1 /*
2 * Block driver for the QCOW version 2 format
3 *
4 * Copyright (c) 2004-2006 Fabrice Bellard
5 *
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
12 *
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
15 *
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22 * THE SOFTWARE.
23 */
24
25 #include "qemu/osdep.h"
26 #include "block/block-io.h"
27 #include "qapi/error.h"
28 #include "qcow2.h"
29 #include "qemu/range.h"
30 #include "qemu/bswap.h"
31 #include "qemu/cutils.h"
32 #include "qemu/memalign.h"
33 #include "trace.h"
34
35 static int64_t alloc_clusters_noref(BlockDriverState *bs, uint64_t size,
36 uint64_t max);
37
38 G_GNUC_WARN_UNUSED_RESULT
39 static int update_refcount(BlockDriverState *bs,
40 int64_t offset, int64_t length, uint64_t addend,
41 bool decrease, enum qcow2_discard_type type);
42
43 static uint64_t get_refcount_ro0(const void *refcount_array, uint64_t index);
44 static uint64_t get_refcount_ro1(const void *refcount_array, uint64_t index);
45 static uint64_t get_refcount_ro2(const void *refcount_array, uint64_t index);
46 static uint64_t get_refcount_ro3(const void *refcount_array, uint64_t index);
47 static uint64_t get_refcount_ro4(const void *refcount_array, uint64_t index);
48 static uint64_t get_refcount_ro5(const void *refcount_array, uint64_t index);
49 static uint64_t get_refcount_ro6(const void *refcount_array, uint64_t index);
50
51 static void set_refcount_ro0(void *refcount_array, uint64_t index,
52 uint64_t value);
53 static void set_refcount_ro1(void *refcount_array, uint64_t index,
54 uint64_t value);
55 static void set_refcount_ro2(void *refcount_array, uint64_t index,
56 uint64_t value);
57 static void set_refcount_ro3(void *refcount_array, uint64_t index,
58 uint64_t value);
59 static void set_refcount_ro4(void *refcount_array, uint64_t index,
60 uint64_t value);
61 static void set_refcount_ro5(void *refcount_array, uint64_t index,
62 uint64_t value);
63 static void set_refcount_ro6(void *refcount_array, uint64_t index,
64 uint64_t value);
65
66
67 static Qcow2GetRefcountFunc *const get_refcount_funcs[] = {
68 &get_refcount_ro0,
69 &get_refcount_ro1,
70 &get_refcount_ro2,
71 &get_refcount_ro3,
72 &get_refcount_ro4,
73 &get_refcount_ro5,
74 &get_refcount_ro6
75 };
76
77 static Qcow2SetRefcountFunc *const set_refcount_funcs[] = {
78 &set_refcount_ro0,
79 &set_refcount_ro1,
80 &set_refcount_ro2,
81 &set_refcount_ro3,
82 &set_refcount_ro4,
83 &set_refcount_ro5,
84 &set_refcount_ro6
85 };
86
87
88 /*********************************************************/
89 /* refcount handling */
90
update_max_refcount_table_index(BDRVQcow2State * s)91 static void update_max_refcount_table_index(BDRVQcow2State *s)
92 {
93 unsigned i = s->refcount_table_size - 1;
94 while (i > 0 && (s->refcount_table[i] & REFT_OFFSET_MASK) == 0) {
95 i--;
96 }
97 /* Set s->max_refcount_table_index to the index of the last used entry */
98 s->max_refcount_table_index = i;
99 }
100
qcow2_refcount_init(BlockDriverState * bs)101 int coroutine_fn qcow2_refcount_init(BlockDriverState *bs)
102 {
103 BDRVQcow2State *s = bs->opaque;
104 unsigned int refcount_table_size2, i;
105 int ret;
106
107 assert(s->refcount_order >= 0 && s->refcount_order <= 6);
108
109 s->get_refcount = get_refcount_funcs[s->refcount_order];
110 s->set_refcount = set_refcount_funcs[s->refcount_order];
111
112 assert(s->refcount_table_size <= INT_MAX / REFTABLE_ENTRY_SIZE);
113 refcount_table_size2 = s->refcount_table_size * REFTABLE_ENTRY_SIZE;
114 s->refcount_table = g_try_malloc(refcount_table_size2);
115
116 if (s->refcount_table_size > 0) {
117 if (s->refcount_table == NULL) {
118 ret = -ENOMEM;
119 goto fail;
120 }
121 BLKDBG_CO_EVENT(bs->file, BLKDBG_REFTABLE_LOAD);
122 ret = bdrv_co_pread(bs->file, s->refcount_table_offset,
123 refcount_table_size2, s->refcount_table, 0);
124 if (ret < 0) {
125 goto fail;
126 }
127 for(i = 0; i < s->refcount_table_size; i++)
128 be64_to_cpus(&s->refcount_table[i]);
129 update_max_refcount_table_index(s);
130 }
131 return 0;
132 fail:
133 return ret;
134 }
135
qcow2_refcount_close(BlockDriverState * bs)136 void qcow2_refcount_close(BlockDriverState *bs)
137 {
138 BDRVQcow2State *s = bs->opaque;
139 g_free(s->refcount_table);
140 }
141
142
get_refcount_ro0(const void * refcount_array,uint64_t index)143 static uint64_t get_refcount_ro0(const void *refcount_array, uint64_t index)
144 {
145 return (((const uint8_t *)refcount_array)[index / 8] >> (index % 8)) & 0x1;
146 }
147
set_refcount_ro0(void * refcount_array,uint64_t index,uint64_t value)148 static void set_refcount_ro0(void *refcount_array, uint64_t index,
149 uint64_t value)
150 {
151 assert(!(value >> 1));
152 ((uint8_t *)refcount_array)[index / 8] &= ~(0x1 << (index % 8));
153 ((uint8_t *)refcount_array)[index / 8] |= value << (index % 8);
154 }
155
get_refcount_ro1(const void * refcount_array,uint64_t index)156 static uint64_t get_refcount_ro1(const void *refcount_array, uint64_t index)
157 {
158 return (((const uint8_t *)refcount_array)[index / 4] >> (2 * (index % 4)))
159 & 0x3;
160 }
161
set_refcount_ro1(void * refcount_array,uint64_t index,uint64_t value)162 static void set_refcount_ro1(void *refcount_array, uint64_t index,
163 uint64_t value)
164 {
165 assert(!(value >> 2));
166 ((uint8_t *)refcount_array)[index / 4] &= ~(0x3 << (2 * (index % 4)));
167 ((uint8_t *)refcount_array)[index / 4] |= value << (2 * (index % 4));
168 }
169
get_refcount_ro2(const void * refcount_array,uint64_t index)170 static uint64_t get_refcount_ro2(const void *refcount_array, uint64_t index)
171 {
172 return (((const uint8_t *)refcount_array)[index / 2] >> (4 * (index % 2)))
173 & 0xf;
174 }
175
set_refcount_ro2(void * refcount_array,uint64_t index,uint64_t value)176 static void set_refcount_ro2(void *refcount_array, uint64_t index,
177 uint64_t value)
178 {
179 assert(!(value >> 4));
180 ((uint8_t *)refcount_array)[index / 2] &= ~(0xf << (4 * (index % 2)));
181 ((uint8_t *)refcount_array)[index / 2] |= value << (4 * (index % 2));
182 }
183
get_refcount_ro3(const void * refcount_array,uint64_t index)184 static uint64_t get_refcount_ro3(const void *refcount_array, uint64_t index)
185 {
186 return ((const uint8_t *)refcount_array)[index];
187 }
188
set_refcount_ro3(void * refcount_array,uint64_t index,uint64_t value)189 static void set_refcount_ro3(void *refcount_array, uint64_t index,
190 uint64_t value)
191 {
192 assert(!(value >> 8));
193 ((uint8_t *)refcount_array)[index] = value;
194 }
195
get_refcount_ro4(const void * refcount_array,uint64_t index)196 static uint64_t get_refcount_ro4(const void *refcount_array, uint64_t index)
197 {
198 return be16_to_cpu(((const uint16_t *)refcount_array)[index]);
199 }
200
set_refcount_ro4(void * refcount_array,uint64_t index,uint64_t value)201 static void set_refcount_ro4(void *refcount_array, uint64_t index,
202 uint64_t value)
203 {
204 assert(!(value >> 16));
205 ((uint16_t *)refcount_array)[index] = cpu_to_be16(value);
206 }
207
get_refcount_ro5(const void * refcount_array,uint64_t index)208 static uint64_t get_refcount_ro5(const void *refcount_array, uint64_t index)
209 {
210 return be32_to_cpu(((const uint32_t *)refcount_array)[index]);
211 }
212
set_refcount_ro5(void * refcount_array,uint64_t index,uint64_t value)213 static void set_refcount_ro5(void *refcount_array, uint64_t index,
214 uint64_t value)
215 {
216 assert(!(value >> 32));
217 ((uint32_t *)refcount_array)[index] = cpu_to_be32(value);
218 }
219
get_refcount_ro6(const void * refcount_array,uint64_t index)220 static uint64_t get_refcount_ro6(const void *refcount_array, uint64_t index)
221 {
222 return be64_to_cpu(((const uint64_t *)refcount_array)[index]);
223 }
224
set_refcount_ro6(void * refcount_array,uint64_t index,uint64_t value)225 static void set_refcount_ro6(void *refcount_array, uint64_t index,
226 uint64_t value)
227 {
228 ((uint64_t *)refcount_array)[index] = cpu_to_be64(value);
229 }
230
231
232 static int GRAPH_RDLOCK
load_refcount_block(BlockDriverState * bs,int64_t refcount_block_offset,void ** refcount_block)233 load_refcount_block(BlockDriverState *bs, int64_t refcount_block_offset,
234 void **refcount_block)
235 {
236 BDRVQcow2State *s = bs->opaque;
237
238 BLKDBG_EVENT(bs->file, BLKDBG_REFBLOCK_LOAD);
239 return qcow2_cache_get(bs, s->refcount_block_cache, refcount_block_offset,
240 refcount_block);
241 }
242
243 /*
244 * Retrieves the refcount of the cluster given by its index and stores it in
245 * *refcount. Returns 0 on success and -errno on failure.
246 */
qcow2_get_refcount(BlockDriverState * bs,int64_t cluster_index,uint64_t * refcount)247 int qcow2_get_refcount(BlockDriverState *bs, int64_t cluster_index,
248 uint64_t *refcount)
249 {
250 BDRVQcow2State *s = bs->opaque;
251 uint64_t refcount_table_index, block_index;
252 int64_t refcount_block_offset;
253 int ret;
254 void *refcount_block;
255
256 refcount_table_index = cluster_index >> s->refcount_block_bits;
257 if (refcount_table_index >= s->refcount_table_size) {
258 *refcount = 0;
259 return 0;
260 }
261 refcount_block_offset =
262 s->refcount_table[refcount_table_index] & REFT_OFFSET_MASK;
263 if (!refcount_block_offset) {
264 *refcount = 0;
265 return 0;
266 }
267
268 if (offset_into_cluster(s, refcount_block_offset)) {
269 qcow2_signal_corruption(bs, true, -1, -1, "Refblock offset %#" PRIx64
270 " unaligned (reftable index: %#" PRIx64 ")",
271 refcount_block_offset, refcount_table_index);
272 return -EIO;
273 }
274
275 ret = qcow2_cache_get(bs, s->refcount_block_cache, refcount_block_offset,
276 &refcount_block);
277 if (ret < 0) {
278 return ret;
279 }
280
281 block_index = cluster_index & (s->refcount_block_size - 1);
282 *refcount = s->get_refcount(refcount_block, block_index);
283
284 qcow2_cache_put(s->refcount_block_cache, &refcount_block);
285
286 return 0;
287 }
288
289 /* Checks if two offsets are described by the same refcount block */
in_same_refcount_block(BDRVQcow2State * s,uint64_t offset_a,uint64_t offset_b)290 static int in_same_refcount_block(BDRVQcow2State *s, uint64_t offset_a,
291 uint64_t offset_b)
292 {
293 uint64_t block_a = offset_a >> (s->cluster_bits + s->refcount_block_bits);
294 uint64_t block_b = offset_b >> (s->cluster_bits + s->refcount_block_bits);
295
296 return (block_a == block_b);
297 }
298
299 /*
300 * Loads a refcount block. If it doesn't exist yet, it is allocated first
301 * (including growing the refcount table if needed).
302 *
303 * Returns 0 on success or -errno in error case
304 */
305 static int GRAPH_RDLOCK
alloc_refcount_block(BlockDriverState * bs,int64_t cluster_index,void ** refcount_block)306 alloc_refcount_block(BlockDriverState *bs, int64_t cluster_index,
307 void **refcount_block)
308 {
309 BDRVQcow2State *s = bs->opaque;
310 unsigned int refcount_table_index;
311 int64_t ret;
312
313 BLKDBG_EVENT(bs->file, BLKDBG_REFBLOCK_ALLOC);
314
315 /* Find the refcount block for the given cluster */
316 refcount_table_index = cluster_index >> s->refcount_block_bits;
317
318 if (refcount_table_index < s->refcount_table_size) {
319
320 uint64_t refcount_block_offset =
321 s->refcount_table[refcount_table_index] & REFT_OFFSET_MASK;
322
323 /* If it's already there, we're done */
324 if (refcount_block_offset) {
325 if (offset_into_cluster(s, refcount_block_offset)) {
326 qcow2_signal_corruption(bs, true, -1, -1, "Refblock offset %#"
327 PRIx64 " unaligned (reftable index: "
328 "%#x)", refcount_block_offset,
329 refcount_table_index);
330 return -EIO;
331 }
332
333 return load_refcount_block(bs, refcount_block_offset,
334 refcount_block);
335 }
336 }
337
338 /*
339 * If we came here, we need to allocate something. Something is at least
340 * a cluster for the new refcount block. It may also include a new refcount
341 * table if the old refcount table is too small.
342 *
343 * Note that allocating clusters here needs some special care:
344 *
345 * - We can't use the normal qcow2_alloc_clusters(), it would try to
346 * increase the refcount and very likely we would end up with an endless
347 * recursion. Instead we must place the refcount blocks in a way that
348 * they can describe them themselves.
349 *
350 * - We need to consider that at this point we are inside update_refcounts
351 * and potentially doing an initial refcount increase. This means that
352 * some clusters have already been allocated by the caller, but their
353 * refcount isn't accurate yet. If we allocate clusters for metadata, we
354 * need to return -EAGAIN to signal the caller that it needs to restart
355 * the search for free clusters.
356 *
357 * - alloc_clusters_noref and qcow2_free_clusters may load a different
358 * refcount block into the cache
359 */
360
361 *refcount_block = NULL;
362
363 /* We write to the refcount table, so we might depend on L2 tables */
364 ret = qcow2_cache_flush(bs, s->l2_table_cache);
365 if (ret < 0) {
366 return ret;
367 }
368
369 /* Allocate the refcount block itself and mark it as used */
370 int64_t new_block = alloc_clusters_noref(bs, s->cluster_size, INT64_MAX);
371 if (new_block < 0) {
372 return new_block;
373 }
374
375 /* The offset must fit in the offset field of the refcount table entry */
376 assert((new_block & REFT_OFFSET_MASK) == new_block);
377
378 /* If we're allocating the block at offset 0 then something is wrong */
379 if (new_block == 0) {
380 qcow2_signal_corruption(bs, true, -1, -1, "Preventing invalid "
381 "allocation of refcount block at offset 0");
382 return -EIO;
383 }
384
385 #ifdef DEBUG_ALLOC2
386 fprintf(stderr, "qcow2: Allocate refcount block %d for %" PRIx64
387 " at %" PRIx64 "\n",
388 refcount_table_index, cluster_index << s->cluster_bits, new_block);
389 #endif
390
391 if (in_same_refcount_block(s, new_block, cluster_index << s->cluster_bits)) {
392 /* Zero the new refcount block before updating it */
393 ret = qcow2_cache_get_empty(bs, s->refcount_block_cache, new_block,
394 refcount_block);
395 if (ret < 0) {
396 goto fail;
397 }
398
399 memset(*refcount_block, 0, s->cluster_size);
400
401 /* The block describes itself, need to update the cache */
402 int block_index = (new_block >> s->cluster_bits) &
403 (s->refcount_block_size - 1);
404 s->set_refcount(*refcount_block, block_index, 1);
405 } else {
406 /* Described somewhere else. This can recurse at most twice before we
407 * arrive at a block that describes itself. */
408 ret = update_refcount(bs, new_block, s->cluster_size, 1, false,
409 QCOW2_DISCARD_NEVER);
410 if (ret < 0) {
411 goto fail;
412 }
413
414 ret = qcow2_cache_flush(bs, s->refcount_block_cache);
415 if (ret < 0) {
416 goto fail;
417 }
418
419 /* Initialize the new refcount block only after updating its refcount,
420 * update_refcount uses the refcount cache itself */
421 ret = qcow2_cache_get_empty(bs, s->refcount_block_cache, new_block,
422 refcount_block);
423 if (ret < 0) {
424 goto fail;
425 }
426
427 memset(*refcount_block, 0, s->cluster_size);
428 }
429
430 /* Now the new refcount block needs to be written to disk */
431 BLKDBG_EVENT(bs->file, BLKDBG_REFBLOCK_ALLOC_WRITE);
432 qcow2_cache_entry_mark_dirty(s->refcount_block_cache, *refcount_block);
433 ret = qcow2_cache_flush(bs, s->refcount_block_cache);
434 if (ret < 0) {
435 goto fail;
436 }
437
438 /* If the refcount table is big enough, just hook the block up there */
439 if (refcount_table_index < s->refcount_table_size) {
440 uint64_t data64 = cpu_to_be64(new_block);
441 BLKDBG_EVENT(bs->file, BLKDBG_REFBLOCK_ALLOC_HOOKUP);
442 ret = bdrv_pwrite_sync(bs->file, s->refcount_table_offset +
443 refcount_table_index * REFTABLE_ENTRY_SIZE,
444 sizeof(data64), &data64, 0);
445 if (ret < 0) {
446 goto fail;
447 }
448
449 s->refcount_table[refcount_table_index] = new_block;
450 /* If there's a hole in s->refcount_table then it can happen
451 * that refcount_table_index < s->max_refcount_table_index */
452 s->max_refcount_table_index =
453 MAX(s->max_refcount_table_index, refcount_table_index);
454
455 /* The new refcount block may be where the caller intended to put its
456 * data, so let it restart the search. */
457 return -EAGAIN;
458 }
459
460 qcow2_cache_put(s->refcount_block_cache, refcount_block);
461
462 /*
463 * If we come here, we need to grow the refcount table. Again, a new
464 * refcount table needs some space and we can't simply allocate to avoid
465 * endless recursion.
