block/qcow2.c

   1 /*
   2  * Block driver for the QCOW version 2 format
   3  *
   4  * Copyright (c) 2004-2006 Fabrice Bellard
   5  *
   6  * Permission is hereby granted, free of charge, to any person obtaining a copy
   7  * of this software and associated documentation files (the "Software"), to deal
   8  * in the Software without restriction, including without limitation the rights
   9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10  * copies of the Software, and to permit persons to whom the Software is
  11  * furnished to do so, subject to the following conditions:
  12  *
  13  * The above copyright notice and this permission notice shall be included in
  14  * all copies or substantial portions of the Software.
  15  *
  16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22  * THE SOFTWARE.
  23  */
  24
  25 #include "qemu/osdep.h"
  26
  27 #define ZLIB_CONST
  28 #include <zlib.h>
  29
  30 #include "block/block_int.h"
  31 #include "block/qdict.h"
  32 #include "sysemu/block-backend.h"
  33 #include "qemu/module.h"
  34 #include "qcow2.h"
  35 #include "qemu/error-report.h"
  36 #include "qapi/error.h"
  37 #include "qapi/qapi-events-block-core.h"
  38 #include "qapi/qmp/qdict.h"
  39 #include "qapi/qmp/qstring.h"
  40 #include "trace.h"
  41 #include "qemu/option_int.h"
  42 #include "qemu/cutils.h"
  43 #include "qemu/bswap.h"
  44 #include "qapi/qobject-input-visitor.h"
  45 #include "qapi/qapi-visit-block-core.h"
  46 #include "crypto.h"
  47 #include "block/thread-pool.h"
  48
  49 /*
  50   Differences with QCOW:
  51
  52   - Support for multiple incremental snapshots.
  53   - Memory management by reference counts.
  54   - Clusters which have a reference count of one have the bit
  55     QCOW_OFLAG_COPIED to optimize write performance.
  56   - Size of compressed clusters is stored in sectors to reduce bit usage
  57     in the cluster offsets.
  58   - Support for storing additional data (such as the VM state) in the
  59     snapshots.
  60   - If a backing store is used, the cluster size is not constrained
  61     (could be backported to QCOW).
  62   - L2 tables have always a size of one cluster.
  63 */
  64
  65
  66 typedef struct {
  67     uint32_t magic;
  68     uint32_t len;
  69 } QEMU_PACKED QCowExtension;
  70
  71 #define  QCOW2_EXT_MAGIC_END 0
  72 #define  QCOW2_EXT_MAGIC_BACKING_FORMAT 0xE2792ACA
  73 #define  QCOW2_EXT_MAGIC_FEATURE_TABLE 0x6803f857
  74 #define  QCOW2_EXT_MAGIC_CRYPTO_HEADER 0x0537be77
  75 #define  QCOW2_EXT_MAGIC_BITMAPS 0x23852875
  76 #define  QCOW2_EXT_MAGIC_DATA_FILE 0x44415441
  77
  78 static int coroutine_fn
  79 qcow2_co_preadv_compressed(BlockDriverState *bs,
  80                            uint64_t file_cluster_offset,
  81                            uint64_t offset,
  82                            uint64_t bytes,
  83                            QEMUIOVector *qiov);
  84
  85 static int qcow2_probe(const uint8_t *buf, int buf_size, const char *filename)
  86 {
  87     const QCowHeader *cow_header = (const void *)buf;
  88
  89     if (buf_size >= sizeof(QCowHeader) &&
  90         be32_to_cpu(cow_header->magic) == QCOW_MAGIC &&
  91         be32_to_cpu(cow_header->version) >= 2)
  92         return 100;
  93     else
  94         return 0;
  95 }
  96
  97
  98 static ssize_t qcow2_crypto_hdr_read_func(QCryptoBlock *block, size_t offset,
  99                                           uint8_t *buf, size_t buflen,
 100                                           void *opaque, Error **errp)
 101 {
 102     BlockDriverState *bs = opaque;
 103     BDRVQcow2State *s = bs->opaque;
 104     ssize_t ret;
 105
 106     if ((offset + buflen) > s->crypto_header.length) {
 107         error_setg(errp, "Request for data outside of extension header");
 108         return -1;
 109     }
 110
 111     ret = bdrv_pread(bs->file,
 112                      s->crypto_header.offset + offset, buf, buflen);
 113     if (ret < 0) {
 114         error_setg_errno(errp, -ret, "Could not read encryption header");
 115         return -1;
 116     }
 117     return ret;
 118 }
 119
 120
 121 static ssize_t qcow2_crypto_hdr_init_func(QCryptoBlock *block, size_t headerlen,
 122                                           void *opaque, Error **errp)
 123 {
 124     BlockDriverState *bs = opaque;
 125     BDRVQcow2State *s = bs->opaque;
 126     int64_t ret;
 127     int64_t clusterlen;
 128
 129     ret = qcow2_alloc_clusters(bs, headerlen);
 130     if (ret < 0) {
 131         error_setg_errno(errp, -ret,
 132                          "Cannot allocate cluster for LUKS header size %zu",
 133                          headerlen);
 134         return -1;
 135     }
 136
 137     s->crypto_header.length = headerlen;
 138     s->crypto_header.offset = ret;
 139
 140     /* Zero fill remaining space in cluster so it has predictable
 141      * content in case of future spec changes */
 142     clusterlen = size_to_clusters(s, headerlen) * s->cluster_size;
 143     assert(qcow2_pre_write_overlap_check(bs, 0, ret, clusterlen, false) == 0);
 144     ret = bdrv_pwrite_zeroes(bs->file,
 145                              ret + headerlen,
 146                              clusterlen - headerlen, 0);
 147     if (ret < 0) {
 148         error_setg_errno(errp, -ret, "Could not zero fill encryption header");
 149         return -1;
 150     }
 151
 152     return ret;
 153 }
 154
 155
 156 static ssize_t qcow2_crypto_hdr_write_func(QCryptoBlock *block, size_t offset,
 157                                            const uint8_t *buf, size_t buflen,
 158                                            void *opaque, Error **errp)
 159 {
 160     BlockDriverState *bs = opaque;
 161     BDRVQcow2State *s = bs->opaque;
 162     ssize_t ret;
 163
 164     if ((offset + buflen) > s->crypto_header.length) {
 165         error_setg(errp, "Request for data outside of extension header");
 166         return -1;
 167     }
 168
 169     ret = bdrv_pwrite(bs->file,
 170                       s->crypto_header.offset + offset, buf, buflen);
 171     if (ret < 0) {
 172         error_setg_errno(errp, -ret, "Could not read encryption header");
 173         return -1;
 174     }
 175     return ret;
 176 }
 177
 178
 179 /*
 180  * read qcow2 extension and fill bs
 181  * start reading from start_offset
 182  * finish reading upon magic of value 0 or when end_offset reached
 183  * unknown magic is skipped (future extension this version knows nothing about)
 184  * return 0 upon success, non-0 otherwise
 185  */
 186 static int qcow2_read_extensions(BlockDriverState *bs, uint64_t start_offset,
 187                                  uint64_t end_offset, void **p_feature_table,
 188                                  int flags, bool *need_update_header,
 189                                  Error **errp)
 190 {
 191     BDRVQcow2State *s = bs->opaque;
 192     QCowExtension ext;
 193     uint64_t offset;
 194     int ret;
 195     Qcow2BitmapHeaderExt bitmaps_ext;
 196
 197     if (need_update_header != NULL) {
 198         *need_update_header = false;
 199     }
 200
 201 #ifdef DEBUG_EXT
 202     printf("qcow2_read_extensions: start=%ld end=%ld\n", start_offset, end_offset);
 203 #endif
 204     offset = start_offset;
 205     while (offset < end_offset) {
 206
 207 #ifdef DEBUG_EXT
 208         /* Sanity check */
 209         if (offset > s->cluster_size)
 210             printf("qcow2_read_extension: suspicious offset %lu\n", offset);
 211
 212         printf("attempting to read extended header in offset %lu\n", offset);
 213 #endif
 214
 215         ret = bdrv_pread(bs->file, offset, &ext, sizeof(ext));
 216         if (ret < 0) {
 217             error_setg_errno(errp, -ret, "qcow2_read_extension: ERROR: "
 218                              "pread fail from offset %" PRIu64, offset);
 219             return 1;
 220         }
 221         ext.magic = be32_to_cpu(ext.magic);
 222         ext.len = be32_to_cpu(ext.len);
 223         offset += sizeof(ext);
 224 #ifdef DEBUG_EXT
 225         printf("ext.magic = 0x%x\n", ext.magic);
 226 #endif
 227         if (offset > end_offset || ext.len > end_offset - offset) {
 228             error_setg(errp, "Header extension too large");
 229             return -EINVAL;
 230         }
 231
 232         switch (ext.magic) {
 233         case QCOW2_EXT_MAGIC_END:
 234             return 0;
 235
 236         case QCOW2_EXT_MAGIC_BACKING_FORMAT:
 237             if (ext.len >= sizeof(bs->backing_format)) {
 238                 error_setg(errp, "ERROR: ext_backing_format: len=%" PRIu32
 239                            " too large (>=%zu)", ext.len,
 240                            sizeof(bs->backing_format));
 241                 return 2;
 242             }
 243             ret = bdrv_pread(bs->file, offset, bs->backing_format, ext.len);
 244             if (ret < 0) {
 245                 error_setg_errno(errp, -ret, "ERROR: ext_backing_format: "
 246                                  "Could not read format name");
 247                 return 3;
 248             }
 249             bs->backing_format[ext.len] = '\0';
 250             s->image_backing_format = g_strdup(bs->backing_format);
 251 #ifdef DEBUG_EXT
 252             printf("Qcow2: Got format extension %s\n", bs->backing_format);
 253 #endif
 254             break;
 255
 256         case QCOW2_EXT_MAGIC_FEATURE_TABLE:
 257             if (p_feature_table != NULL) {
 258                 void* feature_table = g_malloc0(ext.len + 2 * sizeof(Qcow2Feature));
 259                 ret = bdrv_pread(bs->file, offset , feature_table, ext.len);
 260                 if (ret < 0) {
 261                     error_setg_errno(errp, -ret, "ERROR: ext_feature_table: "
 262                                      "Could not read table");
 263                     return ret;
 264                 }
 265
 266                 *p_feature_table = feature_table;
 267             }
 268             break;
 269
 270         case QCOW2_EXT_MAGIC_CRYPTO_HEADER: {
 271             unsigned int cflags = 0;
 272             if (s->crypt_method_header != QCOW_CRYPT_LUKS) {
 273                 error_setg(errp, "CRYPTO header extension only "
 274                            "expected with LUKS encryption method");
 275                 return -EINVAL;
 276             }
 277             if (ext.len != sizeof(Qcow2CryptoHeaderExtension)) {
 278                 error_setg(errp, "CRYPTO header extension size %u, "
 279                            "but expected size %zu", ext.len,
 280                            sizeof(Qcow2CryptoHeaderExtension));
 281                 return -EINVAL;
 282             }
 283
 284             ret = bdrv_pread(bs->file, offset, &s->crypto_header, ext.len);
 285             if (ret < 0) {
 286                 error_setg_errno(errp, -ret,
 287                                  "Unable to read CRYPTO header extension");
 288                 return ret;
 289             }
 290             s->crypto_header.offset = be64_to_cpu(s->crypto_header.offset);
 291             s->crypto_header.length = be64_to_cpu(s->crypto_header.length);
 292
 293             if ((s->crypto_header.offset % s->cluster_size) != 0) {
 294                 error_setg(errp, "Encryption header offset '%" PRIu64 "' is "
 295                            "not a multiple of cluster size '%u'",
 296                            s->crypto_header.offset, s->cluster_size);
 297                 return -EINVAL;
 298             }
 299
 300             if (flags & BDRV_O_NO_IO) {
 301                 cflags |= QCRYPTO_BLOCK_OPEN_NO_IO;
 302             }
 303             s->crypto = qcrypto_block_open(s->crypto_opts, "encrypt.",
 304                                            qcow2_crypto_hdr_read_func,
 305                                            bs, cflags, 1, errp);
 306             if (!s->crypto) {
 307                 return -EINVAL;
 308             }
 309         }   break;
 310
 311         case QCOW2_EXT_MAGIC_BITMAPS:
 312             if (ext.len != sizeof(bitmaps_ext)) {
 313                 error_setg_errno(errp, -ret, "bitmaps_ext: "
 314                                  "Invalid extension length");
 315                 return -EINVAL;
 316             }
 317
 318             if (!(s->autoclear_features & QCOW2_AUTOCLEAR_BITMAPS)) {
 319                 if (s->qcow_version < 3) {
 320                     /* Let's be a bit more specific */
 321                     warn_report("This qcow2 v2 image contains bitmaps, but "
 322                                 "they may have been modified by a program "
 323                                 "without persistent bitmap support; so now "
 324                                 "they must all be considered inconsistent");
 325                 } else {
 326                     warn_report("a program lacking bitmap support "
 327                                 "modified this file, so all bitmaps are now "
 328                                 "considered inconsistent");
 329                 }
 330                 error_printf("Some clusters may be leaked, "
 331                              "run 'qemu-img check -r' on the image "
 332                              "file to fix.");
 333                 if (need_update_header != NULL) {
 334                     /* Updating is needed to drop invalid bitmap extension. */
 335                     *need_update_header = true;
 336                 }
 337                 break;
 338             }
 339
 340             ret = bdrv_pread(bs->file, offset, &bitmaps_ext, ext.len);
 341             if (ret < 0) {
 342                 error_setg_errno(errp, -ret, "bitmaps_ext: "
 343                                  "Could not read ext header");
 344                 return ret;
 345             }
 346
 347             if (bitmaps_ext.reserved32 != 0) {
 348                 error_setg_errno(errp, -ret, "bitmaps_ext: "
 349                                  "Reserved field is not zero");
 350                 return -EINVAL;
 351             }
 352
 353             bitmaps_ext.nb_bitmaps = be32_to_cpu(bitmaps_ext.nb_bitmaps);
 354             bitmaps_ext.bitmap_directory_size =
 355                 be64_to_cpu(bitmaps_ext.bitmap_directory_size);
 356             bitmaps_ext.bitmap_directory_offset =
 357                 be64_to_cpu(bitmaps_ext.bitmap_directory_offset);
 358
 359             if (bitmaps_ext.nb_bitmaps > QCOW2_MAX_BITMAPS) {
 360                 error_setg(errp,
 361                            "bitmaps_ext: Image has %" PRIu32 " bitmaps, "
 362                            "exceeding the QEMU supported maximum of %d",
 363                            bitmaps_ext.nb_bitmaps, QCOW2_MAX_BITMAPS);
 364                 return -EINVAL;
 365             }
 366
 367             if (bitmaps_ext.nb_bitmaps == 0) {
 368                 error_setg(errp, "found bitmaps extension with zero bitmaps");
 369                 return -EINVAL;
 370             }
 371
 372             if (bitmaps_ext.bitmap_directory_offset & (s->cluster_size - 1)) {
 373                 error_setg(errp, "bitmaps_ext: "
 374                                  "invalid bitmap directory offset");
 375                 return -EINVAL;
 376             }
 377
 378             if (bitmaps_ext.bitmap_directory_size >
 379                 QCOW2_MAX_BITMAP_DIRECTORY_SIZE) {
 380                 error_setg(errp, "bitmaps_ext: "
 381                                  "bitmap directory size (%" PRIu64 ") exceeds "
 382                                  "the maximum supported size (%d)",
 383                                  bitmaps_ext.bitmap_directory_size,
 384                                  QCOW2_MAX_BITMAP_DIRECTORY_SIZE);
 385                 return -EINVAL;
 386             }
 387
 388             s->nb_bitmaps = bitmaps_ext.nb_bitmaps;
 389             s->bitmap_directory_offset =
 390                     bitmaps_ext.bitmap_directory_offset;
 391             s->bitmap_directory_size =
 392                     bitmaps_ext.bitmap_directory_size;
 393
 394 #ifdef DEBUG_EXT
 395             printf("Qcow2: Got bitmaps extension: "
 396                    "offset=%" PRIu64 " nb_bitmaps=%" PRIu32 "\n",
 397                    s->bitmap_directory_offset, s->nb_bitmaps);
 398 #endif
 399             break;
 400
 401         default:
 402             /* unknown magic - save it in case we need to rewrite the header */
 403             /* If you add a new feature, make sure to also update the fast
 404              * path of qcow2_make_empty() to deal with it. */
 405             {
 406                 Qcow2UnknownHeaderExtension *uext;
 407
 408                 uext = g_malloc0(sizeof(*uext)  + ext.len);
 409                 uext->magic = ext.magic;
 410                 uext->len = ext.len;
 411                 QLIST_INSERT_HEAD(&s->unknown_header_ext, uext, next);
 412
 413                 ret = bdrv_pread(bs->file, offset , uext->data, uext->len);
 414                 if (ret < 0) {
 415                     error_setg_errno(errp, -ret, "ERROR: unknown extension: "
 416                                      "Could not read data");
 417                     return ret;
 418                 }
 419             }
 420             break;
 421         }
 422
 423         offset += ((ext.len + 7) & ~7);
 424     }
 425
 426     return 0;
 427 }
 428
 429 static void cleanup_unknown_header_ext(BlockDriverState *bs)
 430 {
 431     BDRVQcow2State *s = bs->opaque;
 432     Qcow2UnknownHeaderExtension *uext, *next;
 433
 434     QLIST_FOREACH_SAFE(uext, &s->unknown_header_ext, next, next) {
 435         QLIST_REMOVE(uext, next);
 436         g_free(uext);
 437     }
 438 }
 439
 440 static void report_unsupported_feature(Error **errp, Qcow2Feature *table,
 441                                        uint64_t mask)
 442 {
 443     char *features = g_strdup("");
 444     char *old;
 445
 446     while (table && table->name[0] != '\0') {
 447         if (table->type == QCOW2_FEAT_TYPE_INCOMPATIBLE) {
 448             if (mask & (1ULL << table->bit)) {
 449                 old = features;
 450                 features = g_strdup_printf("%s%s%.46s", old, *old ? ", " : "",
 451                                            table->name);
 452                 g_free(old);
 453                 mask &= ~(1ULL << table->bit);
 454             }
 455         }
 456         table++;
 457     }
 458
 459     if (mask) {
 460         old = features;
 461         features = g_strdup_printf("%s%sUnknown incompatible feature: %" PRIx64,
 462                                    old, *old ? ", " : "", mask);
 463         g_free(old);
 464     }
 465
 466     error_setg(errp, "Unsupported qcow2 feature(s): %s", features);
 467     g_free(features);
 468 }
 469
 470 /*
 471  * Sets the dirty bit and flushes afterwards if necessary.
 472  *
 473  * The incompatible_features bit is only set if the image file header was
 474  * updated successfully.  Therefore it is not required to check the return
 475  * value of this function.
 476  */
 477 int qcow2_mark_dirty(BlockDriverState *bs)
 478 {
 479     BDRVQcow2State *s = bs->opaque;
 480     uint64_t val;
 481     int ret;
 482
 483     assert(s->qcow_version >= 3);
 484
 485     if (s->incompatible_features & QCOW2_INCOMPAT_DIRTY) {
 486         return 0; /* already dirty */
 487     }
 488
 489     val = cpu_to_be64(s->incompatible_features | QCOW2_INCOMPAT_DIRTY);
 490     ret = bdrv_pwrite(bs->file, offsetof(QCowHeader, incompatible_features),
 491                       &val, sizeof(val));
 492     if (ret < 0) {
 493         return ret;
 494     }
 495     ret = bdrv_flush(bs->file->bs);
 496     if (ret < 0) {
 497         return ret;
 498     }
 499
 500     /* Only treat image as dirty if the header was updated successfully */
 501     s->incompatible_features |= QCOW2_INCOMPAT_DIRTY;
 502     return 0;
 503 }
 504
 505 /*
 506  * Clears the dirty bit and flushes before if necessary.  Only call this
 507  * function when there are no pending requests, it does not guard against
 508  * concurrent requests dirtying the image.
 509  */
 510 static int qcow2_mark_clean(BlockDriverState *bs)
 511 {
 512     BDRVQcow2State *s = bs->opaque;
 513
 514     if (s->incompatible_features & QCOW2_INCOMPAT_DIRTY) {
 515         int ret;
 516
 517         s->incompatible_features &= ~QCOW2_INCOMPAT_DIRTY;
 518
 519         ret = qcow2_flush_caches(bs);
 520         if (ret < 0) {
 521             return ret;
 522         }
 523
 524         return qcow2_update_header(bs);
 525     }
 526     return 0;
 527 }
 528
 529 /*
 530  * Marks the image as corrupt.
 531  */
 532 int qcow2_mark_corrupt(BlockDriverState *bs)
 533 {
 534     BDRVQcow2State *s = bs->opaque;
 535
 536     s->incompatible_features |= QCOW2_INCOMPAT_CORRUPT;
 537     return qcow2_update_header(bs);
 538 }
 539
 540 /*
 541  * Marks the image as consistent, i.e., unsets the corrupt bit, and flushes
 542  * before if necessary.
