xref: /openbmc/qemu/block/qcow2.c (revision 72f463bc0803b74cabf0655df1ef4b749ef8dbbd)
1 /*
2  * Block driver for the QCOW version 2 format
3  *
4  * Copyright (c) 2004-2006 Fabrice Bellard
5  *
6  * Permission is hereby granted, free of charge, to any person obtaining a copy
7  * of this software and associated documentation files (the "Software"), to deal
8  * in the Software without restriction, including without limitation the rights
9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10  * copies of the Software, and to permit persons to whom the Software is
11  * furnished to do so, subject to the following conditions:
12  *
13  * The above copyright notice and this permission notice shall be included in
14  * all copies or substantial portions of the Software.
15  *
16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22  * THE SOFTWARE.
23  */
24 
25 #include "qemu/osdep.h"
26 
27 #define ZLIB_CONST
28 #include <zlib.h>
29 
30 #include "block/block_int.h"
31 #include "block/qdict.h"
32 #include "sysemu/block-backend.h"
33 #include "qemu/module.h"
34 #include "qcow2.h"
35 #include "qemu/error-report.h"
36 #include "qapi/error.h"
37 #include "qapi/qapi-events-block-core.h"
38 #include "qapi/qmp/qdict.h"
39 #include "qapi/qmp/qstring.h"
40 #include "trace.h"
41 #include "qemu/option_int.h"
42 #include "qemu/cutils.h"
43 #include "qemu/bswap.h"
44 #include "qapi/qobject-input-visitor.h"
45 #include "qapi/qapi-visit-block-core.h"
46 #include "crypto.h"
47 #include "block/thread-pool.h"
48 
49 /*
50   Differences with QCOW:
51 
52   - Support for multiple incremental snapshots.
53   - Memory management by reference counts.
54   - Clusters which have a reference count of one have the bit
55     QCOW_OFLAG_COPIED to optimize write performance.
56   - Size of compressed clusters is stored in sectors to reduce bit usage
57     in the cluster offsets.
58   - Support for storing additional data (such as the VM state) in the
59     snapshots.
60   - If a backing store is used, the cluster size is not constrained
61     (could be backported to QCOW).
62   - L2 tables have always a size of one cluster.
63 */
64 
65 
66 typedef struct {
67     uint32_t magic;
68     uint32_t len;
69 } QEMU_PACKED QCowExtension;
70 
71 #define  QCOW2_EXT_MAGIC_END 0
72 #define  QCOW2_EXT_MAGIC_BACKING_FORMAT 0xE2792ACA
73 #define  QCOW2_EXT_MAGIC_FEATURE_TABLE 0x6803f857
74 #define  QCOW2_EXT_MAGIC_CRYPTO_HEADER 0x0537be77
75 #define  QCOW2_EXT_MAGIC_BITMAPS 0x23852875
76 #define  QCOW2_EXT_MAGIC_DATA_FILE 0x44415441
77 
78 static int coroutine_fn
79 qcow2_co_preadv_compressed(BlockDriverState *bs,
80                            uint64_t file_cluster_offset,
81                            uint64_t offset,
82                            uint64_t bytes,
83                            QEMUIOVector *qiov);
84 
85 static int qcow2_probe(const uint8_t *buf, int buf_size, const char *filename)
86 {
87     const QCowHeader *cow_header = (const void *)buf;
88 
89     if (buf_size >= sizeof(QCowHeader) &&
90         be32_to_cpu(cow_header->magic) == QCOW_MAGIC &&
91         be32_to_cpu(cow_header->version) >= 2)
92         return 100;
93     else
94         return 0;
95 }
96 
97 
98 static ssize_t qcow2_crypto_hdr_read_func(QCryptoBlock *block, size_t offset,
99                                           uint8_t *buf, size_t buflen,
100                                           void *opaque, Error **errp)
101 {
102     BlockDriverState *bs = opaque;
103     BDRVQcow2State *s = bs->opaque;
104     ssize_t ret;
105 
106     if ((offset + buflen) > s->crypto_header.length) {
107         error_setg(errp, "Request for data outside of extension header");
108         return -1;
109     }
110 
111     ret = bdrv_pread(bs->file,
112                      s->crypto_header.offset + offset, buf, buflen);
113     if (ret < 0) {
114         error_setg_errno(errp, -ret, "Could not read encryption header");
115         return -1;
116     }
117     return ret;
118 }
119 
120 
121 static ssize_t qcow2_crypto_hdr_init_func(QCryptoBlock *block, size_t headerlen,
122                                           void *opaque, Error **errp)
123 {
124     BlockDriverState *bs = opaque;
125     BDRVQcow2State *s = bs->opaque;
126     int64_t ret;
127     int64_t clusterlen;
128 
129     ret = qcow2_alloc_clusters(bs, headerlen);
130     if (ret < 0) {
131         error_setg_errno(errp, -ret,
132                          "Cannot allocate cluster for LUKS header size %zu",
133                          headerlen);
134         return -1;
135     }
136 
137     s->crypto_header.length = headerlen;
138     s->crypto_header.offset = ret;
139 
140     /* Zero fill remaining space in cluster so it has predictable
141      * content in case of future spec changes */
142     clusterlen = size_to_clusters(s, headerlen) * s->cluster_size;
143     assert(qcow2_pre_write_overlap_check(bs, 0, ret, clusterlen, false) == 0);
144     ret = bdrv_pwrite_zeroes(bs->file,
145                              ret + headerlen,
146                              clusterlen - headerlen, 0);
147     if (ret < 0) {
148         error_setg_errno(errp, -ret, "Could not zero fill encryption header");
149         return -1;
150     }
151 
152     return ret;
153 }
154 
155 
156 static ssize_t qcow2_crypto_hdr_write_func(QCryptoBlock *block, size_t offset,
157                                            const uint8_t *buf, size_t buflen,
158                                            void *opaque, Error **errp)
159 {
160     BlockDriverState *bs = opaque;
161     BDRVQcow2State *s = bs->opaque;
162     ssize_t ret;
163 
164     if ((offset + buflen) > s->crypto_header.length) {
165         error_setg(errp, "Request for data outside of extension header");
166         return -1;
167     }
168 
169     ret = bdrv_pwrite(bs->file,
170                       s->crypto_header.offset + offset, buf, buflen);
171     if (ret < 0) {
172         error_setg_errno(errp, -ret, "Could not read encryption header");
173         return -1;
174     }
175     return ret;
176 }
177 
178 
179 /*
180  * read qcow2 extension and fill bs
181  * start reading from start_offset
182  * finish reading upon magic of value 0 or when end_offset reached
183  * unknown magic is skipped (future extension this version knows nothing about)
184  * return 0 upon success, non-0 otherwise
185  */
186 static int qcow2_read_extensions(BlockDriverState *bs, uint64_t start_offset,
187                                  uint64_t end_offset, void **p_feature_table,
188                                  int flags, bool *need_update_header,
189                                  Error **errp)
190 {
191     BDRVQcow2State *s = bs->opaque;
192     QCowExtension ext;
193     uint64_t offset;
194     int ret;
195     Qcow2BitmapHeaderExt bitmaps_ext;
196 
197     if (need_update_header != NULL) {
198         *need_update_header = false;
199     }
200 
201 #ifdef DEBUG_EXT
202     printf("qcow2_read_extensions: start=%ld end=%ld\n", start_offset, end_offset);
203 #endif
204     offset = start_offset;
205     while (offset < end_offset) {
206 
207 #ifdef DEBUG_EXT
208         /* Sanity check */
209         if (offset > s->cluster_size)
210             printf("qcow2_read_extension: suspicious offset %lu\n", offset);
211 
212         printf("attempting to read extended header in offset %lu\n", offset);
213 #endif
214 
215         ret = bdrv_pread(bs->file, offset, &ext, sizeof(ext));
216         if (ret < 0) {
217             error_setg_errno(errp, -ret, "qcow2_read_extension: ERROR: "
218                              "pread fail from offset %" PRIu64, offset);
219             return 1;
220         }
221         ext.magic = be32_to_cpu(ext.magic);
222         ext.len = be32_to_cpu(ext.len);
223         offset += sizeof(ext);
224 #ifdef DEBUG_EXT
225         printf("ext.magic = 0x%x\n", ext.magic);
226 #endif
227         if (offset > end_offset || ext.len > end_offset - offset) {
228             error_setg(errp, "Header extension too large");
229             return -EINVAL;
230         }
231 
232         switch (ext.magic) {
233         case QCOW2_EXT_MAGIC_END:
234             return 0;
235 
236         case QCOW2_EXT_MAGIC_BACKING_FORMAT:
237             if (ext.len >= sizeof(bs->backing_format)) {
238                 error_setg(errp, "ERROR: ext_backing_format: len=%" PRIu32
239                            " too large (>=%zu)", ext.len,
240                            sizeof(bs->backing_format));
241                 return 2;
242             }
243             ret = bdrv_pread(bs->file, offset, bs->backing_format, ext.len);
244             if (ret < 0) {
245                 error_setg_errno(errp, -ret, "ERROR: ext_backing_format: "
246                                  "Could not read format name");
247                 return 3;
248             }
249             bs->backing_format[ext.len] = '\0';
250             s->image_backing_format = g_strdup(bs->backing_format);
251 #ifdef DEBUG_EXT
252             printf("Qcow2: Got format extension %s\n", bs->backing_format);
253 #endif
254             break;
255 
256         case QCOW2_EXT_MAGIC_FEATURE_TABLE:
257             if (p_feature_table != NULL) {
258                 void* feature_table = g_malloc0(ext.len + 2 * sizeof(Qcow2Feature));
259                 ret = bdrv_pread(bs->file, offset , feature_table, ext.len);
260                 if (ret < 0) {
261                     error_setg_errno(errp, -ret, "ERROR: ext_feature_table: "
262                                      "Could not read table");
263                     return ret;
264                 }
265 
266                 *p_feature_table = feature_table;
267             }
268             break;
269 
270         case QCOW2_EXT_MAGIC_CRYPTO_HEADER: {
271             unsigned int cflags = 0;
272             if (s->crypt_method_header != QCOW_CRYPT_LUKS) {
273                 error_setg(errp, "CRYPTO header extension only "
274                            "expected with LUKS encryption method");
275                 return -EINVAL;
276             }
277             if (ext.len != sizeof(Qcow2CryptoHeaderExtension)) {
278                 error_setg(errp, "CRYPTO header extension size %u, "
279                            "but expected size %zu", ext.len,
280                            sizeof(Qcow2CryptoHeaderExtension));
281                 return -EINVAL;
282             }
283 
284             ret = bdrv_pread(bs->file, offset, &s->crypto_header, ext.len);
285             if (ret < 0) {
286                 error_setg_errno(errp, -ret,
287                                  "Unable to read CRYPTO header extension");
288                 return ret;
289             }
290             s->crypto_header.offset = be64_to_cpu(s->crypto_header.offset);
291             s->crypto_header.length = be64_to_cpu(s->crypto_header.length);
292 
293             if ((s->crypto_header.offset % s->cluster_size) != 0) {
294                 error_setg(errp, "Encryption header offset '%" PRIu64 "' is "
295                            "not a multiple of cluster size '%u'",
296                            s->crypto_header.offset, s->cluster_size);
297                 return -EINVAL;
298             }
299 
300             if (flags & BDRV_O_NO_IO) {
301                 cflags |= QCRYPTO_BLOCK_OPEN_NO_IO;
302             }
303             s->crypto = qcrypto_block_open(s->crypto_opts, "encrypt.",
304                                            qcow2_crypto_hdr_read_func,
305                                            bs, cflags, 1, errp);
306             if (!s->crypto) {
307                 return -EINVAL;
308             }
309         }   break;
310 
311         case QCOW2_EXT_MAGIC_BITMAPS:
312             if (ext.len != sizeof(bitmaps_ext)) {
313                 error_setg_errno(errp, -ret, "bitmaps_ext: "
314                                  "Invalid extension length");
315                 return -EINVAL;
316             }
317 
318             if (!(s->autoclear_features & QCOW2_AUTOCLEAR_BITMAPS)) {
319                 if (s->qcow_version < 3) {
320                     /* Let's be a bit more specific */
321                     warn_report("This qcow2 v2 image contains bitmaps, but "
322                                 "they may have been modified by a program "
323                                 "without persistent bitmap support; so now "
324                                 "they must all be considered inconsistent");
325                 } else {
326                     warn_report("a program lacking bitmap support "
327                                 "modified this file, so all bitmaps are now "
328                                 "considered inconsistent");
329                 }
330                 error_printf("Some clusters may be leaked, "
331                              "run 'qemu-img check -r' on the image "
332                              "file to fix.");
333                 if (need_update_header != NULL) {
334                     /* Updating is needed to drop invalid bitmap extension. */
335                     *need_update_header = true;
336                 }
337                 break;
338             }
339 
340             ret = bdrv_pread(bs->file, offset, &bitmaps_ext, ext.len);
341             if (ret < 0) {
342                 error_setg_errno(errp, -ret, "bitmaps_ext: "
343                                  "Could not read ext header");
344                 return ret;
345             }
346 
347             if (bitmaps_ext.reserved32 != 0) {
348                 error_setg_errno(errp, -ret, "bitmaps_ext: "
349                                  "Reserved field is not zero");
350                 return -EINVAL;
351             }
352 
353             bitmaps_ext.nb_bitmaps = be32_to_cpu(bitmaps_ext.nb_bitmaps);
354             bitmaps_ext.bitmap_directory_size =
355                 be64_to_cpu(bitmaps_ext.bitmap_directory_size);
356             bitmaps_ext.bitmap_directory_offset =
357                 be64_to_cpu(bitmaps_ext.bitmap_directory_offset);
358 
359             if (bitmaps_ext.nb_bitmaps > QCOW2_MAX_BITMAPS) {
360                 error_setg(errp,
361                            "bitmaps_ext: Image has %" PRIu32 " bitmaps, "
362                            "exceeding the QEMU supported maximum of %d",
363                            bitmaps_ext.nb_bitmaps, QCOW2_MAX_BITMAPS);
364                 return -EINVAL;
365             }
366 
367             if (bitmaps_ext.nb_bitmaps == 0) {
368                 error_setg(errp, "found bitmaps extension with zero bitmaps");
369                 return -EINVAL;
370             }
371 
372             if (bitmaps_ext.bitmap_directory_offset & (s->cluster_size - 1)) {
373                 error_setg(errp, "bitmaps_ext: "
374                                  "invalid bitmap directory offset");
375                 return -EINVAL;
376             }
377 
378             if (bitmaps_ext.bitmap_directory_size >
379                 QCOW2_MAX_BITMAP_DIRECTORY_SIZE) {
380                 error_setg(errp, "bitmaps_ext: "
381                                  "bitmap directory size (%" PRIu64 ") exceeds "
382                                  "the maximum supported size (%d)",
383                                  bitmaps_ext.bitmap_directory_size,
384                                  QCOW2_MAX_BITMAP_DIRECTORY_SIZE);
385                 return -EINVAL;
386             }
387 
388             s->nb_bitmaps = bitmaps_ext.nb_bitmaps;
389             s->bitmap_directory_offset =
390                     bitmaps_ext.bitmap_directory_offset;
391             s->bitmap_directory_size =
392                     bitmaps_ext.bitmap_directory_size;
393 
394 #ifdef DEBUG_EXT
395             printf("Qcow2: Got bitmaps extension: "
396                    "offset=%" PRIu64 " nb_bitmaps=%" PRIu32 "\n",
397                    s->bitmap_directory_offset, s->nb_bitmaps);
398 #endif
399             break;
400 
401         case QCOW2_EXT_MAGIC_DATA_FILE:
402         {
403             s->image_data_file = g_malloc0(ext.len + 1);
404             ret = bdrv_pread(bs->file, offset, s->image_data_file, ext.len);
405             if (ret < 0) {
406                 error_setg_errno(errp, -ret,
407                                  "ERROR: Could not read data file name");
408                 return ret;
409             }
410 #ifdef DEBUG_EXT
411             printf("Qcow2: Got external data file %s\n", s->image_data_file);
412 #endif
413             break;
414         }
415 
416         default:
417             /* unknown magic - save it in case we need to rewrite the header */
418             /* If you add a new feature, make sure to also update the fast
419              * path of qcow2_make_empty() to deal with it. */
420             {
421                 Qcow2UnknownHeaderExtension *uext;
422 
423                 uext = g_malloc0(sizeof(*uext)  + ext.len);
424                 uext->magic = ext.magic;
425                 uext->len = ext.len;
426                 QLIST_INSERT_HEAD(&s->unknown_header_ext, uext, next);
427 
428                 ret = bdrv_pread(bs->file, offset , uext->data, uext->len);
429                 if (ret < 0) {
430                     error_setg_errno(errp, -ret, "ERROR: unknown extension: "
431                                      "Could not read data");
432                     return ret;
433                 }
434             }
435             break;
436         }
437 
438         offset += ((ext.len + 7) & ~7);
439     }
440 
441     return 0;
442 }
443 
444 static void cleanup_unknown_header_ext(BlockDriverState *bs)
445 {
446     BDRVQcow2State *s = bs->opaque;
447     Qcow2UnknownHeaderExtension *uext, *next;
448 
449     QLIST_FOREACH_SAFE(uext, &s->unknown_header_ext, next, next) {
450         QLIST_REMOVE(uext, next);
451         g_free(uext);
452     }
453 }
454 
455 static void report_unsupported_feature(Error **errp, Qcow2Feature *table,
456                                        uint64_t mask)
457 {
458     char *features = g_strdup("");
459     char *old;
460 
461     while (table && table->name[0] != '\0') {
462         if (table->type == QCOW2_FEAT_TYPE_INCOMPATIBLE) {
463             if (mask & (1ULL << table->bit)) {
464                 old = features;
465                 features = g_strdup_printf("%s%s%.46s", old, *old ? ", " : "",
466                                            table->name);
467                 g_free(old);
468                 mask &= ~(1ULL << table->bit);
469             }
470         }
471         table++;
472     }
473 
474     if (mask) {
475         old = features;
476         features = g_strdup_printf("%s%sUnknown incompatible feature: %" PRIx64,
477                                    old, *old ? ", " : "", mask);
478         g_free(old);
479     }
480 
481     error_setg(errp, "Unsupported qcow2 feature(s): %s", features);
482     g_free(features);
483 }
484 
485 /*
486  * Sets the dirty bit and flushes afterwards if necessary.
487  *
488  * The incompatible_features bit is only set if the image file header was
489  * updated successfully.  Therefore it is not required to check the return
490  * value of this function.
491  */
492 int qcow2_mark_dirty(BlockDriverState *bs)
493 {
494     BDRVQcow2State *s = bs->opaque;
495     uint64_t val;
496     int ret;
497 
498     assert(s->qcow_version >= 3);
499 
500     if (s->incompatible_features & QCOW2_INCOMPAT_DIRTY) {
501         return 0; /* already dirty */
502     }
503 
504     val = cpu_to_be64(s->incompatible_features | QCOW2_INCOMPAT_DIRTY);
505     ret = bdrv_pwrite(bs->file, offsetof(QCowHeader, incompatible_features),
506                       &val, sizeof(val));
507     if (ret < 0) {
508         return ret;
509     }
510     ret = bdrv_flush(bs->file->bs);
511     if (ret < 0) {
512         return ret;
513     }
514 
515     /* Only treat image as dirty if the header was updated successfully */
516     s->incompatible_features |= QCOW2_INCOMPAT_DIRTY;
517     return 0;
518 }
519 
520 /*
521  * Clears the dirty bit and flushes before if necessary.  Only call this
522  * function when there are no pending requests, it does not guard against
523  * concurrent requests dirtying the image.
524  */
525 static int qcow2_mark_clean(BlockDriverState *bs)
526 {
527     BDRVQcow2State *s = bs->opaque;
528 
529     if (s->incompatible_features & QCOW2_INCOMPAT_DIRTY) {
530         int ret;
531 
532         s->incompatible_features &= ~QCOW2_INCOMPAT_DIRTY;
533 
534         ret = qcow2_flush_caches(bs);
535         if (ret < 0) {
536             return ret;
537         }
538 
539         return qcow2_update_header(bs);
540     }
541     return 0;
542 }
543 
544 /*
545  * Marks the image as corrupt.
546  */
547 int qcow2_mark_corrupt(BlockDriverState *bs)
548 {
549     BDRVQcow2State *s = bs->opaque;
550 
551     s->incompatible_features |= QCOW2_INCOMPAT_CORRUPT;
552     return qcow2_update_header(bs);
553 }
554 
555 /*
556  * Marks the image as consistent, i.e., unsets the corrupt bit, and flushes
557  * before if necessary.
