xref: /openbmc/qemu/block/qcow2-snapshot.c (revision 0a553c58)
1 /*
2  * Block driver for the QCOW version 2 format
3  *
4  * Copyright (c) 2004-2006 Fabrice Bellard
5  *
6  * Permission is hereby granted, free of charge, to any person obtaining a copy
7  * of this software and associated documentation files (the "Software"), to deal
8  * in the Software without restriction, including without limitation the rights
9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10  * copies of the Software, and to permit persons to whom the Software is
11  * furnished to do so, subject to the following conditions:
12  *
13  * The above copyright notice and this permission notice shall be included in
14  * all copies or substantial portions of the Software.
15  *
16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22  * THE SOFTWARE.
23  */
24 
25 #include "qemu/osdep.h"
26 #include "qapi/error.h"
27 #include "block/block_int.h"
28 #include "qcow2.h"
29 #include "qemu/bswap.h"
30 #include "qemu/error-report.h"
31 #include "qemu/cutils.h"
32 
33 void qcow2_free_snapshots(BlockDriverState *bs)
34 {
35     BDRVQcow2State *s = bs->opaque;
36     int i;
37 
38     for(i = 0; i < s->nb_snapshots; i++) {
39         g_free(s->snapshots[i].name);
40         g_free(s->snapshots[i].id_str);
41     }
42     g_free(s->snapshots);
43     s->snapshots = NULL;
44     s->nb_snapshots = 0;
45 }
46 
47 int qcow2_read_snapshots(BlockDriverState *bs)
48 {
49     BDRVQcow2State *s = bs->opaque;
50     QCowSnapshotHeader h;
51     QCowSnapshotExtraData extra;
52     QCowSnapshot *sn;
53     int i, id_str_size, name_size;
54     int64_t offset;
55     uint32_t extra_data_size;
56     int ret;
57 
58     if (!s->nb_snapshots) {
59         s->snapshots = NULL;
60         s->snapshots_size = 0;
61         return 0;
62     }
63 
64     offset = s->snapshots_offset;
65     s->snapshots = g_new0(QCowSnapshot, s->nb_snapshots);
66 
67     for(i = 0; i < s->nb_snapshots; i++) {
68         /* Read statically sized part of the snapshot header */
69         offset = ROUND_UP(offset, 8);
70         ret = bdrv_pread(bs->file, offset, &h, sizeof(h));
71         if (ret < 0) {
72             goto fail;
73         }
74 
75         offset += sizeof(h);
76         sn = s->snapshots + i;
77         sn->l1_table_offset = be64_to_cpu(h.l1_table_offset);
78         sn->l1_size = be32_to_cpu(h.l1_size);
79         sn->vm_state_size = be32_to_cpu(h.vm_state_size);
80         sn->date_sec = be32_to_cpu(h.date_sec);
81         sn->date_nsec = be32_to_cpu(h.date_nsec);
82         sn->vm_clock_nsec = be64_to_cpu(h.vm_clock_nsec);
83         extra_data_size = be32_to_cpu(h.extra_data_size);
84 
85         id_str_size = be16_to_cpu(h.id_str_size);
86         name_size = be16_to_cpu(h.name_size);
87 
88         /* Read extra data */
89         ret = bdrv_pread(bs->file, offset, &extra,
90                          MIN(sizeof(extra), extra_data_size));
91         if (ret < 0) {
92             goto fail;
93         }
94         offset += extra_data_size;
95 
96         if (extra_data_size >= 8) {
97             sn->vm_state_size = be64_to_cpu(extra.vm_state_size_large);
98         }
99 
100         if (extra_data_size >= 16) {
101             sn->disk_size = be64_to_cpu(extra.disk_size);
102         } else {
103             sn->disk_size = bs->total_sectors * BDRV_SECTOR_SIZE;
104         }
105 
106         /* Read snapshot ID */
107         sn->id_str = g_malloc(id_str_size + 1);
108         ret = bdrv_pread(bs->file, offset, sn->id_str, id_str_size);
109         if (ret < 0) {
110             goto fail;
111         }
112         offset += id_str_size;
113         sn->id_str[id_str_size] = '\0';
114 
115         /* Read snapshot name */
116         sn->name = g_malloc(name_size + 1);
117         ret = bdrv_pread(bs->file, offset, sn->name, name_size);
118         if (ret < 0) {
119             goto fail;
120         }
121         offset += name_size;
122         sn->name[name_size] = '\0';
123 
124         if (offset - s->snapshots_offset > QCOW_MAX_SNAPSHOTS_SIZE) {
125             ret = -EFBIG;
