1 /* 2 * Block driver for the QCOW version 2 format 3 * 4 * Copyright (c) 2004-2006 Fabrice Bellard 5 * 6 * Permission is hereby granted, free of charge, to any person obtaining a copy 7 * of this software and associated documentation files (the "Software"), to deal 8 * in the Software without restriction, including without limitation the rights 9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 10 * copies of the Software, and to permit persons to whom the Software is 11 * furnished to do so, subject to the following conditions: 12 * 13 * The above copyright notice and this permission notice shall be included in 14 * all copies or substantial portions of the Software. 15 * 16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL 19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 22 * THE SOFTWARE. 23 */ 24 25 #include "qemu/osdep.h" 26 #include "qapi/error.h" 27 #include "qcow2.h" 28 #include "qemu/range.h" 29 #include "qemu/bswap.h" 30 #include "qemu/cutils.h" 31 #include "trace.h" 32 33 static int64_t alloc_clusters_noref(BlockDriverState *bs, uint64_t size, 34 uint64_t max); 35 static int QEMU_WARN_UNUSED_RESULT update_refcount(BlockDriverState *bs, 36 int64_t offset, int64_t length, uint64_t addend, 37 bool decrease, enum qcow2_discard_type type); 38 39 static uint64_t get_refcount_ro0(const void *refcount_array, uint64_t index); 40 static uint64_t get_refcount_ro1(const void *refcount_array, uint64_t index); 41 static uint64_t get_refcount_ro2(const void *refcount_array, uint64_t index); 42 static uint64_t get_refcount_ro3(const void *refcount_array, uint64_t index); 43 static uint64_t get_refcount_ro4(const void *refcount_array, uint64_t index); 44 static uint64_t get_refcount_ro5(const void *refcount_array, uint64_t index); 45 static uint64_t get_refcount_ro6(const void *refcount_array, uint64_t index); 46 47 static void set_refcount_ro0(void *refcount_array, uint64_t index, 48 uint64_t value); 49 static void set_refcount_ro1(void *refcount_array, uint64_t index, 50 uint64_t value); 51 static void set_refcount_ro2(void *refcount_array, uint64_t index, 52 uint64_t value); 53 static void set_refcount_ro3(void *refcount_array, uint64_t index, 54 uint64_t value); 55 static void set_refcount_ro4(void *refcount_array, uint64_t index, 56 uint64_t value); 57 static void set_refcount_ro5(void *refcount_array, uint64_t index, 58 uint64_t value); 59 static void set_refcount_ro6(void *refcount_array, uint64_t index, 60 uint64_t value); 61 62 63 static Qcow2GetRefcountFunc *const get_refcount_funcs[] = { 64 &get_refcount_ro0, 65 &get_refcount_ro1, 66 &get_refcount_ro2, 67 &get_refcount_ro3, 68 &get_refcount_ro4, 69 &get_refcount_ro5, 70 &get_refcount_ro6 71 }; 72 73 static Qcow2SetRefcountFunc *const set_refcount_funcs[] = { 74 &set_refcount_ro0, 75 &set_refcount_ro1, 76 &set_refcount_ro2, 77 &set_refcount_ro3, 78 &set_refcount_ro4, 79 &set_refcount_ro5, 80 &set_refcount_ro6 81 }; 82 83 84 /*********************************************************/ 85 /* refcount handling */ 86 87 static void update_max_refcount_table_index(BDRVQcow2State *s) 88 { 89 unsigned i = s->refcount_table_size - 1; 90 while (i > 0 && (s->refcount_table[i] & REFT_OFFSET_MASK) == 0) { 91 i--; 92 } 93 /* Set s->max_refcount_table_index to the index of the last used entry */ 94 s->max_refcount_table_index = i; 95 } 96 97 int qcow2_refcount_init(BlockDriverState *bs) 98 { 99 BDRVQcow2State *s = bs->opaque; 100 unsigned int refcount_table_size2, i; 101 int ret; 102 103 assert(s->refcount_order >= 0 && s->refcount_order <= 6); 104 105 s->get_refcount = get_refcount_funcs[s->refcount_order]; 106 s->set_refcount = set_refcount_funcs[s->refcount_order]; 107 108 assert(s->refcount_table_size <= INT_MAX / sizeof(uint64_t)); 109 refcount_table_size2 = s->refcount_table_size * sizeof(uint64_t); 110 s->refcount_table = g_try_malloc(refcount_table_size2); 111 112 if (s->refcount_table_size > 0) { 113 if (s->refcount_table == NULL) { 114 ret = -ENOMEM; 115 goto fail; 116 } 117 BLKDBG_EVENT(bs->file, BLKDBG_REFTABLE_LOAD); 118 ret = bdrv_pread(bs->file, s->refcount_table_offset, 119 s->refcount_table, refcount_table_size2); 120 if (ret < 0) { 121 goto fail; 122 } 123 for(i = 0; i < s->refcount_table_size; i++) 124 be64_to_cpus(&s->refcount_table[i]); 125 update_max_refcount_table_index(s); 126 } 127 return 0; 128 fail: 129 return ret; 130 } 131 132 void qcow2_refcount_close(BlockDriverState *bs) 133 { 134 BDRVQcow2State *s = bs->opaque; 135 g_free(s->refcount_table); 136 } 137 138 139 static uint64_t get_refcount_ro0(const void *refcount_array, uint64_t index) 140 { 141 return (((const uint8_t *)refcount_array)[index / 8] >> (index % 8)) & 0x1; 142 } 143 144 static void set_refcount_ro0(void *refcount_array, uint64_t index, 145 uint64_t value) 146 { 147 assert(!(value >> 1)); 148 ((uint8_t *)refcount_array)[index / 8] &= ~(0x1 << (index % 8)); 149 ((uint8_t *)refcount_array)[index / 8] |= value << (index % 8); 150 } 151 152 static uint64_t get_refcount_ro1(const void *refcount_array, uint64_t index) 153 { 154 return (((const uint8_t *)refcount_array)[index / 4] >> (2 * (index % 4))) 155 & 0x3; 156 } 157 158 static void set_refcount_ro1(void *refcount_array, uint64_t index, 159 uint64_t value) 160 { 161 assert(!(value >> 2)); 162 ((uint8_t *)refcount_array)[index / 4] &= ~(0x3 << (2 * (index % 4))); 163 ((uint8_t *)refcount_array)[index / 4] |= value << (2 * (index % 4)); 164 } 165 166 static uint64_t get_refcount_ro2(const void *refcount_array, uint64_t index) 167 { 168 return (((const uint8_t *)refcount_array)[index / 2] >> (4 * (index % 2))) 169 & 0xf; 170 } 171 172 static void set_refcount_ro2(void *refcount_array, uint64_t index, 173 uint64_t value) 174 { 175 assert(!(value >> 4)); 176 ((uint8_t *)refcount_array)[index / 2] &= ~(0xf << (4 * (index % 2))); 177 ((uint8_t *)refcount_array)[index / 2] |= value << (4 * (index % 2)); 178 } 179 180 static uint64_t get_refcount_ro3(const void *refcount_array, uint64_t index) 181 { 182 return ((const uint8_t *)refcount_array)[index]; 183 } 184 185 static void set_refcount_ro3(void *refcount_array, uint64_t index, 186 uint64_t value) 187 { 188 assert(!(value >> 8)); 189 ((uint8_t *)refcount_array)[index] = value; 190 } 191 192 static uint64_t get_refcount_ro4(const void *refcount_array, uint64_t index) 193 { 194 return be16_to_cpu(((const uint16_t *)refcount_array)[index]); 195 } 196 197 static void set_refcount_ro4(void *refcount_array, uint64_t index, 198 uint64_t value) 199 { 200 assert(!(value >> 16)); 201 ((uint16_t *)refcount_array)[index] = cpu_to_be16(value); 202 } 203 204 static uint64_t get_refcount_ro5(const void *refcount_array, uint64_t index) 205 { 206 return be32_to_cpu(((const uint32_t *)refcount_array)[index]); 207 } 208 209 static void set_refcount_ro5(void *refcount_array, uint64_t index, 210 uint64_t value) 211 { 212 assert(!(value >> 32)); 213 ((uint32_t *)refcount_array)[index] = cpu_to_be32(value); 214 } 215 216 static uint64_t get_refcount_ro6(const void *refcount_array, uint64_t index) 217 { 218 return be64_to_cpu(((const uint64_t *)refcount_array)[index]); 219 } 220 221 static void set_refcount_ro6(void *refcount_array, uint64_t index, 222 uint64_t value) 223 { 224 ((uint64_t *)refcount_array)[index] = cpu_to_be64(value); 225 } 226 227 228 static int load_refcount_block(BlockDriverState *bs, 229 int64_t refcount_block_offset, 230 void **refcount_block) 231 { 232 BDRVQcow2State *s = bs->opaque; 233 234 BLKDBG_EVENT(bs->file, BLKDBG_REFBLOCK_LOAD); 235 return qcow2_cache_get(bs, s->refcount_block_cache, refcount_block_offset, 236 refcount_block); 237 } 238 239 /* 240 * Retrieves the refcount of the cluster given by its index and stores it in 241 * *refcount. Returns 0 on success and -errno on failure. 242 */ 243 int qcow2_get_refcount(BlockDriverState *bs, int64_t cluster_index, 244 uint64_t *refcount) 245 { 246 BDRVQcow2State *s = bs->opaque; 247 uint64_t refcount_table_index, block_index; 248 int64_t refcount_block_offset; 249 int ret; 250 void *refcount_block; 251 252 refcount_table_index = cluster_index >> s->refcount_block_bits; 253 if (refcount_table_index >= s->refcount_table_size) { 254 *refcount = 0; 255 return 0; 256 } 257 refcount_block_offset = 258 s->refcount_table[refcount_table_index] & REFT_OFFSET_MASK; 259 if (!refcount_block_offset) { 260 *refcount = 0; 261 return 0; 262 } 263 264 if (offset_into_cluster(s, refcount_block_offset)) { 265 qcow2_signal_corruption(bs, true, -1, -1, "Refblock offset %#" PRIx64 266 " unaligned (reftable index: %#" PRIx64 ")", 267 refcount_block_offset, refcount_table_index); 268 return -EIO; 269 } 270 271 ret = qcow2_cache_get(bs, s->refcount_block_cache, refcount_block_offset, 272 &refcount_block); 273 if (ret < 0) { 274 return ret; 275 } 276 277 block_index = cluster_index & (s->refcount_block_size - 1); 278 *refcount = s->get_refcount(refcount_block, block_index); 279 280 qcow2_cache_put(s->refcount_block_cache, &refcount_block); 281 282 return 0; 283 } 284 285 /* Checks if two offsets are described by the same refcount block */ 286 static int in_same_refcount_block(BDRVQcow2State *s, uint64_t offset_a, 287 uint64_t offset_b) 288 { 289 uint64_t block_a = offset_a >> (s->cluster_bits + s->refcount_block_bits); 290 uint64_t block_b = offset_b >> (s->cluster_bits + s->refcount_block_bits); 291 292 return (block_a == block_b); 293 } 294 295 /* 296 * Loads a refcount block. If it doesn't exist yet, it is allocated first 297 * (including growing the refcount table if needed). 298 * 299 * Returns 0 on success or -errno in error case 300 */ 301 static int alloc_refcount_block(BlockDriverState *bs, 302 int64_t cluster_index, void **refcount_block) 303 { 304 BDRVQcow2State *s = bs->opaque; 305 unsigned int refcount_table_index; 306 int64_t ret; 307 308 BLKDBG_EVENT(bs->file, BLKDBG_REFBLOCK_ALLOC); 309 310 /* Find the refcount block for the given cluster */ 311 refcount_table_index = cluster_index >> s->refcount_block_bits; 312 313 if (refcount_table_index < s->refcount_table_size) { 314 315 uint64_t refcount_block_offset = 316 s->refcount_table[refcount_table_index] & REFT_OFFSET_MASK; 317 318 /* If it's already there, we're done */ 319 if (refcount_block_offset) { 320 if (offset_into_cluster(s, refcount_block_offset)) { 321 qcow2_signal_corruption(bs, true, -1, -1, "Refblock offset %#" 322 PRIx64 " unaligned (reftable index: " 323 "%#x)", refcount_block_offset, 324 refcount_table_index); 325 return -EIO; 326 } 327 328 return load_refcount_block(bs, refcount_block_offset, 329 refcount_block); 330 } 331 } 332 333 /* 334 * If we came here, we need to allocate something. Something is at least 335 * a cluster for the new refcount block. It may also include a new refcount 336 * table if the old refcount table is too small. 337 * 338 * Note that allocating clusters here needs some special care: 339 * 340 * - We can't use the normal qcow2_alloc_clusters(), it would try to 341 * increase the refcount and very likely we would end up with an endless 342 * recursion. Instead we must place the refcount blocks in a way that 343 * they can describe them themselves. 344 * 345 * - We need to consider that at this point we are inside update_refcounts 346 * and potentially doing an initial refcount increase. This means that 347 * some clusters have already been allocated by the caller, but their 348 * refcount isn't accurate yet. If we allocate clusters for metadata, we 349 * need to return -EAGAIN to signal the caller that it needs to restart 350 * the search for free clusters. 351 * 352 * - alloc_clusters_noref and qcow2_free_clusters may load a different 353 * refcount block into the cache 354 */ 355 356 *refcount_block = NULL; 357 358 /* We write to the refcount table, so we might depend on L2 tables */ 359 ret = qcow2_cache_flush(bs, s->l2_table_cache); 360 if (ret < 0) { 361 return ret; 362 } 363 364 /* Allocate the refcount block itself and mark it as used */ 365 int64_t new_block = alloc_clusters_noref(bs, s->cluster_size, INT64_MAX); 366 if (new_block < 0) { 367 return new_block; 368 } 369 370 /* The offset must fit in the offset field of the refcount table entry */ 371 assert((new_block & REFT_OFFSET_MASK) == new_block); 372 373 /* If we're allocating the block at offset 0 then something is wrong */ 374 if (new_block == 0) { 375 qcow2_signal_corruption(bs, true, -1, -1, "Preventing invalid " 376 "allocation of refcount block at offset 0"); 377 return -EIO; 378 } 379 380 #ifdef DEBUG_ALLOC2 381 fprintf(stderr, "qcow2: Allocate refcount block %d for %" PRIx64 382 " at %" PRIx64 "\n", 383 refcount_table_index, cluster_index << s->cluster_bits, new_block); 384 #endif 385 386 if (in_same_refcount_block(s, new_block, cluster_index << s->cluster_bits)) { 387 /* Zero the new refcount block before updating it */ 388 ret = qcow2_cache_get_empty(bs, s->refcount_block_cache, new_block, 389 refcount_block); 390 if (ret < 0) { 391 goto fail; 392 } 393 394 memset(*refcount_block, 0, s->cluster_size); 395 396 /* The block describes itself, need to update the cache */ 397 int block_index = (new_block >> s->cluster_bits) & 398 (s->refcount_block_size - 1); 399 s->set_refcount(*refcount_block, block_index, 1); 400 } else { 401 /* Described somewhere else. This can recurse at most twice before we 402 * arrive at a block that describes itself. */ 403 ret = update_refcount(bs, new_block, s->cluster_size, 1, false, 404 QCOW2_DISCARD_NEVER); 405 if (ret < 0) { 406 goto fail; 407 } 408 409 ret = qcow2_cache_flush(bs, s->refcount_block_cache); 410 if (ret < 0) { 411 goto fail; 412 } 413 414 /* Initialize the new refcount block only after updating its refcount, 415 * update_refcount uses the refcount cache itself */ 416 ret = qcow2_cache_get_empty(bs, s->refcount_block_cache, new_block, 417 refcount_block); 418 if (ret < 0) { 419 goto fail; 420 } 421 422 memset(*refcount_block, 0, s->cluster_size); 423 } 424 425 /* Now the new refcount block needs to be written to disk */ 426 BLKDBG_EVENT(bs->file, BLKDBG_REFBLOCK_ALLOC_WRITE); 427 qcow2_cache_entry_mark_dirty(s->refcount_block_cache, *refcount_block); 428 ret = qcow2_cache_flush(bs, s->refcount_block_cache); 429 if (ret < 0) { 430 goto fail; 431 } 432 433 /* If the refcount table is big enough, just hook the block up there */ 434 if (refcount_table_index < s->refcount_table_size) { 435 uint64_t data64 = cpu_to_be64(new_block); 436 BLKDBG_EVENT(bs->file, BLKDBG_REFBLOCK_ALLOC_HOOKUP); 437 ret = bdrv_pwrite_sync(bs->file, 438 s->refcount_table_offset + refcount_table_index * sizeof(uint64_t), 439 &data64, sizeof(data64)); 440 if (ret < 0) { 441 goto fail; 442 } 443 444 s->refcount_table[refcount_table_index] = new_block; 445 /* If there's a hole in s->refcount_table then it can happen 446 * that refcount_table_index < s->max_refcount_table_index */ 447 s->max_refcount_table_index = 448 MAX(s->max_refcount_table_index, refcount_table_index); 449 450 /* The new refcount block may be where the caller intended to put its 451 * data, so let it restart the search. */ 452 return -EAGAIN; 453 } 454 455 qcow2_cache_put(s->refcount_block_cache, refcount_block); 456 457 /* 458 * If we come here, we need to grow the refcount table. Again, a new 459 * refcount table needs some space and we can't simply allocate to avoid 460 * endless recursion. 