3065 static int64_t coroutine_fn vvfat_co_get_block_status(BlockDriverState *bs,
3066         int64_t sector_num, int nb_sectors, int *n, BlockDriverState **file)
3067 {
3068     *n = bs->total_sectors - sector_num;
3069     if (*n > nb_sectors) {
3070         *n = nb_sectors;
3071     } else if (*n < 0) {
3072         return 0;
3073     }
3074     return BDRV_BLOCK_DATA;
3075 }
3076
3077 static int coroutine_fn
3078 write_target_commit(BlockDriverState *bs, uint64_t offset, uint64_t bytes,
3079                     QEMUIOVector *qiov, int flags)
3080 {
3081     int ret;
3082
3083     BDRVVVFATState* s = *((BDRVVVFATState**) bs->opaque);
3084     qemu_co_mutex_lock(&s->lock);
3085     ret = try_commit(s);
3086     qemu_co_mutex_unlock(&s->lock);
3087
3088     return ret;
3089 }
3090
3091 static void write_target_close(BlockDriverState *bs) {
3092     BDRVVVFATState* s = *((BDRVVVFATState**) bs->opaque);
3093     bdrv_unref_child(s->bs, s->qcow);
3094     g_free(s->qcow_filename);
3095 }
3096
3097 static BlockDriver vvfat_write_target = {
3098     .format_name        = "vvfat_write_target",
3099     .instance_size      = sizeof(void*),
3100     .bdrv_co_pwritev    = write_target_commit,
3101     .bdrv_close         = write_target_close,
3102 };
3103
3104 static void vvfat_qcow_options(int *child_flags, QDict *child_options,
3105                                int parent_flags, QDict *parent_options)
3106 {
3107     qdict_set_default_str(child_options, BDRV_OPT_READ_ONLY, "off");
3108     *child_flags = BDRV_O_NO_FLUSH;
3109 }
3110
3111 static const BdrvChildRole child_vvfat_qcow = {
3112     .inherit_options    = vvfat_qcow_options,
3113 };
3114
3115 static int enable_write_target(BlockDriverState *bs, Error **errp)
3116 {
3117     BDRVVVFATState *s = bs->opaque;
3118     BlockDriver *bdrv_qcow = NULL;
3119     BlockDriverState *backing;
3120     QemuOpts *opts = NULL;
3121     int ret;
3122     int size = sector2cluster(s, s->sector_count);
3123     QDict *options;
3124
3125     s->used_clusters = calloc(size, 1);
3126
3127     array_init(&(s->commits), sizeof(commit_t));
3128
3129     s->qcow_filename = g_malloc(PATH_MAX);
3130     ret = get_tmp_filename(s->qcow_filename, PATH_MAX);
3131     if (ret < 0) {
3132         error_setg_errno(errp, -ret, "can't create temporary file");
3133         goto err;
3134     }
3135
3136     bdrv_qcow = bdrv_find_format("qcow");
3137     if (!bdrv_qcow) {
3138         error_setg(errp, "Failed to locate qcow driver");
3139         ret = -ENOENT;
3140         goto err;
3141     }
3142
3143     opts = qemu_opts_create(bdrv_qcow->create_opts, NULL, 0, &error_abort);
3144     qemu_opt_set_number(opts, BLOCK_OPT_SIZE, s->sector_count * 512,
3145                         &error_abort);
3146     qemu_opt_set(opts, BLOCK_OPT_BACKING_FILE, "fat:", &error_abort);
3147
3148     ret = bdrv_create(bdrv_qcow, s->qcow_filename, opts, errp);
3149     qemu_opts_del(opts);
3150     if (ret < 0) {
3151         goto err;
3152     }
3153
3154     options = qdict_new();
3155     qdict_put_str(options, "write-target.driver", "qcow");
3156     s->qcow = bdrv_open_child(s->qcow_filename, options, "write-target", bs,
3157                               &child_vvfat_qcow, false, errp);
3158     QDECREF(options);
3159     if (!s->qcow) {
3160         ret = -EINVAL;
3161         goto err;
3162     }
3163
3164 #ifndef _WIN32
3165     unlink(s->qcow_filename);
3166 #endif
3167