466 *
467 * Therefore let's grab new refcount blocks at the end of the image, which
468 * will describe themselves and the new refcount table. This way we can
469 * reference them only in the new table and do the switch to the new
470 * refcount table at once without producing an inconsistent state in
471 * between.
472 */
473 BLKDBG_EVENT(bs->file, BLKDBG_REFTABLE_GROW);
474
475 /* Calculate the number of refcount blocks needed so far; this will be the
476 * basis for calculating the index of the first cluster used for the
477 * self-describing refcount structures which we are about to create.
478 *
479 * Because we reached this point, there cannot be any refcount entries for
480 * cluster_index or higher indices yet. However, because new_block has been
481 * allocated to describe that cluster (and it will assume this role later
482 * on), we cannot use that index; also, new_block may actually have a higher
483 * cluster index than cluster_index, so it needs to be taken into account
484 * here (and 1 needs to be added to its value because that cluster is used).
485 */
486 uint64_t blocks_used = DIV_ROUND_UP(MAX(cluster_index + 1,
487 (new_block >> s->cluster_bits) + 1),
488 s->refcount_block_size);
489
490 /* Create the new refcount table and blocks */
491 uint64_t meta_offset = (blocks_used * s->refcount_block_size) *
492 s->cluster_size;
493
494 ret = qcow2_refcount_area(bs, meta_offset, 0, false,
495 refcount_table_index, new_block);
496 if (ret < 0) {
497 return ret;
498 }
499
500 ret = load_refcount_block(bs, new_block, refcount_block);
501 if (ret < 0) {
502 return ret;
503 }
504
505 /* If we were trying to do the initial refcount update for some cluster
506 * allocation, we might have used the same clusters to store newly
507 * allocated metadata. Make the caller search some new space. */
508 return -EAGAIN;
509
510 fail:
511 if (*refcount_block != NULL) {
512 qcow2_cache_put(s->refcount_block_cache, refcount_block);
513 }
514 return ret;
515 }
516
517 /*
518 * Starting at @start_offset, this function creates new self-covering refcount
519 * structures: A new refcount table and refcount blocks which cover all of
520 * themselves, and a number of @additional_clusters beyond their end.
521 * @start_offset must be at the end of the image file, that is, there must be
522 * only empty space beyond it.
523 * If @exact_size is false, the refcount table will have 50 % more entries than
524 * necessary so it will not need to grow again soon.
525 * If @new_refblock_offset is not zero, it contains the offset of a refcount
526 * block that should be entered into the new refcount table at index
527 * @new_refblock_index.
528 *
529 * Returns: The offset after the new refcount structures (i.e. where the
530 * @additional_clusters may be placed) on success, -errno on error.
531 */
qcow2_refcount_area(BlockDriverState * bs,uint64_t start_offset,uint64_t additional_clusters,bool exact_size,int new_refblock_index,uint64_t new_refblock_offset)532 int64_t qcow2_refcount_area(BlockDriverState *bs, uint64_t start_offset,
533 uint64_t additional_clusters, bool exact_size,
534 int new_refblock_index,
535 uint64_t new_refblock_offset)
536 {
537 BDRVQcow2State *s = bs->opaque;
538 uint64_t total_refblock_count_u64, additional_refblock_count;
539 int total_refblock_count, table_size, area_reftable_index, table_clusters;
540 int i;
541 uint64_t table_offset, block_offset, end_offset;
542 int ret;
543 uint64_t *new_table;
544
545 assert(!(start_offset % s->cluster_size));
546
547 qcow2_refcount_metadata_size(start_offset / s->cluster_size +
548 additional_clusters,
549 s->cluster_size, s->refcount_order,
550 !exact_size, &total_refblock_count_u64);
551 if (total_refblock_count_u64 > QCOW_MAX_REFTABLE_SIZE) {
552 return -EFBIG;
553 }
554 total_refblock_count = total_refblock_count_u64;
555
556 /* Index in the refcount table of the first refcount block to cover the area
557 * of refcount structures we are about to create; we know that
558 * @total_refblock_count can cover @start_offset, so this will definitely
559 * fit into an int. */
560 area_reftable_index = (start_offset / s->cluster_size) /
561 s->refcount_block_size;
562
563 if (exact_size) {
564 table_size = total_refblock_count;
565 } else {
566 table_size = total_refblock_count +
567 DIV_ROUND_UP(total_refblock_count, 2);
568 }
569 /* The qcow2 file can only store the reftable size in number of clusters */
570 table_size = ROUND_UP(table_size, s->cluster_size / REFTABLE_ENTRY_SIZE);
571 table_clusters = (table_size * REFTABLE_ENTRY_SIZE) / s->cluster_size;
572
573 if (table_size > QCOW_MAX_REFTABLE_SIZE) {
574 return -EFBIG;
575 }
576
577 new_table = g_try_new0(uint64_t, table_size);
578
579 assert(table_size > 0);
580 if (new_table == NULL) {
581 ret = -ENOMEM;
582 goto fail;
583 }
584
585 /* Fill the new refcount table */
586 if (table_size > s->max_refcount_table_index) {
587 /* We're actually growing the reftable */
588 memcpy(new_table, s->refcount_table,
589 (s->max_refcount_table_index + 1) * REFTABLE_ENTRY_SIZE);
590 } else {
591 /* Improbable case: We're shrinking the reftable. However, the caller
592 * has assured us that there is only empty space beyond @start_offset,
593 * so we can simply drop all of the refblocks that won't fit into the
594 * new reftable. */
595 memcpy(new_table, s->refcount_table, table_size * REFTABLE_ENTRY_SIZE);
596 }
597
598 if (new_refblock_offset) {
599 assert(new_refblock_index < total_refblock_count);
600 new_table[new_refblock_index] = new_refblock_offset;
601 }
602
603 /* Count how many new refblocks we have to create */
604 additional_refblock_count = 0;
605 for (i = area_reftable_index; i < total_refblock_count; i++) {
606 if (!new_table[i]) {
607 additional_refblock_count++;
608 }
609 }
610
611 table_offset = start_offset + additional_refblock_count * s->cluster_size;
612 end_offset = table_offset + table_clusters * s->cluster_size;
613
614 /* Fill the refcount blocks, and create new ones, if necessary */
615 block_offset = start_offset;
616 for (i = area_reftable_index; i < total_refblock_count; i++) {
617 void *refblock_data;
618 uint64_t first_offset_covered;
619
620 /* Reuse an existing refblock if possible, create a new one otherwise */
621 if (new_table[i]) {
622 ret = qcow2_cache_get(bs, s->refcount_block_cache, new_table[i],
623 &refblock_data);
624 if (ret < 0) {
625 goto fail;
626 }
627 } else {
628 ret = qcow2_cache_get_empty(bs, s->refcount_block_cache,
629 block_offset, &refblock_data);
630 if (ret < 0) {
631 goto fail;
632 }
633 memset(refblock_data, 0, s->cluster_size);
634 qcow2_cache_entry_mark_dirty(s->refcount_block_cache,
635 refblock_data);
636
637 new_table[i] = block_offset;
638 block_offset += s->cluster_size;
639 }
640
641 /* First host offset covered by this refblock */
642 first_offset_covered = (uint64_t)i * s->refcount_block_size *
643 s->cluster_size;
644 if (first_offset_covered < end_offset) {
645 int j, end_index;
646
647 /* Set the refcount of all of the new refcount structures to 1 */
648
649 if (first_offset_covered < start_offset) {
650 assert(i == area_reftable_index);
651 j = (start_offset - first_offset_covered) / s->cluster_size;
652 assert(j < s->refcount_block_size);
653 } else {
654 j = 0;
655 }
656
657 end_index = MIN((end_offset - first_offset_covered) /
658 s->cluster_size,
659 s->refcount_block_size);
660
661 for (; j < end_index; j++) {
662 /* The caller guaranteed us this space would be empty */
663 assert(s->get_refcount(refblock_data, j) == 0);
664 s->set_refcount(refblock_data, j, 1);
665 }
666
667 qcow2_cache_entry_mark_dirty(s->refcount_block_cache,
668 refblock_data);
669 }
670
671 qcow2_cache_put(s->refcount_block_cache, &refblock_data);
672 }
673
674 assert(block_offset == table_offset);
675
676 /* Write refcount blocks to disk */
677 BLKDBG_EVENT(bs->file, BLKDBG_REFBLOCK_ALLOC_WRITE_BLOCKS);
678 ret = qcow2_cache_flush(bs, s->refcount_block_cache);
679 if (ret < 0) {
680 goto fail;
681 }
682
683 /* Write refcount table to disk */
684 for (i = 0; i < total_refblock_count; i++) {
685 cpu_to_be64s(&new_table[i]);
686 }
687
688 BLKDBG_EVENT(bs->file, BLKDBG_REFBLOCK_ALLOC_WRITE_TABLE);
689 ret = bdrv_pwrite_sync(bs->file, table_offset,
690 table_size * REFTABLE_ENTRY_SIZE, new_table, 0);
691 if (ret < 0) {
692 goto fail;
693 }
694
695 for (i = 0; i < total_refblock_count; i++) {
696 be64_to_cpus(&new_table[i]);
697 }
698
699 /* Hook up the new refcount table in the qcow2 header */
700 struct QEMU_PACKED {
701 uint64_t d64;
702 uint32_t d32;
703 } data;
704 data.d64 = cpu_to_be64(table_offset);
705 data.d32 = cpu_to_be32(table_clusters);
706 BLKDBG_EVENT(bs->file, BLKDBG_REFBLOCK_ALLOC_SWITCH_TABLE);
707 ret = bdrv_pwrite_sync(bs->file,
708 offsetof(QCowHeader, refcount_table_offset),
709 sizeof(data), &data, 0);
710 if (ret < 0) {
711 goto fail;
712 }
713
714 /* And switch it in memory */
715 uint64_t old_table_offset = s->refcount_table_offset;
716 uint64_t old_table_size = s->refcount_table_size;
717
718 g_free(s->refcount_table);
719 s->refcount_table = new_table;
720 s->refcount_table_size = table_size;
721 s->refcount_table_offset = table_offset;
722 update_max_refcount_table_index(s);
723
724 /* Free old table. */
725 qcow2_free_clusters(bs, old_table_offset,
726 old_table_size * REFTABLE_ENTRY_SIZE,
727 QCOW2_DISCARD_OTHER);
728
729 return end_offset;
730
731 fail:
732 g_free(new_table);
733 return ret;
734 }
735
qcow2_process_discards(BlockDriverState * bs,int ret)736 void qcow2_process_discards(BlockDriverState *bs, int ret)
737 {
738 BDRVQcow2State *s = bs->opaque;
739 Qcow2DiscardRegion *d, *next;
740
741 QTAILQ_FOREACH_SAFE(d, &s->discards, next, next) {
742 QTAILQ_REMOVE(&s->discards, d, next);
743
744 /* Discard is optional, ignore the return value */
745 if (ret >= 0) {
746 int r2 = bdrv_pdiscard(bs->file, d->offset, d->bytes);
747 if (r2 < 0) {
748 trace_qcow2_process_discards_failed_region(d->offset, d->bytes,
749 r2);
750 }
751 }
752
753 g_free(d);
754 }
755 }
756
update_refcount_discard(BlockDriverState * bs,uint64_t offset,uint64_t length)757 static void update_refcount_discard(BlockDriverState *bs,
758 uint64_t offset, uint64_t length)
759 {
760 BDRVQcow2State *s = bs->opaque;
761 Qcow2DiscardRegion *d, *p, *next;
762
763 QTAILQ_FOREACH(d, &s->discards, next) {
764 uint64_t new_start = MIN(offset, d->offset);
765 uint64_t new_end = MAX(offset + length, d->offset + d->bytes);
766
767 if (new_end - new_start <= length + d->bytes) {
768 /* There can't be any overlap, areas ending up here have no
769 * references any more and therefore shouldn't get freed another
770 * time. */
771 assert(d->bytes + length == new_end - new_start);
772 d->offset = new_start;
773 d->bytes = new_end - new_start;
774 goto found;
775 }
776 }
777
778 d = g_malloc(sizeof(*d));
779 *d = (Qcow2DiscardRegion) {
780 .bs = bs,
781 .offset = offset,
782 .bytes = length,
783 };
784 QTAILQ_INSERT_TAIL(&s->discards, d, next);
785
786 found:
787 /* Merge discard requests if they are adjacent now */
788 QTAILQ_FOREACH_SAFE(p, &s->discards, next, next) {
789 if (p == d
790 || p->offset > d->offset + d->bytes
791 || d->offset > p->offset + p->bytes)
792 {
793 continue;
794 }
795
796 /* Still no overlap possible */
797 assert(p->offset == d->offset + d->bytes
798 || d->offset == p->offset + p->bytes);
799
800 QTAILQ_REMOVE(&s->discards, p, next);
801 d->offset = MIN(d->offset, p->offset);
802 d->bytes += p->bytes;
803 g_free(p);
804 }
805 }
806
807 /* XXX: cache several refcount block clusters ? */
808 /* @addend is the absolute value of the addend; if @decrease is set, @addend
809 * will be subtracted from the current refcount, otherwise it will be added */
810 static int GRAPH_RDLOCK
update_refcount(BlockDriverState * bs,int64_t offset,int64_t length,uint64_t addend,bool decrease,enum qcow2_discard_type type)811 update_refcount(BlockDriverState *bs, int64_t offset, int64_t length,
812 uint64_t addend, bool decrease, enum qcow2_discard_type type)
813 {
814 BDRVQcow2State *s = bs->opaque;
815 int64_t start, last, cluster_offset;
816 void *refcount_block = NULL;
817 int64_t old_table_index = -1;
818 int ret;
819
820 #ifdef DEBUG_ALLOC2
821 fprintf(stderr, "update_refcount: offset=%" PRId64 " size=%" PRId64
822 " addend=%s%" PRIu64 "\n", offset, length, decrease ? "-" : "",
823 addend);
824 #endif
825 if (length < 0) {
826 return -EINVAL;
827 } else if (length == 0) {
828 return 0;
829 }
830
831 if (decrease) {
832 qcow2_cache_set_dependency(bs, s->refcount_block_cache,
833 s->l2_table_cache);
834 }
835
836 start = start_of_cluster(s, offset);
837 last = start_of_cluster(s, offset + length - 1);
838 for(cluster_offset = start; cluster_offset <= last;
839 cluster_offset += s->cluster_size)
840 {
841 int block_index;
842 uint64_t refcount;
843 int64_t cluster_index = cluster_offset >> s->cluster_bits;
844 int64_t table_index = cluster_index >> s->refcount_block_bits;
845
846 /* Load the refcount block and allocate it if needed */
847 if (table_index != old_table_index) {
848 if (refcount_block) {
849 qcow2_cache_put(s->refcount_block_cache, &refcount_block);
850 }
851 ret = alloc_refcount_block(bs, cluster_index, &refcount_block);
852 /* If the caller needs to restart the search for free clusters,
853 * try the same ones first to see if they're still free. */
854 if (ret == -EAGAIN) {
855 if (s->free_cluster_index > (start >> s->cluster_bits)) {
856 s->free_cluster_index = (start >> s->cluster_bits);
857 }
858 }
859 if (ret < 0) {
860 goto fail;
861 }
862 }
863 old_table_index = table_index;
864
865 qcow2_cache_entry_mark_dirty(s->refcount_block_cache, refcount_block);
866
867 /* we can update the count and save it */
868 block_index = cluster_index & (s->refcount_block_size - 1);
869
870 refcount = s->get_refcount(refcount_block, block_index);
871 if (decrease ? (refcount - addend > refcount)
872 : (refcount + addend < refcount ||
873 refcount + addend > s->refcount_max))
874 {
875 ret = -EINVAL;
876 goto fail;
877 }
878 if (decrease) {
879 refcount -= addend;
880 } else {
881 refcount += addend;
882 }
883 if (refcount == 0 && cluster_index < s->free_cluster_index) {
884 s->free_cluster_index = cluster_index;
885 }
886 s->set_refcount(refcount_block, block_index, refcount);
887
888 if (refcount == 0) {
889 void *table;
890
891 table = qcow2_cache_is_table_offset(s->refcount_block_cache,
892 offset);
893 if (table != NULL) {
894 qcow2_cache_put(s->refcount_block_cache, &refcount_block);
895 old_table_index = -1;
896 qcow2_cache_discard(s->refcount_block_cache, table);
897 }
898
899 table = qcow2_cache_is_table_offset(s->l2_table_cache, offset);
900 if (table != NULL) {
901 qcow2_cache_discard(s->l2_table_cache, table);
902 }
903
904 if (s->discard_passthrough[type]) {
905 update_refcount_discard(bs, cluster_offset, s->cluster_size);
906 }
907 }
908 }
909
910 ret = 0;
911 fail:
912 if (!s->cache_discards) {
913 qcow2_process_discards(bs, ret);
914 }
915
916 /* Write last changed block to disk */
917 if (refcount_block) {
918 qcow2_cache_put(s->refcount_block_cache, &refcount_block);
919 }
920
921 /*
922 * Try do undo any updates if an error is returned (This may succeed in
923 * some cases like ENOSPC for allocating a new refcount block)
924 */
925 if (ret < 0) {
926 int dummy;
927 dummy = update_refcount(bs, offset, cluster_offset - offset, addend,
928 !decrease, QCOW2_DISCARD_NEVER);
929 (void)dummy;
930 }
931
932 return ret;
933 }
934
935 /*
936 * Increases or decreases the refcount of a given cluster.
937 *
938 * @addend is the absolute value of the addend; if @decrease is set, @addend
939 * will be subtracted from the current refcount, otherwise it will be added.
940 *
941 * On success 0 is returned; on failure -errno is returned.