126             goto fail;
127         }
128     }
129 
130     assert(offset - s->snapshots_offset <= INT_MAX);
131     s->snapshots_size = offset - s->snapshots_offset;
132     return 0;
133 
134 fail:
135     qcow2_free_snapshots(bs);
136     return ret;
137 }
138 
139 /* add at the end of the file a new list of snapshots */
140 static int qcow2_write_snapshots(BlockDriverState *bs)
141 {
142     BDRVQcow2State *s = bs->opaque;
143     QCowSnapshot *sn;
144     QCowSnapshotHeader h;
145     QCowSnapshotExtraData extra;
146     int i, name_size, id_str_size, snapshots_size;
147     struct {
148         uint32_t nb_snapshots;
149         uint64_t snapshots_offset;
150     } QEMU_PACKED header_data;
151     int64_t offset, snapshots_offset = 0;
152     int ret;
153 
154     /* compute the size of the snapshots */
155     offset = 0;
156     for(i = 0; i < s->nb_snapshots; i++) {
157         sn = s->snapshots + i;
158         offset = ROUND_UP(offset, 8);
159         offset += sizeof(h);
160         offset += sizeof(extra);
161         offset += strlen(sn->id_str);
162         offset += strlen(sn->name);
163 
164         if (offset > QCOW_MAX_SNAPSHOTS_SIZE) {
165             ret = -EFBIG;
166             goto fail;
167         }
168     }
169 
170     assert(offset <= INT_MAX);
171     snapshots_size = offset;
172 
173     /* Allocate space for the new snapshot list */
174     snapshots_offset = qcow2_alloc_clusters(bs, snapshots_size);
175     offset = snapshots_offset;
176     if (offset < 0) {
177         ret = offset;
178         goto fail;
179     }
180     ret = bdrv_flush(bs);
181     if (ret < 0) {
182         goto fail;
183     }
184 
185     /* The snapshot list position has not yet been updated, so these clusters
186      * must indeed be completely free */
187     ret = qcow2_pre_write_overlap_check(bs, 0, offset, snapshots_size, false);
188     if (ret < 0) {
189         goto fail;
190     }
191 
192 
193     /* Write all snapshots to the new list */
194     for(i = 0; i < s->nb_snapshots; i++) {
195         sn = s->snapshots + i;
196         memset(&h, 0, sizeof(h));
197         h.l1_table_offset = cpu_to_be64(sn->l1_table_offset);
198         h.l1_size = cpu_to_be32(sn->l1_size);
199         /* If it doesn't fit in 32 bit, older implementations should treat it
200          * as a disk-only snapshot rather than truncate the VM state */
201         if (sn->vm_state_size <= 0xffffffff) {
202             h.vm_state_size = cpu_to_be32(sn->vm_state_size);
203         }
204         h.date_sec = cpu_to_be32(sn->date_sec);
205         h.date_nsec = cpu_to_be32(sn->date_nsec);
206         h.vm_clock_nsec = cpu_to_be64(sn->vm_clock_nsec);
207         h.extra_data_size = cpu_to_be32(sizeof(extra));
208 
209         memset(&extra, 0, sizeof(extra));
210         extra.vm_state_size_large = cpu_to_be64(sn->vm_state_size);
211         extra.disk_size = cpu_to_be64(sn->disk_size);
212 
213         id_str_size = strlen(sn->id_str);
214         name_size = strlen(sn->name);
215         assert(id_str_size <= UINT16_MAX && name_size <= UINT16_MAX);
216         h.id_str_size = cpu_to_be16(id_str_size);
217         h.name_size = cpu_to_be16(name_size);
218         offset = ROUND_UP(offset, 8);
219 
220         ret = bdrv_pwrite(bs->file, offset, &h, sizeof(h));
221         if (ret < 0) {
222             goto fail;
223         }
224         offset += sizeof(h);
225 
226         ret = bdrv_pwrite(bs->file, offset, &extra, sizeof(extra));
227         if (ret < 0) {
228             goto fail;
229         }
230         offset += sizeof(extra);
231 
232         ret = bdrv_pwrite(bs->file, offset, sn->id_str, id_str_size);
233         if (ret < 0) {
234             goto fail;
235         }
236         offset += id_str_size;
237 
238         ret = bdrv_pwrite(bs->file, offset, sn->name, name_size);
239         if (ret < 0) {
240             goto fail;
241         }
242         offset += name_size;
243     }
244 
245     /*
246      * Update the header to point to the new snapshot table. This requires the
247      * new table and its refcounts to be stable on disk.