3168     backing = bdrv_new_open_driver(&vvfat_write_target, NULL, BDRV_O_ALLOW_RDWR,
3169                                    &error_abort);
3170     *(void**) backing->opaque = s;
3171
3172     bdrv_set_backing_hd(s->bs, backing, &error_abort);
3173     bdrv_unref(backing);
3174
3175     return 0;
3176
3177 err:
3178     g_free(s->qcow_filename);
3179     s->qcow_filename = NULL;
3180     return ret;
3181 }
3182
3183 static void vvfat_child_perm(BlockDriverState *bs, BdrvChild *c,
3184                              const BdrvChildRole *role,
3185                              uint64_t perm, uint64_t shared,
3186                              uint64_t *nperm, uint64_t *nshared)
3187 {
3188     BDRVVVFATState *s = bs->opaque;
3189
3190     assert(c == s->qcow || role == &child_backing);
3191
3192     if (c == s->qcow) {
3193         /* This is a private node, nobody should try to attach to it */
3194         *nperm = BLK_PERM_CONSISTENT_READ | BLK_PERM_WRITE;
3195         *nshared = BLK_PERM_WRITE_UNCHANGED;
3196     } else {
3197         /* The backing file is there so 'commit' can use it. vvfat doesn't
3198          * access it in any way. */
3199         *nperm = 0;
3200         *nshared = BLK_PERM_ALL;
3201     }
3202 }
3203
3204 static void vvfat_close(BlockDriverState *bs)
3205 {
3206     BDRVVVFATState *s = bs->opaque;
3207
3208     vvfat_close_current_file(s);
3209     array_free(&(s->fat));
3210     array_free(&(s->directory));
3211     array_free(&(s->mapping));
3212     g_free(s->cluster_buffer);
3213
3214     if (s->qcow) {
3215         migrate_del_blocker(s->migration_blocker);
3216         error_free(s->migration_blocker);
3217     }
3218 }
3219
3220 static BlockDriver bdrv_vvfat = {
3221     .format_name            = "vvfat",
3222     .protocol_name          = "fat",
3223     .instance_size          = sizeof(BDRVVVFATState),
3224
3225     .bdrv_parse_filename    = vvfat_parse_filename,
3226     .bdrv_file_open         = vvfat_open,
3227     .bdrv_refresh_limits    = vvfat_refresh_limits,
3228     .bdrv_close             = vvfat_close,
3229     .bdrv_child_perm        = vvfat_child_perm,
3230
3231     .bdrv_co_preadv         = vvfat_co_preadv,
3232     .bdrv_co_pwritev        = vvfat_co_pwritev,
3233     .bdrv_co_get_block_status = vvfat_co_get_block_status,
3234 };
3235
3236 static void bdrv_vvfat_init(void)
3237 {
3238     bdrv_register(&bdrv_vvfat);
3239 }
3240
3241 block_init(bdrv_vvfat_init);
3242
3243 #ifdef DEBUG
3244 static void checkpoint(void) {
3245     assert(((mapping_t*)array_get(&(vvv->mapping), 0))->end == 2);
3246     check1(vvv);
3247     check2(vvv);
3248     assert(!vvv->current_mapping || vvv->current_fd || (vvv->current_mapping->mode & MODE_DIRECTORY));
3249 #if 0
3250     if (((direntry_t*)vvv->directory.pointer)[1].attributes != 0xf)
3251         fprintf(stderr, "Nonono!\n");
3252     mapping_t* mapping;
3253     direntry_t* direntry;
3254     assert(vvv->mapping.size >= vvv->mapping.item_size * vvv->mapping.next);
3255     assert(vvv->directory.size >= vvv->directory.item_size * vvv->directory.next);
3256     if (vvv->mapping.next<47)
3257         return;
3258     assert((mapping = array_get(&(vvv->mapping), 47)));
3259     assert(mapping->dir_index < vvv->directory.next);
3260     direntry = array_get(&(vvv->directory), mapping->dir_index);
3261     assert(!memcmp(direntry->name, "USB     H  ", 11) || direntry->name[0]==0);
3262 #endif
3263 }
3264 #endif