942 */
qcow2_update_cluster_refcount(BlockDriverState * bs,int64_t cluster_index,uint64_t addend,bool decrease,enum qcow2_discard_type type)943 int qcow2_update_cluster_refcount(BlockDriverState *bs,
944 int64_t cluster_index,
945 uint64_t addend, bool decrease,
946 enum qcow2_discard_type type)
947 {
948 BDRVQcow2State *s = bs->opaque;
949 int ret;
950
951 ret = update_refcount(bs, cluster_index << s->cluster_bits, 1, addend,
952 decrease, type);
953 if (ret < 0) {
954 return ret;
955 }
956
957 return 0;
958 }
959
960
961
962 /*********************************************************/
963 /* cluster allocation functions */
964
965
966
967 /* return < 0 if error */
968 static int64_t GRAPH_RDLOCK
alloc_clusters_noref(BlockDriverState * bs,uint64_t size,uint64_t max)969 alloc_clusters_noref(BlockDriverState *bs, uint64_t size, uint64_t max)
970 {
971 BDRVQcow2State *s = bs->opaque;
972 uint64_t i, nb_clusters, refcount;
973 int ret;
974
975 /* We can't allocate clusters if they may still be queued for discard. */
976 if (s->cache_discards) {
977 qcow2_process_discards(bs, 0);
978 }
979
980 nb_clusters = size_to_clusters(s, size);
981 retry:
982 for(i = 0; i < nb_clusters; i++) {
983 uint64_t next_cluster_index = s->free_cluster_index++;
984 ret = qcow2_get_refcount(bs, next_cluster_index, &refcount);
985
986 if (ret < 0) {
987 return ret;
988 } else if (refcount != 0) {
989 goto retry;
990 }
991 }
992
993 /* Make sure that all offsets in the "allocated" range are representable
994 * in the requested max */
995 if (s->free_cluster_index > 0 &&
996 s->free_cluster_index - 1 > (max >> s->cluster_bits))
997 {
998 return -EFBIG;
999 }
1000
1001 #ifdef DEBUG_ALLOC2
1002 fprintf(stderr, "alloc_clusters: size=%" PRId64 " -> %" PRId64 "\n",
1003 size,
1004 (s->free_cluster_index - nb_clusters) << s->cluster_bits);
1005 #endif
1006 return (s->free_cluster_index - nb_clusters) << s->cluster_bits;
1007 }
1008
qcow2_alloc_clusters(BlockDriverState * bs,uint64_t size)1009 int64_t qcow2_alloc_clusters(BlockDriverState *bs, uint64_t size)
1010 {
1011 int64_t offset;
1012 int ret;
1013
1014 BLKDBG_EVENT(bs->file, BLKDBG_CLUSTER_ALLOC);
1015 do {
1016 offset = alloc_clusters_noref(bs, size, QCOW_MAX_CLUSTER_OFFSET);
1017 if (offset < 0) {
1018 return offset;
1019 }
1020
1021 ret = update_refcount(bs, offset, size, 1, false, QCOW2_DISCARD_NEVER);
1022 } while (ret == -EAGAIN);
1023
1024 if (ret < 0) {
1025 return ret;
1026 }
1027
1028 return offset;
1029 }
1030
qcow2_alloc_clusters_at(BlockDriverState * bs,uint64_t offset,int64_t nb_clusters)1031 int64_t coroutine_fn qcow2_alloc_clusters_at(BlockDriverState *bs, uint64_t offset,
1032 int64_t nb_clusters)
1033 {
1034 BDRVQcow2State *s = bs->opaque;
1035 uint64_t cluster_index, refcount;
1036 uint64_t i;
1037 int ret;
1038
1039 assert(nb_clusters >= 0);
1040 if (nb_clusters == 0) {
1041 return 0;
1042 }
1043
1044 do {
1045 /* Check how many clusters there are free */
1046 cluster_index = offset >> s->cluster_bits;
1047 for(i = 0; i < nb_clusters; i++) {
1048 ret = qcow2_get_refcount(bs, cluster_index++, &refcount);
1049 if (ret < 0) {
1050 return ret;
1051 } else if (refcount != 0) {
1052 break;
1053 }
1054 }
1055
1056 /* And then allocate them */
1057 ret = update_refcount(bs, offset, i << s->cluster_bits, 1, false,
1058 QCOW2_DISCARD_NEVER);
1059 } while (ret == -EAGAIN);
1060
1061 if (ret < 0) {
1062 return ret;
1063 }
1064
1065 return i;
1066 }
1067
1068 /* only used to allocate compressed sectors. We try to allocate
1069 contiguous sectors. size must be <= cluster_size */
qcow2_alloc_bytes(BlockDriverState * bs,int size)1070 int64_t coroutine_fn GRAPH_RDLOCK qcow2_alloc_bytes(BlockDriverState *bs, int size)
1071 {
1072 BDRVQcow2State *s = bs->opaque;
1073 int64_t offset;
1074 size_t free_in_cluster;
1075 int ret;
1076
1077 BLKDBG_CO_EVENT(bs->file, BLKDBG_CLUSTER_ALLOC_BYTES);
1078 assert(size > 0 && size <= s->cluster_size);
1079 assert(!s->free_byte_offset || offset_into_cluster(s, s->free_byte_offset));
1080
1081 offset = s->free_byte_offset;
1082
1083 if (offset) {
1084 uint64_t refcount;
1085 ret = qcow2_get_refcount(bs, offset >> s->cluster_bits, &refcount);
1086 if (ret < 0) {
1087 return ret;
1088 }
1089
1090 if (refcount == s->refcount_max) {
1091 offset = 0;
1092 }
1093 }
1094
1095 free_in_cluster = s->cluster_size - offset_into_cluster(s, offset);
1096 do {
1097 if (!offset || free_in_cluster < size) {
1098 int64_t new_cluster;
1099
1100 new_cluster = alloc_clusters_noref(bs, s->cluster_size,
1101 MIN(s->cluster_offset_mask,
1102 QCOW_MAX_CLUSTER_OFFSET));
1103 if (new_cluster < 0) {
1104 return new_cluster;
1105 }
1106
1107 if (new_cluster == 0) {
1108 qcow2_signal_corruption(bs, true, -1, -1, "Preventing invalid "
1109 "allocation of compressed cluster "
1110 "at offset 0");
1111 return -EIO;
1112 }
1113
1114 if (!offset || ROUND_UP(offset, s->cluster_size) != new_cluster) {
1115 offset = new_cluster;
1116 free_in_cluster = s->cluster_size;
1117 } else {
1118 free_in_cluster += s->cluster_size;
1119 }
1120 }
1121
1122 assert(offset);
1123 ret = update_refcount(bs, offset, size, 1, false, QCOW2_DISCARD_NEVER);
1124 if (ret < 0) {
1125 offset = 0;
1126 }
1127 } while (ret == -EAGAIN);
1128 if (ret < 0) {
1129 return ret;
1130 }
1131
1132 /* The cluster refcount was incremented; refcount blocks must be flushed
1133 * before the caller's L2 table updates. */
1134 qcow2_cache_set_dependency(bs, s->l2_table_cache, s->refcount_block_cache);
1135
1136 s->free_byte_offset = offset + size;
1137 if (!offset_into_cluster(s, s->free_byte_offset)) {
1138 s->free_byte_offset = 0;
1139 }
1140
1141 return offset;
1142 }
1143
qcow2_free_clusters(BlockDriverState * bs,int64_t offset,int64_t size,enum qcow2_discard_type type)1144 void qcow2_free_clusters(BlockDriverState *bs,
1145 int64_t offset, int64_t size,
1146 enum qcow2_discard_type type)
1147 {
1148 int ret;
1149
1150 BLKDBG_EVENT(bs->file, BLKDBG_CLUSTER_FREE);
1151 ret = update_refcount(bs, offset, size, 1, true, type);
1152 if (ret < 0) {
1153 fprintf(stderr, "qcow2_free_clusters failed: %s\n", strerror(-ret));
1154 /* TODO Remember the clusters to free them later and avoid leaking */
1155 }
1156 }
1157
1158 /*
1159 * Free a cluster using its L2 entry (handles clusters of all types, e.g.
1160 * normal cluster, compressed cluster, etc.)
1161 */
qcow2_free_any_cluster(BlockDriverState * bs,uint64_t l2_entry,enum qcow2_discard_type type)1162 void qcow2_free_any_cluster(BlockDriverState *bs, uint64_t l2_entry,
1163 enum qcow2_discard_type type)
1164 {
1165 BDRVQcow2State *s = bs->opaque;
1166 QCow2ClusterType ctype = qcow2_get_cluster_type(bs, l2_entry);
1167
1168 if (has_data_file(bs)) {
1169 if (s->discard_passthrough[type] &&
1170 (ctype == QCOW2_CLUSTER_NORMAL ||
1171 ctype == QCOW2_CLUSTER_ZERO_ALLOC))
1172 {
1173 bdrv_pdiscard(s->data_file, l2_entry & L2E_OFFSET_MASK,
1174 s->cluster_size);
1175 }
1176 return;
1177 }
1178
1179 switch (ctype) {
1180 case QCOW2_CLUSTER_COMPRESSED:
1181 {
1182 uint64_t coffset;
1183 int csize;
1184
1185 qcow2_parse_compressed_l2_entry(bs, l2_entry, &coffset, &csize);
1186 qcow2_free_clusters(bs, coffset, csize, type);
1187 }
1188 break;
1189 case QCOW2_CLUSTER_NORMAL:
1190 case QCOW2_CLUSTER_ZERO_ALLOC:
1191 if (offset_into_cluster(s, l2_entry & L2E_OFFSET_MASK)) {
1192 qcow2_signal_corruption(bs, false, -1, -1,
1193 "Cannot free unaligned cluster %#llx",
1194 l2_entry & L2E_OFFSET_MASK);
1195 } else {
1196 qcow2_free_clusters(bs, l2_entry & L2E_OFFSET_MASK,
1197 s->cluster_size, type);
1198 }
1199 break;
1200 case QCOW2_CLUSTER_ZERO_PLAIN:
1201 case QCOW2_CLUSTER_UNALLOCATED:
1202 break;
1203 default:
1204 abort();
1205 }
1206 }
1207
qcow2_write_caches(BlockDriverState * bs)1208 int qcow2_write_caches(BlockDriverState *bs)
1209 {
1210 BDRVQcow2State *s = bs->opaque;
1211 int ret;
1212
1213 ret = qcow2_cache_write(bs, s->l2_table_cache);
1214 if (ret < 0) {
1215 return ret;
1216 }
1217
1218 if (qcow2_need_accurate_refcounts(s)) {
1219 ret = qcow2_cache_write(bs, s->refcount_block_cache);
1220 if (ret < 0) {
1221 return ret;
1222 }
1223 }
1224
1225 return 0;
1226 }
1227
qcow2_flush_caches(BlockDriverState * bs)1228 int qcow2_flush_caches(BlockDriverState *bs)
1229 {
1230 int ret = qcow2_write_caches(bs);
1231 if (ret < 0) {
1232 return ret;
1233 }
1234
1235 return bdrv_flush(bs->file->bs);
1236 }
1237
1238 /*********************************************************/
1239 /* snapshots and image creation */
1240
1241
1242
1243 /* update the refcounts of snapshots and the copied flag */
qcow2_update_snapshot_refcount(BlockDriverState * bs,int64_t l1_table_offset,int l1_size,int addend)1244 int qcow2_update_snapshot_refcount(BlockDriverState *bs,
1245 int64_t l1_table_offset, int l1_size, int addend)
1246 {
1247 BDRVQcow2State *s = bs->opaque;
1248 uint64_t *l1_table, *l2_slice, l2_offset, entry, l1_size2, refcount;
1249 bool l1_allocated = false;
1250 int64_t old_entry, old_l2_offset;
1251 unsigned slice, slice_size2, n_slices;
1252 int i, j, l1_modified = 0;
1253 int ret;
1254
1255 assert(addend >= -1 && addend <= 1);
1256
1257 l2_slice = NULL;
1258 l1_table = NULL;
1259 l1_size2 = l1_size * L1E_SIZE;
1260 slice_size2 = s->l2_slice_size * l2_entry_size(s);
1261 n_slices = s->cluster_size / slice_size2;
1262
1263 s->cache_discards = true;
1264
1265 /* WARNING: qcow2_snapshot_goto relies on this function not using the
1266 * l1_table_offset when it is the current s->l1_table_offset! Be careful
1267 * when changing this! */
1268 if (l1_table_offset != s->l1_table_offset) {
1269 l1_table = g_try_malloc0(l1_size2);
1270 if (l1_size2 && l1_table == NULL) {
1271 ret = -ENOMEM;
1272 goto fail;
1273 }
1274 l1_allocated = true;
1275
1276 ret = bdrv_pread(bs->file, l1_table_offset, l1_size2, l1_table, 0);
1277 if (ret < 0) {
1278 goto fail;
1279 }
1280
1281 for (i = 0; i < l1_size; i++) {
1282 be64_to_cpus(&l1_table[i]);
1283 }
1284 } else {
1285 assert(l1_size == s->l1_size);
1286 l1_table = s->l1_table;
1287 l1_allocated = false;
1288 }
1289
1290 for (i = 0; i < l1_size; i++) {
1291 l2_offset = l1_table[i];
1292 if (l2_offset) {
1293 old_l2_offset = l2_offset;
1294 l2_offset &= L1E_OFFSET_MASK;
1295
1296 if (offset_into_cluster(s, l2_offset)) {
1297 qcow2_signal_corruption(bs, true, -1, -1, "L2 table offset %#"
1298 PRIx64 " unaligned (L1 index: %#x)",
1299 l2_offset, i);
1300 ret = -EIO;
1301 goto fail;
1302 }
1303
1304 for (slice = 0; slice < n_slices; slice++) {
1305 ret = qcow2_cache_get(bs, s->l2_table_cache,
1306 l2_offset + slice * slice_size2,
1307 (void **) &l2_slice);
1308 if (ret < 0) {
1309 goto fail;
1310 }
1311
1312 for (j = 0; j < s->l2_slice_size; j++) {
1313 uint64_t cluster_index;
1314 uint64_t offset;
1315
1316 entry = get_l2_entry(s, l2_slice, j);
1317 old_entry = entry;
1318 entry &= ~QCOW_OFLAG_COPIED;
1319 offset = entry & L2E_OFFSET_MASK;
1320
1321 switch (qcow2_get_cluster_type(bs, entry)) {
1322 case QCOW2_CLUSTER_COMPRESSED:
1323 if (addend != 0) {
1324 uint64_t coffset;
1325 int csize;
1326
1327 qcow2_parse_compressed_l2_entry(bs, entry,
1328 &coffset, &csize);
1329 ret = update_refcount(
1330 bs, coffset, csize,
1331 abs(addend), addend < 0,
1332 QCOW2_DISCARD_SNAPSHOT);
1333 if (ret < 0) {
1334 goto fail;
1335 }
1336 }
1337 /* compressed clusters are never modified */
1338 refcount = 2;
1339 break;
1340
1341 case QCOW2_CLUSTER_NORMAL:
1342 case QCOW2_CLUSTER_ZERO_ALLOC:
1343 if (offset_into_cluster(s, offset)) {
1344 /* Here l2_index means table (not slice) index */
1345 int l2_index = slice * s->l2_slice_size + j;
1346 qcow2_signal_corruption(
1347 bs, true, -1, -1, "Cluster "
1348 "allocation offset %#" PRIx64
1349 " unaligned (L2 offset: %#"
1350 PRIx64 ", L2 index: %#x)",
1351 offset, l2_offset, l2_index);
1352 ret = -EIO;
1353 goto fail;
1354 }
1355
1356 cluster_index = offset >> s->cluster_bits;
1357 assert(cluster_index);
1358 if (addend != 0) {
1359 ret = qcow2_update_cluster_refcount(
1360 bs, cluster_index, abs(addend), addend < 0,
1361 QCOW2_DISCARD_SNAPSHOT);
1362 if (ret < 0) {
1363 goto fail;
1364 }
1365 }
1366
1367 ret = qcow2_get_refcount(bs, cluster_index, &refcount);
1368 if (ret < 0) {
1369 goto fail;
1370 }
1371 break;
1372
1373 case QCOW2_CLUSTER_ZERO_PLAIN:
1374 case QCOW2_CLUSTER_UNALLOCATED:
1375 refcount = 0;
1376 break;
1377
1378 default:
1379 abort();
1380 }
1381
1382 if (refcount == 1) {
1383 entry |= QCOW_OFLAG_COPIED;
1384 }
1385 if (entry != old_entry) {
1386 if (addend > 0) {
1387 qcow2_cache_set_dependency(bs, s->l2_table_cache,
1388 s->refcount_block_cache);
1389 }
1390 set_l2_entry(s, l2_slice, j, entry);
1391 qcow2_cache_entry_mark_dirty(s->l2_table_cache,
1392 l2_slice);
1393 }
1394 }
1395
1396 qcow2_cache_put(s->l2_table_cache, (void **) &l2_slice);
1397 }
1398
1399 if (addend != 0) {
1400 ret = qcow2_update_cluster_refcount(bs, l2_offset >>
1401 s->cluster_bits,
1402 abs(addend), addend < 0,
1403 QCOW2_DISCARD_SNAPSHOT);
1404 if (ret < 0) {
1405 goto fail;
1406 }
1407 }
1408 ret = qcow2_get_refcount(bs, l2_offset >> s->cluster_bits,
1409 &refcount);
1410 if (ret < 0) {
1411 goto fail;
1412 } else if (refcount == 1) {
1413 l2_offset |= QCOW_OFLAG_COPIED;
1414 }
1415 if (l2_offset != old_l2_offset) {
1416 l1_table[i] = l2_offset;
1417 l1_modified = 1;
1418 }
1419 }
1420 }
1421
1422 ret = bdrv_flush(bs);
1423 fail:
1424 if (l2_slice) {
1425 qcow2_cache_put(s->l2_table_cache, (void **) &l2_slice);
1426 }
1427
1428 s->cache_discards = false;
1429 qcow2_process_discards(bs, ret);
1430
1431 /* Update L1 only if it isn't deleted anyway (addend = -1) */
1432 if (ret == 0 && addend >= 0 && l1_modified) {
1433 for (i = 0; i < l1_size; i++) {
1434 cpu_to_be64s(&l1_table[i]);
1435 }
1436
1437 ret = bdrv_pwrite_sync(bs->file, l1_table_offset, l1_size2, l1_table,
1438 0);
1439
1440 for (i = 0; i < l1_size; i++) {
1441 be64_to_cpus(&l1_table[i]);
1442 }
1443 }
1444 if (l1_allocated)
1445 g_free(l1_table);
1446 return ret;
1447 }
1448
1449
1450
1451
1452 /*********************************************************/
1453 /* refcount checking functions */
1454
1455
refcount_array_byte_size(BDRVQcow2State * s,uint64_t entries)1456 static uint64_t refcount_array_byte_size(BDRVQcow2State *s, uint64_t entries)
1457 {
1458 /* This assertion holds because there is no way we can address more than
1459 * 2^(64 - 9) clusters at once (with cluster size 512 = 2^9, and because
1460 * offsets have to be representable in bytes); due to every cluster
1461 * corresponding to one refcount entry, we are well below that limit */
1462 assert(entries < (UINT64_C(1) << (64 - 9)));
1463
1464 /* Thanks to the assertion this will not overflow, because
1465 * s->refcount_order < 7.