248      */
249     ret = bdrv_flush(bs);
250     if (ret < 0) {
251         goto fail;
252     }
253 
254     QEMU_BUILD_BUG_ON(offsetof(QCowHeader, snapshots_offset) !=
255         offsetof(QCowHeader, nb_snapshots) + sizeof(header_data.nb_snapshots));
256 
257     header_data.nb_snapshots        = cpu_to_be32(s->nb_snapshots);
258     header_data.snapshots_offset    = cpu_to_be64(snapshots_offset);
259 
260     ret = bdrv_pwrite_sync(bs->file, offsetof(QCowHeader, nb_snapshots),
261                            &header_data, sizeof(header_data));
262     if (ret < 0) {
263         goto fail;
264     }
265 
266     /* free the old snapshot table */
267     qcow2_free_clusters(bs, s->snapshots_offset, s->snapshots_size,
268                         QCOW2_DISCARD_SNAPSHOT);
269     s->snapshots_offset = snapshots_offset;
270     s->snapshots_size = snapshots_size;
271     return 0;
272 
273 fail:
274     if (snapshots_offset > 0) {
275         qcow2_free_clusters(bs, snapshots_offset, snapshots_size,
276                             QCOW2_DISCARD_ALWAYS);
277     }
278     return ret;
279 }
280 
281 static void find_new_snapshot_id(BlockDriverState *bs,
282                                  char *id_str, int id_str_size)
283 {
284     BDRVQcow2State *s = bs->opaque;
285     QCowSnapshot *sn;
286     int i;
287     unsigned long id, id_max = 0;
288 
289     for(i = 0; i < s->nb_snapshots; i++) {
290         sn = s->snapshots + i;
291         id = strtoul(sn->id_str, NULL, 10);
292         if (id > id_max)
293             id_max = id;
294     }
295     snprintf(id_str, id_str_size, "%lu", id_max + 1);
296 }
297 
298 static int find_snapshot_by_id_and_name(BlockDriverState *bs,
299                                         const char *id,
300                                         const char *name)
301 {
302     BDRVQcow2State *s = bs->opaque;
303     int i;
304 
305     if (id && name) {
306         for (i = 0; i < s->nb_snapshots; i++) {
307             if (!strcmp(s->snapshots[i].id_str, id) &&
308                 !strcmp(s->snapshots[i].name, name)) {
309                 return i;
310             }
311         }
312     } else if (id) {
313         for (i = 0; i < s->nb_snapshots; i++) {
314             if (!strcmp(s->snapshots[i].id_str, id)) {
315                 return i;
316             }
317         }
318     } else if (name) {
319         for (i = 0; i < s->nb_snapshots; i++) {
320             if (!strcmp(s->snapshots[i].name, name)) {
321                 return i;
322             }
323         }
324     }
325 
326     return -1;
327 }
328 
329 static int find_snapshot_by_id_or_name(BlockDriverState *bs,
330                                        const char *id_or_name)
331 {
332     int ret;
333 
334     ret = find_snapshot_by_id_and_name(bs, id_or_name, NULL);
335     if (ret >= 0) {
336         return ret;
337     }
338     return find_snapshot_by_id_and_name(bs, NULL, id_or_name);
339 }
340 
341 /* if no id is provided, a new one is constructed */
342 int qcow2_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)
343 {
344     BDRVQcow2State *s = bs->opaque;
345     QCowSnapshot *new_snapshot_list = NULL;
346     QCowSnapshot *old_snapshot_list = NULL;
347     QCowSnapshot sn1, *sn = &sn1;
348     int i, ret;
349     uint64_t *l1_table = NULL;
350     int64_t l1_table_offset;
351 
352     if (s->nb_snapshots >= QCOW_MAX_SNAPSHOTS) {
353         return -EFBIG;
354     }