 543  */
 544 int qcow2_mark_consistent(BlockDriverState *bs)
 545 {
 546     BDRVQcow2State *s = bs->opaque;
 547
 548     if (s->incompatible_features & QCOW2_INCOMPAT_CORRUPT) {
 549         int ret = qcow2_flush_caches(bs);
 550         if (ret < 0) {
 551             return ret;
 552         }
 553
 554         s->incompatible_features &= ~QCOW2_INCOMPAT_CORRUPT;
 555         return qcow2_update_header(bs);
 556     }
 557     return 0;
 558 }
 559
 560 static int coroutine_fn qcow2_co_check_locked(BlockDriverState *bs,
 561                                               BdrvCheckResult *result,
 562                                               BdrvCheckMode fix)
 563 {
 564     int ret = qcow2_check_refcounts(bs, result, fix);
 565     if (ret < 0) {
 566         return ret;
 567     }
 568
 569     if (fix && result->check_errors == 0 && result->corruptions == 0) {
 570         ret = qcow2_mark_clean(bs);
 571         if (ret < 0) {
 572             return ret;
 573         }
 574         return qcow2_mark_consistent(bs);
 575     }
 576     return ret;
 577 }
 578
 579 static int coroutine_fn qcow2_co_check(BlockDriverState *bs,
 580                                        BdrvCheckResult *result,
 581                                        BdrvCheckMode fix)
 582 {
 583     BDRVQcow2State *s = bs->opaque;
 584     int ret;
 585
 586     qemu_co_mutex_lock(&s->lock);
 587     ret = qcow2_co_check_locked(bs, result, fix);
 588     qemu_co_mutex_unlock(&s->lock);
 589     return ret;
 590 }
 591
 592 int qcow2_validate_table(BlockDriverState *bs, uint64_t offset,
 593                          uint64_t entries, size_t entry_len,
 594                          int64_t max_size_bytes, const char *table_name,
 595                          Error **errp)
 596 {
 597     BDRVQcow2State *s = bs->opaque;
 598
 599     if (entries > max_size_bytes / entry_len) {
 600         error_setg(errp, "%s too large", table_name);
 601         return -EFBIG;
 602     }
 603
 604     /* Use signed INT64_MAX as the maximum even for uint64_t header fields,
 605      * because values will be passed to qemu functions taking int64_t. */
 606     if ((INT64_MAX - entries * entry_len < offset) ||
 607         (offset_into_cluster(s, offset) != 0)) {
 608         error_setg(errp, "%s offset invalid", table_name);
 609         return -EINVAL;
 610     }
 611
 612     return 0;
 613 }
 614
 615 static QemuOptsList qcow2_runtime_opts = {
 616     .name = "qcow2",
 617     .head = QTAILQ_HEAD_INITIALIZER(qcow2_runtime_opts.head),
 618     .desc = {
 619         {
 620             .name = QCOW2_OPT_LAZY_REFCOUNTS,
 621             .type = QEMU_OPT_BOOL,
 622             .help = "Postpone refcount updates",
 623         },
 624         {
 625             .name = QCOW2_OPT_DISCARD_REQUEST,
 626             .type = QEMU_OPT_BOOL,
 627             .help = "Pass guest discard requests to the layer below",
 628         },
 629         {
 630             .name = QCOW2_OPT_DISCARD_SNAPSHOT,
 631             .type = QEMU_OPT_BOOL,
 632             .help = "Generate discard requests when snapshot related space "
 633                     "is freed",
 634         },
 635         {
 636             .name = QCOW2_OPT_DISCARD_OTHER,
 637             .type = QEMU_OPT_BOOL,
 638             .help = "Generate discard requests when other clusters are freed",
 639         },
 640         {
 641             .name = QCOW2_OPT_OVERLAP,
 642             .type = QEMU_OPT_STRING,
 643             .help = "Selects which overlap checks to perform from a range of "
 644                     "templates (none, constant, cached, all)",
 645         },
 646         {
 647             .name = QCOW2_OPT_OVERLAP_TEMPLATE,
 648             .type = QEMU_OPT_STRING,
 649             .help = "Selects which overlap checks to perform from a range of "
 650                     "templates (none, constant, cached, all)",
 651         },
 652         {
 653             .name = QCOW2_OPT_OVERLAP_MAIN_HEADER,
 654             .type = QEMU_OPT_BOOL,
 655             .help = "Check for unintended writes into the main qcow2 header",
 656         },
 657         {
 658             .name = QCOW2_OPT_OVERLAP_ACTIVE_L1,
 659             .type = QEMU_OPT_BOOL,
 660             .help = "Check for unintended writes into the active L1 table",
 661         },
 662         {
 663             .name = QCOW2_OPT_OVERLAP_ACTIVE_L2,
 664             .type = QEMU_OPT_BOOL,
 665             .help = "Check for unintended writes into an active L2 table",
 666         },
 667         {
 668             .name = QCOW2_OPT_OVERLAP_REFCOUNT_TABLE,
 669             .type = QEMU_OPT_BOOL,
 670             .help = "Check for unintended writes into the refcount table",
 671         },
 672         {
 673             .name = QCOW2_OPT_OVERLAP_REFCOUNT_BLOCK,
 674             .type = QEMU_OPT_BOOL,
 675             .help = "Check for unintended writes into a refcount block",
 676         },
 677         {
 678             .name = QCOW2_OPT_OVERLAP_SNAPSHOT_TABLE,
 679             .type = QEMU_OPT_BOOL,
 680             .help = "Check for unintended writes into the snapshot table",
 681         },
 682         {
 683             .name = QCOW2_OPT_OVERLAP_INACTIVE_L1,
 684             .type = QEMU_OPT_BOOL,
 685             .help = "Check for unintended writes into an inactive L1 table",
 686         },
 687         {
 688             .name = QCOW2_OPT_OVERLAP_INACTIVE_L2,
 689             .type = QEMU_OPT_BOOL,
 690             .help = "Check for unintended writes into an inactive L2 table",
 691         },
 692         {
 693             .name = QCOW2_OPT_OVERLAP_BITMAP_DIRECTORY,
 694             .type = QEMU_OPT_BOOL,
 695             .help = "Check for unintended writes into the bitmap directory",
 696         },
 697         {
 698             .name = QCOW2_OPT_CACHE_SIZE,
 699             .type = QEMU_OPT_SIZE,
 700             .help = "Maximum combined metadata (L2 tables and refcount blocks) "
 701                     "cache size",
 702         },
 703         {
 704             .name = QCOW2_OPT_L2_CACHE_SIZE,
 705             .type = QEMU_OPT_SIZE,
 706             .help = "Maximum L2 table cache size",
 707         },
 708         {
 709             .name = QCOW2_OPT_L2_CACHE_ENTRY_SIZE,
 710             .type = QEMU_OPT_SIZE,
 711             .help = "Size of each entry in the L2 cache",
 712         },
 713         {
 714             .name = QCOW2_OPT_REFCOUNT_CACHE_SIZE,
 715             .type = QEMU_OPT_SIZE,
 716             .help = "Maximum refcount block cache size",
 717         },
 718         {
 719             .name = QCOW2_OPT_CACHE_CLEAN_INTERVAL,
 720             .type = QEMU_OPT_NUMBER,
 721             .help = "Clean unused cache entries after this time (in seconds)",
 722         },
 723         BLOCK_CRYPTO_OPT_DEF_KEY_SECRET("encrypt.",
 724             "ID of secret providing qcow2 AES key or LUKS passphrase"),
 725         { /* end of list */ }
 726     },
 727 };
 728
 729 static const char *overlap_bool_option_names[QCOW2_OL_MAX_BITNR] = {
 730     [QCOW2_OL_MAIN_HEADER_BITNR]      = QCOW2_OPT_OVERLAP_MAIN_HEADER,
 731     [QCOW2_OL_ACTIVE_L1_BITNR]        = QCOW2_OPT_OVERLAP_ACTIVE_L1,
 732     [QCOW2_OL_ACTIVE_L2_BITNR]        = QCOW2_OPT_OVERLAP_ACTIVE_L2,
 733     [QCOW2_OL_REFCOUNT_TABLE_BITNR]   = QCOW2_OPT_OVERLAP_REFCOUNT_TABLE,
 734     [QCOW2_OL_REFCOUNT_BLOCK_BITNR]   = QCOW2_OPT_OVERLAP_REFCOUNT_BLOCK,
 735     [QCOW2_OL_SNAPSHOT_TABLE_BITNR]   = QCOW2_OPT_OVERLAP_SNAPSHOT_TABLE,
 736     [QCOW2_OL_INACTIVE_L1_BITNR]      = QCOW2_OPT_OVERLAP_INACTIVE_L1,
 737     [QCOW2_OL_INACTIVE_L2_BITNR]      = QCOW2_OPT_OVERLAP_INACTIVE_L2,
 738     [QCOW2_OL_BITMAP_DIRECTORY_BITNR] = QCOW2_OPT_OVERLAP_BITMAP_DIRECTORY,
 739 };
 740
 741 static void cache_clean_timer_cb(void *opaque)
 742 {
 743     BlockDriverState *bs = opaque;
 744     BDRVQcow2State *s = bs->opaque;
 745     qcow2_cache_clean_unused(s->l2_table_cache);
 746     qcow2_cache_clean_unused(s->refcount_block_cache);
 747     timer_mod(s->cache_clean_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) +
 748               (int64_t) s->cache_clean_interval * 1000);
 749 }
 750
 751 static void cache_clean_timer_init(BlockDriverState *bs, AioContext *context)
 752 {
 753     BDRVQcow2State *s = bs->opaque;
 754     if (s->cache_clean_interval > 0) {
 755         s->cache_clean_timer = aio_timer_new(context, QEMU_CLOCK_VIRTUAL,
 756                                              SCALE_MS, cache_clean_timer_cb,
 757                                              bs);
 758         timer_mod(s->cache_clean_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) +
 759                   (int64_t) s->cache_clean_interval * 1000);
 760     }
 761 }
 762
 763 static void cache_clean_timer_del(BlockDriverState *bs)
 764 {
 765     BDRVQcow2State *s = bs->opaque;
 766     if (s->cache_clean_timer) {
 767         timer_del(s->cache_clean_timer);
 768         timer_free(s->cache_clean_timer);
 769         s->cache_clean_timer = NULL;
 770     }
 771 }
 772
 773 static void qcow2_detach_aio_context(BlockDriverState *bs)
 774 {
 775     cache_clean_timer_del(bs);
 776 }
 777
 778 static void qcow2_attach_aio_context(BlockDriverState *bs,
 779                                      AioContext *new_context)
 780 {
 781     cache_clean_timer_init(bs, new_context);
 782 }
 783
 784 static void read_cache_sizes(BlockDriverState *bs, QemuOpts *opts,
 785                              uint64_t *l2_cache_size,
 786                              uint64_t *l2_cache_entry_size,
 787                              uint64_t *refcount_cache_size, Error **errp)
 788 {
 789     BDRVQcow2State *s = bs->opaque;
 790     uint64_t combined_cache_size, l2_cache_max_setting;
 791     bool l2_cache_size_set, refcount_cache_size_set, combined_cache_size_set;
 792     bool l2_cache_entry_size_set;
 793     int min_refcount_cache = MIN_REFCOUNT_CACHE_SIZE * s->cluster_size;
 794     uint64_t virtual_disk_size = bs->total_sectors * BDRV_SECTOR_SIZE;
 795     uint64_t max_l2_cache = virtual_disk_size / (s->cluster_size / 8);
 796
 797     combined_cache_size_set = qemu_opt_get(opts, QCOW2_OPT_CACHE_SIZE);
 798     l2_cache_size_set = qemu_opt_get(opts, QCOW2_OPT_L2_CACHE_SIZE);
 799     refcount_cache_size_set = qemu_opt_get(opts, QCOW2_OPT_REFCOUNT_CACHE_SIZE);
 800     l2_cache_entry_size_set = qemu_opt_get(opts, QCOW2_OPT_L2_CACHE_ENTRY_SIZE);
 801
 802     combined_cache_size = qemu_opt_get_size(opts, QCOW2_OPT_CACHE_SIZE, 0);
 803     l2_cache_max_setting = qemu_opt_get_size(opts, QCOW2_OPT_L2_CACHE_SIZE,
 804                                              DEFAULT_L2_CACHE_MAX_SIZE);
 805     *refcount_cache_size = qemu_opt_get_size(opts,
 806                                              QCOW2_OPT_REFCOUNT_CACHE_SIZE, 0);
 807
 808     *l2_cache_entry_size = qemu_opt_get_size(
 809         opts, QCOW2_OPT_L2_CACHE_ENTRY_SIZE, s->cluster_size);
 810
 811     *l2_cache_size = MIN(max_l2_cache, l2_cache_max_setting);
 812
 813     if (combined_cache_size_set) {
 814         if (l2_cache_size_set && refcount_cache_size_set) {
 815             error_setg(errp, QCOW2_OPT_CACHE_SIZE ", " QCOW2_OPT_L2_CACHE_SIZE
 816                        " and " QCOW2_OPT_REFCOUNT_CACHE_SIZE " may not be set "
 817                        "at the same time");
 818             return;
 819         } else if (l2_cache_size_set &&
 820                    (l2_cache_max_setting > combined_cache_size)) {
 821             error_setg(errp, QCOW2_OPT_L2_CACHE_SIZE " may not exceed "
 822                        QCOW2_OPT_CACHE_SIZE);
 823             return;
 824         } else if (*refcount_cache_size > combined_cache_size) {
 825             error_setg(errp, QCOW2_OPT_REFCOUNT_CACHE_SIZE " may not exceed "
 826                        QCOW2_OPT_CACHE_SIZE);
 827             return;
 828         }
 829
 830         if (l2_cache_size_set) {
 831             *refcount_cache_size = combined_cache_size - *l2_cache_size;
 832         } else if (refcount_cache_size_set) {
 833             *l2_cache_size = combined_cache_size - *refcount_cache_size;
 834         } else {
 835             /* Assign as much memory as possible to the L2 cache, and
 836              * use the remainder for the refcount cache */
 837             if (combined_cache_size >= max_l2_cache + min_refcount_cache) {
 838                 *l2_cache_size = max_l2_cache;
 839                 *refcount_cache_size = combined_cache_size - *l2_cache_size;
 840             } else {
 841                 *refcount_cache_size =
 842                     MIN(combined_cache_size, min_refcount_cache);
 843                 *l2_cache_size = combined_cache_size - *refcount_cache_size;
 844             }
 845         }
 846     }
 847
 848     /*
 849      * If the L2 cache is not enough to cover the whole disk then
 850      * default to 4KB entries. Smaller entries reduce the cost of
 851      * loads and evictions and increase I/O performance.
 852      */
 853     if (*l2_cache_size < max_l2_cache && !l2_cache_entry_size_set) {
 854         *l2_cache_entry_size = MIN(s->cluster_size, 4096);
 855     }
 856
 857     /* l2_cache_size and refcount_cache_size are ensured to have at least
 858      * their minimum values in qcow2_update_options_prepare() */
 859
 860     if (*l2_cache_entry_size < (1 << MIN_CLUSTER_BITS) ||
 861         *l2_cache_entry_size > s->cluster_size ||
 862         !is_power_of_2(*l2_cache_entry_size)) {
 863         error_setg(errp, "L2 cache entry size must be a power of two "
 864                    "between %d and the cluster size (%d)",
 865                    1 << MIN_CLUSTER_BITS, s->cluster_size);
 866         return;
 867     }
 868 }
 869
 870 typedef struct Qcow2ReopenState {
 871     Qcow2Cache *l2_table_cache;
 872     Qcow2Cache *refcount_block_cache;
 873     int l2_slice_size; /* Number of entries in a slice of the L2 table */
 874     bool use_lazy_refcounts;
 875     int overlap_check;
 876     bool discard_passthrough[QCOW2_DISCARD_MAX];
 877     uint64_t cache_clean_interval;
 878     QCryptoBlockOpenOptions *crypto_opts; /* Disk encryption runtime options */
 879 } Qcow2ReopenState;
 880
 881 static int qcow2_update_options_prepare(BlockDriverState *bs,
 882                                         Qcow2ReopenState *r,
 883                                         QDict *options, int flags,
 884                                         Error **errp)
 885 {
 886     BDRVQcow2State *s = bs->opaque;
 887     QemuOpts *opts = NULL;
 888     const char *opt_overlap_check, *opt_overlap_check_template;
 889     int overlap_check_template = 0;
 890     uint64_t l2_cache_size, l2_cache_entry_size, refcount_cache_size;
 891     int i;
 892     const char *encryptfmt;
 893     QDict *encryptopts = NULL;
 894     Error *local_err = NULL;
 895     int ret;
 896
 897     qdict_extract_subqdict(options, &encryptopts, "encrypt.");
 898     encryptfmt = qdict_get_try_str(encryptopts, "format");
 899
 900     opts = qemu_opts_create(&qcow2_runtime_opts, NULL, 0, &error_abort);
 901     qemu_opts_absorb_qdict(opts, options, &local_err);
 902     if (local_err) {
 903         error_propagate(errp, local_err);
 904         ret = -EINVAL;
 905         goto fail;
 906     }
 907
 908     /* get L2 table/refcount block cache size from command line options */
 909     read_cache_sizes(bs, opts, &l2_cache_size, &l2_cache_entry_size,
 910                      &refcount_cache_size, &local_err);
 911     if (local_err) {
 912         error_propagate(errp, local_err);
 913         ret = -EINVAL;
 914         goto fail;
 915     }
 916
 917     l2_cache_size /= l2_cache_entry_size;
 918     if (l2_cache_size < MIN_L2_CACHE_SIZE) {
 919         l2_cache_size = MIN_L2_CACHE_SIZE;
 920     }
 921     if (l2_cache_size > INT_MAX) {
 922         error_setg(errp, "L2 cache size too big");
 923         ret = -EINVAL;
 924         goto fail;
 925     }
 926
 927     refcount_cache_size /= s->cluster_size;
 928     if (refcount_cache_size < MIN_REFCOUNT_CACHE_SIZE) {
 929         refcount_cache_size = MIN_REFCOUNT_CACHE_SIZE;
 930     }
 931     if (refcount_cache_size > INT_MAX) {
 932         error_setg(errp, "Refcount cache size too big");
 933         ret = -EINVAL;
 934         goto fail;
 935     }
 936
 937     /* alloc new L2 table/refcount block cache, flush old one */
 938     if (s->l2_table_cache) {
 939         ret = qcow2_cache_flush(bs, s->l2_table_cache);
 940         if (ret) {
 941             error_setg_errno(errp, -ret, "Failed to flush the L2 table cache");
 942             goto fail;
 943         }
 944     }
 945
 946     if (s->refcount_block_cache) {
 947         ret = qcow2_cache_flush(bs, s->refcount_block_cache);
 948         if (ret) {
 949             error_setg_errno(errp, -ret,
 950                              "Failed to flush the refcount block cache");
 951             goto fail;
 952         }
 953     }
 954
 955     r->l2_slice_size = l2_cache_entry_size / sizeof(uint64_t);
 956     r->l2_table_cache = qcow2_cache_create(bs, l2_cache_size,
 957                                            l2_cache_entry_size);
 958     r->refcount_block_cache = qcow2_cache_create(bs, refcount_cache_size,
 959                                                  s->cluster_size);
 960     if (r->l2_table_cache == NULL || r->refcount_block_cache == NULL) {
 961         error_setg(errp, "Could not allocate metadata caches");
 962         ret = -ENOMEM;
 963         goto fail;
 964     }
 965
 966     /* New interval for cache cleanup timer */
 967     r->cache_clean_interval =
 968         qemu_opt_get_number(opts, QCOW2_OPT_CACHE_CLEAN_INTERVAL,
 969                             DEFAULT_CACHE_CLEAN_INTERVAL);
 970 #ifndef CONFIG_LINUX
 971     if (r->cache_clean_interval != 0) {
 972         error_setg(errp, QCOW2_OPT_CACHE_CLEAN_INTERVAL
 973                    " not supported on this host");
 974         ret = -EINVAL;
 975         goto fail;
 976     }
 977 #endif
 978     if (r->cache_clean_interval > UINT_MAX) {
 979         error_setg(errp, "Cache clean interval too big");
 980         ret = -EINVAL;
 981         goto fail;
 982     }
 983
 984     /* lazy-refcounts; flush if going from enabled to disabled */
 985     r->use_lazy_refcounts = qemu_opt_get_bool(opts, QCOW2_OPT_LAZY_REFCOUNTS,
 986         (s->compatible_features & QCOW2_COMPAT_LAZY_REFCOUNTS));
 987     if (r->use_lazy_refcounts && s->qcow_version < 3) {
 988         error_setg(errp, "Lazy refcounts require a qcow2 image with at least "
 989                    "qemu 1.1 compatibility level");
 990         ret = -EINVAL;
 991         goto fail;
 992     }
 993
 994     if (s->use_lazy_refcounts && !r->use_lazy_refcounts) {
 995         ret = qcow2_mark_clean(bs);
 996         if (ret < 0) {
 997             error_setg_errno(errp, -ret, "Failed to disable lazy refcounts");
 998             goto fail;
 999         }
1000     }
1001
1002     /* Overlap check options */
1003     opt_overlap_check = qemu_opt_get(opts, QCOW2_OPT_OVERLAP);
1004     opt_overlap_check_template = qemu_opt_get(opts, QCOW2_OPT_OVERLAP_TEMPLATE);
1005     if (opt_overlap_check_template && opt_overlap_check &&
1006         strcmp(opt_overlap_check_template, opt_overlap_check))
1007     {
1008         error_setg(errp, "Conflicting values for qcow2 options '"
1009                    QCOW2_OPT_OVERLAP "' ('%s') and '" QCOW2_OPT_OVERLAP_TEMPLATE
1010                    "' ('%s')", opt_overlap_check, opt_overlap_check_template);
1011         ret = -EINVAL;
1012         goto fail;
1013     }
1014     if (!opt_overlap_check) {
1015         opt_overlap_check = opt_overlap_check_template ?: "cached";
1016     }
1017
1018     if (!strcmp(opt_overlap_check, "none")) {
1019         overlap_check_template = 0;
1020     } else if (!strcmp(opt_overlap_check, "constant")) {
1021         overlap_check_template = QCOW2_OL_CONSTANT;
1022     } else if (!strcmp(opt_overlap_check, "cached")) {
1023         overlap_check_template = QCOW2_OL_CACHED;
1024     } else if (!strcmp(opt_overlap_check, "all")) {
1025         overlap_check_template = QCOW2_OL_ALL;
1026     } else {
1027         error_setg(errp, "Unsupported value '%s' for qcow2 option "
1028                    "'overlap-check'. Allowed are any of the following: "
1029                    "none, constant, cached, all", opt_overlap_check);
1030         ret = -EINVAL;
1031         goto fail;
1032     }
1033
1034     r->overlap_check = 0;
1035     for (i = 0; i < QCOW2_OL_MAX_BITNR; i++) {
1036         /* overlap-check defines a template bitmask, but every flag may be
1037          * overwritten through the associated boolean option */
1038         r->overlap_check |=
1039             qemu_opt_get_bool(opts, overlap_bool_option_names[i],
1040                               overlap_check_template & (1 << i)) << i;
1041     }
1042
1043     r->discard_passthrough[QCOW2_DISCARD_NEVER] = false;
1044     r->discard_passthrough[QCOW2_DISCARD_ALWAYS] = true;
1045     r->discard_passthrough[QCOW2_DISCARD_REQUEST] =
1046         qemu_opt_get_bool(opts, QCOW2_OPT_DISCARD_REQUEST,
1047                           flags & BDRV_O_UNMAP);
1048     r->discard_passthrough[QCOW2_DISCARD_SNAPSHOT] =
1049         qemu_opt_get_bool(opts, QCOW2_OPT_DISCARD_SNAPSHOT, true);
1050     r->discard_passthrough[QCOW2_DISCARD_OTHER] =
1051         qemu_opt_get_bool(opts, QCOW2_OPT_DISCARD_OTHER, false);
1052
1053     switch (s->crypt_method_header) {
1054     case QCOW_CRYPT_NONE:
1055         if (encryptfmt) {
1056             error_setg(errp, "No encryption in image header, but options "
1057                        "specified format '%s'", encryptfmt);
1058             ret = -EINVAL;
1059             goto fail;
1060         }
1061         break;
1062
1063     case QCOW_CRYPT_AES:
1064         if (encryptfmt && !g_str_equal(encryptfmt, "aes")) {
1065             error_setg(errp,
1066                        "Header reported 'aes' encryption format but "
1067                        "options specify '%s'", encryptfmt);
1068             ret = -EINVAL;
1069             goto fail;
1070         }
1071         qdict_put_str(encryptopts, "format", "qcow");
1072         r->crypto_opts = block_crypto_open_opts_init(encryptopts, errp);
1073         break;
1074
1075     case QCOW_CRYPT_LUKS:
1076         if (encryptfmt && !g_str_equal(encryptfmt, "luks")) {
1077             error_setg(errp,
1078                        "Header reported 'luks' encryption format but "
1079                        "options specify '%s'", encryptfmt);
1080             ret = -EINVAL;
1081             goto fail;
1082         }
1083         qdict_put_str(encryptopts, "format", "luks");
1084         r->crypto_opts = block_crypto_open_opts_init(encryptopts, errp);
1085         break;
1086
1087     default:
1088         error_setg(errp, "Unsupported encryption method %d",
1089                    s->crypt_method_header);
1090         break;
1091     }
1092     if (s->crypt_method_header != QCOW_CRYPT_NONE && !r->crypto_opts) {
1093         ret = -EINVAL;
1094         goto fail;
1095     }
1096
1097     ret = 0;
1098 fail:
1099     qobject_unref(encryptopts);
1100     qemu_opts_del(opts);
1101     opts = NULL;
1102     return ret;
1103 }
1104
1105 static void qcow2_update_options_commit(BlockDriverState *bs,
1106                                         Qcow2ReopenState *r)
1107 {
1108     BDRVQcow2State *s = bs->opaque;
1109     int i;
1110
1111     if (s->l2_table_cache) {
1112         qcow2_cache_destroy(s->l2_table_cache);
1113     }
1114     if (s->refcount_block_cache) {
1115         qcow2_cache_destroy(s->refcount_block_cache);
1116     }
1117     s->l2_table_cache = r->l2_table_cache;
1118     s->refcount_block_cache = r->refcount_block_cache;
1119     s->l2_slice_size = r->l2_slice_size;
1120
1121     s->overlap_check = r->overlap_check;
1122     s->use_lazy_refcounts = r->use_lazy_refcounts;
1123
1124     for (i = 0; i < QCOW2_DISCARD_MAX; i++) {
1125         s->discard_passthrough[i] = r->discard_passthrough[i];
1126     }
1127
1128     if (s->cache_clean_interval != r->cache_clean_interval) {
1129         cache_clean_timer_del(bs);
1130         s->cache_clean_interval = r->cache_clean_interval;
1131         cache_clean_timer_init(bs, bdrv_get_aio_context(bs));
1132     }
1133
1134     qapi_free_QCryptoBlockOpenOptions(s->crypto_opts);
1135     s->crypto_opts = r->crypto_opts;
1136 }
1137
1138 static void qcow2_update_options_abort(BlockDriverState *bs,
1139                                        Qcow2ReopenState *r)
1140 {
1141     if (r->l2_table_cache) {
1142         qcow2_cache_destroy(r->l2_table_cache);
1143     }
1144     if (r->refcount_block_cache) {
1145         qcow2_cache_destroy(r->refcount_block_cache);
1146     }
1147     qapi_free_QCryptoBlockOpenOptions(r->crypto_opts);
1148 }
1149
1150 static int qcow2_update_options(BlockDriverState *bs, QDict *options,
1151                                 int flags, Error **errp)
1152 {
1153     Qcow2ReopenState r = {};
1154     int ret;
1155
1156     ret = qcow2_update_options_prepare(bs, &r, options, flags, errp);
1157     if (ret >= 0) {
1158         qcow2_update_options_commit(bs, &r);
1159     } else {
1160         qcow2_update_options_abort(bs, &r);
1161     }
1162
1163     return ret;
1164 }
1165
1166 /* Called with s->lock held.  */
1167 static int coroutine_fn qcow2_do_open(BlockDriverState *bs, QDict *options,
1168                                       int flags, Error **errp)
1169 {
1170     BDRVQcow2State *s = bs->opaque;
1171     unsigned int len, i;
1172     int ret = 0;
1173     QCowHeader header;
1174     Error *local_err = NULL;
1175     uint64_t ext_end;
1176     uint64_t l1_vm_state_index;
1177     bool update_header = false;
1178
1179     ret = bdrv_pread(bs->file, 0, &header, sizeof(header));
1180     if (ret < 0) {
1181         error_setg_errno(errp, -ret, "Could not read qcow2 header");
1182         goto fail;
1183     }
1184     header.magic = be32_to_cpu(header.magic);
1185     header.version = be32_to_cpu(header.version);
1186     header.backing_file_offset = be64_to_cpu(header.backing_file_offset);
1187     header.backing_file_size = be32_to_cpu(header.backing_file_size);
1188     header.size = be64_to_cpu(header.size);
1189     header.cluster_bits = be32_to_cpu(header.cluster_bits);
1190     header.crypt_method = be32_to_cpu(header.crypt_method);
1191     header.l1_table_offset = be64_to_cpu(header.l1_table_offset);
1192     header.l1_size = be32_to_cpu(header.l1_size);
1193     header.refcount_table_offset = be64_to_cpu(header.refcount_table_offset);
1194     header.refcount_table_clusters =
1195         be32_to_cpu(header.refcount_table_clusters);
1196     header.snapshots_offset = be64_to_cpu(header.snapshots_offset);
1197     header.nb_snapshots = be32_to_cpu(header.nb_snapshots);
1198
1199     if (header.magic != QCOW_MAGIC) {
1200         error_setg(errp, "Image is not in qcow2 format");
1201         ret = -EINVAL;
1202         goto fail;
1203     }
1204     if (header.version < 2 || header.version > 3) {
1205         error_setg(errp, "Unsupported qcow2 version %" PRIu32, header.version);
1206         ret = -ENOTSUP;
1207         goto fail;
1208     }
1209
1210     s->qcow_version = header.version;
1211
1212     /* Initialise cluster size */
1213     if (header.cluster_bits < MIN_CLUSTER_BITS ||
1214         header.cluster_bits > MAX_CLUSTER_BITS) {
1215         error_setg(errp, "Unsupported cluster size: 2^%" PRIu32,
1216                    header.cluster_bits);
1217         ret = -EINVAL;
1218         goto fail;
1219     }
1220
1221     s->cluster_bits = header.cluster_bits;
1222     s->cluster_size = 1 << s->cluster_bits;
1223     s->cluster_sectors = 1 << (s->cluster_bits - BDRV_SECTOR_BITS);
1224
1225     /* Initialise version 3 header fields */
1226     if (header.version == 2) {
1227         header.incompatible_features    = 0;
1228         header.compatible_features      = 0;
1229         header.autoclear_features       = 0;
1230         header.refcount_order           = 4;
1231         header.header_length            = 72;
1232     } else {
1233         header.incompatible_features =
1234             be64_to_cpu(header.incompatible_features);
1235         header.compatible_features = be64_to_cpu(header.compatible_features);
1236         header.autoclear_features = be64_to_cpu(header.autoclear_features);
1237         header.refcount_order = be32_to_cpu(header.refcount_order);
1238         header.header_length = be32_to_cpu(header.header_length);
1239
1240         if (header.header_length < 104) {
1241             error_setg(errp, "qcow2 header too short");
1242             ret = -EINVAL;
1243             goto fail;
1244         }
1245     }
1246
1247     if (header.header_length > s->cluster_size) {
1248         error_setg(errp, "qcow2 header exceeds cluster size");
1249         ret = -EINVAL;
1250         goto fail;
1251     }
1252
1253     if (header.header_length > sizeof(header)) {
1254         s->unknown_header_fields_size = header.header_length - sizeof(header);
1255         s->unknown_header_fields = g_malloc(s->unknown_header_fields_size);
1256         ret = bdrv_pread(bs->file, sizeof(header), s->unknown_header_fields,
1257                          s->unknown_header_fields_size);
1258         if (ret < 0) {
1259             error_setg_errno(errp, -ret, "Could not read unknown qcow2 header "
1260                              "fields");
1261             goto fail;
1262         }
1263     }
1264
1265     if (header.backing_file_offset > s->cluster_size) {
1266         error_setg(errp, "Invalid backing file offset");
1267         ret = -EINVAL;
1268         goto fail;
1269     }
1270
1271     if (header.backing_file_offset) {
1272         ext_end = header.backing_file_offset;
1273     } else {
1274         ext_end = 1 << header.cluster_bits;
1275     }
1276
1277     /* Handle feature bits */
1278     s->incompatible_features    = header.incompatible_features;
1279     s->compatible_features      = header.compatible_features;
1280     s->autoclear_features       = header.autoclear_features;
1281
1282     if (s->incompatible_features & ~QCOW2_INCOMPAT_MASK) {
1283         void *feature_table = NULL;
1284         qcow2_read_extensions(bs, header.header_length, ext_end,
1285                               &feature_table, flags, NULL, NULL);
1286         report_unsupported_feature(errp, feature_table,
1287                                    s->incompatible_features &
1288                                    ~QCOW2_INCOMPAT_MASK);
1289         ret = -ENOTSUP;
1290         g_free(feature_table);
1291         goto fail;
1292     }
1293
1294     if (s->incompatible_features & QCOW2_INCOMPAT_CORRUPT) {
1295         /* Corrupt images may not be written to unless they are being repaired
1296          */
1297         if ((flags & BDRV_O_RDWR) && !(flags & BDRV_O_CHECK)) {
1298             error_setg(errp, "qcow2: Image is corrupt; cannot be opened "
1299                        "read/write");
1300             ret = -EACCES;
1301             goto fail;
1302         }
1303     }
1304
1305     /* Check support for various header values */
1306     if (header.refcount_order > 6) {
1307         error_setg(errp, "Reference count entry width too large; may not "
1308                    "exceed 64 bits");
1309         ret = -EINVAL;
1310         goto fail;
1311     }
1312     s->refcount_order = header.refcount_order;
1313     s->refcount_bits = 1 << s->refcount_order;
1314     s->refcount_max = UINT64_C(1) << (s->refcount_bits - 1);
1315     s->refcount_max += s->refcount_max - 1;
1316
1317     s->crypt_method_header = header.crypt_method;
1318     if (s->crypt_method_header) {
1319         if (bdrv_uses_whitelist() &&
1320             s->crypt_method_header == QCOW_CRYPT_AES) {
1321             error_setg(errp,
1322                        "Use of AES-CBC encrypted qcow2 images is no longer "
1323                        "supported in system emulators");
1324             error_append_hint(errp,
1325                               "You can use 'qemu-img convert' to convert your "
1326                               "image to an alternative supported format, such "
1327                               "as unencrypted qcow2, or raw with the LUKS "
1328                               "format instead.\n");
1329             ret = -ENOSYS;
1330             goto fail;
1331         }
1332
1333         if (s->crypt_method_header == QCOW_CRYPT_AES) {
1334             s->crypt_physical_offset = false;
1335         } else {
1336             /* Assuming LUKS and any future crypt methods we
1337              * add will all use physical offsets, due to the
1338              * fact that the alternative is insecure...  */
1339             s->crypt_physical_offset = true;
1340         }
1341
1342         bs->encrypted = true;
1343     }
1344
1345     s->l2_bits = s->cluster_bits - 3; /* L2 is always one cluster */
1346     s->l2_size = 1 << s->l2_bits;
1347     /* 2^(s->refcount_order - 3) is the refcount width in bytes */
1348     s->refcount_block_bits = s->cluster_bits - (s->refcount_order - 3);
1349     s->refcount_block_size = 1 << s->refcount_block_bits;
1350     bs->total_sectors = header.size / BDRV_SECTOR_SIZE;
1351     s->csize_shift = (62 - (s->cluster_bits - 8));
1352     s->csize_mask = (1 << (s->cluster_bits - 8)) - 1;
1353     s->cluster_offset_mask = (1LL << s->csize_shift) - 1;
1354
1355     s->refcount_table_offset = header.refcount_table_offset;
1356     s->refcount_table_size =
1357         header.refcount_table_clusters << (s->cluster_bits - 3);
1358
1359     if (header.refcount_table_clusters == 0 && !(flags & BDRV_O_CHECK)) {
1360         error_setg(errp, "Image does not contain a reference count table");
1361         ret = -EINVAL;
1362         goto fail;
1363     }
1364
1365     ret = qcow2_validate_table(bs, s->refcount_table_offset,
1366                                header.refcount_table_clusters,
1367                                s->cluster_size, QCOW_MAX_REFTABLE_SIZE,
1368                                "Reference count table", errp);
1369     if (ret < 0) {
1370         goto fail;
1371     }
1372
1373     /* The total size in bytes of the snapshot table is checked in
1374      * qcow2_read_snapshots() because the size of each snapshot is
1375      * variable and we don't know it yet.