1466 * (note: x << s->refcount_order == x * s->refcount_bits) */
1467 return DIV_ROUND_UP(entries << s->refcount_order, 8);
1468 }
1469
1470 /**
1471 * Reallocates *array so that it can hold new_size entries. *size must contain
1472 * the current number of entries in *array. If the reallocation fails, *array
1473 * and *size will not be modified and -errno will be returned. If the
1474 * reallocation is successful, *array will be set to the new buffer, *size
1475 * will be set to new_size and 0 will be returned. The size of the reallocated
1476 * refcount array buffer will be aligned to a cluster boundary, and the newly
1477 * allocated area will be zeroed.
1478 */
realloc_refcount_array(BDRVQcow2State * s,void ** array,int64_t * size,int64_t new_size)1479 static int realloc_refcount_array(BDRVQcow2State *s, void **array,
1480 int64_t *size, int64_t new_size)
1481 {
1482 int64_t old_byte_size, new_byte_size;
1483 void *new_ptr;
1484
1485 /* Round to clusters so the array can be directly written to disk */
1486 old_byte_size = size_to_clusters(s, refcount_array_byte_size(s, *size))
1487 * s->cluster_size;
1488 new_byte_size = size_to_clusters(s, refcount_array_byte_size(s, new_size))
1489 * s->cluster_size;
1490
1491 if (new_byte_size == old_byte_size) {
1492 *size = new_size;
1493 return 0;
1494 }
1495
1496 assert(new_byte_size > 0);
1497
1498 if (new_byte_size > SIZE_MAX) {
1499 return -ENOMEM;
1500 }
1501
1502 new_ptr = g_try_realloc(*array, new_byte_size);
1503 if (!new_ptr) {
1504 return -ENOMEM;
1505 }
1506
1507 if (new_byte_size > old_byte_size) {
1508 memset((char *)new_ptr + old_byte_size, 0,
1509 new_byte_size - old_byte_size);
1510 }
1511
1512 *array = new_ptr;
1513 *size = new_size;
1514
1515 return 0;
1516 }
1517
1518 /*
1519 * Increases the refcount for a range of clusters in a given refcount table.
1520 * This is used to construct a temporary refcount table out of L1 and L2 tables
1521 * which can be compared to the refcount table saved in the image.
1522 *
1523 * Modifies the number of errors in res.
1524 */
1525 int coroutine_fn GRAPH_RDLOCK
qcow2_inc_refcounts_imrt(BlockDriverState * bs,BdrvCheckResult * res,void ** refcount_table,int64_t * refcount_table_size,int64_t offset,int64_t size)1526 qcow2_inc_refcounts_imrt(BlockDriverState *bs, BdrvCheckResult *res,
1527 void **refcount_table,
1528 int64_t *refcount_table_size,
1529 int64_t offset, int64_t size)
1530 {
1531 BDRVQcow2State *s = bs->opaque;
1532 uint64_t start, last, cluster_offset, k, refcount;
1533 int64_t file_len;
1534 int ret;
1535
1536 if (size <= 0) {
1537 return 0;
1538 }
1539
1540 file_len = bdrv_co_getlength(bs->file->bs);
1541 if (file_len < 0) {
1542 return file_len;
1543 }
1544
1545 /*
1546 * Last cluster of qcow2 image may be semi-allocated, so it may be OK to
1547 * reference some space after file end but it should be less than one
1548 * cluster.
1549 */
1550 if (offset + size - file_len >= s->cluster_size) {
1551 fprintf(stderr, "ERROR: counting reference for region exceeding the "
1552 "end of the file by one cluster or more: offset 0x%" PRIx64
1553 " size 0x%" PRIx64 "\n", offset, size);
1554 res->corruptions++;
1555 return 0;
1556 }
1557
1558 start = start_of_cluster(s, offset);
1559 last = start_of_cluster(s, offset + size - 1);
1560 for(cluster_offset = start; cluster_offset <= last;
1561 cluster_offset += s->cluster_size) {
1562 k = cluster_offset >> s->cluster_bits;
1563 if (k >= *refcount_table_size) {
1564 ret = realloc_refcount_array(s, refcount_table,
1565 refcount_table_size, k + 1);
1566 if (ret < 0) {
1567 res->check_errors++;
1568 return ret;
1569 }
1570 }
1571
1572 refcount = s->get_refcount(*refcount_table, k);
1573 if (refcount == s->refcount_max) {
1574 fprintf(stderr, "ERROR: overflow cluster offset=0x%" PRIx64
1575 "\n", cluster_offset);
1576 fprintf(stderr, "Use qemu-img amend to increase the refcount entry "
1577 "width or qemu-img convert to create a clean copy if the "
1578 "image cannot be opened for writing\n");
1579 res->corruptions++;
1580 continue;
1581 }
1582 s->set_refcount(*refcount_table, k, refcount + 1);
1583 }
1584
1585 return 0;
1586 }
1587
1588 /* Flags for check_refcounts_l1() and check_refcounts_l2() */
1589 enum {
1590 CHECK_FRAG_INFO = 0x2, /* update BlockFragInfo counters */
1591 };
1592
1593 /*
1594 * Fix L2 entry by making it QCOW2_CLUSTER_ZERO_PLAIN (or making all its present
1595 * subclusters QCOW2_SUBCLUSTER_ZERO_PLAIN).
1596 *
1597 * This function decrements res->corruptions on success, so the caller is
1598 * responsible to increment res->corruptions prior to the call.
1599 *
1600 * On failure in-memory @l2_table may be modified.
1601 */
1602 static int coroutine_fn GRAPH_RDLOCK
fix_l2_entry_by_zero(BlockDriverState * bs,BdrvCheckResult * res,uint64_t l2_offset,uint64_t * l2_table,int l2_index,bool active,bool * metadata_overlap)1603 fix_l2_entry_by_zero(BlockDriverState *bs, BdrvCheckResult *res,
1604 uint64_t l2_offset, uint64_t *l2_table,
1605 int l2_index, bool active,
1606 bool *metadata_overlap)
1607 {
1608 BDRVQcow2State *s = bs->opaque;
1609 int ret;
1610 int idx = l2_index * (l2_entry_size(s) / sizeof(uint64_t));
1611 uint64_t l2e_offset = l2_offset + (uint64_t)l2_index * l2_entry_size(s);
1612 int ign = active ? QCOW2_OL_ACTIVE_L2 : QCOW2_OL_INACTIVE_L2;
1613
1614 if (has_subclusters(s)) {
1615 uint64_t l2_bitmap = get_l2_bitmap(s, l2_table, l2_index);
1616
1617 /* Allocated subclusters become zero */
1618 l2_bitmap |= l2_bitmap << 32;
1619 l2_bitmap &= QCOW_L2_BITMAP_ALL_ZEROES;
1620
1621 set_l2_bitmap(s, l2_table, l2_index, l2_bitmap);
1622 set_l2_entry(s, l2_table, l2_index, 0);
1623 } else {
1624 set_l2_entry(s, l2_table, l2_index, QCOW_OFLAG_ZERO);
1625 }
1626
1627 ret = qcow2_pre_write_overlap_check(bs, ign, l2e_offset, l2_entry_size(s),
1628 false);
1629 if (metadata_overlap) {
1630 *metadata_overlap = ret < 0;
1631 }
1632 if (ret < 0) {
1633 fprintf(stderr, "ERROR: Overlap check failed\n");
1634 goto fail;
1635 }
1636
1637 ret = bdrv_co_pwrite_sync(bs->file, l2e_offset, l2_entry_size(s),
1638 &l2_table[idx], 0);
1639 if (ret < 0) {
1640 fprintf(stderr, "ERROR: Failed to overwrite L2 "
1641 "table entry: %s\n", strerror(-ret));
1642 goto fail;
1643 }
1644
1645 res->corruptions--;
1646 res->corruptions_fixed++;
1647 return 0;
1648
1649 fail:
1650 res->check_errors++;
1651 return ret;
1652 }
1653
1654 /*
1655 * Increases the refcount in the given refcount table for the all clusters
1656 * referenced in the L2 table. While doing so, performs some checks on L2
1657 * entries.
1658 *
1659 * Returns the number of errors found by the checks or -errno if an internal
1660 * error occurred.
1661 */
1662 static int coroutine_fn GRAPH_RDLOCK
check_refcounts_l2(BlockDriverState * bs,BdrvCheckResult * res,void ** refcount_table,int64_t * refcount_table_size,int64_t l2_offset,int flags,BdrvCheckMode fix,bool active)1663 check_refcounts_l2(BlockDriverState *bs, BdrvCheckResult *res,
1664 void **refcount_table,
1665 int64_t *refcount_table_size, int64_t l2_offset,
1666 int flags, BdrvCheckMode fix, bool active)
1667 {
1668 BDRVQcow2State *s = bs->opaque;
1669 uint64_t l2_entry, l2_bitmap;
1670 uint64_t next_contiguous_offset = 0;
1671 int i, ret;
1672 size_t l2_size_bytes = s->l2_size * l2_entry_size(s);
1673 g_autofree uint64_t *l2_table = g_malloc(l2_size_bytes);
1674 bool metadata_overlap;
1675
1676 /* Read L2 table from disk */
1677 ret = bdrv_co_pread(bs->file, l2_offset, l2_size_bytes, l2_table, 0);
1678 if (ret < 0) {
1679 fprintf(stderr, "ERROR: I/O error in check_refcounts_l2\n");
1680 res->check_errors++;
1681 return ret;
1682 }
1683
1684 /* Do the actual checks */
1685 for (i = 0; i < s->l2_size; i++) {
1686 uint64_t coffset;
1687 int csize;
1688 QCow2ClusterType type;
1689
1690 l2_entry = get_l2_entry(s, l2_table, i);
1691 l2_bitmap = get_l2_bitmap(s, l2_table, i);
1692 type = qcow2_get_cluster_type(bs, l2_entry);
1693
1694 if (type != QCOW2_CLUSTER_COMPRESSED) {
1695 /* Check reserved bits of Standard Cluster Descriptor */
1696 if (l2_entry & L2E_STD_RESERVED_MASK) {
1697 fprintf(stderr, "ERROR found l2 entry with reserved bits set: "
1698 "%" PRIx64 "\n", l2_entry);
1699 res->corruptions++;
1700 }
1701 }
1702
1703 switch (type) {
1704 case QCOW2_CLUSTER_COMPRESSED:
1705 /* Compressed clusters don't have QCOW_OFLAG_COPIED */
1706 if (l2_entry & QCOW_OFLAG_COPIED) {
1707 fprintf(stderr, "ERROR: coffset=0x%" PRIx64 ": "
1708 "copied flag must never be set for compressed "
1709 "clusters\n", l2_entry & s->cluster_offset_mask);
1710 l2_entry &= ~QCOW_OFLAG_COPIED;
1711 res->corruptions++;
1712 }
1713
1714 if (has_data_file(bs)) {
1715 fprintf(stderr, "ERROR compressed cluster %d with data file, "
1716 "entry=0x%" PRIx64 "\n", i, l2_entry);
1717 res->corruptions++;
1718 break;
1719 }
1720
1721 if (l2_bitmap) {
1722 fprintf(stderr, "ERROR compressed cluster %d with non-zero "
1723 "subcluster allocation bitmap, entry=0x%" PRIx64 "\n",
1724 i, l2_entry);
1725 res->corruptions++;
1726 break;
1727 }
1728
1729 /* Mark cluster as used */
1730 qcow2_parse_compressed_l2_entry(bs, l2_entry, &coffset, &csize);
1731 ret = qcow2_inc_refcounts_imrt(
1732 bs, res, refcount_table, refcount_table_size, coffset, csize);
1733 if (ret < 0) {
1734 return ret;
1735 }
1736
1737 if (flags & CHECK_FRAG_INFO) {
1738 res->bfi.allocated_clusters++;
1739 res->bfi.compressed_clusters++;
1740
1741 /*
1742 * Compressed clusters are fragmented by nature. Since they
1743 * take up sub-sector space but we only have sector granularity
1744 * I/O we need to re-read the same sectors even for adjacent
1745 * compressed clusters.
1746 */
1747 res->bfi.fragmented_clusters++;
1748 }
1749 break;
1750
1751 case QCOW2_CLUSTER_ZERO_ALLOC:
1752 case QCOW2_CLUSTER_NORMAL:
1753 {
1754 uint64_t offset = l2_entry & L2E_OFFSET_MASK;
1755
1756 if ((l2_bitmap >> 32) & l2_bitmap) {
1757 res->corruptions++;
1758 fprintf(stderr, "ERROR offset=%" PRIx64 ": Allocated "
1759 "cluster has corrupted subcluster allocation bitmap\n",
1760 offset);
1761 }
1762
1763 /* Correct offsets are cluster aligned */
1764 if (offset_into_cluster(s, offset)) {
1765 bool contains_data;
1766 res->corruptions++;
1767
1768 if (has_subclusters(s)) {
1769 contains_data = (l2_bitmap & QCOW_L2_BITMAP_ALL_ALLOC);
1770 } else {
1771 contains_data = !(l2_entry & QCOW_OFLAG_ZERO);
1772 }
1773
1774 if (!contains_data) {
1775 fprintf(stderr, "%s offset=%" PRIx64 ": Preallocated "
1776 "cluster is not properly aligned; L2 entry "
1777 "corrupted.\n",
1778 fix & BDRV_FIX_ERRORS ? "Repairing" : "ERROR",
1779 offset);
1780 if (fix & BDRV_FIX_ERRORS) {
1781 ret = fix_l2_entry_by_zero(bs, res, l2_offset,
1782 l2_table, i, active,
1783 &metadata_overlap);
1784 if (metadata_overlap) {
1785 /*
1786 * Something is seriously wrong, so abort checking
1787 * this L2 table.
1788 */
1789 return ret;
1790 }
1791
1792 if (ret == 0) {
1793 /*
1794 * Skip marking the cluster as used
1795 * (it is unused now).
1796 */
1797 continue;
1798 }
1799
1800 /*
1801 * Failed to fix.
1802 * Do not abort, continue checking the rest of this
1803 * L2 table's entries.
1804 */
1805 }
1806 } else {
1807 fprintf(stderr, "ERROR offset=%" PRIx64 ": Data cluster is "
1808 "not properly aligned; L2 entry corrupted.\n", offset);
1809 }
1810 }
1811
1812 if (flags & CHECK_FRAG_INFO) {
1813 res->bfi.allocated_clusters++;
1814 if (next_contiguous_offset &&
1815 offset != next_contiguous_offset) {
1816 res->bfi.fragmented_clusters++;
1817 }
1818 next_contiguous_offset = offset + s->cluster_size;
1819 }
1820
1821 /* Mark cluster as used */
1822 if (!has_data_file(bs)) {
1823 ret = qcow2_inc_refcounts_imrt(bs, res, refcount_table,
1824 refcount_table_size,
1825 offset, s->cluster_size);
1826 if (ret < 0) {
1827 return ret;
1828 }
1829 }
1830 break;
1831 }
1832
1833 case QCOW2_CLUSTER_ZERO_PLAIN:
1834 /* Impossible when image has subclusters */
1835 assert(!l2_bitmap);
1836 break;
1837
1838 case QCOW2_CLUSTER_UNALLOCATED:
1839 if (l2_bitmap & QCOW_L2_BITMAP_ALL_ALLOC) {
1840 res->corruptions++;
1841 fprintf(stderr, "ERROR: Unallocated "
1842 "cluster has non-zero subcluster allocation map\n");
1843 }
1844 break;
1845
1846 default:
1847 abort();
1848 }
1849 }
1850
1851 return 0;
1852 }
1853
1854 /*
1855 * Increases the refcount for the L1 table, its L2 tables and all referenced
1856 * clusters in the given refcount table. While doing so, performs some checks
1857 * on L1 and L2 entries.
1858 *
1859 * Returns the number of errors found by the checks or -errno if an internal
1860 * error occurred.
1861 */
1862 static int coroutine_fn GRAPH_RDLOCK
check_refcounts_l1(BlockDriverState * bs,BdrvCheckResult * res,void ** refcount_table,int64_t * refcount_table_size,int64_t l1_table_offset,int l1_size,int flags,BdrvCheckMode fix,bool active)1863 check_refcounts_l1(BlockDriverState *bs, BdrvCheckResult *res,
1864 void **refcount_table, int64_t *refcount_table_size,
1865 int64_t l1_table_offset, int l1_size,
1866 int flags, BdrvCheckMode fix, bool active)
1867 {
1868 BDRVQcow2State *s = bs->opaque;
1869 size_t l1_size_bytes = l1_size * L1E_SIZE;
1870 g_autofree uint64_t *l1_table = NULL;
1871 uint64_t l2_offset;
1872 int i, ret;
1873
1874 if (!l1_size) {
1875 return 0;
1876 }
1877
1878 /* Mark L1 table as used */
1879 ret = qcow2_inc_refcounts_imrt(bs, res, refcount_table, refcount_table_size,
1880 l1_table_offset, l1_size_bytes);
1881 if (ret < 0) {
1882 return ret;
1883 }
1884
1885 l1_table = g_try_malloc(l1_size_bytes);
1886 if (l1_table == NULL) {
1887 res->check_errors++;
1888 return -ENOMEM;
1889 }
1890
1891 /* Read L1 table entries from disk */
1892 ret = bdrv_co_pread(bs->file, l1_table_offset, l1_size_bytes, l1_table, 0);
1893 if (ret < 0) {
1894 fprintf(stderr, "ERROR: I/O error in check_refcounts_l1\n");
1895 res->check_errors++;
1896 return ret;
1897 }
1898
1899 for (i = 0; i < l1_size; i++) {
1900 be64_to_cpus(&l1_table[i]);
1901 }
1902
1903 /* Do the actual checks */
1904 for (i = 0; i < l1_size; i++) {
1905 if (!l1_table[i]) {
1906 continue;
1907 }
1908
1909 if (l1_table[i] & L1E_RESERVED_MASK) {
1910 fprintf(stderr, "ERROR found L1 entry with reserved bits set: "
1911 "%" PRIx64 "\n", l1_table[i]);
1912 res->corruptions++;
1913 }
1914
1915 l2_offset = l1_table[i] & L1E_OFFSET_MASK;
1916
1917 /* Mark L2 table as used */
1918 ret = qcow2_inc_refcounts_imrt(bs, res,
1919 refcount_table, refcount_table_size,
1920 l2_offset, s->cluster_size);
1921 if (ret < 0) {
1922 return ret;
1923 }
1924
1925 /* L2 tables are cluster aligned */
1926 if (offset_into_cluster(s, l2_offset)) {
1927 fprintf(stderr, "ERROR l2_offset=%" PRIx64 ": Table is not "
1928 "cluster aligned; L1 entry corrupted\n", l2_offset);
1929 res->corruptions++;
1930 }
1931
1932 /* Process and check L2 entries */
1933 ret = check_refcounts_l2(bs, res, refcount_table,
1934 refcount_table_size, l2_offset, flags,
1935 fix, active);
1936 if (ret < 0) {
1937 return ret;
1938 }
1939 }
1940
1941 return 0;
1942 }
1943
1944 /*
1945 * Checks the OFLAG_COPIED flag for all L1 and L2 entries.