558  */
559 int qcow2_mark_consistent(BlockDriverState *bs)
560 {
561     BDRVQcow2State *s = bs->opaque;
562 
563     if (s->incompatible_features & QCOW2_INCOMPAT_CORRUPT) {
564         int ret = qcow2_flush_caches(bs);
565         if (ret < 0) {
566             return ret;
567         }
568 
569         s->incompatible_features &= ~QCOW2_INCOMPAT_CORRUPT;
570         return qcow2_update_header(bs);
571     }
572     return 0;
573 }
574 
575 static int coroutine_fn qcow2_co_check_locked(BlockDriverState *bs,
576                                               BdrvCheckResult *result,
577                                               BdrvCheckMode fix)
578 {
579     int ret = qcow2_check_refcounts(bs, result, fix);
580     if (ret < 0) {
581         return ret;
582     }
583 
584     if (fix && result->check_errors == 0 && result->corruptions == 0) {
585         ret = qcow2_mark_clean(bs);
586         if (ret < 0) {
587             return ret;
588         }
589         return qcow2_mark_consistent(bs);
590     }
591     return ret;
592 }
593 
594 static int coroutine_fn qcow2_co_check(BlockDriverState *bs,
595                                        BdrvCheckResult *result,
596                                        BdrvCheckMode fix)
597 {
598     BDRVQcow2State *s = bs->opaque;
599     int ret;
600 
601     qemu_co_mutex_lock(&s->lock);
602     ret = qcow2_co_check_locked(bs, result, fix);
603     qemu_co_mutex_unlock(&s->lock);
604     return ret;
605 }
606 
607 int qcow2_validate_table(BlockDriverState *bs, uint64_t offset,
608                          uint64_t entries, size_t entry_len,
609                          int64_t max_size_bytes, const char *table_name,
610                          Error **errp)
611 {
612     BDRVQcow2State *s = bs->opaque;
613 
614     if (entries > max_size_bytes / entry_len) {
615         error_setg(errp, "%s too large", table_name);
616         return -EFBIG;
617     }
618 
619     /* Use signed INT64_MAX as the maximum even for uint64_t header fields,
620      * because values will be passed to qemu functions taking int64_t. */
621     if ((INT64_MAX - entries * entry_len < offset) ||
622         (offset_into_cluster(s, offset) != 0)) {
623         error_setg(errp, "%s offset invalid", table_name);
624         return -EINVAL;
625     }
626 
627     return 0;
628 }
629 
630 static QemuOptsList qcow2_runtime_opts = {
631     .name = "qcow2",
632     .head = QTAILQ_HEAD_INITIALIZER(qcow2_runtime_opts.head),
633     .desc = {
634         {
635             .name = QCOW2_OPT_LAZY_REFCOUNTS,
636             .type = QEMU_OPT_BOOL,
637             .help = "Postpone refcount updates",
638         },
639         {
640             .name = QCOW2_OPT_DISCARD_REQUEST,
641             .type = QEMU_OPT_BOOL,
642             .help = "Pass guest discard requests to the layer below",
643         },
644         {
645             .name = QCOW2_OPT_DISCARD_SNAPSHOT,
646             .type = QEMU_OPT_BOOL,
647             .help = "Generate discard requests when snapshot related space "
648                     "is freed",
649         },
650         {
651             .name = QCOW2_OPT_DISCARD_OTHER,
652             .type = QEMU_OPT_BOOL,
653             .help = "Generate discard requests when other clusters are freed",
654         },
655         {
656             .name = QCOW2_OPT_OVERLAP,
657             .type = QEMU_OPT_STRING,
658             .help = "Selects which overlap checks to perform from a range of "
659                     "templates (none, constant, cached, all)",
660         },
661         {
662             .name = QCOW2_OPT_OVERLAP_TEMPLATE,
663             .type = QEMU_OPT_STRING,
664             .help = "Selects which overlap checks to perform from a range of "
665                     "templates (none, constant, cached, all)",
666         },
667         {
668             .name = QCOW2_OPT_OVERLAP_MAIN_HEADER,
669             .type = QEMU_OPT_BOOL,
670             .help = "Check for unintended writes into the main qcow2 header",
671         },
672         {
673             .name = QCOW2_OPT_OVERLAP_ACTIVE_L1,
674             .type = QEMU_OPT_BOOL,
675             .help = "Check for unintended writes into the active L1 table",
676         },
677         {
678             .name = QCOW2_OPT_OVERLAP_ACTIVE_L2,
679             .type = QEMU_OPT_BOOL,
680             .help = "Check for unintended writes into an active L2 table",
681         },
682         {
683             .name = QCOW2_OPT_OVERLAP_REFCOUNT_TABLE,
684             .type = QEMU_OPT_BOOL,
685             .help = "Check for unintended writes into the refcount table",
686         },
687         {
688             .name = QCOW2_OPT_OVERLAP_REFCOUNT_BLOCK,
689             .type = QEMU_OPT_BOOL,
690             .help = "Check for unintended writes into a refcount block",
691         },
692         {
693             .name = QCOW2_OPT_OVERLAP_SNAPSHOT_TABLE,
694             .type = QEMU_OPT_BOOL,
695             .help = "Check for unintended writes into the snapshot table",
696         },
697         {
698             .name = QCOW2_OPT_OVERLAP_INACTIVE_L1,
699             .type = QEMU_OPT_BOOL,
700             .help = "Check for unintended writes into an inactive L1 table",
701         },
702         {
703             .name = QCOW2_OPT_OVERLAP_INACTIVE_L2,
704             .type = QEMU_OPT_BOOL,
705             .help = "Check for unintended writes into an inactive L2 table",
706         },
707         {
708             .name = QCOW2_OPT_OVERLAP_BITMAP_DIRECTORY,
709             .type = QEMU_OPT_BOOL,
710             .help = "Check for unintended writes into the bitmap directory",
711         },
712         {
713             .name = QCOW2_OPT_CACHE_SIZE,
714             .type = QEMU_OPT_SIZE,
715             .help = "Maximum combined metadata (L2 tables and refcount blocks) "
716                     "cache size",
717         },
718         {
719             .name = QCOW2_OPT_L2_CACHE_SIZE,
720             .type = QEMU_OPT_SIZE,
721             .help = "Maximum L2 table cache size",
722         },
723         {
724             .name = QCOW2_OPT_L2_CACHE_ENTRY_SIZE,
725             .type = QEMU_OPT_SIZE,
726             .help = "Size of each entry in the L2 cache",
727         },
728         {
729             .name = QCOW2_OPT_REFCOUNT_CACHE_SIZE,
730             .type = QEMU_OPT_SIZE,
731             .help = "Maximum refcount block cache size",
732         },
733         {
734             .name = QCOW2_OPT_CACHE_CLEAN_INTERVAL,
735             .type = QEMU_OPT_NUMBER,
736             .help = "Clean unused cache entries after this time (in seconds)",
737         },
738         BLOCK_CRYPTO_OPT_DEF_KEY_SECRET("encrypt.",
739             "ID of secret providing qcow2 AES key or LUKS passphrase"),
740         { /* end of list */ }
741     },
742 };
743 
744 static const char *overlap_bool_option_names[QCOW2_OL_MAX_BITNR] = {
745     [QCOW2_OL_MAIN_HEADER_BITNR]      = QCOW2_OPT_OVERLAP_MAIN_HEADER,
746     [QCOW2_OL_ACTIVE_L1_BITNR]        = QCOW2_OPT_OVERLAP_ACTIVE_L1,
747     [QCOW2_OL_ACTIVE_L2_BITNR]        = QCOW2_OPT_OVERLAP_ACTIVE_L2,
748     [QCOW2_OL_REFCOUNT_TABLE_BITNR]   = QCOW2_OPT_OVERLAP_REFCOUNT_TABLE,
749     [QCOW2_OL_REFCOUNT_BLOCK_BITNR]   = QCOW2_OPT_OVERLAP_REFCOUNT_BLOCK,
750     [QCOW2_OL_SNAPSHOT_TABLE_BITNR]   = QCOW2_OPT_OVERLAP_SNAPSHOT_TABLE,
751     [QCOW2_OL_INACTIVE_L1_BITNR]      = QCOW2_OPT_OVERLAP_INACTIVE_L1,
752     [QCOW2_OL_INACTIVE_L2_BITNR]      = QCOW2_OPT_OVERLAP_INACTIVE_L2,
753     [QCOW2_OL_BITMAP_DIRECTORY_BITNR] = QCOW2_OPT_OVERLAP_BITMAP_DIRECTORY,
754 };
755 
756 static void cache_clean_timer_cb(void *opaque)
757 {
758     BlockDriverState *bs = opaque;
759     BDRVQcow2State *s = bs->opaque;
760     qcow2_cache_clean_unused(s->l2_table_cache);
761     qcow2_cache_clean_unused(s->refcount_block_cache);
762     timer_mod(s->cache_clean_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) +
763               (int64_t) s->cache_clean_interval * 1000);
764 }
765 
766 static void cache_clean_timer_init(BlockDriverState *bs, AioContext *context)
767 {
768     BDRVQcow2State *s = bs->opaque;
769     if (s->cache_clean_interval > 0) {
770         s->cache_clean_timer = aio_timer_new(context, QEMU_CLOCK_VIRTUAL,
771                                              SCALE_MS, cache_clean_timer_cb,
772                                              bs);
773         timer_mod(s->cache_clean_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) +
774                   (int64_t) s->cache_clean_interval * 1000);
775     }
776 }
777 
778 static void cache_clean_timer_del(BlockDriverState *bs)
779 {
780     BDRVQcow2State *s = bs->opaque;
781     if (s->cache_clean_timer) {
782         timer_del(s->cache_clean_timer);
783         timer_free(s->cache_clean_timer);
784         s->cache_clean_timer = NULL;
785     }
786 }
787 
788 static void qcow2_detach_aio_context(BlockDriverState *bs)
789 {
790     cache_clean_timer_del(bs);
791 }
792 
793 static void qcow2_attach_aio_context(BlockDriverState *bs,
794                                      AioContext *new_context)
795 {
796     cache_clean_timer_init(bs, new_context);
797 }
798 
799 static void read_cache_sizes(BlockDriverState *bs, QemuOpts *opts,
800                              uint64_t *l2_cache_size,
801                              uint64_t *l2_cache_entry_size,
802                              uint64_t *refcount_cache_size, Error **errp)
803 {
804     BDRVQcow2State *s = bs->opaque;
805     uint64_t combined_cache_size, l2_cache_max_setting;
806     bool l2_cache_size_set, refcount_cache_size_set, combined_cache_size_set;
807     bool l2_cache_entry_size_set;
808     int min_refcount_cache = MIN_REFCOUNT_CACHE_SIZE * s->cluster_size;
809     uint64_t virtual_disk_size = bs->total_sectors * BDRV_SECTOR_SIZE;
810     uint64_t max_l2_cache = virtual_disk_size / (s->cluster_size / 8);
811 
812     combined_cache_size_set = qemu_opt_get(opts, QCOW2_OPT_CACHE_SIZE);
813     l2_cache_size_set = qemu_opt_get(opts, QCOW2_OPT_L2_CACHE_SIZE);
814     refcount_cache_size_set = qemu_opt_get(opts, QCOW2_OPT_REFCOUNT_CACHE_SIZE);
815     l2_cache_entry_size_set = qemu_opt_get(opts, QCOW2_OPT_L2_CACHE_ENTRY_SIZE);
816 
817     combined_cache_size = qemu_opt_get_size(opts, QCOW2_OPT_CACHE_SIZE, 0);
818     l2_cache_max_setting = qemu_opt_get_size(opts, QCOW2_OPT_L2_CACHE_SIZE,
819                                              DEFAULT_L2_CACHE_MAX_SIZE);
820     *refcount_cache_size = qemu_opt_get_size(opts,
821                                              QCOW2_OPT_REFCOUNT_CACHE_SIZE, 0);
822 
823     *l2_cache_entry_size = qemu_opt_get_size(
824         opts, QCOW2_OPT_L2_CACHE_ENTRY_SIZE, s->cluster_size);
825 
826     *l2_cache_size = MIN(max_l2_cache, l2_cache_max_setting);
827 
828     if (combined_cache_size_set) {
829         if (l2_cache_size_set && refcount_cache_size_set) {
830             error_setg(errp, QCOW2_OPT_CACHE_SIZE ", " QCOW2_OPT_L2_CACHE_SIZE
831                        " and " QCOW2_OPT_REFCOUNT_CACHE_SIZE " may not be set "
832                        "at the same time");
833             return;
834         } else if (l2_cache_size_set &&
835                    (l2_cache_max_setting > combined_cache_size)) {
836             error_setg(errp, QCOW2_OPT_L2_CACHE_SIZE " may not exceed "
837                        QCOW2_OPT_CACHE_SIZE);
838             return;
839         } else if (*refcount_cache_size > combined_cache_size) {
840             error_setg(errp, QCOW2_OPT_REFCOUNT_CACHE_SIZE " may not exceed "
841                        QCOW2_OPT_CACHE_SIZE);
842             return;
843         }
844 
845         if (l2_cache_size_set) {
846             *refcount_cache_size = combined_cache_size - *l2_cache_size;
847         } else if (refcount_cache_size_set) {
848             *l2_cache_size = combined_cache_size - *refcount_cache_size;
849         } else {
850             /* Assign as much memory as possible to the L2 cache, and
851              * use the remainder for the refcount cache */
852             if (combined_cache_size >= max_l2_cache + min_refcount_cache) {
853                 *l2_cache_size = max_l2_cache;
854                 *refcount_cache_size = combined_cache_size - *l2_cache_size;
855             } else {
856                 *refcount_cache_size =
857                     MIN(combined_cache_size, min_refcount_cache);
858                 *l2_cache_size = combined_cache_size - *refcount_cache_size;
859             }
860         }
861     }
862 
863     /*
864      * If the L2 cache is not enough to cover the whole disk then
865      * default to 4KB entries. Smaller entries reduce the cost of
866      * loads and evictions and increase I/O performance.
867      */
868     if (*l2_cache_size < max_l2_cache && !l2_cache_entry_size_set) {
869         *l2_cache_entry_size = MIN(s->cluster_size, 4096);
870     }
871 
872     /* l2_cache_size and refcount_cache_size are ensured to have at least
873      * their minimum values in qcow2_update_options_prepare() */
874 
875     if (*l2_cache_entry_size < (1 << MIN_CLUSTER_BITS) ||
876         *l2_cache_entry_size > s->cluster_size ||
877         !is_power_of_2(*l2_cache_entry_size)) {
878         error_setg(errp, "L2 cache entry size must be a power of two "
879                    "between %d and the cluster size (%d)",
880                    1 << MIN_CLUSTER_BITS, s->cluster_size);
881         return;
882     }
883 }
884 
885 typedef struct Qcow2ReopenState {
886     Qcow2Cache *l2_table_cache;
887     Qcow2Cache *refcount_block_cache;
888     int l2_slice_size; /* Number of entries in a slice of the L2 table */
889     bool use_lazy_refcounts;
890     int overlap_check;
891     bool discard_passthrough[QCOW2_DISCARD_MAX];
892     uint64_t cache_clean_interval;
893     QCryptoBlockOpenOptions *crypto_opts; /* Disk encryption runtime options */
894 } Qcow2ReopenState;
895 
896 static int qcow2_update_options_prepare(BlockDriverState *bs,
897                                         Qcow2ReopenState *r,
898                                         QDict *options, int flags,
899                                         Error **errp)
900 {
901     BDRVQcow2State *s = bs->opaque;
902     QemuOpts *opts = NULL;
903     const char *opt_overlap_check, *opt_overlap_check_template;
904     int overlap_check_template = 0;
905     uint64_t l2_cache_size, l2_cache_entry_size, refcount_cache_size;
906     int i;
907     const char *encryptfmt;
908     QDict *encryptopts = NULL;
909     Error *local_err = NULL;
910     int ret;
911 
912     qdict_extract_subqdict(options, &encryptopts, "encrypt.");
913     encryptfmt = qdict_get_try_str(encryptopts, "format");
914 
915     opts = qemu_opts_create(&qcow2_runtime_opts, NULL, 0, &error_abort);
916     qemu_opts_absorb_qdict(opts, options, &local_err);
917     if (local_err) {
918         error_propagate(errp, local_err);
919         ret = -EINVAL;
920         goto fail;
921     }
922 
923     /* get L2 table/refcount block cache size from command line options */
924     read_cache_sizes(bs, opts, &l2_cache_size, &l2_cache_entry_size,
925                      &refcount_cache_size, &local_err);
926     if (local_err) {
927         error_propagate(errp, local_err);
928         ret = -EINVAL;
929         goto fail;
930     }
931 
932     l2_cache_size /= l2_cache_entry_size;
933     if (l2_cache_size < MIN_L2_CACHE_SIZE) {
934         l2_cache_size = MIN_L2_CACHE_SIZE;
935     }
936     if (l2_cache_size > INT_MAX) {
937         error_setg(errp, "L2 cache size too big");
938         ret = -EINVAL;
939         goto fail;
940     }
941 
942     refcount_cache_size /= s->cluster_size;
943     if (refcount_cache_size < MIN_REFCOUNT_CACHE_SIZE) {
944         refcount_cache_size = MIN_REFCOUNT_CACHE_SIZE;
945     }
946     if (refcount_cache_size > INT_MAX) {
947         error_setg(errp, "Refcount cache size too big");
948         ret = -EINVAL;
949         goto fail;
950     }
951 
952     /* alloc new L2 table/refcount block cache, flush old one */
953     if (s->l2_table_cache) {
954         ret = qcow2_cache_flush(bs, s->l2_table_cache);
955         if (ret) {
956             error_setg_errno(errp, -ret, "Failed to flush the L2 table cache");
957             goto fail;
958         }
959     }
960 
961     if (s->refcount_block_cache) {
962         ret = qcow2_cache_flush(bs, s->refcount_block_cache);
963         if (ret) {
964             error_setg_errno(errp, -ret,
965                              "Failed to flush the refcount block cache");
966             goto fail;
967         }
968     }
969 
970     r->l2_slice_size = l2_cache_entry_size / sizeof(uint64_t);
971     r->l2_table_cache = qcow2_cache_create(bs, l2_cache_size,
972                                            l2_cache_entry_size);
973     r->refcount_block_cache = qcow2_cache_create(bs, refcount_cache_size,
974                                                  s->cluster_size);
975     if (r->l2_table_cache == NULL || r->refcount_block_cache == NULL) {
976         error_setg(errp, "Could not allocate metadata caches");
977         ret = -ENOMEM;
978         goto fail;
979     }
980 
981     /* New interval for cache cleanup timer */
982     r->cache_clean_interval =
983         qemu_opt_get_number(opts, QCOW2_OPT_CACHE_CLEAN_INTERVAL,
984                             DEFAULT_CACHE_CLEAN_INTERVAL);
985 #ifndef CONFIG_LINUX
986     if (r->cache_clean_interval != 0) {
987         error_setg(errp, QCOW2_OPT_CACHE_CLEAN_INTERVAL
988                    " not supported on this host");
989         ret = -EINVAL;
990         goto fail;
991     }
992 #endif
993     if (r->cache_clean_interval > UINT_MAX) {
994         error_setg(errp, "Cache clean interval too big");
995         ret = -EINVAL;
996         goto fail;
997     }
998 
999     /* lazy-refcounts; flush if going from enabled to disabled */
1000     r->use_lazy_refcounts = qemu_opt_get_bool(opts, QCOW2_OPT_LAZY_REFCOUNTS,
1001         (s->compatible_features & QCOW2_COMPAT_LAZY_REFCOUNTS));
1002     if (r->use_lazy_refcounts && s->qcow_version < 3) {
1003         error_setg(errp, "Lazy refcounts require a qcow2 image with at least "
1004                    "qemu 1.1 compatibility level");
1005         ret = -EINVAL;
1006         goto fail;
1007     }
1008 
1009     if (s->use_lazy_refcounts && !r->use_lazy_refcounts) {
1010         ret = qcow2_mark_clean(bs);
1011         if (ret < 0) {
1012             error_setg_errno(errp, -ret, "Failed to disable lazy refcounts");
1013             goto fail;
1014         }
1015     }
1016 
1017     /* Overlap check options */
1018     opt_overlap_check = qemu_opt_get(opts, QCOW2_OPT_OVERLAP);
1019     opt_overlap_check_template = qemu_opt_get(opts, QCOW2_OPT_OVERLAP_TEMPLATE);
1020     if (opt_overlap_check_template && opt_overlap_check &&
1021         strcmp(opt_overlap_check_template, opt_overlap_check))
1022     {
1023         error_setg(errp, "Conflicting values for qcow2 options '"
1024                    QCOW2_OPT_OVERLAP "' ('%s') and '" QCOW2_OPT_OVERLAP_TEMPLATE
1025                    "' ('%s')", opt_overlap_check, opt_overlap_check_template);
1026         ret = -EINVAL;
1027         goto fail;
1028     }
1029     if (!opt_overlap_check) {
1030         opt_overlap_check = opt_overlap_check_template ?: "cached";
1031     }
1032 
1033     if (!strcmp(opt_overlap_check, "none")) {
1034         overlap_check_template = 0;
1035     } else if (!strcmp(opt_overlap_check, "constant")) {
1036         overlap_check_template = QCOW2_OL_CONSTANT;
1037     } else if (!strcmp(opt_overlap_check, "cached")) {
1038         overlap_check_template = QCOW2_OL_CACHED;
1039     } else if (!strcmp(opt_overlap_check, "all")) {
1040         overlap_check_template = QCOW2_OL_ALL;
1041     } else {
1042         error_setg(errp, "Unsupported value '%s' for qcow2 option "
1043                    "'overlap-check'. Allowed are any of the following: "
1044                    "none, constant, cached, all", opt_overlap_check);
1045         ret = -EINVAL;
1046         goto fail;
1047     }
1048 
1049     r->overlap_check = 0;
1050     for (i = 0; i < QCOW2_OL_MAX_BITNR; i++) {
1051         /* overlap-check defines a template bitmask, but every flag may be
1052          * overwritten through the associated boolean option */
1053         r->overlap_check |=
1054             qemu_opt_get_bool(opts, overlap_bool_option_names[i],
1055                               overlap_check_template & (1 << i)) << i;
1056     }
1057 
1058     r->discard_passthrough[QCOW2_DISCARD_NEVER] = false;
1059     r->discard_passthrough[QCOW2_DISCARD_ALWAYS] = true;
1060     r->discard_passthrough[QCOW2_DISCARD_REQUEST] =
1061         qemu_opt_get_bool(opts, QCOW2_OPT_DISCARD_REQUEST,
1062                           flags & BDRV_O_UNMAP);
1063     r->discard_passthrough[QCOW2_DISCARD_SNAPSHOT] =
1064         qemu_opt_get_bool(opts, QCOW2_OPT_DISCARD_SNAPSHOT, true);
1065     r->discard_passthrough[QCOW2_DISCARD_OTHER] =
1066         qemu_opt_get_bool(opts, QCOW2_OPT_DISCARD_OTHER, false);
1067 
1068     switch (s->crypt_method_header) {
1069     case QCOW_CRYPT_NONE:
1070         if (encryptfmt) {
1071             error_setg(errp, "No encryption in image header, but options "
1072                        "specified format '%s'", encryptfmt);
1073             ret = -EINVAL;
1074             goto fail;
1075         }
1076         break;
1077 
1078     case QCOW_CRYPT_AES:
1079         if (encryptfmt && !g_str_equal(encryptfmt, "aes")) {
1080             error_setg(errp,
1081                        "Header reported 'aes' encryption format but "
1082                        "options specify '%s'", encryptfmt);
1083             ret = -EINVAL;
1084             goto fail;
1085         }
1086         qdict_put_str(encryptopts, "format", "qcow");
1087         r->crypto_opts = block_crypto_open_opts_init(encryptopts, errp);
1088         break;
1089 
1090     case QCOW_CRYPT_LUKS:
1091         if (encryptfmt && !g_str_equal(encryptfmt, "luks")) {
1092             error_setg(errp,
1093                        "Header reported 'luks' encryption format but "
1094                        "options specify '%s'", encryptfmt);
1095             ret = -EINVAL;
1096             goto fail;
1097         }
1098         qdict_put_str(encryptopts, "format", "luks");
1099         r->crypto_opts = block_crypto_open_opts_init(encryptopts, errp);
1100         break;
1101 
1102     default:
1103         error_setg(errp, "Unsupported encryption method %d",
1104                    s->crypt_method_header);
1105         break;
1106     }
1107     if (s->crypt_method_header != QCOW_CRYPT_NONE && !r->crypto_opts) {
1108         ret = -EINVAL;
1109         goto fail;
1110     }
1111 
1112     ret = 0;
1113 fail:
1114     qobject_unref(encryptopts);
1115     qemu_opts_del(opts);
1116     opts = NULL;
1117     return ret;
1118 }
1119 
1120 static void qcow2_update_options_commit(BlockDriverState *bs,
1121                                         Qcow2ReopenState *r)
1122 {
1123     BDRVQcow2State *s = bs->opaque;
1124     int i;
1125 
1126     if (s->l2_table_cache) {
1127         qcow2_cache_destroy(s->l2_table_cache);
1128     }
1129     if (s->refcount_block_cache) {
1130         qcow2_cache_destroy(s->refcount_block_cache);
1131     }
1132     s->l2_table_cache = r->l2_table_cache;
1133     s->refcount_block_cache = r->refcount_block_cache;
1134     s->l2_slice_size = r->l2_slice_size;
1135 
1136     s->overlap_check = r->overlap_check;
1137     s->use_lazy_refcounts = r->use_lazy_refcounts;
1138 
1139     for (i = 0; i < QCOW2_DISCARD_MAX; i++) {
1140         s->discard_passthrough[i] = r->discard_passthrough[i];
1141     }
1142 
1143     if (s->cache_clean_interval != r->cache_clean_interval) {
1144         cache_clean_timer_del(bs);
1145         s->cache_clean_interval = r->cache_clean_interval;
1146         cache_clean_timer_init(bs, bdrv_get_aio_context(bs));
1147     }
1148 
1149     qapi_free_QCryptoBlockOpenOptions(s->crypto_opts);
1150     s->crypto_opts = r->crypto_opts;
1151 }
1152 
1153 static void qcow2_update_options_abort(BlockDriverState *bs,
1154                                        Qcow2ReopenState *r)
1155 {
1156     if (r->l2_table_cache) {
1157         qcow2_cache_destroy(r->l2_table_cache);
1158     }
1159     if (r->refcount_block_cache) {
1160         qcow2_cache_destroy(r->refcount_block_cache);
1161     }
1162     qapi_free_QCryptoBlockOpenOptions(r->crypto_opts);
1163 }
1164 
1165 static int qcow2_update_options(BlockDriverState *bs, QDict *options,
1166                                 int flags, Error **errp)
1167 {
1168     Qcow2ReopenState r = {};
1169     int ret;
1170 
1171     ret = qcow2_update_options_prepare(bs, &r, options, flags, errp);
1172     if (ret >= 0) {
1173         qcow2_update_options_commit(bs, &r);
1174     } else {
1175         qcow2_update_options_abort(bs, &r);
1176     }
1177 
1178     return ret;
1179 }
1180 
1181 /* Called with s->lock held.  */
1182 static int coroutine_fn qcow2_do_open(BlockDriverState *bs, QDict *options,
1183                                       int flags, Error **errp)
1184 {
1185     BDRVQcow2State *s = bs->opaque;
1186     unsigned int len, i;
1187     int ret = 0;
1188     QCowHeader header;
1189     Error *local_err = NULL;
1190     uint64_t ext_end;
1191     uint64_t l1_vm_state_index;
1192     bool update_header = false;
1193 
1194     ret = bdrv_pread(bs->file, 0, &header, sizeof(header));
1195     if (ret < 0) {
1196         error_setg_errno(errp, -ret, "Could not read qcow2 header");
1197         goto fail;
1198     }
1199     header.magic = be32_to_cpu(header.magic);
1200     header.version = be32_to_cpu(header.version);
1201     header.backing_file_offset = be64_to_cpu(header.backing_file_offset);
1202     header.backing_file_size = be32_to_cpu(header.backing_file_size);
1203     header.size = be64_to_cpu(header.size);
1204     header.cluster_bits = be32_to_cpu(header.cluster_bits);
1205     header.crypt_method = be32_to_cpu(header.crypt_method);
1206     header.l1_table_offset = be64_to_cpu(header.l1_table_offset);
1207     header.l1_size = be32_to_cpu(header.l1_size);
1208     header.refcount_table_offset = be64_to_cpu(header.refcount_table_offset);
1209     header.refcount_table_clusters =
1210         be32_to_cpu(header.refcount_table_clusters);
1211     header.snapshots_offset = be64_to_cpu(header.snapshots_offset);
1212     header.nb_snapshots = be32_to_cpu(header.nb_snapshots);
1213 
1214     if (header.magic != QCOW_MAGIC) {
1215         error_setg(errp, "Image is not in qcow2 format");
1216         ret = -EINVAL;
1217         goto fail;
1218     }
1219     if (header.version < 2 || header.version > 3) {
1220         error_setg(errp, "Unsupported qcow2 version %" PRIu32, header.version);
1221         ret = -ENOTSUP;
1222         goto fail;
1223     }
1224 
1225     s->qcow_version = header.version;
1226 
1227     /* Initialise cluster size */
1228     if (header.cluster_bits < MIN_CLUSTER_BITS ||
1229         header.cluster_bits > MAX_CLUSTER_BITS) {
1230         error_setg(errp, "Unsupported cluster size: 2^%" PRIu32,
1231                    header.cluster_bits);
1232         ret = -EINVAL;
1233         goto fail;
1234     }
1235 
1236     s->cluster_bits = header.cluster_bits;
1237     s->cluster_size = 1 << s->cluster_bits;
1238     s->cluster_sectors = 1 << (s->cluster_bits - BDRV_SECTOR_BITS);
1239 
1240     /* Initialise version 3 header fields */
1241     if (header.version == 2) {
1242         header.incompatible_features    = 0;
1243         header.compatible_features      = 0;
1244         header.autoclear_features       = 0;
1245         header.refcount_order           = 4;
1246         header.header_length            = 72;
1247     } else {
1248         header.incompatible_features =
1249             be64_to_cpu(header.incompatible_features);
1250         header.compatible_features = be64_to_cpu(header.compatible_features);
1251         header.autoclear_features = be64_to_cpu(header.autoclear_features);
1252         header.refcount_order = be32_to_cpu(header.refcount_order);
1253         header.header_length = be32_to_cpu(header.header_length);
1254 
1255         if (header.header_length < 104) {
1256             error_setg(errp, "qcow2 header too short");
1257             ret = -EINVAL;
1258             goto fail;
1259         }
1260     }
1261 
1262     if (header.header_length > s->cluster_size) {
1263         error_setg(errp, "qcow2 header exceeds cluster size");
1264         ret = -EINVAL;
1265         goto fail;
1266     }
1267 
1268     if (header.header_length > sizeof(header)) {
1269         s->unknown_header_fields_size = header.header_length - sizeof(header);
1270         s->unknown_header_fields = g_malloc(s->unknown_header_fields_size);
1271         ret = bdrv_pread(bs->file, sizeof(header), s->unknown_header_fields,
1272                          s->unknown_header_fields_size);
1273         if (ret < 0) {
1274             error_setg_errno(errp, -ret, "Could not read unknown qcow2 header "
1275                              "fields");
1276             goto fail;
1277         }
1278     }
1279 
1280     if (header.backing_file_offset > s->cluster_size) {
1281         error_setg(errp, "Invalid backing file offset");
1282         ret = -EINVAL;
1283         goto fail;
1284     }
1285 
1286     if (header.backing_file_offset) {
1287         ext_end = header.backing_file_offset;
1288     } else {
1289         ext_end = 1 << header.cluster_bits;
1290     }
1291 
1292     /* Handle feature bits */
1293     s->incompatible_features    = header.incompatible_features;
1294     s->compatible_features      = header.compatible_features;
1295     s->autoclear_features       = header.autoclear_features;
1296 
1297     if (s->incompatible_features & ~QCOW2_INCOMPAT_MASK) {
1298         void *feature_table = NULL;
1299         qcow2_read_extensions(bs, header.header_length, ext_end,
1300                               &feature_table, flags, NULL, NULL);
1301         report_unsupported_feature(errp, feature_table,
1302                                    s->incompatible_features &
1303                                    ~QCOW2_INCOMPAT_MASK);
1304         ret = -ENOTSUP;
1305         g_free(feature_table);
1306         goto fail;
1307     }
1308 
1309     if (s->incompatible_features & QCOW2_INCOMPAT_CORRUPT) {
1310         /* Corrupt images may not be written to unless they are being repaired
1311          */
1312         if ((flags & BDRV_O_RDWR) && !(flags & BDRV_O_CHECK)) {
1313             error_setg(errp, "qcow2: Image is corrupt; cannot be opened "
1314                        "read/write");
1315             ret = -EACCES;
1316             goto fail;
1317         }
1318     }
1319 
1320     /* Check support for various header values */
1321     if (header.refcount_order > 6) {
1322         error_setg(errp, "Reference count entry width too large; may not "
1323                    "exceed 64 bits");
1324         ret = -EINVAL;
1325         goto fail;
1326     }
1327     s->refcount_order = header.refcount_order;
1328     s->refcount_bits = 1 << s->refcount_order;
1329     s->refcount_max = UINT64_C(1) << (s->refcount_bits - 1);
1330     s->refcount_max += s->refcount_max - 1;
1331 
1332     s->crypt_method_header = header.crypt_method;
1333     if (s->crypt_method_header) {
1334         if (bdrv_uses_whitelist() &&
1335             s->crypt_method_header == QCOW_CRYPT_AES) {
1336             error_setg(errp,
1337                        "Use of AES-CBC encrypted qcow2 images is no longer "
1338                        "supported in system emulators");
1339             error_append_hint(errp,
1340                               "You can use 'qemu-img convert' to convert your "
1341                               "image to an alternative supported format, such "
1342                               "as unencrypted qcow2, or raw with the LUKS "
1343                               "format instead.\n");
1344             ret = -ENOSYS;
1345             goto fail;
1346         }
1347 
1348         if (s->crypt_method_header == QCOW_CRYPT_AES) {
1349             s->crypt_physical_offset = false;
1350         } else {
1351             /* Assuming LUKS and any future crypt methods we
1352              * add will all use physical offsets, due to the
1353              * fact that the alternative is insecure...  */
1354             s->crypt_physical_offset = true;
1355         }
1356 
1357         bs->encrypted = true;
1358     }
1359 
1360     s->l2_bits = s->cluster_bits - 3; /* L2 is always one cluster */
1361     s->l2_size = 1 << s->l2_bits;
1362     /* 2^(s->refcount_order - 3) is the refcount width in bytes */
1363     s->refcount_block_bits = s->cluster_bits - (s->refcount_order - 3);
1364     s->refcount_block_size = 1 << s->refcount_block_bits;
1365     bs->total_sectors = header.size / BDRV_SECTOR_SIZE;
1366     s->csize_shift = (62 - (s->cluster_bits - 8));
1367     s->csize_mask = (1 << (s->cluster_bits - 8)) - 1;
1368     s->cluster_offset_mask = (1LL << s->csize_shift) - 1;
1369 
1370     s->refcount_table_offset = header.refcount_table_offset;
1371     s->refcount_table_size =
1372         header.refcount_table_clusters << (s->cluster_bits - 3);
1373 
1374     if (header.refcount_table_clusters == 0 && !(flags & BDRV_O_CHECK)) {
1375         error_setg(errp, "Image does not contain a reference count table");
1376         ret = -EINVAL;
1377         goto fail;
1378     }
1379 
1380     ret = qcow2_validate_table(bs, s->refcount_table_offset,
1381                                header.refcount_table_clusters,
1382                                s->cluster_size, QCOW_MAX_REFTABLE_SIZE,
1383                                "Reference count table", errp);
1384     if (ret < 0) {
1385         goto fail;
1386     }
1387 
1388     /* The total size in bytes of the snapshot table is checked in
1389      * qcow2_read_snapshots() because the size of each snapshot is
1390      * variable and we don't know it yet.