1376      * Here we only check the offset and number of snapshots. */
1377     ret = qcow2_validate_table(bs, header.snapshots_offset,
1378                                header.nb_snapshots,
1379                                sizeof(QCowSnapshotHeader),
1380                                sizeof(QCowSnapshotHeader) * QCOW_MAX_SNAPSHOTS,
1381                                "Snapshot table", errp);
1382     if (ret < 0) {
1383         goto fail;
1384     }
1385
1386     /* read the level 1 table */
1387     ret = qcow2_validate_table(bs, header.l1_table_offset,
1388                                header.l1_size, sizeof(uint64_t),
1389                                QCOW_MAX_L1_SIZE, "Active L1 table", errp);
1390     if (ret < 0) {
1391         goto fail;
1392     }
1393     s->l1_size = header.l1_size;
1394     s->l1_table_offset = header.l1_table_offset;
1395
1396     l1_vm_state_index = size_to_l1(s, header.size);
1397     if (l1_vm_state_index > INT_MAX) {
1398         error_setg(errp, "Image is too big");
1399         ret = -EFBIG;
1400         goto fail;
1401     }
1402     s->l1_vm_state_index = l1_vm_state_index;
1403
1404     /* the L1 table must contain at least enough entries to put
1405        header.size bytes */
1406     if (s->l1_size < s->l1_vm_state_index) {
1407         error_setg(errp, "L1 table is too small");
1408         ret = -EINVAL;
1409         goto fail;
1410     }
1411
1412     if (s->l1_size > 0) {
1413         s->l1_table = qemu_try_blockalign(bs->file->bs,
1414             ROUND_UP(s->l1_size * sizeof(uint64_t), 512));
1415         if (s->l1_table == NULL) {
1416             error_setg(errp, "Could not allocate L1 table");
1417             ret = -ENOMEM;
1418             goto fail;
1419         }
1420         ret = bdrv_pread(bs->file, s->l1_table_offset, s->l1_table,
1421                          s->l1_size * sizeof(uint64_t));
1422         if (ret < 0) {
1423             error_setg_errno(errp, -ret, "Could not read L1 table");
1424             goto fail;
1425         }
1426         for(i = 0;i < s->l1_size; i++) {
1427             s->l1_table[i] = be64_to_cpu(s->l1_table[i]);
1428         }
1429     }
1430
1431     /* Parse driver-specific options */
1432     ret = qcow2_update_options(bs, options, flags, errp);
1433     if (ret < 0) {
1434         goto fail;
1435     }
1436
1437     s->flags = flags;
1438
1439     ret = qcow2_refcount_init(bs);
1440     if (ret != 0) {
1441         error_setg_errno(errp, -ret, "Could not initialize refcount handling");
1442         goto fail;
1443     }
1444
1445     QLIST_INIT(&s->cluster_allocs);
1446     QTAILQ_INIT(&s->discards);
1447
1448     /* read qcow2 extensions */
1449     if (qcow2_read_extensions(bs, header.header_length, ext_end, NULL,
1450                               flags, &update_header, &local_err)) {
1451         error_propagate(errp, local_err);
1452         ret = -EINVAL;
1453         goto fail;
1454     }
1455
1456     /* Open external data file */
1457     s->data_file = bdrv_open_child(NULL, options, "data-file", bs, &child_file,
1458                                    true, &local_err);
1459     if (local_err) {
1460         error_propagate(errp, local_err);
1461         ret = -EINVAL;
1462         goto fail;
1463     }
1464
1465     if (s->incompatible_features & QCOW2_INCOMPAT_DATA_FILE) {
1466         if (!s->data_file) {
1467             error_setg(errp, "'data-file' is required for this image");
1468             ret = -EINVAL;
1469             goto fail;
1470         }
1471     } else {
1472         if (s->data_file) {
1473             error_setg(errp, "'data-file' can only be set for images with an "
1474                              "external data file");
1475             ret = -EINVAL;
1476             goto fail;
1477         } else {
1478             s->data_file = bs->file;
1479         }
1480     }
1481
1482     /* qcow2_read_extension may have set up the crypto context
1483      * if the crypt method needs a header region, some methods
1484      * don't need header extensions, so must check here
1485      */
1486     if (s->crypt_method_header && !s->crypto) {
1487         if (s->crypt_method_header == QCOW_CRYPT_AES) {
1488             unsigned int cflags = 0;
1489             if (flags & BDRV_O_NO_IO) {
1490                 cflags |= QCRYPTO_BLOCK_OPEN_NO_IO;
1491             }
1492             s->crypto = qcrypto_block_open(s->crypto_opts, "encrypt.",
1493                                            NULL, NULL, cflags, 1, errp);
1494             if (!s->crypto) {
1495                 ret = -EINVAL;
1496                 goto fail;
1497             }
1498         } else if (!(flags & BDRV_O_NO_IO)) {
1499             error_setg(errp, "Missing CRYPTO header for crypt method %d",
1500                        s->crypt_method_header);
1501             ret = -EINVAL;
1502             goto fail;
1503         }
1504     }
1505
1506     /* read the backing file name */
1507     if (header.backing_file_offset != 0) {
1508         len = header.backing_file_size;
1509         if (len > MIN(1023, s->cluster_size - header.backing_file_offset) ||
1510             len >= sizeof(bs->backing_file)) {
1511             error_setg(errp, "Backing file name too long");
1512             ret = -EINVAL;
1513             goto fail;
1514         }
1515         ret = bdrv_pread(bs->file, header.backing_file_offset,
1516                          bs->auto_backing_file, len);
1517         if (ret < 0) {
1518             error_setg_errno(errp, -ret, "Could not read backing file name");
1519             goto fail;
1520         }
1521         bs->auto_backing_file[len] = '\0';
1522         pstrcpy(bs->backing_file, sizeof(bs->backing_file),
1523                 bs->auto_backing_file);
1524         s->image_backing_file = g_strdup(bs->auto_backing_file);
1525     }
1526
1527     /* Internal snapshots */
1528     s->snapshots_offset = header.snapshots_offset;
1529     s->nb_snapshots = header.nb_snapshots;
1530
1531     ret = qcow2_read_snapshots(bs);
1532     if (ret < 0) {
1533         error_setg_errno(errp, -ret, "Could not read snapshots");
1534         goto fail;
1535     }
1536
1537     /* Clear unknown autoclear feature bits */
1538     update_header |= s->autoclear_features & ~QCOW2_AUTOCLEAR_MASK;
1539     update_header =
1540         update_header && !bs->read_only && !(flags & BDRV_O_INACTIVE);
1541     if (update_header) {
1542         s->autoclear_features &= QCOW2_AUTOCLEAR_MASK;
1543     }
1544
1545     /* == Handle persistent dirty bitmaps ==
1546      *
1547      * We want load dirty bitmaps in three cases:
1548      *
1549      * 1. Normal open of the disk in active mode, not related to invalidation
1550      *    after migration.
1551      *
1552      * 2. Invalidation of the target vm after pre-copy phase of migration, if
1553      *    bitmaps are _not_ migrating through migration channel, i.e.
1554      *    'dirty-bitmaps' capability is disabled.
1555      *
1556      * 3. Invalidation of source vm after failed or canceled migration.
1557      *    This is a very interesting case. There are two possible types of
1558      *    bitmaps:
1559      *
1560      *    A. Stored on inactivation and removed. They should be loaded from the
1561      *       image.
1562      *
1563      *    B. Not stored: not-persistent bitmaps and bitmaps, migrated through
1564      *       the migration channel (with dirty-bitmaps capability).
1565      *
1566      *    On the other hand, there are two possible sub-cases:
1567      *
1568      *    3.1 disk was changed by somebody else while were inactive. In this
1569      *        case all in-RAM dirty bitmaps (both persistent and not) are
1570      *        definitely invalid. And we don't have any method to determine
1571      *        this.
1572      *
1573      *        Simple and safe thing is to just drop all the bitmaps of type B on
1574      *        inactivation. But in this case we lose bitmaps in valid 4.2 case.
1575      *
1576      *        On the other hand, resuming source vm, if disk was already changed
1577      *        is a bad thing anyway: not only bitmaps, the whole vm state is
1578      *        out of sync with disk.
1579      *
1580      *        This means, that user or management tool, who for some reason
1581      *        decided to resume source vm, after disk was already changed by
1582      *        target vm, should at least drop all dirty bitmaps by hand.
1583      *
1584      *        So, we can ignore this case for now, but TODO: "generation"
1585      *        extension for qcow2, to determine, that image was changed after
1586      *        last inactivation. And if it is changed, we will drop (or at least
1587      *        mark as 'invalid' all the bitmaps of type B, both persistent
1588      *        and not).
1589      *
1590      *    3.2 disk was _not_ changed while were inactive. Bitmaps may be saved
1591      *        to disk ('dirty-bitmaps' capability disabled), or not saved
1592      *        ('dirty-bitmaps' capability enabled), but we don't need to care
1593      *        of: let's load bitmaps as always: stored bitmaps will be loaded,
1594      *        and not stored has flag IN_USE=1 in the image and will be skipped
1595      *        on loading.
1596      *
1597      * One remaining possible case when we don't want load bitmaps:
1598      *
1599      * 4. Open disk in inactive mode in target vm (bitmaps are migrating or
1600      *    will be loaded on invalidation, no needs try loading them before)
1601      */
1602
1603     if (!(bdrv_get_flags(bs) & BDRV_O_INACTIVE)) {
1604         /* It's case 1, 2 or 3.2. Or 3.1 which is BUG in management layer. */
1605         bool header_updated = qcow2_load_dirty_bitmaps(bs, &local_err);
1606
1607         update_header = update_header && !header_updated;
1608     }
1609     if (local_err != NULL) {
1610         error_propagate(errp, local_err);
1611         ret = -EINVAL;
1612         goto fail;
1613     }
1614
1615     if (update_header) {
1616         ret = qcow2_update_header(bs);
1617         if (ret < 0) {
1618             error_setg_errno(errp, -ret, "Could not update qcow2 header");
1619             goto fail;
1620         }
1621     }
1622
1623     bs->supported_zero_flags = header.version >= 3 ? BDRV_REQ_MAY_UNMAP : 0;
1624
1625     /* Repair image if dirty */
1626     if (!(flags & (BDRV_O_CHECK | BDRV_O_INACTIVE)) && !bs->read_only &&
1627         (s->incompatible_features & QCOW2_INCOMPAT_DIRTY)) {
1628         BdrvCheckResult result = {0};
1629
1630         ret = qcow2_co_check_locked(bs, &result,
1631                                     BDRV_FIX_ERRORS | BDRV_FIX_LEAKS);
1632         if (ret < 0 || result.check_errors) {
1633             if (ret >= 0) {
1634                 ret = -EIO;
1635             }
1636             error_setg_errno(errp, -ret, "Could not repair dirty image");
1637             goto fail;
1638         }
1639     }
1640
1641 #ifdef DEBUG_ALLOC
1642     {
1643         BdrvCheckResult result = {0};
1644         qcow2_check_refcounts(bs, &result, 0);
1645     }
1646 #endif
1647
1648     qemu_co_queue_init(&s->compress_wait_queue);
1649
1650     return ret;
1651
1652  fail:
1653     if (has_data_file(bs)) {
1654         bdrv_unref_child(bs, s->data_file);
1655     }
1656     g_free(s->unknown_header_fields);
1657     cleanup_unknown_header_ext(bs);
1658     qcow2_free_snapshots(bs);
1659     qcow2_refcount_close(bs);
1660     qemu_vfree(s->l1_table);
1661     /* else pre-write overlap checks in cache_destroy may crash */
1662     s->l1_table = NULL;
1663     cache_clean_timer_del(bs);
1664     if (s->l2_table_cache) {
1665         qcow2_cache_destroy(s->l2_table_cache);
1666     }
1667     if (s->refcount_block_cache) {
1668         qcow2_cache_destroy(s->refcount_block_cache);
1669     }
1670     qcrypto_block_free(s->crypto);
1671     qapi_free_QCryptoBlockOpenOptions(s->crypto_opts);
1672     return ret;
1673 }
1674
1675 typedef struct QCow2OpenCo {
1676     BlockDriverState *bs;
1677     QDict *options;
1678     int flags;
1679     Error **errp;
1680     int ret;
1681 } QCow2OpenCo;
1682
1683 static void coroutine_fn qcow2_open_entry(void *opaque)
1684 {
1685     QCow2OpenCo *qoc = opaque;
1686     BDRVQcow2State *s = qoc->bs->opaque;
1687
1688     qemu_co_mutex_lock(&s->lock);
1689     qoc->ret = qcow2_do_open(qoc->bs, qoc->options, qoc->flags, qoc->errp);
1690     qemu_co_mutex_unlock(&s->lock);
1691 }
1692
1693 static int qcow2_open(BlockDriverState *bs, QDict *options, int flags,
1694                       Error **errp)
1695 {
1696     BDRVQcow2State *s = bs->opaque;
1697     QCow2OpenCo qoc = {
1698         .bs = bs,
1699         .options = options,
1700         .flags = flags,
1701         .errp = errp,
1702         .ret = -EINPROGRESS
1703     };
1704
1705     bs->file = bdrv_open_child(NULL, options, "file", bs, &child_file,
1706                                false, errp);
1707     if (!bs->file) {
1708         return -EINVAL;
1709     }
1710
1711     /* Initialise locks */
1712     qemu_co_mutex_init(&s->lock);
1713
1714     if (qemu_in_coroutine()) {
1715         /* From bdrv_co_create.  */
1716         qcow2_open_entry(&qoc);
1717     } else {
1718         assert(qemu_get_current_aio_context() == qemu_get_aio_context());
1719         qemu_coroutine_enter(qemu_coroutine_create(qcow2_open_entry, &qoc));
1720         BDRV_POLL_WHILE(bs, qoc.ret == -EINPROGRESS);
1721     }
1722     return qoc.ret;
1723 }
1724
1725 static void qcow2_refresh_limits(BlockDriverState *bs, Error **errp)
1726 {
1727     BDRVQcow2State *s = bs->opaque;
1728
1729     if (bs->encrypted) {
1730         /* Encryption works on a sector granularity */
1731         bs->bl.request_alignment = qcrypto_block_get_sector_size(s->crypto);
1732     }
1733     bs->bl.pwrite_zeroes_alignment = s->cluster_size;
1734     bs->bl.pdiscard_alignment = s->cluster_size;
1735 }
1736
1737 static int qcow2_reopen_prepare(BDRVReopenState *state,
1738                                 BlockReopenQueue *queue, Error **errp)
1739 {
1740     Qcow2ReopenState *r;
1741     int ret;
1742
1743     r = g_new0(Qcow2ReopenState, 1);
1744     state->opaque = r;
1745
1746     ret = qcow2_update_options_prepare(state->bs, r, state->options,
1747                                        state->flags, errp);
1748     if (ret < 0) {
1749         goto fail;
1750     }
1751
1752     /* We need to write out any unwritten data if we reopen read-only. */
1753     if ((state->flags & BDRV_O_RDWR) == 0) {
1754         ret = qcow2_reopen_bitmaps_ro(state->bs, errp);
1755         if (ret < 0) {
1756             goto fail;
1757         }
1758
1759         ret = bdrv_flush(state->bs);
1760         if (ret < 0) {
1761             goto fail;
1762         }
1763
1764         ret = qcow2_mark_clean(state->bs);
1765         if (ret < 0) {
1766             goto fail;
1767         }
1768     }
1769
1770     return 0;
1771
1772 fail:
1773     qcow2_update_options_abort(state->bs, r);
1774     g_free(r);
1775     return ret;
1776 }
1777
1778 static void qcow2_reopen_commit(BDRVReopenState *state)
1779 {
1780     qcow2_update_options_commit(state->bs, state->opaque);
1781     g_free(state->opaque);
1782 }
1783
1784 static void qcow2_reopen_abort(BDRVReopenState *state)
1785 {
1786     qcow2_update_options_abort(state->bs, state->opaque);
1787     g_free(state->opaque);
1788 }
1789
1790 static void qcow2_join_options(QDict *options, QDict *old_options)
1791 {
1792     bool has_new_overlap_template =
1793         qdict_haskey(options, QCOW2_OPT_OVERLAP) ||
1794         qdict_haskey(options, QCOW2_OPT_OVERLAP_TEMPLATE);
1795     bool has_new_total_cache_size =
1796         qdict_haskey(options, QCOW2_OPT_CACHE_SIZE);
1797     bool has_all_cache_options;
1798
1799     /* New overlap template overrides all old overlap options */
1800     if (has_new_overlap_template) {
1801         qdict_del(old_options, QCOW2_OPT_OVERLAP);
1802         qdict_del(old_options, QCOW2_OPT_OVERLAP_TEMPLATE);
1803         qdict_del(old_options, QCOW2_OPT_OVERLAP_MAIN_HEADER);
1804         qdict_del(old_options, QCOW2_OPT_OVERLAP_ACTIVE_L1);
1805         qdict_del(old_options, QCOW2_OPT_OVERLAP_ACTIVE_L2);
1806         qdict_del(old_options, QCOW2_OPT_OVERLAP_REFCOUNT_TABLE);
1807         qdict_del(old_options, QCOW2_OPT_OVERLAP_REFCOUNT_BLOCK);
1808         qdict_del(old_options, QCOW2_OPT_OVERLAP_SNAPSHOT_TABLE);
1809         qdict_del(old_options, QCOW2_OPT_OVERLAP_INACTIVE_L1);
1810         qdict_del(old_options, QCOW2_OPT_OVERLAP_INACTIVE_L2);
1811     }
1812
1813     /* New total cache size overrides all old options */
1814     if (qdict_haskey(options, QCOW2_OPT_CACHE_SIZE)) {
1815         qdict_del(old_options, QCOW2_OPT_L2_CACHE_SIZE);
1816         qdict_del(old_options, QCOW2_OPT_REFCOUNT_CACHE_SIZE);
1817     }
1818
1819     qdict_join(options, old_options, false);
1820
1821     /*
1822      * If after merging all cache size options are set, an old total size is
1823      * overwritten. Do keep all options, however, if all three are new. The
1824      * resulting error message is what we want to happen.