355 
356     if (has_data_file(bs)) {
357         return -ENOTSUP;
358     }
359 
360     memset(sn, 0, sizeof(*sn));
361 
362     /* Generate an ID */
363     find_new_snapshot_id(bs, sn_info->id_str, sizeof(sn_info->id_str));
364 
365     /* Populate sn with passed data */
366     sn->id_str = g_strdup(sn_info->id_str);
367     sn->name = g_strdup(sn_info->name);
368 
369     sn->disk_size = bs->total_sectors * BDRV_SECTOR_SIZE;
370     sn->vm_state_size = sn_info->vm_state_size;
371     sn->date_sec = sn_info->date_sec;
372     sn->date_nsec = sn_info->date_nsec;
373     sn->vm_clock_nsec = sn_info->vm_clock_nsec;
374 
375     /* Allocate the L1 table of the snapshot and copy the current one there. */
376     l1_table_offset = qcow2_alloc_clusters(bs, s->l1_size * sizeof(uint64_t));
377     if (l1_table_offset < 0) {
378         ret = l1_table_offset;
379         goto fail;
380     }
381 
382     sn->l1_table_offset = l1_table_offset;
383     sn->l1_size = s->l1_size;
384 
385     l1_table = g_try_new(uint64_t, s->l1_size);
386     if (s->l1_size && l1_table == NULL) {
387         ret = -ENOMEM;
388         goto fail;
389     }
390 
391     for(i = 0; i < s->l1_size; i++) {
392         l1_table[i] = cpu_to_be64(s->l1_table[i]);
393     }
394 
395     ret = qcow2_pre_write_overlap_check(bs, 0, sn->l1_table_offset,
396                                         s->l1_size * sizeof(uint64_t), false);
397     if (ret < 0) {
398         goto fail;
399     }
400 
401     ret = bdrv_pwrite(bs->file, sn->l1_table_offset, l1_table,
402                       s->l1_size * sizeof(uint64_t));
403     if (ret < 0) {
404         goto fail;
405     }
406 
407     g_free(l1_table);
408     l1_table = NULL;
409 
410     /*
411      * Increase the refcounts of all clusters and make sure everything is
412      * stable on disk before updating the snapshot table to contain a pointer
413      * to the new L1 table.
414      */
415     ret = qcow2_update_snapshot_refcount(bs, s->l1_table_offset, s->l1_size, 1);
416     if (ret < 0) {
417         goto fail;
418     }
419 
420     /* Append the new snapshot to the snapshot list */
421     new_snapshot_list = g_new(QCowSnapshot, s->nb_snapshots + 1);
422     if (s->snapshots) {
423         memcpy(new_snapshot_list, s->snapshots,
424                s->nb_snapshots * sizeof(QCowSnapshot));
425         old_snapshot_list = s->snapshots;
426     }
427     s->snapshots = new_snapshot_list;
428     s->snapshots[s->nb_snapshots++] = *sn;
429 
430     ret = qcow2_write_snapshots(bs);
431     if (ret < 0) {
432         g_free(s->snapshots);
433         s->snapshots = old_snapshot_list;
434         s->nb_snapshots--;
435         goto fail;
436     }
437 
438     g_free(old_snapshot_list);
439 
440     /* The VM state isn't needed any more in the active L1 table; in fact, it
441      * hurts by causing expensive COW for the next snapshot. */
442     qcow2_cluster_discard(bs, qcow2_vm_state_offset(s),
443                           ROUND_UP(sn->vm_state_size, s->cluster_size),
444                           QCOW2_DISCARD_NEVER, false);
445 
446 #ifdef DEBUG_ALLOC
447     {
448       BdrvCheckResult result = {0};
449       qcow2_check_refcounts(bs, &result, 0);
450     }
451 #endif
452     return 0;
453 
454 fail:
455     g_free(sn->id_str);
456     g_free(sn->name);
457     g_free(l1_table);
458 
459     return ret;
460 }
461 
462 /* copy the snapshot 'snapshot_name' into the current disk image */