1946 *
1947 * This function does not print an error message nor does it increment
1948 * check_errors if qcow2_get_refcount fails (this is because such an error will
1949 * have been already detected and sufficiently signaled by the calling function
1950 * (qcow2_check_refcounts) by the time this function is called).
1951 */
1952 static int coroutine_fn GRAPH_RDLOCK
check_oflag_copied(BlockDriverState * bs,BdrvCheckResult * res,BdrvCheckMode fix)1953 check_oflag_copied(BlockDriverState *bs, BdrvCheckResult *res, BdrvCheckMode fix)
1954 {
1955 BDRVQcow2State *s = bs->opaque;
1956 uint64_t *l2_table = qemu_blockalign(bs, s->cluster_size);
1957 int ret;
1958 uint64_t refcount;
1959 int i, j;
1960 bool repair;
1961
1962 if (fix & BDRV_FIX_ERRORS) {
1963 /* Always repair */
1964 repair = true;
1965 } else if (fix & BDRV_FIX_LEAKS) {
1966 /* Repair only if that seems safe: This function is always
1967 * called after the refcounts have been fixed, so the refcount
1968 * is accurate if that repair was successful */
1969 repair = !res->check_errors && !res->corruptions && !res->leaks;
1970 } else {
1971 repair = false;
1972 }
1973
1974 for (i = 0; i < s->l1_size; i++) {
1975 uint64_t l1_entry = s->l1_table[i];
1976 uint64_t l2_offset = l1_entry & L1E_OFFSET_MASK;
1977 int l2_dirty = 0;
1978
1979 if (!l2_offset) {
1980 continue;
1981 }
1982
1983 ret = qcow2_get_refcount(bs, l2_offset >> s->cluster_bits,
1984 &refcount);
1985 if (ret < 0) {
1986 /* don't print message nor increment check_errors */
1987 continue;
1988 }
1989 if ((refcount == 1) != ((l1_entry & QCOW_OFLAG_COPIED) != 0)) {
1990 res->corruptions++;
1991 fprintf(stderr, "%s OFLAG_COPIED L2 cluster: l1_index=%d "
1992 "l1_entry=%" PRIx64 " refcount=%" PRIu64 "\n",
1993 repair ? "Repairing" : "ERROR", i, l1_entry, refcount);
1994 if (repair) {
1995 s->l1_table[i] = refcount == 1
1996 ? l1_entry | QCOW_OFLAG_COPIED
1997 : l1_entry & ~QCOW_OFLAG_COPIED;
1998 ret = qcow2_write_l1_entry(bs, i);
1999 if (ret < 0) {
2000 res->check_errors++;
2001 goto fail;
2002 }
2003 res->corruptions--;
2004 res->corruptions_fixed++;
2005 }
2006 }
2007
2008 ret = bdrv_co_pread(bs->file, l2_offset, s->l2_size * l2_entry_size(s),
2009 l2_table, 0);
2010 if (ret < 0) {
2011 fprintf(stderr, "ERROR: Could not read L2 table: %s\n",
2012 strerror(-ret));
2013 res->check_errors++;
2014 goto fail;
2015 }
2016
2017 for (j = 0; j < s->l2_size; j++) {
2018 uint64_t l2_entry = get_l2_entry(s, l2_table, j);
2019 uint64_t data_offset = l2_entry & L2E_OFFSET_MASK;
2020 QCow2ClusterType cluster_type = qcow2_get_cluster_type(bs, l2_entry);
2021
2022 if (cluster_type == QCOW2_CLUSTER_NORMAL ||
2023 cluster_type == QCOW2_CLUSTER_ZERO_ALLOC) {
2024 if (has_data_file(bs)) {
2025 refcount = 1;
2026 } else {
2027 ret = qcow2_get_refcount(bs,
2028 data_offset >> s->cluster_bits,
2029 &refcount);
2030 if (ret < 0) {
2031 /* don't print message nor increment check_errors */
2032 continue;
2033 }
2034 }
2035 if ((refcount == 1) != ((l2_entry & QCOW_OFLAG_COPIED) != 0)) {
2036 res->corruptions++;
2037 fprintf(stderr, "%s OFLAG_COPIED data cluster: "
2038 "l2_entry=%" PRIx64 " refcount=%" PRIu64 "\n",
2039 repair ? "Repairing" : "ERROR", l2_entry, refcount);
2040 if (repair) {
2041 set_l2_entry(s, l2_table, j,
2042 refcount == 1 ?
2043 l2_entry | QCOW_OFLAG_COPIED :
2044 l2_entry & ~QCOW_OFLAG_COPIED);
2045 l2_dirty++;
2046 }
2047 }
2048 }
2049 }
2050
2051 if (l2_dirty > 0) {
2052 ret = qcow2_pre_write_overlap_check(bs, QCOW2_OL_ACTIVE_L2,
2053 l2_offset, s->cluster_size,
2054 false);
2055 if (ret < 0) {
2056 fprintf(stderr, "ERROR: Could not write L2 table; metadata "
2057 "overlap check failed: %s\n", strerror(-ret));
2058 res->check_errors++;
2059 goto fail;
2060 }
2061
2062 ret = bdrv_co_pwrite(bs->file, l2_offset, s->cluster_size, l2_table, 0);
2063 if (ret < 0) {
2064 fprintf(stderr, "ERROR: Could not write L2 table: %s\n",
2065 strerror(-ret));
2066 res->check_errors++;
2067 goto fail;
2068 }
2069 res->corruptions -= l2_dirty;
2070 res->corruptions_fixed += l2_dirty;
2071 }
2072 }
2073
2074 ret = 0;
2075
2076 fail:
2077 qemu_vfree(l2_table);
2078 return ret;
2079 }
2080
2081 /*
2082 * Checks consistency of refblocks and accounts for each refblock in
2083 * *refcount_table.
2084 */
2085 static int coroutine_fn GRAPH_RDLOCK
check_refblocks(BlockDriverState * bs,BdrvCheckResult * res,BdrvCheckMode fix,bool * rebuild,void ** refcount_table,int64_t * nb_clusters)2086 check_refblocks(BlockDriverState *bs, BdrvCheckResult *res,
2087 BdrvCheckMode fix, bool *rebuild,
2088 void **refcount_table, int64_t *nb_clusters)
2089 {
2090 BDRVQcow2State *s = bs->opaque;
2091 int64_t i, size;
2092 int ret;
2093
2094 for(i = 0; i < s->refcount_table_size; i++) {
2095 uint64_t offset, cluster;
2096 offset = s->refcount_table[i] & REFT_OFFSET_MASK;
2097 cluster = offset >> s->cluster_bits;
2098
2099 if (s->refcount_table[i] & REFT_RESERVED_MASK) {
2100 fprintf(stderr, "ERROR refcount table entry %" PRId64 " has "
2101 "reserved bits set\n", i);
2102 res->corruptions++;
2103 *rebuild = true;
2104 continue;
2105 }
2106
2107 /* Refcount blocks are cluster aligned */
2108 if (offset_into_cluster(s, offset)) {
2109 fprintf(stderr, "ERROR refcount block %" PRId64 " is not "
2110 "cluster aligned; refcount table entry corrupted\n", i);
2111 res->corruptions++;
2112 *rebuild = true;
2113 continue;
2114 }
2115
2116 if (cluster >= *nb_clusters) {
2117 res->corruptions++;
2118 fprintf(stderr, "%s refcount block %" PRId64 " is outside image\n",
2119 fix & BDRV_FIX_ERRORS ? "Repairing" : "ERROR", i);
2120
2121 if (fix & BDRV_FIX_ERRORS) {
2122 int64_t new_nb_clusters;
2123 Error *local_err = NULL;
2124
2125 if (offset > INT64_MAX - s->cluster_size) {
2126 ret = -EINVAL;
2127 goto resize_fail;
2128 }
2129
2130 ret = bdrv_co_truncate(bs->file, offset + s->cluster_size, false,
2131 PREALLOC_MODE_OFF, 0, &local_err);
2132 if (ret < 0) {
2133 error_report_err(local_err);
2134 goto resize_fail;
2135 }
2136 size = bdrv_co_getlength(bs->file->bs);
2137 if (size < 0) {
2138 ret = size;
2139 goto resize_fail;
2140 }
2141
2142 new_nb_clusters = size_to_clusters(s, size);
2143 assert(new_nb_clusters >= *nb_clusters);
2144
2145 ret = realloc_refcount_array(s, refcount_table,
2146 nb_clusters, new_nb_clusters);
2147 if (ret < 0) {
2148 res->check_errors++;
2149 return ret;
2150 }
2151
2152 if (cluster >= *nb_clusters) {
2153 ret = -EINVAL;
2154 goto resize_fail;
2155 }
2156
2157 res->corruptions--;
2158 res->corruptions_fixed++;
2159 ret = qcow2_inc_refcounts_imrt(bs, res,
2160 refcount_table, nb_clusters,
2161 offset, s->cluster_size);
2162 if (ret < 0) {
2163 return ret;
2164 }
2165 /* No need to check whether the refcount is now greater than 1:
2166 * This area was just allocated and zeroed, so it can only be
2167 * exactly 1 after qcow2_inc_refcounts_imrt() */
2168 continue;
2169
2170 resize_fail:
2171 *rebuild = true;
2172 fprintf(stderr, "ERROR could not resize image: %s\n",
2173 strerror(-ret));
2174 }
2175 continue;
2176 }
2177
2178 if (offset != 0) {
2179 ret = qcow2_inc_refcounts_imrt(bs, res, refcount_table, nb_clusters,
2180 offset, s->cluster_size);
2181 if (ret < 0) {
2182 return ret;
2183 }
2184 if (s->get_refcount(*refcount_table, cluster) != 1) {
2185 fprintf(stderr, "ERROR refcount block %" PRId64
2186 " refcount=%" PRIu64 "\n", i,
2187 s->get_refcount(*refcount_table, cluster));
2188 res->corruptions++;
2189 *rebuild = true;
2190 }
2191 }
2192 }
2193
2194 return 0;
2195 }
2196
2197 /*
2198 * Calculates an in-memory refcount table.
2199 */
2200 static int coroutine_fn GRAPH_RDLOCK
calculate_refcounts(BlockDriverState * bs,BdrvCheckResult * res,BdrvCheckMode fix,bool * rebuild,void ** refcount_table,int64_t * nb_clusters)2201 calculate_refcounts(BlockDriverState *bs, BdrvCheckResult *res,
2202 BdrvCheckMode fix, bool *rebuild,
2203 void **refcount_table, int64_t *nb_clusters)
2204 {
2205 BDRVQcow2State *s = bs->opaque;
2206 int64_t i;
2207 QCowSnapshot *sn;
2208 int ret;
2209
2210 if (!*refcount_table) {
2211 int64_t old_size = 0;
2212 ret = realloc_refcount_array(s, refcount_table,
2213 &old_size, *nb_clusters);
2214 if (ret < 0) {
2215 res->check_errors++;
2216 return ret;
2217 }
2218 }
2219
2220 /* header */
2221 ret = qcow2_inc_refcounts_imrt(bs, res, refcount_table, nb_clusters,
2222 0, s->cluster_size);
2223 if (ret < 0) {
2224 return ret;
2225 }
2226
2227 /* current L1 table */
2228 ret = check_refcounts_l1(bs, res, refcount_table, nb_clusters,
2229 s->l1_table_offset, s->l1_size, CHECK_FRAG_INFO,
2230 fix, true);
2231 if (ret < 0) {
2232 return ret;
2233 }
2234
2235 /* snapshots */
2236 if (has_data_file(bs) && s->nb_snapshots) {
2237 fprintf(stderr, "ERROR %d snapshots in image with data file\n",
2238 s->nb_snapshots);
2239 res->corruptions++;
2240 }
2241
2242 for (i = 0; i < s->nb_snapshots; i++) {
2243 sn = s->snapshots + i;
2244 if (offset_into_cluster(s, sn->l1_table_offset)) {
2245 fprintf(stderr, "ERROR snapshot %s (%s) l1_offset=%#" PRIx64 ": "
2246 "L1 table is not cluster aligned; snapshot table entry "
2247 "corrupted\n", sn->id_str, sn->name, sn->l1_table_offset);
2248 res->corruptions++;
2249 continue;
2250 }
2251 if (sn->l1_size > QCOW_MAX_L1_SIZE / L1E_SIZE) {
2252 fprintf(stderr, "ERROR snapshot %s (%s) l1_size=%#" PRIx32 ": "
2253 "L1 table is too large; snapshot table entry corrupted\n",
2254 sn->id_str, sn->name, sn->l1_size);
2255 res->corruptions++;
2256 continue;
2257 }
2258 ret = check_refcounts_l1(bs, res, refcount_table, nb_clusters,
2259 sn->l1_table_offset, sn->l1_size, 0, fix,
2260 false);
2261 if (ret < 0) {
2262 return ret;
2263 }
2264 }
2265 ret = qcow2_inc_refcounts_imrt(bs, res, refcount_table, nb_clusters,
2266 s->snapshots_offset, s->snapshots_size);
2267 if (ret < 0) {
2268 return ret;
2269 }
2270
2271 /* refcount data */
2272 ret = qcow2_inc_refcounts_imrt(bs, res, refcount_table, nb_clusters,
2273 s->refcount_table_offset,
2274 s->refcount_table_size *
2275 REFTABLE_ENTRY_SIZE);
2276 if (ret < 0) {
2277 return ret;
2278 }
2279
2280 /* encryption */
2281 if (s->crypto_header.length) {
2282 ret = qcow2_inc_refcounts_imrt(bs, res, refcount_table, nb_clusters,
2283 s->crypto_header.offset,
2284 s->crypto_header.length);
2285 if (ret < 0) {
2286 return ret;
2287 }
2288 }
2289
2290 /* bitmaps */
2291 ret = qcow2_check_bitmaps_refcounts(bs, res, refcount_table, nb_clusters);
2292 if (ret < 0) {
2293 return ret;
2294 }
2295
2296 return check_refblocks(bs, res, fix, rebuild, refcount_table, nb_clusters);
2297 }
2298
2299 /*
2300 * Compares the actual reference count for each cluster in the image against the
2301 * refcount as reported by the refcount structures on-disk.
2302 */
2303 static void coroutine_fn GRAPH_RDLOCK
compare_refcounts(BlockDriverState * bs,BdrvCheckResult * res,BdrvCheckMode fix,bool * rebuild,int64_t * highest_cluster,void * refcount_table,int64_t nb_clusters)2304 compare_refcounts(BlockDriverState *bs, BdrvCheckResult *res,
2305 BdrvCheckMode fix, bool *rebuild,
2306 int64_t *highest_cluster,
2307 void *refcount_table, int64_t nb_clusters)
2308 {
2309 BDRVQcow2State *s = bs->opaque;
2310 int64_t i;
2311 uint64_t refcount1, refcount2;
2312 int ret;
2313
2314 for (i = 0, *highest_cluster = 0; i < nb_clusters; i++) {
2315 ret = qcow2_get_refcount(bs, i, &refcount1);
2316 if (ret < 0) {
2317 fprintf(stderr, "Can't get refcount for cluster %" PRId64 ": %s\n",
2318 i, strerror(-ret));
2319 res->check_errors++;
2320 continue;
2321 }
2322
2323 refcount2 = s->get_refcount(refcount_table, i);
2324
2325 if (refcount1 > 0 || refcount2 > 0) {
2326 *highest_cluster = i;
2327 }
2328
2329 if (refcount1 != refcount2) {
2330 /* Check if we're allowed to fix the mismatch */
2331 int *num_fixed = NULL;
2332 if (refcount1 == 0) {
2333 *rebuild = true;
2334 } else if (refcount1 > refcount2 && (fix & BDRV_FIX_LEAKS)) {
2335 num_fixed = &res->leaks_fixed;
2336 } else if (refcount1 < refcount2 && (fix & BDRV_FIX_ERRORS)) {
2337 num_fixed = &res->corruptions_fixed;
2338 }
2339
2340 fprintf(stderr, "%s cluster %" PRId64 " refcount=%" PRIu64
2341 " reference=%" PRIu64 "\n",
2342 num_fixed != NULL ? "Repairing" :
2343 refcount1 < refcount2 ? "ERROR" :
2344 "Leaked",
2345 i, refcount1, refcount2);
2346
2347 if (num_fixed) {
2348 ret = update_refcount(bs, i << s->cluster_bits, 1,
2349 refcount_diff(refcount1, refcount2),
2350 refcount1 > refcount2,
2351 QCOW2_DISCARD_ALWAYS);
2352 if (ret >= 0) {
2353 (*num_fixed)++;
2354 continue;
2355 }
2356 }
2357
2358 /* And if we couldn't, print an error */
2359 if (refcount1 < refcount2) {
2360 res->corruptions++;
2361 } else {
2362 res->leaks++;
2363 }
2364 }
2365 }
2366 }
2367
2368 /*
2369 * Allocates clusters using an in-memory refcount table (IMRT) in contrast to
2370 * the on-disk refcount structures.
2371 *
2372 * On input, *first_free_cluster tells where to start looking, and need not
2373 * actually be a free cluster; the returned offset will not be before that
2374 * cluster. On output, *first_free_cluster points to the first gap found, even
2375 * if that gap was too small to be used as the returned offset.
2376 *
2377 * Note that *first_free_cluster is a cluster index whereas the return value is
2378 * an offset.