1825      */
1826     has_all_cache_options =
1827         qdict_haskey(options, QCOW2_OPT_CACHE_SIZE) ||
1828         qdict_haskey(options, QCOW2_OPT_L2_CACHE_SIZE) ||
1829         qdict_haskey(options, QCOW2_OPT_REFCOUNT_CACHE_SIZE);
1830
1831     if (has_all_cache_options && !has_new_total_cache_size) {
1832         qdict_del(options, QCOW2_OPT_CACHE_SIZE);
1833     }
1834 }
1835
1836 static int coroutine_fn qcow2_co_block_status(BlockDriverState *bs,
1837                                               bool want_zero,
1838                                               int64_t offset, int64_t count,
1839                                               int64_t *pnum, int64_t *map,
1840                                               BlockDriverState **file)
1841 {
1842     BDRVQcow2State *s = bs->opaque;
1843     uint64_t cluster_offset;
1844     int index_in_cluster, ret;
1845     unsigned int bytes;
1846     int status = 0;
1847
1848     bytes = MIN(INT_MAX, count);
1849     qemu_co_mutex_lock(&s->lock);
1850     ret = qcow2_get_cluster_offset(bs, offset, &bytes, &cluster_offset);
1851     qemu_co_mutex_unlock(&s->lock);
1852     if (ret < 0) {
1853         return ret;
1854     }
1855
1856     *pnum = bytes;
1857
1858     if ((ret == QCOW2_CLUSTER_NORMAL || ret == QCOW2_CLUSTER_ZERO_ALLOC) &&
1859         !s->crypto) {
1860         index_in_cluster = offset & (s->cluster_size - 1);
1861         *map = cluster_offset | index_in_cluster;
1862         *file = s->data_file->bs;
1863         status |= BDRV_BLOCK_OFFSET_VALID;
1864     }
1865     if (ret == QCOW2_CLUSTER_ZERO_PLAIN || ret == QCOW2_CLUSTER_ZERO_ALLOC) {
1866         status |= BDRV_BLOCK_ZERO;
1867     } else if (ret != QCOW2_CLUSTER_UNALLOCATED) {
1868         status |= BDRV_BLOCK_DATA;
1869     }
1870     return status;
1871 }
1872
1873 static coroutine_fn int qcow2_handle_l2meta(BlockDriverState *bs,
1874                                             QCowL2Meta **pl2meta,
1875                                             bool link_l2)
1876 {
1877     int ret = 0;
1878     QCowL2Meta *l2meta = *pl2meta;
1879
1880     while (l2meta != NULL) {
1881         QCowL2Meta *next;
1882
1883         if (link_l2) {
1884             ret = qcow2_alloc_cluster_link_l2(bs, l2meta);
1885             if (ret) {
1886                 goto out;
1887             }
1888         } else {
1889             qcow2_alloc_cluster_abort(bs, l2meta);
1890         }
1891
1892         /* Take the request off the list of running requests */
1893         if (l2meta->nb_clusters != 0) {
1894             QLIST_REMOVE(l2meta, next_in_flight);
1895         }
1896
1897         qemu_co_queue_restart_all(&l2meta->dependent_requests);
1898
1899         next = l2meta->next;
1900         g_free(l2meta);
1901         l2meta = next;
1902     }
1903 out:
1904     *pl2meta = l2meta;
1905     return ret;
1906 }
1907
1908 static coroutine_fn int qcow2_co_preadv(BlockDriverState *bs, uint64_t offset,
1909                                         uint64_t bytes, QEMUIOVector *qiov,
1910                                         int flags)
1911 {
1912     BDRVQcow2State *s = bs->opaque;
1913     int offset_in_cluster;
1914     int ret;
1915     unsigned int cur_bytes; /* number of bytes in current iteration */
1916     uint64_t cluster_offset = 0;
1917     uint64_t bytes_done = 0;
1918     QEMUIOVector hd_qiov;
1919     uint8_t *cluster_data = NULL;
1920
1921     qemu_iovec_init(&hd_qiov, qiov->niov);
1922
1923     qemu_co_mutex_lock(&s->lock);
1924
1925     while (bytes != 0) {
1926
1927         /* prepare next request */
1928         cur_bytes = MIN(bytes, INT_MAX);
1929         if (s->crypto) {
1930             cur_bytes = MIN(cur_bytes,
1931                             QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size);
1932         }
1933
1934         ret = qcow2_get_cluster_offset(bs, offset, &cur_bytes, &cluster_offset);
1935         if (ret < 0) {
1936             goto fail;
1937         }
1938
1939         offset_in_cluster = offset_into_cluster(s, offset);
1940
1941         qemu_iovec_reset(&hd_qiov);
1942         qemu_iovec_concat(&hd_qiov, qiov, bytes_done, cur_bytes);
1943
1944         switch (ret) {
1945         case QCOW2_CLUSTER_UNALLOCATED:
1946
1947             if (bs->backing) {
1948                 BLKDBG_EVENT(bs->file, BLKDBG_READ_BACKING_AIO);
1949                 qemu_co_mutex_unlock(&s->lock);
1950                 ret = bdrv_co_preadv(bs->backing, offset, cur_bytes,
1951                                      &hd_qiov, 0);
1952                 qemu_co_mutex_lock(&s->lock);
1953                 if (ret < 0) {
1954                     goto fail;
1955                 }
1956             } else {
1957                 /* Note: in this case, no need to wait */
1958                 qemu_iovec_memset(&hd_qiov, 0, 0, cur_bytes);
1959             }
1960             break;
1961
1962         case QCOW2_CLUSTER_ZERO_PLAIN:
1963         case QCOW2_CLUSTER_ZERO_ALLOC:
1964             qemu_iovec_memset(&hd_qiov, 0, 0, cur_bytes);
1965             break;
1966
1967         case QCOW2_CLUSTER_COMPRESSED:
1968             qemu_co_mutex_unlock(&s->lock);
1969             ret = qcow2_co_preadv_compressed(bs, cluster_offset,
1970                                              offset, cur_bytes,
1971                                              &hd_qiov);
1972             qemu_co_mutex_lock(&s->lock);
1973             if (ret < 0) {
1974                 goto fail;
1975             }
1976
1977             break;
1978
1979         case QCOW2_CLUSTER_NORMAL:
1980             if ((cluster_offset & 511) != 0) {
1981                 ret = -EIO;
1982                 goto fail;
1983             }
1984
1985             if (bs->encrypted) {
1986                 assert(s->crypto);
1987
1988                 /*
1989                  * For encrypted images, read everything into a temporary
1990                  * contiguous buffer on which the AES functions can work.
1991                  */
1992                 if (!cluster_data) {
1993                     cluster_data =
1994                         qemu_try_blockalign(s->data_file->bs,
1995                                             QCOW_MAX_CRYPT_CLUSTERS
1996                                             * s->cluster_size);
1997                     if (cluster_data == NULL) {
1998                         ret = -ENOMEM;
1999                         goto fail;
2000                     }
2001                 }
2002
2003                 assert(cur_bytes <= QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size);
2004                 qemu_iovec_reset(&hd_qiov);
2005                 qemu_iovec_add(&hd_qiov, cluster_data, cur_bytes);
2006             }
2007
2008             BLKDBG_EVENT(bs->file, BLKDBG_READ_AIO);
2009             qemu_co_mutex_unlock(&s->lock);
2010             ret = bdrv_co_preadv(s->data_file,
2011                                  cluster_offset + offset_in_cluster,
2012                                  cur_bytes, &hd_qiov, 0);
2013             qemu_co_mutex_lock(&s->lock);
2014             if (ret < 0) {
2015                 goto fail;
2016             }
2017             if (bs->encrypted) {
2018                 assert(s->crypto);
2019                 assert((offset & (BDRV_SECTOR_SIZE - 1)) == 0);
2020                 assert((cur_bytes & (BDRV_SECTOR_SIZE - 1)) == 0);
2021                 if (qcrypto_block_decrypt(s->crypto,
2022                                           (s->crypt_physical_offset ?
2023                                            cluster_offset + offset_in_cluster :
2024                                            offset),
2025                                           cluster_data,
2026                                           cur_bytes,
2027                                           NULL) < 0) {
2028                     ret = -EIO;
2029                     goto fail;
2030                 }
2031                 qemu_iovec_from_buf(qiov, bytes_done, cluster_data, cur_bytes);
2032             }
2033             break;
2034
2035         default:
2036             g_assert_not_reached();
2037             ret = -EIO;
2038             goto fail;
2039         }
2040
2041         bytes -= cur_bytes;
2042         offset += cur_bytes;
2043         bytes_done += cur_bytes;
2044     }
2045     ret = 0;
2046
2047 fail:
2048     qemu_co_mutex_unlock(&s->lock);
2049
2050     qemu_iovec_destroy(&hd_qiov);
2051     qemu_vfree(cluster_data);
2052
2053     return ret;
2054 }
2055
2056 /* Check if it's possible to merge a write request with the writing of
2057  * the data from the COW regions */
2058 static bool merge_cow(uint64_t offset, unsigned bytes,
2059                       QEMUIOVector *hd_qiov, QCowL2Meta *l2meta)
2060 {
2061     QCowL2Meta *m;
2062
2063     for (m = l2meta; m != NULL; m = m->next) {
2064         /* If both COW regions are empty then there's nothing to merge */
2065         if (m->cow_start.nb_bytes == 0 && m->cow_end.nb_bytes == 0) {
2066             continue;
2067         }
2068
2069         /* The data (middle) region must be immediately after the
2070          * start region */
2071         if (l2meta_cow_start(m) + m->cow_start.nb_bytes != offset) {
2072             continue;
2073         }
2074
2075         /* The end region must be immediately after the data (middle)
2076          * region */
2077         if (m->offset + m->cow_end.offset != offset + bytes) {
2078             continue;
2079         }
2080
2081         /* Make sure that adding both COW regions to the QEMUIOVector
2082          * does not exceed IOV_MAX */
2083         if (hd_qiov->niov > IOV_MAX - 2) {
2084             continue;
2085         }
2086
2087         m->data_qiov = hd_qiov;
2088         return true;
2089     }
2090
2091     return false;
2092 }
2093
2094 static coroutine_fn int qcow2_co_pwritev(BlockDriverState *bs, uint64_t offset,
2095                                          uint64_t bytes, QEMUIOVector *qiov,
2096                                          int flags)
2097 {
2098     BDRVQcow2State *s = bs->opaque;
2099     int offset_in_cluster;
2100     int ret;
2101     unsigned int cur_bytes; /* number of sectors in current iteration */
2102     uint64_t cluster_offset;
2103     QEMUIOVector hd_qiov;
2104     uint64_t bytes_done = 0;
2105     uint8_t *cluster_data = NULL;
2106     QCowL2Meta *l2meta = NULL;
2107
2108     trace_qcow2_writev_start_req(qemu_coroutine_self(), offset, bytes);
2109
2110     qemu_iovec_init(&hd_qiov, qiov->niov);
2111
2112     qemu_co_mutex_lock(&s->lock);
2113
2114     while (bytes != 0) {
2115
2116         l2meta = NULL;
2117
2118         trace_qcow2_writev_start_part(qemu_coroutine_self());
2119         offset_in_cluster = offset_into_cluster(s, offset);
2120         cur_bytes = MIN(bytes, INT_MAX);
2121         if (bs->encrypted) {
2122             cur_bytes = MIN(cur_bytes,
2123                             QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size
2124                             - offset_in_cluster);
2125         }
2126
2127         ret = qcow2_alloc_cluster_offset(bs, offset, &cur_bytes,
2128                                          &cluster_offset, &l2meta);
2129         if (ret < 0) {
2130             goto fail;
2131         }
2132
2133         assert((cluster_offset & 511) == 0);
2134
2135         qemu_iovec_reset(&hd_qiov);
2136         qemu_iovec_concat(&hd_qiov, qiov, bytes_done, cur_bytes);
2137
2138         if (bs->encrypted) {
2139             assert(s->crypto);
2140             if (!cluster_data) {
2141                 cluster_data = qemu_try_blockalign(bs->file->bs,
2142                                                    QCOW_MAX_CRYPT_CLUSTERS
2143                                                    * s->cluster_size);
2144                 if (cluster_data == NULL) {
2145                     ret = -ENOMEM;
2146                     goto fail;
2147                 }
2148             }
2149
2150             assert(hd_qiov.size <=
2151                    QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size);
2152             qemu_iovec_to_buf(&hd_qiov, 0, cluster_data, hd_qiov.size);
2153
2154             if (qcrypto_block_encrypt(s->crypto,
2155                                       (s->crypt_physical_offset ?
2156                                        cluster_offset + offset_in_cluster :
2157                                        offset),
2158                                       cluster_data,
2159                                       cur_bytes, NULL) < 0) {
2160                 ret = -EIO;
2161                 goto fail;
2162             }
2163
2164             qemu_iovec_reset(&hd_qiov);
2165             qemu_iovec_add(&hd_qiov, cluster_data, cur_bytes);
2166         }
2167
2168         ret = qcow2_pre_write_overlap_check(bs, 0,
2169                 cluster_offset + offset_in_cluster, cur_bytes, true);
2170         if (ret < 0) {
2171             goto fail;
2172         }
2173
2174         /* If we need to do COW, check if it's possible to merge the
2175          * writing of the guest data together with that of the COW regions.
2176          * If it's not possible (or not necessary) then write the
2177          * guest data now. */
2178         if (!merge_cow(offset, cur_bytes, &hd_qiov, l2meta)) {
2179             qemu_co_mutex_unlock(&s->lock);
2180             BLKDBG_EVENT(bs->file, BLKDBG_WRITE_AIO);
2181             trace_qcow2_writev_data(qemu_coroutine_self(),
2182                                     cluster_offset + offset_in_cluster);
2183             ret = bdrv_co_pwritev(s->data_file,
2184                                   cluster_offset + offset_in_cluster,
2185                                   cur_bytes, &hd_qiov, 0);
2186             qemu_co_mutex_lock(&s->lock);
2187             if (ret < 0) {
2188                 goto fail;
2189             }
2190         }
2191
2192         ret = qcow2_handle_l2meta(bs, &l2meta, true);
2193         if (ret) {
2194             goto fail;
2195         }
2196
2197         bytes -= cur_bytes;
2198         offset += cur_bytes;
2199         bytes_done += cur_bytes;
2200         trace_qcow2_writev_done_part(qemu_coroutine_self(), cur_bytes);
2201     }
2202     ret = 0;
2203
2204 fail:
2205     qcow2_handle_l2meta(bs, &l2meta, false);
2206
2207     qemu_co_mutex_unlock(&s->lock);
2208
2209     qemu_iovec_destroy(&hd_qiov);
2210     qemu_vfree(cluster_data);
2211     trace_qcow2_writev_done_req(qemu_coroutine_self(), ret);
2212
2213     return ret;
2214 }
2215
2216 static int qcow2_inactivate(BlockDriverState *bs)
2217 {
2218     BDRVQcow2State *s = bs->opaque;
2219     int ret, result = 0;
2220     Error *local_err = NULL;
2221
2222     qcow2_store_persistent_dirty_bitmaps(bs, &local_err);
2223     if (local_err != NULL) {
2224         result = -EINVAL;
2225         error_reportf_err(local_err, "Lost persistent bitmaps during "
2226                           "inactivation of node '%s': ",
2227                           bdrv_get_device_or_node_name(bs));
2228     }
2229
2230     ret = qcow2_cache_flush(bs, s->l2_table_cache);
2231     if (ret) {
2232         result = ret;
2233         error_report("Failed to flush the L2 table cache: %s",
2234                      strerror(-ret));
2235     }
2236
2237     ret = qcow2_cache_flush(bs, s->refcount_block_cache);
2238     if (ret) {
2239         result = ret;
2240         error_report("Failed to flush the refcount block cache: %s",
2241                      strerror(-ret));
2242     }
2243
2244     if (result == 0) {
2245         qcow2_mark_clean(bs);
2246     }
2247
2248     return result;
2249 }
2250
2251 static void qcow2_close(BlockDriverState *bs)
2252 {
2253     BDRVQcow2State *s = bs->opaque;
2254     qemu_vfree(s->l1_table);
2255     /* else pre-write overlap checks in cache_destroy may crash */
2256     s->l1_table = NULL;
2257
2258     if (!(s->flags & BDRV_O_INACTIVE)) {
2259         qcow2_inactivate(bs);
2260     }
2261
2262     cache_clean_timer_del(bs);
2263     qcow2_cache_destroy(s->l2_table_cache);
2264     qcow2_cache_destroy(s->refcount_block_cache);
2265
2266     qcrypto_block_free(s->crypto);
2267     s->crypto = NULL;
2268
2269     g_free(s->unknown_header_fields);
2270     cleanup_unknown_header_ext(bs);
2271
2272     g_free(s->image_backing_file);
2273     g_free(s->image_backing_format);
2274
2275     if (has_data_file(bs)) {
2276         bdrv_unref_child(bs, s->data_file);
2277     }
2278
2279     qcow2_refcount_close(bs);
2280     qcow2_free_snapshots(bs);
2281 }
2282
2283 static void coroutine_fn qcow2_co_invalidate_cache(BlockDriverState *bs,
2284                                                    Error **errp)
2285 {
2286     BDRVQcow2State *s = bs->opaque;
2287     int flags = s->flags;
2288     QCryptoBlock *crypto = NULL;
2289     QDict *options;
2290     Error *local_err = NULL;
2291     int ret;
2292
2293     /*
2294      * Backing files are read-only which makes all of their metadata immutable,
2295      * that means we don't have to worry about reopening them here.
2296      */
2297
2298     crypto = s->crypto;
2299     s->crypto = NULL;
2300
2301     qcow2_close(bs);
2302
2303     memset(s, 0, sizeof(BDRVQcow2State));
2304     options = qdict_clone_shallow(bs->options);
2305
2306     flags &= ~BDRV_O_INACTIVE;
2307     qemu_co_mutex_lock(&s->lock);
2308     ret = qcow2_do_open(bs, options, flags, &local_err);
2309     qemu_co_mutex_unlock(&s->lock);
2310     qobject_unref(options);
2311     if (local_err) {
2312         error_propagate_prepend(errp, local_err,
2313                                 "Could not reopen qcow2 layer: ");
2314         bs->drv = NULL;
2315         return;
2316     } else if (ret < 0) {
2317         error_setg_errno(errp, -ret, "Could not reopen qcow2 layer");
2318         bs->drv = NULL;
2319         return;
2320     }
2321
2322     s->crypto = crypto;
2323 }
2324
2325 static size_t header_ext_add(char *buf, uint32_t magic, const void *s,
2326     size_t len, size_t buflen)
2327 {
2328     QCowExtension *ext_backing_fmt = (QCowExtension*) buf;
2329     size_t ext_len = sizeof(QCowExtension) + ((len + 7) & ~7);
2330
2331     if (buflen < ext_len) {
2332         return -ENOSPC;
2333     }
2334
2335     *ext_backing_fmt = (QCowExtension) {
2336         .magic  = cpu_to_be32(magic),
2337         .len    = cpu_to_be32(len),
2338     };
2339
2340     if (len) {
2341         memcpy(buf + sizeof(QCowExtension), s, len);
2342     }
2343
2344     return ext_len;
2345 }
2346
2347 /*
2348  * Updates the qcow2 header, including the variable length parts of it, i.e.
2349  * the backing file name and all extensions. qcow2 was not designed to allow
2350  * such changes, so if we run out of space (we can only use the first cluster)
2351  * this function may fail.
2352  *
2353  * Returns 0 on success, -errno in error cases.
2354  */
2355 int qcow2_update_header(BlockDriverState *bs)
2356 {
2357     BDRVQcow2State *s = bs->opaque;
2358     QCowHeader *header;
2359     char *buf;
2360     size_t buflen = s->cluster_size;
2361     int ret;
2362     uint64_t total_size;
2363     uint32_t refcount_table_clusters;
2364     size_t header_length;
2365     Qcow2UnknownHeaderExtension *uext;
2366
2367     buf = qemu_blockalign(bs, buflen);
2368
2369     /* Header structure */
2370     header = (QCowHeader*) buf;
2371
2372     if (buflen < sizeof(*header)) {
2373         ret = -ENOSPC;
2374         goto fail;
2375     }
2376
2377     header_length = sizeof(*header) + s->unknown_header_fields_size;
2378     total_size = bs->total_sectors * BDRV_SECTOR_SIZE;
2379     refcount_table_clusters = s->refcount_table_size >> (s->cluster_bits - 3);
2380
2381     *header = (QCowHeader) {
2382         /* Version 2 fields */
2383         .magic                  = cpu_to_be32(QCOW_MAGIC),
2384         .version                = cpu_to_be32(s->qcow_version),
2385         .backing_file_offset    = 0,
2386         .backing_file_size      = 0,
2387         .cluster_bits           = cpu_to_be32(s->cluster_bits),
2388         .size                   = cpu_to_be64(total_size),
2389         .crypt_method           = cpu_to_be32(s->crypt_method_header),
2390         .l1_size                = cpu_to_be32(s->l1_size),
2391         .l1_table_offset        = cpu_to_be64(s->l1_table_offset),
2392         .refcount_table_offset  = cpu_to_be64(s->refcount_table_offset),
2393         .refcount_table_clusters = cpu_to_be32(refcount_table_clusters),
2394         .nb_snapshots           = cpu_to_be32(s->nb_snapshots),
2395         .snapshots_offset       = cpu_to_be64(s->snapshots_offset),
2396
2397         /* Version 3 fields */
2398         .incompatible_features  = cpu_to_be64(s->incompatible_features),
2399         .compatible_features    = cpu_to_be64(s->compatible_features),
2400         .autoclear_features     = cpu_to_be64(s->autoclear_features),
2401         .refcount_order         = cpu_to_be32(s->refcount_order),
2402         .header_length          = cpu_to_be32(header_length),
2403     };
2404
2405     /* For older versions, write a shorter header */
2406     switch (s->qcow_version) {
2407     case 2:
2408         ret = offsetof(QCowHeader, incompatible_features);
2409         break;
2410     case 3:
2411         ret = sizeof(*header);
2412         break;
2413     default:
2414         ret = -EINVAL;
2415         goto fail;
2416     }
2417
2418     buf += ret;
2419     buflen -= ret;
2420     memset(buf, 0, buflen);
2421
2422     /* Preserve any unknown field in the header */
2423     if (s->unknown_header_fields_size) {
2424         if (buflen < s->unknown_header_fields_size) {
2425             ret = -ENOSPC;
2426             goto fail;
2427         }
2428
2429         memcpy(buf, s->unknown_header_fields, s->unknown_header_fields_size);
2430         buf += s->unknown_header_fields_size;
2431         buflen -= s->unknown_header_fields_size;
2432     }
2433
2434     /* Backing file format header extension */
2435     if (s->image_backing_format) {
2436         ret = header_ext_add(buf, QCOW2_EXT_MAGIC_BACKING_FORMAT,
2437                              s->image_backing_format,
2438                              strlen(s->image_backing_format),
2439                              buflen);
2440         if (ret < 0) {
2441             goto fail;
2442         }
2443
2444         buf += ret;
2445         buflen -= ret;
2446     }
2447
2448     /* Full disk encryption header pointer extension */
2449     if (s->crypto_header.offset != 0) {
2450         s->crypto_header.offset = cpu_to_be64(s->crypto_header.offset);
2451         s->crypto_header.length = cpu_to_be64(s->crypto_header.length);
2452         ret = header_ext_add(buf, QCOW2_EXT_MAGIC_CRYPTO_HEADER,
2453                              &s->crypto_header, sizeof(s->crypto_header),
2454                              buflen);
2455         s->crypto_header.offset = be64_to_cpu(s->crypto_header.offset);
2456         s->crypto_header.length = be64_to_cpu(s->crypto_header.length);
2457         if (ret < 0) {
2458             goto fail;
2459         }
2460         buf += ret;
2461         buflen -= ret;
2462     }
2463
2464     /* Feature table */
2465     if (s->qcow_version >= 3) {
2466         Qcow2Feature features[] = {
2467             {
2468                 .type = QCOW2_FEAT_TYPE_INCOMPATIBLE,
2469                 .bit  = QCOW2_INCOMPAT_DIRTY_BITNR,
2470                 .name = "dirty bit",
2471             },
2472             {
2473                 .type = QCOW2_FEAT_TYPE_INCOMPATIBLE,
2474                 .bit  = QCOW2_INCOMPAT_CORRUPT_BITNR,
2475                 .name = "corrupt bit",
2476             },
2477             {
2478                 .type = QCOW2_FEAT_TYPE_INCOMPATIBLE,
2479                 .bit  = QCOW2_INCOMPAT_DATA_FILE_BITNR,
2480                 .name = "external data file",
2481             },
2482             {
2483                 .type = QCOW2_FEAT_TYPE_COMPATIBLE,
2484                 .bit  = QCOW2_COMPAT_LAZY_REFCOUNTS_BITNR,
2485                 .name = "lazy refcounts",
2486             },
2487         };
2488
2489         ret = header_ext_add(buf, QCOW2_EXT_MAGIC_FEATURE_TABLE,
2490                              features, sizeof(features), buflen);
2491         if (ret < 0) {
2492             goto fail;
2493         }
2494         buf += ret;
2495         buflen -= ret;
2496     }
2497
2498     /* Bitmap extension */
2499     if (s->nb_bitmaps > 0) {
2500         Qcow2BitmapHeaderExt bitmaps_header = {
2501             .nb_bitmaps = cpu_to_be32(s->nb_bitmaps),
2502             .bitmap_directory_size =
2503                     cpu_to_be64(s->bitmap_directory_size),
2504             .bitmap_directory_offset =
2505                     cpu_to_be64(s->bitmap_directory_offset)
2506         };
2507         ret = header_ext_add(buf, QCOW2_EXT_MAGIC_BITMAPS,
2508                              &bitmaps_header, sizeof(bitmaps_header),
2509                              buflen);
2510         if (ret < 0) {
2511             goto fail;
2512         }
2513         buf += ret;
2514         buflen -= ret;
2515     }
2516
2517     /* Keep unknown header extensions */
2518     QLIST_FOREACH(uext, &s->unknown_header_ext, next) {
2519         ret = header_ext_add(buf, uext->magic, uext->data, uext->len, buflen);
2520         if (ret < 0) {
2521             goto fail;
2522         }
2523
2524         buf += ret;
2525         buflen -= ret;
2526     }
2527
2528     /* End of header extensions */
2529     ret = header_ext_add(buf, QCOW2_EXT_MAGIC_END, NULL, 0, buflen);
2530     if (ret < 0) {
2531         goto fail;
2532     }
2533
2534     buf += ret;
2535     buflen -= ret;
2536
2537     /* Backing file name */
2538     if (s->image_backing_file) {
2539         size_t backing_file_len = strlen(s->image_backing_file);
2540
2541         if (buflen < backing_file_len) {
2542             ret = -ENOSPC;
2543             goto fail;
2544         }
2545
2546         /* Using strncpy is ok here, since buf is not NUL-terminated. */
2547         strncpy(buf, s->image_backing_file, buflen);
2548
2549         header->backing_file_offset = cpu_to_be64(buf - ((char*) header));
2550         header->backing_file_size   = cpu_to_be32(backing_file_len);
2551     }
2552
2553     /* Write the new header */
2554     ret = bdrv_pwrite(bs->file, 0, header, s->cluster_size);
2555     if (ret < 0) {
2556         goto fail;
2557     }
2558
2559     ret = 0;
2560 fail:
2561     qemu_vfree(header);
2562     return ret;
2563 }
2564
2565 static int qcow2_change_backing_file(BlockDriverState *bs,
2566     const char *backing_file, const char *backing_fmt)
2567 {
2568     BDRVQcow2State *s = bs->opaque;
2569
2570     if (backing_file && strlen(backing_file) > 1023) {
2571         return -EINVAL;
2572     }
2573
2574     pstrcpy(bs->auto_backing_file, sizeof(bs->auto_backing_file),
2575             backing_file ?: "");
2576     pstrcpy(bs->backing_file, sizeof(bs->backing_file), backing_file ?: "");
2577     pstrcpy(bs->backing_format, sizeof(bs->backing_format), backing_fmt ?: "");
2578
2579     g_free(s->image_backing_file);
2580     g_free(s->image_backing_format);
2581
2582     s->image_backing_file = backing_file ? g_strdup(bs->backing_file) : NULL;
2583     s->image_backing_format = backing_fmt ? g_strdup(bs->backing_format) : NULL;
2584
2585     return qcow2_update_header(bs);
2586 }
2587
2588 static int qcow2_crypt_method_from_format(const char *encryptfmt)
2589 {
2590     if (g_str_equal(encryptfmt, "luks")) {
2591         return QCOW_CRYPT_LUKS;
2592     } else if (g_str_equal(encryptfmt, "aes")) {
2593         return QCOW_CRYPT_AES;
2594     } else {
2595         return -EINVAL;
2596     }
2597 }
2598
2599 static int qcow2_set_up_encryption(BlockDriverState *bs,
2600                                    QCryptoBlockCreateOptions *cryptoopts,
2601                                    Error **errp)
2602 {
2603     BDRVQcow2State *s = bs->opaque;
2604     QCryptoBlock *crypto = NULL;
2605     int fmt, ret;
2606
2607     switch (cryptoopts->format) {
2608     case Q_CRYPTO_BLOCK_FORMAT_LUKS:
2609         fmt = QCOW_CRYPT_LUKS;
2610         break;
2611     case Q_CRYPTO_BLOCK_FORMAT_QCOW:
2612         fmt = QCOW_CRYPT_AES;
2613         break;
2614     default:
2615         error_setg(errp, "Crypto format not supported in qcow2");
2616         return -EINVAL;
2617     }
2618
2619     s->crypt_method_header = fmt;
2620
2621     crypto = qcrypto_block_create(cryptoopts, "encrypt.",
2622                                   qcow2_crypto_hdr_init_func,
2623                                   qcow2_crypto_hdr_write_func,
2624                                   bs, errp);
2625     if (!crypto) {
2626         return -EINVAL;
2627     }
2628
2629     ret = qcow2_update_header(bs);
2630     if (ret < 0) {
2631         error_setg_errno(errp, -ret, "Could not write encryption header");
2632         goto out;
2633     }
2634
2635     ret = 0;
2636  out:
2637     qcrypto_block_free(crypto);
2638     return ret;
2639 }
2640
2641 /**
2642  * Preallocates metadata structures for data clusters between @offset (in the
2643  * guest disk) and @new_length (which is thus generally the new guest disk
2644  * size).