1391      * Here we only check the offset and number of snapshots. */
1392     ret = qcow2_validate_table(bs, header.snapshots_offset,
1393                                header.nb_snapshots,
1394                                sizeof(QCowSnapshotHeader),
1395                                sizeof(QCowSnapshotHeader) * QCOW_MAX_SNAPSHOTS,
1396                                "Snapshot table", errp);
1397     if (ret < 0) {
1398         goto fail;
1399     }
1400 
1401     /* read the level 1 table */
1402     ret = qcow2_validate_table(bs, header.l1_table_offset,
1403                                header.l1_size, sizeof(uint64_t),
1404                                QCOW_MAX_L1_SIZE, "Active L1 table", errp);
1405     if (ret < 0) {
1406         goto fail;
1407     }
1408     s->l1_size = header.l1_size;
1409     s->l1_table_offset = header.l1_table_offset;
1410 
1411     l1_vm_state_index = size_to_l1(s, header.size);
1412     if (l1_vm_state_index > INT_MAX) {
1413         error_setg(errp, "Image is too big");
1414         ret = -EFBIG;
1415         goto fail;
1416     }
1417     s->l1_vm_state_index = l1_vm_state_index;
1418 
1419     /* the L1 table must contain at least enough entries to put
1420        header.size bytes */
1421     if (s->l1_size < s->l1_vm_state_index) {
1422         error_setg(errp, "L1 table is too small");
1423         ret = -EINVAL;
1424         goto fail;
1425     }
1426 
1427     if (s->l1_size > 0) {
1428         s->l1_table = qemu_try_blockalign(bs->file->bs,
1429             ROUND_UP(s->l1_size * sizeof(uint64_t), 512));
1430         if (s->l1_table == NULL) {
1431             error_setg(errp, "Could not allocate L1 table");
1432             ret = -ENOMEM;
1433             goto fail;
1434         }
1435         ret = bdrv_pread(bs->file, s->l1_table_offset, s->l1_table,
1436                          s->l1_size * sizeof(uint64_t));
1437         if (ret < 0) {
1438             error_setg_errno(errp, -ret, "Could not read L1 table");
1439             goto fail;
1440         }
1441         for(i = 0;i < s->l1_size; i++) {
1442             s->l1_table[i] = be64_to_cpu(s->l1_table[i]);
1443         }
1444     }
1445 
1446     /* Parse driver-specific options */
1447     ret = qcow2_update_options(bs, options, flags, errp);
1448     if (ret < 0) {
1449         goto fail;
1450     }
1451 
1452     s->flags = flags;
1453 
1454     ret = qcow2_refcount_init(bs);
1455     if (ret != 0) {
1456         error_setg_errno(errp, -ret, "Could not initialize refcount handling");
1457         goto fail;
1458     }
1459 
1460     QLIST_INIT(&s->cluster_allocs);
1461     QTAILQ_INIT(&s->discards);
1462 
1463     /* read qcow2 extensions */
1464     if (qcow2_read_extensions(bs, header.header_length, ext_end, NULL,
1465                               flags, &update_header, &local_err)) {
1466         error_propagate(errp, local_err);
1467         ret = -EINVAL;
1468         goto fail;
1469     }
1470 
1471     /* Open external data file */
1472     s->data_file = bdrv_open_child(NULL, options, "data-file", bs, &child_file,
1473                                    true, &local_err);
1474     if (local_err) {
1475         error_propagate(errp, local_err);
1476         ret = -EINVAL;
1477         goto fail;
1478     }
1479 
1480     if (s->incompatible_features & QCOW2_INCOMPAT_DATA_FILE) {
1481         if (!s->data_file && s->image_data_file) {
1482             s->data_file = bdrv_open_child(s->image_data_file, options,
1483                                            "data-file", bs, &child_file,
1484                                            false, errp);
1485             if (!s->data_file) {
1486                 ret = -EINVAL;
1487                 goto fail;
1488             }
1489         }
1490         if (!s->data_file) {
1491             error_setg(errp, "'data-file' is required for this image");
1492             ret = -EINVAL;
1493             goto fail;
1494         }
1495     } else {
1496         if (s->data_file) {
1497             error_setg(errp, "'data-file' can only be set for images with an "
1498                              "external data file");
1499             ret = -EINVAL;
1500             goto fail;
1501         }
1502 
1503         s->data_file = bs->file;
1504 
1505         if (data_file_is_raw(bs)) {
1506             error_setg(errp, "data-file-raw requires a data file");
1507             ret = -EINVAL;
1508             goto fail;
1509         }
1510     }
1511 
1512     /* qcow2_read_extension may have set up the crypto context
1513      * if the crypt method needs a header region, some methods
1514      * don't need header extensions, so must check here
1515      */
1516     if (s->crypt_method_header && !s->crypto) {
1517         if (s->crypt_method_header == QCOW_CRYPT_AES) {
1518             unsigned int cflags = 0;
1519             if (flags & BDRV_O_NO_IO) {
1520                 cflags |= QCRYPTO_BLOCK_OPEN_NO_IO;
1521             }
1522             s->crypto = qcrypto_block_open(s->crypto_opts, "encrypt.",
1523                                            NULL, NULL, cflags, 1, errp);
1524             if (!s->crypto) {
1525                 ret = -EINVAL;
1526                 goto fail;
1527             }
1528         } else if (!(flags & BDRV_O_NO_IO)) {
1529             error_setg(errp, "Missing CRYPTO header for crypt method %d",
1530                        s->crypt_method_header);
1531             ret = -EINVAL;
1532             goto fail;
1533         }
1534     }
1535 
1536     /* read the backing file name */
1537     if (header.backing_file_offset != 0) {
1538         len = header.backing_file_size;
1539         if (len > MIN(1023, s->cluster_size - header.backing_file_offset) ||
1540             len >= sizeof(bs->backing_file)) {
1541             error_setg(errp, "Backing file name too long");
1542             ret = -EINVAL;
1543             goto fail;
1544         }
1545         ret = bdrv_pread(bs->file, header.backing_file_offset,
1546                          bs->auto_backing_file, len);
1547         if (ret < 0) {
1548             error_setg_errno(errp, -ret, "Could not read backing file name");
1549             goto fail;
1550         }
1551         bs->auto_backing_file[len] = '\0';
1552         pstrcpy(bs->backing_file, sizeof(bs->backing_file),
1553                 bs->auto_backing_file);
1554         s->image_backing_file = g_strdup(bs->auto_backing_file);
1555     }
1556 
1557     /* Internal snapshots */
1558     s->snapshots_offset = header.snapshots_offset;
1559     s->nb_snapshots = header.nb_snapshots;
1560 
1561     ret = qcow2_read_snapshots(bs);
1562     if (ret < 0) {
1563         error_setg_errno(errp, -ret, "Could not read snapshots");
1564         goto fail;
1565     }
1566 
1567     /* Clear unknown autoclear feature bits */
1568     update_header |= s->autoclear_features & ~QCOW2_AUTOCLEAR_MASK;
1569     update_header =
1570         update_header && !bs->read_only && !(flags & BDRV_O_INACTIVE);
1571     if (update_header) {
1572         s->autoclear_features &= QCOW2_AUTOCLEAR_MASK;
1573     }
1574 
1575     /* == Handle persistent dirty bitmaps ==
1576      *
1577      * We want load dirty bitmaps in three cases:
1578      *
1579      * 1. Normal open of the disk in active mode, not related to invalidation
1580      *    after migration.
1581      *
1582      * 2. Invalidation of the target vm after pre-copy phase of migration, if
1583      *    bitmaps are _not_ migrating through migration channel, i.e.
1584      *    'dirty-bitmaps' capability is disabled.
1585      *
1586      * 3. Invalidation of source vm after failed or canceled migration.
1587      *    This is a very interesting case. There are two possible types of
1588      *    bitmaps:
1589      *
1590      *    A. Stored on inactivation and removed. They should be loaded from the
1591      *       image.
1592      *
1593      *    B. Not stored: not-persistent bitmaps and bitmaps, migrated through
1594      *       the migration channel (with dirty-bitmaps capability).
1595      *
1596      *    On the other hand, there are two possible sub-cases:
1597      *
1598      *    3.1 disk was changed by somebody else while were inactive. In this
1599      *        case all in-RAM dirty bitmaps (both persistent and not) are
1600      *        definitely invalid. And we don't have any method to determine
1601      *        this.
1602      *
1603      *        Simple and safe thing is to just drop all the bitmaps of type B on
1604      *        inactivation. But in this case we lose bitmaps in valid 4.2 case.
1605      *
1606      *        On the other hand, resuming source vm, if disk was already changed
1607      *        is a bad thing anyway: not only bitmaps, the whole vm state is
1608      *        out of sync with disk.
1609      *
1610      *        This means, that user or management tool, who for some reason
1611      *        decided to resume source vm, after disk was already changed by
1612      *        target vm, should at least drop all dirty bitmaps by hand.
1613      *
1614      *        So, we can ignore this case for now, but TODO: "generation"
1615      *        extension for qcow2, to determine, that image was changed after
1616      *        last inactivation. And if it is changed, we will drop (or at least
1617      *        mark as 'invalid' all the bitmaps of type B, both persistent
1618      *        and not).
1619      *
1620      *    3.2 disk was _not_ changed while were inactive. Bitmaps may be saved
1621      *        to disk ('dirty-bitmaps' capability disabled), or not saved
1622      *        ('dirty-bitmaps' capability enabled), but we don't need to care
1623      *        of: let's load bitmaps as always: stored bitmaps will be loaded,
1624      *        and not stored has flag IN_USE=1 in the image and will be skipped
1625      *        on loading.
1626      *
1627      * One remaining possible case when we don't want load bitmaps:
1628      *
1629      * 4. Open disk in inactive mode in target vm (bitmaps are migrating or
1630      *    will be loaded on invalidation, no needs try loading them before)
1631      */
1632 
1633     if (!(bdrv_get_flags(bs) & BDRV_O_INACTIVE)) {
1634         /* It's case 1, 2 or 3.2. Or 3.1 which is BUG in management layer. */
1635         bool header_updated = qcow2_load_dirty_bitmaps(bs, &local_err);
1636 
1637         update_header = update_header && !header_updated;
1638     }
1639     if (local_err != NULL) {
1640         error_propagate(errp, local_err);
1641         ret = -EINVAL;
1642         goto fail;
1643     }
1644 
1645     if (update_header) {
1646         ret = qcow2_update_header(bs);
1647         if (ret < 0) {
1648             error_setg_errno(errp, -ret, "Could not update qcow2 header");
1649             goto fail;
1650         }
1651     }
1652 
1653     bs->supported_zero_flags = header.version >= 3 ? BDRV_REQ_MAY_UNMAP : 0;
1654 
1655     /* Repair image if dirty */
1656     if (!(flags & (BDRV_O_CHECK | BDRV_O_INACTIVE)) && !bs->read_only &&
1657         (s->incompatible_features & QCOW2_INCOMPAT_DIRTY)) {
1658         BdrvCheckResult result = {0};
1659 
1660         ret = qcow2_co_check_locked(bs, &result,
1661                                     BDRV_FIX_ERRORS | BDRV_FIX_LEAKS);
1662         if (ret < 0 || result.check_errors) {
1663             if (ret >= 0) {
1664                 ret = -EIO;
1665             }
1666             error_setg_errno(errp, -ret, "Could not repair dirty image");
1667             goto fail;
1668         }
1669     }
1670 
1671 #ifdef DEBUG_ALLOC
1672     {
1673         BdrvCheckResult result = {0};
1674         qcow2_check_refcounts(bs, &result, 0);
1675     }
1676 #endif
1677 
1678     qemu_co_queue_init(&s->compress_wait_queue);
1679 
1680     return ret;
1681 
1682  fail:
1683     g_free(s->image_data_file);
1684     if (has_data_file(bs)) {
1685         bdrv_unref_child(bs, s->data_file);
1686     }
1687     g_free(s->unknown_header_fields);
1688     cleanup_unknown_header_ext(bs);
1689     qcow2_free_snapshots(bs);
1690     qcow2_refcount_close(bs);
1691     qemu_vfree(s->l1_table);
1692     /* else pre-write overlap checks in cache_destroy may crash */
1693     s->l1_table = NULL;
1694     cache_clean_timer_del(bs);
1695     if (s->l2_table_cache) {
1696         qcow2_cache_destroy(s->l2_table_cache);
1697     }
1698     if (s->refcount_block_cache) {
1699         qcow2_cache_destroy(s->refcount_block_cache);
1700     }
1701     qcrypto_block_free(s->crypto);
1702     qapi_free_QCryptoBlockOpenOptions(s->crypto_opts);
1703     return ret;
1704 }
1705 
1706 typedef struct QCow2OpenCo {
1707     BlockDriverState *bs;
1708     QDict *options;
1709     int flags;
1710     Error **errp;
1711     int ret;
1712 } QCow2OpenCo;
1713 
1714 static void coroutine_fn qcow2_open_entry(void *opaque)
1715 {
1716     QCow2OpenCo *qoc = opaque;
1717     BDRVQcow2State *s = qoc->bs->opaque;
1718 
1719     qemu_co_mutex_lock(&s->lock);
1720     qoc->ret = qcow2_do_open(qoc->bs, qoc->options, qoc->flags, qoc->errp);
1721     qemu_co_mutex_unlock(&s->lock);
1722 }
1723 
1724 static int qcow2_open(BlockDriverState *bs, QDict *options, int flags,
1725                       Error **errp)
1726 {
1727     BDRVQcow2State *s = bs->opaque;
1728     QCow2OpenCo qoc = {
1729         .bs = bs,
1730         .options = options,
1731         .flags = flags,
1732         .errp = errp,
1733         .ret = -EINPROGRESS
1734     };
1735 
1736     bs->file = bdrv_open_child(NULL, options, "file", bs, &child_file,
1737                                false, errp);
1738     if (!bs->file) {
1739         return -EINVAL;
1740     }
1741 
1742     /* Initialise locks */
1743     qemu_co_mutex_init(&s->lock);
1744 
1745     if (qemu_in_coroutine()) {
1746         /* From bdrv_co_create.  */
1747         qcow2_open_entry(&qoc);
1748     } else {
1749         assert(qemu_get_current_aio_context() == qemu_get_aio_context());
1750         qemu_coroutine_enter(qemu_coroutine_create(qcow2_open_entry, &qoc));
1751         BDRV_POLL_WHILE(bs, qoc.ret == -EINPROGRESS);
1752     }
1753     return qoc.ret;
1754 }
1755 
1756 static void qcow2_refresh_limits(BlockDriverState *bs, Error **errp)
1757 {
1758     BDRVQcow2State *s = bs->opaque;
1759 
1760     if (bs->encrypted) {
1761         /* Encryption works on a sector granularity */
1762         bs->bl.request_alignment = qcrypto_block_get_sector_size(s->crypto);
1763     }
1764     bs->bl.pwrite_zeroes_alignment = s->cluster_size;
1765     bs->bl.pdiscard_alignment = s->cluster_size;
1766 }
1767 
1768 static int qcow2_reopen_prepare(BDRVReopenState *state,
1769                                 BlockReopenQueue *queue, Error **errp)
1770 {
1771     Qcow2ReopenState *r;
1772     int ret;
1773 
1774     r = g_new0(Qcow2ReopenState, 1);
1775     state->opaque = r;
1776 
1777     ret = qcow2_update_options_prepare(state->bs, r, state->options,
1778                                        state->flags, errp);
1779     if (ret < 0) {
1780         goto fail;
1781     }
1782 
1783     /* We need to write out any unwritten data if we reopen read-only. */
1784     if ((state->flags & BDRV_O_RDWR) == 0) {
1785         ret = qcow2_reopen_bitmaps_ro(state->bs, errp);
1786         if (ret < 0) {
1787             goto fail;
1788         }
1789 
1790         ret = bdrv_flush(state->bs);
1791         if (ret < 0) {
1792             goto fail;
1793         }
1794 
1795         ret = qcow2_mark_clean(state->bs);
1796         if (ret < 0) {
1797             goto fail;
1798         }
1799     }
1800 
1801     return 0;
1802 
1803 fail:
1804     qcow2_update_options_abort(state->bs, r);
1805     g_free(r);
1806     return ret;
1807 }
1808 
1809 static void qcow2_reopen_commit(BDRVReopenState *state)
1810 {
1811     qcow2_update_options_commit(state->bs, state->opaque);
1812     g_free(state->opaque);
1813 }
1814 
1815 static void qcow2_reopen_abort(BDRVReopenState *state)
1816 {
1817     qcow2_update_options_abort(state->bs, state->opaque);
1818     g_free(state->opaque);
1819 }
1820 
1821 static void qcow2_join_options(QDict *options, QDict *old_options)
1822 {
1823     bool has_new_overlap_template =
1824         qdict_haskey(options, QCOW2_OPT_OVERLAP) ||
1825         qdict_haskey(options, QCOW2_OPT_OVERLAP_TEMPLATE);
1826     bool has_new_total_cache_size =
1827         qdict_haskey(options, QCOW2_OPT_CACHE_SIZE);
1828     bool has_all_cache_options;
1829 
1830     /* New overlap template overrides all old overlap options */
1831     if (has_new_overlap_template) {
1832         qdict_del(old_options, QCOW2_OPT_OVERLAP);
1833         qdict_del(old_options, QCOW2_OPT_OVERLAP_TEMPLATE);
1834         qdict_del(old_options, QCOW2_OPT_OVERLAP_MAIN_HEADER);
1835         qdict_del(old_options, QCOW2_OPT_OVERLAP_ACTIVE_L1);
1836         qdict_del(old_options, QCOW2_OPT_OVERLAP_ACTIVE_L2);
1837         qdict_del(old_options, QCOW2_OPT_OVERLAP_REFCOUNT_TABLE);
1838         qdict_del(old_options, QCOW2_OPT_OVERLAP_REFCOUNT_BLOCK);
1839         qdict_del(old_options, QCOW2_OPT_OVERLAP_SNAPSHOT_TABLE);
1840         qdict_del(old_options, QCOW2_OPT_OVERLAP_INACTIVE_L1);
1841         qdict_del(old_options, QCOW2_OPT_OVERLAP_INACTIVE_L2);
1842     }
1843 
1844     /* New total cache size overrides all old options */
1845     if (qdict_haskey(options, QCOW2_OPT_CACHE_SIZE)) {
1846         qdict_del(old_options, QCOW2_OPT_L2_CACHE_SIZE);
1847         qdict_del(old_options, QCOW2_OPT_REFCOUNT_CACHE_SIZE);
1848     }
1849 
1850     qdict_join(options, old_options, false);
1851 
1852     /*
1853      * If after merging all cache size options are set, an old total size is
1854      * overwritten. Do keep all options, however, if all three are new. The
1855      * resulting error message is what we want to happen.
1856      */
1857     has_all_cache_options =
1858         qdict_haskey(options, QCOW2_OPT_CACHE_SIZE) ||
1859         qdict_haskey(options, QCOW2_OPT_L2_CACHE_SIZE) ||
1860         qdict_haskey(options, QCOW2_OPT_REFCOUNT_CACHE_SIZE);
1861 
1862     if (has_all_cache_options && !has_new_total_cache_size) {
1863         qdict_del(options, QCOW2_OPT_CACHE_SIZE);
1864     }
1865 }
1866 
1867 static int coroutine_fn qcow2_co_block_status(BlockDriverState *bs,
1868                                               bool want_zero,
1869                                               int64_t offset, int64_t count,
1870                                               int64_t *pnum, int64_t *map,
1871                                               BlockDriverState **file)
1872 {
1873     BDRVQcow2State *s = bs->opaque;
1874     uint64_t cluster_offset;
1875     int index_in_cluster, ret;
1876     unsigned int bytes;
1877     int status = 0;
1878 
1879     bytes = MIN(INT_MAX, count);
1880     qemu_co_mutex_lock(&s->lock);
1881     ret = qcow2_get_cluster_offset(bs, offset, &bytes, &cluster_offset);
1882     qemu_co_mutex_unlock(&s->lock);
1883     if (ret < 0) {
1884         return ret;
1885     }
1886 
1887     *pnum = bytes;
1888 
1889     if ((ret == QCOW2_CLUSTER_NORMAL || ret == QCOW2_CLUSTER_ZERO_ALLOC) &&
1890         !s->crypto) {
1891         index_in_cluster = offset & (s->cluster_size - 1);
1892         *map = cluster_offset | index_in_cluster;
1893         *file = s->data_file->bs;
1894         status |= BDRV_BLOCK_OFFSET_VALID;
1895     }
1896     if (ret == QCOW2_CLUSTER_ZERO_PLAIN || ret == QCOW2_CLUSTER_ZERO_ALLOC) {
1897         status |= BDRV_BLOCK_ZERO;
1898     } else if (ret != QCOW2_CLUSTER_UNALLOCATED) {
1899         status |= BDRV_BLOCK_DATA;
1900     }
1901     return status;
1902 }
1903 
1904 static coroutine_fn int qcow2_handle_l2meta(BlockDriverState *bs,
1905                                             QCowL2Meta **pl2meta,
1906                                             bool link_l2)
1907 {
1908     int ret = 0;
1909     QCowL2Meta *l2meta = *pl2meta;
1910 
1911     while (l2meta != NULL) {
1912         QCowL2Meta *next;
1913 
1914         if (link_l2) {
1915             ret = qcow2_alloc_cluster_link_l2(bs, l2meta);
1916             if (ret) {
1917                 goto out;
1918             }
1919         } else {
1920             qcow2_alloc_cluster_abort(bs, l2meta);
1921         }
1922 
1923         /* Take the request off the list of running requests */
1924         if (l2meta->nb_clusters != 0) {
1925             QLIST_REMOVE(l2meta, next_in_flight);
1926         }
1927 
1928         qemu_co_queue_restart_all(&l2meta->dependent_requests);
1929 
1930         next = l2meta->next;
1931         g_free(l2meta);
1932         l2meta = next;
1933     }
1934 out:
1935     *pl2meta = l2meta;
1936     return ret;
1937 }
1938 
1939 static coroutine_fn int qcow2_co_preadv(BlockDriverState *bs, uint64_t offset,
1940                                         uint64_t bytes, QEMUIOVector *qiov,
1941                                         int flags)
1942 {
1943     BDRVQcow2State *s = bs->opaque;
1944     int offset_in_cluster;
1945     int ret;
1946     unsigned int cur_bytes; /* number of bytes in current iteration */
1947     uint64_t cluster_offset = 0;
1948     uint64_t bytes_done = 0;
1949     QEMUIOVector hd_qiov;
1950     uint8_t *cluster_data = NULL;
1951 
1952     qemu_iovec_init(&hd_qiov, qiov->niov);
1953 
1954     qemu_co_mutex_lock(&s->lock);
1955 
1956     while (bytes != 0) {
1957 
1958         /* prepare next request */
1959         cur_bytes = MIN(bytes, INT_MAX);
1960         if (s->crypto) {
1961             cur_bytes = MIN(cur_bytes,
1962                             QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size);
1963         }
1964 
1965         ret = qcow2_get_cluster_offset(bs, offset, &cur_bytes, &cluster_offset);
1966         if (ret < 0) {
1967             goto fail;
1968         }
1969 
1970         offset_in_cluster = offset_into_cluster(s, offset);
1971 
1972         qemu_iovec_reset(&hd_qiov);
1973         qemu_iovec_concat(&hd_qiov, qiov, bytes_done, cur_bytes);
1974 
1975         switch (ret) {
1976         case QCOW2_CLUSTER_UNALLOCATED:
1977 
1978             if (bs->backing) {
1979                 BLKDBG_EVENT(bs->file, BLKDBG_READ_BACKING_AIO);
1980                 qemu_co_mutex_unlock(&s->lock);
1981                 ret = bdrv_co_preadv(bs->backing, offset, cur_bytes,
1982                                      &hd_qiov, 0);
1983                 qemu_co_mutex_lock(&s->lock);
1984                 if (ret < 0) {
1985                     goto fail;
1986                 }
1987             } else {
1988                 /* Note: in this case, no need to wait */
1989                 qemu_iovec_memset(&hd_qiov, 0, 0, cur_bytes);
1990             }
1991             break;
1992 
1993         case QCOW2_CLUSTER_ZERO_PLAIN:
1994         case QCOW2_CLUSTER_ZERO_ALLOC:
1995             qemu_iovec_memset(&hd_qiov, 0, 0, cur_bytes);
1996             break;
1997 
1998         case QCOW2_CLUSTER_COMPRESSED:
1999             qemu_co_mutex_unlock(&s->lock);
2000             ret = qcow2_co_preadv_compressed(bs, cluster_offset,
2001                                              offset, cur_bytes,
2002                                              &hd_qiov);
2003             qemu_co_mutex_lock(&s->lock);
2004             if (ret < 0) {
2005                 goto fail;
2006             }
2007 
2008             break;
2009 
2010         case QCOW2_CLUSTER_NORMAL:
2011             if ((cluster_offset & 511) != 0) {
2012                 ret = -EIO;
2013                 goto fail;
2014             }
2015 
2016             if (bs->encrypted) {
2017                 assert(s->crypto);
2018 
2019                 /*
2020                  * For encrypted images, read everything into a temporary
2021                  * contiguous buffer on which the AES functions can work.