461 * 462 * Therefore let's grab new refcount blocks at the end of the image, which 463 * will describe themselves and the new refcount table. This way we can 464 * reference them only in the new table and do the switch to the new 465 * refcount table at once without producing an inconsistent state in 466 * between. 467 */ 468 BLKDBG_EVENT(bs->file, BLKDBG_REFTABLE_GROW); 469 470 /* Calculate the number of refcount blocks needed so far; this will be the 471 * basis for calculating the index of the first cluster used for the 472 * self-describing refcount structures which we are about to create. 473 * 474 * Because we reached this point, there cannot be any refcount entries for 475 * cluster_index or higher indices yet. However, because new_block has been 476 * allocated to describe that cluster (and it will assume this role later 477 * on), we cannot use that index; also, new_block may actually have a higher 478 * cluster index than cluster_index, so it needs to be taken into account 479 * here (and 1 needs to be added to its value because that cluster is used). 480 */ 481 uint64_t blocks_used = DIV_ROUND_UP(MAX(cluster_index + 1, 482 (new_block >> s->cluster_bits) + 1), 483 s->refcount_block_size); 484 485 /* Create the new refcount table and blocks */ 486 uint64_t meta_offset = (blocks_used * s->refcount_block_size) * 487 s->cluster_size; 488 489 ret = qcow2_refcount_area(bs, meta_offset, 0, false, 490 refcount_table_index, new_block); 491 if (ret < 0) { 492 return ret; 493 } 494 495 ret = load_refcount_block(bs, new_block, refcount_block); 496 if (ret < 0) { 497 return ret; 498 } 499 500 /* If we were trying to do the initial refcount update for some cluster 501 * allocation, we might have used the same clusters to store newly 502 * allocated metadata. Make the caller search some new space. */ 503 return -EAGAIN; 504 505 fail: 506 if (*refcount_block != NULL) { 507 qcow2_cache_put(s->refcount_block_cache, refcount_block); 508 } 509 return ret; 510 } 511 512 /* 513 * Starting at @start_offset, this function creates new self-covering refcount 514 * structures: A new refcount table and refcount blocks which cover all of 515 * themselves, and a number of @additional_clusters beyond their end. 516 * @start_offset must be at the end of the image file, that is, there must be 517 * only empty space beyond it. 518 * If @exact_size is false, the refcount table will have 50 % more entries than 519 * necessary so it will not need to grow again soon. 520 * If @new_refblock_offset is not zero, it contains the offset of a refcount 521 * block that should be entered into the new refcount table at index 522 * @new_refblock_index. 523 * 524 * Returns: The offset after the new refcount structures (i.e. where the 525 * @additional_clusters may be placed) on success, -errno on error. 526 */ 527 int64_t qcow2_refcount_area(BlockDriverState *bs, uint64_t start_offset, 528 uint64_t additional_clusters, bool exact_size, 529 int new_refblock_index, 530 uint64_t new_refblock_offset) 531 { 532 BDRVQcow2State *s = bs->opaque; 533 uint64_t total_refblock_count_u64, additional_refblock_count; 534 int total_refblock_count, table_size, area_reftable_index, table_clusters; 535 int i; 536 uint64_t table_offset, block_offset, end_offset; 537 int ret; 538 uint64_t *new_table; 539 540 assert(!(start_offset % s->cluster_size)); 541 542 qcow2_refcount_metadata_size(start_offset / s->cluster_size + 543 additional_clusters, 544 s->cluster_size, s->refcount_order, 545 !exact_size, &total_refblock_count_u64); 546 if (total_refblock_count_u64 > QCOW_MAX_REFTABLE_SIZE) { 547 return -EFBIG; 548 } 549 total_refblock_count = total_refblock_count_u64; 550 551 /* Index in the refcount table of the first refcount block to cover the area 552 * of refcount structures we are about to create; we know that 553 * @total_refblock_count can cover @start_offset, so this will definitely 554 * fit into an int. */ 555 area_reftable_index = (start_offset / s->cluster_size) / 556 s->refcount_block_size; 557 558 if (exact_size) { 559 table_size = total_refblock_count; 560 } else { 561 table_size = total_refblock_count + 562 DIV_ROUND_UP(total_refblock_count, 2); 563 } 564 /* The qcow2 file can only store the reftable size in number of clusters */ 565 table_size = ROUND_UP(table_size, s->cluster_size / sizeof(uint64_t)); 566 table_clusters = (table_size * sizeof(uint64_t)) / s->cluster_size; 567 568 if (table_size > QCOW_MAX_REFTABLE_SIZE) { 569 return -EFBIG; 570 } 571 572 new_table = g_try_new0(uint64_t, table_size); 573 574 assert(table_size > 0); 575 if (new_table == NULL) { 576 ret = -ENOMEM; 577 goto fail; 578 } 579 580 /* Fill the new refcount table */ 581 if (table_size > s->max_refcount_table_index) { 582 /* We're actually growing the reftable */ 583 memcpy(new_table, s->refcount_table, 584 (s->max_refcount_table_index + 1) * sizeof(uint64_t)); 585 } else { 586 /* Improbable case: We're shrinking the reftable. However, the caller 587 * has assured us that there is only empty space beyond @start_offset, 588 * so we can simply drop all of the refblocks that won't fit into the 589 * new reftable. */ 590 memcpy(new_table, s->refcount_table, table_size * sizeof(uint64_t)); 591 } 592 593 if (new_refblock_offset) { 594 assert(new_refblock_index < total_refblock_count); 595 new_table[new_refblock_index] = new_refblock_offset; 596 } 597 598 /* Count how many new refblocks we have to create */ 599 additional_refblock_count = 0; 600 for (i = area_reftable_index; i < total_refblock_count; i++) { 601 if (!new_table[i]) { 602 additional_refblock_count++; 603 } 604 } 605 606 table_offset = start_offset + additional_refblock_count * s->cluster_size; 607 end_offset = table_offset + table_clusters * s->cluster_size; 608 609 /* Fill the refcount blocks, and create new ones, if necessary */ 610 block_offset = start_offset; 611 for (i = area_reftable_index; i < total_refblock_count; i++) { 612 void *refblock_data; 613 uint64_t first_offset_covered; 614 615 /* Reuse an existing refblock if possible, create a new one otherwise */ 616 if (new_table[i]) { 617 ret = qcow2_cache_get(bs, s->refcount_block_cache, new_table[i], 618 &refblock_data); 619 if (ret < 0) { 620 goto fail; 621 } 622 } else { 623 ret = qcow2_cache_get_empty(bs, s->refcount_block_cache, 624 block_offset, &refblock_data); 625 if (ret < 0) { 626 goto fail; 627 } 628 memset(refblock_data, 0, s->cluster_size); 629 qcow2_cache_entry_mark_dirty(s->refcount_block_cache, 630 refblock_data); 631 632 new_table[i] = block_offset; 633 block_offset += s->cluster_size; 634 } 635 636 /* First host offset covered by this refblock */ 637 first_offset_covered = (uint64_t)i * s->refcount_block_size * 638 s->cluster_size; 639 if (first_offset_covered < end_offset) { 640 int j, end_index; 641 642 /* Set the refcount of all of the new refcount structures to 1 */ 643 644 if (first_offset_covered < start_offset) { 645 assert(i == area_reftable_index); 646 j = (start_offset - first_offset_covered) / s->cluster_size; 647 assert(j < s->refcount_block_size); 648 } else { 649 j = 0; 650 } 651 652 end_index = MIN((end_offset - first_offset_covered) / 653 s->cluster_size, 654 s->refcount_block_size); 655 656 for (; j < end_index; j++) { 657 /* The caller guaranteed us this space would be empty */ 658 assert(s->get_refcount(refblock_data, j) == 0); 659 s->set_refcount(refblock_data, j, 1); 660 } 661 662 qcow2_cache_entry_mark_dirty(s->refcount_block_cache, 663 refblock_data); 664 } 665 666 qcow2_cache_put(s->refcount_block_cache, &refblock_data); 667 } 668 669 assert(block_offset == table_offset); 670 671 /* Write refcount blocks to disk */ 672 BLKDBG_EVENT(bs->file, BLKDBG_REFBLOCK_ALLOC_WRITE_BLOCKS); 673 ret = qcow2_cache_flush(bs, s->refcount_block_cache); 674 if (ret < 0) { 675 goto fail; 676 } 677 678 /* Write refcount table to disk */ 679 for (i = 0; i < total_refblock_count; i++) { 680 cpu_to_be64s(&new_table[i]); 681 } 682 683 BLKDBG_EVENT(bs->file, BLKDBG_REFBLOCK_ALLOC_WRITE_TABLE); 684 ret = bdrv_pwrite_sync(bs->file, table_offset, new_table, 685 table_size * sizeof(uint64_t)); 686 if (ret < 0) { 687 goto fail; 688 } 689 690 for (i = 0; i < total_refblock_count; i++) { 691 be64_to_cpus(&new_table[i]); 692 } 693 694 /* Hook up the new refcount table in the qcow2 header */ 695 struct QEMU_PACKED { 696 uint64_t d64; 697 uint32_t d32; 698 } data; 699 data.d64 = cpu_to_be64(table_offset); 700 data.d32 = cpu_to_be32(table_clusters); 701 BLKDBG_EVENT(bs->file, BLKDBG_REFBLOCK_ALLOC_SWITCH_TABLE); 702 ret = bdrv_pwrite_sync(bs->file, 703 offsetof(QCowHeader, refcount_table_offset), 704 &data, sizeof(data)); 705 if (ret < 0) { 706 goto fail; 707 } 708 709 /* And switch it in memory */ 710 uint64_t old_table_offset = s->refcount_table_offset; 711 uint64_t old_table_size = s->refcount_table_size; 712 713 g_free(s->refcount_table); 714 s->refcount_table = new_table; 715 s->refcount_table_size = table_size; 716 s->refcount_table_offset = table_offset; 717 update_max_refcount_table_index(s); 718 719 /* Free old table. */ 720 qcow2_free_clusters(bs, old_table_offset, old_table_size * sizeof(uint64_t), 721 QCOW2_DISCARD_OTHER); 722 723 return end_offset; 724 725 fail: 726 g_free(new_table); 727 return ret; 728 } 729 730 void qcow2_process_discards(BlockDriverState *bs, int ret) 731 { 732 BDRVQcow2State *s = bs->opaque; 733 Qcow2DiscardRegion *d, *next; 734 735 QTAILQ_FOREACH_SAFE(d, &s->discards, next, next) { 736 QTAILQ_REMOVE(&s->discards, d, next); 737 738 /* Discard is optional, ignore the return value */ 739 if (ret >= 0) { 740 int r2 = bdrv_pdiscard(bs->file, d->offset, d->bytes); 741 if (r2 < 0) { 742 trace_qcow2_process_discards_failed_region(d->offset, d->bytes, 743 r2); 744 } 745 } 746 747 g_free(d); 748 } 749 } 750 751 static void update_refcount_discard(BlockDriverState *bs, 752 uint64_t offset, uint64_t length) 753 { 754 BDRVQcow2State *s = bs->opaque; 755 Qcow2DiscardRegion *d, *p, *next; 756 757 QTAILQ_FOREACH(d, &s->discards, next) { 758 uint64_t new_start = MIN(offset, d->offset); 759 uint64_t new_end = MAX(offset + length, d->offset + d->bytes); 760 761 if (new_end - new_start <= length + d->bytes) { 762 /* There can't be any overlap, areas ending up here have no 763 * references any more and therefore shouldn't get freed another 764 * time. */ 765 assert(d->bytes + length == new_end - new_start); 766 d->offset = new_start; 767 d->bytes = new_end - new_start; 768 goto found; 769 } 770 } 771 772 d = g_malloc(sizeof(*d)); 773 *d = (Qcow2DiscardRegion) { 774 .bs = bs, 775 .offset = offset, 776 .bytes = length, 777 }; 778 QTAILQ_INSERT_TAIL(&s->discards, d, next); 779 780 found: 781 /* Merge discard requests if they are adjacent now */ 782 QTAILQ_FOREACH_SAFE(p, &s->discards, next, next) { 783 if (p == d 784 || p->offset > d->offset + d->bytes 785 || d->offset > p->offset + p->bytes) 786 { 787 continue; 788 } 789 790 /* Still no overlap possible */ 791 assert(p->offset == d->offset + d->bytes 792 || d->offset == p->offset + p->bytes); 793 794 QTAILQ_REMOVE(&s->discards, p, next); 795 d->offset = MIN(d->offset, p->offset); 796 d->bytes += p->bytes; 797 g_free(p); 798 } 799 } 800 801 /* XXX: cache several refcount block clusters ? */ 802 /* @addend is the absolute value of the addend; if @decrease is set, @addend 803 * will be subtracted from the current refcount, otherwise it will be added */ 804 static int QEMU_WARN_UNUSED_RESULT update_refcount(BlockDriverState *bs, 805 int64_t offset, 806 int64_t length, 807 uint64_t addend, 808 bool decrease, 809 enum qcow2_discard_type type) 810 { 811 BDRVQcow2State *s = bs->opaque; 812 int64_t start, last, cluster_offset; 813 void *refcount_block = NULL; 814 int64_t old_table_index = -1; 815 int ret; 816 817 #ifdef DEBUG_ALLOC2 818 fprintf(stderr, "update_refcount: offset=%" PRId64 " size=%" PRId64 819 " addend=%s%" PRIu64 "\n", offset, length, decrease ? "-" : "", 820 addend); 821 #endif 822 if (length < 0) { 823 return -EINVAL; 824 } else if (length == 0) { 825 return 0; 826 } 827 828 if (decrease) { 829 qcow2_cache_set_dependency(bs, s->refcount_block_cache, 830 s->l2_table_cache); 831 } 832 833 start = start_of_cluster(s, offset); 834 last = start_of_cluster(s, offset + length - 1); 835 for(cluster_offset = start; cluster_offset <= last; 836 cluster_offset += s->cluster_size) 837 { 838 int block_index; 839 uint64_t refcount; 840 int64_t cluster_index = cluster_offset >> s->cluster_bits; 841 int64_t table_index = cluster_index >> s->refcount_block_bits; 842 843 /* Load the refcount block and allocate it if needed */ 844 if (table_index != old_table_index) { 845 if (refcount_block) { 846 qcow2_cache_put(s->refcount_block_cache, &refcount_block); 847 } 848 ret = alloc_refcount_block(bs, cluster_index, &refcount_block); 849 /* If the caller needs to restart the search for free clusters, 850 * try the same ones first to see if they're still free. */ 851 if (ret == -EAGAIN) { 852 if (s->free_cluster_index > (start >> s->cluster_bits)) { 853 s->free_cluster_index = (start >> s->cluster_bits); 854 } 855 } 856 if (ret < 0) { 857 goto fail; 858 } 859 } 860 old_table_index = table_index; 861 862 qcow2_cache_entry_mark_dirty(s->refcount_block_cache, refcount_block); 863 864 /* we can update the count and save it */ 865 block_index = cluster_index & (s->refcount_block_size - 1); 866 867 refcount = s->get_refcount(refcount_block, block_index); 868 if (decrease ? (refcount - addend > refcount) 869 : (refcount + addend < refcount || 870 refcount + addend > s->refcount_max)) 871 { 872 ret = -EINVAL; 873 goto fail; 874 } 875 if (decrease) { 876 refcount -= addend; 877 } else { 878 refcount += addend; 879 } 880 if (refcount == 0 && cluster_index < s->free_cluster_index) { 881 s->free_cluster_index = cluster_index; 882 } 883 s->set_refcount(refcount_block, block_index, refcount); 884 885 if (refcount == 0) { 886 void *table; 887 888 table = qcow2_cache_is_table_offset(s->refcount_block_cache, 889 offset); 890 if (table != NULL) { 891 qcow2_cache_put(s->refcount_block_cache, &refcount_block); 892 old_table_index = -1; 893 qcow2_cache_discard(s->refcount_block_cache, table); 894 } 895 896 table = qcow2_cache_is_table_offset(s->l2_table_cache, offset); 897 if (table != NULL) { 898 qcow2_cache_discard(s->l2_table_cache, table); 899 } 900 901 if (s->discard_passthrough[type]) { 902 update_refcount_discard(bs, cluster_offset, s->cluster_size); 903 } 904 } 905 } 906 907 ret = 0; 908 fail: 909 if (!s->cache_discards) { 910 qcow2_process_discards(bs, ret); 911 } 912 913 /* Write last changed block to disk */ 914 if (refcount_block) { 915 qcow2_cache_put(s->refcount_block_cache, &refcount_block); 916 } 917 918 /* 919 * Try do undo any updates if an error is returned (This may succeed in 920 * some cases like ENOSPC for allocating a new refcount block) 921 */ 922 if (ret < 0) { 923 int dummy; 924 dummy = update_refcount(bs, offset, cluster_offset - offset, addend, 925 !decrease, QCOW2_DISCARD_NEVER); 926 (void)dummy; 927 } 928 929 return ret; 930 } 931 932 /* 933 * Increases or decreases the refcount of a given cluster. 934 * 935 * @addend is the absolute value of the addend; if @decrease is set, @addend 936 * will be subtracted from the current refcount, otherwise it will be added. 937 * 938 * On success 0 is returned; on failure -errno is returned. 939 */ 940 int qcow2_update_cluster_refcount(BlockDriverState *bs, 941 int64_t cluster_index, 942 uint64_t addend, bool decrease, 943 enum qcow2_discard_type type) 944 { 945 BDRVQcow2State *s = bs->opaque; 946 int ret; 947 948 ret = update_refcount(bs, cluster_index << s->cluster_bits, 1, addend, 949 decrease, type); 950 if (ret < 0) { 951 return ret; 952 } 953 954 return 0; 955 } 956 957 958 959 /*********************************************************/ 960 /* cluster allocation functions */ 961 962 963 964 /* return < 0 if error */ 965 static int64_t alloc_clusters_noref(BlockDriverState *bs, uint64_t size, 966 uint64_t max) 967 { 968 BDRVQcow2State *s = bs->opaque; 969 uint64_t i, nb_clusters, refcount; 970 int ret; 971 972 /* We can't allocate clusters if they may still be queued for discard. */ 973 if (s->cache_discards) { 974 qcow2_process_discards(bs, 0); 975 } 976 977 nb_clusters = size_to_clusters(s, size); 978 retry: 979 for(i = 0; i < nb_clusters; i++) { 980 uint64_t next_cluster_index = s->free_cluster_index++; 981 ret = qcow2_get_refcount(bs, next_cluster_index, &refcount); 982 983 if (ret < 0) { 984 return ret; 985 } else if (refcount != 0) { 986 goto retry; 987 } 988 } 989 990 /* Make sure that all offsets in the "allocated" range are representable 991 * in the requested max */ 992 if (s->free_cluster_index > 0 && 993 s->free_cluster_index - 1 > (max >> s->cluster_bits)) 994 { 995 return -EFBIG; 996 } 997 998 #ifdef DEBUG_ALLOC2 999 fprintf(stderr, "alloc_clusters: size=%" PRId64 " -> %" PRId64 "\n", 1000 size, 1001 (s->free_cluster_index - nb_clusters) << s->cluster_bits); 1002 #endif 1003 return (s->free_cluster_index - nb_clusters) << s->cluster_bits; 1004 } 1005 1006 int64_t qcow2_alloc_clusters(BlockDriverState *bs, uint64_t size) 1007 { 1008 int64_t offset; 1009 int ret; 1010 1011 BLKDBG_EVENT(bs->file, BLKDBG_CLUSTER_ALLOC); 1012 do { 1013 offset = alloc_clusters_noref(bs, size, QCOW_MAX_CLUSTER_OFFSET); 1014 if (offset < 0) { 1015 return offset; 1016 } 1017 1018 ret = update_refcount(bs, offset, size, 1, false, QCOW2_DISCARD_NEVER); 1019 } while (ret == -EAGAIN); 1020 1021 if (ret < 0) { 1022 return ret; 1023 } 1024 1025 return offset; 1026 } 1027 1028 int64_t qcow2_alloc_clusters_at(BlockDriverState *bs, uint64_t offset, 1029 int64_t nb_clusters) 1030 { 1031 BDRVQcow2State *s = bs->opaque; 1032 uint64_t cluster_index, refcount; 1033 uint64_t i; 1034 int ret; 1035 1036 assert(nb_clusters >= 0); 1037 if (nb_clusters == 0) { 1038 return 0; 1039 } 1040 1041 do { 1042 /* Check how many clusters there are free */ 1043 cluster_index = offset >> s->cluster_bits; 1044 for(i = 0; i < nb_clusters; i++) { 1045 ret = qcow2_get_refcount(bs, cluster_index++, &refcount); 1046 if (ret < 0) { 1047 return ret; 1048 } else if (refcount != 0) { 1049 break; 1050 } 1051 } 1052 1053 /* And then allocate them */ 1054 ret = update_refcount(bs, offset, i << s->cluster_bits, 1, false, 1055 QCOW2_DISCARD_NEVER); 1056 } while (ret == -EAGAIN); 1057 1058 if (ret < 0) { 1059 return ret; 1060 } 1061 1062 return i; 1063 } 1064 1065 /* only used to allocate compressed sectors. We try to allocate 1066 contiguous sectors. size must be <= cluster_size */ 1067 int64_t qcow2_alloc_bytes(BlockDriverState *bs, int size) 1068 { 1069 BDRVQcow2State *s = bs->opaque; 1070 int64_t offset; 1071 size_t free_in_cluster; 1072 int ret; 1073 1074 BLKDBG_EVENT(bs->file, BLKDBG_CLUSTER_ALLOC_BYTES); 1075 assert(size > 0 && size <= s->cluster_size); 1076 assert(!s->free_byte_offset || offset_into_cluster(s, s->free_byte_offset)); 1077 1078 offset = s->free_byte_offset; 1079 1080 if (offset) { 1081 uint64_t refcount; 1082 ret = qcow2_get_refcount(bs, offset >> s->cluster_bits, &refcount); 1083 if (ret < 0) { 1084 return ret; 1085 } 1086 1087 if (refcount == s->refcount_max) { 1088 offset = 0; 1089 } 1090 } 1091 1092 free_in_cluster = s->cluster_size - offset_into_cluster(s, offset); 1093 do { 1094 if (!offset || free_in_cluster < size) { 1095 int64_t new_cluster; 1096 1097 new_cluster = alloc_clusters_noref(bs, s->cluster_size, 1098 MIN(s->cluster_offset_mask, 1099 QCOW_MAX_CLUSTER_OFFSET)); 1100 if (new_cluster < 0) { 1101 return new_cluster; 1102 } 1103 1104 if (new_cluster == 0) { 1105 qcow2_signal_corruption(bs, true, -1, -1, "Preventing invalid " 1106 "allocation of compressed cluster " 1107 "at offset 0"); 1108 return -EIO; 1109 } 1110 1111 if (!offset || ROUND_UP(offset, s->cluster_size) != new_cluster) { 1112 offset = new_cluster; 1113 free_in_cluster = s->cluster_size; 1114 } else { 1115 free_in_cluster += s->cluster_size; 1116 } 1117 } 1118 1119 assert(offset); 1120 ret = update_refcount(bs, offset, size, 1, false, QCOW2_DISCARD_NEVER); 1121 if (ret < 0) { 1122 offset = 0; 1123 } 1124 } while (ret == -EAGAIN); 1125 if (ret < 0) { 1126 return ret; 1127 } 1128 1129 /* The cluster refcount was incremented; refcount blocks must be flushed 1130 * before the caller's L2 table updates. */ 1131 qcow2_cache_set_dependency(bs, s->l2_table_cache, s->refcount_block_cache); 1132 1133 s->free_byte_offset = offset + size; 1134 if (!offset_into_cluster(s, s->free_byte_offset)) { 1135 s->free_byte_offset = 0; 1136 } 1137 1138 return offset; 1139 } 1140 1141 void qcow2_free_clusters(BlockDriverState *bs, 1142 int64_t offset, int64_t size, 1143 enum qcow2_discard_type type) 1144 { 1145 int ret; 1146 1147 BLKDBG_EVENT(bs->file, BLKDBG_CLUSTER_FREE); 1148 ret = update_refcount(bs, offset, size, 1, true, type); 1149 if (ret < 0) { 1150 fprintf(stderr, "qcow2_free_clusters failed: %s\n", strerror(-ret)); 1151 /* TODO Remember the clusters to free them later and avoid leaking */ 1152 } 1153 } 1154 1155 /* 1156 * Free a cluster using its L2 entry (handles clusters of all types, e.g. 1157 * normal cluster, compressed cluster, etc.) 1158 */ 1159 void qcow2_free_any_clusters(BlockDriverState *bs, uint64_t l2_entry, 1160 int nb_clusters, enum qcow2_discard_type type) 1161 { 1162 BDRVQcow2State *s = bs->opaque; 1163 QCow2ClusterType ctype = qcow2_get_cluster_type(bs, l2_entry); 1164 1165 if (has_data_file(bs)) { 1166 if (s->discard_passthrough[type] && 1167 (ctype == QCOW2_CLUSTER_NORMAL || 1168 ctype == QCOW2_CLUSTER_ZERO_ALLOC)) 1169 { 1170 bdrv_pdiscard(s->data_file, l2_entry & L2E_OFFSET_MASK, 1171 nb_clusters << s->cluster_bits); 1172 } 1173 return; 1174 } 1175 1176 switch (ctype) { 1177 case QCOW2_CLUSTER_COMPRESSED: 1178 { 1179 int64_t offset = (l2_entry & s->cluster_offset_mask) 1180 & QCOW2_COMPRESSED_SECTOR_MASK; 1181 int size = QCOW2_COMPRESSED_SECTOR_SIZE * 1182 (((l2_entry >> s->csize_shift) & s->csize_mask) + 1); 1183 qcow2_free_clusters(bs, offset, size, type); 1184 } 1185 break; 1186 case QCOW2_CLUSTER_NORMAL: 1187 case QCOW2_CLUSTER_ZERO_ALLOC: 1188 if (offset_into_cluster(s, l2_entry & L2E_OFFSET_MASK)) { 1189 qcow2_signal_corruption(bs, false, -1, -1, 1190 "Cannot free unaligned cluster %#llx", 1191 l2_entry & L2E_OFFSET_MASK); 1192 } else { 1193 qcow2_free_clusters(bs, l2_entry & L2E_OFFSET_MASK, 1194 nb_clusters << s->cluster_bits, type); 1195 } 1196 break; 1197 case QCOW2_CLUSTER_ZERO_PLAIN: 1198 case QCOW2_CLUSTER_UNALLOCATED: 1199 break; 1200 default: 1201 abort(); 1202 } 1203 } 1204 1205 int coroutine_fn qcow2_write_caches(BlockDriverState *bs) 1206 { 1207 BDRVQcow2State *s = bs->opaque; 1208 int ret; 1209 1210 ret = qcow2_cache_write(bs, s->l2_table_cache); 1211 if (ret < 0) { 1212 return ret; 1213 } 1214 1215 if (qcow2_need_accurate_refcounts(s)) { 1216 ret = qcow2_cache_write(bs, s->refcount_block_cache); 1217 if (ret < 0) { 1218 return ret; 1219 } 1220 } 1221 1222 return 0; 1223 } 1224 1225 int coroutine_fn qcow2_flush_caches(BlockDriverState *bs) 1226 { 1227 int ret = qcow2_write_caches(bs); 1228 if (ret < 0) { 1229 return ret; 1230 } 1231 1232 return bdrv_flush(bs->file->bs); 1233 } 1234 1235 /*********************************************************/ 1236 /* snapshots and image creation */ 1237 1238 1239 1240 /* update the refcounts of snapshots and the copied flag */ 1241 int qcow2_update_snapshot_refcount(BlockDriverState *bs, 1242 int64_t l1_table_offset, int l1_size, int addend) 1243 { 1244 BDRVQcow2State *s = bs->opaque; 1245 uint64_t *l1_table, *l2_slice, l2_offset, entry, l1_size2, refcount; 1246 bool l1_allocated = false; 1247 int64_t old_entry, old_l2_offset; 1248 unsigned slice, slice_size2, n_slices; 1249 int i, j, l1_modified = 0, nb_csectors; 1250 int ret; 1251 1252 assert(addend >= -1 && addend <= 1); 1253 1254 l2_slice = NULL; 1255 l1_table = NULL; 1256 l1_size2 = l1_size * sizeof(uint64_t); 1257 slice_size2 = s->l2_slice_size * sizeof(uint64_t); 1258 n_slices = s->cluster_size / slice_size2; 1259 1260 s->cache_discards = true; 1261 1262 /* WARNING: qcow2_snapshot_goto relies on this function not using the 1263 * l1_table_offset when it is the current s->l1_table_offset! Be careful 1264 * when changing this! */ 1265 if (l1_table_offset != s->l1_table_offset) { 1266 l1_table = g_try_malloc0(l1_size2); 1267 if (l1_size2 && l1_table == NULL) { 1268 ret = -ENOMEM; 1269 goto fail; 1270 } 1271 l1_allocated = true; 1272 1273 ret = bdrv_pread(bs->file, l1_table_offset, l1_table, l1_size2); 1274 if (ret < 0) { 1275 goto fail; 1276 } 1277 1278 for (i = 0; i < l1_size; i++) { 1279 be64_to_cpus(&l1_table[i]); 1280 } 1281 } else { 1282 assert(l1_size == s->l1_size); 1283 l1_table = s->l1_table; 1284 l1_allocated = false; 1285 } 1286 1287 for (i = 0; i < l1_size; i++) { 1288 l2_offset = l1_table[i]; 1289 if (l2_offset) { 1290 old_l2_offset = l2_offset; 1291 l2_offset &= L1E_OFFSET_MASK; 1292 1293 if (offset_into_cluster(s, l2_offset)) { 1294 qcow2_signal_corruption(bs, true, -1, -1, "L2 table offset %#" 1295 PRIx64 " unaligned (L1 index: %#x)", 1296 l2_offset, i); 1297 ret = -EIO; 1298 goto fail; 1299 } 1300 1301 for (slice = 0; slice < n_slices; slice++) { 1302 ret = qcow2_cache_get(bs, s->l2_table_cache, 1303 l2_offset + slice * slice_size2, 1304 (void **) &l2_slice); 1305 if (ret < 0) { 1306 goto fail; 1307 } 1308 1309 for (j = 0; j < s->l2_slice_size; j++) { 1310 uint64_t cluster_index; 1311 uint64_t offset; 1312 1313 entry = be64_to_cpu(l2_slice[j]); 1314 old_entry = entry; 1315 entry &= ~QCOW_OFLAG_COPIED; 1316 offset = entry & L2E_OFFSET_MASK; 1317 1318 switch (qcow2_get_cluster_type(bs, entry)) { 1319 case QCOW2_CLUSTER_COMPRESSED: 1320 nb_csectors = ((entry >> s->csize_shift) & 1321 s->csize_mask) + 1; 1322 if (addend != 0) { 1323 uint64_t coffset = (entry & s->cluster_offset_mask) 1324 & QCOW2_COMPRESSED_SECTOR_MASK; 1325 ret = update_refcount( 1326 bs, coffset, 1327 nb_csectors * QCOW2_COMPRESSED_SECTOR_SIZE, 1328 abs(addend), addend < 0, 1329 QCOW2_DISCARD_SNAPSHOT); 1330 if (ret < 0) { 1331 goto fail; 1332 } 1333 } 1334 /* compressed clusters are never modified */ 1335 refcount = 2; 1336 break; 1337 1338 case QCOW2_CLUSTER_NORMAL: 1339 case QCOW2_CLUSTER_ZERO_ALLOC: 1340 if (offset_into_cluster(s, offset)) { 1341 /* Here l2_index means table (not slice) index */ 1342 int l2_index = slice * s->l2_slice_size + j; 1343 qcow2_signal_corruption( 1344 bs, true, -1, -1, "Cluster " 1345 "allocation offset %#" PRIx64 1346 " unaligned (L2 offset: %#" 1347 PRIx64 ", L2 index: %#x)", 1348 offset, l2_offset, l2_index); 1349 ret = -EIO; 1350 goto fail; 1351 } 1352 1353 cluster_index = offset >> s->cluster_bits; 1354 assert(cluster_index); 1355 if (addend != 0) { 1356 ret = qcow2_update_cluster_refcount( 1357 bs, cluster_index, abs(addend), addend < 0, 1358 QCOW2_DISCARD_SNAPSHOT); 1359 if (ret < 0) { 1360 goto fail; 1361 } 1362 } 1363 1364 ret = qcow2_get_refcount(bs, cluster_index, &refcount); 1365 if (ret < 0) { 1366 goto fail; 1367 } 1368 break; 1369 1370 case QCOW2_CLUSTER_ZERO_PLAIN: 1371 case QCOW2_CLUSTER_UNALLOCATED: 1372 refcount = 0; 1373 break; 1374 1375 default: 1376 abort(); 1377 } 1378 1379 if (refcount == 1) { 1380 entry |= QCOW_OFLAG_COPIED; 1381 } 1382 if (entry != old_entry) { 1383 if (addend > 0) { 1384 qcow2_cache_set_dependency(bs, s->l2_table_cache, 1385 s->refcount_block_cache); 1386 } 1387 l2_slice[j] = cpu_to_be64(entry); 1388 qcow2_cache_entry_mark_dirty(s->l2_table_cache, 1389 l2_slice); 1390 } 1391 } 1392 1393 qcow2_cache_put(s->l2_table_cache, (void **) &l2_slice); 1394 } 1395 1396 if (addend != 0) { 1397 ret = qcow2_update_cluster_refcount(bs, l2_offset >> 1398 s->cluster_bits, 1399 abs(addend), addend < 0, 1400 QCOW2_DISCARD_SNAPSHOT); 1401 if (ret < 0) { 1402 goto fail; 1403 } 1404 } 1405 ret = qcow2_get_refcount(bs, l2_offset >> s->cluster_bits, 1406 &refcount); 1407 if (ret < 0) { 1408 goto fail; 1409 } else if (refcount == 1) { 1410 l2_offset |= QCOW_OFLAG_COPIED; 1411 } 1412 if (l2_offset != old_l2_offset) { 1413 l1_table[i] = l2_offset; 1414 l1_modified = 1; 1415 } 1416 } 1417 } 1418 1419 ret = bdrv_flush(bs); 1420 fail: 1421 if (l2_slice) { 1422 qcow2_cache_put(s->l2_table_cache, (void **) &l2_slice); 1423 } 1424 1425 s->cache_discards = false; 1426 qcow2_process_discards(bs, ret); 1427 1428 /* Update L1 only if it isn't deleted anyway (addend = -1) */ 1429 if (ret == 0 && addend >= 0 && l1_modified) { 1430 for (i = 0; i < l1_size; i++) { 1431 cpu_to_be64s(&l1_table[i]); 1432 } 1433 1434 ret = bdrv_pwrite_sync(bs->file, l1_table_offset, 1435 l1_table, l1_size2); 1436 1437 for (i = 0; i < l1_size; i++) { 1438 be64_to_cpus(&l1_table[i]); 1439 } 1440 } 1441 if (l1_allocated) 1442 g_free(l1_table); 1443 return ret; 1444 } 1445 1446 1447 1448 1449 /*********************************************************/ 1450 /* refcount checking functions */ 1451 1452 1453 static uint64_t refcount_array_byte_size(BDRVQcow2State *s, uint64_t entries) 1454 { 1455 /* This assertion holds because there is no way we can address more than 1456 * 2^(64 - 9) clusters at once (with cluster size 512 = 2^9, and because 1457 * offsets have to be representable in bytes); due to every cluster 1458 * corresponding to one refcount entry, we are well below that limit */ 1459 assert(entries < (UINT64_C(1) << (64 - 9))); 1460 1461 /* Thanks to the assertion this will not overflow, because 1462 * s->refcount_order < 7. 1463 * (note: x << s->refcount_order == x * s->refcount_bits) */ 1464 return DIV_ROUND_UP(entries << s->refcount_order, 8); 1465 } 1466 1467 /** 1468 * Reallocates *array so that it can hold new_size entries. *size must contain 1469 * the current number of entries in *array. If the reallocation fails, *array 1470 * and *size will not be modified and -errno will be returned. If the 1471 * reallocation is successful, *array will be set to the new buffer, *size 1472 * will be set to new_size and 0 will be returned. The size of the reallocated 1473 * refcount array buffer will be aligned to a cluster boundary, and the newly 1474 * allocated area will be zeroed. 1475 */ 1476 static int realloc_refcount_array(BDRVQcow2State *s, void **array, 1477 int64_t *size, int64_t new_size) 1478 { 1479 int64_t old_byte_size, new_byte_size; 1480 void *new_ptr; 1481 1482 /* Round to clusters so the array can be directly written to disk */ 1483 old_byte_size = size_to_clusters(s, refcount_array_byte_size(s, *size)) 1484 * s->cluster_size; 1485 new_byte_size = size_to_clusters(s, refcount_array_byte_size(s, new_size)) 1486 * s->cluster_size; 1487 1488 if (new_byte_size == old_byte_size) { 1489 *size = new_size; 1490 return 0; 1491 } 1492 1493 assert(new_byte_size > 0); 1494 1495 if (new_byte_size > SIZE_MAX) { 1496 return -ENOMEM; 1497 } 1498 1499 new_ptr = g_try_realloc(*array, new_byte_size); 1500 if (!new_ptr) { 1501 return -ENOMEM; 1502 } 1503 1504 if (new_byte_size > old_byte_size) { 1505 memset((char *)new_ptr + old_byte_size, 0, 1506 new_byte_size - old_byte_size); 1507 } 1508 1509 *array = new_ptr; 1510 *size = new_size; 1511 1512 return 0; 1513 } 1514 1515 /* 1516 * Increases the refcount for a range of clusters in a given refcount table. 1517 * This is used to construct a temporary refcount table out of L1 and L2 tables 1518 * which can be compared to the refcount table saved in the image. 1519 * 1520 * Modifies the number of errors in res. 1521 */ 1522 int qcow2_inc_refcounts_imrt(BlockDriverState *bs, BdrvCheckResult *res, 1523 void **refcount_table, 1524 int64_t *refcount_table_size, 1525 int64_t offset, int64_t size) 1526 { 1527 BDRVQcow2State *s = bs->opaque; 1528 uint64_t start, last, cluster_offset, k, refcount; 1529 int64_t file_len; 1530 int ret; 1531 1532 if (size <= 0) { 1533 return 0; 1534 } 1535 1536 file_len = bdrv_getlength(bs->file->bs); 1537 if (file_len < 0) { 1538 return file_len; 1539 } 1540 1541 /* 1542 * Last cluster of qcow2 image may be semi-allocated, so it may be OK to 1543 * reference some space after file end but it should be less than one 1544 * cluster. 1545 */ 1546 if (offset + size - file_len >= s->cluster_size) { 1547 fprintf(stderr, "ERROR: counting reference for region exceeding the " 1548 "end of the file by one cluster or more: offset 0x%" PRIx64 1549 " size 0x%" PRIx64 "\n", offset, size); 1550 res->corruptions++; 1551 return 0; 1552 } 1553 1554 start = start_of_cluster(s, offset); 1555 last = start_of_cluster(s, offset + size - 1); 1556 for(cluster_offset = start; cluster_offset <= last; 1557 cluster_offset += s->cluster_size) { 1558 k = cluster_offset >> s->cluster_bits; 1559 if (k >= *refcount_table_size) { 1560 ret = realloc_refcount_array(s, refcount_table, 1561 refcount_table_size, k + 1); 1562 if (ret < 0) { 1563 res->check_errors++; 1564 return ret; 1565 } 1566 } 1567 1568 refcount = s->get_refcount(*refcount_table, k); 1569 if (refcount == s->refcount_max) { 1570 fprintf(stderr, "ERROR: overflow cluster offset=0x%" PRIx64 1571 "\n", cluster_offset); 1572 fprintf(stderr, "Use qemu-img amend to increase the refcount entry " 1573 "width or qemu-img convert to create a clean copy if the " 1574 "image cannot be opened for writing\n"); 1575 res->corruptions++; 1576 continue; 1577 } 1578 s->set_refcount(*refcount_table, k, refcount + 1); 1579 } 1580 1581 return 0; 1582 } 1583 1584 /* Flags for check_refcounts_l1() and check_refcounts_l2() */ 1585 enum { 1586 CHECK_FRAG_INFO = 0x2, /* update BlockFragInfo counters */ 1587 }; 1588 1589 /* 1590 * Increases the refcount in the given refcount table for the all clusters 1591 * referenced in the L2 table. While doing so, performs some checks on L2 1592 * entries. 1593 * 1594 * Returns the number of errors found by the checks or -errno if an internal 1595 * error occurred. 1596 */ 1597 static int check_refcounts_l2(BlockDriverState *bs, BdrvCheckResult *res, 1598 void **refcount_table, 1599 int64_t *refcount_table_size, int64_t l2_offset, 1600 int flags, BdrvCheckMode fix, bool active) 1601 { 1602 BDRVQcow2State *s = bs->opaque; 1603 uint64_t *l2_table, l2_entry; 1604 uint64_t next_contiguous_offset = 0; 1605 int i, l2_size, nb_csectors, ret; 1606 1607 /* Read L2 table from disk */ 1608 l2_size = s->l2_size * sizeof(uint64_t); 1609 l2_table = g_malloc(l2_size); 1610 1611 ret = bdrv_pread(bs->file, l2_offset, l2_table, l2_size); 1612 if (ret < 0) { 1613 fprintf(stderr, "ERROR: I/O error in check_refcounts_l2\n"); 1614 res->check_errors++; 1615 goto fail; 1616 } 1617 1618 /* Do the actual checks */ 1619 for(i = 0; i < s->l2_size; i++) { 1620 l2_entry = be64_to_cpu(l2_table[i]); 1621 1622 switch (qcow2_get_cluster_type(bs, l2_entry)) { 1623 case QCOW2_CLUSTER_COMPRESSED: 1624 /* Compressed clusters don't have QCOW_OFLAG_COPIED */ 1625 if (l2_entry & QCOW_OFLAG_COPIED) { 1626 fprintf(stderr, "ERROR: coffset=0x%" PRIx64 ": " 1627 "copied flag must never be set for compressed " 1628 "clusters\n", l2_entry & s->cluster_offset_mask); 1629 l2_entry &= ~QCOW_OFLAG_COPIED; 1630 res->corruptions++; 1631 } 1632 1633 if (has_data_file(bs)) { 1634 fprintf(stderr, "ERROR compressed cluster %d with data file, " 1635 "entry=0x%" PRIx64 "\n", i, l2_entry); 1636 res->corruptions++; 1637 break; 1638 } 1639 1640 /* Mark cluster as used */ 1641 nb_csectors = ((l2_entry >> s->csize_shift) & 1642 s->csize_mask) + 1; 1643 l2_entry &= s->cluster_offset_mask; 1644 ret = qcow2_inc_refcounts_imrt( 1645 bs, res, refcount_table, refcount_table_size, 1646 l2_entry & QCOW2_COMPRESSED_SECTOR_MASK, 1647 nb_csectors * QCOW2_COMPRESSED_SECTOR_SIZE); 1648 if (ret < 0) { 1649 goto fail; 1650 } 1651 1652 if (flags & CHECK_FRAG_INFO) { 1653 res->bfi.allocated_clusters++; 1654 res->bfi.compressed_clusters++; 1655 1656 /* Compressed clusters are fragmented by nature. Since they 1657 * take up sub-sector space but we only have sector granularity 1658 * I/O we need to re-read the same sectors even for adjacent 1659 * compressed clusters. 1660 */ 1661 res->bfi.fragmented_clusters++; 1662 } 1663 break; 1664 1665 case QCOW2_CLUSTER_ZERO_ALLOC: 1666 case QCOW2_CLUSTER_NORMAL: 1667 { 1668 uint64_t offset = l2_entry & L2E_OFFSET_MASK; 1669 1670 /* Correct offsets are cluster aligned */ 1671 if (offset_into_cluster(s, offset)) { 1672 res->corruptions++; 1673 1674 if (qcow2_get_cluster_type(bs, l2_entry) == 1675 QCOW2_CLUSTER_ZERO_ALLOC) 1676 { 1677 fprintf(stderr, "%s offset=%" PRIx64 ": Preallocated zero " 1678 "cluster is not properly aligned; L2 entry " 1679 "corrupted.\n", 1680 fix & BDRV_FIX_ERRORS ? "Repairing" : "ERROR", 1681 offset); 1682 if (fix & BDRV_FIX_ERRORS) { 1683 uint64_t l2e_offset = 1684 l2_offset + (uint64_t)i * sizeof(uint64_t); 1685 int ign = active ? QCOW2_OL_ACTIVE_L2 : 1686 QCOW2_OL_INACTIVE_L2; 1687 1688 l2_entry = QCOW_OFLAG_ZERO; 1689 l2_table[i] = cpu_to_be64(l2_entry); 1690 ret = qcow2_pre_write_overlap_check(bs, ign, 1691 l2e_offset, sizeof(uint64_t), false); 1692 if (ret < 0) { 1693 fprintf(stderr, "ERROR: Overlap check failed\n"); 1694 res->check_errors++; 1695 /* Something is seriously wrong, so abort checking 1696 * this L2 table */ 1697 goto fail; 1698 } 1699 1700 ret = bdrv_pwrite_sync(bs->file, l2e_offset, 1701 &l2_table[i], sizeof(uint64_t)); 1702 if (ret < 0) { 1703 fprintf(stderr, "ERROR: Failed to overwrite L2 " 1704 "table entry: %s\n", strerror(-ret)); 1705 res->check_errors++; 1706 /* Do not abort, continue checking the rest of this 1707 * L2 table's entries */ 1708 } else { 1709 res->corruptions--; 1710 res->corruptions_fixed++; 1711 /* Skip marking the cluster as used 1712 * (it is unused now) */ 1713 continue; 1714 } 1715 } 1716 } else { 1717 fprintf(stderr, "ERROR offset=%" PRIx64 ": Data cluster is " 1718 "not properly aligned; L2 entry corrupted.\n", offset); 1719 } 1720 } 1721 1722 if (flags & CHECK_FRAG_INFO) { 1723 res->bfi.allocated_clusters++; 1724 if (next_contiguous_offset && 1725 offset != next_contiguous_offset) { 1726 res->bfi.fragmented_clusters++; 1727 } 1728 next_contiguous_offset = offset + s->cluster_size; 1729 } 1730 1731 /* Mark cluster as used */ 1732 if (!has_data_file(bs)) { 1733 ret = qcow2_inc_refcounts_imrt(bs, res, refcount_table, 1734 refcount_table_size, 1735 offset, s->cluster_size); 1736 if (ret < 0) { 1737 goto fail; 1738 } 1739 } 1740 break; 1741 } 1742 1743 case QCOW2_CLUSTER_ZERO_PLAIN: 1744 case QCOW2_CLUSTER_UNALLOCATED: 1745 break; 1746 1747 default: 1748 abort(); 1749 } 1750 } 1751 1752 g_free(l2_table); 1753 return 0; 1754 1755 fail: 1756 g_free(l2_table); 1757 return ret; 1758 } 1759 1760 /* 1761 * Increases the refcount for the L1 table, its L2 tables and all referenced 1762 * clusters in the given refcount table. While doing so, performs some checks 1763 * on L1 and L2 entries. 1764 * 1765 * Returns the number of errors found by the checks or -errno if an internal 1766 * error occurred. 