2645  *
2646  * Returns: 0 on success, -errno on failure.
2647  */
2648 static int coroutine_fn preallocate_co(BlockDriverState *bs, uint64_t offset,
2649                                        uint64_t new_length)
2650 {
2651     uint64_t bytes;
2652     uint64_t host_offset = 0;
2653     unsigned int cur_bytes;
2654     int ret;
2655     QCowL2Meta *meta;
2656
2657     assert(offset <= new_length);
2658     bytes = new_length - offset;
2659
2660     while (bytes) {
2661         cur_bytes = MIN(bytes, INT_MAX);
2662         ret = qcow2_alloc_cluster_offset(bs, offset, &cur_bytes,
2663                                          &host_offset, &meta);
2664         if (ret < 0) {
2665             return ret;
2666         }
2667
2668         while (meta) {
2669             QCowL2Meta *next = meta->next;
2670
2671             ret = qcow2_alloc_cluster_link_l2(bs, meta);
2672             if (ret < 0) {
2673                 qcow2_free_any_clusters(bs, meta->alloc_offset,
2674                                         meta->nb_clusters, QCOW2_DISCARD_NEVER);
2675                 return ret;
2676             }
2677
2678             /* There are no dependent requests, but we need to remove our
2679              * request from the list of in-flight requests */
2680             QLIST_REMOVE(meta, next_in_flight);
2681
2682             g_free(meta);
2683             meta = next;
2684         }
2685
2686         /* TODO Preallocate data if requested */
2687
2688         bytes -= cur_bytes;
2689         offset += cur_bytes;
2690     }
2691
2692     /*
2693      * It is expected that the image file is large enough to actually contain
2694      * all of the allocated clusters (otherwise we get failing reads after
2695      * EOF). Extend the image to the last allocated sector.
2696      */
2697     if (host_offset != 0) {
2698         uint8_t data = 0;
2699         ret = bdrv_pwrite(bs->file, (host_offset + cur_bytes) - 1,
2700                           &data, 1);
2701         if (ret < 0) {
2702             return ret;
2703         }
2704     }
2705
2706     return 0;
2707 }
2708
2709 /* qcow2_refcount_metadata_size:
2710  * @clusters: number of clusters to refcount (including data and L1/L2 tables)
2711  * @cluster_size: size of a cluster, in bytes
2712  * @refcount_order: refcount bits power-of-2 exponent
2713  * @generous_increase: allow for the refcount table to be 1.5x as large as it
2714  *                     needs to be
2715  *
2716  * Returns: Number of bytes required for refcount blocks and table metadata.
2717  */
2718 int64_t qcow2_refcount_metadata_size(int64_t clusters, size_t cluster_size,
2719                                      int refcount_order, bool generous_increase,
2720                                      uint64_t *refblock_count)
2721 {
2722     /*
2723      * Every host cluster is reference-counted, including metadata (even
2724      * refcount metadata is recursively included).
2725      *
2726      * An accurate formula for the size of refcount metadata size is difficult
2727      * to derive.  An easier method of calculation is finding the fixed point
2728      * where no further refcount blocks or table clusters are required to
2729      * reference count every cluster.
2730      */
2731     int64_t blocks_per_table_cluster = cluster_size / sizeof(uint64_t);
2732     int64_t refcounts_per_block = cluster_size * 8 / (1 << refcount_order);
2733     int64_t table = 0;  /* number of refcount table clusters */
2734     int64_t blocks = 0; /* number of refcount block clusters */
2735     int64_t last;
2736     int64_t n = 0;
2737
2738     do {
2739         last = n;
2740         blocks = DIV_ROUND_UP(clusters + table + blocks, refcounts_per_block);
2741         table = DIV_ROUND_UP(blocks, blocks_per_table_cluster);
2742         n = clusters + blocks + table;
2743
2744         if (n == last && generous_increase) {
2745             clusters += DIV_ROUND_UP(table, 2);
2746             n = 0; /* force another loop */
2747             generous_increase = false;
2748         }
2749     } while (n != last);
2750
2751     if (refblock_count) {
2752         *refblock_count = blocks;
2753     }
2754
2755     return (blocks + table) * cluster_size;
2756 }
2757
2758 /**
2759  * qcow2_calc_prealloc_size:
2760  * @total_size: virtual disk size in bytes
2761  * @cluster_size: cluster size in bytes
2762  * @refcount_order: refcount bits power-of-2 exponent
2763  *
2764  * Returns: Total number of bytes required for the fully allocated image
2765  * (including metadata).
2766  */
2767 static int64_t qcow2_calc_prealloc_size(int64_t total_size,
2768                                         size_t cluster_size,
2769                                         int refcount_order)
2770 {
2771     int64_t meta_size = 0;
2772     uint64_t nl1e, nl2e;
2773     int64_t aligned_total_size = ROUND_UP(total_size, cluster_size);
2774
2775     /* header: 1 cluster */
2776     meta_size += cluster_size;
2777
2778     /* total size of L2 tables */
2779     nl2e = aligned_total_size / cluster_size;
2780     nl2e = ROUND_UP(nl2e, cluster_size / sizeof(uint64_t));
2781     meta_size += nl2e * sizeof(uint64_t);
2782
2783     /* total size of L1 tables */
2784     nl1e = nl2e * sizeof(uint64_t) / cluster_size;
2785     nl1e = ROUND_UP(nl1e, cluster_size / sizeof(uint64_t));
2786     meta_size += nl1e * sizeof(uint64_t);
2787
2788     /* total size of refcount table and blocks */
2789     meta_size += qcow2_refcount_metadata_size(
2790             (meta_size + aligned_total_size) / cluster_size,
2791             cluster_size, refcount_order, false, NULL);
2792
2793     return meta_size + aligned_total_size;
2794 }
2795
2796 static bool validate_cluster_size(size_t cluster_size, Error **errp)
2797 {
2798     int cluster_bits = ctz32(cluster_size);
2799     if (cluster_bits < MIN_CLUSTER_BITS || cluster_bits > MAX_CLUSTER_BITS ||
2800         (1 << cluster_bits) != cluster_size)
2801     {
2802         error_setg(errp, "Cluster size must be a power of two between %d and "
2803                    "%dk", 1 << MIN_CLUSTER_BITS, 1 << (MAX_CLUSTER_BITS - 10));
2804         return false;
2805     }
2806     return true;
2807 }
2808
2809 static size_t qcow2_opt_get_cluster_size_del(QemuOpts *opts, Error **errp)
2810 {
2811     size_t cluster_size;
2812
2813     cluster_size = qemu_opt_get_size_del(opts, BLOCK_OPT_CLUSTER_SIZE,
2814                                          DEFAULT_CLUSTER_SIZE);
2815     if (!validate_cluster_size(cluster_size, errp)) {
2816         return 0;
2817     }
2818     return cluster_size;
2819 }
2820
2821 static int qcow2_opt_get_version_del(QemuOpts *opts, Error **errp)
2822 {
2823     char *buf;
2824     int ret;
2825
2826     buf = qemu_opt_get_del(opts, BLOCK_OPT_COMPAT_LEVEL);
2827     if (!buf) {
2828         ret = 3; /* default */
2829     } else if (!strcmp(buf, "0.10")) {
2830         ret = 2;
2831     } else if (!strcmp(buf, "1.1")) {
2832         ret = 3;
2833     } else {
2834         error_setg(errp, "Invalid compatibility level: '%s'", buf);
2835         ret = -EINVAL;
2836     }
2837     g_free(buf);
2838     return ret;
2839 }
2840
2841 static uint64_t qcow2_opt_get_refcount_bits_del(QemuOpts *opts, int version,
2842                                                 Error **errp)
2843 {
2844     uint64_t refcount_bits;
2845
2846     refcount_bits = qemu_opt_get_number_del(opts, BLOCK_OPT_REFCOUNT_BITS, 16);
2847     if (refcount_bits > 64 || !is_power_of_2(refcount_bits)) {
2848         error_setg(errp, "Refcount width must be a power of two and may not "
2849                    "exceed 64 bits");
2850         return 0;
2851     }
2852
2853     if (version < 3 && refcount_bits != 16) {
2854         error_setg(errp, "Different refcount widths than 16 bits require "
2855                    "compatibility level 1.1 or above (use compat=1.1 or "
2856                    "greater)");
2857         return 0;
2858     }
2859
2860     return refcount_bits;
2861 }
2862
2863 static int coroutine_fn
2864 qcow2_co_create(BlockdevCreateOptions *create_options, Error **errp)
2865 {
2866     BlockdevCreateOptionsQcow2 *qcow2_opts;
2867     QDict *options;
2868
2869     /*
2870      * Open the image file and write a minimal qcow2 header.
2871      *
2872      * We keep things simple and start with a zero-sized image. We also
2873      * do without refcount blocks or a L1 table for now. We'll fix the
2874      * inconsistency later.
2875      *
2876      * We do need a refcount table because growing the refcount table means
2877      * allocating two new refcount blocks - the seconds of which would be at
2878      * 2 GB for 64k clusters, and we don't want to have a 2 GB initial file
2879      * size for any qcow2 image.
2880      */
2881     BlockBackend *blk = NULL;
2882     BlockDriverState *bs = NULL;
2883     BlockDriverState *data_bs = NULL;
2884     QCowHeader *header;
2885     size_t cluster_size;
2886     int version;
2887     int refcount_order;
2888     uint64_t* refcount_table;
2889     Error *local_err = NULL;
2890     int ret;
2891
2892     assert(create_options->driver == BLOCKDEV_DRIVER_QCOW2);
2893     qcow2_opts = &create_options->u.qcow2;
2894
2895     bs = bdrv_open_blockdev_ref(qcow2_opts->file, errp);
2896     if (bs == NULL) {
2897         return -EIO;
2898     }
2899
2900     /* Validate options and set default values */
2901     if (!QEMU_IS_ALIGNED(qcow2_opts->size, BDRV_SECTOR_SIZE)) {
2902         error_setg(errp, "Image size must be a multiple of 512 bytes");
2903         ret = -EINVAL;
2904         goto out;
2905     }
2906
2907     if (qcow2_opts->has_version) {
2908         switch (qcow2_opts->version) {
2909         case BLOCKDEV_QCOW2_VERSION_V2:
2910             version = 2;
2911             break;
2912         case BLOCKDEV_QCOW2_VERSION_V3:
2913             version = 3;
2914             break;
2915         default:
2916             g_assert_not_reached();
2917         }
2918     } else {
2919         version = 3;
2920     }
2921
2922     if (qcow2_opts->has_cluster_size) {
2923         cluster_size = qcow2_opts->cluster_size;
2924     } else {
2925         cluster_size = DEFAULT_CLUSTER_SIZE;
2926     }
2927
2928     if (!validate_cluster_size(cluster_size, errp)) {
2929         ret = -EINVAL;
2930         goto out;
2931     }
2932
2933     if (!qcow2_opts->has_preallocation) {
2934         qcow2_opts->preallocation = PREALLOC_MODE_OFF;
2935     }
2936     if (qcow2_opts->has_backing_file &&
2937         qcow2_opts->preallocation != PREALLOC_MODE_OFF)
2938     {
2939         error_setg(errp, "Backing file and preallocation cannot be used at "
2940                    "the same time");
2941         ret = -EINVAL;
2942         goto out;
2943     }
2944     if (qcow2_opts->has_backing_fmt && !qcow2_opts->has_backing_file) {
2945         error_setg(errp, "Backing format cannot be used without backing file");
2946         ret = -EINVAL;
2947         goto out;
2948     }
2949
2950     if (!qcow2_opts->has_lazy_refcounts) {
2951         qcow2_opts->lazy_refcounts = false;
2952     }
2953     if (version < 3 && qcow2_opts->lazy_refcounts) {
2954         error_setg(errp, "Lazy refcounts only supported with compatibility "
2955                    "level 1.1 and above (use version=v3 or greater)");
2956         ret = -EINVAL;
2957         goto out;
2958     }
2959
2960     if (!qcow2_opts->has_refcount_bits) {
2961         qcow2_opts->refcount_bits = 16;
2962     }
2963     if (qcow2_opts->refcount_bits > 64 ||
2964         !is_power_of_2(qcow2_opts->refcount_bits))
2965     {
2966         error_setg(errp, "Refcount width must be a power of two and may not "
2967                    "exceed 64 bits");
2968         ret = -EINVAL;
2969         goto out;
2970     }
2971     if (version < 3 && qcow2_opts->refcount_bits != 16) {
2972         error_setg(errp, "Different refcount widths than 16 bits require "
2973                    "compatibility level 1.1 or above (use version=v3 or "
2974                    "greater)");
2975         ret = -EINVAL;
2976         goto out;
2977     }
2978     refcount_order = ctz32(qcow2_opts->refcount_bits);
2979
2980     if (qcow2_opts->data_file) {
2981         if (version < 3) {
2982             error_setg(errp, "External data files are only supported with "
2983                        "compatibility level 1.1 and above (use version=v3 or "
2984                        "greater)");
2985             ret = -EINVAL;
2986             goto out;
2987         }
2988         data_bs = bdrv_open_blockdev_ref(qcow2_opts->data_file, errp);
2989         if (bs == NULL) {
2990             ret = -EIO;
2991             goto out;
2992         }
2993     }
2994
2995     /* Create BlockBackend to write to the image */
2996     blk = blk_new(BLK_PERM_WRITE | BLK_PERM_RESIZE, BLK_PERM_ALL);
2997     ret = blk_insert_bs(blk, bs, errp);
2998     if (ret < 0) {
2999         goto out;
3000     }
3001     blk_set_allow_write_beyond_eof(blk, true);
3002
3003     /* Clear the protocol layer and preallocate it if necessary */
3004     ret = blk_truncate(blk, 0, PREALLOC_MODE_OFF, errp);
3005     if (ret < 0) {
3006         goto out;
3007     }
3008
3009     /* Write the header */
3010     QEMU_BUILD_BUG_ON((1 << MIN_CLUSTER_BITS) < sizeof(*header));
3011     header = g_malloc0(cluster_size);
3012     *header = (QCowHeader) {
3013         .magic                      = cpu_to_be32(QCOW_MAGIC),
3014         .version                    = cpu_to_be32(version),
3015         .cluster_bits               = cpu_to_be32(ctz32(cluster_size)),
3016         .size                       = cpu_to_be64(0),
3017         .l1_table_offset            = cpu_to_be64(0),
3018         .l1_size                    = cpu_to_be32(0),
3019         .refcount_table_offset      = cpu_to_be64(cluster_size),
3020         .refcount_table_clusters    = cpu_to_be32(1),
3021         .refcount_order             = cpu_to_be32(refcount_order),
3022         .header_length              = cpu_to_be32(sizeof(*header)),
3023     };
3024
3025     /* We'll update this to correct value later */
3026     header->crypt_method = cpu_to_be32(QCOW_CRYPT_NONE);
3027
3028     if (qcow2_opts->lazy_refcounts) {
3029         header->compatible_features |=
3030             cpu_to_be64(QCOW2_COMPAT_LAZY_REFCOUNTS);
3031     }
3032     if (data_bs) {
3033         header->incompatible_features |=
3034             cpu_to_be64(QCOW2_INCOMPAT_DATA_FILE);
3035     }
3036
3037     ret = blk_pwrite(blk, 0, header, cluster_size, 0);
3038     g_free(header);
3039     if (ret < 0) {
3040         error_setg_errno(errp, -ret, "Could not write qcow2 header");
3041         goto out;
3042     }
3043
3044     /* Write a refcount table with one refcount block */
3045     refcount_table = g_malloc0(2 * cluster_size);
3046     refcount_table[0] = cpu_to_be64(2 * cluster_size);
3047     ret = blk_pwrite(blk, cluster_size, refcount_table, 2 * cluster_size, 0);
3048     g_free(refcount_table);
3049
3050     if (ret < 0) {
3051         error_setg_errno(errp, -ret, "Could not write refcount table");
3052         goto out;
3053     }
3054
3055     blk_unref(blk);
3056     blk = NULL;
3057
3058     /*
3059      * And now open the image and make it consistent first (i.e. increase the
3060      * refcount of the cluster that is occupied by the header and the refcount
3061      * table)
3062      */
3063     options = qdict_new();
3064     qdict_put_str(options, "driver", "qcow2");
3065     qdict_put_str(options, "file", bs->node_name);
3066     if (data_bs) {
3067         qdict_put_str(options, "data-file", data_bs->node_name);
3068     }
3069     blk = blk_new_open(NULL, NULL, options,
3070                        BDRV_O_RDWR | BDRV_O_RESIZE | BDRV_O_NO_FLUSH,
3071                        &local_err);
3072     if (blk == NULL) {
3073         error_propagate(errp, local_err);
3074         ret = -EIO;
3075         goto out;
3076     }
3077
3078     ret = qcow2_alloc_clusters(blk_bs(blk), 3 * cluster_size);
3079     if (ret < 0) {
3080         error_setg_errno(errp, -ret, "Could not allocate clusters for qcow2 "
3081                          "header and refcount table");
3082         goto out;
3083
3084     } else if (ret != 0) {
3085         error_report("Huh, first cluster in empty image is already in use?");
3086         abort();
3087     }
3088
3089     /* Create a full header (including things like feature table) */
3090     ret = qcow2_update_header(blk_bs(blk));
3091     if (ret < 0) {
3092         error_setg_errno(errp, -ret, "Could not update qcow2 header");
3093         goto out;
3094     }
3095
3096     /* Okay, now that we have a valid image, let's give it the right size */
3097     ret = blk_truncate(blk, qcow2_opts->size, qcow2_opts->preallocation, errp);
3098     if (ret < 0) {
3099         error_prepend(errp, "Could not resize image: ");
3100         goto out;
3101     }
3102
3103     /* Want a backing file? There you go.*/
3104     if (qcow2_opts->has_backing_file) {
3105         const char *backing_format = NULL;
3106
3107         if (qcow2_opts->has_backing_fmt) {
3108             backing_format = BlockdevDriver_str(qcow2_opts->backing_fmt);
3109         }
3110
3111         ret = bdrv_change_backing_file(blk_bs(blk), qcow2_opts->backing_file,
3112                                        backing_format);
3113         if (ret < 0) {
3114             error_setg_errno(errp, -ret, "Could not assign backing file '%s' "
3115                              "with format '%s'", qcow2_opts->backing_file,
3116                              backing_format);
3117             goto out;
3118         }
3119     }
3120
3121     /* Want encryption? There you go. */
3122     if (qcow2_opts->has_encrypt) {
3123         ret = qcow2_set_up_encryption(blk_bs(blk), qcow2_opts->encrypt, errp);
3124         if (ret < 0) {
3125             goto out;
3126         }
3127     }
3128
3129     blk_unref(blk);
3130     blk = NULL;
3131
3132     /* Reopen the image without BDRV_O_NO_FLUSH to flush it before returning.
3133      * Using BDRV_O_NO_IO, since encryption is now setup we don't want to
3134      * have to setup decryption context. We're not doing any I/O on the top
3135      * level BlockDriverState, only lower layers, where BDRV_O_NO_IO does
3136      * not have effect.