2022                  */
2023                 if (!cluster_data) {
2024                     cluster_data =
2025                         qemu_try_blockalign(s->data_file->bs,
2026                                             QCOW_MAX_CRYPT_CLUSTERS
2027                                             * s->cluster_size);
2028                     if (cluster_data == NULL) {
2029                         ret = -ENOMEM;
2030                         goto fail;
2031                     }
2032                 }
2033 
2034                 assert(cur_bytes <= QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size);
2035                 qemu_iovec_reset(&hd_qiov);
2036                 qemu_iovec_add(&hd_qiov, cluster_data, cur_bytes);
2037             }
2038 
2039             BLKDBG_EVENT(bs->file, BLKDBG_READ_AIO);
2040             qemu_co_mutex_unlock(&s->lock);
2041             ret = bdrv_co_preadv(s->data_file,
2042                                  cluster_offset + offset_in_cluster,
2043                                  cur_bytes, &hd_qiov, 0);
2044             qemu_co_mutex_lock(&s->lock);
2045             if (ret < 0) {
2046                 goto fail;
2047             }
2048             if (bs->encrypted) {
2049                 assert(s->crypto);
2050                 assert((offset & (BDRV_SECTOR_SIZE - 1)) == 0);
2051                 assert((cur_bytes & (BDRV_SECTOR_SIZE - 1)) == 0);
2052                 if (qcrypto_block_decrypt(s->crypto,
2053                                           (s->crypt_physical_offset ?
2054                                            cluster_offset + offset_in_cluster :
2055                                            offset),
2056                                           cluster_data,
2057                                           cur_bytes,
2058                                           NULL) < 0) {
2059                     ret = -EIO;
2060                     goto fail;
2061                 }
2062                 qemu_iovec_from_buf(qiov, bytes_done, cluster_data, cur_bytes);
2063             }
2064             break;
2065 
2066         default:
2067             g_assert_not_reached();
2068             ret = -EIO;
2069             goto fail;
2070         }
2071 
2072         bytes -= cur_bytes;
2073         offset += cur_bytes;
2074         bytes_done += cur_bytes;
2075     }
2076     ret = 0;
2077 
2078 fail:
2079     qemu_co_mutex_unlock(&s->lock);
2080 
2081     qemu_iovec_destroy(&hd_qiov);
2082     qemu_vfree(cluster_data);
2083 
2084     return ret;
2085 }
2086 
2087 /* Check if it's possible to merge a write request with the writing of
2088  * the data from the COW regions */
2089 static bool merge_cow(uint64_t offset, unsigned bytes,
2090                       QEMUIOVector *hd_qiov, QCowL2Meta *l2meta)
2091 {
2092     QCowL2Meta *m;
2093 
2094     for (m = l2meta; m != NULL; m = m->next) {
2095         /* If both COW regions are empty then there's nothing to merge */
2096         if (m->cow_start.nb_bytes == 0 && m->cow_end.nb_bytes == 0) {
2097             continue;
2098         }
2099 
2100         /* The data (middle) region must be immediately after the
2101          * start region */
2102         if (l2meta_cow_start(m) + m->cow_start.nb_bytes != offset) {
2103             continue;
2104         }
2105 
2106         /* The end region must be immediately after the data (middle)
2107          * region */
2108         if (m->offset + m->cow_end.offset != offset + bytes) {
2109             continue;
2110         }
2111 
2112         /* Make sure that adding both COW regions to the QEMUIOVector
2113          * does not exceed IOV_MAX */
2114         if (hd_qiov->niov > IOV_MAX - 2) {
2115             continue;
2116         }
2117 
2118         m->data_qiov = hd_qiov;
2119         return true;
2120     }
2121 
2122     return false;
2123 }
2124 
2125 static coroutine_fn int qcow2_co_pwritev(BlockDriverState *bs, uint64_t offset,
2126                                          uint64_t bytes, QEMUIOVector *qiov,
2127                                          int flags)
2128 {
2129     BDRVQcow2State *s = bs->opaque;
2130     int offset_in_cluster;
2131     int ret;
2132     unsigned int cur_bytes; /* number of sectors in current iteration */
2133     uint64_t cluster_offset;
2134     QEMUIOVector hd_qiov;
2135     uint64_t bytes_done = 0;
2136     uint8_t *cluster_data = NULL;
2137     QCowL2Meta *l2meta = NULL;
2138 
2139     trace_qcow2_writev_start_req(qemu_coroutine_self(), offset, bytes);
2140 
2141     qemu_iovec_init(&hd_qiov, qiov->niov);
2142 
2143     qemu_co_mutex_lock(&s->lock);
2144 
2145     while (bytes != 0) {
2146 
2147         l2meta = NULL;
2148 
2149         trace_qcow2_writev_start_part(qemu_coroutine_self());
2150         offset_in_cluster = offset_into_cluster(s, offset);
2151         cur_bytes = MIN(bytes, INT_MAX);
2152         if (bs->encrypted) {
2153             cur_bytes = MIN(cur_bytes,
2154                             QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size
2155                             - offset_in_cluster);
2156         }
2157 
2158         ret = qcow2_alloc_cluster_offset(bs, offset, &cur_bytes,
2159                                          &cluster_offset, &l2meta);
2160         if (ret < 0) {
2161             goto fail;
2162         }
2163 
2164         assert((cluster_offset & 511) == 0);
2165 
2166         qemu_iovec_reset(&hd_qiov);
2167         qemu_iovec_concat(&hd_qiov, qiov, bytes_done, cur_bytes);
2168 
2169         if (bs->encrypted) {
2170             assert(s->crypto);
2171             if (!cluster_data) {
2172                 cluster_data = qemu_try_blockalign(bs->file->bs,
2173                                                    QCOW_MAX_CRYPT_CLUSTERS
2174                                                    * s->cluster_size);
2175                 if (cluster_data == NULL) {
2176                     ret = -ENOMEM;
2177                     goto fail;
2178                 }
2179             }
2180 
2181             assert(hd_qiov.size <=
2182                    QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size);
2183             qemu_iovec_to_buf(&hd_qiov, 0, cluster_data, hd_qiov.size);
2184 
2185             if (qcrypto_block_encrypt(s->crypto,
2186                                       (s->crypt_physical_offset ?
2187                                        cluster_offset + offset_in_cluster :
2188                                        offset),
2189                                       cluster_data,
2190                                       cur_bytes, NULL) < 0) {
2191                 ret = -EIO;
2192                 goto fail;
2193             }
2194 
2195             qemu_iovec_reset(&hd_qiov);
2196             qemu_iovec_add(&hd_qiov, cluster_data, cur_bytes);
2197         }
2198 
2199         ret = qcow2_pre_write_overlap_check(bs, 0,
2200                 cluster_offset + offset_in_cluster, cur_bytes, true);
2201         if (ret < 0) {
2202             goto fail;
2203         }
2204 
2205         /* If we need to do COW, check if it's possible to merge the
2206          * writing of the guest data together with that of the COW regions.
2207          * If it's not possible (or not necessary) then write the
2208          * guest data now. */
2209         if (!merge_cow(offset, cur_bytes, &hd_qiov, l2meta)) {
2210             qemu_co_mutex_unlock(&s->lock);
2211             BLKDBG_EVENT(bs->file, BLKDBG_WRITE_AIO);
2212             trace_qcow2_writev_data(qemu_coroutine_self(),
2213                                     cluster_offset + offset_in_cluster);
2214             ret = bdrv_co_pwritev(s->data_file,
2215                                   cluster_offset + offset_in_cluster,
2216                                   cur_bytes, &hd_qiov, 0);
2217             qemu_co_mutex_lock(&s->lock);
2218             if (ret < 0) {
2219                 goto fail;
2220             }
2221         }
2222 
2223         ret = qcow2_handle_l2meta(bs, &l2meta, true);
2224         if (ret) {
2225             goto fail;
2226         }
2227 
2228         bytes -= cur_bytes;
2229         offset += cur_bytes;
2230         bytes_done += cur_bytes;
2231         trace_qcow2_writev_done_part(qemu_coroutine_self(), cur_bytes);
2232     }
2233     ret = 0;
2234 
2235 fail:
2236     qcow2_handle_l2meta(bs, &l2meta, false);
2237 
2238     qemu_co_mutex_unlock(&s->lock);
2239 
2240     qemu_iovec_destroy(&hd_qiov);
2241     qemu_vfree(cluster_data);
2242     trace_qcow2_writev_done_req(qemu_coroutine_self(), ret);
2243 
2244     return ret;
2245 }
2246 
2247 static int qcow2_inactivate(BlockDriverState *bs)
2248 {
2249     BDRVQcow2State *s = bs->opaque;
2250     int ret, result = 0;
2251     Error *local_err = NULL;
2252 
2253     qcow2_store_persistent_dirty_bitmaps(bs, &local_err);
2254     if (local_err != NULL) {
2255         result = -EINVAL;
2256         error_reportf_err(local_err, "Lost persistent bitmaps during "
2257                           "inactivation of node '%s': ",
2258                           bdrv_get_device_or_node_name(bs));
2259     }
2260 
2261     ret = qcow2_cache_flush(bs, s->l2_table_cache);
2262     if (ret) {
2263         result = ret;
2264         error_report("Failed to flush the L2 table cache: %s",
2265                      strerror(-ret));
2266     }
2267 
2268     ret = qcow2_cache_flush(bs, s->refcount_block_cache);
2269     if (ret) {
2270         result = ret;
2271         error_report("Failed to flush the refcount block cache: %s",
2272                      strerror(-ret));
2273     }
2274 
2275     if (result == 0) {
2276         qcow2_mark_clean(bs);
2277     }
2278 
2279     return result;
2280 }
2281 
2282 static void qcow2_close(BlockDriverState *bs)
2283 {
2284     BDRVQcow2State *s = bs->opaque;
2285     qemu_vfree(s->l1_table);
2286     /* else pre-write overlap checks in cache_destroy may crash */
2287     s->l1_table = NULL;
2288 
2289     if (!(s->flags & BDRV_O_INACTIVE)) {
2290         qcow2_inactivate(bs);
2291     }
2292 
2293     cache_clean_timer_del(bs);
2294     qcow2_cache_destroy(s->l2_table_cache);
2295     qcow2_cache_destroy(s->refcount_block_cache);
2296 
2297     qcrypto_block_free(s->crypto);
2298     s->crypto = NULL;
2299 
2300     g_free(s->unknown_header_fields);
2301     cleanup_unknown_header_ext(bs);
2302 
2303     g_free(s->image_data_file);
2304     g_free(s->image_backing_file);
2305     g_free(s->image_backing_format);
2306 
2307     if (has_data_file(bs)) {
2308         bdrv_unref_child(bs, s->data_file);
2309     }
2310 
2311     qcow2_refcount_close(bs);
2312     qcow2_free_snapshots(bs);
2313 }
2314 
2315 static void coroutine_fn qcow2_co_invalidate_cache(BlockDriverState *bs,
2316                                                    Error **errp)
2317 {
2318     BDRVQcow2State *s = bs->opaque;
2319     int flags = s->flags;
2320     QCryptoBlock *crypto = NULL;
2321     QDict *options;
2322     Error *local_err = NULL;
2323     int ret;
2324 
2325     /*
2326      * Backing files are read-only which makes all of their metadata immutable,
2327      * that means we don't have to worry about reopening them here.
2328      */
2329 
2330     crypto = s->crypto;
2331     s->crypto = NULL;
2332 
2333     qcow2_close(bs);
2334 
2335     memset(s, 0, sizeof(BDRVQcow2State));
2336     options = qdict_clone_shallow(bs->options);
2337 
2338     flags &= ~BDRV_O_INACTIVE;
2339     qemu_co_mutex_lock(&s->lock);
2340     ret = qcow2_do_open(bs, options, flags, &local_err);
2341     qemu_co_mutex_unlock(&s->lock);
2342     qobject_unref(options);
2343     if (local_err) {
2344         error_propagate_prepend(errp, local_err,
2345                                 "Could not reopen qcow2 layer: ");
2346         bs->drv = NULL;
2347         return;
2348     } else if (ret < 0) {
2349         error_setg_errno(errp, -ret, "Could not reopen qcow2 layer");
2350         bs->drv = NULL;
2351         return;
2352     }
2353 
2354     s->crypto = crypto;
2355 }
2356 
2357 static size_t header_ext_add(char *buf, uint32_t magic, const void *s,
2358     size_t len, size_t buflen)
2359 {
2360     QCowExtension *ext_backing_fmt = (QCowExtension*) buf;
2361     size_t ext_len = sizeof(QCowExtension) + ((len + 7) & ~7);
2362 
2363     if (buflen < ext_len) {
2364         return -ENOSPC;
2365     }
2366 
2367     *ext_backing_fmt = (QCowExtension) {
2368         .magic  = cpu_to_be32(magic),
2369         .len    = cpu_to_be32(len),
2370     };
2371 
2372     if (len) {
2373         memcpy(buf + sizeof(QCowExtension), s, len);
2374     }
2375 
2376     return ext_len;
2377 }
2378 
2379 /*
2380  * Updates the qcow2 header, including the variable length parts of it, i.e.
2381  * the backing file name and all extensions. qcow2 was not designed to allow
2382  * such changes, so if we run out of space (we can only use the first cluster)
2383  * this function may fail.
2384  *
2385  * Returns 0 on success, -errno in error cases.
2386  */
2387 int qcow2_update_header(BlockDriverState *bs)
2388 {
2389     BDRVQcow2State *s = bs->opaque;
2390     QCowHeader *header;
2391     char *buf;
2392     size_t buflen = s->cluster_size;
2393     int ret;
2394     uint64_t total_size;
2395     uint32_t refcount_table_clusters;
2396     size_t header_length;
2397     Qcow2UnknownHeaderExtension *uext;
2398 
2399     buf = qemu_blockalign(bs, buflen);
2400 
2401     /* Header structure */
2402     header = (QCowHeader*) buf;
2403 
2404     if (buflen < sizeof(*header)) {
2405         ret = -ENOSPC;
2406         goto fail;
2407     }
2408 
2409     header_length = sizeof(*header) + s->unknown_header_fields_size;
2410     total_size = bs->total_sectors * BDRV_SECTOR_SIZE;
2411     refcount_table_clusters = s->refcount_table_size >> (s->cluster_bits - 3);
2412 
2413     *header = (QCowHeader) {
2414         /* Version 2 fields */
2415         .magic                  = cpu_to_be32(QCOW_MAGIC),
2416         .version                = cpu_to_be32(s->qcow_version),
2417         .backing_file_offset    = 0,
2418         .backing_file_size      = 0,
2419         .cluster_bits           = cpu_to_be32(s->cluster_bits),
2420         .size                   = cpu_to_be64(total_size),
2421         .crypt_method           = cpu_to_be32(s->crypt_method_header),
2422         .l1_size                = cpu_to_be32(s->l1_size),
2423         .l1_table_offset        = cpu_to_be64(s->l1_table_offset),
2424         .refcount_table_offset  = cpu_to_be64(s->refcount_table_offset),
2425         .refcount_table_clusters = cpu_to_be32(refcount_table_clusters),
2426         .nb_snapshots           = cpu_to_be32(s->nb_snapshots),
2427         .snapshots_offset       = cpu_to_be64(s->snapshots_offset),
2428 
2429         /* Version 3 fields */
2430         .incompatible_features  = cpu_to_be64(s->incompatible_features),
2431         .compatible_features    = cpu_to_be64(s->compatible_features),
2432         .autoclear_features     = cpu_to_be64(s->autoclear_features),
2433         .refcount_order         = cpu_to_be32(s->refcount_order),
2434         .header_length          = cpu_to_be32(header_length),
2435     };
2436 
2437     /* For older versions, write a shorter header */
2438     switch (s->qcow_version) {
2439     case 2:
2440         ret = offsetof(QCowHeader, incompatible_features);
2441         break;
2442     case 3:
2443         ret = sizeof(*header);
2444         break;
2445     default:
2446         ret = -EINVAL;
2447         goto fail;
2448     }
2449 
2450     buf += ret;
2451     buflen -= ret;
2452     memset(buf, 0, buflen);
2453 
2454     /* Preserve any unknown field in the header */
2455     if (s->unknown_header_fields_size) {
2456         if (buflen < s->unknown_header_fields_size) {
2457             ret = -ENOSPC;
2458             goto fail;
2459         }
2460 
2461         memcpy(buf, s->unknown_header_fields, s->unknown_header_fields_size);
2462         buf += s->unknown_header_fields_size;
2463         buflen -= s->unknown_header_fields_size;
2464     }
2465 
2466     /* Backing file format header extension */
2467     if (s->image_backing_format) {
2468         ret = header_ext_add(buf, QCOW2_EXT_MAGIC_BACKING_FORMAT,
2469                              s->image_backing_format,
2470                              strlen(s->image_backing_format),
2471                              buflen);
2472         if (ret < 0) {
2473             goto fail;
2474         }
2475 
2476         buf += ret;
2477         buflen -= ret;
2478     }
2479 
2480     /* External data file header extension */
2481     if (has_data_file(bs) && s->image_data_file) {
2482         ret = header_ext_add(buf, QCOW2_EXT_MAGIC_DATA_FILE,
2483                              s->image_data_file, strlen(s->image_data_file),
2484                              buflen);
2485         if (ret < 0) {
2486             goto fail;
2487         }
2488 
2489         buf += ret;
2490         buflen -= ret;
2491     }
2492 
2493     /* Full disk encryption header pointer extension */
2494     if (s->crypto_header.offset != 0) {
2495         s->crypto_header.offset = cpu_to_be64(s->crypto_header.offset);
2496         s->crypto_header.length = cpu_to_be64(s->crypto_header.length);
2497         ret = header_ext_add(buf, QCOW2_EXT_MAGIC_CRYPTO_HEADER,
2498                              &s->crypto_header, sizeof(s->crypto_header),
2499                              buflen);
2500         s->crypto_header.offset = be64_to_cpu(s->crypto_header.offset);
2501         s->crypto_header.length = be64_to_cpu(s->crypto_header.length);
2502         if (ret < 0) {
2503             goto fail;
2504         }
2505         buf += ret;
2506         buflen -= ret;
2507     }
2508 
2509     /* Feature table */
2510     if (s->qcow_version >= 3) {
2511         Qcow2Feature features[] = {
2512             {
2513                 .type = QCOW2_FEAT_TYPE_INCOMPATIBLE,
2514                 .bit  = QCOW2_INCOMPAT_DIRTY_BITNR,
2515                 .name = "dirty bit",
2516             },
2517             {
2518                 .type = QCOW2_FEAT_TYPE_INCOMPATIBLE,
2519                 .bit  = QCOW2_INCOMPAT_CORRUPT_BITNR,
2520                 .name = "corrupt bit",
2521             },
2522             {
2523                 .type = QCOW2_FEAT_TYPE_INCOMPATIBLE,
2524                 .bit  = QCOW2_INCOMPAT_DATA_FILE_BITNR,
2525                 .name = "external data file",
2526             },
2527             {
2528                 .type = QCOW2_FEAT_TYPE_COMPATIBLE,
2529                 .bit  = QCOW2_COMPAT_LAZY_REFCOUNTS_BITNR,
2530                 .name = "lazy refcounts",
2531             },
2532         };
2533 
2534         ret = header_ext_add(buf, QCOW2_EXT_MAGIC_FEATURE_TABLE,
2535                              features, sizeof(features), buflen);
2536         if (ret < 0) {
2537             goto fail;
2538         }
2539         buf += ret;
2540         buflen -= ret;
2541     }
2542 
2543     /* Bitmap extension */
2544     if (s->nb_bitmaps > 0) {
2545         Qcow2BitmapHeaderExt bitmaps_header = {
2546             .nb_bitmaps = cpu_to_be32(s->nb_bitmaps),
2547             .bitmap_directory_size =
2548                     cpu_to_be64(s->bitmap_directory_size),
2549             .bitmap_directory_offset =
2550                     cpu_to_be64(s->bitmap_directory_offset)
2551         };
2552         ret = header_ext_add(buf, QCOW2_EXT_MAGIC_BITMAPS,
2553                              &bitmaps_header, sizeof(bitmaps_header),
2554                              buflen);
2555         if (ret < 0) {
2556             goto fail;
2557         }
2558         buf += ret;
2559         buflen -= ret;
2560     }
2561 
2562     /* Keep unknown header extensions */
2563     QLIST_FOREACH(uext, &s->unknown_header_ext, next) {
2564         ret = header_ext_add(buf, uext->magic, uext->data, uext->len, buflen);
2565         if (ret < 0) {
2566             goto fail;
2567         }
2568 
2569         buf += ret;
2570         buflen -= ret;
2571     }
2572 
2573     /* End of header extensions */
2574     ret = header_ext_add(buf, QCOW2_EXT_MAGIC_END, NULL, 0, buflen);
2575     if (ret < 0) {
2576         goto fail;
2577     }
2578 
2579     buf += ret;
2580     buflen -= ret;
2581 
2582     /* Backing file name */
2583     if (s->image_backing_file) {
2584         size_t backing_file_len = strlen(s->image_backing_file);
2585 
2586         if (buflen < backing_file_len) {
2587             ret = -ENOSPC;
2588             goto fail;
2589         }
2590 
2591         /* Using strncpy is ok here, since buf is not NUL-terminated. */
2592         strncpy(buf, s->image_backing_file, buflen);
2593 
2594         header->backing_file_offset = cpu_to_be64(buf - ((char*) header));
2595         header->backing_file_size   = cpu_to_be32(backing_file_len);
2596     }
2597 
2598     /* Write the new header */
2599     ret = bdrv_pwrite(bs->file, 0, header, s->cluster_size);
2600     if (ret < 0) {
2601         goto fail;
2602     }
2603 
2604     ret = 0;
2605 fail:
2606     qemu_vfree(header);
2607     return ret;
2608 }
2609 
2610 static int qcow2_change_backing_file(BlockDriverState *bs,
2611     const char *backing_file, const char *backing_fmt)
2612 {
2613     BDRVQcow2State *s = bs->opaque;
2614 
2615     /* Adding a backing file means that the external data file alone won't be
2616      * enough to make sense of the content */
2617     if (backing_file && data_file_is_raw(bs)) {
2618         return -EINVAL;
2619     }
2620 
2621     if (backing_file && strlen(backing_file) > 1023) {
2622         return -EINVAL;
2623     }
2624 
2625     pstrcpy(bs->auto_backing_file, sizeof(bs->auto_backing_file),
2626             backing_file ?: "");
2627     pstrcpy(bs->backing_file, sizeof(bs->backing_file), backing_file ?: "");
2628     pstrcpy(bs->backing_format, sizeof(bs->backing_format), backing_fmt ?: "");
2629 
2630     g_free(s->image_backing_file);
2631     g_free(s->image_backing_format);
2632 
2633     s->image_backing_file = backing_file ? g_strdup(bs->backing_file) : NULL;
2634     s->image_backing_format = backing_fmt ? g_strdup(bs->backing_format) : NULL;
2635 
2636     return qcow2_update_header(bs);
2637 }
2638 
2639 static int qcow2_crypt_method_from_format(const char *encryptfmt)
2640 {
2641     if (g_str_equal(encryptfmt, "luks")) {
2642         return QCOW_CRYPT_LUKS;
2643     } else if (g_str_equal(encryptfmt, "aes")) {
2644         return QCOW_CRYPT_AES;
2645     } else {
2646         return -EINVAL;
2647     }
2648 }
2649 
2650 static int qcow2_set_up_encryption(BlockDriverState *bs,
2651                                    QCryptoBlockCreateOptions *cryptoopts,
2652                                    Error **errp)
2653 {
2654     BDRVQcow2State *s = bs->opaque;
2655     QCryptoBlock *crypto = NULL;
2656     int fmt, ret;
2657 
2658     switch (cryptoopts->format) {
2659     case Q_CRYPTO_BLOCK_FORMAT_LUKS:
2660         fmt = QCOW_CRYPT_LUKS;
2661         break;
2662     case Q_CRYPTO_BLOCK_FORMAT_QCOW:
2663         fmt = QCOW_CRYPT_AES;
2664         break;
2665     default:
2666         error_setg(errp, "Crypto format not supported in qcow2");
2667         return -EINVAL;
2668     }
2669 
2670     s->crypt_method_header = fmt;
2671 
2672     crypto = qcrypto_block_create(cryptoopts, "encrypt.",
2673                                   qcow2_crypto_hdr_init_func,
2674                                   qcow2_crypto_hdr_write_func,
2675                                   bs, errp);
2676     if (!crypto) {
2677         return -EINVAL;
2678     }
2679 
2680     ret = qcow2_update_header(bs);
2681     if (ret < 0) {
2682         error_setg_errno(errp, -ret, "Could not write encryption header");
2683         goto out;
2684     }
2685 
2686     ret = 0;
2687  out:
2688     qcrypto_block_free(crypto);
2689     return ret;
2690 }
2691 
2692 /**
2693  * Preallocates metadata structures for data clusters between @offset (in the
2694  * guest disk) and @new_length (which is thus generally the new guest disk
2695  * size).