2379 */
alloc_clusters_imrt(BlockDriverState * bs,int cluster_count,void ** refcount_table,int64_t * imrt_nb_clusters,int64_t * first_free_cluster)2380 static int64_t alloc_clusters_imrt(BlockDriverState *bs,
2381 int cluster_count,
2382 void **refcount_table,
2383 int64_t *imrt_nb_clusters,
2384 int64_t *first_free_cluster)
2385 {
2386 BDRVQcow2State *s = bs->opaque;
2387 int64_t cluster = *first_free_cluster, i;
2388 bool first_gap = true;
2389 int contiguous_free_clusters;
2390 int ret;
2391
2392 /* Starting at *first_free_cluster, find a range of at least cluster_count
2393 * continuously free clusters */
2394 for (contiguous_free_clusters = 0;
2395 cluster < *imrt_nb_clusters &&
2396 contiguous_free_clusters < cluster_count;
2397 cluster++)
2398 {
2399 if (!s->get_refcount(*refcount_table, cluster)) {
2400 contiguous_free_clusters++;
2401 if (first_gap) {
2402 /* If this is the first free cluster found, update
2403 * *first_free_cluster accordingly */
2404 *first_free_cluster = cluster;
2405 first_gap = false;
2406 }
2407 } else if (contiguous_free_clusters) {
2408 contiguous_free_clusters = 0;
2409 }
2410 }
2411
2412 /* If contiguous_free_clusters is greater than zero, it contains the number
2413 * of continuously free clusters until the current cluster; the first free
2414 * cluster in the current "gap" is therefore
2415 * cluster - contiguous_free_clusters */
2416
2417 /* If no such range could be found, grow the in-memory refcount table
2418 * accordingly to append free clusters at the end of the image */
2419 if (contiguous_free_clusters < cluster_count) {
2420 /* contiguous_free_clusters clusters are already empty at the image end;
2421 * we need cluster_count clusters; therefore, we have to allocate
2422 * cluster_count - contiguous_free_clusters new clusters at the end of
2423 * the image (which is the current value of cluster; note that cluster
2424 * may exceed old_imrt_nb_clusters if *first_free_cluster pointed beyond
2425 * the image end) */
2426 ret = realloc_refcount_array(s, refcount_table, imrt_nb_clusters,
2427 cluster + cluster_count
2428 - contiguous_free_clusters);
2429 if (ret < 0) {
2430 return ret;
2431 }
2432 }
2433
2434 /* Go back to the first free cluster */
2435 cluster -= contiguous_free_clusters;
2436 for (i = 0; i < cluster_count; i++) {
2437 s->set_refcount(*refcount_table, cluster + i, 1);
2438 }
2439
2440 return cluster << s->cluster_bits;
2441 }
2442
2443 /*
2444 * Helper function for rebuild_refcount_structure().
2445 *
2446 * Scan the range of clusters [first_cluster, end_cluster) for allocated
2447 * clusters and write all corresponding refblocks to disk. The refblock
2448 * and allocation data is taken from the in-memory refcount table
2449 * *refcount_table[] (of size *nb_clusters), which is basically one big
2450 * (unlimited size) refblock for the whole image.
2451 *
2452 * For these refblocks, clusters are allocated using said in-memory
2453 * refcount table. Care is taken that these allocations are reflected
2454 * in the refblocks written to disk.
2455 *
2456 * The refblocks' offsets are written into a reftable, which is
2457 * *on_disk_reftable_ptr[] (of size *on_disk_reftable_entries_ptr). If
2458 * that reftable is of insufficient size, it will be resized to fit.
2459 * This reftable is not written to disk.
2460 *
2461 * (If *on_disk_reftable_ptr is not NULL, the entries within are assumed
2462 * to point to existing valid refblocks that do not need to be allocated
2463 * again.)
2464 *
2465 * Return whether the on-disk reftable array was resized (true/false),
2466 * or -errno on error.
2467 */
2468 static int coroutine_fn GRAPH_RDLOCK
rebuild_refcounts_write_refblocks(BlockDriverState * bs,void ** refcount_table,int64_t * nb_clusters,int64_t first_cluster,int64_t end_cluster,uint64_t ** on_disk_reftable_ptr,uint32_t * on_disk_reftable_entries_ptr,Error ** errp)2469 rebuild_refcounts_write_refblocks(
2470 BlockDriverState *bs, void **refcount_table, int64_t *nb_clusters,
2471 int64_t first_cluster, int64_t end_cluster,
2472 uint64_t **on_disk_reftable_ptr, uint32_t *on_disk_reftable_entries_ptr,
2473 Error **errp
2474 )
2475 {
2476 BDRVQcow2State *s = bs->opaque;
2477 int64_t cluster;
2478 int64_t refblock_offset, refblock_start, refblock_index;
2479 int64_t first_free_cluster = 0;
2480 uint64_t *on_disk_reftable = *on_disk_reftable_ptr;
2481 uint32_t on_disk_reftable_entries = *on_disk_reftable_entries_ptr;
2482 void *on_disk_refblock;
2483 bool reftable_grown = false;
2484 int ret;
2485
2486 for (cluster = first_cluster; cluster < end_cluster; cluster++) {
2487 /* Check all clusters to find refblocks that contain non-zero entries */
2488 if (!s->get_refcount(*refcount_table, cluster)) {
2489 continue;
2490 }
2491
2492 /*
2493 * This cluster is allocated, so we need to create a refblock
2494 * for it. The data we will write to disk is just the
2495 * respective slice from *refcount_table, so it will contain
2496 * accurate refcounts for all clusters belonging to this
2497 * refblock. After we have written it, we will therefore skip
2498 * all remaining clusters in this refblock.
2499 */
2500
2501 refblock_index = cluster >> s->refcount_block_bits;
2502 refblock_start = refblock_index << s->refcount_block_bits;
2503
2504 if (on_disk_reftable_entries > refblock_index &&
2505 on_disk_reftable[refblock_index])
2506 {
2507 /*
2508 * We can get here after a `goto write_refblocks`: We have a
2509 * reftable from a previous run, and the refblock is already
2510 * allocated. No need to allocate it again.
2511 */
2512 refblock_offset = on_disk_reftable[refblock_index];
2513 } else {
2514 int64_t refblock_cluster_index;
2515
2516 /* Don't allocate a cluster in a refblock already written to disk */
2517 if (first_free_cluster < refblock_start) {
2518 first_free_cluster = refblock_start;
2519 }
2520 refblock_offset = alloc_clusters_imrt(bs, 1, refcount_table,
2521 nb_clusters,
2522 &first_free_cluster);
2523 if (refblock_offset < 0) {
2524 error_setg_errno(errp, -refblock_offset,
2525 "ERROR allocating refblock");
2526 return refblock_offset;
2527 }
2528
2529 refblock_cluster_index = refblock_offset / s->cluster_size;
2530 if (refblock_cluster_index >= end_cluster) {
2531 /*
2532 * We must write the refblock that holds this refblock's
2533 * refcount
2534 */
2535 end_cluster = refblock_cluster_index + 1;
2536 }
2537
2538 if (on_disk_reftable_entries <= refblock_index) {
2539 on_disk_reftable_entries =
2540 ROUND_UP((refblock_index + 1) * REFTABLE_ENTRY_SIZE,
2541 s->cluster_size) / REFTABLE_ENTRY_SIZE;
2542 on_disk_reftable =
2543 g_try_realloc(on_disk_reftable,
2544 on_disk_reftable_entries *
2545 REFTABLE_ENTRY_SIZE);
2546 if (!on_disk_reftable) {
2547 error_setg(errp, "ERROR allocating reftable memory");
2548 return -ENOMEM;
2549 }
2550
2551 memset(on_disk_reftable + *on_disk_reftable_entries_ptr, 0,
2552 (on_disk_reftable_entries -
2553 *on_disk_reftable_entries_ptr) *
2554 REFTABLE_ENTRY_SIZE);
2555
2556 *on_disk_reftable_ptr = on_disk_reftable;
2557 *on_disk_reftable_entries_ptr = on_disk_reftable_entries;
2558
2559 reftable_grown = true;
2560 } else {
2561 assert(on_disk_reftable);
2562 }
2563 on_disk_reftable[refblock_index] = refblock_offset;
2564 }
2565
2566 /* Refblock is allocated, write it to disk */
2567
2568 ret = qcow2_pre_write_overlap_check(bs, 0, refblock_offset,
2569 s->cluster_size, false);
2570 if (ret < 0) {
2571 error_setg_errno(errp, -ret, "ERROR writing refblock");
2572 return ret;
2573 }
2574
2575 /*
2576 * The refblock is simply a slice of *refcount_table.
2577 * Note that the size of *refcount_table is always aligned to
2578 * whole clusters, so the write operation will not result in
2579 * out-of-bounds accesses.
2580 */
2581 on_disk_refblock = (void *)((char *) *refcount_table +
2582 refblock_index * s->cluster_size);
2583
2584 ret = bdrv_co_pwrite(bs->file, refblock_offset, s->cluster_size,
2585 on_disk_refblock, 0);
2586 if (ret < 0) {
2587 error_setg_errno(errp, -ret, "ERROR writing refblock");
2588 return ret;
2589 }
2590
2591 /* This refblock is done, skip to its end */
2592 cluster = refblock_start + s->refcount_block_size - 1;
2593 }
2594
2595 return reftable_grown;
2596 }
2597
2598 /*
2599 * Creates a new refcount structure based solely on the in-memory information
2600 * given through *refcount_table (this in-memory information is basically just
2601 * the concatenation of all refblocks). All necessary allocations will be
2602 * reflected in that array.
2603 *
2604 * On success, the old refcount structure is leaked (it will be covered by the
2605 * new refcount structure).
2606 */
2607 static int coroutine_fn GRAPH_RDLOCK
rebuild_refcount_structure(BlockDriverState * bs,BdrvCheckResult * res,void ** refcount_table,int64_t * nb_clusters,Error ** errp)2608 rebuild_refcount_structure(BlockDriverState *bs, BdrvCheckResult *res,
2609 void **refcount_table, int64_t *nb_clusters,
2610 Error **errp)
2611 {
2612 BDRVQcow2State *s = bs->opaque;
2613 int64_t reftable_offset = -1;
2614 int64_t reftable_length = 0;
2615 int64_t reftable_clusters;
2616 int64_t refblock_index;
2617 uint32_t on_disk_reftable_entries = 0;
2618 uint64_t *on_disk_reftable = NULL;
2619 int ret = 0;
2620 int reftable_size_changed = 0;
2621 struct {
2622 uint64_t reftable_offset;
2623 uint32_t reftable_clusters;
2624 } QEMU_PACKED reftable_offset_and_clusters;
2625
2626 qcow2_cache_empty(bs, s->refcount_block_cache);
2627
2628 /*
2629 * For each refblock containing entries, we try to allocate a
2630 * cluster (in the in-memory refcount table) and write its offset
2631 * into on_disk_reftable[]. We then write the whole refblock to
2632 * disk (as a slice of the in-memory refcount table).
2633 * This is done by rebuild_refcounts_write_refblocks().
2634 *
2635 * Once we have scanned all clusters, we try to find space for the
2636 * reftable. This will dirty the in-memory refcount table (i.e.
2637 * make it differ from the refblocks we have already written), so we
2638 * need to run rebuild_refcounts_write_refblocks() again for the
2639 * range of clusters where the reftable has been allocated.
2640 *
2641 * This second run might make the reftable grow again, in which case
2642 * we will need to allocate another space for it, which is why we
2643 * repeat all this until the reftable stops growing.
2644 *
2645 * (This loop will terminate, because with every cluster the
2646 * reftable grows, it can accommodate a multitude of more refcounts,
2647 * so that at some point this must be able to cover the reftable
2648 * and all refblocks describing it.)
2649 *
2650 * We then convert the reftable to big-endian and write it to disk.
2651 *
2652 * Note that we never free any reftable allocations. Doing so would
2653 * needlessly complicate the algorithm: The eventual second check
2654 * run we do will clean up all leaks we have caused.
2655 */
2656
2657 reftable_size_changed =
2658 rebuild_refcounts_write_refblocks(bs, refcount_table, nb_clusters,
2659 0, *nb_clusters,
2660 &on_disk_reftable,
2661 &on_disk_reftable_entries, errp);
2662 if (reftable_size_changed < 0) {
2663 res->check_errors++;
2664 ret = reftable_size_changed;
2665 goto fail;
2666 }
2667
2668 /*
2669 * There was no reftable before, so rebuild_refcounts_write_refblocks()
2670 * must have increased its size (from 0 to something).
2671 */
2672 assert(reftable_size_changed);
2673
2674 do {
2675 int64_t reftable_start_cluster, reftable_end_cluster;
2676 int64_t first_free_cluster = 0;
2677
2678 reftable_length = on_disk_reftable_entries * REFTABLE_ENTRY_SIZE;
2679 reftable_clusters = size_to_clusters(s, reftable_length);
2680
2681 reftable_offset = alloc_clusters_imrt(bs, reftable_clusters,
2682 refcount_table, nb_clusters,
2683 &first_free_cluster);
2684 if (reftable_offset < 0) {
2685 error_setg_errno(errp, -reftable_offset,
2686 "ERROR allocating reftable");
2687 res->check_errors++;
2688 ret = reftable_offset;
2689 goto fail;
2690 }
2691
2692 /*
2693 * We need to update the affected refblocks, so re-run the
2694 * write_refblocks loop for the reftable's range of clusters.
2695 */
2696 assert(offset_into_cluster(s, reftable_offset) == 0);
2697 reftable_start_cluster = reftable_offset / s->cluster_size;
2698 reftable_end_cluster = reftable_start_cluster + reftable_clusters;
2699 reftable_size_changed =
2700 rebuild_refcounts_write_refblocks(bs, refcount_table, nb_clusters,
2701 reftable_start_cluster,
2702 reftable_end_cluster,
2703 &on_disk_reftable,
2704 &on_disk_reftable_entries, errp);
2705 if (reftable_size_changed < 0) {
2706 res->check_errors++;
2707 ret = reftable_size_changed;
2708 goto fail;
2709 }
2710
2711 /*
2712 * If the reftable size has changed, we will need to find a new
2713 * allocation, repeating the loop.
2714 */
2715 } while (reftable_size_changed);
2716
2717 /* The above loop must have run at least once */
2718 assert(reftable_offset >= 0);
2719
2720 /*
2721 * All allocations are done, all refblocks are written, convert the
2722 * reftable to big-endian and write it to disk.
2723 */
2724
2725 for (refblock_index = 0; refblock_index < on_disk_reftable_entries;
2726 refblock_index++)
2727 {
2728 cpu_to_be64s(&on_disk_reftable[refblock_index]);
2729 }
2730
2731 ret = qcow2_pre_write_overlap_check(bs, 0, reftable_offset, reftable_length,
2732 false);
2733 if (ret < 0) {
2734 error_setg_errno(errp, -ret, "ERROR writing reftable");
2735 goto fail;
2736 }
2737
2738 assert(reftable_length < INT_MAX);
2739 ret = bdrv_co_pwrite(bs->file, reftable_offset, reftable_length,
2740 on_disk_reftable, 0);
2741 if (ret < 0) {
2742 error_setg_errno(errp, -ret, "ERROR writing reftable");
2743 goto fail;
2744 }
2745
2746 /* Enter new reftable into the image header */
2747 reftable_offset_and_clusters.reftable_offset = cpu_to_be64(reftable_offset);
2748 reftable_offset_and_clusters.reftable_clusters =
2749 cpu_to_be32(reftable_clusters);
2750 ret = bdrv_co_pwrite_sync(bs->file,
2751 offsetof(QCowHeader, refcount_table_offset),
2752 sizeof(reftable_offset_and_clusters),
2753 &reftable_offset_and_clusters, 0);
2754 if (ret < 0) {
2755 error_setg_errno(errp, -ret, "ERROR setting reftable");
2756 goto fail;
2757 }
2758
2759 for (refblock_index = 0; refblock_index < on_disk_reftable_entries;
2760 refblock_index++)
2761 {
2762 be64_to_cpus(&on_disk_reftable[refblock_index]);
2763 }
2764 s->refcount_table = on_disk_reftable;
2765 s->refcount_table_offset = reftable_offset;
2766 s->refcount_table_size = on_disk_reftable_entries;
2767 update_max_refcount_table_index(s);
2768
2769 return 0;
2770
2771 fail:
2772 g_free(on_disk_reftable);
2773 return ret;
2774 }
2775
2776 /*
2777 * Checks an image for refcount consistency.
2778 *
2779 * Returns 0 if no errors are found, the number of errors in case the image is
2780 * detected as corrupted, and -errno when an internal error occurred.
2781 */
2782 int coroutine_fn GRAPH_RDLOCK
qcow2_check_refcounts(BlockDriverState * bs,BdrvCheckResult * res,BdrvCheckMode fix)2783 qcow2_check_refcounts(BlockDriverState *bs, BdrvCheckResult *res, BdrvCheckMode fix)
2784 {
2785 BDRVQcow2State *s = bs->opaque;
2786 BdrvCheckResult pre_compare_res;
2787 int64_t size, highest_cluster, nb_clusters;
2788 void *refcount_table = NULL;
2789 bool rebuild = false;
2790 int ret;
2791
2792 size = bdrv_co_getlength(bs->file->bs);
2793 if (size < 0) {
2794 res->check_errors++;
2795 return size;
2796 }
2797
2798 nb_clusters = size_to_clusters(s, size);
2799 if (nb_clusters > INT_MAX) {
2800 res->check_errors++;
2801 return -EFBIG;
2802 }
2803
2804 res->bfi.total_clusters =
2805 size_to_clusters(s, bs->total_sectors * BDRV_SECTOR_SIZE);
2806
2807 ret = calculate_refcounts(bs, res, fix, &rebuild, &refcount_table,
2808 &nb_clusters);
2809 if (ret < 0) {
2810 goto fail;
2811 }
2812
2813 /* In case we don't need to rebuild the refcount structure (but want to fix
2814 * something), this function is immediately called again, in which case the
2815 * result should be ignored */
2816 pre_compare_res = *res;
2817 compare_refcounts(bs, res, 0, &rebuild, &highest_cluster, refcount_table,
2818 nb_clusters);
2819
2820 if (rebuild && (fix & BDRV_FIX_ERRORS)) {
2821 BdrvCheckResult old_res = *res;
2822 int fresh_leaks = 0;
2823 Error *local_err = NULL;
2824
2825 fprintf(stderr, "Rebuilding refcount structure\n");
2826 ret = rebuild_refcount_structure(bs, res, &refcount_table,
2827 &nb_clusters, &local_err);
2828 if (ret < 0) {
2829 error_report_err(local_err);
2830 goto fail;
2831 }
2832
2833 res->corruptions = 0;
2834 res->leaks = 0;
2835
2836 /* Because the old reftable has been exchanged for a new one the
2837 * references have to be recalculated */
2838 rebuild = false;
2839 memset(refcount_table, 0, refcount_array_byte_size(s, nb_clusters));
2840 ret = calculate_refcounts(bs, res, 0, &rebuild, &refcount_table,
2841 &nb_clusters);
2842 if (ret < 0) {
2843 goto fail;
2844 }
2845
2846 if (fix & BDRV_FIX_LEAKS) {
2847 /* The old refcount structures are now leaked, fix it; the result
2848 * can be ignored, aside from leaks which were introduced by
2849 * rebuild_refcount_structure() that could not be fixed */
2850 BdrvCheckResult saved_res = *res;
2851 *res = (BdrvCheckResult){ 0 };
2852
2853 compare_refcounts(bs, res, BDRV_FIX_LEAKS, &rebuild,
2854 &highest_cluster, refcount_table, nb_clusters);
2855 if (rebuild) {
2856 fprintf(stderr, "ERROR rebuilt refcount structure is still "
2857 "broken\n");
2858 }
2859
2860 /* Any leaks accounted for here were introduced by
2861 * rebuild_refcount_structure() because that function has created a
2862 * new refcount structure from scratch */
2863 fresh_leaks = res->leaks;
2864 *res = saved_res;
2865 }
2866
2867 if (res->corruptions < old_res.corruptions) {
2868 res->corruptions_fixed += old_res.corruptions - res->corruptions;
2869 }
2870 if (res->leaks < old_res.leaks) {
2871 res->leaks_fixed += old_res.leaks - res->leaks;
2872 }
2873 res->leaks += fresh_leaks;
2874 } else if (fix) {
2875 if (rebuild) {
2876 fprintf(stderr, "ERROR need to rebuild refcount structures\n");
2877 res->check_errors++;
2878 ret = -EIO;
2879 goto fail;
2880 }
2881
2882 if (res->leaks || res->corruptions) {
2883 *res = pre_compare_res;
2884 compare_refcounts(bs, res, fix, &rebuild, &highest_cluster,
2885 refcount_table, nb_clusters);
2886 }
2887 }
2888
2889 /* check OFLAG_COPIED */
2890 ret = check_oflag_copied(bs, res, fix);
2891 if (ret < 0) {
2892 goto fail;
2893 }
2894
2895 res->image_end_offset = (highest_cluster + 1) * s->cluster_size;
2896 ret = 0;
2897
2898 fail:
2899 g_free(refcount_table);
2900
2901 return ret;
2902 }
2903
2904 #define overlaps_with(ofs, sz) \
2905 ranges_overlap(offset, size, ofs, sz)
2906
2907 /*
2908 * Checks if the given offset into the image file is actually free to use by
2909 * looking for overlaps with important metadata sections (L1/L2 tables etc.),
2910 * i.e. a sanity check without relying on the refcount tables.