3137      */
3138     options = qdict_new();
3139     qdict_put_str(options, "driver", "qcow2");
3140     qdict_put_str(options, "file", bs->node_name);
3141     if (data_bs) {
3142         qdict_put_str(options, "data-file", data_bs->node_name);
3143     }
3144     blk = blk_new_open(NULL, NULL, options,
3145                        BDRV_O_RDWR | BDRV_O_NO_BACKING | BDRV_O_NO_IO,
3146                        &local_err);
3147     if (blk == NULL) {
3148         error_propagate(errp, local_err);
3149         ret = -EIO;
3150         goto out;
3151     }
3152
3153     ret = 0;
3154 out:
3155     blk_unref(blk);
3156     bdrv_unref(bs);
3157     bdrv_unref(data_bs);
3158     return ret;
3159 }
3160
3161 static int coroutine_fn qcow2_co_create_opts(const char *filename, QemuOpts *opts,
3162                                              Error **errp)
3163 {
3164     BlockdevCreateOptions *create_options = NULL;
3165     QDict *qdict;
3166     Visitor *v;
3167     BlockDriverState *bs = NULL;
3168     Error *local_err = NULL;
3169     const char *val;
3170     int ret;
3171
3172     /* Only the keyval visitor supports the dotted syntax needed for
3173      * encryption, so go through a QDict before getting a QAPI type. Ignore
3174      * options meant for the protocol layer so that the visitor doesn't
3175      * complain. */
3176     qdict = qemu_opts_to_qdict_filtered(opts, NULL, bdrv_qcow2.create_opts,
3177                                         true);
3178
3179     /* Handle encryption options */
3180     val = qdict_get_try_str(qdict, BLOCK_OPT_ENCRYPT);
3181     if (val && !strcmp(val, "on")) {
3182         qdict_put_str(qdict, BLOCK_OPT_ENCRYPT, "qcow");
3183     } else if (val && !strcmp(val, "off")) {
3184         qdict_del(qdict, BLOCK_OPT_ENCRYPT);
3185     }
3186
3187     val = qdict_get_try_str(qdict, BLOCK_OPT_ENCRYPT_FORMAT);
3188     if (val && !strcmp(val, "aes")) {
3189         qdict_put_str(qdict, BLOCK_OPT_ENCRYPT_FORMAT, "qcow");
3190     }
3191
3192     /* Convert compat=0.10/1.1 into compat=v2/v3, to be renamed into
3193      * version=v2/v3 below. */
3194     val = qdict_get_try_str(qdict, BLOCK_OPT_COMPAT_LEVEL);
3195     if (val && !strcmp(val, "0.10")) {
3196         qdict_put_str(qdict, BLOCK_OPT_COMPAT_LEVEL, "v2");
3197     } else if (val && !strcmp(val, "1.1")) {
3198         qdict_put_str(qdict, BLOCK_OPT_COMPAT_LEVEL, "v3");
3199     }
3200
3201     /* Change legacy command line options into QMP ones */
3202     static const QDictRenames opt_renames[] = {
3203         { BLOCK_OPT_BACKING_FILE,       "backing-file" },
3204         { BLOCK_OPT_BACKING_FMT,        "backing-fmt" },
3205         { BLOCK_OPT_CLUSTER_SIZE,       "cluster-size" },
3206         { BLOCK_OPT_LAZY_REFCOUNTS,     "lazy-refcounts" },
3207         { BLOCK_OPT_REFCOUNT_BITS,      "refcount-bits" },
3208         { BLOCK_OPT_ENCRYPT,            BLOCK_OPT_ENCRYPT_FORMAT },
3209         { BLOCK_OPT_COMPAT_LEVEL,       "version" },
3210         { NULL, NULL },
3211     };
3212
3213     if (!qdict_rename_keys(qdict, opt_renames, errp)) {
3214         ret = -EINVAL;
3215         goto finish;
3216     }
3217
3218     /* Create and open the file (protocol layer) */
3219     ret = bdrv_create_file(filename, opts, errp);
3220     if (ret < 0) {
3221         goto finish;
3222     }
3223
3224     bs = bdrv_open(filename, NULL, NULL,
3225                    BDRV_O_RDWR | BDRV_O_RESIZE | BDRV_O_PROTOCOL, errp);
3226     if (bs == NULL) {
3227         ret = -EIO;
3228         goto finish;
3229     }
3230
3231     /* Set 'driver' and 'node' options */
3232     qdict_put_str(qdict, "driver", "qcow2");
3233     qdict_put_str(qdict, "file", bs->node_name);
3234
3235     /* Now get the QAPI type BlockdevCreateOptions */
3236     v = qobject_input_visitor_new_flat_confused(qdict, errp);
3237     if (!v) {
3238         ret = -EINVAL;
3239         goto finish;
3240     }
3241
3242     visit_type_BlockdevCreateOptions(v, NULL, &create_options, &local_err);
3243     visit_free(v);
3244
3245     if (local_err) {
3246         error_propagate(errp, local_err);
3247         ret = -EINVAL;
3248         goto finish;
3249     }
3250
3251     /* Silently round up size */
3252     create_options->u.qcow2.size = ROUND_UP(create_options->u.qcow2.size,
3253                                             BDRV_SECTOR_SIZE);
3254
3255     /* Create the qcow2 image (format layer) */
3256     ret = qcow2_co_create(create_options, errp);
3257     if (ret < 0) {
3258         goto finish;
3259     }
3260
3261     ret = 0;
3262 finish:
3263     qobject_unref(qdict);
3264     bdrv_unref(bs);
3265     qapi_free_BlockdevCreateOptions(create_options);
3266     return ret;
3267 }
3268
3269
3270 static bool is_zero(BlockDriverState *bs, int64_t offset, int64_t bytes)
3271 {
3272     int64_t nr;
3273     int res;
3274
3275     /* Clamp to image length, before checking status of underlying sectors */
3276     if (offset + bytes > bs->total_sectors * BDRV_SECTOR_SIZE) {
3277         bytes = bs->total_sectors * BDRV_SECTOR_SIZE - offset;
3278     }
3279
3280     if (!bytes) {
3281         return true;
3282     }
3283     res = bdrv_block_status_above(bs, NULL, offset, bytes, &nr, NULL, NULL);
3284     return res >= 0 && (res & BDRV_BLOCK_ZERO) && nr == bytes;
3285 }
3286
3287 static coroutine_fn int qcow2_co_pwrite_zeroes(BlockDriverState *bs,
3288     int64_t offset, int bytes, BdrvRequestFlags flags)
3289 {
3290     int ret;
3291     BDRVQcow2State *s = bs->opaque;
3292
3293     uint32_t head = offset % s->cluster_size;
3294     uint32_t tail = (offset + bytes) % s->cluster_size;
3295
3296     trace_qcow2_pwrite_zeroes_start_req(qemu_coroutine_self(), offset, bytes);
3297     if (offset + bytes == bs->total_sectors * BDRV_SECTOR_SIZE) {
3298         tail = 0;
3299     }
3300
3301     if (head || tail) {
3302         uint64_t off;
3303         unsigned int nr;
3304
3305         assert(head + bytes <= s->cluster_size);
3306
3307         /* check whether remainder of cluster already reads as zero */
3308         if (!(is_zero(bs, offset - head, head) &&
3309               is_zero(bs, offset + bytes,
3310                       tail ? s->cluster_size - tail : 0))) {
3311             return -ENOTSUP;
3312         }
3313
3314         qemu_co_mutex_lock(&s->lock);
3315         /* We can have new write after previous check */
3316         offset = QEMU_ALIGN_DOWN(offset, s->cluster_size);
3317         bytes = s->cluster_size;
3318         nr = s->cluster_size;
3319         ret = qcow2_get_cluster_offset(bs, offset, &nr, &off);
3320         if (ret != QCOW2_CLUSTER_UNALLOCATED &&
3321             ret != QCOW2_CLUSTER_ZERO_PLAIN &&
3322             ret != QCOW2_CLUSTER_ZERO_ALLOC) {
3323             qemu_co_mutex_unlock(&s->lock);
3324             return -ENOTSUP;
3325         }
3326     } else {
3327         qemu_co_mutex_lock(&s->lock);
3328     }
3329
3330     trace_qcow2_pwrite_zeroes(qemu_coroutine_self(), offset, bytes);
3331
3332     /* Whatever is left can use real zero clusters */
3333     ret = qcow2_cluster_zeroize(bs, offset, bytes, flags);
3334     qemu_co_mutex_unlock(&s->lock);
3335
3336     return ret;
3337 }
3338
3339 static coroutine_fn int qcow2_co_pdiscard(BlockDriverState *bs,
3340                                           int64_t offset, int bytes)
3341 {
3342     int ret;
3343     BDRVQcow2State *s = bs->opaque;
3344
3345     if (!QEMU_IS_ALIGNED(offset | bytes, s->cluster_size)) {
3346         assert(bytes < s->cluster_size);
3347         /* Ignore partial clusters, except for the special case of the
3348          * complete partial cluster at the end of an unaligned file */
3349         if (!QEMU_IS_ALIGNED(offset, s->cluster_size) ||
3350             offset + bytes != bs->total_sectors * BDRV_SECTOR_SIZE) {
3351             return -ENOTSUP;
3352         }
3353     }
3354
3355     qemu_co_mutex_lock(&s->lock);
3356     ret = qcow2_cluster_discard(bs, offset, bytes, QCOW2_DISCARD_REQUEST,
3357                                 false);
3358     qemu_co_mutex_unlock(&s->lock);
3359     return ret;
3360 }
3361
3362 static int coroutine_fn
3363 qcow2_co_copy_range_from(BlockDriverState *bs,
3364                          BdrvChild *src, uint64_t src_offset,
3365                          BdrvChild *dst, uint64_t dst_offset,
3366                          uint64_t bytes, BdrvRequestFlags read_flags,
3367                          BdrvRequestFlags write_flags)
3368 {
3369     BDRVQcow2State *s = bs->opaque;
3370     int ret;
3371     unsigned int cur_bytes; /* number of bytes in current iteration */
3372     BdrvChild *child = NULL;
3373     BdrvRequestFlags cur_write_flags;
3374
3375     assert(!bs->encrypted);
3376     qemu_co_mutex_lock(&s->lock);
3377
3378     while (bytes != 0) {
3379         uint64_t copy_offset = 0;
3380         /* prepare next request */
3381         cur_bytes = MIN(bytes, INT_MAX);
3382         cur_write_flags = write_flags;
3383
3384         ret = qcow2_get_cluster_offset(bs, src_offset, &cur_bytes, &copy_offset);
3385         if (ret < 0) {
3386             goto out;
3387         }
3388
3389         switch (ret) {
3390         case QCOW2_CLUSTER_UNALLOCATED:
3391             if (bs->backing && bs->backing->bs) {
3392                 int64_t backing_length = bdrv_getlength(bs->backing->bs);
3393                 if (src_offset >= backing_length) {
3394                     cur_write_flags |= BDRV_REQ_ZERO_WRITE;
3395                 } else {
3396                     child = bs->backing;
3397                     cur_bytes = MIN(cur_bytes, backing_length - src_offset);
3398                     copy_offset = src_offset;
3399                 }
3400             } else {
3401                 cur_write_flags |= BDRV_REQ_ZERO_WRITE;
3402             }
3403             break;
3404
3405         case QCOW2_CLUSTER_ZERO_PLAIN:
3406         case QCOW2_CLUSTER_ZERO_ALLOC:
3407             cur_write_flags |= BDRV_REQ_ZERO_WRITE;
3408             break;
3409
3410         case QCOW2_CLUSTER_COMPRESSED:
3411             ret = -ENOTSUP;
3412             goto out;
3413
3414         case QCOW2_CLUSTER_NORMAL:
3415             child = s->data_file;
3416             copy_offset += offset_into_cluster(s, src_offset);
3417             if ((copy_offset & 511) != 0) {
3418                 ret = -EIO;
3419                 goto out;
3420             }
3421             break;
3422
3423         default:
3424             abort();
3425         }
3426         qemu_co_mutex_unlock(&s->lock);
3427         ret = bdrv_co_copy_range_from(child,
3428                                       copy_offset,
3429                                       dst, dst_offset,
3430                                       cur_bytes, read_flags, cur_write_flags);
3431         qemu_co_mutex_lock(&s->lock);
3432         if (ret < 0) {
3433             goto out;
3434         }
3435
3436         bytes -= cur_bytes;
3437         src_offset += cur_bytes;
3438         dst_offset += cur_bytes;
3439     }
3440     ret = 0;
3441
3442 out:
3443     qemu_co_mutex_unlock(&s->lock);
3444     return ret;
3445 }
3446
3447 static int coroutine_fn
3448 qcow2_co_copy_range_to(BlockDriverState *bs,
3449                        BdrvChild *src, uint64_t src_offset,
3450                        BdrvChild *dst, uint64_t dst_offset,
3451                        uint64_t bytes, BdrvRequestFlags read_flags,
3452                        BdrvRequestFlags write_flags)
3453 {
3454     BDRVQcow2State *s = bs->opaque;
3455     int offset_in_cluster;
3456     int ret;
3457     unsigned int cur_bytes; /* number of sectors in current iteration */
3458     uint64_t cluster_offset;
3459     QCowL2Meta *l2meta = NULL;
3460
3461     assert(!bs->encrypted);
3462
3463     qemu_co_mutex_lock(&s->lock);
3464
3465     while (bytes != 0) {
3466
3467         l2meta = NULL;
3468
3469         offset_in_cluster = offset_into_cluster(s, dst_offset);
3470         cur_bytes = MIN(bytes, INT_MAX);
3471
3472         /* TODO:
3473          * If src->bs == dst->bs, we could simply copy by incrementing
3474          * the refcnt, without copying user data.
3475          * Or if src->bs == dst->bs->backing->bs, we could copy by discarding. */
3476         ret = qcow2_alloc_cluster_offset(bs, dst_offset, &cur_bytes,
3477                                          &cluster_offset, &l2meta);
3478         if (ret < 0) {
3479             goto fail;
3480         }
3481
3482         assert((cluster_offset & 511) == 0);
3483
3484         ret = qcow2_pre_write_overlap_check(bs, 0,
3485                 cluster_offset + offset_in_cluster, cur_bytes, true);
3486         if (ret < 0) {
3487             goto fail;
3488         }
3489
3490         qemu_co_mutex_unlock(&s->lock);
3491         ret = bdrv_co_copy_range_to(src, src_offset,
3492                                     s->data_file,
3493                                     cluster_offset + offset_in_cluster,
3494                                     cur_bytes, read_flags, write_flags);
3495         qemu_co_mutex_lock(&s->lock);
3496         if (ret < 0) {
3497             goto fail;
3498         }
3499
3500         ret = qcow2_handle_l2meta(bs, &l2meta, true);
3501         if (ret) {
3502             goto fail;
3503         }
3504
3505         bytes -= cur_bytes;
3506         src_offset += cur_bytes;
3507         dst_offset += cur_bytes;
3508     }
3509     ret = 0;
3510
3511 fail:
3512     qcow2_handle_l2meta(bs, &l2meta, false);
3513
3514     qemu_co_mutex_unlock(&s->lock);
3515
3516     trace_qcow2_writev_done_req(qemu_coroutine_self(), ret);
3517
3518     return ret;
3519 }
3520
3521 static int coroutine_fn qcow2_co_truncate(BlockDriverState *bs, int64_t offset,
3522                                           PreallocMode prealloc, Error **errp)
3523 {
3524     BDRVQcow2State *s = bs->opaque;
3525     uint64_t old_length;
3526     int64_t new_l1_size;
3527     int ret;
3528     QDict *options;
3529
3530     if (prealloc != PREALLOC_MODE_OFF && prealloc != PREALLOC_MODE_METADATA &&
3531         prealloc != PREALLOC_MODE_FALLOC && prealloc != PREALLOC_MODE_FULL)
3532     {
3533         error_setg(errp, "Unsupported preallocation mode '%s'",
3534                    PreallocMode_str(prealloc));
3535         return -ENOTSUP;
3536     }
3537
3538     if (offset & 511) {
3539         error_setg(errp, "The new size must be a multiple of 512");
3540         return -EINVAL;
3541     }
3542
3543     qemu_co_mutex_lock(&s->lock);
3544
3545     /* cannot proceed if image has snapshots */
3546     if (s->nb_snapshots) {
3547         error_setg(errp, "Can't resize an image which has snapshots");
3548         ret = -ENOTSUP;
3549         goto fail;
3550     }
3551
3552     /* cannot proceed if image has bitmaps */
3553     if (s->nb_bitmaps) {
3554         /* TODO: resize bitmaps in the image */
3555         error_setg(errp, "Can't resize an image which has bitmaps");
3556         ret = -ENOTSUP;
3557         goto fail;
3558     }
3559
3560     old_length = bs->total_sectors * BDRV_SECTOR_SIZE;
3561     new_l1_size = size_to_l1(s, offset);
3562
3563     if (offset < old_length) {
3564         int64_t last_cluster, old_file_size;
3565         if (prealloc != PREALLOC_MODE_OFF) {
3566             error_setg(errp,
3567                        "Preallocation can't be used for shrinking an image");
3568             ret = -EINVAL;
3569             goto fail;
3570         }
3571
3572         ret = qcow2_cluster_discard(bs, ROUND_UP(offset, s->cluster_size),
3573                                     old_length - ROUND_UP(offset,
3574                                                           s->cluster_size),
3575                                     QCOW2_DISCARD_ALWAYS, true);
3576         if (ret < 0) {
3577             error_setg_errno(errp, -ret, "Failed to discard cropped clusters");
3578             goto fail;
3579         }
3580
3581         ret = qcow2_shrink_l1_table(bs, new_l1_size);
3582         if (ret < 0) {
3583             error_setg_errno(errp, -ret,
3584                              "Failed to reduce the number of L2 tables");
3585             goto fail;
3586         }
3587
3588         ret = qcow2_shrink_reftable(bs);
3589         if (ret < 0) {
3590             error_setg_errno(errp, -ret,
3591                              "Failed to discard unused refblocks");
3592             goto fail;
3593         }
3594
3595         old_file_size = bdrv_getlength(bs->file->bs);
3596         if (old_file_size < 0) {
3597             error_setg_errno(errp, -old_file_size,
3598                              "Failed to inquire current file length");
3599             ret = old_file_size;
3600             goto fail;
3601         }
3602         last_cluster = qcow2_get_last_cluster(bs, old_file_size);
3603         if (last_cluster < 0) {
3604             error_setg_errno(errp, -last_cluster,
3605                              "Failed to find the last cluster");
3606             ret = last_cluster;
3607             goto fail;
3608         }
3609         if ((last_cluster + 1) * s->cluster_size < old_file_size) {
3610             Error *local_err = NULL;
3611
3612             bdrv_co_truncate(bs->file, (last_cluster + 1) * s->cluster_size,
3613                              PREALLOC_MODE_OFF, &local_err);
3614             if (local_err) {
3615                 warn_reportf_err(local_err,
3616                                  "Failed to truncate the tail of the image: ");
3617             }
3618         }
3619     } else {
3620         ret = qcow2_grow_l1_table(bs, new_l1_size, true);
3621         if (ret < 0) {
3622             error_setg_errno(errp, -ret, "Failed to grow the L1 table");
3623             goto fail;
3624         }
3625     }
3626
3627     switch (prealloc) {
3628     case PREALLOC_MODE_OFF:
3629         break;
3630
3631     case PREALLOC_MODE_METADATA:
3632         ret = preallocate_co(bs, old_length, offset);
3633         if (ret < 0) {
3634             error_setg_errno(errp, -ret, "Preallocation failed");
3635             goto fail;
3636         }
3637         break;
3638
3639     case PREALLOC_MODE_FALLOC:
3640     case PREALLOC_MODE_FULL:
3641     {
3642         int64_t allocation_start, host_offset, guest_offset;
3643         int64_t clusters_allocated;
3644         int64_t old_file_size, new_file_size;
3645         uint64_t nb_new_data_clusters, nb_new_l2_tables;
3646
3647         /* With a data file, preallocation means just allocating the metadata
3648          * and forwarding the truncate request to the data file */
3649         if (has_data_file(bs)) {
3650             ret = preallocate_co(bs, old_length, offset);
3651             if (ret < 0) {
3652                 error_setg_errno(errp, -ret, "Preallocation failed");
3653                 goto fail;
3654             }
3655             break;
3656         }
3657
3658         old_file_size = bdrv_getlength(bs->file->bs);
3659         if (old_file_size < 0) {
3660             error_setg_errno(errp, -old_file_size,
3661                              "Failed to inquire current file length");
3662             ret = old_file_size;
3663             goto fail;
3664         }
3665         old_file_size = ROUND_UP(old_file_size, s->cluster_size);
3666
3667         nb_new_data_clusters = DIV_ROUND_UP(offset - old_length,
3668                                             s->cluster_size);
3669
3670         /* This is an overestimation; we will not actually allocate space for
3671          * these in the file but just make sure the new refcount structures are
3672          * able to cover them so we will not have to allocate new refblocks
3673          * while entering the data blocks in the potentially new L2 tables.
3674          * (We do not actually care where the L2 tables are placed. Maybe they
3675          *  are already allocated or they can be placed somewhere before
3676          *  @old_file_size. It does not matter because they will be fully
3677          *  allocated automatically, so they do not need to be covered by the
3678          *  preallocation. All that matters is that we will not have to allocate
3679          *  new refcount structures for them.) */
3680         nb_new_l2_tables = DIV_ROUND_UP(nb_new_data_clusters,
3681                                         s->cluster_size / sizeof(uint64_t));
3682         /* The cluster range may not be aligned to L2 boundaries, so add one L2
3683          * table for a potential head/tail */
3684         nb_new_l2_tables++;
3685
3686         allocation_start = qcow2_refcount_area(bs, old_file_size,
3687                                                nb_new_data_clusters +
3688                                                nb_new_l2_tables,
3689                                                true, 0, 0);
3690         if (allocation_start < 0) {
3691             error_setg_errno(errp, -allocation_start,
3692                              "Failed to resize refcount structures");
3693             ret = allocation_start;
3694             goto fail;
3695         }
3696
3697         clusters_allocated = qcow2_alloc_clusters_at(bs, allocation_start,
3698                                                      nb_new_data_clusters);
3699         if (clusters_allocated < 0) {
3700             error_setg_errno(errp, -clusters_allocated,
3701                              "Failed to allocate data clusters");
3702             ret = clusters_allocated;
3703             goto fail;
3704         }
3705
3706         assert(clusters_allocated == nb_new_data_clusters);
3707
3708         /* Allocate the data area */
3709         new_file_size = allocation_start +
3710                         nb_new_data_clusters * s->cluster_size;
3711         ret = bdrv_co_truncate(bs->file, new_file_size, prealloc, errp);
3712         if (ret < 0) {
3713             error_prepend(errp, "Failed to resize underlying file: ");
3714             qcow2_free_clusters(bs, allocation_start,
3715                                 nb_new_data_clusters * s->cluster_size,
3716                                 QCOW2_DISCARD_OTHER);
3717             goto fail;
3718         }
3719
3720         /* Create the necessary L2 entries */
3721         host_offset = allocation_start;
3722         guest_offset = old_length;
3723         while (nb_new_data_clusters) {
3724             int64_t nb_clusters = MIN(
3725                 nb_new_data_clusters,
3726                 s->l2_slice_size - offset_to_l2_slice_index(s, guest_offset));
3727             QCowL2Meta allocation = {
3728                 .offset       = guest_offset,
3729                 .alloc_offset = host_offset,
3730                 .nb_clusters  = nb_clusters,
3731             };
3732             qemu_co_queue_init(&allocation.dependent_requests);
3733
3734             ret = qcow2_alloc_cluster_link_l2(bs, &allocation);
3735             if (ret < 0) {
3736                 error_setg_errno(errp, -ret, "Failed to update L2 tables");
3737                 qcow2_free_clusters(bs, host_offset,
3738                                     nb_new_data_clusters * s->cluster_size,
3739                                     QCOW2_DISCARD_OTHER);
3740                 goto fail;
3741             }
3742
3743             guest_offset += nb_clusters * s->cluster_size;
3744             host_offset += nb_clusters * s->cluster_size;
3745             nb_new_data_clusters -= nb_clusters;
3746         }
3747         break;
3748     }
3749
3750     default:
3751         g_assert_not_reached();
3752     }
3753
3754     if (prealloc != PREALLOC_MODE_OFF) {
3755         /* Flush metadata before actually changing the image size */
3756         ret = qcow2_write_caches(bs);
3757         if (ret < 0) {
3758             error_setg_errno(errp, -ret,
3759                              "Failed to flush the preallocated area to disk");
3760             goto fail;
3761         }
3762     }
3763
3764     bs->total_sectors = offset / BDRV_SECTOR_SIZE;
3765
3766     if (has_data_file(bs)) {
3767         if (prealloc == PREALLOC_MODE_METADATA) {
3768             prealloc = PREALLOC_MODE_OFF;
3769         }
3770         ret = bdrv_co_truncate(s->data_file, offset, prealloc, errp);
3771         if (ret < 0) {
3772             goto fail;
3773         }
3774     }
3775
3776     /* write updated header.size */
3777     offset = cpu_to_be64(offset);
3778     ret = bdrv_pwrite_sync(bs->file, offsetof(QCowHeader, size),
3779                            &offset, sizeof(uint64_t));
3780     if (ret < 0) {
3781         error_setg_errno(errp, -ret, "Failed to update the image size");
3782         goto fail;
3783     }
3784
3785     s->l1_vm_state_index = new_l1_size;
3786
3787     /* Update cache sizes */
3788     options = qdict_clone_shallow(bs->options);
3789     ret = qcow2_update_options(bs, options, s->flags, errp);
3790     qobject_unref(options);
3791     if (ret < 0) {
3792         goto fail;
3793     }
3794     ret = 0;
3795 fail:
3796     qemu_co_mutex_unlock(&s->lock);
3797     return ret;
3798 }
3799
3800 /*
3801  * qcow2_compress()
3802  *
3803  * @dest - destination buffer, @dest_size bytes
3804  * @src - source buffer, @src_size bytes
3805  *
3806  * Returns: compressed size on success
3807  *          -1 destination buffer is not enough to store compressed data
3808  *          -2 on any other error
3809  */
3810 static ssize_t qcow2_compress(void *dest, size_t dest_size,
3811                               const void *src, size_t src_size)
3812 {
3813     ssize_t ret;
3814     z_stream strm;
3815
3816     /* best compression, small window, no zlib header */
3817     memset(&strm, 0, sizeof(strm));
3818     ret = deflateInit2(&strm, Z_DEFAULT_COMPRESSION, Z_DEFLATED,
3819                        -12, 9, Z_DEFAULT_STRATEGY);
3820     if (ret != Z_OK) {
3821         return -2;
3822     }
3823
3824     /* strm.next_in is not const in old zlib versions, such as those used on
3825      * OpenBSD/NetBSD, so cast the const away */
3826     strm.avail_in = src_size;
3827     strm.next_in = (void *) src;
3828     strm.avail_out = dest_size;
3829     strm.next_out = dest;
3830
3831     ret = deflate(&strm, Z_FINISH);
3832     if (ret == Z_STREAM_END) {
3833         ret = dest_size - strm.avail_out;
3834     } else {
3835         ret = (ret == Z_OK ? -1 : -2);
3836     }
3837
3838     deflateEnd(&strm);
3839
3840     return ret;
3841 }
3842
3843 /*
3844  * qcow2_decompress()
3845  *
3846  * Decompress some data (not more than @src_size bytes) to produce exactly
3847  * @dest_size bytes.