2696  *
2697  * Returns: 0 on success, -errno on failure.
2698  */
2699 static int coroutine_fn preallocate_co(BlockDriverState *bs, uint64_t offset,
2700                                        uint64_t new_length)
2701 {
2702     uint64_t bytes;
2703     uint64_t host_offset = 0;
2704     unsigned int cur_bytes;
2705     int ret;
2706     QCowL2Meta *meta;
2707 
2708     assert(offset <= new_length);
2709     bytes = new_length - offset;
2710 
2711     while (bytes) {
2712         cur_bytes = MIN(bytes, INT_MAX);
2713         ret = qcow2_alloc_cluster_offset(bs, offset, &cur_bytes,
2714                                          &host_offset, &meta);
2715         if (ret < 0) {
2716             return ret;
2717         }
2718 
2719         while (meta) {
2720             QCowL2Meta *next = meta->next;
2721 
2722             ret = qcow2_alloc_cluster_link_l2(bs, meta);
2723             if (ret < 0) {
2724                 qcow2_free_any_clusters(bs, meta->alloc_offset,
2725                                         meta->nb_clusters, QCOW2_DISCARD_NEVER);
2726                 return ret;
2727             }
2728 
2729             /* There are no dependent requests, but we need to remove our
2730              * request from the list of in-flight requests */
2731             QLIST_REMOVE(meta, next_in_flight);
2732 
2733             g_free(meta);
2734             meta = next;
2735         }
2736 
2737         /* TODO Preallocate data if requested */
2738 
2739         bytes -= cur_bytes;
2740         offset += cur_bytes;
2741     }
2742 
2743     /*
2744      * It is expected that the image file is large enough to actually contain
2745      * all of the allocated clusters (otherwise we get failing reads after
2746      * EOF). Extend the image to the last allocated sector.
2747      */
2748     if (host_offset != 0) {
2749         uint8_t data = 0;
2750         ret = bdrv_pwrite(bs->file, (host_offset + cur_bytes) - 1,
2751                           &data, 1);
2752         if (ret < 0) {
2753             return ret;
2754         }
2755     }
2756 
2757     return 0;
2758 }
2759 
2760 /* qcow2_refcount_metadata_size:
2761  * @clusters: number of clusters to refcount (including data and L1/L2 tables)
2762  * @cluster_size: size of a cluster, in bytes
2763  * @refcount_order: refcount bits power-of-2 exponent
2764  * @generous_increase: allow for the refcount table to be 1.5x as large as it
2765  *                     needs to be
2766  *
2767  * Returns: Number of bytes required for refcount blocks and table metadata.
2768  */
2769 int64_t qcow2_refcount_metadata_size(int64_t clusters, size_t cluster_size,
2770                                      int refcount_order, bool generous_increase,
2771                                      uint64_t *refblock_count)
2772 {
2773     /*
2774      * Every host cluster is reference-counted, including metadata (even
2775      * refcount metadata is recursively included).
2776      *
2777      * An accurate formula for the size of refcount metadata size is difficult
2778      * to derive.  An easier method of calculation is finding the fixed point
2779      * where no further refcount blocks or table clusters are required to
2780      * reference count every cluster.
2781      */
2782     int64_t blocks_per_table_cluster = cluster_size / sizeof(uint64_t);
2783     int64_t refcounts_per_block = cluster_size * 8 / (1 << refcount_order);
2784     int64_t table = 0;  /* number of refcount table clusters */
2785     int64_t blocks = 0; /* number of refcount block clusters */
2786     int64_t last;
2787     int64_t n = 0;
2788 
2789     do {
2790         last = n;
2791         blocks = DIV_ROUND_UP(clusters + table + blocks, refcounts_per_block);
2792         table = DIV_ROUND_UP(blocks, blocks_per_table_cluster);
2793         n = clusters + blocks + table;
2794 
2795         if (n == last && generous_increase) {
2796             clusters += DIV_ROUND_UP(table, 2);
2797             n = 0; /* force another loop */
2798             generous_increase = false;
2799         }
2800     } while (n != last);
2801 
2802     if (refblock_count) {
2803         *refblock_count = blocks;
2804     }
2805 
2806     return (blocks + table) * cluster_size;
2807 }
2808 
2809 /**
2810  * qcow2_calc_prealloc_size:
2811  * @total_size: virtual disk size in bytes
2812  * @cluster_size: cluster size in bytes
2813  * @refcount_order: refcount bits power-of-2 exponent
2814  *
2815  * Returns: Total number of bytes required for the fully allocated image
2816  * (including metadata).
2817  */
2818 static int64_t qcow2_calc_prealloc_size(int64_t total_size,
2819                                         size_t cluster_size,
2820                                         int refcount_order)
2821 {
2822     int64_t meta_size = 0;
2823     uint64_t nl1e, nl2e;
2824     int64_t aligned_total_size = ROUND_UP(total_size, cluster_size);
2825 
2826     /* header: 1 cluster */
2827     meta_size += cluster_size;
2828 
2829     /* total size of L2 tables */
2830     nl2e = aligned_total_size / cluster_size;
2831     nl2e = ROUND_UP(nl2e, cluster_size / sizeof(uint64_t));
2832     meta_size += nl2e * sizeof(uint64_t);
2833 
2834     /* total size of L1 tables */
2835     nl1e = nl2e * sizeof(uint64_t) / cluster_size;
2836     nl1e = ROUND_UP(nl1e, cluster_size / sizeof(uint64_t));
2837     meta_size += nl1e * sizeof(uint64_t);
2838 
2839     /* total size of refcount table and blocks */
2840     meta_size += qcow2_refcount_metadata_size(
2841             (meta_size + aligned_total_size) / cluster_size,
2842             cluster_size, refcount_order, false, NULL);
2843 
2844     return meta_size + aligned_total_size;
2845 }
2846 
2847 static bool validate_cluster_size(size_t cluster_size, Error **errp)
2848 {
2849     int cluster_bits = ctz32(cluster_size);
2850     if (cluster_bits < MIN_CLUSTER_BITS || cluster_bits > MAX_CLUSTER_BITS ||
2851         (1 << cluster_bits) != cluster_size)
2852     {
2853         error_setg(errp, "Cluster size must be a power of two between %d and "
2854                    "%dk", 1 << MIN_CLUSTER_BITS, 1 << (MAX_CLUSTER_BITS - 10));
2855         return false;
2856     }
2857     return true;
2858 }
2859 
2860 static size_t qcow2_opt_get_cluster_size_del(QemuOpts *opts, Error **errp)
2861 {
2862     size_t cluster_size;
2863 
2864     cluster_size = qemu_opt_get_size_del(opts, BLOCK_OPT_CLUSTER_SIZE,
2865                                          DEFAULT_CLUSTER_SIZE);
2866     if (!validate_cluster_size(cluster_size, errp)) {
2867         return 0;
2868     }
2869     return cluster_size;
2870 }
2871 
2872 static int qcow2_opt_get_version_del(QemuOpts *opts, Error **errp)
2873 {
2874     char *buf;
2875     int ret;
2876 
2877     buf = qemu_opt_get_del(opts, BLOCK_OPT_COMPAT_LEVEL);
2878     if (!buf) {
2879         ret = 3; /* default */
2880     } else if (!strcmp(buf, "0.10")) {
2881         ret = 2;
2882     } else if (!strcmp(buf, "1.1")) {
2883         ret = 3;
2884     } else {
2885         error_setg(errp, "Invalid compatibility level: '%s'", buf);
2886         ret = -EINVAL;
2887     }
2888     g_free(buf);
2889     return ret;
2890 }
2891 
2892 static uint64_t qcow2_opt_get_refcount_bits_del(QemuOpts *opts, int version,
2893                                                 Error **errp)
2894 {
2895     uint64_t refcount_bits;
2896 
2897     refcount_bits = qemu_opt_get_number_del(opts, BLOCK_OPT_REFCOUNT_BITS, 16);
2898     if (refcount_bits > 64 || !is_power_of_2(refcount_bits)) {
2899         error_setg(errp, "Refcount width must be a power of two and may not "
2900                    "exceed 64 bits");
2901         return 0;
2902     }
2903 
2904     if (version < 3 && refcount_bits != 16) {
2905         error_setg(errp, "Different refcount widths than 16 bits require "
2906                    "compatibility level 1.1 or above (use compat=1.1 or "
2907                    "greater)");
2908         return 0;
2909     }
2910 
2911     return refcount_bits;
2912 }
2913 
2914 static int coroutine_fn
2915 qcow2_co_create(BlockdevCreateOptions *create_options, Error **errp)
2916 {
2917     BlockdevCreateOptionsQcow2 *qcow2_opts;
2918     QDict *options;
2919 
2920     /*
2921      * Open the image file and write a minimal qcow2 header.
2922      *
2923      * We keep things simple and start with a zero-sized image. We also
2924      * do without refcount blocks or a L1 table for now. We'll fix the
2925      * inconsistency later.
2926      *
2927      * We do need a refcount table because growing the refcount table means
2928      * allocating two new refcount blocks - the seconds of which would be at
2929      * 2 GB for 64k clusters, and we don't want to have a 2 GB initial file
2930      * size for any qcow2 image.
2931      */
2932     BlockBackend *blk = NULL;
2933     BlockDriverState *bs = NULL;
2934     BlockDriverState *data_bs = NULL;
2935     QCowHeader *header;
2936     size_t cluster_size;
2937     int version;
2938     int refcount_order;
2939     uint64_t* refcount_table;
2940     Error *local_err = NULL;
2941     int ret;
2942 
2943     assert(create_options->driver == BLOCKDEV_DRIVER_QCOW2);
2944     qcow2_opts = &create_options->u.qcow2;
2945 
2946     bs = bdrv_open_blockdev_ref(qcow2_opts->file, errp);
2947     if (bs == NULL) {
2948         return -EIO;
2949     }
2950 
2951     /* Validate options and set default values */
2952     if (!QEMU_IS_ALIGNED(qcow2_opts->size, BDRV_SECTOR_SIZE)) {
2953         error_setg(errp, "Image size must be a multiple of 512 bytes");
2954         ret = -EINVAL;
2955         goto out;
2956     }
2957 
2958     if (qcow2_opts->has_version) {
2959         switch (qcow2_opts->version) {
2960         case BLOCKDEV_QCOW2_VERSION_V2:
2961             version = 2;
2962             break;
2963         case BLOCKDEV_QCOW2_VERSION_V3:
2964             version = 3;
2965             break;
2966         default:
2967             g_assert_not_reached();
2968         }
2969     } else {
2970         version = 3;
2971     }
2972 
2973     if (qcow2_opts->has_cluster_size) {
2974         cluster_size = qcow2_opts->cluster_size;
2975     } else {
2976         cluster_size = DEFAULT_CLUSTER_SIZE;
2977     }
2978 
2979     if (!validate_cluster_size(cluster_size, errp)) {
2980         ret = -EINVAL;
2981         goto out;
2982     }
2983 
2984     if (!qcow2_opts->has_preallocation) {
2985         qcow2_opts->preallocation = PREALLOC_MODE_OFF;
2986     }
2987     if (qcow2_opts->has_backing_file &&
2988         qcow2_opts->preallocation != PREALLOC_MODE_OFF)
2989     {
2990         error_setg(errp, "Backing file and preallocation cannot be used at "
2991                    "the same time");
2992         ret = -EINVAL;
2993         goto out;
2994     }
2995     if (qcow2_opts->has_backing_fmt && !qcow2_opts->has_backing_file) {
2996         error_setg(errp, "Backing format cannot be used without backing file");
2997         ret = -EINVAL;
2998         goto out;
2999     }
3000 
3001     if (!qcow2_opts->has_lazy_refcounts) {
3002         qcow2_opts->lazy_refcounts = false;
3003     }
3004     if (version < 3 && qcow2_opts->lazy_refcounts) {
3005         error_setg(errp, "Lazy refcounts only supported with compatibility "
3006                    "level 1.1 and above (use version=v3 or greater)");
3007         ret = -EINVAL;
3008         goto out;
3009     }
3010 
3011     if (!qcow2_opts->has_refcount_bits) {
3012         qcow2_opts->refcount_bits = 16;
3013     }
3014     if (qcow2_opts->refcount_bits > 64 ||
3015         !is_power_of_2(qcow2_opts->refcount_bits))
3016     {
3017         error_setg(errp, "Refcount width must be a power of two and may not "
3018                    "exceed 64 bits");
3019         ret = -EINVAL;
3020         goto out;
3021     }
3022     if (version < 3 && qcow2_opts->refcount_bits != 16) {
3023         error_setg(errp, "Different refcount widths than 16 bits require "
3024                    "compatibility level 1.1 or above (use version=v3 or "
3025                    "greater)");
3026         ret = -EINVAL;
3027         goto out;
3028     }
3029     refcount_order = ctz32(qcow2_opts->refcount_bits);
3030 
3031     if (qcow2_opts->data_file_raw && !qcow2_opts->data_file) {
3032         error_setg(errp, "data-file-raw requires data-file");
3033         ret = -EINVAL;
3034         goto out;
3035     }
3036     if (qcow2_opts->data_file_raw && qcow2_opts->has_backing_file) {
3037         error_setg(errp, "Backing file and data-file-raw cannot be used at "
3038                    "the same time");
3039         ret = -EINVAL;
3040         goto out;
3041     }
3042 
3043     if (qcow2_opts->data_file) {
3044         if (version < 3) {
3045             error_setg(errp, "External data files are only supported with "
3046                        "compatibility level 1.1 and above (use version=v3 or "
3047                        "greater)");
3048             ret = -EINVAL;
3049             goto out;
3050         }
3051         data_bs = bdrv_open_blockdev_ref(qcow2_opts->data_file, errp);
3052         if (bs == NULL) {
3053             ret = -EIO;
3054             goto out;
3055         }
3056     }
3057 
3058     /* Create BlockBackend to write to the image */
3059     blk = blk_new(BLK_PERM_WRITE | BLK_PERM_RESIZE, BLK_PERM_ALL);
3060     ret = blk_insert_bs(blk, bs, errp);
3061     if (ret < 0) {
3062         goto out;
3063     }
3064     blk_set_allow_write_beyond_eof(blk, true);
3065 
3066     /* Clear the protocol layer and preallocate it if necessary */
3067     ret = blk_truncate(blk, 0, PREALLOC_MODE_OFF, errp);
3068     if (ret < 0) {
3069         goto out;
3070     }
3071 
3072     /* Write the header */
3073     QEMU_BUILD_BUG_ON((1 << MIN_CLUSTER_BITS) < sizeof(*header));
3074     header = g_malloc0(cluster_size);
3075     *header = (QCowHeader) {
3076         .magic                      = cpu_to_be32(QCOW_MAGIC),
3077         .version                    = cpu_to_be32(version),
3078         .cluster_bits               = cpu_to_be32(ctz32(cluster_size)),
3079         .size                       = cpu_to_be64(0),
3080         .l1_table_offset            = cpu_to_be64(0),
3081         .l1_size                    = cpu_to_be32(0),
3082         .refcount_table_offset      = cpu_to_be64(cluster_size),
3083         .refcount_table_clusters    = cpu_to_be32(1),
3084         .refcount_order             = cpu_to_be32(refcount_order),
3085         .header_length              = cpu_to_be32(sizeof(*header)),
3086     };
3087 
3088     /* We'll update this to correct value later */
3089     header->crypt_method = cpu_to_be32(QCOW_CRYPT_NONE);
3090 
3091     if (qcow2_opts->lazy_refcounts) {
3092         header->compatible_features |=
3093             cpu_to_be64(QCOW2_COMPAT_LAZY_REFCOUNTS);
3094     }
3095     if (data_bs) {
3096         header->incompatible_features |=
3097             cpu_to_be64(QCOW2_INCOMPAT_DATA_FILE);
3098     }
3099     if (qcow2_opts->data_file_raw) {
3100         header->autoclear_features |=
3101             cpu_to_be64(QCOW2_AUTOCLEAR_DATA_FILE_RAW);
3102     }
3103 
3104     ret = blk_pwrite(blk, 0, header, cluster_size, 0);
3105     g_free(header);
3106     if (ret < 0) {
3107         error_setg_errno(errp, -ret, "Could not write qcow2 header");
3108         goto out;
3109     }
3110 
3111     /* Write a refcount table with one refcount block */
3112     refcount_table = g_malloc0(2 * cluster_size);
3113     refcount_table[0] = cpu_to_be64(2 * cluster_size);
3114     ret = blk_pwrite(blk, cluster_size, refcount_table, 2 * cluster_size, 0);
3115     g_free(refcount_table);
3116 
3117     if (ret < 0) {
3118         error_setg_errno(errp, -ret, "Could not write refcount table");
3119         goto out;
3120     }
3121 
3122     blk_unref(blk);
3123     blk = NULL;
3124 
3125     /*
3126      * And now open the image and make it consistent first (i.e. increase the
3127      * refcount of the cluster that is occupied by the header and the refcount
3128      * table)
3129      */
3130     options = qdict_new();
3131     qdict_put_str(options, "driver", "qcow2");
3132     qdict_put_str(options, "file", bs->node_name);
3133     if (data_bs) {
3134         qdict_put_str(options, "data-file", data_bs->node_name);
3135     }
3136     blk = blk_new_open(NULL, NULL, options,
3137                        BDRV_O_RDWR | BDRV_O_RESIZE | BDRV_O_NO_FLUSH,
3138                        &local_err);
3139     if (blk == NULL) {
3140         error_propagate(errp, local_err);
3141         ret = -EIO;
3142         goto out;
3143     }
3144 
3145     ret = qcow2_alloc_clusters(blk_bs(blk), 3 * cluster_size);
3146     if (ret < 0) {
3147         error_setg_errno(errp, -ret, "Could not allocate clusters for qcow2 "
3148                          "header and refcount table");
3149         goto out;
3150 
3151     } else if (ret != 0) {
3152         error_report("Huh, first cluster in empty image is already in use?");
3153         abort();
3154     }
3155 
3156     /* Set the external data file if necessary */
3157     if (data_bs) {
3158         BDRVQcow2State *s = blk_bs(blk)->opaque;
3159         s->image_data_file = g_strdup(data_bs->filename);
3160     }
3161 
3162     /* Create a full header (including things like feature table) */
3163     ret = qcow2_update_header(blk_bs(blk));
3164     if (ret < 0) {
3165         error_setg_errno(errp, -ret, "Could not update qcow2 header");
3166         goto out;
3167     }
3168 
3169     /* Okay, now that we have a valid image, let's give it the right size */
3170     ret = blk_truncate(blk, qcow2_opts->size, qcow2_opts->preallocation, errp);
3171     if (ret < 0) {
3172         error_prepend(errp, "Could not resize image: ");
3173         goto out;
3174     }
3175 
3176     /* Want a backing file? There you go.*/
3177     if (qcow2_opts->has_backing_file) {
3178         const char *backing_format = NULL;
3179 
3180         if (qcow2_opts->has_backing_fmt) {
3181             backing_format = BlockdevDriver_str(qcow2_opts->backing_fmt);
3182         }
3183 
3184         ret = bdrv_change_backing_file(blk_bs(blk), qcow2_opts->backing_file,
3185                                        backing_format);
3186         if (ret < 0) {
3187             error_setg_errno(errp, -ret, "Could not assign backing file '%s' "
3188                              "with format '%s'", qcow2_opts->backing_file,
3189                              backing_format);
3190             goto out;
3191         }
3192     }
3193 
3194     /* Want encryption? There you go. */
3195     if (qcow2_opts->has_encrypt) {
3196         ret = qcow2_set_up_encryption(blk_bs(blk), qcow2_opts->encrypt, errp);
3197         if (ret < 0) {
3198             goto out;
3199         }
3200     }
3201 
3202     blk_unref(blk);
3203     blk = NULL;
3204 
3205     /* Reopen the image without BDRV_O_NO_FLUSH to flush it before returning.
3206      * Using BDRV_O_NO_IO, since encryption is now setup we don't want to
3207      * have to setup decryption context. We're not doing any I/O on the top
3208      * level BlockDriverState, only lower layers, where BDRV_O_NO_IO does
3209      * not have effect.