2911 *
2912 * The ign parameter specifies what checks not to perform (being a bitmask of
2913 * QCow2MetadataOverlap values), i.e., what sections to ignore.
2914 *
2915 * Returns:
2916 * - 0 if writing to this offset will not affect the mentioned metadata
2917 * - a positive QCow2MetadataOverlap value indicating one overlapping section
2918 * - a negative value (-errno) indicating an error while performing a check,
2919 * e.g. when bdrv_pread failed on QCOW2_OL_INACTIVE_L2
2920 */
qcow2_check_metadata_overlap(BlockDriverState * bs,int ign,int64_t offset,int64_t size)2921 int qcow2_check_metadata_overlap(BlockDriverState *bs, int ign, int64_t offset,
2922 int64_t size)
2923 {
2924 BDRVQcow2State *s = bs->opaque;
2925 int chk = s->overlap_check & ~ign;
2926 int i, j;
2927
2928 if (!size) {
2929 return 0;
2930 }
2931
2932 if (chk & QCOW2_OL_MAIN_HEADER) {
2933 if (offset < s->cluster_size) {
2934 return QCOW2_OL_MAIN_HEADER;
2935 }
2936 }
2937
2938 /* align range to test to cluster boundaries */
2939 size = ROUND_UP(offset_into_cluster(s, offset) + size, s->cluster_size);
2940 offset = start_of_cluster(s, offset);
2941
2942 if ((chk & QCOW2_OL_ACTIVE_L1) && s->l1_size) {
2943 if (overlaps_with(s->l1_table_offset, s->l1_size * L1E_SIZE)) {
2944 return QCOW2_OL_ACTIVE_L1;
2945 }
2946 }
2947
2948 if ((chk & QCOW2_OL_REFCOUNT_TABLE) && s->refcount_table_size) {
2949 if (overlaps_with(s->refcount_table_offset,
2950 s->refcount_table_size * REFTABLE_ENTRY_SIZE)) {
2951 return QCOW2_OL_REFCOUNT_TABLE;
2952 }
2953 }
2954
2955 if ((chk & QCOW2_OL_SNAPSHOT_TABLE) && s->snapshots_size) {
2956 if (overlaps_with(s->snapshots_offset, s->snapshots_size)) {
2957 return QCOW2_OL_SNAPSHOT_TABLE;
2958 }
2959 }
2960
2961 if ((chk & QCOW2_OL_INACTIVE_L1) && s->snapshots) {
2962 for (i = 0; i < s->nb_snapshots; i++) {
2963 if (s->snapshots[i].l1_size &&
2964 overlaps_with(s->snapshots[i].l1_table_offset,
2965 s->snapshots[i].l1_size * L1E_SIZE)) {
2966 return QCOW2_OL_INACTIVE_L1;
2967 }
2968 }
2969 }
2970
2971 if ((chk & QCOW2_OL_ACTIVE_L2) && s->l1_table) {
2972 for (i = 0; i < s->l1_size; i++) {
2973 if ((s->l1_table[i] & L1E_OFFSET_MASK) &&
2974 overlaps_with(s->l1_table[i] & L1E_OFFSET_MASK,
2975 s->cluster_size)) {
2976 return QCOW2_OL_ACTIVE_L2;
2977 }
2978 }
2979 }
2980
2981 if ((chk & QCOW2_OL_REFCOUNT_BLOCK) && s->refcount_table) {
2982 unsigned last_entry = s->max_refcount_table_index;
2983 assert(last_entry < s->refcount_table_size);
2984 assert(last_entry + 1 == s->refcount_table_size ||
2985 (s->refcount_table[last_entry + 1] & REFT_OFFSET_MASK) == 0);
2986 for (i = 0; i <= last_entry; i++) {
2987 if ((s->refcount_table[i] & REFT_OFFSET_MASK) &&
2988 overlaps_with(s->refcount_table[i] & REFT_OFFSET_MASK,
2989 s->cluster_size)) {
2990 return QCOW2_OL_REFCOUNT_BLOCK;
2991 }
2992 }
2993 }
2994
2995 if ((chk & QCOW2_OL_INACTIVE_L2) && s->snapshots) {
2996 for (i = 0; i < s->nb_snapshots; i++) {
2997 uint64_t l1_ofs = s->snapshots[i].l1_table_offset;
2998 uint32_t l1_sz = s->snapshots[i].l1_size;
2999 uint64_t l1_sz2 = l1_sz * L1E_SIZE;
3000 uint64_t *l1;
3001 int ret;
3002
3003 ret = qcow2_validate_table(bs, l1_ofs, l1_sz, L1E_SIZE,
3004 QCOW_MAX_L1_SIZE, "", NULL);
3005 if (ret < 0) {
3006 return ret;
3007 }
3008
3009 l1 = g_try_malloc(l1_sz2);
3010
3011 if (l1_sz2 && l1 == NULL) {
3012 return -ENOMEM;
3013 }
3014
3015 ret = bdrv_pread(bs->file, l1_ofs, l1_sz2, l1, 0);
3016 if (ret < 0) {
3017 g_free(l1);
3018 return ret;
3019 }
3020
3021 for (j = 0; j < l1_sz; j++) {
3022 uint64_t l2_ofs = be64_to_cpu(l1[j]) & L1E_OFFSET_MASK;
3023 if (l2_ofs && overlaps_with(l2_ofs, s->cluster_size)) {
3024 g_free(l1);
3025 return QCOW2_OL_INACTIVE_L2;
3026 }
3027 }
3028
3029 g_free(l1);
3030 }
3031 }
3032
3033 if ((chk & QCOW2_OL_BITMAP_DIRECTORY) &&
3034 (s->autoclear_features & QCOW2_AUTOCLEAR_BITMAPS))
3035 {
3036 if (overlaps_with(s->bitmap_directory_offset,
3037 s->bitmap_directory_size))
3038 {
3039 return QCOW2_OL_BITMAP_DIRECTORY;
3040 }
3041 }
3042
3043 return 0;
3044 }
3045
3046 static const char *metadata_ol_names[] = {
3047 [QCOW2_OL_MAIN_HEADER_BITNR] = "qcow2_header",
3048 [QCOW2_OL_ACTIVE_L1_BITNR] = "active L1 table",
3049 [QCOW2_OL_ACTIVE_L2_BITNR] = "active L2 table",
3050 [QCOW2_OL_REFCOUNT_TABLE_BITNR] = "refcount table",
3051 [QCOW2_OL_REFCOUNT_BLOCK_BITNR] = "refcount block",
3052 [QCOW2_OL_SNAPSHOT_TABLE_BITNR] = "snapshot table",
3053 [QCOW2_OL_INACTIVE_L1_BITNR] = "inactive L1 table",
3054 [QCOW2_OL_INACTIVE_L2_BITNR] = "inactive L2 table",
3055 [QCOW2_OL_BITMAP_DIRECTORY_BITNR] = "bitmap directory",
3056 };
3057 QEMU_BUILD_BUG_ON(QCOW2_OL_MAX_BITNR != ARRAY_SIZE(metadata_ol_names));
3058
3059 /*
3060 * First performs a check for metadata overlaps (through
3061 * qcow2_check_metadata_overlap); if that fails with a negative value (error
3062 * while performing a check), that value is returned. If an impending overlap
3063 * is detected, the BDS will be made unusable, the qcow2 file marked corrupt
3064 * and -EIO returned.
3065 *
3066 * Returns 0 if there were neither overlaps nor errors while checking for
3067 * overlaps; or a negative value (-errno) on error.
3068 */
qcow2_pre_write_overlap_check(BlockDriverState * bs,int ign,int64_t offset,int64_t size,bool data_file)3069 int qcow2_pre_write_overlap_check(BlockDriverState *bs, int ign, int64_t offset,
3070 int64_t size, bool data_file)
3071 {
3072 int ret;
3073
3074 if (data_file && has_data_file(bs)) {
3075 return 0;
3076 }
3077
3078 ret = qcow2_check_metadata_overlap(bs, ign, offset, size);
3079 if (ret < 0) {
3080 return ret;
3081 } else if (ret > 0) {
3082 int metadata_ol_bitnr = ctz32(ret);
3083 assert(metadata_ol_bitnr < QCOW2_OL_MAX_BITNR);
3084
3085 qcow2_signal_corruption(bs, true, offset, size, "Preventing invalid "
3086 "write on metadata (overlaps with %s)",
3087 metadata_ol_names[metadata_ol_bitnr]);
3088 return -EIO;
3089 }
3090
3091 return 0;
3092 }
3093
3094 /* A pointer to a function of this type is given to walk_over_reftable(). That
3095 * function will create refblocks and pass them to a RefblockFinishOp once they
3096 * are completed (@refblock). @refblock_empty is set if the refblock is
3097 * completely empty.
3098 *
3099 * Along with the refblock, a corresponding reftable entry is passed, in the
3100 * reftable @reftable (which may be reallocated) at @reftable_index.
3101 *
3102 * @allocated should be set to true if a new cluster has been allocated.
3103 */
3104 typedef int /* GRAPH_RDLOCK_PTR */
3105 (RefblockFinishOp)(BlockDriverState *bs, uint64_t **reftable,
3106 uint64_t reftable_index, uint64_t *reftable_size,
3107 void *refblock, bool refblock_empty,
3108 bool *allocated, Error **errp);
3109
3110 /**
3111 * This "operation" for walk_over_reftable() allocates the refblock on disk (if
3112 * it is not empty) and inserts its offset into the new reftable. The size of
3113 * this new reftable is increased as required.
3114 */
3115 static int GRAPH_RDLOCK
alloc_refblock(BlockDriverState * bs,uint64_t ** reftable,uint64_t reftable_index,uint64_t * reftable_size,void * refblock,bool refblock_empty,bool * allocated,Error ** errp)3116 alloc_refblock(BlockDriverState *bs, uint64_t **reftable,
3117 uint64_t reftable_index, uint64_t *reftable_size,
3118 void *refblock, bool refblock_empty, bool *allocated,
3119 Error **errp)
3120 {
3121 BDRVQcow2State *s = bs->opaque;
3122 int64_t offset;
3123
3124 if (!refblock_empty && reftable_index >= *reftable_size) {
3125 uint64_t *new_reftable;
3126 uint64_t new_reftable_size;
3127
3128 new_reftable_size = ROUND_UP(reftable_index + 1,
3129 s->cluster_size / REFTABLE_ENTRY_SIZE);
3130 if (new_reftable_size > QCOW_MAX_REFTABLE_SIZE / REFTABLE_ENTRY_SIZE) {
3131 error_setg(errp,
3132 "This operation would make the refcount table grow "
3133 "beyond the maximum size supported by QEMU, aborting");
3134 return -ENOTSUP;
3135 }
3136
3137 new_reftable = g_try_realloc(*reftable, new_reftable_size *
3138 REFTABLE_ENTRY_SIZE);
3139 if (!new_reftable) {
3140 error_setg(errp, "Failed to increase reftable buffer size");
3141 return -ENOMEM;
3142 }
3143
3144 memset(new_reftable + *reftable_size, 0,
3145 (new_reftable_size - *reftable_size) * REFTABLE_ENTRY_SIZE);
3146
3147 *reftable = new_reftable;
3148 *reftable_size = new_reftable_size;
3149 }
3150
3151 if (!refblock_empty && !(*reftable)[reftable_index]) {
3152 offset = qcow2_alloc_clusters(bs, s->cluster_size);
3153 if (offset < 0) {
3154 error_setg_errno(errp, -offset, "Failed to allocate refblock");
3155 return offset;
3156 }
3157 (*reftable)[reftable_index] = offset;
3158 *allocated = true;
3159 }
3160
3161 return 0;
3162 }
3163
3164 /**
3165 * This "operation" for walk_over_reftable() writes the refblock to disk at the
3166 * offset specified by the new reftable's entry. It does not modify the new
3167 * reftable or change any refcounts.
3168 */
3169 static int GRAPH_RDLOCK
flush_refblock(BlockDriverState * bs,uint64_t ** reftable,uint64_t reftable_index,uint64_t * reftable_size,void * refblock,bool refblock_empty,bool * allocated,Error ** errp)3170 flush_refblock(BlockDriverState *bs, uint64_t **reftable,
3171 uint64_t reftable_index, uint64_t *reftable_size,
3172 void *refblock, bool refblock_empty, bool *allocated,
3173 Error **errp)
3174 {
3175 BDRVQcow2State *s = bs->opaque;
3176 int64_t offset;
3177 int ret;
3178
3179 if (reftable_index < *reftable_size && (*reftable)[reftable_index]) {
3180 offset = (*reftable)[reftable_index];
3181
3182 ret = qcow2_pre_write_overlap_check(bs, 0, offset, s->cluster_size,
3183 false);
3184 if (ret < 0) {
3185 error_setg_errno(errp, -ret, "Overlap check failed");
3186 return ret;
3187 }
3188
3189 ret = bdrv_pwrite(bs->file, offset, s->cluster_size, refblock, 0);
3190 if (ret < 0) {
3191 error_setg_errno(errp, -ret, "Failed to write refblock");
3192 return ret;
3193 }
3194 } else {
3195 assert(refblock_empty);
3196 }
3197
3198 return 0;
3199 }
3200
3201 /**
3202 * This function walks over the existing reftable and every referenced refblock;
3203 * if @new_set_refcount is non-NULL, it is called for every refcount entry to
3204 * create an equal new entry in the passed @new_refblock. Once that
3205 * @new_refblock is completely filled, @operation will be called.
3206 *
3207 * @status_cb and @cb_opaque are used for the amend operation's status callback.
3208 * @index is the index of the walk_over_reftable() calls and @total is the total
3209 * number of walk_over_reftable() calls per amend operation. Both are used for
3210 * calculating the parameters for the status callback.
3211 *
3212 * @allocated is set to true if a new cluster has been allocated.