463 int qcow2_snapshot_goto(BlockDriverState *bs, const char *snapshot_id)
464 {
465     BDRVQcow2State *s = bs->opaque;
466     QCowSnapshot *sn;
467     Error *local_err = NULL;
468     int i, snapshot_index;
469     int cur_l1_bytes, sn_l1_bytes;
470     int ret;
471     uint64_t *sn_l1_table = NULL;
472 
473     if (has_data_file(bs)) {
474         return -ENOTSUP;
475     }
476 
477     /* Search the snapshot */
478     snapshot_index = find_snapshot_by_id_or_name(bs, snapshot_id);
479     if (snapshot_index < 0) {
480         return -ENOENT;
481     }
482     sn = &s->snapshots[snapshot_index];
483 
484     ret = qcow2_validate_table(bs, sn->l1_table_offset, sn->l1_size,
485                                sizeof(uint64_t), QCOW_MAX_L1_SIZE,
486                                "Snapshot L1 table", &local_err);
487     if (ret < 0) {
488         error_report_err(local_err);
489         goto fail;
490     }
491 
492     if (sn->disk_size != bs->total_sectors * BDRV_SECTOR_SIZE) {
493         error_report("qcow2: Loading snapshots with different disk "
494             "size is not implemented");
495         ret = -ENOTSUP;
496         goto fail;
497     }
498 
499     /*
500      * Make sure that the current L1 table is big enough to contain the whole
501      * L1 table of the snapshot. If the snapshot L1 table is smaller, the
502      * current one must be padded with zeros.
503      */
504     ret = qcow2_grow_l1_table(bs, sn->l1_size, true);
505     if (ret < 0) {
506         goto fail;
507     }
508 
509     cur_l1_bytes = s->l1_size * sizeof(uint64_t);
510     sn_l1_bytes = sn->l1_size * sizeof(uint64_t);
511 
512     /*
513      * Copy the snapshot L1 table to the current L1 table.
514      *
515      * Before overwriting the old current L1 table on disk, make sure to
516      * increase all refcounts for the clusters referenced by the new one.
517      * Decrease the refcount referenced by the old one only when the L1
518      * table is overwritten.
519      */
520     sn_l1_table = g_try_malloc0(cur_l1_bytes);
521     if (cur_l1_bytes && sn_l1_table == NULL) {
522         ret = -ENOMEM;
523         goto fail;
524     }
525 
526     ret = bdrv_pread(bs->file, sn->l1_table_offset,
527                      sn_l1_table, sn_l1_bytes);
528     if (ret < 0) {
529         goto fail;
530     }
531 
532     ret = qcow2_update_snapshot_refcount(bs, sn->l1_table_offset,
533                                          sn->l1_size, 1);
534     if (ret < 0) {
535         goto fail;
536     }
537 
538     ret = qcow2_pre_write_overlap_check(bs, QCOW2_OL_ACTIVE_L1,
539                                         s->l1_table_offset, cur_l1_bytes,
540                                         false);
541     if (ret < 0) {
542         goto fail;
543     }
544 
545     ret = bdrv_pwrite_sync(bs->file, s->l1_table_offset, sn_l1_table,
546                            cur_l1_bytes);
547     if (ret < 0) {
548         goto fail;
549     }
550 
551     /*
552      * Decrease refcount of clusters of current L1 table.
553      *
554      * At this point, the in-memory s->l1_table points to the old L1 table,
555      * whereas on disk we already have the new one.
556      *
557      * qcow2_update_snapshot_refcount special cases the current L1 table to use
558      * the in-memory data instead of really using the offset to load a new one,
559      * which is why this works.