3210      */
3211     options = qdict_new();
3212     qdict_put_str(options, "driver", "qcow2");
3213     qdict_put_str(options, "file", bs->node_name);
3214     if (data_bs) {
3215         qdict_put_str(options, "data-file", data_bs->node_name);
3216     }
3217     blk = blk_new_open(NULL, NULL, options,
3218                        BDRV_O_RDWR | BDRV_O_NO_BACKING | BDRV_O_NO_IO,
3219                        &local_err);
3220     if (blk == NULL) {
3221         error_propagate(errp, local_err);
3222         ret = -EIO;
3223         goto out;
3224     }
3225 
3226     ret = 0;
3227 out:
3228     blk_unref(blk);
3229     bdrv_unref(bs);
3230     bdrv_unref(data_bs);
3231     return ret;
3232 }
3233 
3234 static int coroutine_fn qcow2_co_create_opts(const char *filename, QemuOpts *opts,
3235                                              Error **errp)
3236 {
3237     BlockdevCreateOptions *create_options = NULL;
3238     QDict *qdict;
3239     Visitor *v;
3240     BlockDriverState *bs = NULL;
3241     BlockDriverState *data_bs = NULL;
3242     Error *local_err = NULL;
3243     const char *val;
3244     int ret;
3245 
3246     /* Only the keyval visitor supports the dotted syntax needed for
3247      * encryption, so go through a QDict before getting a QAPI type. Ignore
3248      * options meant for the protocol layer so that the visitor doesn't
3249      * complain. */
3250     qdict = qemu_opts_to_qdict_filtered(opts, NULL, bdrv_qcow2.create_opts,
3251                                         true);
3252 
3253     /* Handle encryption options */
3254     val = qdict_get_try_str(qdict, BLOCK_OPT_ENCRYPT);
3255     if (val && !strcmp(val, "on")) {
3256         qdict_put_str(qdict, BLOCK_OPT_ENCRYPT, "qcow");
3257     } else if (val && !strcmp(val, "off")) {
3258         qdict_del(qdict, BLOCK_OPT_ENCRYPT);
3259     }
3260 
3261     val = qdict_get_try_str(qdict, BLOCK_OPT_ENCRYPT_FORMAT);
3262     if (val && !strcmp(val, "aes")) {
3263         qdict_put_str(qdict, BLOCK_OPT_ENCRYPT_FORMAT, "qcow");
3264     }
3265 
3266     /* Convert compat=0.10/1.1 into compat=v2/v3, to be renamed into
3267      * version=v2/v3 below. */
3268     val = qdict_get_try_str(qdict, BLOCK_OPT_COMPAT_LEVEL);
3269     if (val && !strcmp(val, "0.10")) {
3270         qdict_put_str(qdict, BLOCK_OPT_COMPAT_LEVEL, "v2");
3271     } else if (val && !strcmp(val, "1.1")) {
3272         qdict_put_str(qdict, BLOCK_OPT_COMPAT_LEVEL, "v3");
3273     }
3274 
3275     /* Change legacy command line options into QMP ones */
3276     static const QDictRenames opt_renames[] = {
3277         { BLOCK_OPT_BACKING_FILE,       "backing-file" },
3278         { BLOCK_OPT_BACKING_FMT,        "backing-fmt" },
3279         { BLOCK_OPT_CLUSTER_SIZE,       "cluster-size" },
3280         { BLOCK_OPT_LAZY_REFCOUNTS,     "lazy-refcounts" },
3281         { BLOCK_OPT_REFCOUNT_BITS,      "refcount-bits" },
3282         { BLOCK_OPT_ENCRYPT,            BLOCK_OPT_ENCRYPT_FORMAT },
3283         { BLOCK_OPT_COMPAT_LEVEL,       "version" },
3284         { BLOCK_OPT_DATA_FILE_RAW,      "data-file-raw" },
3285         { NULL, NULL },
3286     };
3287 
3288     if (!qdict_rename_keys(qdict, opt_renames, errp)) {
3289         ret = -EINVAL;
3290         goto finish;
3291     }
3292 
3293     /* Create and open the file (protocol layer) */
3294     ret = bdrv_create_file(filename, opts, errp);
3295     if (ret < 0) {
3296         goto finish;
3297     }
3298 
3299     bs = bdrv_open(filename, NULL, NULL,
3300                    BDRV_O_RDWR | BDRV_O_RESIZE | BDRV_O_PROTOCOL, errp);
3301     if (bs == NULL) {
3302         ret = -EIO;
3303         goto finish;
3304     }
3305 
3306     /* Create and open an external data file (protocol layer) */
3307     val = qdict_get_try_str(qdict, BLOCK_OPT_DATA_FILE);
3308     if (val) {
3309         ret = bdrv_create_file(val, opts, errp);
3310         if (ret < 0) {
3311             goto finish;
3312         }
3313 
3314         data_bs = bdrv_open(val, NULL, NULL,
3315                             BDRV_O_RDWR | BDRV_O_RESIZE | BDRV_O_PROTOCOL,
3316                             errp);
3317         if (data_bs == NULL) {
3318             ret = -EIO;
3319             goto finish;
3320         }
3321 
3322         qdict_del(qdict, BLOCK_OPT_DATA_FILE);
3323         qdict_put_str(qdict, "data-file", data_bs->node_name);
3324     }
3325 
3326     /* Set 'driver' and 'node' options */
3327     qdict_put_str(qdict, "driver", "qcow2");
3328     qdict_put_str(qdict, "file", bs->node_name);
3329 
3330     /* Now get the QAPI type BlockdevCreateOptions */
3331     v = qobject_input_visitor_new_flat_confused(qdict, errp);
3332     if (!v) {
3333         ret = -EINVAL;
3334         goto finish;
3335     }
3336 
3337     visit_type_BlockdevCreateOptions(v, NULL, &create_options, &local_err);
3338     visit_free(v);
3339 
3340     if (local_err) {
3341         error_propagate(errp, local_err);
3342         ret = -EINVAL;
3343         goto finish;
3344     }
3345 
3346     /* Silently round up size */
3347     create_options->u.qcow2.size = ROUND_UP(create_options->u.qcow2.size,
3348                                             BDRV_SECTOR_SIZE);
3349 
3350     /* Create the qcow2 image (format layer) */
3351     ret = qcow2_co_create(create_options, errp);
3352     if (ret < 0) {
3353         goto finish;
3354     }
3355 
3356     ret = 0;
3357 finish:
3358     qobject_unref(qdict);
3359     bdrv_unref(bs);
3360     bdrv_unref(data_bs);
3361     qapi_free_BlockdevCreateOptions(create_options);
3362     return ret;
3363 }
3364 
3365 
3366 static bool is_zero(BlockDriverState *bs, int64_t offset, int64_t bytes)
3367 {
3368     int64_t nr;
3369     int res;
3370 
3371     /* Clamp to image length, before checking status of underlying sectors */
3372     if (offset + bytes > bs->total_sectors * BDRV_SECTOR_SIZE) {
3373         bytes = bs->total_sectors * BDRV_SECTOR_SIZE - offset;
3374     }
3375 
3376     if (!bytes) {
3377         return true;
3378     }
3379     res = bdrv_block_status_above(bs, NULL, offset, bytes, &nr, NULL, NULL);
3380     return res >= 0 && (res & BDRV_BLOCK_ZERO) && nr == bytes;
3381 }
3382 
3383 static coroutine_fn int qcow2_co_pwrite_zeroes(BlockDriverState *bs,
3384     int64_t offset, int bytes, BdrvRequestFlags flags)
3385 {
3386     int ret;
3387     BDRVQcow2State *s = bs->opaque;
3388 
3389     uint32_t head = offset % s->cluster_size;
3390     uint32_t tail = (offset + bytes) % s->cluster_size;
3391 
3392     trace_qcow2_pwrite_zeroes_start_req(qemu_coroutine_self(), offset, bytes);
3393     if (offset + bytes == bs->total_sectors * BDRV_SECTOR_SIZE) {
3394         tail = 0;
3395     }
3396 
3397     if (head || tail) {
3398         uint64_t off;
3399         unsigned int nr;
3400 
3401         assert(head + bytes <= s->cluster_size);
3402 
3403         /* check whether remainder of cluster already reads as zero */
3404         if (!(is_zero(bs, offset - head, head) &&
3405               is_zero(bs, offset + bytes,
3406                       tail ? s->cluster_size - tail : 0))) {
3407             return -ENOTSUP;
3408         }
3409 
3410         qemu_co_mutex_lock(&s->lock);
3411         /* We can have new write after previous check */
3412         offset = QEMU_ALIGN_DOWN(offset, s->cluster_size);
3413         bytes = s->cluster_size;
3414         nr = s->cluster_size;
3415         ret = qcow2_get_cluster_offset(bs, offset, &nr, &off);
3416         if (ret != QCOW2_CLUSTER_UNALLOCATED &&
3417             ret != QCOW2_CLUSTER_ZERO_PLAIN &&
3418             ret != QCOW2_CLUSTER_ZERO_ALLOC) {
3419             qemu_co_mutex_unlock(&s->lock);
3420             return -ENOTSUP;
3421         }
3422     } else {
3423         qemu_co_mutex_lock(&s->lock);
3424     }
3425 
3426     trace_qcow2_pwrite_zeroes(qemu_coroutine_self(), offset, bytes);
3427 
3428     /* Whatever is left can use real zero clusters */
3429     ret = qcow2_cluster_zeroize(bs, offset, bytes, flags);
3430     qemu_co_mutex_unlock(&s->lock);
3431 
3432     return ret;
3433 }
3434 
3435 static coroutine_fn int qcow2_co_pdiscard(BlockDriverState *bs,
3436                                           int64_t offset, int bytes)
3437 {
3438     int ret;
3439     BDRVQcow2State *s = bs->opaque;
3440 
3441     if (!QEMU_IS_ALIGNED(offset | bytes, s->cluster_size)) {
3442         assert(bytes < s->cluster_size);
3443         /* Ignore partial clusters, except for the special case of the
3444          * complete partial cluster at the end of an unaligned file */
3445         if (!QEMU_IS_ALIGNED(offset, s->cluster_size) ||
3446             offset + bytes != bs->total_sectors * BDRV_SECTOR_SIZE) {
3447             return -ENOTSUP;
3448         }
3449     }
3450 
3451     qemu_co_mutex_lock(&s->lock);
3452     ret = qcow2_cluster_discard(bs, offset, bytes, QCOW2_DISCARD_REQUEST,
3453                                 false);
3454     qemu_co_mutex_unlock(&s->lock);
3455     return ret;
3456 }
3457 
3458 static int coroutine_fn
3459 qcow2_co_copy_range_from(BlockDriverState *bs,
3460                          BdrvChild *src, uint64_t src_offset,
3461                          BdrvChild *dst, uint64_t dst_offset,
3462                          uint64_t bytes, BdrvRequestFlags read_flags,
3463                          BdrvRequestFlags write_flags)
3464 {
3465     BDRVQcow2State *s = bs->opaque;
3466     int ret;
3467     unsigned int cur_bytes; /* number of bytes in current iteration */
3468     BdrvChild *child = NULL;
3469     BdrvRequestFlags cur_write_flags;
3470 
3471     assert(!bs->encrypted);
3472     qemu_co_mutex_lock(&s->lock);
3473 
3474     while (bytes != 0) {
3475         uint64_t copy_offset = 0;
3476         /* prepare next request */
3477         cur_bytes = MIN(bytes, INT_MAX);
3478         cur_write_flags = write_flags;
3479 
3480         ret = qcow2_get_cluster_offset(bs, src_offset, &cur_bytes, &copy_offset);
3481         if (ret < 0) {
3482             goto out;
3483         }
3484 
3485         switch (ret) {
3486         case QCOW2_CLUSTER_UNALLOCATED:
3487             if (bs->backing && bs->backing->bs) {
3488                 int64_t backing_length = bdrv_getlength(bs->backing->bs);
3489                 if (src_offset >= backing_length) {
3490                     cur_write_flags |= BDRV_REQ_ZERO_WRITE;
3491                 } else {
3492                     child = bs->backing;
3493                     cur_bytes = MIN(cur_bytes, backing_length - src_offset);
3494                     copy_offset = src_offset;
3495                 }
3496             } else {
3497                 cur_write_flags |= BDRV_REQ_ZERO_WRITE;
3498             }
3499             break;
3500 
3501         case QCOW2_CLUSTER_ZERO_PLAIN:
3502         case QCOW2_CLUSTER_ZERO_ALLOC:
3503             cur_write_flags |= BDRV_REQ_ZERO_WRITE;
3504             break;
3505 
3506         case QCOW2_CLUSTER_COMPRESSED:
3507             ret = -ENOTSUP;
3508             goto out;
3509 
3510         case QCOW2_CLUSTER_NORMAL:
3511             child = s->data_file;
3512             copy_offset += offset_into_cluster(s, src_offset);
3513             if ((copy_offset & 511) != 0) {
3514                 ret = -EIO;
3515                 goto out;
3516             }
3517             break;
3518 
3519         default:
3520             abort();
3521         }
3522         qemu_co_mutex_unlock(&s->lock);
3523         ret = bdrv_co_copy_range_from(child,
3524                                       copy_offset,
3525                                       dst, dst_offset,
3526                                       cur_bytes, read_flags, cur_write_flags);
3527         qemu_co_mutex_lock(&s->lock);
3528         if (ret < 0) {
3529             goto out;
3530         }
3531 
3532         bytes -= cur_bytes;
3533         src_offset += cur_bytes;
3534         dst_offset += cur_bytes;
3535     }
3536     ret = 0;
3537 
3538 out:
3539     qemu_co_mutex_unlock(&s->lock);
3540     return ret;
3541 }
3542 
3543 static int coroutine_fn
3544 qcow2_co_copy_range_to(BlockDriverState *bs,
3545                        BdrvChild *src, uint64_t src_offset,
3546                        BdrvChild *dst, uint64_t dst_offset,
3547                        uint64_t bytes, BdrvRequestFlags read_flags,
3548                        BdrvRequestFlags write_flags)
3549 {
3550     BDRVQcow2State *s = bs->opaque;
3551     int offset_in_cluster;
3552     int ret;
3553     unsigned int cur_bytes; /* number of sectors in current iteration */
3554     uint64_t cluster_offset;
3555     QCowL2Meta *l2meta = NULL;
3556 
3557     assert(!bs->encrypted);
3558 
3559     qemu_co_mutex_lock(&s->lock);
3560 
3561     while (bytes != 0) {
3562 
3563         l2meta = NULL;
3564 
3565         offset_in_cluster = offset_into_cluster(s, dst_offset);
3566         cur_bytes = MIN(bytes, INT_MAX);
3567 
3568         /* TODO:
3569          * If src->bs == dst->bs, we could simply copy by incrementing
3570          * the refcnt, without copying user data.
3571          * Or if src->bs == dst->bs->backing->bs, we could copy by discarding. */
3572         ret = qcow2_alloc_cluster_offset(bs, dst_offset, &cur_bytes,
3573                                          &cluster_offset, &l2meta);
3574         if (ret < 0) {
3575             goto fail;
3576         }
3577 
3578         assert((cluster_offset & 511) == 0);
3579 
3580         ret = qcow2_pre_write_overlap_check(bs, 0,
3581                 cluster_offset + offset_in_cluster, cur_bytes, true);
3582         if (ret < 0) {
3583             goto fail;
3584         }
3585 
3586         qemu_co_mutex_unlock(&s->lock);
3587         ret = bdrv_co_copy_range_to(src, src_offset,
3588                                     s->data_file,
3589                                     cluster_offset + offset_in_cluster,
3590                                     cur_bytes, read_flags, write_flags);
3591         qemu_co_mutex_lock(&s->lock);
3592         if (ret < 0) {
3593             goto fail;
3594         }
3595 
3596         ret = qcow2_handle_l2meta(bs, &l2meta, true);
3597         if (ret) {
3598             goto fail;
3599         }
3600 
3601         bytes -= cur_bytes;
3602         src_offset += cur_bytes;
3603         dst_offset += cur_bytes;
3604     }
3605     ret = 0;
3606 
3607 fail:
3608     qcow2_handle_l2meta(bs, &l2meta, false);
3609 
3610     qemu_co_mutex_unlock(&s->lock);
3611 
3612     trace_qcow2_writev_done_req(qemu_coroutine_self(), ret);
3613 
3614     return ret;
3615 }
3616 
3617 static int coroutine_fn qcow2_co_truncate(BlockDriverState *bs, int64_t offset,
3618                                           PreallocMode prealloc, Error **errp)
3619 {
3620     BDRVQcow2State *s = bs->opaque;
3621     uint64_t old_length;
3622     int64_t new_l1_size;
3623     int ret;
3624     QDict *options;
3625 
3626     if (prealloc != PREALLOC_MODE_OFF && prealloc != PREALLOC_MODE_METADATA &&
3627         prealloc != PREALLOC_MODE_FALLOC && prealloc != PREALLOC_MODE_FULL)
3628     {
3629         error_setg(errp, "Unsupported preallocation mode '%s'",
3630                    PreallocMode_str(prealloc));
3631         return -ENOTSUP;
3632     }
3633 
3634     if (offset & 511) {
3635         error_setg(errp, "The new size must be a multiple of 512");
3636         return -EINVAL;
3637     }
3638 
3639     qemu_co_mutex_lock(&s->lock);
3640 
3641     /* cannot proceed if image has snapshots */
3642     if (s->nb_snapshots) {
3643         error_setg(errp, "Can't resize an image which has snapshots");
3644         ret = -ENOTSUP;
3645         goto fail;
3646     }
3647 
3648     /* cannot proceed if image has bitmaps */
3649     if (s->nb_bitmaps) {
3650         /* TODO: resize bitmaps in the image */
3651         error_setg(errp, "Can't resize an image which has bitmaps");
3652         ret = -ENOTSUP;
3653         goto fail;
3654     }
3655 
3656     old_length = bs->total_sectors * BDRV_SECTOR_SIZE;
3657     new_l1_size = size_to_l1(s, offset);
3658 
3659     if (offset < old_length) {
3660         int64_t last_cluster, old_file_size;
3661         if (prealloc != PREALLOC_MODE_OFF) {
3662             error_setg(errp,
3663                        "Preallocation can't be used for shrinking an image");
3664             ret = -EINVAL;
3665             goto fail;
3666         }
3667 
3668         ret = qcow2_cluster_discard(bs, ROUND_UP(offset, s->cluster_size),
3669                                     old_length - ROUND_UP(offset,
3670                                                           s->cluster_size),
3671                                     QCOW2_DISCARD_ALWAYS, true);
3672         if (ret < 0) {
3673             error_setg_errno(errp, -ret, "Failed to discard cropped clusters");
3674             goto fail;
3675         }
3676 
3677         ret = qcow2_shrink_l1_table(bs, new_l1_size);
3678         if (ret < 0) {
3679             error_setg_errno(errp, -ret,
3680                              "Failed to reduce the number of L2 tables");
3681             goto fail;
3682         }
3683 
3684         ret = qcow2_shrink_reftable(bs);
3685         if (ret < 0) {
3686             error_setg_errno(errp, -ret,
3687                              "Failed to discard unused refblocks");
3688             goto fail;
3689         }
3690 
3691         old_file_size = bdrv_getlength(bs->file->bs);
3692         if (old_file_size < 0) {
3693             error_setg_errno(errp, -old_file_size,
3694                              "Failed to inquire current file length");
3695             ret = old_file_size;
3696             goto fail;
3697         }
3698         last_cluster = qcow2_get_last_cluster(bs, old_file_size);
3699         if (last_cluster < 0) {
3700             error_setg_errno(errp, -last_cluster,
3701                              "Failed to find the last cluster");
3702             ret = last_cluster;
3703             goto fail;
3704         }
3705         if ((last_cluster + 1) * s->cluster_size < old_file_size) {
3706             Error *local_err = NULL;
3707 
3708             bdrv_co_truncate(bs->file, (last_cluster + 1) * s->cluster_size,
3709                              PREALLOC_MODE_OFF, &local_err);
3710             if (local_err) {
3711                 warn_reportf_err(local_err,
3712                                  "Failed to truncate the tail of the image: ");
3713             }
3714         }
3715     } else {
3716         ret = qcow2_grow_l1_table(bs, new_l1_size, true);
3717         if (ret < 0) {
3718             error_setg_errno(errp, -ret, "Failed to grow the L1 table");
3719             goto fail;
3720         }
3721     }
3722 
3723     switch (prealloc) {
3724     case PREALLOC_MODE_OFF:
3725         break;
3726 
3727     case PREALLOC_MODE_METADATA:
3728         ret = preallocate_co(bs, old_length, offset);
3729         if (ret < 0) {
3730             error_setg_errno(errp, -ret, "Preallocation failed");
3731             goto fail;
3732         }
3733         break;
3734 
3735     case PREALLOC_MODE_FALLOC:
3736     case PREALLOC_MODE_FULL:
3737     {
3738         int64_t allocation_start, host_offset, guest_offset;
3739         int64_t clusters_allocated;
3740         int64_t old_file_size, new_file_size;
3741         uint64_t nb_new_data_clusters, nb_new_l2_tables;
3742 
3743         /* With a data file, preallocation means just allocating the metadata
3744          * and forwarding the truncate request to the data file */
3745         if (has_data_file(bs)) {
3746             ret = preallocate_co(bs, old_length, offset);
3747             if (ret < 0) {
3748                 error_setg_errno(errp, -ret, "Preallocation failed");
3749                 goto fail;
3750             }
3751             break;
3752         }
3753 
3754         old_file_size = bdrv_getlength(bs->file->bs);
3755         if (old_file_size < 0) {
3756             error_setg_errno(errp, -old_file_size,
3757                              "Failed to inquire current file length");
3758             ret = old_file_size;
3759             goto fail;
3760         }
3761         old_file_size = ROUND_UP(old_file_size, s->cluster_size);
3762 
3763         nb_new_data_clusters = DIV_ROUND_UP(offset - old_length,
3764                                             s->cluster_size);
3765 
3766         /* This is an overestimation; we will not actually allocate space for
3767          * these in the file but just make sure the new refcount structures are
3768          * able to cover them so we will not have to allocate new refblocks
3769          * while entering the data blocks in the potentially new L2 tables.
3770          * (We do not actually care where the L2 tables are placed. Maybe they
3771          *  are already allocated or they can be placed somewhere before
3772          *  @old_file_size. It does not matter because they will be fully
3773          *  allocated automatically, so they do not need to be covered by the
3774          *  preallocation. All that matters is that we will not have to allocate
3775          *  new refcount structures for them.) */
3776         nb_new_l2_tables = DIV_ROUND_UP(nb_new_data_clusters,
3777                                         s->cluster_size / sizeof(uint64_t));
3778         /* The cluster range may not be aligned to L2 boundaries, so add one L2
3779          * table for a potential head/tail */
3780         nb_new_l2_tables++;
3781 
3782         allocation_start = qcow2_refcount_area(bs, old_file_size,
3783                                                nb_new_data_clusters +
3784                                                nb_new_l2_tables,
3785                                                true, 0, 0);
3786         if (allocation_start < 0) {
3787             error_setg_errno(errp, -allocation_start,
3788                              "Failed to resize refcount structures");
3789             ret = allocation_start;
3790             goto fail;
3791         }
3792 
3793         clusters_allocated = qcow2_alloc_clusters_at(bs, allocation_start,
3794                                                      nb_new_data_clusters);
3795         if (clusters_allocated < 0) {
3796             error_setg_errno(errp, -clusters_allocated,
3797                              "Failed to allocate data clusters");
3798             ret = clusters_allocated;
3799             goto fail;
3800         }
3801 
3802         assert(clusters_allocated == nb_new_data_clusters);
3803 
3804         /* Allocate the data area */
3805         new_file_size = allocation_start +
3806                         nb_new_data_clusters * s->cluster_size;
3807         ret = bdrv_co_truncate(bs->file, new_file_size, prealloc, errp);
3808         if (ret < 0) {
3809             error_prepend(errp, "Failed to resize underlying file: ");
3810             qcow2_free_clusters(bs, allocation_start,
3811                                 nb_new_data_clusters * s->cluster_size,
3812                                 QCOW2_DISCARD_OTHER);
3813             goto fail;
3814         }
3815 
3816         /* Create the necessary L2 entries */
3817         host_offset = allocation_start;
3818         guest_offset = old_length;
3819         while (nb_new_data_clusters) {
3820             int64_t nb_clusters = MIN(
3821                 nb_new_data_clusters,
3822                 s->l2_slice_size - offset_to_l2_slice_index(s, guest_offset));
3823             QCowL2Meta allocation = {
3824                 .offset       = guest_offset,
3825                 .alloc_offset = host_offset,
3826                 .nb_clusters  = nb_clusters,
3827             };
3828             qemu_co_queue_init(&allocation.dependent_requests);
3829 
3830             ret = qcow2_alloc_cluster_link_l2(bs, &allocation);
3831             if (ret < 0) {
3832                 error_setg_errno(errp, -ret, "Failed to update L2 tables");
3833                 qcow2_free_clusters(bs, host_offset,
3834                                     nb_new_data_clusters * s->cluster_size,
3835                                     QCOW2_DISCARD_OTHER);
3836                 goto fail;
3837             }
3838 
3839             guest_offset += nb_clusters * s->cluster_size;
3840             host_offset += nb_clusters * s->cluster_size;
3841             nb_new_data_clusters -= nb_clusters;
3842         }
3843         break;
3844     }
3845 
3846     default:
3847         g_assert_not_reached();
3848     }
3849 
3850     if (prealloc != PREALLOC_MODE_OFF) {
3851         /* Flush metadata before actually changing the image size */
3852         ret = qcow2_write_caches(bs);
3853         if (ret < 0) {
3854             error_setg_errno(errp, -ret,
3855                              "Failed to flush the preallocated area to disk");
3856             goto fail;
3857         }
3858     }
3859 
3860     bs->total_sectors = offset / BDRV_SECTOR_SIZE;
3861 
3862     if (has_data_file(bs)) {
3863         if (prealloc == PREALLOC_MODE_METADATA) {
3864             prealloc = PREALLOC_MODE_OFF;
3865         }
3866         ret = bdrv_co_truncate(s->data_file, offset, prealloc, errp);
3867         if (ret < 0) {
3868             goto fail;
3869         }
3870     }
3871 
3872     /* write updated header.size */
3873     offset = cpu_to_be64(offset);
3874     ret = bdrv_pwrite_sync(bs->file, offsetof(QCowHeader, size),
3875                            &offset, sizeof(uint64_t));
3876     if (ret < 0) {
3877         error_setg_errno(errp, -ret, "Failed to update the image size");
3878         goto fail;
3879     }
3880 
3881     s->l1_vm_state_index = new_l1_size;
3882 
3883     /* Update cache sizes */
3884     options = qdict_clone_shallow(bs->options);
3885     ret = qcow2_update_options(bs, options, s->flags, errp);
3886     qobject_unref(options);
3887     if (ret < 0) {
3888         goto fail;
3889     }
3890     ret = 0;
3891 fail:
3892     qemu_co_mutex_unlock(&s->lock);
3893     return ret;
3894 }
3895 
3896 /*
3897  * qcow2_compress()
3898  *
3899  * @dest - destination buffer, @dest_size bytes
3900  * @src - source buffer, @src_size bytes
3901  *
3902  * Returns: compressed size on success
3903  *          -1 destination buffer is not enough to store compressed data
3904  *          -2 on any other error
3905  */
3906 static ssize_t qcow2_compress(void *dest, size_t dest_size,
3907                               const void *src, size_t src_size)
3908 {
3909     ssize_t ret;
3910     z_stream strm;
3911 
3912     /* best compression, small window, no zlib header */
3913     memset(&strm, 0, sizeof(strm));
3914     ret = deflateInit2(&strm, Z_DEFAULT_COMPRESSION, Z_DEFLATED,
3915                        -12, 9, Z_DEFAULT_STRATEGY);
3916     if (ret != Z_OK) {
3917         return -2;
3918     }
3919 
3920     /* strm.next_in is not const in old zlib versions, such as those used on
3921      * OpenBSD/NetBSD, so cast the const away */
3922     strm.avail_in = src_size;
3923     strm.next_in = (void *) src;
3924     strm.avail_out = dest_size;
3925     strm.next_out = dest;
3926 
3927     ret = deflate(&strm, Z_FINISH);
3928     if (ret == Z_STREAM_END) {
3929         ret = dest_size - strm.avail_out;
3930     } else {
3931         ret = (ret == Z_OK ? -1 : -2);
3932     }
3933 
3934     deflateEnd(&strm);
3935 
3936     return ret;
3937 }
3938 
3939 /*
3940  * qcow2_decompress()
3941  *
3942  * Decompress some data (not more than @src_size bytes) to produce exactly
3943  * @dest_size bytes.