1767 */ 1768 static int check_refcounts_l1(BlockDriverState *bs, 1769 BdrvCheckResult *res, 1770 void **refcount_table, 1771 int64_t *refcount_table_size, 1772 int64_t l1_table_offset, int l1_size, 1773 int flags, BdrvCheckMode fix, bool active) 1774 { 1775 BDRVQcow2State *s = bs->opaque; 1776 uint64_t *l1_table = NULL, l2_offset, l1_size2; 1777 int i, ret; 1778 1779 l1_size2 = l1_size * sizeof(uint64_t); 1780 1781 /* Mark L1 table as used */ 1782 ret = qcow2_inc_refcounts_imrt(bs, res, refcount_table, refcount_table_size, 1783 l1_table_offset, l1_size2); 1784 if (ret < 0) { 1785 goto fail; 1786 } 1787 1788 /* Read L1 table entries from disk */ 1789 if (l1_size2 > 0) { 1790 l1_table = g_try_malloc(l1_size2); 1791 if (l1_table == NULL) { 1792 ret = -ENOMEM; 1793 res->check_errors++; 1794 goto fail; 1795 } 1796 ret = bdrv_pread(bs->file, l1_table_offset, l1_table, l1_size2); 1797 if (ret < 0) { 1798 fprintf(stderr, "ERROR: I/O error in check_refcounts_l1\n"); 1799 res->check_errors++; 1800 goto fail; 1801 } 1802 for(i = 0;i < l1_size; i++) 1803 be64_to_cpus(&l1_table[i]); 1804 } 1805 1806 /* Do the actual checks */ 1807 for(i = 0; i < l1_size; i++) { 1808 l2_offset = l1_table[i]; 1809 if (l2_offset) { 1810 /* Mark L2 table as used */ 1811 l2_offset &= L1E_OFFSET_MASK; 1812 ret = qcow2_inc_refcounts_imrt(bs, res, 1813 refcount_table, refcount_table_size, 1814 l2_offset, s->cluster_size); 1815 if (ret < 0) { 1816 goto fail; 1817 } 1818 1819 /* L2 tables are cluster aligned */ 1820 if (offset_into_cluster(s, l2_offset)) { 1821 fprintf(stderr, "ERROR l2_offset=%" PRIx64 ": Table is not " 1822 "cluster aligned; L1 entry corrupted\n", l2_offset); 1823 res->corruptions++; 1824 } 1825 1826 /* Process and check L2 entries */ 1827 ret = check_refcounts_l2(bs, res, refcount_table, 1828 refcount_table_size, l2_offset, flags, 1829 fix, active); 1830 if (ret < 0) { 1831 goto fail; 1832 } 1833 } 1834 } 1835 g_free(l1_table); 1836 return 0; 1837 1838 fail: 1839 g_free(l1_table); 1840 return ret; 1841 } 1842 1843 /* 1844 * Checks the OFLAG_COPIED flag for all L1 and L2 entries. 1845 * 1846 * This function does not print an error message nor does it increment 1847 * check_errors if qcow2_get_refcount fails (this is because such an error will 1848 * have been already detected and sufficiently signaled by the calling function 1849 * (qcow2_check_refcounts) by the time this function is called). 1850 */ 1851 static int check_oflag_copied(BlockDriverState *bs, BdrvCheckResult *res, 1852 BdrvCheckMode fix) 1853 { 1854 BDRVQcow2State *s = bs->opaque; 1855 uint64_t *l2_table = qemu_blockalign(bs, s->cluster_size); 1856 int ret; 1857 uint64_t refcount; 1858 int i, j; 1859 bool repair; 1860 1861 if (fix & BDRV_FIX_ERRORS) { 1862 /* Always repair */ 1863 repair = true; 1864 } else if (fix & BDRV_FIX_LEAKS) { 1865 /* Repair only if that seems safe: This function is always 1866 * called after the refcounts have been fixed, so the refcount 1867 * is accurate if that repair was successful */ 1868 repair = !res->check_errors && !res->corruptions && !res->leaks; 1869 } else { 1870 repair = false; 1871 } 1872 1873 for (i = 0; i < s->l1_size; i++) { 1874 uint64_t l1_entry = s->l1_table[i]; 1875 uint64_t l2_offset = l1_entry & L1E_OFFSET_MASK; 1876 int l2_dirty = 0; 1877 1878 if (!l2_offset) { 1879 continue; 1880 } 1881 1882 ret = qcow2_get_refcount(bs, l2_offset >> s->cluster_bits, 1883 &refcount); 1884 if (ret < 0) { 1885 /* don't print message nor increment check_errors */ 1886 continue; 1887 } 1888 if ((refcount == 1) != ((l1_entry & QCOW_OFLAG_COPIED) != 0)) { 1889 res->corruptions++; 1890 fprintf(stderr, "%s OFLAG_COPIED L2 cluster: l1_index=%d " 1891 "l1_entry=%" PRIx64 " refcount=%" PRIu64 "\n", 1892 repair ? "Repairing" : "ERROR", i, l1_entry, refcount); 1893 if (repair) { 1894 s->l1_table[i] = refcount == 1 1895 ? l1_entry | QCOW_OFLAG_COPIED 1896 : l1_entry & ~QCOW_OFLAG_COPIED; 1897 ret = qcow2_write_l1_entry(bs, i); 1898 if (ret < 0) { 1899 res->check_errors++; 1900 goto fail; 1901 } 1902 res->corruptions--; 1903 res->corruptions_fixed++; 1904 } 1905 } 1906 1907 ret = bdrv_pread(bs->file, l2_offset, l2_table, 1908 s->l2_size * sizeof(uint64_t)); 1909 if (ret < 0) { 1910 fprintf(stderr, "ERROR: Could not read L2 table: %s\n", 1911 strerror(-ret)); 1912 res->check_errors++; 1913 goto fail; 1914 } 1915 1916 for (j = 0; j < s->l2_size; j++) { 1917 uint64_t l2_entry = be64_to_cpu(l2_table[j]); 1918 uint64_t data_offset = l2_entry & L2E_OFFSET_MASK; 1919 QCow2ClusterType cluster_type = qcow2_get_cluster_type(bs, l2_entry); 1920 1921 if (cluster_type == QCOW2_CLUSTER_NORMAL || 1922 cluster_type == QCOW2_CLUSTER_ZERO_ALLOC) { 1923 if (has_data_file(bs)) { 1924 refcount = 1; 1925 } else { 1926 ret = qcow2_get_refcount(bs, 1927 data_offset >> s->cluster_bits, 1928 &refcount); 1929 if (ret < 0) { 1930 /* don't print message nor increment check_errors */ 1931 continue; 1932 } 1933 } 1934 if ((refcount == 1) != ((l2_entry & QCOW_OFLAG_COPIED) != 0)) { 1935 res->corruptions++; 1936 fprintf(stderr, "%s OFLAG_COPIED data cluster: " 1937 "l2_entry=%" PRIx64 " refcount=%" PRIu64 "\n", 1938 repair ? "Repairing" : "ERROR", l2_entry, refcount); 1939 if (repair) { 1940 l2_table[j] = cpu_to_be64(refcount == 1 1941 ? l2_entry | QCOW_OFLAG_COPIED 1942 : l2_entry & ~QCOW_OFLAG_COPIED); 1943 l2_dirty++; 1944 } 1945 } 1946 } 1947 } 1948 1949 if (l2_dirty > 0) { 1950 ret = qcow2_pre_write_overlap_check(bs, QCOW2_OL_ACTIVE_L2, 1951 l2_offset, s->cluster_size, 1952 false); 1953 if (ret < 0) { 1954 fprintf(stderr, "ERROR: Could not write L2 table; metadata " 1955 "overlap check failed: %s\n", strerror(-ret)); 1956 res->check_errors++; 1957 goto fail; 1958 } 1959 1960 ret = bdrv_pwrite(bs->file, l2_offset, l2_table, 1961 s->cluster_size); 1962 if (ret < 0) { 1963 fprintf(stderr, "ERROR: Could not write L2 table: %s\n", 1964 strerror(-ret)); 1965 res->check_errors++; 1966 goto fail; 1967 } 1968 res->corruptions -= l2_dirty; 1969 res->corruptions_fixed += l2_dirty; 1970 } 1971 } 1972 1973 ret = 0; 1974 1975 fail: 1976 qemu_vfree(l2_table); 1977 return ret; 1978 } 1979 1980 /* 1981 * Checks consistency of refblocks and accounts for each refblock in 1982 * *refcount_table. 1983 */ 1984 static int check_refblocks(BlockDriverState *bs, BdrvCheckResult *res, 1985 BdrvCheckMode fix, bool *rebuild, 1986 void **refcount_table, int64_t *nb_clusters) 1987 { 1988 BDRVQcow2State *s = bs->opaque; 1989 int64_t i, size; 1990 int ret; 1991 1992 for(i = 0; i < s->refcount_table_size; i++) { 1993 uint64_t offset, cluster; 1994 offset = s->refcount_table[i]; 1995 cluster = offset >> s->cluster_bits; 1996 1997 /* Refcount blocks are cluster aligned */ 1998 if (offset_into_cluster(s, offset)) { 1999 fprintf(stderr, "ERROR refcount block %" PRId64 " is not " 2000 "cluster aligned; refcount table entry corrupted\n", i); 2001 res->corruptions++; 2002 *rebuild = true; 2003 continue; 2004 } 2005 2006 if (cluster >= *nb_clusters) { 2007 res->corruptions++; 2008 fprintf(stderr, "%s refcount block %" PRId64 " is outside image\n", 2009 fix & BDRV_FIX_ERRORS ? "Repairing" : "ERROR", i); 2010 2011 if (fix & BDRV_FIX_ERRORS) { 2012 int64_t new_nb_clusters; 2013 Error *local_err = NULL; 2014 2015 if (offset > INT64_MAX - s->cluster_size) { 2016 ret = -EINVAL; 2017 goto resize_fail; 2018 } 2019 2020 ret = bdrv_truncate(bs->file, offset + s->cluster_size, false, 2021 PREALLOC_MODE_OFF, 0, &local_err); 2022 if (ret < 0) { 2023 error_report_err(local_err); 2024 goto resize_fail; 2025 } 2026 size = bdrv_getlength(bs->file->bs); 2027 if (size < 0) { 2028 ret = size; 2029 goto resize_fail; 2030 } 2031 2032 new_nb_clusters = size_to_clusters(s, size); 2033 assert(new_nb_clusters >= *nb_clusters); 2034 2035 ret = realloc_refcount_array(s, refcount_table, 2036 nb_clusters, new_nb_clusters); 2037 if (ret < 0) { 2038 res->check_errors++; 2039 return ret; 2040 } 2041 2042 if (cluster >= *nb_clusters) { 2043 ret = -EINVAL; 2044 goto resize_fail; 2045 } 2046 2047 res->corruptions--; 2048 res->corruptions_fixed++; 2049 ret = qcow2_inc_refcounts_imrt(bs, res, 2050 refcount_table, nb_clusters, 2051 offset, s->cluster_size); 2052 if (ret < 0) { 2053 return ret; 2054 } 2055 /* No need to check whether the refcount is now greater than 1: 2056 * This area was just allocated and zeroed, so it can only be 2057 * exactly 1 after qcow2_inc_refcounts_imrt() */ 2058 continue; 2059 2060 resize_fail: 2061 *rebuild = true; 2062 fprintf(stderr, "ERROR could not resize image: %s\n", 2063 strerror(-ret)); 2064 } 2065 continue; 2066 } 2067 2068 if (offset != 0) { 2069 ret = qcow2_inc_refcounts_imrt(bs, res, refcount_table, nb_clusters, 2070 offset, s->cluster_size); 2071 if (ret < 0) { 2072 return ret; 2073 } 2074 if (s->get_refcount(*refcount_table, cluster) != 1) { 2075 fprintf(stderr, "ERROR refcount block %" PRId64 2076 " refcount=%" PRIu64 "\n", i, 2077 s->get_refcount(*refcount_table, cluster)); 2078 res->corruptions++; 2079 *rebuild = true; 2080 } 2081 } 2082 } 2083 2084 return 0; 2085 } 2086 2087 /* 2088 * Calculates an in-memory refcount table. 2089 */ 2090 static int calculate_refcounts(BlockDriverState *bs, BdrvCheckResult *res, 2091 BdrvCheckMode fix, bool *rebuild, 2092 void **refcount_table, int64_t *nb_clusters) 2093 { 2094 BDRVQcow2State *s = bs->opaque; 2095 int64_t i; 2096 QCowSnapshot *sn; 2097 int ret; 2098 2099 if (!*refcount_table) { 2100 int64_t old_size = 0; 2101 ret = realloc_refcount_array(s, refcount_table, 2102 &old_size, *nb_clusters); 2103 if (ret < 0) { 2104 res->check_errors++; 2105 return ret; 2106 } 2107 } 2108 2109 /* header */ 2110 ret = qcow2_inc_refcounts_imrt(bs, res, refcount_table, nb_clusters, 2111 0, s->cluster_size); 2112 if (ret < 0) { 2113 return ret; 2114 } 2115 2116 /* current L1 table */ 2117 ret = check_refcounts_l1(bs, res, refcount_table, nb_clusters, 2118 s->l1_table_offset, s->l1_size, CHECK_FRAG_INFO, 2119 fix, true); 2120 if (ret < 0) { 2121 return ret; 2122 } 2123 2124 /* snapshots */ 2125 if (has_data_file(bs) && s->nb_snapshots) { 2126 fprintf(stderr, "ERROR %d snapshots in image with data file\n", 2127 s->nb_snapshots); 2128 res->corruptions++; 2129 } 2130 2131 for (i = 0; i < s->nb_snapshots; i++) { 2132 sn = s->snapshots + i; 2133 if (offset_into_cluster(s, sn->l1_table_offset)) { 2134 fprintf(stderr, "ERROR snapshot %s (%s) l1_offset=%#" PRIx64 ": " 2135 "L1 table is not cluster aligned; snapshot table entry " 2136 "corrupted\n", sn->id_str, sn->name, sn->l1_table_offset); 2137 res->corruptions++; 2138 continue; 2139 } 2140 if (sn->l1_size > QCOW_MAX_L1_SIZE / sizeof(uint64_t)) { 2141 fprintf(stderr, "ERROR snapshot %s (%s) l1_size=%#" PRIx32 ": " 2142 "L1 table is too large; snapshot table entry corrupted\n", 2143 sn->id_str, sn->name, sn->l1_size); 2144 res->corruptions++; 2145 continue; 2146 } 2147 ret = check_refcounts_l1(bs, res, refcount_table, nb_clusters, 2148 sn->l1_table_offset, sn->l1_size, 0, fix, 2149 false); 2150 if (ret < 0) { 2151 return ret; 2152 } 2153 } 2154 ret = qcow2_inc_refcounts_imrt(bs, res, refcount_table, nb_clusters, 2155 s->snapshots_offset, s->snapshots_size); 2156 if (ret < 0) { 2157 return ret; 2158 } 2159 2160 /* refcount data */ 2161 ret = qcow2_inc_refcounts_imrt(bs, res, refcount_table, nb_clusters, 2162 s->refcount_table_offset, 2163 s->refcount_table_size * sizeof(uint64_t)); 2164 if (ret < 0) { 2165 return ret; 2166 } 2167 2168 /* encryption */ 2169 if (s->crypto_header.length) { 2170 ret = qcow2_inc_refcounts_imrt(bs, res, refcount_table, nb_clusters, 2171 s->crypto_header.offset, 2172 s->crypto_header.length); 2173 if (ret < 0) { 2174 return ret; 2175 } 2176 } 2177 2178 /* bitmaps */ 2179 ret = qcow2_check_bitmaps_refcounts(bs, res, refcount_table, nb_clusters); 2180 if (ret < 0) { 2181 return ret; 2182 } 2183 2184 return check_refblocks(bs, res, fix, rebuild, refcount_table, nb_clusters); 2185 } 2186 2187 /* 2188 * Compares the actual reference count for each cluster in the image against the 2189 * refcount as reported by the refcount structures on-disk. 2190 */ 2191 static void compare_refcounts(BlockDriverState *bs, BdrvCheckResult *res, 2192 BdrvCheckMode fix, bool *rebuild, 2193 int64_t *highest_cluster, 2194 void *refcount_table, int64_t nb_clusters) 2195 { 2196 BDRVQcow2State *s = bs->opaque; 2197 int64_t i; 2198 uint64_t refcount1, refcount2; 2199 int ret; 2200 2201 for (i = 0, *highest_cluster = 0; i < nb_clusters; i++) { 2202 ret = qcow2_get_refcount(bs, i, &refcount1); 2203 if (ret < 0) { 2204 fprintf(stderr, "Can't get refcount for cluster %" PRId64 ": %s\n", 2205 i, strerror(-ret)); 2206 res->check_errors++; 2207 continue; 2208 } 2209 2210 refcount2 = s->get_refcount(refcount_table, i); 2211 2212 if (refcount1 > 0 || refcount2 > 0) { 2213 *highest_cluster = i; 2214 } 2215 2216 if (refcount1 != refcount2) { 2217 /* Check if we're allowed to fix the mismatch */ 2218 int *num_fixed = NULL; 2219 if (refcount1 == 0) { 2220 *rebuild = true; 2221 } else if (refcount1 > refcount2 && (fix & BDRV_FIX_LEAKS)) { 2222 num_fixed = &res->leaks_fixed; 2223 } else if (refcount1 < refcount2 && (fix & BDRV_FIX_ERRORS)) { 2224 num_fixed = &res->corruptions_fixed; 2225 } 2226 2227 fprintf(stderr, "%s cluster %" PRId64 " refcount=%" PRIu64 2228 " reference=%" PRIu64 "\n", 2229 num_fixed != NULL ? "Repairing" : 2230 refcount1 < refcount2 ? "ERROR" : 2231 "Leaked", 2232 i, refcount1, refcount2); 2233 2234 if (num_fixed) { 2235 ret = update_refcount(bs, i << s->cluster_bits, 1, 2236 refcount_diff(refcount1, refcount2), 2237 refcount1 > refcount2, 2238 QCOW2_DISCARD_ALWAYS); 2239 if (ret >= 0) { 2240 (*num_fixed)++; 2241 continue; 2242 } 2243 } 2244 2245 /* And if we couldn't, print an error */ 2246 if (refcount1 < refcount2) { 2247 res->corruptions++; 2248 } else { 2249 res->leaks++; 2250 } 2251 } 2252 } 2253 } 2254 2255 /* 2256 * Allocates clusters using an in-memory refcount table (IMRT) in contrast to 2257 * the on-disk refcount structures. 