3848  *
3849  * @dest - destination buffer, @dest_size bytes
3850  * @src - source buffer, @src_size bytes
3851  *
3852  * Returns: 0 on success
3853  *          -1 on fail
3854  */
3855 static ssize_t qcow2_decompress(void *dest, size_t dest_size,
3856                                 const void *src, size_t src_size)
3857 {
3858     int ret = 0;
3859     z_stream strm;
3860
3861     memset(&strm, 0, sizeof(strm));
3862     strm.avail_in = src_size;
3863     strm.next_in = (void *) src;
3864     strm.avail_out = dest_size;
3865     strm.next_out = dest;
3866
3867     ret = inflateInit2(&strm, -12);
3868     if (ret != Z_OK) {
3869         return -1;
3870     }
3871
3872     ret = inflate(&strm, Z_FINISH);
3873     if ((ret != Z_STREAM_END && ret != Z_BUF_ERROR) || strm.avail_out != 0) {
3874         /* We approve Z_BUF_ERROR because we need @dest buffer to be filled, but
3875          * @src buffer may be processed partly (because in qcow2 we know size of
3876          * compressed data with precision of one sector) */
3877         ret = -1;
3878     }
3879
3880     inflateEnd(&strm);
3881
3882     return ret;
3883 }
3884
3885 #define MAX_COMPRESS_THREADS 4
3886
3887 typedef ssize_t (*Qcow2CompressFunc)(void *dest, size_t dest_size,
3888                                      const void *src, size_t src_size);
3889 typedef struct Qcow2CompressData {
3890     void *dest;
3891     size_t dest_size;
3892     const void *src;
3893     size_t src_size;
3894     ssize_t ret;
3895
3896     Qcow2CompressFunc func;
3897 } Qcow2CompressData;
3898
3899 static int qcow2_compress_pool_func(void *opaque)
3900 {
3901     Qcow2CompressData *data = opaque;
3902
3903     data->ret = data->func(data->dest, data->dest_size,
3904                            data->src, data->src_size);
3905
3906     return 0;
3907 }
3908
3909 static void qcow2_compress_complete(void *opaque, int ret)
3910 {
3911     qemu_coroutine_enter(opaque);
3912 }
3913
3914 static ssize_t coroutine_fn
3915 qcow2_co_do_compress(BlockDriverState *bs, void *dest, size_t dest_size,
3916                      const void *src, size_t src_size, Qcow2CompressFunc func)
3917 {
3918     BDRVQcow2State *s = bs->opaque;
3919     BlockAIOCB *acb;
3920     ThreadPool *pool = aio_get_thread_pool(bdrv_get_aio_context(bs));
3921     Qcow2CompressData arg = {
3922         .dest = dest,
3923         .dest_size = dest_size,
3924         .src = src,
3925         .src_size = src_size,
3926         .func = func,
3927     };
3928
3929     while (s->nb_compress_threads >= MAX_COMPRESS_THREADS) {
3930         qemu_co_queue_wait(&s->compress_wait_queue, NULL);
3931     }
3932
3933     s->nb_compress_threads++;
3934     acb = thread_pool_submit_aio(pool, qcow2_compress_pool_func, &arg,
3935                                  qcow2_compress_complete,
3936                                  qemu_coroutine_self());
3937
3938     if (!acb) {
3939         s->nb_compress_threads--;
3940         return -EINVAL;
3941     }
3942     qemu_coroutine_yield();
3943     s->nb_compress_threads--;
3944     qemu_co_queue_next(&s->compress_wait_queue);
3945
3946     return arg.ret;
3947 }
3948
3949 static ssize_t coroutine_fn
3950 qcow2_co_compress(BlockDriverState *bs, void *dest, size_t dest_size,
3951                   const void *src, size_t src_size)
3952 {
3953     return qcow2_co_do_compress(bs, dest, dest_size, src, src_size,
3954                                 qcow2_compress);
3955 }
3956
3957 static ssize_t coroutine_fn
3958 qcow2_co_decompress(BlockDriverState *bs, void *dest, size_t dest_size,
3959                     const void *src, size_t src_size)
3960 {
3961     return qcow2_co_do_compress(bs, dest, dest_size, src, src_size,
3962                                 qcow2_decompress);
3963 }
3964
3965 /* XXX: put compressed sectors first, then all the cluster aligned
3966    tables to avoid losing bytes in alignment */
3967 static coroutine_fn int
3968 qcow2_co_pwritev_compressed(BlockDriverState *bs, uint64_t offset,
3969                             uint64_t bytes, QEMUIOVector *qiov)
3970 {
3971     BDRVQcow2State *s = bs->opaque;
3972     QEMUIOVector hd_qiov;
3973     int ret;
3974     size_t out_len;
3975     uint8_t *buf, *out_buf;
3976     uint64_t cluster_offset;
3977
3978     if (has_data_file(bs)) {
3979         return -ENOTSUP;
3980     }
3981
3982     if (bytes == 0) {
3983         /* align end of file to a sector boundary to ease reading with
3984            sector based I/Os */
3985         int64_t len = bdrv_getlength(bs->file->bs);
3986         if (len < 0) {
3987             return len;
3988         }
3989         return bdrv_co_truncate(bs->file, len, PREALLOC_MODE_OFF, NULL);
3990     }
3991
3992     if (offset_into_cluster(s, offset)) {
3993         return -EINVAL;
3994     }
3995
3996     buf = qemu_blockalign(bs, s->cluster_size);
3997     if (bytes != s->cluster_size) {
3998         if (bytes > s->cluster_size ||
3999             offset + bytes != bs->total_sectors << BDRV_SECTOR_BITS)
4000         {
4001             qemu_vfree(buf);
4002             return -EINVAL;
4003         }
4004         /* Zero-pad last write if image size is not cluster aligned */
4005         memset(buf + bytes, 0, s->cluster_size - bytes);
4006     }
4007     qemu_iovec_to_buf(qiov, 0, buf, bytes);
4008
4009     out_buf = g_malloc(s->cluster_size);
4010
4011     out_len = qcow2_co_compress(bs, out_buf, s->cluster_size - 1,
4012                                 buf, s->cluster_size);
4013     if (out_len == -2) {
4014         ret = -EINVAL;
4015         goto fail;
4016     } else if (out_len == -1) {
4017         /* could not compress: write normal cluster */
4018         ret = qcow2_co_pwritev(bs, offset, bytes, qiov, 0);
4019         if (ret < 0) {
4020             goto fail;
4021         }
4022         goto success;
4023     }
4024
4025     qemu_co_mutex_lock(&s->lock);
4026     ret = qcow2_alloc_compressed_cluster_offset(bs, offset, out_len,
4027                                                 &cluster_offset);
4028     if (ret < 0) {
4029         qemu_co_mutex_unlock(&s->lock);
4030         goto fail;
4031     }
4032
4033     ret = qcow2_pre_write_overlap_check(bs, 0, cluster_offset, out_len, true);
4034     qemu_co_mutex_unlock(&s->lock);
4035     if (ret < 0) {
4036         goto fail;
4037     }
4038
4039     qemu_iovec_init_buf(&hd_qiov, out_buf, out_len);
4040
4041     BLKDBG_EVENT(s->data_file, BLKDBG_WRITE_COMPRESSED);
4042     ret = bdrv_co_pwritev(s->data_file, cluster_offset, out_len, &hd_qiov, 0);
4043     if (ret < 0) {
4044         goto fail;
4045     }
4046 success:
4047     ret = 0;
4048 fail:
4049     qemu_vfree(buf);
4050     g_free(out_buf);
4051     return ret;
4052 }
4053
4054 static int coroutine_fn
4055 qcow2_co_preadv_compressed(BlockDriverState *bs,
4056                            uint64_t file_cluster_offset,
4057                            uint64_t offset,
4058                            uint64_t bytes,
4059                            QEMUIOVector *qiov)
4060 {
4061     BDRVQcow2State *s = bs->opaque;
4062     int ret = 0, csize, nb_csectors;
4063     uint64_t coffset;
4064     uint8_t *buf, *out_buf;
4065     QEMUIOVector local_qiov;
4066     int offset_in_cluster = offset_into_cluster(s, offset);
4067
4068     coffset = file_cluster_offset & s->cluster_offset_mask;
4069     nb_csectors = ((file_cluster_offset >> s->csize_shift) & s->csize_mask) + 1;
4070     csize = nb_csectors * 512 - (coffset & 511);
4071
4072     buf = g_try_malloc(csize);
4073     if (!buf) {
4074         return -ENOMEM;
4075     }
4076     qemu_iovec_init_buf(&local_qiov, buf, csize);
4077
4078     out_buf = qemu_blockalign(bs, s->cluster_size);
4079
4080     BLKDBG_EVENT(bs->file, BLKDBG_READ_COMPRESSED);
4081     ret = bdrv_co_preadv(bs->file, coffset, csize, &local_qiov, 0);
4082     if (ret < 0) {
4083         goto fail;
4084     }
4085
4086     if (qcow2_co_decompress(bs, out_buf, s->cluster_size, buf, csize) < 0) {
4087         ret = -EIO;
4088         goto fail;
4089     }
4090
4091     qemu_iovec_from_buf(qiov, 0, out_buf + offset_in_cluster, bytes);
4092
4093 fail:
4094     qemu_vfree(out_buf);
4095     g_free(buf);
4096
4097     return ret;
4098 }
4099
4100 static int make_completely_empty(BlockDriverState *bs)
4101 {
4102     BDRVQcow2State *s = bs->opaque;
4103     Error *local_err = NULL;
4104     int ret, l1_clusters;
4105     int64_t offset;
4106     uint64_t *new_reftable = NULL;
4107     uint64_t rt_entry, l1_size2;
4108     struct {
4109         uint64_t l1_offset;
4110         uint64_t reftable_offset;
4111         uint32_t reftable_clusters;
4112     } QEMU_PACKED l1_ofs_rt_ofs_cls;
4113
4114     ret = qcow2_cache_empty(bs, s->l2_table_cache);
4115     if (ret < 0) {
4116         goto fail;
4117     }
4118
4119     ret = qcow2_cache_empty(bs, s->refcount_block_cache);
4120     if (ret < 0) {
4121         goto fail;
4122     }
4123
4124     /* Refcounts will be broken utterly */
4125     ret = qcow2_mark_dirty(bs);
4126     if (ret < 0) {
4127         goto fail;
4128     }
4129
4130     BLKDBG_EVENT(bs->file, BLKDBG_L1_UPDATE);
4131
4132     l1_clusters = DIV_ROUND_UP(s->l1_size, s->cluster_size / sizeof(uint64_t));
4133     l1_size2 = (uint64_t)s->l1_size * sizeof(uint64_t);
4134
4135     /* After this call, neither the in-memory nor the on-disk refcount
4136      * information accurately describe the actual references */
4137
4138     ret = bdrv_pwrite_zeroes(bs->file, s->l1_table_offset,
4139                              l1_clusters * s->cluster_size, 0);
4140     if (ret < 0) {
4141         goto fail_broken_refcounts;
4142     }
4143     memset(s->l1_table, 0, l1_size2);
4144
4145     BLKDBG_EVENT(bs->file, BLKDBG_EMPTY_IMAGE_PREPARE);
4146
4147     /* Overwrite enough clusters at the beginning of the sectors to place
4148      * the refcount table, a refcount block and the L1 table in; this may
4149      * overwrite parts of the existing refcount and L1 table, which is not
4150      * an issue because the dirty flag is set, complete data loss is in fact
4151      * desired and partial data loss is consequently fine as well */
4152     ret = bdrv_pwrite_zeroes(bs->file, s->cluster_size,
4153                              (2 + l1_clusters) * s->cluster_size, 0);
4154     /* This call (even if it failed overall) may have overwritten on-disk
4155      * refcount structures; in that case, the in-memory refcount information
4156      * will probably differ from the on-disk information which makes the BDS
4157      * unusable */
4158     if (ret < 0) {
4159         goto fail_broken_refcounts;
4160     }
4161
4162     BLKDBG_EVENT(bs->file, BLKDBG_L1_UPDATE);
4163     BLKDBG_EVENT(bs->file, BLKDBG_REFTABLE_UPDATE);
4164
4165     /* "Create" an empty reftable (one cluster) directly after the image
4166      * header and an empty L1 table three clusters after the image header;
4167      * the cluster between those two will be used as the first refblock */
4168     l1_ofs_rt_ofs_cls.l1_offset = cpu_to_be64(3 * s->cluster_size);
4169     l1_ofs_rt_ofs_cls.reftable_offset = cpu_to_be64(s->cluster_size);
4170     l1_ofs_rt_ofs_cls.reftable_clusters = cpu_to_be32(1);
4171     ret = bdrv_pwrite_sync(bs->file, offsetof(QCowHeader, l1_table_offset),
4172                            &l1_ofs_rt_ofs_cls, sizeof(l1_ofs_rt_ofs_cls));
4173     if (ret < 0) {
4174         goto fail_broken_refcounts;
4175     }
4176
4177     s->l1_table_offset = 3 * s->cluster_size;
4178
4179     new_reftable = g_try_new0(uint64_t, s->cluster_size / sizeof(uint64_t));
4180     if (!new_reftable) {
4181         ret = -ENOMEM;
4182         goto fail_broken_refcounts;
4183     }
4184
4185     s->refcount_table_offset = s->cluster_size;
4186     s->refcount_table_size   = s->cluster_size / sizeof(uint64_t);
4187     s->max_refcount_table_index = 0;
4188
4189     g_free(s->refcount_table);
4190     s->refcount_table = new_reftable;
4191     new_reftable = NULL;
4192
4193     /* Now the in-memory refcount information again corresponds to the on-disk
4194      * information (reftable is empty and no refblocks (the refblock cache is
4195      * empty)); however, this means some clusters (e.g. the image header) are
4196      * referenced, but not refcounted, but the normal qcow2 code assumes that
4197      * the in-memory information is always correct */
4198
4199     BLKDBG_EVENT(bs->file, BLKDBG_REFBLOCK_ALLOC);
4200
4201     /* Enter the first refblock into the reftable */
4202     rt_entry = cpu_to_be64(2 * s->cluster_size);
4203     ret = bdrv_pwrite_sync(bs->file, s->cluster_size,
4204                            &rt_entry, sizeof(rt_entry));
4205     if (ret < 0) {
4206         goto fail_broken_refcounts;
4207     }
4208     s->refcount_table[0] = 2 * s->cluster_size;
4209
4210     s->free_cluster_index = 0;
4211     assert(3 + l1_clusters <= s->refcount_block_size);
4212     offset = qcow2_alloc_clusters(bs, 3 * s->cluster_size + l1_size2);
4213     if (offset < 0) {
4214         ret = offset;
4215         goto fail_broken_refcounts;
4216     } else if (offset > 0) {
4217         error_report("First cluster in emptied image is in use");
4218         abort();
4219     }
4220
4221     /* Now finally the in-memory information corresponds to the on-disk
4222      * structures and is correct */
4223     ret = qcow2_mark_clean(bs);
4224     if (ret < 0) {
4225         goto fail;
4226     }
4227
4228     ret = bdrv_truncate(bs->file, (3 + l1_clusters) * s->cluster_size,
4229                         PREALLOC_MODE_OFF, &local_err);
4230     if (ret < 0) {
4231         error_report_err(local_err);
4232         goto fail;
4233     }
4234
4235     return 0;
4236
4237 fail_broken_refcounts:
4238     /* The BDS is unusable at this point. If we wanted to make it usable, we
4239      * would have to call qcow2_refcount_close(), qcow2_refcount_init(),
4240      * qcow2_check_refcounts(), qcow2_refcount_close() and qcow2_refcount_init()
4241      * again. However, because the functions which could have caused this error
4242      * path to be taken are used by those functions as well, it's very likely
4243      * that that sequence will fail as well. Therefore, just eject the BDS. */
4244     bs->drv = NULL;
4245
4246 fail:
4247     g_free(new_reftable);
4248     return ret;
4249 }
4250
4251 static int qcow2_make_empty(BlockDriverState *bs)
4252 {
4253     BDRVQcow2State *s = bs->opaque;
4254     uint64_t offset, end_offset;
4255     int step = QEMU_ALIGN_DOWN(INT_MAX, s->cluster_size);
4256     int l1_clusters, ret = 0;
4257
4258     l1_clusters = DIV_ROUND_UP(s->l1_size, s->cluster_size / sizeof(uint64_t));
4259
4260     if (s->qcow_version >= 3 && !s->snapshots && !s->nb_bitmaps &&
4261         3 + l1_clusters <= s->refcount_block_size &&
4262         s->crypt_method_header != QCOW_CRYPT_LUKS) {
4263         /* The following function only works for qcow2 v3 images (it
4264          * requires the dirty flag) and only as long as there are no
4265          * features that reserve extra clusters (such as snapshots,
4266          * LUKS header, or persistent bitmaps), because it completely
4267          * empties the image.  Furthermore, the L1 table and three
4268          * additional clusters (image header, refcount table, one
4269          * refcount block) have to fit inside one refcount block. */
4270         return make_completely_empty(bs);
4271     }
4272
4273     /* This fallback code simply discards every active cluster; this is slow,
4274      * but works in all cases */
4275     end_offset = bs->total_sectors * BDRV_SECTOR_SIZE;
4276     for (offset = 0; offset < end_offset; offset += step) {
4277         /* As this function is generally used after committing an external
4278          * snapshot, QCOW2_DISCARD_SNAPSHOT seems appropriate. Also, the
4279          * default action for this kind of discard is to pass the discard,
4280          * which will ideally result in an actually smaller image file, as
4281          * is probably desired. */
4282         ret = qcow2_cluster_discard(bs, offset, MIN(step, end_offset - offset),
4283                                     QCOW2_DISCARD_SNAPSHOT, true);
4284         if (ret < 0) {
4285             break;
4286         }
4287     }
4288
4289     return ret;
4290 }
4291
4292 static coroutine_fn int qcow2_co_flush_to_os(BlockDriverState *bs)
4293 {
4294     BDRVQcow2State *s = bs->opaque;
4295     int ret;
4296
4297     qemu_co_mutex_lock(&s->lock);
4298     ret = qcow2_write_caches(bs);
4299     qemu_co_mutex_unlock(&s->lock);
4300
4301     return ret;
4302 }
4303
4304 static ssize_t qcow2_measure_crypto_hdr_init_func(QCryptoBlock *block,
4305         size_t headerlen, void *opaque, Error **errp)
4306 {
4307     size_t *headerlenp = opaque;
4308
4309     /* Stash away the payload size */
4310     *headerlenp = headerlen;
4311     return 0;
4312 }
4313
4314 static ssize_t qcow2_measure_crypto_hdr_write_func(QCryptoBlock *block,
4315         size_t offset, const uint8_t *buf, size_t buflen,
4316         void *opaque, Error **errp)
4317 {
4318     /* Discard the bytes, we're not actually writing to an image */
4319     return buflen;
4320 }
4321
4322 /* Determine the number of bytes for the LUKS payload */
4323 static bool qcow2_measure_luks_headerlen(QemuOpts *opts, size_t *len,
4324                                          Error **errp)
4325 {
4326     QDict *opts_qdict;
4327     QDict *cryptoopts_qdict;
4328     QCryptoBlockCreateOptions *cryptoopts;
4329     QCryptoBlock *crypto;
4330
4331     /* Extract "encrypt." options into a qdict */
4332     opts_qdict = qemu_opts_to_qdict(opts, NULL);
4333     qdict_extract_subqdict(opts_qdict, &cryptoopts_qdict, "encrypt.");
4334     qobject_unref(opts_qdict);
4335
4336     /* Build QCryptoBlockCreateOptions object from qdict */
4337     qdict_put_str(cryptoopts_qdict, "format", "luks");
4338     cryptoopts = block_crypto_create_opts_init(cryptoopts_qdict, errp);
4339     qobject_unref(cryptoopts_qdict);
4340     if (!cryptoopts) {
4341         return false;
4342     }
4343
4344     /* Fake LUKS creation in order to determine the payload size */
4345     crypto = qcrypto_block_create(cryptoopts, "encrypt.",
4346                                   qcow2_measure_crypto_hdr_init_func,
4347                                   qcow2_measure_crypto_hdr_write_func,
4348                                   len, errp);
4349     qapi_free_QCryptoBlockCreateOptions(cryptoopts);
4350     if (!crypto) {
4351         return false;
4352     }
4353
4354     qcrypto_block_free(crypto);
4355     return true;
4356 }
4357
4358 static BlockMeasureInfo *qcow2_measure(QemuOpts *opts, BlockDriverState *in_bs,
4359                                        Error **errp)
4360 {
4361     Error *local_err = NULL;
4362     BlockMeasureInfo *info;
4363     uint64_t required = 0; /* bytes that contribute to required size */
4364     uint64_t virtual_size; /* disk size as seen by guest */
4365     uint64_t refcount_bits;
4366     uint64_t l2_tables;
4367     uint64_t luks_payload_size = 0;
4368     size_t cluster_size;
4369     int version;
4370     char *optstr;
4371     PreallocMode prealloc;
4372     bool has_backing_file;
4373     bool has_luks;
4374
4375     /* Parse image creation options */
4376     cluster_size = qcow2_opt_get_cluster_size_del(opts, &local_err);
4377     if (local_err) {
4378         goto err;
4379     }
4380
4381     version = qcow2_opt_get_version_del(opts, &local_err);
4382     if (local_err) {
4383         goto err;
4384     }
4385
4386     refcount_bits = qcow2_opt_get_refcount_bits_del(opts, version, &local_err);
4387     if (local_err) {
4388         goto err;
4389     }
4390
4391     optstr = qemu_opt_get_del(opts, BLOCK_OPT_PREALLOC);
4392     prealloc = qapi_enum_parse(&PreallocMode_lookup, optstr,
4393                                PREALLOC_MODE_OFF, &local_err);
4394     g_free(optstr);
4395     if (local_err) {
4396         goto err;
4397     }
4398
4399     optstr = qemu_opt_get_del(opts, BLOCK_OPT_BACKING_FILE);
4400     has_backing_file = !!optstr;
4401     g_free(optstr);
4402
4403     optstr = qemu_opt_get_del(opts, BLOCK_OPT_ENCRYPT_FORMAT);
4404     has_luks = optstr && strcmp(optstr, "luks") == 0;
4405     g_free(optstr);
4406
4407     if (has_luks) {
4408         size_t headerlen;
4409
4410         if (!qcow2_measure_luks_headerlen(opts, &headerlen, &local_err)) {
4411             goto err;
4412         }
4413
4414         luks_payload_size = ROUND_UP(headerlen, cluster_size);
4415     }
4416
4417     virtual_size = qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0);
4418     virtual_size = ROUND_UP(virtual_size, cluster_size);
4419
4420     /* Check that virtual disk size is valid */
4421     l2_tables = DIV_ROUND_UP(virtual_size / cluster_size,
4422                              cluster_size / sizeof(uint64_t));
4423     if (l2_tables * sizeof(uint64_t) > QCOW_MAX_L1_SIZE) {
4424         error_setg(&local_err, "The image size is too large "
4425                                "(try using a larger cluster size)");
4426         goto err;
4427     }
4428
4429     /* Account for input image */
4430     if (in_bs) {
4431         int64_t ssize = bdrv_getlength(in_bs);
4432         if (ssize < 0) {
4433             error_setg_errno(&local_err, -ssize,
4434                              "Unable to get image virtual_size");
4435             goto err;
4436         }
4437
4438         virtual_size = ROUND_UP(ssize, cluster_size);
4439
4440         if (has_backing_file) {
4441             /* We don't how much of the backing chain is shared by the input
4442              * image and the new image file.  In the worst case the new image's
4443              * backing file has nothing in common with the input image.  Be
4444              * conservative and assume all clusters need to be written.
4445              */
4446             required = virtual_size;
4447         } else {
4448             int64_t offset;
4449             int64_t pnum = 0;
4450
4451             for (offset = 0; offset < ssize; offset += pnum) {
4452                 int ret;
4453
4454                 ret = bdrv_block_status_above(in_bs, NULL, offset,
4455                                               ssize - offset, &pnum, NULL,
4456                                               NULL);
4457                 if (ret < 0) {
4458                     error_setg_errno(&local_err, -ret,
4459                                      "Unable to get block status");
4460                     goto err;
4461                 }
4462
4463                 if (ret & BDRV_BLOCK_ZERO) {
4464                     /* Skip zero regions (safe with no backing file) */
4465                 } else if ((ret & (BDRV_BLOCK_DATA | BDRV_BLOCK_ALLOCATED)) ==
4466                            (BDRV_BLOCK_DATA | BDRV_BLOCK_ALLOCATED)) {
4467                     /* Extend pnum to end of cluster for next iteration */
4468                     pnum = ROUND_UP(offset + pnum, cluster_size) - offset;
4469
4470                     /* Count clusters we've seen */
4471                     required += offset % cluster_size + pnum;
4472                 }
4473             }
4474         }
4475     }
4476
4477     /* Take into account preallocation.  Nothing special is needed for
4478      * PREALLOC_MODE_METADATA since metadata is always counted.
4479      */
4480     if (prealloc == PREALLOC_MODE_FULL || prealloc == PREALLOC_MODE_FALLOC) {
4481         required = virtual_size;
4482     }
4483
4484     info = g_new(BlockMeasureInfo, 1);
4485     info->fully_allocated =
4486         qcow2_calc_prealloc_size(virtual_size, cluster_size,
4487                                  ctz32(refcount_bits)) + luks_payload_size;
4488
4489     /* Remove data clusters that are not required.  This overestimates the
4490      * required size because metadata needed for the fully allocated file is
4491      * still counted.