3944  *
3945  * @dest - destination buffer, @dest_size bytes
3946  * @src - source buffer, @src_size bytes
3947  *
3948  * Returns: 0 on success
3949  *          -1 on fail
3950  */
3951 static ssize_t qcow2_decompress(void *dest, size_t dest_size,
3952                                 const void *src, size_t src_size)
3953 {
3954     int ret = 0;
3955     z_stream strm;
3956 
3957     memset(&strm, 0, sizeof(strm));
3958     strm.avail_in = src_size;
3959     strm.next_in = (void *) src;
3960     strm.avail_out = dest_size;
3961     strm.next_out = dest;
3962 
3963     ret = inflateInit2(&strm, -12);
3964     if (ret != Z_OK) {
3965         return -1;
3966     }
3967 
3968     ret = inflate(&strm, Z_FINISH);
3969     if ((ret != Z_STREAM_END && ret != Z_BUF_ERROR) || strm.avail_out != 0) {
3970         /* We approve Z_BUF_ERROR because we need @dest buffer to be filled, but
3971          * @src buffer may be processed partly (because in qcow2 we know size of
3972          * compressed data with precision of one sector) */
3973         ret = -1;
3974     }
3975 
3976     inflateEnd(&strm);
3977 
3978     return ret;
3979 }
3980 
3981 #define MAX_COMPRESS_THREADS 4
3982 
3983 typedef ssize_t (*Qcow2CompressFunc)(void *dest, size_t dest_size,
3984                                      const void *src, size_t src_size);
3985 typedef struct Qcow2CompressData {
3986     void *dest;
3987     size_t dest_size;
3988     const void *src;
3989     size_t src_size;
3990     ssize_t ret;
3991 
3992     Qcow2CompressFunc func;
3993 } Qcow2CompressData;
3994 
3995 static int qcow2_compress_pool_func(void *opaque)
3996 {
3997     Qcow2CompressData *data = opaque;
3998 
3999     data->ret = data->func(data->dest, data->dest_size,
4000                            data->src, data->src_size);
4001 
4002     return 0;
4003 }
4004 
4005 static void qcow2_compress_complete(void *opaque, int ret)
4006 {
4007     qemu_coroutine_enter(opaque);
4008 }
4009 
4010 static ssize_t coroutine_fn
4011 qcow2_co_do_compress(BlockDriverState *bs, void *dest, size_t dest_size,
4012                      const void *src, size_t src_size, Qcow2CompressFunc func)
4013 {
4014     BDRVQcow2State *s = bs->opaque;
4015     BlockAIOCB *acb;
4016     ThreadPool *pool = aio_get_thread_pool(bdrv_get_aio_context(bs));
4017     Qcow2CompressData arg = {
4018         .dest = dest,
4019         .dest_size = dest_size,
4020         .src = src,
4021         .src_size = src_size,
4022         .func = func,
4023     };
4024 
4025     while (s->nb_compress_threads >= MAX_COMPRESS_THREADS) {
4026         qemu_co_queue_wait(&s->compress_wait_queue, NULL);
4027     }
4028 
4029     s->nb_compress_threads++;
4030     acb = thread_pool_submit_aio(pool, qcow2_compress_pool_func, &arg,
4031                                  qcow2_compress_complete,
4032                                  qemu_coroutine_self());
4033 
4034     if (!acb) {
4035         s->nb_compress_threads--;
4036         return -EINVAL;
4037     }
4038     qemu_coroutine_yield();
4039     s->nb_compress_threads--;
4040     qemu_co_queue_next(&s->compress_wait_queue);
4041 
4042     return arg.ret;
4043 }
4044 
4045 static ssize_t coroutine_fn
4046 qcow2_co_compress(BlockDriverState *bs, void *dest, size_t dest_size,
4047                   const void *src, size_t src_size)
4048 {
4049     return qcow2_co_do_compress(bs, dest, dest_size, src, src_size,
4050                                 qcow2_compress);
4051 }
4052 
4053 static ssize_t coroutine_fn
4054 qcow2_co_decompress(BlockDriverState *bs, void *dest, size_t dest_size,
4055                     const void *src, size_t src_size)
4056 {
4057     return qcow2_co_do_compress(bs, dest, dest_size, src, src_size,
4058                                 qcow2_decompress);
4059 }
4060 
4061 /* XXX: put compressed sectors first, then all the cluster aligned
4062    tables to avoid losing bytes in alignment */
4063 static coroutine_fn int
4064 qcow2_co_pwritev_compressed(BlockDriverState *bs, uint64_t offset,
4065                             uint64_t bytes, QEMUIOVector *qiov)
4066 {
4067     BDRVQcow2State *s = bs->opaque;
4068     QEMUIOVector hd_qiov;
4069     int ret;
4070     size_t out_len;
4071     uint8_t *buf, *out_buf;
4072     uint64_t cluster_offset;
4073 
4074     if (has_data_file(bs)) {
4075         return -ENOTSUP;
4076     }
4077 
4078     if (bytes == 0) {
4079         /* align end of file to a sector boundary to ease reading with
4080            sector based I/Os */
4081         int64_t len = bdrv_getlength(bs->file->bs);
4082         if (len < 0) {
4083             return len;
4084         }
4085         return bdrv_co_truncate(bs->file, len, PREALLOC_MODE_OFF, NULL);
4086     }
4087 
4088     if (offset_into_cluster(s, offset)) {
4089         return -EINVAL;
4090     }
4091 
4092     buf = qemu_blockalign(bs, s->cluster_size);
4093     if (bytes != s->cluster_size) {
4094         if (bytes > s->cluster_size ||
4095             offset + bytes != bs->total_sectors << BDRV_SECTOR_BITS)
4096         {
4097             qemu_vfree(buf);
4098             return -EINVAL;
4099         }
4100         /* Zero-pad last write if image size is not cluster aligned */
4101         memset(buf + bytes, 0, s->cluster_size - bytes);
4102     }
4103     qemu_iovec_to_buf(qiov, 0, buf, bytes);
4104 
4105     out_buf = g_malloc(s->cluster_size);
4106 
4107     out_len = qcow2_co_compress(bs, out_buf, s->cluster_size - 1,
4108                                 buf, s->cluster_size);
4109     if (out_len == -2) {
4110         ret = -EINVAL;
4111         goto fail;
4112     } else if (out_len == -1) {
4113         /* could not compress: write normal cluster */
4114         ret = qcow2_co_pwritev(bs, offset, bytes, qiov, 0);
4115         if (ret < 0) {
4116             goto fail;
4117         }
4118         goto success;
4119     }
4120 
4121     qemu_co_mutex_lock(&s->lock);
4122     ret = qcow2_alloc_compressed_cluster_offset(bs, offset, out_len,
4123                                                 &cluster_offset);
4124     if (ret < 0) {
4125         qemu_co_mutex_unlock(&s->lock);
4126         goto fail;
4127     }
4128 
4129     ret = qcow2_pre_write_overlap_check(bs, 0, cluster_offset, out_len, true);
4130     qemu_co_mutex_unlock(&s->lock);
4131     if (ret < 0) {
4132         goto fail;
4133     }
4134 
4135     qemu_iovec_init_buf(&hd_qiov, out_buf, out_len);
4136 
4137     BLKDBG_EVENT(s->data_file, BLKDBG_WRITE_COMPRESSED);
4138     ret = bdrv_co_pwritev(s->data_file, cluster_offset, out_len, &hd_qiov, 0);
4139     if (ret < 0) {
4140         goto fail;
4141     }
4142 success:
4143     ret = 0;
4144 fail:
4145     qemu_vfree(buf);
4146     g_free(out_buf);
4147     return ret;
4148 }
4149 
4150 static int coroutine_fn
4151 qcow2_co_preadv_compressed(BlockDriverState *bs,
4152                            uint64_t file_cluster_offset,
4153                            uint64_t offset,
4154                            uint64_t bytes,
4155                            QEMUIOVector *qiov)
4156 {
4157     BDRVQcow2State *s = bs->opaque;
4158     int ret = 0, csize, nb_csectors;
4159     uint64_t coffset;
4160     uint8_t *buf, *out_buf;
4161     QEMUIOVector local_qiov;
4162     int offset_in_cluster = offset_into_cluster(s, offset);
4163 
4164     coffset = file_cluster_offset & s->cluster_offset_mask;
4165     nb_csectors = ((file_cluster_offset >> s->csize_shift) & s->csize_mask) + 1;
4166     csize = nb_csectors * 512 - (coffset & 511);
4167 
4168     buf = g_try_malloc(csize);
4169     if (!buf) {
4170         return -ENOMEM;
4171     }
4172     qemu_iovec_init_buf(&local_qiov, buf, csize);
4173 
4174     out_buf = qemu_blockalign(bs, s->cluster_size);
4175 
4176     BLKDBG_EVENT(bs->file, BLKDBG_READ_COMPRESSED);
4177     ret = bdrv_co_preadv(bs->file, coffset, csize, &local_qiov, 0);
4178     if (ret < 0) {
4179         goto fail;
4180     }
4181 
4182     if (qcow2_co_decompress(bs, out_buf, s->cluster_size, buf, csize) < 0) {
4183         ret = -EIO;
4184         goto fail;
4185     }
4186 
4187     qemu_iovec_from_buf(qiov, 0, out_buf + offset_in_cluster, bytes);
4188 
4189 fail:
4190     qemu_vfree(out_buf);
4191     g_free(buf);
4192 
4193     return ret;
4194 }
4195 
4196 static int make_completely_empty(BlockDriverState *bs)
4197 {
4198     BDRVQcow2State *s = bs->opaque;
4199     Error *local_err = NULL;
4200     int ret, l1_clusters;
4201     int64_t offset;
4202     uint64_t *new_reftable = NULL;
4203     uint64_t rt_entry, l1_size2;
4204     struct {
4205         uint64_t l1_offset;
4206         uint64_t reftable_offset;
4207         uint32_t reftable_clusters;
4208     } QEMU_PACKED l1_ofs_rt_ofs_cls;
4209 
4210     ret = qcow2_cache_empty(bs, s->l2_table_cache);
4211     if (ret < 0) {
4212         goto fail;
4213     }
4214 
4215     ret = qcow2_cache_empty(bs, s->refcount_block_cache);
4216     if (ret < 0) {
4217         goto fail;
4218     }
4219 
4220     /* Refcounts will be broken utterly */
4221     ret = qcow2_mark_dirty(bs);
4222     if (ret < 0) {
4223         goto fail;
4224     }
4225 
4226     BLKDBG_EVENT(bs->file, BLKDBG_L1_UPDATE);
4227 
4228     l1_clusters = DIV_ROUND_UP(s->l1_size, s->cluster_size / sizeof(uint64_t));
4229     l1_size2 = (uint64_t)s->l1_size * sizeof(uint64_t);
4230 
4231     /* After this call, neither the in-memory nor the on-disk refcount
4232      * information accurately describe the actual references */
4233 
4234     ret = bdrv_pwrite_zeroes(bs->file, s->l1_table_offset,
4235                              l1_clusters * s->cluster_size, 0);
4236     if (ret < 0) {
4237         goto fail_broken_refcounts;
4238     }
4239     memset(s->l1_table, 0, l1_size2);
4240 
4241     BLKDBG_EVENT(bs->file, BLKDBG_EMPTY_IMAGE_PREPARE);
4242 
4243     /* Overwrite enough clusters at the beginning of the sectors to place
4244      * the refcount table, a refcount block and the L1 table in; this may
4245      * overwrite parts of the existing refcount and L1 table, which is not
4246      * an issue because the dirty flag is set, complete data loss is in fact
4247      * desired and partial data loss is consequently fine as well */
4248     ret = bdrv_pwrite_zeroes(bs->file, s->cluster_size,
4249                              (2 + l1_clusters) * s->cluster_size, 0);
4250     /* This call (even if it failed overall) may have overwritten on-disk
4251      * refcount structures; in that case, the in-memory refcount information
4252      * will probably differ from the on-disk information which makes the BDS
4253      * unusable */
4254     if (ret < 0) {
4255         goto fail_broken_refcounts;
4256     }
4257 
4258     BLKDBG_EVENT(bs->file, BLKDBG_L1_UPDATE);
4259     BLKDBG_EVENT(bs->file, BLKDBG_REFTABLE_UPDATE);
4260 
4261     /* "Create" an empty reftable (one cluster) directly after the image
4262      * header and an empty L1 table three clusters after the image header;
4263      * the cluster between those two will be used as the first refblock */
4264     l1_ofs_rt_ofs_cls.l1_offset = cpu_to_be64(3 * s->cluster_size);
4265     l1_ofs_rt_ofs_cls.reftable_offset = cpu_to_be64(s->cluster_size);
4266     l1_ofs_rt_ofs_cls.reftable_clusters = cpu_to_be32(1);
4267     ret = bdrv_pwrite_sync(bs->file, offsetof(QCowHeader, l1_table_offset),
4268                            &l1_ofs_rt_ofs_cls, sizeof(l1_ofs_rt_ofs_cls));
4269     if (ret < 0) {
4270         goto fail_broken_refcounts;
4271     }
4272 
4273     s->l1_table_offset = 3 * s->cluster_size;
4274 
4275     new_reftable = g_try_new0(uint64_t, s->cluster_size / sizeof(uint64_t));
4276     if (!new_reftable) {
4277         ret = -ENOMEM;
4278         goto fail_broken_refcounts;
4279     }
4280 
4281     s->refcount_table_offset = s->cluster_size;
4282     s->refcount_table_size   = s->cluster_size / sizeof(uint64_t);
4283     s->max_refcount_table_index = 0;
4284 
4285     g_free(s->refcount_table);
4286     s->refcount_table = new_reftable;
4287     new_reftable = NULL;
4288 
4289     /* Now the in-memory refcount information again corresponds to the on-disk
4290      * information (reftable is empty and no refblocks (the refblock cache is
4291      * empty)); however, this means some clusters (e.g. the image header) are
4292      * referenced, but not refcounted, but the normal qcow2 code assumes that
4293      * the in-memory information is always correct */
4294 
4295     BLKDBG_EVENT(bs->file, BLKDBG_REFBLOCK_ALLOC);
4296 
4297     /* Enter the first refblock into the reftable */
4298     rt_entry = cpu_to_be64(2 * s->cluster_size);
4299     ret = bdrv_pwrite_sync(bs->file, s->cluster_size,
4300                            &rt_entry, sizeof(rt_entry));
4301     if (ret < 0) {
4302         goto fail_broken_refcounts;
4303     }
4304     s->refcount_table[0] = 2 * s->cluster_size;
4305 
4306     s->free_cluster_index = 0;
4307     assert(3 + l1_clusters <= s->refcount_block_size);
4308     offset = qcow2_alloc_clusters(bs, 3 * s->cluster_size + l1_size2);
4309     if (offset < 0) {
4310         ret = offset;
4311         goto fail_broken_refcounts;
4312     } else if (offset > 0) {
4313         error_report("First cluster in emptied image is in use");
4314         abort();
4315     }
4316 
4317     /* Now finally the in-memory information corresponds to the on-disk
4318      * structures and is correct */
4319     ret = qcow2_mark_clean(bs);
4320     if (ret < 0) {
4321         goto fail;
4322     }
4323 
4324     ret = bdrv_truncate(bs->file, (3 + l1_clusters) * s->cluster_size,
4325                         PREALLOC_MODE_OFF, &local_err);
4326     if (ret < 0) {
4327         error_report_err(local_err);
4328         goto fail;
4329     }
4330 
4331     return 0;
4332 
4333 fail_broken_refcounts:
4334     /* The BDS is unusable at this point. If we wanted to make it usable, we
4335      * would have to call qcow2_refcount_close(), qcow2_refcount_init(),
4336      * qcow2_check_refcounts(), qcow2_refcount_close() and qcow2_refcount_init()
4337      * again. However, because the functions which could have caused this error
4338      * path to be taken are used by those functions as well, it's very likely
4339      * that that sequence will fail as well. Therefore, just eject the BDS. */
4340     bs->drv = NULL;
4341 
4342 fail:
4343     g_free(new_reftable);
4344     return ret;
4345 }
4346 
4347 static int qcow2_make_empty(BlockDriverState *bs)
4348 {
4349     BDRVQcow2State *s = bs->opaque;
4350     uint64_t offset, end_offset;
4351     int step = QEMU_ALIGN_DOWN(INT_MAX, s->cluster_size);
4352     int l1_clusters, ret = 0;
4353 
4354     l1_clusters = DIV_ROUND_UP(s->l1_size, s->cluster_size / sizeof(uint64_t));
4355 
4356     if (s->qcow_version >= 3 && !s->snapshots && !s->nb_bitmaps &&
4357         3 + l1_clusters <= s->refcount_block_size &&
4358         s->crypt_method_header != QCOW_CRYPT_LUKS) {
4359         /* The following function only works for qcow2 v3 images (it
4360          * requires the dirty flag) and only as long as there are no
4361          * features that reserve extra clusters (such as snapshots,
4362          * LUKS header, or persistent bitmaps), because it completely
4363          * empties the image.  Furthermore, the L1 table and three
4364          * additional clusters (image header, refcount table, one
4365          * refcount block) have to fit inside one refcount block. */
4366         return make_completely_empty(bs);
4367     }
4368 
4369     /* This fallback code simply discards every active cluster; this is slow,
4370      * but works in all cases */
4371     end_offset = bs->total_sectors * BDRV_SECTOR_SIZE;
4372     for (offset = 0; offset < end_offset; offset += step) {
4373         /* As this function is generally used after committing an external
4374          * snapshot, QCOW2_DISCARD_SNAPSHOT seems appropriate. Also, the
4375          * default action for this kind of discard is to pass the discard,
4376          * which will ideally result in an actually smaller image file, as
4377          * is probably desired. */
4378         ret = qcow2_cluster_discard(bs, offset, MIN(step, end_offset - offset),
4379                                     QCOW2_DISCARD_SNAPSHOT, true);
4380         if (ret < 0) {
4381             break;
4382         }
4383     }
4384 
4385     return ret;
4386 }
4387 
4388 static coroutine_fn int qcow2_co_flush_to_os(BlockDriverState *bs)
4389 {
4390     BDRVQcow2State *s = bs->opaque;
4391     int ret;
4392 
4393     qemu_co_mutex_lock(&s->lock);
4394     ret = qcow2_write_caches(bs);
4395     qemu_co_mutex_unlock(&s->lock);
4396 
4397     return ret;
4398 }
4399 
4400 static ssize_t qcow2_measure_crypto_hdr_init_func(QCryptoBlock *block,
4401         size_t headerlen, void *opaque, Error **errp)
4402 {
4403     size_t *headerlenp = opaque;
4404 
4405     /* Stash away the payload size */
4406     *headerlenp = headerlen;
4407     return 0;
4408 }
4409 
4410 static ssize_t qcow2_measure_crypto_hdr_write_func(QCryptoBlock *block,
4411         size_t offset, const uint8_t *buf, size_t buflen,
4412         void *opaque, Error **errp)
4413 {
4414     /* Discard the bytes, we're not actually writing to an image */
4415     return buflen;
4416 }
4417 
4418 /* Determine the number of bytes for the LUKS payload */
4419 static bool qcow2_measure_luks_headerlen(QemuOpts *opts, size_t *len,
4420                                          Error **errp)
4421 {
4422     QDict *opts_qdict;
4423     QDict *cryptoopts_qdict;
4424     QCryptoBlockCreateOptions *cryptoopts;
4425     QCryptoBlock *crypto;
4426 
4427     /* Extract "encrypt." options into a qdict */
4428     opts_qdict = qemu_opts_to_qdict(opts, NULL);
4429     qdict_extract_subqdict(opts_qdict, &cryptoopts_qdict, "encrypt.");
4430     qobject_unref(opts_qdict);
4431 
4432     /* Build QCryptoBlockCreateOptions object from qdict */
4433     qdict_put_str(cryptoopts_qdict, "format", "luks");
4434     cryptoopts = block_crypto_create_opts_init(cryptoopts_qdict, errp);
4435     qobject_unref(cryptoopts_qdict);
4436     if (!cryptoopts) {
4437         return false;
4438     }
4439 
4440     /* Fake LUKS creation in order to determine the payload size */
4441     crypto = qcrypto_block_create(cryptoopts, "encrypt.",
4442                                   qcow2_measure_crypto_hdr_init_func,
4443                                   qcow2_measure_crypto_hdr_write_func,
4444                                   len, errp);
4445     qapi_free_QCryptoBlockCreateOptions(cryptoopts);
4446     if (!crypto) {
4447         return false;
4448     }
4449 
4450     qcrypto_block_free(crypto);
4451     return true;
4452 }
4453 
4454 static BlockMeasureInfo *qcow2_measure(QemuOpts *opts, BlockDriverState *in_bs,
4455                                        Error **errp)
4456 {
4457     Error *local_err = NULL;
4458     BlockMeasureInfo *info;
4459     uint64_t required = 0; /* bytes that contribute to required size */
4460     uint64_t virtual_size; /* disk size as seen by guest */
4461     uint64_t refcount_bits;
4462     uint64_t l2_tables;
4463     uint64_t luks_payload_size = 0;
4464     size_t cluster_size;
4465     int version;
4466     char *optstr;
4467     PreallocMode prealloc;
4468     bool has_backing_file;
4469     bool has_luks;
4470 
4471     /* Parse image creation options */
4472     cluster_size = qcow2_opt_get_cluster_size_del(opts, &local_err);
4473     if (local_err) {
4474         goto err;
4475     }
4476 
4477     version = qcow2_opt_get_version_del(opts, &local_err);
4478     if (local_err) {
4479         goto err;
4480     }
4481 
4482     refcount_bits = qcow2_opt_get_refcount_bits_del(opts, version, &local_err);
4483     if (local_err) {
4484         goto err;
4485     }
4486 
4487     optstr = qemu_opt_get_del(opts, BLOCK_OPT_PREALLOC);
4488     prealloc = qapi_enum_parse(&PreallocMode_lookup, optstr,
4489                                PREALLOC_MODE_OFF, &local_err);
4490     g_free(optstr);
4491     if (local_err) {
4492         goto err;
4493     }
4494 
4495     optstr = qemu_opt_get_del(opts, BLOCK_OPT_BACKING_FILE);
4496     has_backing_file = !!optstr;
4497     g_free(optstr);
4498 
4499     optstr = qemu_opt_get_del(opts, BLOCK_OPT_ENCRYPT_FORMAT);
4500     has_luks = optstr && strcmp(optstr, "luks") == 0;
4501     g_free(optstr);
4502 
4503     if (has_luks) {
4504         size_t headerlen;
4505 
4506         if (!qcow2_measure_luks_headerlen(opts, &headerlen, &local_err)) {
4507             goto err;
4508         }
4509 
4510         luks_payload_size = ROUND_UP(headerlen, cluster_size);
4511     }
4512 
4513     virtual_size = qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0);
4514     virtual_size = ROUND_UP(virtual_size, cluster_size);
4515 
4516     /* Check that virtual disk size is valid */
4517     l2_tables = DIV_ROUND_UP(virtual_size / cluster_size,
4518                              cluster_size / sizeof(uint64_t));
4519     if (l2_tables * sizeof(uint64_t) > QCOW_MAX_L1_SIZE) {
4520         error_setg(&local_err, "The image size is too large "
4521                                "(try using a larger cluster size)");
4522         goto err;
4523     }
4524 
4525     /* Account for input image */
4526     if (in_bs) {
4527         int64_t ssize = bdrv_getlength(in_bs);
4528         if (ssize < 0) {
4529             error_setg_errno(&local_err, -ssize,
4530                              "Unable to get image virtual_size");
4531             goto err;
4532         }
4533 
4534         virtual_size = ROUND_UP(ssize, cluster_size);
4535 
4536         if (has_backing_file) {
4537             /* We don't how much of the backing chain is shared by the input
4538              * image and the new image file.  In the worst case the new image's
4539              * backing file has nothing in common with the input image.  Be
4540              * conservative and assume all clusters need to be written.
4541              */
4542             required = virtual_size;
4543         } else {
4544             int64_t offset;
4545             int64_t pnum = 0;
4546 
4547             for (offset = 0; offset < ssize; offset += pnum) {
4548                 int ret;
4549 
4550                 ret = bdrv_block_status_above(in_bs, NULL, offset,
4551                                               ssize - offset, &pnum, NULL,
4552                                               NULL);
4553                 if (ret < 0) {
4554                     error_setg_errno(&local_err, -ret,
4555                                      "Unable to get block status");
4556                     goto err;
4557                 }
4558 
4559                 if (ret & BDRV_BLOCK_ZERO) {
4560                     /* Skip zero regions (safe with no backing file) */
4561                 } else if ((ret & (BDRV_BLOCK_DATA | BDRV_BLOCK_ALLOCATED)) ==
4562                            (BDRV_BLOCK_DATA | BDRV_BLOCK_ALLOCATED)) {
4563                     /* Extend pnum to end of cluster for next iteration */
4564                     pnum = ROUND_UP(offset + pnum, cluster_size) - offset;
4565 
4566                     /* Count clusters we've seen */
4567                     required += offset % cluster_size + pnum;
4568                 }
4569             }
4570         }
4571     }
4572 
4573     /* Take into account preallocation.  Nothing special is needed for
4574      * PREALLOC_MODE_METADATA since metadata is always counted.
4575      */
4576     if (prealloc == PREALLOC_MODE_FULL || prealloc == PREALLOC_MODE_FALLOC) {
4577         required = virtual_size;
4578     }
4579 
4580     info = g_new(BlockMeasureInfo, 1);
4581     info->fully_allocated =
4582         qcow2_calc_prealloc_size(virtual_size, cluster_size,
4583                                  ctz32(refcount_bits)) + luks_payload_size;
4584 
4585     /* Remove data clusters that are not required.  This overestimates the
4586      * required size because metadata needed for the fully allocated file is
4587      * still counted.
4588      */
4589     info->required = info->fully_allocated - virtual_size + required;
4590     return info;
4591 
4592 err:
4593     error_propagate(errp, local_err);
4594     return NULL;
4595 }
4596 
4597 static int qcow2_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
4598 {
4599     BDRVQcow2State *s = bs->opaque;
4600     bdi->unallocated_blocks_are_zero = true;
4601     bdi->cluster_size = s->cluster_size;
4602     bdi->vm_state_offset = qcow2_vm_state_offset(s);
4603     return 0;
4604 }
4605 
4606 static ImageInfoSpecific *qcow2_get_specific_info(BlockDriverState *bs,
4607                                                   Error **errp)
4608 {
4609     BDRVQcow2State *s = bs->opaque;
4610     ImageInfoSpecific *spec_info;
4611     QCryptoBlockInfo *encrypt_info = NULL;
4612     Error *local_err = NULL;
4613 
4614     if (s->crypto != NULL) {
4615         encrypt_info = qcrypto_block_get_info(s->crypto, &local_err);
4616         if (local_err) {
4617             error_propagate(errp, local_err);
4618             return NULL;
4619         }
4620     }
4621 
4622     spec_info = g_new(ImageInfoSpecific, 1);
4623     *spec_info = (ImageInfoSpecific){
4624         .type  = IMAGE_INFO_SPECIFIC_KIND_QCOW2,
4625         .u.qcow2.data = g_new0(ImageInfoSpecificQCow2, 1),
4626     };
4627     if (s->qcow_version == 2) {
4628         *spec_info->u.qcow2.data = (ImageInfoSpecificQCow2){
4629             .compat             = g_strdup("0.10"),
4630             .refcount_bits      = s->refcount_bits,
4631         };
4632     } else if (s->qcow_version == 3) {
4633         Qcow2BitmapInfoList *bitmaps;
4634         bitmaps = qcow2_get_bitmap_info_list(bs, &local_err);
4635         if (local_err) {
4636             error_propagate(errp, local_err);
4637             qapi_free_ImageInfoSpecific(spec_info);
4638             return NULL;
4639         }
4640         *spec_info->u.qcow2.data = (ImageInfoSpecificQCow2){
4641             .compat             = g_strdup("1.1"),
4642             .lazy_refcounts     = s->compatible_features &
4643                                   QCOW2_COMPAT_LAZY_REFCOUNTS,
4644             .has_lazy_refcounts = true,
4645             .corrupt            = s->incompatible_features &
4646                                   QCOW2_INCOMPAT_CORRUPT,
4647             .has_corrupt        = true,
4648             .refcount_bits      = s->refcount_bits,
4649             .has_bitmaps        = !!bitmaps,
4650             .bitmaps            = bitmaps,
4651             .has_data_file      = !!s->image_data_file,
4652             .data_file          = g_strdup(s->image_data_file),
4653             .has_data_file_raw  = has_data_file(bs),
4654             .data_file_raw      = data_file_is_raw(bs),
4655         };
4656     } else {
4657         /* if this assertion fails, this probably means a new version was
4658          * added without having it covered here */
4659         assert(false);
4660     }
4661 
4662     if (encrypt_info) {
4663         ImageInfoSpecificQCow2Encryption *qencrypt =
4664             g_new(ImageInfoSpecificQCow2Encryption, 1);
4665         switch (encrypt_info->format) {
4666         case Q_CRYPTO_BLOCK_FORMAT_QCOW:
4667             qencrypt->format = BLOCKDEV_QCOW2_ENCRYPTION_FORMAT_AES;
4668             break;
4669         case Q_CRYPTO_BLOCK_FORMAT_LUKS:
4670             qencrypt->format = BLOCKDEV_QCOW2_ENCRYPTION_FORMAT_LUKS;
4671             qencrypt->u.luks = encrypt_info->u.luks;
4672             break;
4673         default:
4674             abort();
4675         }
4676         /* Since we did shallow copy above, erase any pointers
4677          * in the original info */
4678         memset(&encrypt_info->u, 0, sizeof(encrypt_info->u));
4679         qapi_free_QCryptoBlockInfo(encrypt_info);
4680 
4681         spec_info->u.qcow2.data->has_encrypt = true;
4682         spec_info->u.qcow2.data->encrypt = qencrypt;
4683     }
4684 
4685     return spec_info;
4686 }
4687 
4688 static int qcow2_save_vmstate(BlockDriverState *bs, QEMUIOVector *qiov,
4689                               int64_t pos)
4690 {
4691     BDRVQcow2State *s = bs->opaque;
4692 
4693     BLKDBG_EVENT(bs->file, BLKDBG_VMSTATE_SAVE);
4694     return bs->drv->bdrv_co_pwritev(bs, qcow2_vm_state_offset(s) + pos,
4695                                     qiov->size, qiov, 0);
4696 }
4697 
4698 static int qcow2_load_vmstate(BlockDriverState *bs, QEMUIOVector *qiov,
4699                               int64_t pos)
4700 {
4701     BDRVQcow2State *s = bs->opaque;
4702 
4703     BLKDBG_EVENT(bs->file, BLKDBG_VMSTATE_LOAD);
4704     return bs->drv->bdrv_co_preadv(bs, qcow2_vm_state_offset(s) + pos,
4705                                    qiov->size, qiov, 0);
4706 }
4707 
4708 /*
4709  * Downgrades an image's version. To achieve this, any incompatible features
4710  * have to be removed.