2258 * 2259 * On input, *first_free_cluster tells where to start looking, and need not 2260 * actually be a free cluster; the returned offset will not be before that 2261 * cluster. On output, *first_free_cluster points to the first gap found, even 2262 * if that gap was too small to be used as the returned offset. 2263 * 2264 * Note that *first_free_cluster is a cluster index whereas the return value is 2265 * an offset. 2266 */ 2267 static int64_t alloc_clusters_imrt(BlockDriverState *bs, 2268 int cluster_count, 2269 void **refcount_table, 2270 int64_t *imrt_nb_clusters, 2271 int64_t *first_free_cluster) 2272 { 2273 BDRVQcow2State *s = bs->opaque; 2274 int64_t cluster = *first_free_cluster, i; 2275 bool first_gap = true; 2276 int contiguous_free_clusters; 2277 int ret; 2278 2279 /* Starting at *first_free_cluster, find a range of at least cluster_count 2280 * continuously free clusters */ 2281 for (contiguous_free_clusters = 0; 2282 cluster < *imrt_nb_clusters && 2283 contiguous_free_clusters < cluster_count; 2284 cluster++) 2285 { 2286 if (!s->get_refcount(*refcount_table, cluster)) { 2287 contiguous_free_clusters++; 2288 if (first_gap) { 2289 /* If this is the first free cluster found, update 2290 * *first_free_cluster accordingly */ 2291 *first_free_cluster = cluster; 2292 first_gap = false; 2293 } 2294 } else if (contiguous_free_clusters) { 2295 contiguous_free_clusters = 0; 2296 } 2297 } 2298 2299 /* If contiguous_free_clusters is greater than zero, it contains the number 2300 * of continuously free clusters until the current cluster; the first free 2301 * cluster in the current "gap" is therefore 2302 * cluster - contiguous_free_clusters */ 2303 2304 /* If no such range could be found, grow the in-memory refcount table 2305 * accordingly to append free clusters at the end of the image */ 2306 if (contiguous_free_clusters < cluster_count) { 2307 /* contiguous_free_clusters clusters are already empty at the image end; 2308 * we need cluster_count clusters; therefore, we have to allocate 2309 * cluster_count - contiguous_free_clusters new clusters at the end of 2310 * the image (which is the current value of cluster; note that cluster 2311 * may exceed old_imrt_nb_clusters if *first_free_cluster pointed beyond 2312 * the image end) */ 2313 ret = realloc_refcount_array(s, refcount_table, imrt_nb_clusters, 2314 cluster + cluster_count 2315 - contiguous_free_clusters); 2316 if (ret < 0) { 2317 return ret; 2318 } 2319 } 2320 2321 /* Go back to the first free cluster */ 2322 cluster -= contiguous_free_clusters; 2323 for (i = 0; i < cluster_count; i++) { 2324 s->set_refcount(*refcount_table, cluster + i, 1); 2325 } 2326 2327 return cluster << s->cluster_bits; 2328 } 2329 2330 /* 2331 * Creates a new refcount structure based solely on the in-memory information 2332 * given through *refcount_table. All necessary allocations will be reflected 2333 * in that array. 2334 * 2335 * On success, the old refcount structure is leaked (it will be covered by the 2336 * new refcount structure). 2337 */ 2338 static int rebuild_refcount_structure(BlockDriverState *bs, 2339 BdrvCheckResult *res, 2340 void **refcount_table, 2341 int64_t *nb_clusters) 2342 { 2343 BDRVQcow2State *s = bs->opaque; 2344 int64_t first_free_cluster = 0, reftable_offset = -1, cluster = 0; 2345 int64_t refblock_offset, refblock_start, refblock_index; 2346 uint32_t reftable_size = 0; 2347 uint64_t *on_disk_reftable = NULL; 2348 void *on_disk_refblock; 2349 int ret = 0; 2350 struct { 2351 uint64_t reftable_offset; 2352 uint32_t reftable_clusters; 2353 } QEMU_PACKED reftable_offset_and_clusters; 2354 2355 qcow2_cache_empty(bs, s->refcount_block_cache); 2356 2357 write_refblocks: 2358 for (; cluster < *nb_clusters; cluster++) { 2359 if (!s->get_refcount(*refcount_table, cluster)) { 2360 continue; 2361 } 2362 2363 refblock_index = cluster >> s->refcount_block_bits; 2364 refblock_start = refblock_index << s->refcount_block_bits; 2365 2366 /* Don't allocate a cluster in a refblock already written to disk */ 2367 if (first_free_cluster < refblock_start) { 2368 first_free_cluster = refblock_start; 2369 } 2370 refblock_offset = alloc_clusters_imrt(bs, 1, refcount_table, 2371 nb_clusters, &first_free_cluster); 2372 if (refblock_offset < 0) { 2373 fprintf(stderr, "ERROR allocating refblock: %s\n", 2374 strerror(-refblock_offset)); 2375 res->check_errors++; 2376 ret = refblock_offset; 2377 goto fail; 2378 } 2379 2380 if (reftable_size <= refblock_index) { 2381 uint32_t old_reftable_size = reftable_size; 2382 uint64_t *new_on_disk_reftable; 2383 2384 reftable_size = ROUND_UP((refblock_index + 1) * sizeof(uint64_t), 2385 s->cluster_size) / sizeof(uint64_t); 2386 new_on_disk_reftable = g_try_realloc(on_disk_reftable, 2387 reftable_size * 2388 sizeof(uint64_t)); 2389 if (!new_on_disk_reftable) { 2390 res->check_errors++; 2391 ret = -ENOMEM; 2392 goto fail; 2393 } 2394 on_disk_reftable = new_on_disk_reftable; 2395 2396 memset(on_disk_reftable + old_reftable_size, 0, 2397 (reftable_size - old_reftable_size) * sizeof(uint64_t)); 2398 2399 /* The offset we have for the reftable is now no longer valid; 2400 * this will leak that range, but we can easily fix that by running 2401 * a leak-fixing check after this rebuild operation */ 2402 reftable_offset = -1; 2403 } else { 2404 assert(on_disk_reftable); 2405 } 2406 on_disk_reftable[refblock_index] = refblock_offset; 2407 2408 /* If this is apparently the last refblock (for now), try to squeeze the 2409 * reftable in */ 2410 if (refblock_index == (*nb_clusters - 1) >> s->refcount_block_bits && 2411 reftable_offset < 0) 2412 { 2413 uint64_t reftable_clusters = size_to_clusters(s, reftable_size * 2414 sizeof(uint64_t)); 2415 reftable_offset = alloc_clusters_imrt(bs, reftable_clusters, 2416 refcount_table, nb_clusters, 2417 &first_free_cluster); 2418 if (reftable_offset < 0) { 2419 fprintf(stderr, "ERROR allocating reftable: %s\n", 2420 strerror(-reftable_offset)); 2421 res->check_errors++; 2422 ret = reftable_offset; 2423 goto fail; 2424 } 2425 } 2426 2427 ret = qcow2_pre_write_overlap_check(bs, 0, refblock_offset, 2428 s->cluster_size, false); 2429 if (ret < 0) { 2430 fprintf(stderr, "ERROR writing refblock: %s\n", strerror(-ret)); 2431 goto fail; 2432 } 2433 2434 /* The size of *refcount_table is always cluster-aligned, therefore the 2435 * write operation will not overflow */ 2436 on_disk_refblock = (void *)((char *) *refcount_table + 2437 refblock_index * s->cluster_size); 2438 2439 ret = bdrv_pwrite(bs->file, refblock_offset, on_disk_refblock, 2440 s->cluster_size); 2441 if (ret < 0) { 2442 fprintf(stderr, "ERROR writing refblock: %s\n", strerror(-ret)); 2443 goto fail; 2444 } 2445 2446 /* Go to the end of this refblock */ 2447 cluster = refblock_start + s->refcount_block_size - 1; 2448 } 2449 2450 if (reftable_offset < 0) { 2451 uint64_t post_refblock_start, reftable_clusters; 2452 2453 post_refblock_start = ROUND_UP(*nb_clusters, s->refcount_block_size); 2454 reftable_clusters = size_to_clusters(s, 2455 reftable_size * sizeof(uint64_t)); 2456 /* Not pretty but simple */ 2457 if (first_free_cluster < post_refblock_start) { 2458 first_free_cluster = post_refblock_start; 2459 } 2460 reftable_offset = alloc_clusters_imrt(bs, reftable_clusters, 2461 refcount_table, nb_clusters, 2462 &first_free_cluster); 2463 if (reftable_offset < 0) { 2464 fprintf(stderr, "ERROR allocating reftable: %s\n", 2465 strerror(-reftable_offset)); 2466 res->check_errors++; 2467 ret = reftable_offset; 2468 goto fail; 2469 } 2470 2471 goto write_refblocks; 2472 } 2473 2474 for (refblock_index = 0; refblock_index < reftable_size; refblock_index++) { 2475 cpu_to_be64s(&on_disk_reftable[refblock_index]); 2476 } 2477 2478 ret = qcow2_pre_write_overlap_check(bs, 0, reftable_offset, 2479 reftable_size * sizeof(uint64_t), 2480 false); 2481 if (ret < 0) { 2482 fprintf(stderr, "ERROR writing reftable: %s\n", strerror(-ret)); 2483 goto fail; 2484 } 2485 2486 assert(reftable_size < INT_MAX / sizeof(uint64_t)); 2487 ret = bdrv_pwrite(bs->file, reftable_offset, on_disk_reftable, 2488 reftable_size * sizeof(uint64_t)); 2489 if (ret < 0) { 2490 fprintf(stderr, "ERROR writing reftable: %s\n", strerror(-ret)); 2491 goto fail; 2492 } 2493 2494 /* Enter new reftable into the image header */ 2495 reftable_offset_and_clusters.reftable_offset = cpu_to_be64(reftable_offset); 2496 reftable_offset_and_clusters.reftable_clusters = 2497 cpu_to_be32(size_to_clusters(s, reftable_size * sizeof(uint64_t))); 2498 ret = bdrv_pwrite_sync(bs->file, 2499 offsetof(QCowHeader, refcount_table_offset), 2500 &reftable_offset_and_clusters, 2501 sizeof(reftable_offset_and_clusters)); 2502 if (ret < 0) { 2503 fprintf(stderr, "ERROR setting reftable: %s\n", strerror(-ret)); 2504 goto fail; 2505 } 2506 2507 for (refblock_index = 0; refblock_index < reftable_size; refblock_index++) { 2508 be64_to_cpus(&on_disk_reftable[refblock_index]); 2509 } 2510 s->refcount_table = on_disk_reftable; 2511 s->refcount_table_offset = reftable_offset; 2512 s->refcount_table_size = reftable_size; 2513 update_max_refcount_table_index(s); 2514 2515 return 0; 2516 2517 fail: 2518 g_free(on_disk_reftable); 2519 return ret; 2520 } 2521 2522 /* 2523 * Checks an image for refcount consistency. 2524 * 2525 * Returns 0 if no errors are found, the number of errors in case the image is 2526 * detected as corrupted, and -errno when an internal error occurred. 2527 */ 2528 int qcow2_check_refcounts(BlockDriverState *bs, BdrvCheckResult *res, 2529 BdrvCheckMode fix) 2530 { 2531 BDRVQcow2State *s = bs->opaque; 2532 BdrvCheckResult pre_compare_res; 2533 int64_t size, highest_cluster, nb_clusters; 2534 void *refcount_table = NULL; 2535 bool rebuild = false; 2536 int ret; 2537 2538 size = bdrv_getlength(bs->file->bs); 2539 if (size < 0) { 2540 res->check_errors++; 2541 return size; 2542 } 2543 2544 nb_clusters = size_to_clusters(s, size); 2545 if (nb_clusters > INT_MAX) { 2546 res->check_errors++; 2547 return -EFBIG; 2548 } 2549 2550 res->bfi.total_clusters = 2551 size_to_clusters(s, bs->total_sectors * BDRV_SECTOR_SIZE); 2552 2553 ret = calculate_refcounts(bs, res, fix, &rebuild, &refcount_table, 2554 &nb_clusters); 2555 if (ret < 0) { 2556 goto fail; 2557 } 2558 2559 /* In case we don't need to rebuild the refcount structure (but want to fix 2560 * something), this function is immediately called again, in which case the 2561 * result should be ignored */ 2562 pre_compare_res = *res; 2563 compare_refcounts(bs, res, 0, &rebuild, &highest_cluster, refcount_table, 2564 nb_clusters); 2565 2566 if (rebuild && (fix & BDRV_FIX_ERRORS)) { 2567 BdrvCheckResult old_res = *res; 2568 int fresh_leaks = 0; 2569 2570 fprintf(stderr, "Rebuilding refcount structure\n"); 2571 ret = rebuild_refcount_structure(bs, res, &refcount_table, 2572 &nb_clusters); 2573 if (ret < 0) { 2574 goto fail; 2575 } 2576 2577 res->corruptions = 0; 2578 res->leaks = 0; 2579 2580 /* Because the old reftable has been exchanged for a new one the 2581 * references have to be recalculated */ 2582 rebuild = false; 2583 memset(refcount_table, 0, refcount_array_byte_size(s, nb_clusters)); 2584 ret = calculate_refcounts(bs, res, 0, &rebuild, &refcount_table, 2585 &nb_clusters); 2586 if (ret < 0) { 2587 goto fail; 2588 } 2589 2590 if (fix & BDRV_FIX_LEAKS) { 2591 /* The old refcount structures are now leaked, fix it; the result 2592 * can be ignored, aside from leaks which were introduced by 2593 * rebuild_refcount_structure() that could not be fixed */ 2594 BdrvCheckResult saved_res = *res; 2595 *res = (BdrvCheckResult){ 0 }; 2596 2597 compare_refcounts(bs, res, BDRV_FIX_LEAKS, &rebuild, 2598 &highest_cluster, refcount_table, nb_clusters); 2599 if (rebuild) { 2600 fprintf(stderr, "ERROR rebuilt refcount structure is still " 2601 "broken\n"); 2602 } 2603 2604 /* Any leaks accounted for here were introduced by 2605 * rebuild_refcount_structure() because that function has created a 2606 * new refcount structure from scratch */ 2607 fresh_leaks = res->leaks; 2608 *res = saved_res; 2609 } 2610 2611 if (res->corruptions < old_res.corruptions) { 2612 res->corruptions_fixed += old_res.corruptions - res->corruptions; 2613 } 2614 if (res->leaks < old_res.leaks) { 2615 res->leaks_fixed += old_res.leaks - res->leaks; 2616 } 2617 res->leaks += fresh_leaks; 2618 } else if (fix) { 2619 if (rebuild) { 2620 fprintf(stderr, "ERROR need to rebuild refcount structures\n"); 2621 res->check_errors++; 2622 ret = -EIO; 2623 goto fail; 2624 } 2625 2626 if (res->leaks || res->corruptions) { 2627 *res = pre_compare_res; 2628 compare_refcounts(bs, res, fix, &rebuild, &highest_cluster, 2629 refcount_table, nb_clusters); 2630 } 2631 } 2632 2633 /* check OFLAG_COPIED */ 2634 ret = check_oflag_copied(bs, res, fix); 2635 if (ret < 0) { 2636 goto fail; 2637 } 2638 2639 res->image_end_offset = (highest_cluster + 1) * s->cluster_size; 2640 ret = 0; 2641 2642 fail: 2643 g_free(refcount_table); 2644 2645 return ret; 2646 } 2647 2648 #define overlaps_with(ofs, sz) \ 2649 ranges_overlap(offset, size, ofs, sz) 2650 2651 /* 2652 * Checks if the given offset into the image file is actually free to use by 2653 * looking for overlaps with important metadata sections (L1/L2 tables etc.), 2654 * i.e. a sanity check without relying on the refcount tables. 