3213 */
3214 static int GRAPH_RDLOCK
walk_over_reftable(BlockDriverState * bs,uint64_t ** new_reftable,uint64_t * new_reftable_index,uint64_t * new_reftable_size,void * new_refblock,int new_refblock_size,int new_refcount_bits,RefblockFinishOp * operation,bool * allocated,Qcow2SetRefcountFunc * new_set_refcount,BlockDriverAmendStatusCB * status_cb,void * cb_opaque,int index,int total,Error ** errp)3215 walk_over_reftable(BlockDriverState *bs, uint64_t **new_reftable,
3216 uint64_t *new_reftable_index,
3217 uint64_t *new_reftable_size,
3218 void *new_refblock, int new_refblock_size,
3219 int new_refcount_bits,
3220 RefblockFinishOp *operation, bool *allocated,
3221 Qcow2SetRefcountFunc *new_set_refcount,
3222 BlockDriverAmendStatusCB *status_cb,
3223 void *cb_opaque, int index, int total,
3224 Error **errp)
3225 {
3226 BDRVQcow2State *s = bs->opaque;
3227 uint64_t reftable_index;
3228 bool new_refblock_empty = true;
3229 int refblock_index;
3230 int new_refblock_index = 0;
3231 int ret;
3232
3233 for (reftable_index = 0; reftable_index < s->refcount_table_size;
3234 reftable_index++)
3235 {
3236 uint64_t refblock_offset = s->refcount_table[reftable_index]
3237 & REFT_OFFSET_MASK;
3238
3239 status_cb(bs, (uint64_t)index * s->refcount_table_size + reftable_index,
3240 (uint64_t)total * s->refcount_table_size, cb_opaque);
3241
3242 if (refblock_offset) {
3243 void *refblock;
3244
3245 if (offset_into_cluster(s, refblock_offset)) {
3246 qcow2_signal_corruption(bs, true, -1, -1, "Refblock offset %#"
3247 PRIx64 " unaligned (reftable index: %#"
3248 PRIx64 ")", refblock_offset,
3249 reftable_index);
3250 error_setg(errp,
3251 "Image is corrupt (unaligned refblock offset)");
3252 return -EIO;
3253 }
3254
3255 ret = qcow2_cache_get(bs, s->refcount_block_cache, refblock_offset,
3256 &refblock);
3257 if (ret < 0) {
3258 error_setg_errno(errp, -ret, "Failed to retrieve refblock");
3259 return ret;
3260 }
3261
3262 for (refblock_index = 0; refblock_index < s->refcount_block_size;
3263 refblock_index++)
3264 {
3265 uint64_t refcount;
3266
3267 if (new_refblock_index >= new_refblock_size) {
3268 /* new_refblock is now complete */
3269 ret = operation(bs, new_reftable, *new_reftable_index,
3270 new_reftable_size, new_refblock,
3271 new_refblock_empty, allocated, errp);
3272 if (ret < 0) {
3273 qcow2_cache_put(s->refcount_block_cache, &refblock);
3274 return ret;
3275 }
3276
3277 (*new_reftable_index)++;
3278 new_refblock_index = 0;
3279 new_refblock_empty = true;
3280 }
3281
3282 refcount = s->get_refcount(refblock, refblock_index);
3283 if (new_refcount_bits < 64 && refcount >> new_refcount_bits) {
3284 uint64_t offset;
3285
3286 qcow2_cache_put(s->refcount_block_cache, &refblock);
3287
3288 offset = ((reftable_index << s->refcount_block_bits)
3289 + refblock_index) << s->cluster_bits;
3290
3291 error_setg(errp, "Cannot decrease refcount entry width to "
3292 "%i bits: Cluster at offset %#" PRIx64 " has a "
3293 "refcount of %" PRIu64, new_refcount_bits,
3294 offset, refcount);
3295 return -EINVAL;
3296 }
3297
3298 if (new_set_refcount) {
3299 new_set_refcount(new_refblock, new_refblock_index++,
3300 refcount);
3301 } else {
3302 new_refblock_index++;
3303 }
3304 new_refblock_empty = new_refblock_empty && refcount == 0;
3305 }
3306
3307 qcow2_cache_put(s->refcount_block_cache, &refblock);
3308 } else {
3309 /* No refblock means every refcount is 0 */
3310 for (refblock_index = 0; refblock_index < s->refcount_block_size;
3311 refblock_index++)
3312 {
3313 if (new_refblock_index >= new_refblock_size) {
3314 /* new_refblock is now complete */
3315 ret = operation(bs, new_reftable, *new_reftable_index,
3316 new_reftable_size, new_refblock,
3317 new_refblock_empty, allocated, errp);
3318 if (ret < 0) {
3319 return ret;
3320 }
3321
3322 (*new_reftable_index)++;
3323 new_refblock_index = 0;
3324 new_refblock_empty = true;
3325 }
3326
3327 if (new_set_refcount) {
3328 new_set_refcount(new_refblock, new_refblock_index++, 0);
3329 } else {
3330 new_refblock_index++;
3331 }
3332 }
3333 }
3334 }
3335
3336 if (new_refblock_index > 0) {
3337 /* Complete the potentially existing partially filled final refblock */
3338 if (new_set_refcount) {
3339 for (; new_refblock_index < new_refblock_size;
3340 new_refblock_index++)
3341 {
3342 new_set_refcount(new_refblock, new_refblock_index, 0);
3343 }
3344 }
3345
3346 ret = operation(bs, new_reftable, *new_reftable_index,
3347 new_reftable_size, new_refblock, new_refblock_empty,
3348 allocated, errp);
3349 if (ret < 0) {
3350 return ret;
3351 }
3352
3353 (*new_reftable_index)++;
3354 }
3355
3356 status_cb(bs, (uint64_t)(index + 1) * s->refcount_table_size,
3357 (uint64_t)total * s->refcount_table_size, cb_opaque);
3358
3359 return 0;
3360 }
3361
qcow2_change_refcount_order(BlockDriverState * bs,int refcount_order,BlockDriverAmendStatusCB * status_cb,void * cb_opaque,Error ** errp)3362 int qcow2_change_refcount_order(BlockDriverState *bs, int refcount_order,
3363 BlockDriverAmendStatusCB *status_cb,
3364 void *cb_opaque, Error **errp)
3365 {
3366 BDRVQcow2State *s = bs->opaque;
3367 Qcow2GetRefcountFunc *new_get_refcount;
3368 Qcow2SetRefcountFunc *new_set_refcount;
3369 void *new_refblock = qemu_blockalign(bs->file->bs, s->cluster_size);
3370 uint64_t *new_reftable = NULL, new_reftable_size = 0;
3371 uint64_t *old_reftable, old_reftable_size, old_reftable_offset;
3372 uint64_t new_reftable_index = 0;
3373 uint64_t i;
3374 int64_t new_reftable_offset = 0, allocated_reftable_size = 0;
3375 int new_refblock_size, new_refcount_bits = 1 << refcount_order;
3376 int old_refcount_order;
3377 int walk_index = 0;
3378 int ret;
3379 bool new_allocation;
3380
3381 assert(s->qcow_version >= 3);
3382 assert(refcount_order >= 0 && refcount_order <= 6);
3383
3384 /* see qcow2_open() */
3385 new_refblock_size = 1 << (s->cluster_bits - (refcount_order - 3));
3386
3387 new_get_refcount = get_refcount_funcs[refcount_order];
3388 new_set_refcount = set_refcount_funcs[refcount_order];
3389
3390
3391 do {
3392 int total_walks;
3393
3394 new_allocation = false;
3395
3396 /* At least we have to do this walk and the one which writes the
3397 * refblocks; also, at least we have to do this loop here at least
3398 * twice (normally), first to do the allocations, and second to
3399 * determine that everything is correctly allocated, this then makes
3400 * three walks in total */
3401 total_walks = MAX(walk_index + 2, 3);
3402
3403 /* First, allocate the structures so they are present in the refcount
3404 * structures */
3405 ret = walk_over_reftable(bs, &new_reftable, &new_reftable_index,
3406 &new_reftable_size, NULL, new_refblock_size,
3407 new_refcount_bits, &alloc_refblock,
3408 &new_allocation, NULL, status_cb, cb_opaque,
3409 walk_index++, total_walks, errp);
3410 if (ret < 0) {
3411 goto done;
3412 }
3413
3414 new_reftable_index = 0;
3415
3416 if (new_allocation) {
3417 if (new_reftable_offset) {
3418 qcow2_free_clusters(
3419 bs, new_reftable_offset,
3420 allocated_reftable_size * REFTABLE_ENTRY_SIZE,
3421 QCOW2_DISCARD_NEVER);
3422 }
3423
3424 new_reftable_offset = qcow2_alloc_clusters(bs, new_reftable_size *
3425 REFTABLE_ENTRY_SIZE);
3426 if (new_reftable_offset < 0) {
3427 error_setg_errno(errp, -new_reftable_offset,
3428 "Failed to allocate the new reftable");
3429 ret = new_reftable_offset;
3430 goto done;
3431 }
3432 allocated_reftable_size = new_reftable_size;
3433 }
3434 } while (new_allocation);
3435
3436 /* Second, write the new refblocks */
3437 ret = walk_over_reftable(bs, &new_reftable, &new_reftable_index,
3438 &new_reftable_size, new_refblock,
3439 new_refblock_size, new_refcount_bits,
3440 &flush_refblock, &new_allocation, new_set_refcount,
3441 status_cb, cb_opaque, walk_index, walk_index + 1,
3442 errp);
3443 if (ret < 0) {
3444 goto done;
3445 }
3446 assert(!new_allocation);
3447
3448
3449 /* Write the new reftable */
3450 ret = qcow2_pre_write_overlap_check(bs, 0, new_reftable_offset,
3451 new_reftable_size * REFTABLE_ENTRY_SIZE,
3452 false);
3453 if (ret < 0) {
3454 error_setg_errno(errp, -ret, "Overlap check failed");
3455 goto done;
3456 }
3457
3458 for (i = 0; i < new_reftable_size; i++) {
3459 cpu_to_be64s(&new_reftable[i]);
3460 }
3461
3462 ret = bdrv_pwrite(bs->file, new_reftable_offset,
3463 new_reftable_size * REFTABLE_ENTRY_SIZE, new_reftable,
3464 0);
3465
3466 for (i = 0; i < new_reftable_size; i++) {
3467 be64_to_cpus(&new_reftable[i]);
3468 }
3469
3470 if (ret < 0) {
3471 error_setg_errno(errp, -ret, "Failed to write the new reftable");
3472 goto done;
3473 }
3474
3475
3476 /* Empty the refcount cache */
3477 ret = qcow2_cache_flush(bs, s->refcount_block_cache);
3478 if (ret < 0) {
3479 error_setg_errno(errp, -ret, "Failed to flush the refblock cache");
3480 goto done;
3481 }
3482
3483 /* Update the image header to point to the new reftable; this only updates
3484 * the fields which are relevant to qcow2_update_header(); other fields
3485 * such as s->refcount_table or s->refcount_bits stay stale for now
3486 * (because we have to restore everything if qcow2_update_header() fails) */
3487 old_refcount_order = s->refcount_order;
3488 old_reftable_size = s->refcount_table_size;
3489 old_reftable_offset = s->refcount_table_offset;
3490
3491 s->refcount_order = refcount_order;
3492 s->refcount_table_size = new_reftable_size;
3493 s->refcount_table_offset = new_reftable_offset;
3494
3495 ret = qcow2_update_header(bs);
3496 if (ret < 0) {
3497 s->refcount_order = old_refcount_order;
3498 s->refcount_table_size = old_reftable_size;
3499 s->refcount_table_offset = old_reftable_offset;
3500 error_setg_errno(errp, -ret, "Failed to update the qcow2 header");
3501 goto done;
3502 }
3503
3504 /* Now update the rest of the in-memory information */
3505 old_reftable = s->refcount_table;
3506 s->refcount_table = new_reftable;
3507 update_max_refcount_table_index(s);
3508
3509 s->refcount_bits = 1 << refcount_order;
3510 s->refcount_max = UINT64_C(1) << (s->refcount_bits - 1);
3511 s->refcount_max += s->refcount_max - 1;
3512
3513 s->refcount_block_bits = s->cluster_bits - (refcount_order - 3);
3514 s->refcount_block_size = 1 << s->refcount_block_bits;
3515
3516 s->get_refcount = new_get_refcount;
3517 s->set_refcount = new_set_refcount;
3518
3519 /* For cleaning up all old refblocks and the old reftable below the "done"
3520 * label */
3521 new_reftable = old_reftable;
3522 new_reftable_size = old_reftable_size;
3523 new_reftable_offset = old_reftable_offset;
3524
3525 done:
3526 if (new_reftable) {
3527 /* On success, new_reftable actually points to the old reftable (and
3528 * new_reftable_size is the old reftable's size); but that is just
3529 * fine */
3530 for (i = 0; i < new_reftable_size; i++) {
3531 uint64_t offset = new_reftable[i] & REFT_OFFSET_MASK;
3532 if (offset) {
3533 qcow2_free_clusters(bs, offset, s->cluster_size,
3534 QCOW2_DISCARD_OTHER);
3535 }
3536 }
3537 g_free(new_reftable);
3538
3539 if (new_reftable_offset > 0) {
3540 qcow2_free_clusters(bs, new_reftable_offset,
3541 new_reftable_size * REFTABLE_ENTRY_SIZE,
3542 QCOW2_DISCARD_OTHER);
3543 }
3544 }
3545
3546 qemu_vfree(new_refblock);
3547 return ret;
3548 }
3549
3550 static int64_t coroutine_fn GRAPH_RDLOCK
get_refblock_offset(BlockDriverState * bs,uint64_t offset)3551 get_refblock_offset(BlockDriverState *bs, uint64_t offset)
3552 {
3553 BDRVQcow2State *s = bs->opaque;
3554 uint32_t index = offset_to_reftable_index(s, offset);
3555 int64_t covering_refblock_offset = 0;
3556
3557 if (index < s->refcount_table_size) {
3558 covering_refblock_offset = s->refcount_table[index] & REFT_OFFSET_MASK;
3559 }
3560 if (!covering_refblock_offset) {
3561 qcow2_signal_corruption(bs, true, -1, -1, "Refblock at %#" PRIx64 " is "
3562 "not covered by the refcount structures",
3563 offset);
3564 return -EIO;
3565 }
3566
3567 return covering_refblock_offset;
3568 }
3569
3570 static int coroutine_fn GRAPH_RDLOCK
qcow2_discard_refcount_block(BlockDriverState * bs,uint64_t discard_block_offs)3571 qcow2_discard_refcount_block(BlockDriverState *bs, uint64_t discard_block_offs)
3572 {
3573 BDRVQcow2State *s = bs->opaque;
3574 int64_t refblock_offs;
3575 uint64_t cluster_index = discard_block_offs >> s->cluster_bits;
3576 uint32_t block_index = cluster_index & (s->refcount_block_size - 1);
3577 void *refblock;
3578 int ret;
3579
3580 refblock_offs = get_refblock_offset(bs, discard_block_offs);
3581 if (refblock_offs < 0) {
3582 return refblock_offs;
3583 }
3584
3585 assert(discard_block_offs != 0);
3586
3587 ret = qcow2_cache_get(bs, s->refcount_block_cache, refblock_offs,
3588 &refblock);
3589 if (ret < 0) {
3590 return ret;
3591 }
3592
3593 if (s->get_refcount(refblock, block_index) != 1) {
3594 qcow2_signal_corruption(bs, true, -1, -1, "Invalid refcount:"
3595 " refblock offset %#" PRIx64
3596 ", reftable index %u"
3597 ", block offset %#" PRIx64
3598 ", refcount %#" PRIx64,
3599 refblock_offs,
3600 offset_to_reftable_index(s, discard_block_offs),
3601 discard_block_offs,
3602 s->get_refcount(refblock, block_index));
3603 qcow2_cache_put(s->refcount_block_cache, &refblock);
3604 return -EINVAL;
3605 }
3606 s->set_refcount(refblock, block_index, 0);
3607
3608 qcow2_cache_entry_mark_dirty(s->refcount_block_cache, refblock);
3609
3610 qcow2_cache_put(s->refcount_block_cache, &refblock);
3611
3612 if (cluster_index < s->free_cluster_index) {
3613 s->free_cluster_index = cluster_index;
3614 }
3615
3616 refblock = qcow2_cache_is_table_offset(s->refcount_block_cache,
3617 discard_block_offs);
3618 if (refblock) {
3619 /* discard refblock from the cache if refblock is cached */
3620 qcow2_cache_discard(s->refcount_block_cache, refblock);
3621 }
3622 update_refcount_discard(bs, discard_block_offs, s->cluster_size);
3623
3624 return 0;
3625 }
3626
qcow2_shrink_reftable(BlockDriverState * bs)3627 int coroutine_fn qcow2_shrink_reftable(BlockDriverState *bs)
3628 {
3629 BDRVQcow2State *s = bs->opaque;
3630 uint64_t *reftable_tmp =
3631 g_malloc(s->refcount_table_size * REFTABLE_ENTRY_SIZE);
3632 int i, ret;
3633
3634 for (i = 0; i < s->refcount_table_size; i++) {
3635 int64_t refblock_offs = s->refcount_table[i] & REFT_OFFSET_MASK;
3636 void *refblock;
3637 bool unused_block;
3638
3639 if (refblock_offs == 0) {
3640 reftable_tmp[i] = 0;
3641 continue;
3642 }
3643 ret = qcow2_cache_get(bs, s->refcount_block_cache, refblock_offs,
3644 &refblock);
3645 if (ret < 0) {
3646 goto out;
3647 }
3648
3649 /* the refblock has own reference */
3650 if (i == offset_to_reftable_index(s, refblock_offs)) {
3651 uint64_t block_index = (refblock_offs >> s->cluster_bits) &
3652 (s->refcount_block_size - 1);
3653 uint64_t refcount = s->get_refcount(refblock, block_index);
3654
3655 s->set_refcount(refblock, block_index, 0);
3656
3657 unused_block = buffer_is_zero(refblock, s->cluster_size);
3658
3659 s->set_refcount(refblock, block_index, refcount);
3660 } else {
3661 unused_block = buffer_is_zero(refblock, s->cluster_size);
3662 }
3663 qcow2_cache_put(s->refcount_block_cache, &refblock);
3664
3665 reftable_tmp[i] = unused_block ? 0 : cpu_to_be64(s->refcount_table[i]);
3666 }
3667
3668 ret = bdrv_co_pwrite_sync(bs->file, s->refcount_table_offset,
3669 s->refcount_table_size * REFTABLE_ENTRY_SIZE,
3670 reftable_tmp, 0);
3671 /*
3672 * If the write in the reftable failed the image may contain a partially
3673 * overwritten reftable. In this case it would be better to clear the
3674 * reftable in memory to avoid possible image corruption.
3675 */
3676 for (i = 0; i < s->refcount_table_size; i++) {
3677 if (s->refcount_table[i] && !reftable_tmp[i]) {
3678 if (ret == 0) {
3679 ret = qcow2_discard_refcount_block(bs, s->refcount_table[i] &
3680 REFT_OFFSET_MASK);
3681 }
3682 s->refcount_table[i] = 0;
3683 }
3684 }
3685
3686 if (!s->cache_discards) {
3687 qcow2_process_discards(bs, ret);
3688 }
3689
3690 out:
3691 g_free(reftable_tmp);
3692 return ret;
3693 }
3694
qcow2_get_last_cluster(BlockDriverState * bs,int64_t size)3695 int64_t coroutine_fn qcow2_get_last_cluster(BlockDriverState *bs, int64_t size)
3696 {
3697 BDRVQcow2State *s = bs->opaque;
3698 int64_t i;
3699
3700 for (i = size_to_clusters(s, size) - 1; i >= 0; i--) {
3701 uint64_t refcount;
3702 int ret = qcow2_get_refcount(bs, i, &refcount);
3703 if (ret < 0) {
3704 fprintf(stderr, "Can't get refcount for cluster %" PRId64 ": %s\n",
3705 i, strerror(-ret));
3706 return ret;
3707 }
3708 if (refcount > 0) {
3709 return i;
3710 }
3711 }
3712 qcow2_signal_corruption(bs, true, -1, -1,
3713 "There are no references in the refcount table.");
3714 return -EIO;
3715 }
3716
3717 int coroutine_fn GRAPH_RDLOCK
qcow2_detect_metadata_preallocation(BlockDriverState * bs)3718 qcow2_detect_metadata_preallocation(BlockDriverState *bs)
3719 {
3720 BDRVQcow2State *s = bs->opaque;
3721 int64_t i, end_cluster, cluster_count = 0, threshold;
3722 int64_t file_length, real_allocation, real_clusters;
3723
3724 qemu_co_mutex_assert_locked(&s->lock);
3725
3726 file_length = bdrv_co_getlength(bs->file->bs);
3727 if (file_length < 0) {
3728 return file_length;
3729 }
3730
3731 real_allocation = bdrv_co_get_allocated_file_size(bs->file->bs);
3732 if (real_allocation < 0) {
3733 return real_allocation;
3734 }
3735
3736 real_clusters = real_allocation / s->cluster_size;
3737 threshold = MAX(real_clusters * 10 / 9, real_clusters + 2);
3738
3739 end_cluster = size_to_clusters(s, file_length);
3740 for (i = 0; i < end_cluster && cluster_count < threshold; i++) {
3741 uint64_t refcount;
3742 int ret = qcow2_get_refcount(bs, i, &refcount);
3743 if (ret < 0) {
3744 return ret;
3745 }
3746 cluster_count += !!refcount;
3747 }
3748
3749 return cluster_count >= threshold;
3750 }
3751