4492      */
4493     info->required = info->fully_allocated - virtual_size + required;
4494     return info;
4495
4496 err:
4497     error_propagate(errp, local_err);
4498     return NULL;
4499 }
4500
4501 static int qcow2_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
4502 {
4503     BDRVQcow2State *s = bs->opaque;
4504     bdi->unallocated_blocks_are_zero = true;
4505     bdi->cluster_size = s->cluster_size;
4506     bdi->vm_state_offset = qcow2_vm_state_offset(s);
4507     return 0;
4508 }
4509
4510 static ImageInfoSpecific *qcow2_get_specific_info(BlockDriverState *bs,
4511                                                   Error **errp)
4512 {
4513     BDRVQcow2State *s = bs->opaque;
4514     ImageInfoSpecific *spec_info;
4515     QCryptoBlockInfo *encrypt_info = NULL;
4516     Error *local_err = NULL;
4517
4518     if (s->crypto != NULL) {
4519         encrypt_info = qcrypto_block_get_info(s->crypto, &local_err);
4520         if (local_err) {
4521             error_propagate(errp, local_err);
4522             return NULL;
4523         }
4524     }
4525
4526     spec_info = g_new(ImageInfoSpecific, 1);
4527     *spec_info = (ImageInfoSpecific){
4528         .type  = IMAGE_INFO_SPECIFIC_KIND_QCOW2,
4529         .u.qcow2.data = g_new0(ImageInfoSpecificQCow2, 1),
4530     };
4531     if (s->qcow_version == 2) {
4532         *spec_info->u.qcow2.data = (ImageInfoSpecificQCow2){
4533             .compat             = g_strdup("0.10"),
4534             .refcount_bits      = s->refcount_bits,
4535         };
4536     } else if (s->qcow_version == 3) {
4537         Qcow2BitmapInfoList *bitmaps;
4538         bitmaps = qcow2_get_bitmap_info_list(bs, &local_err);
4539         if (local_err) {
4540             error_propagate(errp, local_err);
4541             qapi_free_ImageInfoSpecific(spec_info);
4542             return NULL;
4543         }
4544         *spec_info->u.qcow2.data = (ImageInfoSpecificQCow2){
4545             .compat             = g_strdup("1.1"),
4546             .lazy_refcounts     = s->compatible_features &
4547                                   QCOW2_COMPAT_LAZY_REFCOUNTS,
4548             .has_lazy_refcounts = true,
4549             .corrupt            = s->incompatible_features &
4550                                   QCOW2_INCOMPAT_CORRUPT,
4551             .has_corrupt        = true,
4552             .refcount_bits      = s->refcount_bits,
4553             .has_bitmaps        = !!bitmaps,
4554             .bitmaps            = bitmaps,
4555         };
4556     } else {
4557         /* if this assertion fails, this probably means a new version was
4558          * added without having it covered here */
4559         assert(false);
4560     }
4561
4562     if (encrypt_info) {
4563         ImageInfoSpecificQCow2Encryption *qencrypt =
4564             g_new(ImageInfoSpecificQCow2Encryption, 1);
4565         switch (encrypt_info->format) {
4566         case Q_CRYPTO_BLOCK_FORMAT_QCOW:
4567             qencrypt->format = BLOCKDEV_QCOW2_ENCRYPTION_FORMAT_AES;
4568             break;
4569         case Q_CRYPTO_BLOCK_FORMAT_LUKS:
4570             qencrypt->format = BLOCKDEV_QCOW2_ENCRYPTION_FORMAT_LUKS;
4571             qencrypt->u.luks = encrypt_info->u.luks;
4572             break;
4573         default:
4574             abort();
4575         }
4576         /* Since we did shallow copy above, erase any pointers
4577          * in the original info */
4578         memset(&encrypt_info->u, 0, sizeof(encrypt_info->u));
4579         qapi_free_QCryptoBlockInfo(encrypt_info);
4580
4581         spec_info->u.qcow2.data->has_encrypt = true;
4582         spec_info->u.qcow2.data->encrypt = qencrypt;
4583     }
4584
4585     return spec_info;
4586 }
4587
4588 static int qcow2_save_vmstate(BlockDriverState *bs, QEMUIOVector *qiov,
4589                               int64_t pos)
4590 {
4591     BDRVQcow2State *s = bs->opaque;
4592
4593     BLKDBG_EVENT(bs->file, BLKDBG_VMSTATE_SAVE);
4594     return bs->drv->bdrv_co_pwritev(bs, qcow2_vm_state_offset(s) + pos,
4595                                     qiov->size, qiov, 0);
4596 }
4597
4598 static int qcow2_load_vmstate(BlockDriverState *bs, QEMUIOVector *qiov,
4599                               int64_t pos)
4600 {
4601     BDRVQcow2State *s = bs->opaque;
4602
4603     BLKDBG_EVENT(bs->file, BLKDBG_VMSTATE_LOAD);
4604     return bs->drv->bdrv_co_preadv(bs, qcow2_vm_state_offset(s) + pos,
4605                                    qiov->size, qiov, 0);
4606 }
4607
4608 /*
4609  * Downgrades an image's version. To achieve this, any incompatible features
4610  * have to be removed.
4611  */
4612 static int qcow2_downgrade(BlockDriverState *bs, int target_version,
4613                            BlockDriverAmendStatusCB *status_cb, void *cb_opaque,
4614                            Error **errp)
4615 {
4616     BDRVQcow2State *s = bs->opaque;
4617     int current_version = s->qcow_version;
4618     int ret;
4619
4620     /* This is qcow2_downgrade(), not qcow2_upgrade() */
4621     assert(target_version < current_version);
4622
4623     /* There are no other versions (now) that you can downgrade to */
4624     assert(target_version == 2);
4625
4626     if (s->refcount_order != 4) {
4627         error_setg(errp, "compat=0.10 requires refcount_bits=16");
4628         return -ENOTSUP;
4629     }
4630
4631     if (has_data_file(bs)) {
4632         error_setg(errp, "Cannot downgrade an image with a data file");
4633         return -ENOTSUP;
4634     }
4635
4636     /* clear incompatible features */
4637     if (s->incompatible_features & QCOW2_INCOMPAT_DIRTY) {
4638         ret = qcow2_mark_clean(bs);
4639         if (ret < 0) {
4640             error_setg_errno(errp, -ret, "Failed to make the image clean");
4641             return ret;
4642         }
4643     }
4644
4645     /* with QCOW2_INCOMPAT_CORRUPT, it is pretty much impossible to get here in
4646      * the first place; if that happens nonetheless, returning -ENOTSUP is the
4647      * best thing to do anyway */
4648
4649     if (s->incompatible_features) {
4650         error_setg(errp, "Cannot downgrade an image with incompatible features "
4651                    "%#" PRIx64 " set", s->incompatible_features);
4652         return -ENOTSUP;
4653     }
4654
4655     /* since we can ignore compatible features, we can set them to 0 as well */
4656     s->compatible_features = 0;
4657     /* if lazy refcounts have been used, they have already been fixed through
4658      * clearing the dirty flag */
4659
4660     /* clearing autoclear features is trivial */
4661     s->autoclear_features = 0;
4662
4663     ret = qcow2_expand_zero_clusters(bs, status_cb, cb_opaque);
4664     if (ret < 0) {
4665         error_setg_errno(errp, -ret, "Failed to turn zero into data clusters");
4666         return ret;
4667     }
4668
4669     s->qcow_version = target_version;
4670     ret = qcow2_update_header(bs);
4671     if (ret < 0) {
4672         s->qcow_version = current_version;
4673         error_setg_errno(errp, -ret, "Failed to update the image header");
4674         return ret;
4675     }
4676     return 0;
4677 }
4678
4679 typedef enum Qcow2AmendOperation {
4680     /* This is the value Qcow2AmendHelperCBInfo::last_operation will be
4681      * statically initialized to so that the helper CB can discern the first
4682      * invocation from an operation change */
4683     QCOW2_NO_OPERATION = 0,
4684
4685     QCOW2_CHANGING_REFCOUNT_ORDER,
4686     QCOW2_DOWNGRADING,
4687 } Qcow2AmendOperation;
4688
4689 typedef struct Qcow2AmendHelperCBInfo {
4690     /* The code coordinating the amend operations should only modify
4691      * these four fields; the rest will be managed by the CB */
4692     BlockDriverAmendStatusCB *original_status_cb;
4693     void *original_cb_opaque;
4694
4695     Qcow2AmendOperation current_operation;
4696
4697     /* Total number of operations to perform (only set once) */
4698     int total_operations;
4699
4700     /* The following fields are managed by the CB */
4701
4702     /* Number of operations completed */
4703     int operations_completed;
4704
4705     /* Cumulative offset of all completed operations */
4706     int64_t offset_completed;
4707
4708     Qcow2AmendOperation last_operation;
4709     int64_t last_work_size;
4710 } Qcow2AmendHelperCBInfo;
4711
4712 static void qcow2_amend_helper_cb(BlockDriverState *bs,
4713                                   int64_t operation_offset,
4714                                   int64_t operation_work_size, void *opaque)
4715 {
4716     Qcow2AmendHelperCBInfo *info = opaque;
4717     int64_t current_work_size;
4718     int64_t projected_work_size;
4719
4720     if (info->current_operation != info->last_operation) {
4721         if (info->last_operation != QCOW2_NO_OPERATION) {
4722             info->offset_completed += info->last_work_size;
4723             info->operations_completed++;
4724         }
4725
4726         info->last_operation = info->current_operation;
4727     }
4728
4729     assert(info->total_operations > 0);
4730     assert(info->operations_completed < info->total_operations);
4731
4732     info->last_work_size = operation_work_size;
4733
4734     current_work_size = info->offset_completed + operation_work_size;
4735
4736     /* current_work_size is the total work size for (operations_completed + 1)
4737      * operations (which includes this one), so multiply it by the number of
4738      * operations not covered and divide it by the number of operations
4739      * covered to get a projection for the operations not covered */
4740     projected_work_size = current_work_size * (info->total_operations -
4741                                                info->operations_completed - 1)
4742                                             / (info->operations_completed + 1);
4743
4744     info->original_status_cb(bs, info->offset_completed + operation_offset,
4745                              current_work_size + projected_work_size,
4746                              info->original_cb_opaque);
4747 }
4748
4749 static int qcow2_amend_options(BlockDriverState *bs, QemuOpts *opts,
4750                                BlockDriverAmendStatusCB *status_cb,
4751                                void *cb_opaque,
4752                                Error **errp)
4753 {
4754     BDRVQcow2State *s = bs->opaque;
4755     int old_version = s->qcow_version, new_version = old_version;
4756     uint64_t new_size = 0;
4757     const char *backing_file = NULL, *backing_format = NULL;
4758     bool lazy_refcounts = s->use_lazy_refcounts;
4759     const char *compat = NULL;
4760     uint64_t cluster_size = s->cluster_size;
4761     bool encrypt;
4762     int encformat;
4763     int refcount_bits = s->refcount_bits;
4764     int ret;
4765     QemuOptDesc *desc = opts->list->desc;
4766     Qcow2AmendHelperCBInfo helper_cb_info;
4767
4768     while (desc && desc->name) {
4769         if (!qemu_opt_find(opts, desc->name)) {
4770             /* only change explicitly defined options */
4771             desc++;
4772             continue;
4773         }
4774
4775         if (!strcmp(desc->name, BLOCK_OPT_COMPAT_LEVEL)) {
4776             compat = qemu_opt_get(opts, BLOCK_OPT_COMPAT_LEVEL);
4777             if (!compat) {
4778                 /* preserve default */
4779             } else if (!strcmp(compat, "0.10")) {
4780                 new_version = 2;
4781             } else if (!strcmp(compat, "1.1")) {
4782                 new_version = 3;
4783             } else {
4784                 error_setg(errp, "Unknown compatibility level %s", compat);
4785                 return -EINVAL;
4786             }
4787         } else if (!strcmp(desc->name, BLOCK_OPT_PREALLOC)) {
4788             error_setg(errp, "Cannot change preallocation mode");
4789             return -ENOTSUP;
4790         } else if (!strcmp(desc->name, BLOCK_OPT_SIZE)) {
4791             new_size = qemu_opt_get_size(opts, BLOCK_OPT_SIZE, 0);
4792         } else if (!strcmp(desc->name, BLOCK_OPT_BACKING_FILE)) {
4793             backing_file = qemu_opt_get(opts, BLOCK_OPT_BACKING_FILE);
4794         } else if (!strcmp(desc->name, BLOCK_OPT_BACKING_FMT)) {
4795             backing_format = qemu_opt_get(opts, BLOCK_OPT_BACKING_FMT);
4796         } else if (!strcmp(desc->name, BLOCK_OPT_ENCRYPT)) {
4797             encrypt = qemu_opt_get_bool(opts, BLOCK_OPT_ENCRYPT,
4798                                         !!s->crypto);
4799
4800             if (encrypt != !!s->crypto) {
4801                 error_setg(errp,
4802                            "Changing the encryption flag is not supported");
4803                 return -ENOTSUP;
4804             }
4805         } else if (!strcmp(desc->name, BLOCK_OPT_ENCRYPT_FORMAT)) {
4806             encformat = qcow2_crypt_method_from_format(
4807                 qemu_opt_get(opts, BLOCK_OPT_ENCRYPT_FORMAT));
4808
4809             if (encformat != s->crypt_method_header) {
4810                 error_setg(errp,
4811                            "Changing the encryption format is not supported");
4812                 return -ENOTSUP;
4813             }
4814         } else if (g_str_has_prefix(desc->name, "encrypt.")) {
4815             error_setg(errp,
4816                        "Changing the encryption parameters is not supported");
4817             return -ENOTSUP;
4818         } else if (!strcmp(desc->name, BLOCK_OPT_CLUSTER_SIZE)) {
4819             cluster_size = qemu_opt_get_size(opts, BLOCK_OPT_CLUSTER_SIZE,
4820                                              cluster_size);
4821             if (cluster_size != s->cluster_size) {
4822                 error_setg(errp, "Changing the cluster size is not supported");
4823                 return -ENOTSUP;
4824             }
4825         } else if (!strcmp(desc->name, BLOCK_OPT_LAZY_REFCOUNTS)) {
4826             lazy_refcounts = qemu_opt_get_bool(opts, BLOCK_OPT_LAZY_REFCOUNTS,
4827                                                lazy_refcounts);
4828         } else if (!strcmp(desc->name, BLOCK_OPT_REFCOUNT_BITS)) {
4829             refcount_bits = qemu_opt_get_number(opts, BLOCK_OPT_REFCOUNT_BITS,
4830                                                 refcount_bits);
4831
4832             if (refcount_bits <= 0 || refcount_bits > 64 ||
4833                 !is_power_of_2(refcount_bits))
4834             {
4835                 error_setg(errp, "Refcount width must be a power of two and "
4836                            "may not exceed 64 bits");
4837                 return -EINVAL;
4838             }
4839         } else {
4840             /* if this point is reached, this probably means a new option was
4841              * added without having it covered here */
4842             abort();
4843         }
4844
4845         desc++;
4846     }
4847
4848     helper_cb_info = (Qcow2AmendHelperCBInfo){
4849         .original_status_cb = status_cb,
4850         .original_cb_opaque = cb_opaque,
4851         .total_operations = (new_version < old_version)
4852                           + (s->refcount_bits != refcount_bits)
4853     };
4854
4855     /* Upgrade first (some features may require compat=1.1) */
4856     if (new_version > old_version) {
4857         s->qcow_version = new_version;
4858         ret = qcow2_update_header(bs);
4859         if (ret < 0) {
4860             s->qcow_version = old_version;
4861             error_setg_errno(errp, -ret, "Failed to update the image header");
4862             return ret;
4863         }
4864     }
4865
4866     if (s->refcount_bits != refcount_bits) {
4867         int refcount_order = ctz32(refcount_bits);
4868
4869         if (new_version < 3 && refcount_bits != 16) {
4870             error_setg(errp, "Refcount widths other than 16 bits require "
4871                        "compatibility level 1.1 or above (use compat=1.1 or "
4872                        "greater)");
4873             return -EINVAL;
4874         }
4875
4876         helper_cb_info.current_operation = QCOW2_CHANGING_REFCOUNT_ORDER;
4877         ret = qcow2_change_refcount_order(bs, refcount_order,
4878                                           &qcow2_amend_helper_cb,
4879                                           &helper_cb_info, errp);
4880         if (ret < 0) {
4881             return ret;
4882         }
4883     }
4884
4885     if (backing_file || backing_format) {
4886         ret = qcow2_change_backing_file(bs,
4887                     backing_file ?: s->image_backing_file,
4888                     backing_format ?: s->image_backing_format);
4889         if (ret < 0) {
4890             error_setg_errno(errp, -ret, "Failed to change the backing file");
4891             return ret;
4892         }
4893     }
4894
4895     if (s->use_lazy_refcounts != lazy_refcounts) {
4896         if (lazy_refcounts) {
4897             if (new_version < 3) {
4898                 error_setg(errp, "Lazy refcounts only supported with "
4899                            "compatibility level 1.1 and above (use compat=1.1 "
4900                            "or greater)");
4901                 return -EINVAL;
4902             }
4903             s->compatible_features |= QCOW2_COMPAT_LAZY_REFCOUNTS;
4904             ret = qcow2_update_header(bs);
4905             if (ret < 0) {
4906                 s->compatible_features &= ~QCOW2_COMPAT_LAZY_REFCOUNTS;
4907                 error_setg_errno(errp, -ret, "Failed to update the image header");
4908                 return ret;
4909             }
4910             s->use_lazy_refcounts = true;
4911         } else {
4912             /* make image clean first */
4913             ret = qcow2_mark_clean(bs);
4914             if (ret < 0) {
4915                 error_setg_errno(errp, -ret, "Failed to make the image clean");
4916                 return ret;
4917             }
4918             /* now disallow lazy refcounts */
4919             s->compatible_features &= ~QCOW2_COMPAT_LAZY_REFCOUNTS;
4920             ret = qcow2_update_header(bs);
4921             if (ret < 0) {
4922                 s->compatible_features |= QCOW2_COMPAT_LAZY_REFCOUNTS;
4923                 error_setg_errno(errp, -ret, "Failed to update the image header");
4924                 return ret;
4925             }
4926             s->use_lazy_refcounts = false;
4927         }
4928     }
4929
4930     if (new_size) {
4931         BlockBackend *blk = blk_new(BLK_PERM_RESIZE, BLK_PERM_ALL);
4932         ret = blk_insert_bs(blk, bs, errp);
4933         if (ret < 0) {
4934             blk_unref(blk);
4935             return ret;
4936         }
4937
4938         ret = blk_truncate(blk, new_size, PREALLOC_MODE_OFF, errp);
4939         blk_unref(blk);
4940         if (ret < 0) {
4941             return ret;
4942         }
4943     }
4944
4945     /* Downgrade last (so unsupported features can be removed before) */
4946     if (new_version < old_version) {
4947         helper_cb_info.current_operation = QCOW2_DOWNGRADING;
4948         ret = qcow2_downgrade(bs, new_version, &qcow2_amend_helper_cb,
4949                               &helper_cb_info, errp);
4950         if (ret < 0) {
4951             return ret;
4952         }
4953     }
4954
4955     return 0;
4956 }
4957
4958 /*
4959  * If offset or size are negative, respectively, they will not be included in
4960  * the BLOCK_IMAGE_CORRUPTED event emitted.
4961  * fatal will be ignored for read-only BDS; corruptions found there will always
4962  * be considered non-fatal.
4963  */
4964 void qcow2_signal_corruption(BlockDriverState *bs, bool fatal, int64_t offset,
4965                              int64_t size, const char *message_format, ...)
4966 {
4967     BDRVQcow2State *s = bs->opaque;
4968     const char *node_name;
4969     char *message;
4970     va_list ap;
4971
4972     fatal = fatal && bdrv_is_writable(bs);
4973
4974     if (s->signaled_corruption &&
4975         (!fatal || (s->incompatible_features & QCOW2_INCOMPAT_CORRUPT)))
4976     {
4977         return;
4978     }
4979
4980     va_start(ap, message_format);
4981     message = g_strdup_vprintf(message_format, ap);
4982     va_end(ap);
4983
4984     if (fatal) {
4985         fprintf(stderr, "qcow2: Marking image as corrupt: %s; further "
4986                 "corruption events will be suppressed\n", message);
4987     } else {
4988         fprintf(stderr, "qcow2: Image is corrupt: %s; further non-fatal "
4989                 "corruption events will be suppressed\n", message);
4990     }
4991
4992     node_name = bdrv_get_node_name(bs);
4993     qapi_event_send_block_image_corrupted(bdrv_get_device_name(bs),
4994                                           *node_name != '\0', node_name,
4995                                           message, offset >= 0, offset,
4996                                           size >= 0, size,
4997                                           fatal);
4998     g_free(message);
4999
5000     if (fatal) {
5001         qcow2_mark_corrupt(bs);
5002         bs->drv = NULL; /* make BDS unusable */
5003     }
5004
5005     s->signaled_corruption = true;
5006 }
5007
5008 static QemuOptsList qcow2_create_opts = {
5009     .name = "qcow2-create-opts",
5010     .head = QTAILQ_HEAD_INITIALIZER(qcow2_create_opts.head),
5011     .desc = {
5012         {
5013             .name = BLOCK_OPT_SIZE,
5014             .type = QEMU_OPT_SIZE,
5015             .help = "Virtual disk size"
5016         },
5017         {
5018             .name = BLOCK_OPT_COMPAT_LEVEL,
5019             .type = QEMU_OPT_STRING,
5020             .help = "Compatibility level (0.10 or 1.1)"
5021         },
5022         {
5023             .name = BLOCK_OPT_BACKING_FILE,
5024             .type = QEMU_OPT_STRING,
5025             .help = "File name of a base image"
5026         },
5027         {
5028             .name = BLOCK_OPT_BACKING_FMT,
5029             .type = QEMU_OPT_STRING,
5030             .help = "Image format of the base image"
5031         },
5032         {
5033             .name = BLOCK_OPT_ENCRYPT,
5034             .type = QEMU_OPT_BOOL,
5035             .help = "Encrypt the image with format 'aes'. (Deprecated "
5036                     "in favor of " BLOCK_OPT_ENCRYPT_FORMAT "=aes)",
5037         },
5038         {
5039             .name = BLOCK_OPT_ENCRYPT_FORMAT,
5040             .type = QEMU_OPT_STRING,
5041             .help = "Encrypt the image, format choices: 'aes', 'luks'",
5042         },
5043         BLOCK_CRYPTO_OPT_DEF_KEY_SECRET("encrypt.",
5044             "ID of secret providing qcow AES key or LUKS passphrase"),
5045         BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_ALG("encrypt."),
5046         BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_MODE("encrypt."),
5047         BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_ALG("encrypt."),
5048         BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_HASH_ALG("encrypt."),
5049         BLOCK_CRYPTO_OPT_DEF_LUKS_HASH_ALG("encrypt."),
5050         BLOCK_CRYPTO_OPT_DEF_LUKS_ITER_TIME("encrypt."),
5051         {
5052             .name = BLOCK_OPT_CLUSTER_SIZE,
5053             .type = QEMU_OPT_SIZE,
5054             .help = "qcow2 cluster size",
5055             .def_value_str = stringify(DEFAULT_CLUSTER_SIZE)
5056         },
5057         {
5058             .name = BLOCK_OPT_PREALLOC,
5059             .type = QEMU_OPT_STRING,
5060             .help = "Preallocation mode (allowed values: off, metadata, "
5061                     "falloc, full)"
5062         },
5063         {
5064             .name = BLOCK_OPT_LAZY_REFCOUNTS,
5065             .type = QEMU_OPT_BOOL,
5066             .help = "Postpone refcount updates",
5067             .def_value_str = "off"
5068         },
5069         {
5070             .name = BLOCK_OPT_REFCOUNT_BITS,
5071             .type = QEMU_OPT_NUMBER,
5072             .help = "Width of a reference count entry in bits",
5073             .def_value_str = "16"
5074         },
5075         { /* end of list */ }
5076     }
5077 };
5078
5079 static const char *const qcow2_strong_runtime_opts[] = {
5080     "encrypt." BLOCK_CRYPTO_OPT_QCOW_KEY_SECRET,
5081
5082     NULL
5083 };
5084
5085 BlockDriver bdrv_qcow2 = {
5086     .format_name        = "qcow2",
5087     .instance_size      = sizeof(BDRVQcow2State),
5088     .bdrv_probe         = qcow2_probe,
5089     .bdrv_open          = qcow2_open,
5090     .bdrv_close         = qcow2_close,
5091     .bdrv_reopen_prepare  = qcow2_reopen_prepare,
5092     .bdrv_reopen_commit   = qcow2_reopen_commit,
5093     .bdrv_reopen_abort    = qcow2_reopen_abort,
5094     .bdrv_join_options    = qcow2_join_options,
5095     .bdrv_child_perm      = bdrv_format_default_perms,
5096     .bdrv_co_create_opts  = qcow2_co_create_opts,
5097     .bdrv_co_create       = qcow2_co_create,
5098     .bdrv_has_zero_init = bdrv_has_zero_init_1,
5099     .bdrv_co_block_status = qcow2_co_block_status,
5100
5101     .bdrv_co_preadv         = qcow2_co_preadv,
5102     .bdrv_co_pwritev        = qcow2_co_pwritev,
5103     .bdrv_co_flush_to_os    = qcow2_co_flush_to_os,
5104
5105     .bdrv_co_pwrite_zeroes  = qcow2_co_pwrite_zeroes,
5106     .bdrv_co_pdiscard       = qcow2_co_pdiscard,
5107     .bdrv_co_copy_range_from = qcow2_co_copy_range_from,
5108     .bdrv_co_copy_range_to  = qcow2_co_copy_range_to,
5109     .bdrv_co_truncate       = qcow2_co_truncate,
5110     .bdrv_co_pwritev_compressed = qcow2_co_pwritev_compressed,
5111     .bdrv_make_empty        = qcow2_make_empty,
5112
5113     .bdrv_snapshot_create   = qcow2_snapshot_create,
5114     .bdrv_snapshot_goto     = qcow2_snapshot_goto,
5115     .bdrv_snapshot_delete   = qcow2_snapshot_delete,
5116     .bdrv_snapshot_list     = qcow2_snapshot_list,
5117     .bdrv_snapshot_load_tmp = qcow2_snapshot_load_tmp,
5118     .bdrv_measure           = qcow2_measure,
5119     .bdrv_get_info          = qcow2_get_info,
5120     .bdrv_get_specific_info = qcow2_get_specific_info,
5121
5122     .bdrv_save_vmstate    = qcow2_save_vmstate,
5123     .bdrv_load_vmstate    = qcow2_load_vmstate,
5124
5125     .supports_backing           = true,
5126     .bdrv_change_backing_file   = qcow2_change_backing_file,
5127
5128     .bdrv_refresh_limits        = qcow2_refresh_limits,
5129     .bdrv_co_invalidate_cache   = qcow2_co_invalidate_cache,
5130     .bdrv_inactivate            = qcow2_inactivate,
5131
5132     .create_opts         = &qcow2_create_opts,
5133     .strong_runtime_opts = qcow2_strong_runtime_opts,
5134     .bdrv_co_check       = qcow2_co_check,
5135     .bdrv_amend_options  = qcow2_amend_options,
5136
5137     .bdrv_detach_aio_context  = qcow2_detach_aio_context,
5138     .bdrv_attach_aio_context  = qcow2_attach_aio_context,
5139
5140     .bdrv_reopen_bitmaps_rw = qcow2_reopen_bitmaps_rw,
5141     .bdrv_can_store_new_dirty_bitmap = qcow2_can_store_new_dirty_bitmap,
5142     .bdrv_remove_persistent_dirty_bitmap = qcow2_remove_persistent_dirty_bitmap,
5143 };
5144
5145 static void bdrv_qcow2_init(void)
5146 {
5147     bdrv_register(&bdrv_qcow2);
5148 }
5149
5150 block_init(bdrv_qcow2_init);