4711  */
4712 static int qcow2_downgrade(BlockDriverState *bs, int target_version,
4713                            BlockDriverAmendStatusCB *status_cb, void *cb_opaque,
4714                            Error **errp)
4715 {
4716     BDRVQcow2State *s = bs->opaque;
4717     int current_version = s->qcow_version;
4718     int ret;
4719 
4720     /* This is qcow2_downgrade(), not qcow2_upgrade() */
4721     assert(target_version < current_version);
4722 
4723     /* There are no other versions (now) that you can downgrade to */
4724     assert(target_version == 2);
4725 
4726     if (s->refcount_order != 4) {
4727         error_setg(errp, "compat=0.10 requires refcount_bits=16");
4728         return -ENOTSUP;
4729     }
4730 
4731     if (has_data_file(bs)) {
4732         error_setg(errp, "Cannot downgrade an image with a data file");
4733         return -ENOTSUP;
4734     }
4735 
4736     /* clear incompatible features */
4737     if (s->incompatible_features & QCOW2_INCOMPAT_DIRTY) {
4738         ret = qcow2_mark_clean(bs);
4739         if (ret < 0) {
4740             error_setg_errno(errp, -ret, "Failed to make the image clean");
4741             return ret;
4742         }
4743     }
4744 
4745     /* with QCOW2_INCOMPAT_CORRUPT, it is pretty much impossible to get here in
4746      * the first place; if that happens nonetheless, returning -ENOTSUP is the
4747      * best thing to do anyway */
4748 
4749     if (s->incompatible_features) {
4750         error_setg(errp, "Cannot downgrade an image with incompatible features "
4751                    "%#" PRIx64 " set", s->incompatible_features);
4752         return -ENOTSUP;
4753     }
4754 
4755     /* since we can ignore compatible features, we can set them to 0 as well */
4756     s->compatible_features = 0;
4757     /* if lazy refcounts have been used, they have already been fixed through
4758      * clearing the dirty flag */
4759 
4760     /* clearing autoclear features is trivial */
4761     s->autoclear_features = 0;
4762 
4763     ret = qcow2_expand_zero_clusters(bs, status_cb, cb_opaque);
4764     if (ret < 0) {
4765         error_setg_errno(errp, -ret, "Failed to turn zero into data clusters");
4766         return ret;
4767     }
4768 
4769     s->qcow_version = target_version;
4770     ret = qcow2_update_header(bs);
4771     if (ret < 0) {
4772         s->qcow_version = current_version;
4773         error_setg_errno(errp, -ret, "Failed to update the image header");
4774         return ret;
4775     }
4776     return 0;
4777 }
4778 
4779 typedef enum Qcow2AmendOperation {
4780     /* This is the value Qcow2AmendHelperCBInfo::last_operation will be
4781      * statically initialized to so that the helper CB can discern the first
4782      * invocation from an operation change */
4783     QCOW2_NO_OPERATION = 0,
4784 
4785     QCOW2_CHANGING_REFCOUNT_ORDER,
4786     QCOW2_DOWNGRADING,
4787 } Qcow2AmendOperation;
4788 
4789 typedef struct Qcow2AmendHelperCBInfo {
4790     /* The code coordinating the amend operations should only modify
4791      * these four fields; the rest will be managed by the CB */
4792     BlockDriverAmendStatusCB *original_status_cb;
4793     void *original_cb_opaque;
4794 
4795     Qcow2AmendOperation current_operation;
4796 
4797     /* Total number of operations to perform (only set once) */
4798     int total_operations;
4799 
4800     /* The following fields are managed by the CB */
4801 
4802     /* Number of operations completed */
4803     int operations_completed;
4804 
4805     /* Cumulative offset of all completed operations */
4806     int64_t offset_completed;
4807 
4808     Qcow2AmendOperation last_operation;
4809     int64_t last_work_size;
4810 } Qcow2AmendHelperCBInfo;
4811 
4812 static void qcow2_amend_helper_cb(BlockDriverState *bs,
4813                                   int64_t operation_offset,
4814                                   int64_t operation_work_size, void *opaque)
4815 {
4816     Qcow2AmendHelperCBInfo *info = opaque;
4817     int64_t current_work_size;
4818     int64_t projected_work_size;
4819 
4820     if (info->current_operation != info->last_operation) {
4821         if (info->last_operation != QCOW2_NO_OPERATION) {
4822             info->offset_completed += info->last_work_size;
4823             info->operations_completed++;
4824         }
4825 
4826         info->last_operation = info->current_operation;
4827     }
4828 
4829     assert(info->total_operations > 0);
4830     assert(info->operations_completed < info->total_operations);
4831 
4832     info->last_work_size = operation_work_size;
4833 
4834     current_work_size = info->offset_completed + operation_work_size;
4835 
4836     /* current_work_size is the total work size for (operations_completed + 1)
4837      * operations (which includes this one), so multiply it by the number of
4838      * operations not covered and divide it by the number of operations
4839      * covered to get a projection for the operations not covered */
4840     projected_work_size = current_work_size * (info->total_operations -
4841                                                info->operations_completed - 1)
4842                                             / (info->operations_completed + 1);
4843 
4844     info->original_status_cb(bs, info->offset_completed + operation_offset,
4845                              current_work_size + projected_work_size,
4846                              info->original_cb_opaque);
4847 }
4848 
4849 static int qcow2_amend_options(BlockDriverState *bs, QemuOpts *opts,
4850                                BlockDriverAmendStatusCB *status_cb,
4851                                void *cb_opaque,
4852                                Error **errp)
4853 {
4854     BDRVQcow2State *s = bs->opaque;
4855     int old_version = s->qcow_version, new_version = old_version;
4856     uint64_t new_size = 0;
4857     const char *backing_file = NULL, *backing_format = NULL, *data_file = NULL;
4858     bool lazy_refcounts = s->use_lazy_refcounts;
4859     bool data_file_raw = data_file_is_raw(bs);
4860     const char *compat = NULL;
4861     uint64_t cluster_size = s->cluster_size;
4862     bool encrypt;
4863     int encformat;
4864     int refcount_bits = s->refcount_bits;
4865     int ret;
4866     QemuOptDesc *desc = opts->list->desc;
4867     Qcow2AmendHelperCBInfo helper_cb_info;
4868 
4869     while (desc && desc->name) {
4870         if (!qemu_opt_find(opts, desc->name)) {
4871             /* only change explicitly defined options */
4872             desc++;
4873             continue;
4874         }
4875 
4876         if (!strcmp(desc->name, BLOCK_OPT_COMPAT_LEVEL)) {
4877             compat = qemu_opt_get(opts, BLOCK_OPT_COMPAT_LEVEL);
4878             if (!compat) {
4879                 /* preserve default */
4880             } else if (!strcmp(compat, "0.10")) {
4881                 new_version = 2;
4882             } else if (!strcmp(compat, "1.1")) {
4883                 new_version = 3;
4884             } else {
4885                 error_setg(errp, "Unknown compatibility level %s", compat);
4886                 return -EINVAL;
4887             }
4888         } else if (!strcmp(desc->name, BLOCK_OPT_PREALLOC)) {
4889             error_setg(errp, "Cannot change preallocation mode");
4890             return -ENOTSUP;
4891         } else if (!strcmp(desc->name, BLOCK_OPT_SIZE)) {
4892             new_size = qemu_opt_get_size(opts, BLOCK_OPT_SIZE, 0);
4893         } else if (!strcmp(desc->name, BLOCK_OPT_BACKING_FILE)) {
4894             backing_file = qemu_opt_get(opts, BLOCK_OPT_BACKING_FILE);
4895         } else if (!strcmp(desc->name, BLOCK_OPT_BACKING_FMT)) {
4896             backing_format = qemu_opt_get(opts, BLOCK_OPT_BACKING_FMT);
4897         } else if (!strcmp(desc->name, BLOCK_OPT_ENCRYPT)) {
4898             encrypt = qemu_opt_get_bool(opts, BLOCK_OPT_ENCRYPT,
4899                                         !!s->crypto);
4900 
4901             if (encrypt != !!s->crypto) {
4902                 error_setg(errp,
4903                            "Changing the encryption flag is not supported");
4904                 return -ENOTSUP;
4905             }
4906         } else if (!strcmp(desc->name, BLOCK_OPT_ENCRYPT_FORMAT)) {
4907             encformat = qcow2_crypt_method_from_format(
4908                 qemu_opt_get(opts, BLOCK_OPT_ENCRYPT_FORMAT));
4909 
4910             if (encformat != s->crypt_method_header) {
4911                 error_setg(errp,
4912                            "Changing the encryption format is not supported");
4913                 return -ENOTSUP;
4914             }
4915         } else if (g_str_has_prefix(desc->name, "encrypt.")) {
4916             error_setg(errp,
4917                        "Changing the encryption parameters is not supported");
4918             return -ENOTSUP;
4919         } else if (!strcmp(desc->name, BLOCK_OPT_CLUSTER_SIZE)) {
4920             cluster_size = qemu_opt_get_size(opts, BLOCK_OPT_CLUSTER_SIZE,
4921                                              cluster_size);
4922             if (cluster_size != s->cluster_size) {
4923                 error_setg(errp, "Changing the cluster size is not supported");
4924                 return -ENOTSUP;
4925             }
4926         } else if (!strcmp(desc->name, BLOCK_OPT_LAZY_REFCOUNTS)) {
4927             lazy_refcounts = qemu_opt_get_bool(opts, BLOCK_OPT_LAZY_REFCOUNTS,
4928                                                lazy_refcounts);
4929         } else if (!strcmp(desc->name, BLOCK_OPT_REFCOUNT_BITS)) {
4930             refcount_bits = qemu_opt_get_number(opts, BLOCK_OPT_REFCOUNT_BITS,
4931                                                 refcount_bits);
4932 
4933             if (refcount_bits <= 0 || refcount_bits > 64 ||
4934                 !is_power_of_2(refcount_bits))
4935             {
4936                 error_setg(errp, "Refcount width must be a power of two and "
4937                            "may not exceed 64 bits");
4938                 return -EINVAL;
4939             }
4940         } else if (!strcmp(desc->name, BLOCK_OPT_DATA_FILE)) {
4941             data_file = qemu_opt_get(opts, BLOCK_OPT_DATA_FILE);
4942             if (data_file && !has_data_file(bs)) {
4943                 error_setg(errp, "data-file can only be set for images that "
4944                                  "use an external data file");
4945                 return -EINVAL;
4946             }
4947         } else if (!strcmp(desc->name, BLOCK_OPT_DATA_FILE_RAW)) {
4948             data_file_raw = qemu_opt_get_bool(opts, BLOCK_OPT_DATA_FILE_RAW,
4949                                               data_file_raw);
4950             if (data_file_raw && !data_file_is_raw(bs)) {
4951                 error_setg(errp, "data-file-raw cannot be set on existing "
4952                                  "images");
4953                 return -EINVAL;
4954             }
4955         } else {
4956             /* if this point is reached, this probably means a new option was
4957              * added without having it covered here */
4958             abort();
4959         }
4960 
4961         desc++;
4962     }
4963 
4964     helper_cb_info = (Qcow2AmendHelperCBInfo){
4965         .original_status_cb = status_cb,
4966         .original_cb_opaque = cb_opaque,
4967         .total_operations = (new_version < old_version)
4968                           + (s->refcount_bits != refcount_bits)
4969     };
4970 
4971     /* Upgrade first (some features may require compat=1.1) */
4972     if (new_version > old_version) {
4973         s->qcow_version = new_version;
4974         ret = qcow2_update_header(bs);
4975         if (ret < 0) {
4976             s->qcow_version = old_version;
4977             error_setg_errno(errp, -ret, "Failed to update the image header");
4978             return ret;
4979         }
4980     }
4981 
4982     if (s->refcount_bits != refcount_bits) {
4983         int refcount_order = ctz32(refcount_bits);
4984 
4985         if (new_version < 3 && refcount_bits != 16) {
4986             error_setg(errp, "Refcount widths other than 16 bits require "
4987                        "compatibility level 1.1 or above (use compat=1.1 or "
4988                        "greater)");
4989             return -EINVAL;
4990         }
4991 
4992         helper_cb_info.current_operation = QCOW2_CHANGING_REFCOUNT_ORDER;
4993         ret = qcow2_change_refcount_order(bs, refcount_order,
4994                                           &qcow2_amend_helper_cb,
4995                                           &helper_cb_info, errp);
4996         if (ret < 0) {
4997             return ret;
4998         }
4999     }
5000 
5001     /* data-file-raw blocks backing files, so clear it first if requested */
5002     if (data_file_raw) {
5003         s->autoclear_features |= QCOW2_AUTOCLEAR_DATA_FILE_RAW;
5004     } else {
5005         s->autoclear_features &= ~QCOW2_AUTOCLEAR_DATA_FILE_RAW;
5006     }
5007 
5008     if (data_file) {
5009         g_free(s->image_data_file);
5010         s->image_data_file = *data_file ? g_strdup(data_file) : NULL;
5011     }
5012 
5013     ret = qcow2_update_header(bs);
5014     if (ret < 0) {
5015         error_setg_errno(errp, -ret, "Failed to update the image header");
5016         return ret;
5017     }
5018 
5019     if (backing_file || backing_format) {
5020         ret = qcow2_change_backing_file(bs,
5021                     backing_file ?: s->image_backing_file,
5022                     backing_format ?: s->image_backing_format);
5023         if (ret < 0) {
5024             error_setg_errno(errp, -ret, "Failed to change the backing file");
5025             return ret;
5026         }
5027     }
5028 
5029     if (s->use_lazy_refcounts != lazy_refcounts) {
5030         if (lazy_refcounts) {
5031             if (new_version < 3) {
5032                 error_setg(errp, "Lazy refcounts only supported with "
5033                            "compatibility level 1.1 and above (use compat=1.1 "
5034                            "or greater)");
5035                 return -EINVAL;
5036             }
5037             s->compatible_features |= QCOW2_COMPAT_LAZY_REFCOUNTS;
5038             ret = qcow2_update_header(bs);
5039             if (ret < 0) {
5040                 s->compatible_features &= ~QCOW2_COMPAT_LAZY_REFCOUNTS;
5041                 error_setg_errno(errp, -ret, "Failed to update the image header");
5042                 return ret;
5043             }
5044             s->use_lazy_refcounts = true;
5045         } else {
5046             /* make image clean first */
5047             ret = qcow2_mark_clean(bs);
5048             if (ret < 0) {
5049                 error_setg_errno(errp, -ret, "Failed to make the image clean");
5050                 return ret;
5051             }
5052             /* now disallow lazy refcounts */
5053             s->compatible_features &= ~QCOW2_COMPAT_LAZY_REFCOUNTS;
5054             ret = qcow2_update_header(bs);
5055             if (ret < 0) {
5056                 s->compatible_features |= QCOW2_COMPAT_LAZY_REFCOUNTS;
5057                 error_setg_errno(errp, -ret, "Failed to update the image header");
5058                 return ret;
5059             }
5060             s->use_lazy_refcounts = false;
5061         }
5062     }
5063 
5064     if (new_size) {
5065         BlockBackend *blk = blk_new(BLK_PERM_RESIZE, BLK_PERM_ALL);
5066         ret = blk_insert_bs(blk, bs, errp);
5067         if (ret < 0) {
5068             blk_unref(blk);
5069             return ret;
5070         }
5071 
5072         ret = blk_truncate(blk, new_size, PREALLOC_MODE_OFF, errp);
5073         blk_unref(blk);
5074         if (ret < 0) {
5075             return ret;
5076         }
5077     }
5078 
5079     /* Downgrade last (so unsupported features can be removed before) */
5080     if (new_version < old_version) {
5081         helper_cb_info.current_operation = QCOW2_DOWNGRADING;
5082         ret = qcow2_downgrade(bs, new_version, &qcow2_amend_helper_cb,
5083                               &helper_cb_info, errp);
5084         if (ret < 0) {
5085             return ret;
5086         }
5087     }
5088 
5089     return 0;
5090 }
5091 
5092 /*
5093  * If offset or size are negative, respectively, they will not be included in
5094  * the BLOCK_IMAGE_CORRUPTED event emitted.
5095  * fatal will be ignored for read-only BDS; corruptions found there will always
5096  * be considered non-fatal.
5097  */
5098 void qcow2_signal_corruption(BlockDriverState *bs, bool fatal, int64_t offset,
5099                              int64_t size, const char *message_format, ...)
5100 {
5101     BDRVQcow2State *s = bs->opaque;
5102     const char *node_name;
5103     char *message;
5104     va_list ap;
5105 
5106     fatal = fatal && bdrv_is_writable(bs);
5107 
5108     if (s->signaled_corruption &&
5109         (!fatal || (s->incompatible_features & QCOW2_INCOMPAT_CORRUPT)))
5110     {
5111         return;
5112     }
5113 
5114     va_start(ap, message_format);
5115     message = g_strdup_vprintf(message_format, ap);
5116     va_end(ap);
5117 
5118     if (fatal) {
5119         fprintf(stderr, "qcow2: Marking image as corrupt: %s; further "
5120                 "corruption events will be suppressed\n", message);
5121     } else {
5122         fprintf(stderr, "qcow2: Image is corrupt: %s; further non-fatal "
5123                 "corruption events will be suppressed\n", message);
5124     }
5125 
5126     node_name = bdrv_get_node_name(bs);
5127     qapi_event_send_block_image_corrupted(bdrv_get_device_name(bs),
5128                                           *node_name != '\0', node_name,
5129                                           message, offset >= 0, offset,
5130                                           size >= 0, size,
5131                                           fatal);
5132     g_free(message);
5133 
5134     if (fatal) {
5135         qcow2_mark_corrupt(bs);
5136         bs->drv = NULL; /* make BDS unusable */
5137     }
5138 
5139     s->signaled_corruption = true;
5140 }
5141 
5142 static QemuOptsList qcow2_create_opts = {
5143     .name = "qcow2-create-opts",
5144     .head = QTAILQ_HEAD_INITIALIZER(qcow2_create_opts.head),
5145     .desc = {
5146         {
5147             .name = BLOCK_OPT_SIZE,
5148             .type = QEMU_OPT_SIZE,
5149             .help = "Virtual disk size"
5150         },
5151         {
5152             .name = BLOCK_OPT_COMPAT_LEVEL,
5153             .type = QEMU_OPT_STRING,
5154             .help = "Compatibility level (0.10 or 1.1)"
5155         },
5156         {
5157             .name = BLOCK_OPT_BACKING_FILE,
5158             .type = QEMU_OPT_STRING,
5159             .help = "File name of a base image"
5160         },
5161         {
5162             .name = BLOCK_OPT_BACKING_FMT,
5163             .type = QEMU_OPT_STRING,
5164             .help = "Image format of the base image"
5165         },
5166         {
5167             .name = BLOCK_OPT_DATA_FILE,
5168             .type = QEMU_OPT_STRING,
5169             .help = "File name of an external data file"
5170         },
5171         {
5172             .name = BLOCK_OPT_DATA_FILE_RAW,
5173             .type = QEMU_OPT_BOOL,
5174             .help = "The external data file must stay valid as a raw image"
5175         },
5176         {
5177             .name = BLOCK_OPT_ENCRYPT,
5178             .type = QEMU_OPT_BOOL,
5179             .help = "Encrypt the image with format 'aes'. (Deprecated "
5180                     "in favor of " BLOCK_OPT_ENCRYPT_FORMAT "=aes)",
5181         },
5182         {
5183             .name = BLOCK_OPT_ENCRYPT_FORMAT,
5184             .type = QEMU_OPT_STRING,
5185             .help = "Encrypt the image, format choices: 'aes', 'luks'",
5186         },
5187         BLOCK_CRYPTO_OPT_DEF_KEY_SECRET("encrypt.",
5188             "ID of secret providing qcow AES key or LUKS passphrase"),
5189         BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_ALG("encrypt."),
5190         BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_MODE("encrypt."),
5191         BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_ALG("encrypt."),
5192         BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_HASH_ALG("encrypt."),
5193         BLOCK_CRYPTO_OPT_DEF_LUKS_HASH_ALG("encrypt."),
5194         BLOCK_CRYPTO_OPT_DEF_LUKS_ITER_TIME("encrypt."),
5195         {
5196             .name = BLOCK_OPT_CLUSTER_SIZE,
5197             .type = QEMU_OPT_SIZE,
5198             .help = "qcow2 cluster size",
5199             .def_value_str = stringify(DEFAULT_CLUSTER_SIZE)
5200         },
5201         {
5202             .name = BLOCK_OPT_PREALLOC,
5203             .type = QEMU_OPT_STRING,
5204             .help = "Preallocation mode (allowed values: off, metadata, "
5205                     "falloc, full)"
5206         },
5207         {
5208             .name = BLOCK_OPT_LAZY_REFCOUNTS,
5209             .type = QEMU_OPT_BOOL,
5210             .help = "Postpone refcount updates",
5211             .def_value_str = "off"
5212         },
5213         {
5214             .name = BLOCK_OPT_REFCOUNT_BITS,
5215             .type = QEMU_OPT_NUMBER,
5216             .help = "Width of a reference count entry in bits",
5217             .def_value_str = "16"
5218         },
5219         { /* end of list */ }
5220     }
5221 };
5222 
5223 static const char *const qcow2_strong_runtime_opts[] = {
5224     "encrypt." BLOCK_CRYPTO_OPT_QCOW_KEY_SECRET,
5225 
5226     NULL
5227 };
5228 
5229 BlockDriver bdrv_qcow2 = {
5230     .format_name        = "qcow2",
5231     .instance_size      = sizeof(BDRVQcow2State),
5232     .bdrv_probe         = qcow2_probe,
5233     .bdrv_open          = qcow2_open,
5234     .bdrv_close         = qcow2_close,
5235     .bdrv_reopen_prepare  = qcow2_reopen_prepare,
5236     .bdrv_reopen_commit   = qcow2_reopen_commit,
5237     .bdrv_reopen_abort    = qcow2_reopen_abort,
5238     .bdrv_join_options    = qcow2_join_options,
5239     .bdrv_child_perm      = bdrv_format_default_perms,
5240     .bdrv_co_create_opts  = qcow2_co_create_opts,
5241     .bdrv_co_create       = qcow2_co_create,
5242     .bdrv_has_zero_init = bdrv_has_zero_init_1,
5243     .bdrv_co_block_status = qcow2_co_block_status,
5244 
5245     .bdrv_co_preadv         = qcow2_co_preadv,
5246     .bdrv_co_pwritev        = qcow2_co_pwritev,
5247     .bdrv_co_flush_to_os    = qcow2_co_flush_to_os,
5248 
5249     .bdrv_co_pwrite_zeroes  = qcow2_co_pwrite_zeroes,
5250     .bdrv_co_pdiscard       = qcow2_co_pdiscard,
5251     .bdrv_co_copy_range_from = qcow2_co_copy_range_from,
5252     .bdrv_co_copy_range_to  = qcow2_co_copy_range_to,
5253     .bdrv_co_truncate       = qcow2_co_truncate,
5254     .bdrv_co_pwritev_compressed = qcow2_co_pwritev_compressed,
5255     .bdrv_make_empty        = qcow2_make_empty,
5256 
5257     .bdrv_snapshot_create   = qcow2_snapshot_create,
5258     .bdrv_snapshot_goto     = qcow2_snapshot_goto,
5259     .bdrv_snapshot_delete   = qcow2_snapshot_delete,
5260     .bdrv_snapshot_list     = qcow2_snapshot_list,
5261     .bdrv_snapshot_load_tmp = qcow2_snapshot_load_tmp,
5262     .bdrv_measure           = qcow2_measure,
5263     .bdrv_get_info          = qcow2_get_info,
5264     .bdrv_get_specific_info = qcow2_get_specific_info,
5265 
5266     .bdrv_save_vmstate    = qcow2_save_vmstate,
5267     .bdrv_load_vmstate    = qcow2_load_vmstate,
5268 
5269     .supports_backing           = true,
5270     .bdrv_change_backing_file   = qcow2_change_backing_file,
5271 
5272     .bdrv_refresh_limits        = qcow2_refresh_limits,
5273     .bdrv_co_invalidate_cache   = qcow2_co_invalidate_cache,
5274     .bdrv_inactivate            = qcow2_inactivate,
5275 
5276     .create_opts         = &qcow2_create_opts,
5277     .strong_runtime_opts = qcow2_strong_runtime_opts,
5278     .bdrv_co_check       = qcow2_co_check,
5279     .bdrv_amend_options  = qcow2_amend_options,
5280 
5281     .bdrv_detach_aio_context  = qcow2_detach_aio_context,
5282     .bdrv_attach_aio_context  = qcow2_attach_aio_context,
5283 
5284     .bdrv_reopen_bitmaps_rw = qcow2_reopen_bitmaps_rw,
5285     .bdrv_can_store_new_dirty_bitmap = qcow2_can_store_new_dirty_bitmap,
5286     .bdrv_remove_persistent_dirty_bitmap = qcow2_remove_persistent_dirty_bitmap,
5287 };
5288 
5289 static void bdrv_qcow2_init(void)
5290 {
5291     bdrv_register(&bdrv_qcow2);
5292 }
5293 
5294 block_init(bdrv_qcow2_init);
5295