2655 * 2656 * The ign parameter specifies what checks not to perform (being a bitmask of 2657 * QCow2MetadataOverlap values), i.e., what sections to ignore. 2658 * 2659 * Returns: 2660 * - 0 if writing to this offset will not affect the mentioned metadata 2661 * - a positive QCow2MetadataOverlap value indicating one overlapping section 2662 * - a negative value (-errno) indicating an error while performing a check, 2663 * e.g. when bdrv_read failed on QCOW2_OL_INACTIVE_L2 2664 */ 2665 int qcow2_check_metadata_overlap(BlockDriverState *bs, int ign, int64_t offset, 2666 int64_t size) 2667 { 2668 BDRVQcow2State *s = bs->opaque; 2669 int chk = s->overlap_check & ~ign; 2670 int i, j; 2671 2672 if (!size) { 2673 return 0; 2674 } 2675 2676 if (chk & QCOW2_OL_MAIN_HEADER) { 2677 if (offset < s->cluster_size) { 2678 return QCOW2_OL_MAIN_HEADER; 2679 } 2680 } 2681 2682 /* align range to test to cluster boundaries */ 2683 size = ROUND_UP(offset_into_cluster(s, offset) + size, s->cluster_size); 2684 offset = start_of_cluster(s, offset); 2685 2686 if ((chk & QCOW2_OL_ACTIVE_L1) && s->l1_size) { 2687 if (overlaps_with(s->l1_table_offset, s->l1_size * sizeof(uint64_t))) { 2688 return QCOW2_OL_ACTIVE_L1; 2689 } 2690 } 2691 2692 if ((chk & QCOW2_OL_REFCOUNT_TABLE) && s->refcount_table_size) { 2693 if (overlaps_with(s->refcount_table_offset, 2694 s->refcount_table_size * sizeof(uint64_t))) { 2695 return QCOW2_OL_REFCOUNT_TABLE; 2696 } 2697 } 2698 2699 if ((chk & QCOW2_OL_SNAPSHOT_TABLE) && s->snapshots_size) { 2700 if (overlaps_with(s->snapshots_offset, s->snapshots_size)) { 2701 return QCOW2_OL_SNAPSHOT_TABLE; 2702 } 2703 } 2704 2705 if ((chk & QCOW2_OL_INACTIVE_L1) && s->snapshots) { 2706 for (i = 0; i < s->nb_snapshots; i++) { 2707 if (s->snapshots[i].l1_size && 2708 overlaps_with(s->snapshots[i].l1_table_offset, 2709 s->snapshots[i].l1_size * sizeof(uint64_t))) { 2710 return QCOW2_OL_INACTIVE_L1; 2711 } 2712 } 2713 } 2714 2715 if ((chk & QCOW2_OL_ACTIVE_L2) && s->l1_table) { 2716 for (i = 0; i < s->l1_size; i++) { 2717 if ((s->l1_table[i] & L1E_OFFSET_MASK) && 2718 overlaps_with(s->l1_table[i] & L1E_OFFSET_MASK, 2719 s->cluster_size)) { 2720 return QCOW2_OL_ACTIVE_L2; 2721 } 2722 } 2723 } 2724 2725 if ((chk & QCOW2_OL_REFCOUNT_BLOCK) && s->refcount_table) { 2726 unsigned last_entry = s->max_refcount_table_index; 2727 assert(last_entry < s->refcount_table_size); 2728 assert(last_entry + 1 == s->refcount_table_size || 2729 (s->refcount_table[last_entry + 1] & REFT_OFFSET_MASK) == 0); 2730 for (i = 0; i <= last_entry; i++) { 2731 if ((s->refcount_table[i] & REFT_OFFSET_MASK) && 2732 overlaps_with(s->refcount_table[i] & REFT_OFFSET_MASK, 2733 s->cluster_size)) { 2734 return QCOW2_OL_REFCOUNT_BLOCK; 2735 } 2736 } 2737 } 2738 2739 if ((chk & QCOW2_OL_INACTIVE_L2) && s->snapshots) { 2740 for (i = 0; i < s->nb_snapshots; i++) { 2741 uint64_t l1_ofs = s->snapshots[i].l1_table_offset; 2742 uint32_t l1_sz = s->snapshots[i].l1_size; 2743 uint64_t l1_sz2 = l1_sz * sizeof(uint64_t); 2744 uint64_t *l1; 2745 int ret; 2746 2747 ret = qcow2_validate_table(bs, l1_ofs, l1_sz, sizeof(uint64_t), 2748 QCOW_MAX_L1_SIZE, "", NULL); 2749 if (ret < 0) { 2750 return ret; 2751 } 2752 2753 l1 = g_try_malloc(l1_sz2); 2754 2755 if (l1_sz2 && l1 == NULL) { 2756 return -ENOMEM; 2757 } 2758 2759 ret = bdrv_pread(bs->file, l1_ofs, l1, l1_sz2); 2760 if (ret < 0) { 2761 g_free(l1); 2762 return ret; 2763 } 2764 2765 for (j = 0; j < l1_sz; j++) { 2766 uint64_t l2_ofs = be64_to_cpu(l1[j]) & L1E_OFFSET_MASK; 2767 if (l2_ofs && overlaps_with(l2_ofs, s->cluster_size)) { 2768 g_free(l1); 2769 return QCOW2_OL_INACTIVE_L2; 2770 } 2771 } 2772 2773 g_free(l1); 2774 } 2775 } 2776 2777 if ((chk & QCOW2_OL_BITMAP_DIRECTORY) && 2778 (s->autoclear_features & QCOW2_AUTOCLEAR_BITMAPS)) 2779 { 2780 if (overlaps_with(s->bitmap_directory_offset, 2781 s->bitmap_directory_size)) 2782 { 2783 return QCOW2_OL_BITMAP_DIRECTORY; 2784 } 2785 } 2786 2787 return 0; 2788 } 2789 2790 static const char *metadata_ol_names[] = { 2791 [QCOW2_OL_MAIN_HEADER_BITNR] = "qcow2_header", 2792 [QCOW2_OL_ACTIVE_L1_BITNR] = "active L1 table", 2793 [QCOW2_OL_ACTIVE_L2_BITNR] = "active L2 table", 2794 [QCOW2_OL_REFCOUNT_TABLE_BITNR] = "refcount table", 2795 [QCOW2_OL_REFCOUNT_BLOCK_BITNR] = "refcount block", 2796 [QCOW2_OL_SNAPSHOT_TABLE_BITNR] = "snapshot table", 2797 [QCOW2_OL_INACTIVE_L1_BITNR] = "inactive L1 table", 2798 [QCOW2_OL_INACTIVE_L2_BITNR] = "inactive L2 table", 2799 [QCOW2_OL_BITMAP_DIRECTORY_BITNR] = "bitmap directory", 2800 }; 2801 QEMU_BUILD_BUG_ON(QCOW2_OL_MAX_BITNR != ARRAY_SIZE(metadata_ol_names)); 2802 2803 /* 2804 * First performs a check for metadata overlaps (through 2805 * qcow2_check_metadata_overlap); if that fails with a negative value (error 2806 * while performing a check), that value is returned. If an impending overlap 2807 * is detected, the BDS will be made unusable, the qcow2 file marked corrupt 2808 * and -EIO returned. 2809 * 2810 * Returns 0 if there were neither overlaps nor errors while checking for 2811 * overlaps; or a negative value (-errno) on error. 2812 */ 2813 int qcow2_pre_write_overlap_check(BlockDriverState *bs, int ign, int64_t offset, 2814 int64_t size, bool data_file) 2815 { 2816 int ret; 2817 2818 if (data_file && has_data_file(bs)) { 2819 return 0; 2820 } 2821 2822 ret = qcow2_check_metadata_overlap(bs, ign, offset, size); 2823 if (ret < 0) { 2824 return ret; 2825 } else if (ret > 0) { 2826 int metadata_ol_bitnr = ctz32(ret); 2827 assert(metadata_ol_bitnr < QCOW2_OL_MAX_BITNR); 2828 2829 qcow2_signal_corruption(bs, true, offset, size, "Preventing invalid " 2830 "write on metadata (overlaps with %s)", 2831 metadata_ol_names[metadata_ol_bitnr]); 2832 return -EIO; 2833 } 2834 2835 return 0; 2836 } 2837 2838 /* A pointer to a function of this type is given to walk_over_reftable(). That 2839 * function will create refblocks and pass them to a RefblockFinishOp once they 2840 * are completed (@refblock). @refblock_empty is set if the refblock is 2841 * completely empty. 2842 * 2843 * Along with the refblock, a corresponding reftable entry is passed, in the 2844 * reftable @reftable (which may be reallocated) at @reftable_index. 2845 * 2846 * @allocated should be set to true if a new cluster has been allocated. 2847 */ 2848 typedef int (RefblockFinishOp)(BlockDriverState *bs, uint64_t **reftable, 2849 uint64_t reftable_index, uint64_t *reftable_size, 2850 void *refblock, bool refblock_empty, 2851 bool *allocated, Error **errp); 2852 2853 /** 2854 * This "operation" for walk_over_reftable() allocates the refblock on disk (if 2855 * it is not empty) and inserts its offset into the new reftable. The size of 2856 * this new reftable is increased as required. 2857 */ 2858 static int alloc_refblock(BlockDriverState *bs, uint64_t **reftable, 2859 uint64_t reftable_index, uint64_t *reftable_size, 2860 void *refblock, bool refblock_empty, bool *allocated, 2861 Error **errp) 2862 { 2863 BDRVQcow2State *s = bs->opaque; 2864 int64_t offset; 2865 2866 if (!refblock_empty && reftable_index >= *reftable_size) { 2867 uint64_t *new_reftable; 2868 uint64_t new_reftable_size; 2869 2870 new_reftable_size = ROUND_UP(reftable_index + 1, 2871 s->cluster_size / sizeof(uint64_t)); 2872 if (new_reftable_size > QCOW_MAX_REFTABLE_SIZE / sizeof(uint64_t)) { 2873 error_setg(errp, 2874 "This operation would make the refcount table grow " 2875 "beyond the maximum size supported by QEMU, aborting"); 2876 return -ENOTSUP; 2877 } 2878 2879 new_reftable = g_try_realloc(*reftable, new_reftable_size * 2880 sizeof(uint64_t)); 2881 if (!new_reftable) { 2882 error_setg(errp, "Failed to increase reftable buffer size"); 2883 return -ENOMEM; 2884 } 2885 2886 memset(new_reftable + *reftable_size, 0, 2887 (new_reftable_size - *reftable_size) * sizeof(uint64_t)); 2888 2889 *reftable = new_reftable; 2890 *reftable_size = new_reftable_size; 2891 } 2892 2893 if (!refblock_empty && !(*reftable)[reftable_index]) { 2894 offset = qcow2_alloc_clusters(bs, s->cluster_size); 2895 if (offset < 0) { 2896 error_setg_errno(errp, -offset, "Failed to allocate refblock"); 2897 return offset; 2898 } 2899 (*reftable)[reftable_index] = offset; 2900 *allocated = true; 2901 } 2902 2903 return 0; 2904 } 2905 2906 /** 2907 * This "operation" for walk_over_reftable() writes the refblock to disk at the 2908 * offset specified by the new reftable's entry. It does not modify the new 2909 * reftable or change any refcounts. 2910 */ 2911 static int flush_refblock(BlockDriverState *bs, uint64_t **reftable, 2912 uint64_t reftable_index, uint64_t *reftable_size, 2913 void *refblock, bool refblock_empty, bool *allocated, 2914 Error **errp) 2915 { 2916 BDRVQcow2State *s = bs->opaque; 2917 int64_t offset; 2918 int ret; 2919 2920 if (reftable_index < *reftable_size && (*reftable)[reftable_index]) { 2921 offset = (*reftable)[reftable_index]; 2922 2923 ret = qcow2_pre_write_overlap_check(bs, 0, offset, s->cluster_size, 2924 false); 2925 if (ret < 0) { 2926 error_setg_errno(errp, -ret, "Overlap check failed"); 2927 return ret; 2928 } 2929 2930 ret = bdrv_pwrite(bs->file, offset, refblock, s->cluster_size); 2931 if (ret < 0) { 2932 error_setg_errno(errp, -ret, "Failed to write refblock"); 2933 return ret; 2934 } 2935 } else { 2936 assert(refblock_empty); 2937 } 2938 2939 return 0; 2940 } 2941 2942 /** 2943 * This function walks over the existing reftable and every referenced refblock; 2944 * if @new_set_refcount is non-NULL, it is called for every refcount entry to 2945 * create an equal new entry in the passed @new_refblock. Once that 2946 * @new_refblock is completely filled, @operation will be called. 2947 * 2948 * @status_cb and @cb_opaque are used for the amend operation's status callback. 2949 * @index is the index of the walk_over_reftable() calls and @total is the total 2950 * number of walk_over_reftable() calls per amend operation. Both are used for 2951 * calculating the parameters for the status callback. 2952 * 2953 * @allocated is set to true if a new cluster has been allocated. 2954 */ 2955 static int walk_over_reftable(BlockDriverState *bs, uint64_t **new_reftable, 2956 uint64_t *new_reftable_index, 2957 uint64_t *new_reftable_size, 2958 void *new_refblock, int new_refblock_size, 2959 int new_refcount_bits, 2960 RefblockFinishOp *operation, bool *allocated, 2961 Qcow2SetRefcountFunc *new_set_refcount, 2962 BlockDriverAmendStatusCB *status_cb, 2963 void *cb_opaque, int index, int total, 2964 Error **errp) 2965 { 2966 BDRVQcow2State *s = bs->opaque; 2967 uint64_t reftable_index; 2968 bool new_refblock_empty = true; 2969 int refblock_index; 2970 int new_refblock_index = 0; 2971 int ret; 2972 2973 for (reftable_index = 0; reftable_index < s->refcount_table_size; 2974 reftable_index++) 2975 { 2976 uint64_t refblock_offset = s->refcount_table[reftable_index] 2977 & REFT_OFFSET_MASK; 2978 2979 status_cb(bs, (uint64_t)index * s->refcount_table_size + reftable_index, 2980 (uint64_t)total * s->refcount_table_size, cb_opaque); 2981 2982 if (refblock_offset) { 2983 void *refblock; 2984 2985 if (offset_into_cluster(s, refblock_offset)) { 2986 qcow2_signal_corruption(bs, true, -1, -1, "Refblock offset %#" 2987 PRIx64 " unaligned (reftable index: %#" 2988 PRIx64 ")", refblock_offset, 2989 reftable_index); 2990 error_setg(errp, 2991 "Image is corrupt (unaligned refblock offset)"); 2992 return -EIO; 2993 } 2994 2995 ret = qcow2_cache_get(bs, s->refcount_block_cache, refblock_offset, 2996 &refblock); 2997 if (ret < 0) { 2998 error_setg_errno(errp, -ret, "Failed to retrieve refblock"); 2999 return ret; 3000 } 3001 3002 for (refblock_index = 0; refblock_index < s->refcount_block_size; 3003 refblock_index++) 3004 { 3005 uint64_t refcount; 3006 3007 if (new_refblock_index >= new_refblock_size) { 3008 /* new_refblock is now complete */ 3009 ret = operation(bs, new_reftable, *new_reftable_index, 3010 new_reftable_size, new_refblock, 3011 new_refblock_empty, allocated, errp); 3012 if (ret < 0) { 3013 qcow2_cache_put(s->refcount_block_cache, &refblock); 3014 return ret; 3015 } 3016 3017 (*new_reftable_index)++; 3018 new_refblock_index = 0; 3019 new_refblock_empty = true; 3020 } 3021 3022 refcount = s->get_refcount(refblock, refblock_index); 3023 if (new_refcount_bits < 64 && refcount >> new_refcount_bits) { 3024 uint64_t offset; 3025 3026 qcow2_cache_put(s->refcount_block_cache, &refblock); 3027 3028 offset = ((reftable_index << s->refcount_block_bits) 3029 + refblock_index) << s->cluster_bits; 3030 3031 error_setg(errp, "Cannot decrease refcount entry width to " 3032 "%i bits: Cluster at offset %#" PRIx64 " has a " 3033 "refcount of %" PRIu64, new_refcount_bits, 3034 offset, refcount); 3035 return -EINVAL; 3036 } 3037 3038 if (new_set_refcount) { 3039 new_set_refcount(new_refblock, new_refblock_index++, 3040 refcount); 3041 } else { 3042 new_refblock_index++; 3043 } 3044 new_refblock_empty = new_refblock_empty && refcount == 0; 3045 } 3046 3047 qcow2_cache_put(s->refcount_block_cache, &refblock); 3048 } else { 3049 /* No refblock means every refcount is 0 */ 3050 for (refblock_index = 0; refblock_index < s->refcount_block_size; 3051 refblock_index++) 3052 { 3053 if (new_refblock_index >= new_refblock_size) { 3054 /* new_refblock is now complete */ 3055 ret = operation(bs, new_reftable, *new_reftable_index, 3056 new_reftable_size, new_refblock, 3057 new_refblock_empty, allocated, errp); 3058 if (ret < 0) { 3059 return ret; 3060 } 3061 3062 (*new_reftable_index)++; 3063 new_refblock_index = 0; 3064 new_refblock_empty = true; 3065 } 3066 3067 if (new_set_refcount) { 3068 new_set_refcount(new_refblock, new_refblock_index++, 0); 3069 } else { 3070 new_refblock_index++; 3071 } 3072 } 3073 } 3074 } 3075 3076 if (new_refblock_index > 0) { 3077 /* Complete the potentially existing partially filled final refblock */ 3078 if (new_set_refcount) { 3079 for (; new_refblock_index < new_refblock_size; 3080 new_refblock_index++) 3081 { 3082 new_set_refcount(new_refblock, new_refblock_index, 0); 3083 } 3084 } 3085 3086 ret = operation(bs, new_reftable, *new_reftable_index, 3087 new_reftable_size, new_refblock, new_refblock_empty, 3088 allocated, errp); 3089 if (ret < 0) { 3090 return ret; 3091 } 3092 3093 (*new_reftable_index)++; 3094 } 3095 3096 status_cb(bs, (uint64_t)(index + 1) * s->refcount_table_size, 3097 (uint64_t)total * s->refcount_table_size, cb_opaque); 3098 3099 return 0; 3100 } 3101 3102 int qcow2_change_refcount_order(BlockDriverState *bs, int refcount_order, 3103 BlockDriverAmendStatusCB *status_cb, 3104 void *cb_opaque, Error **errp) 3105 { 3106 BDRVQcow2State *s = bs->opaque; 3107 Qcow2GetRefcountFunc *new_get_refcount; 3108 Qcow2SetRefcountFunc *new_set_refcount; 3109 void *new_refblock = qemu_blockalign(bs->file->bs, s->cluster_size); 3110 uint64_t *new_reftable = NULL, new_reftable_size = 0; 3111 uint64_t *old_reftable, old_reftable_size, old_reftable_offset; 3112 uint64_t new_reftable_index = 0; 3113 uint64_t i; 3114 int64_t new_reftable_offset = 0, allocated_reftable_size = 0; 3115 int new_refblock_size, new_refcount_bits = 1 << refcount_order; 3116 int old_refcount_order; 3117 int walk_index = 0; 3118 int ret; 3119 bool new_allocation; 3120 3121 assert(s->qcow_version >= 3); 3122 assert(refcount_order >= 0 && refcount_order <= 6); 3123 3124 /* see qcow2_open() */ 3125 new_refblock_size = 1 << (s->cluster_bits - (refcount_order - 3)); 3126 3127 new_get_refcount = get_refcount_funcs[refcount_order]; 3128 new_set_refcount = set_refcount_funcs[refcount_order]; 3129 3130 3131 do { 3132 int total_walks; 3133 3134 new_allocation = false; 3135 3136 /* At least we have to do this walk and the one which writes the 3137 * refblocks; also, at least we have to do this loop here at least 3138 * twice (normally), first to do the allocations, and second to 3139 * determine that everything is correctly allocated, this then makes 3140 * three walks in total */ 3141 total_walks = MAX(walk_index + 2, 3); 3142 3143 /* First, allocate the structures so they are present in the refcount 3144 * structures */ 3145 ret = walk_over_reftable(bs, &new_reftable, &new_reftable_index, 3146 &new_reftable_size, NULL, new_refblock_size, 3147 new_refcount_bits, &alloc_refblock, 3148 &new_allocation, NULL, status_cb, cb_opaque, 3149 walk_index++, total_walks, errp); 3150 if (ret < 0) { 3151 goto done; 3152 } 3153 3154 new_reftable_index = 0; 3155 3156 if (new_allocation) { 3157 if (new_reftable_offset) { 3158 qcow2_free_clusters(bs, new_reftable_offset, 3159 allocated_reftable_size * sizeof(uint64_t), 3160 QCOW2_DISCARD_NEVER); 3161 } 3162 3163 new_reftable_offset = qcow2_alloc_clusters(bs, new_reftable_size * 3164 sizeof(uint64_t)); 3165 if (new_reftable_offset < 0) { 3166 error_setg_errno(errp, -new_reftable_offset, 3167 "Failed to allocate the new reftable"); 3168 ret = new_reftable_offset; 3169 goto done; 3170 } 3171 allocated_reftable_size = new_reftable_size; 3172 } 3173 } while (new_allocation); 3174 3175 /* Second, write the new refblocks */ 3176 ret = walk_over_reftable(bs, &new_reftable, &new_reftable_index, 3177 &new_reftable_size, new_refblock, 3178 new_refblock_size, new_refcount_bits, 3179 &flush_refblock, &new_allocation, new_set_refcount, 3180 status_cb, cb_opaque, walk_index, walk_index + 1, 3181 errp); 3182 if (ret < 0) { 3183 goto done; 3184 } 3185 assert(!new_allocation); 3186 3187 3188 /* Write the new reftable */ 3189 ret = qcow2_pre_write_overlap_check(bs, 0, new_reftable_offset, 3190 new_reftable_size * sizeof(uint64_t), 3191 false); 3192 if (ret < 0) { 3193 error_setg_errno(errp, -ret, "Overlap check failed"); 3194 goto done; 3195 } 3196 3197 for (i = 0; i < new_reftable_size; i++) { 3198 cpu_to_be64s(&new_reftable[i]); 3199 } 3200 3201 ret = bdrv_pwrite(bs->file, new_reftable_offset, new_reftable, 3202 new_reftable_size * sizeof(uint64_t)); 3203 3204 for (i = 0; i < new_reftable_size; i++) { 3205 be64_to_cpus(&new_reftable[i]); 3206 } 3207 3208 if (ret < 0) { 3209 error_setg_errno(errp, -ret, "Failed to write the new reftable"); 3210 goto done; 3211 } 3212 3213 3214 /* Empty the refcount cache */ 3215 ret = qcow2_cache_flush(bs, s->refcount_block_cache); 3216 if (ret < 0) { 3217 error_setg_errno(errp, -ret, "Failed to flush the refblock cache"); 3218 goto done; 3219 } 3220 3221 /* Update the image header to point to the new reftable; this only updates 3222 * the fields which are relevant to qcow2_update_header(); other fields 3223 * such as s->refcount_table or s->refcount_bits stay stale for now 3224 * (because we have to restore everything if qcow2_update_header() fails) */ 3225 old_refcount_order = s->refcount_order; 3226 old_reftable_size = s->refcount_table_size; 3227 old_reftable_offset = s->refcount_table_offset; 3228 3229 s->refcount_order = refcount_order; 3230 s->refcount_table_size = new_reftable_size; 3231 s->refcount_table_offset = new_reftable_offset; 3232 3233 ret = qcow2_update_header(bs); 3234 if (ret < 0) { 3235 s->refcount_order = old_refcount_order; 3236 s->refcount_table_size = old_reftable_size; 3237 s->refcount_table_offset = old_reftable_offset; 3238 error_setg_errno(errp, -ret, "Failed to update the qcow2 header"); 3239 goto done; 3240 } 3241 3242 /* Now update the rest of the in-memory information */ 3243 old_reftable = s->refcount_table; 3244 s->refcount_table = new_reftable; 3245 update_max_refcount_table_index(s); 3246 3247 s->refcount_bits = 1 << refcount_order; 3248 s->refcount_max = UINT64_C(1) << (s->refcount_bits - 1); 3249 s->refcount_max += s->refcount_max - 1; 3250 3251 s->refcount_block_bits = s->cluster_bits - (refcount_order - 3); 3252 s->refcount_block_size = 1 << s->refcount_block_bits; 3253 3254 s->get_refcount = new_get_refcount; 3255 s->set_refcount = new_set_refcount; 3256 3257 /* For cleaning up all old refblocks and the old reftable below the "done" 3258 * label */ 3259 new_reftable = old_reftable; 3260 new_reftable_size = old_reftable_size; 3261 new_reftable_offset = old_reftable_offset; 3262 3263 done: 3264 if (new_reftable) { 3265 /* On success, new_reftable actually points to the old reftable (and 3266 * new_reftable_size is the old reftable's size); but that is just 3267 * fine */ 3268 for (i = 0; i < new_reftable_size; i++) { 3269 uint64_t offset = new_reftable[i] & REFT_OFFSET_MASK; 3270 if (offset) { 3271 qcow2_free_clusters(bs, offset, s->cluster_size, 3272 QCOW2_DISCARD_OTHER); 3273 } 3274 } 3275 g_free(new_reftable); 3276 3277 if (new_reftable_offset > 0) { 3278 qcow2_free_clusters(bs, new_reftable_offset, 3279 new_reftable_size * sizeof(uint64_t), 3280 QCOW2_DISCARD_OTHER); 3281 } 3282 } 3283 3284 qemu_vfree(new_refblock); 3285 return ret; 3286 } 3287 3288 static int64_t get_refblock_offset(BlockDriverState *bs, uint64_t offset) 3289 { 3290 BDRVQcow2State *s = bs->opaque; 3291 uint32_t index = offset_to_reftable_index(s, offset); 3292 int64_t covering_refblock_offset = 0; 3293 3294 if (index < s->refcount_table_size) { 3295 covering_refblock_offset = s->refcount_table[index] & REFT_OFFSET_MASK; 3296 } 3297 if (!covering_refblock_offset) { 3298 qcow2_signal_corruption(bs, true, -1, -1, "Refblock at %#" PRIx64 " is " 3299 "not covered by the refcount structures", 3300 offset); 3301 return -EIO; 3302 } 3303 3304 return covering_refblock_offset; 3305 } 3306 3307 static int qcow2_discard_refcount_block(BlockDriverState *bs, 3308 uint64_t discard_block_offs) 3309 { 3310 BDRVQcow2State *s = bs->opaque; 3311 int64_t refblock_offs; 3312 uint64_t cluster_index = discard_block_offs >> s->cluster_bits; 3313 uint32_t block_index = cluster_index & (s->refcount_block_size - 1); 3314 void *refblock; 3315 int ret; 3316 3317 refblock_offs = get_refblock_offset(bs, discard_block_offs); 3318 if (refblock_offs < 0) { 3319 return refblock_offs; 3320 } 3321 3322 assert(discard_block_offs != 0); 3323 3324 ret = qcow2_cache_get(bs, s->refcount_block_cache, refblock_offs, 3325 &refblock); 3326 if (ret < 0) { 3327 return ret; 3328 } 3329 3330 if (s->get_refcount(refblock, block_index) != 1) { 3331 qcow2_signal_corruption(bs, true, -1, -1, "Invalid refcount:" 3332 " refblock offset %#" PRIx64 3333 ", reftable index %u" 3334 ", block offset %#" PRIx64 3335 ", refcount %#" PRIx64, 3336 refblock_offs, 3337 offset_to_reftable_index(s, discard_block_offs), 3338 discard_block_offs, 3339 s->get_refcount(refblock, block_index)); 3340 qcow2_cache_put(s->refcount_block_cache, &refblock); 3341 return -EINVAL; 3342 } 3343 s->set_refcount(refblock, block_index, 0); 3344 3345 qcow2_cache_entry_mark_dirty(s->refcount_block_cache, refblock); 3346 3347 qcow2_cache_put(s->refcount_block_cache, &refblock); 3348 3349 if (cluster_index < s->free_cluster_index) { 3350 s->free_cluster_index = cluster_index; 3351 } 3352 3353 refblock = qcow2_cache_is_table_offset(s->refcount_block_cache, 3354 discard_block_offs); 3355 if (refblock) { 3356 /* discard refblock from the cache if refblock is cached */ 3357 qcow2_cache_discard(s->refcount_block_cache, refblock); 3358 } 3359 update_refcount_discard(bs, discard_block_offs, s->cluster_size); 3360 3361 return 0; 3362 } 3363 3364 int qcow2_shrink_reftable(BlockDriverState *bs) 3365 { 3366 BDRVQcow2State *s = bs->opaque; 3367 uint64_t *reftable_tmp = 3368 g_malloc(s->refcount_table_size * sizeof(uint64_t)); 3369 int i, ret; 3370 3371 for (i = 0; i < s->refcount_table_size; i++) { 3372 int64_t refblock_offs = s->refcount_table[i] & REFT_OFFSET_MASK; 3373 void *refblock; 3374 bool unused_block; 3375 3376 if (refblock_offs == 0) { 3377 reftable_tmp[i] = 0; 3378 continue; 3379 } 3380 ret = qcow2_cache_get(bs, s->refcount_block_cache, refblock_offs, 3381 &refblock); 3382 if (ret < 0) { 3383 goto out; 3384 } 3385 3386 /* the refblock has own reference */ 3387 if (i == offset_to_reftable_index(s, refblock_offs)) { 3388 uint64_t block_index = (refblock_offs >> s->cluster_bits) & 3389 (s->refcount_block_size - 1); 3390 uint64_t refcount = s->get_refcount(refblock, block_index); 3391 3392 s->set_refcount(refblock, block_index, 0); 3393 3394 unused_block = buffer_is_zero(refblock, s->cluster_size); 3395 3396 s->set_refcount(refblock, block_index, refcount); 3397 } else { 3398 unused_block = buffer_is_zero(refblock, s->cluster_size); 3399 } 3400 qcow2_cache_put(s->refcount_block_cache, &refblock); 3401 3402 reftable_tmp[i] = unused_block ? 0 : cpu_to_be64(s->refcount_table[i]); 3403 } 3404 3405 ret = bdrv_pwrite_sync(bs->file, s->refcount_table_offset, reftable_tmp, 3406 s->refcount_table_size * sizeof(uint64_t)); 3407 /* 3408 * If the write in the reftable failed the image may contain a partially 3409 * overwritten reftable. In this case it would be better to clear the 3410 * reftable in memory to avoid possible image corruption. 3411 */ 3412 for (i = 0; i < s->refcount_table_size; i++) { 3413 if (s->refcount_table[i] && !reftable_tmp[i]) { 3414 if (ret == 0) { 3415 ret = qcow2_discard_refcount_block(bs, s->refcount_table[i] & 3416 REFT_OFFSET_MASK); 3417 } 3418 s->refcount_table[i] = 0; 3419 } 3420 } 3421 3422 if (!s->cache_discards) { 3423 qcow2_process_discards(bs, ret); 3424 } 3425 3426 out: 3427 g_free(reftable_tmp); 3428 return ret; 3429 } 3430 3431 int64_t qcow2_get_last_cluster(BlockDriverState *bs, int64_t size) 3432 { 3433 BDRVQcow2State *s = bs->opaque; 3434 int64_t i; 3435 3436 for (i = size_to_clusters(s, size) - 1; i >= 0; i--) { 3437 uint64_t refcount; 3438 int ret = qcow2_get_refcount(bs, i, &refcount); 3439 if (ret < 0) { 3440 fprintf(stderr, "Can't get refcount for cluster %" PRId64 ": %s\n", 3441 i, strerror(-ret)); 3442 return ret; 3443 } 3444 if (refcount > 0) { 3445 return i; 3446 } 3447 } 3448 qcow2_signal_corruption(bs, true, -1, -1, 3449 "There are no references in the refcount table."); 3450 return -EIO; 3451 } 3452 3453 int qcow2_detect_metadata_preallocation(BlockDriverState *bs) 3454 { 3455 BDRVQcow2State *s = bs->opaque; 3456 int64_t i, end_cluster, cluster_count = 0, threshold; 3457 int64_t file_length, real_allocation, real_clusters; 3458 3459 qemu_co_mutex_assert_locked(&s->lock); 3460 3461 file_length = bdrv_getlength(bs->file->bs); 3462 if (file_length < 0) { 3463 return file_length; 3464 } 3465 3466 real_allocation = bdrv_get_allocated_file_size(bs->file->bs); 3467 if (real_allocation < 0) { 3468 return real_allocation; 3469 } 3470 3471 real_clusters = real_allocation / s->cluster_size; 3472 threshold = MAX(real_clusters * 10 / 9, real_clusters + 2); 3473 3474 end_cluster = size_to_clusters(s, file_length); 3475 for (i = 0; i < end_cluster && cluster_count < threshold; i++) { 3476 uint64_t refcount; 3477 int ret = qcow2_get_refcount(bs, i, &refcount); 3478 if (ret < 0) { 3479 return ret; 3480 } 3481 cluster_count += !!refcount; 3482 } 3483 3484 return cluster_count >= threshold; 3485 } 3486