560      */
561     ret = qcow2_update_snapshot_refcount(bs, s->l1_table_offset,
562                                          s->l1_size, -1);
563 
564     /*
565      * Now update the in-memory L1 table to be in sync with the on-disk one. We
566      * need to do this even if updating refcounts failed.
567      */
568     for(i = 0;i < s->l1_size; i++) {
569         s->l1_table[i] = be64_to_cpu(sn_l1_table[i]);
570     }
571 
572     if (ret < 0) {
573         goto fail;
574     }
575 
576     g_free(sn_l1_table);
577     sn_l1_table = NULL;
578 
579     /*
580      * Update QCOW_OFLAG_COPIED in the active L1 table (it may have changed
581      * when we decreased the refcount of the old snapshot.
582      */
583     ret = qcow2_update_snapshot_refcount(bs, s->l1_table_offset, s->l1_size, 0);
584     if (ret < 0) {
585         goto fail;
586     }
587 
588 #ifdef DEBUG_ALLOC
589     {
590         BdrvCheckResult result = {0};
591         qcow2_check_refcounts(bs, &result, 0);
592     }
593 #endif
594     return 0;
595 
596 fail:
597     g_free(sn_l1_table);
598     return ret;
599 }
600 
601 int qcow2_snapshot_delete(BlockDriverState *bs,
602                           const char *snapshot_id,
603                           const char *name,
604                           Error **errp)
605 {
606     BDRVQcow2State *s = bs->opaque;
607     QCowSnapshot sn;
608     int snapshot_index, ret;
609 
610     if (has_data_file(bs)) {
611         return -ENOTSUP;
612     }
613 
614     /* Search the snapshot */
615     snapshot_index = find_snapshot_by_id_and_name(bs, snapshot_id, name);
616     if (snapshot_index < 0) {
617         error_setg(errp, "Can't find the snapshot");
618         return -ENOENT;
619     }
620     sn = s->snapshots[snapshot_index];
621 
622     ret = qcow2_validate_table(bs, sn.l1_table_offset, sn.l1_size,
623                                sizeof(uint64_t), QCOW_MAX_L1_SIZE,
624                                "Snapshot L1 table", errp);
625     if (ret < 0) {
626         return ret;
627     }
628 
629     /* Remove it from the snapshot list */
630     memmove(s->snapshots + snapshot_index,
631             s->snapshots + snapshot_index + 1,
632             (s->nb_snapshots - snapshot_index - 1) * sizeof(sn));
633     s->nb_snapshots--;
634     ret = qcow2_write_snapshots(bs);
635     if (ret < 0) {
636         error_setg_errno(errp, -ret,
637                          "Failed to remove snapshot from snapshot list");
638         return ret;
639     }
640 
641     /*
642      * The snapshot is now unused, clean up. If we fail after this point, we
643      * won't recover but just leak clusters.
644      */
645     g_free(sn.id_str);
646     g_free(sn.name);
647 
648     /*
649      * Now decrease the refcounts of clusters referenced by the snapshot and
650      * free the L1 table.
651      */
652     ret = qcow2_update_snapshot_refcount(bs, sn.l1_table_offset,
653                                          sn.l1_size, -1);
654     if (ret < 0) {
655         error_setg_errno(errp, -ret, "Failed to free the cluster and L1 table");
656         return ret;
657     }
658     qcow2_free_clusters(bs, sn.l1_table_offset, sn.l1_size * sizeof(uint64_t),
659                         QCOW2_DISCARD_SNAPSHOT);
660 
661     /* must update the copied flag on the current cluster offsets */
662     ret = qcow2_update_snapshot_refcount(bs, s->l1_table_offset, s->l1_size, 0);
663     if (ret < 0) {
664         error_setg_errno(errp, -ret,
665                          "Failed to update snapshot status in disk");
666         return ret;
667     }
668 
669 #ifdef DEBUG_ALLOC
670     {
671         BdrvCheckResult result = {0};
672         qcow2_check_refcounts(bs, &result, 0);
673     }
674 #endif
675     return 0;
676 }
677 
678 int qcow2_snapshot_list(BlockDriverState *bs, QEMUSnapshotInfo **psn_tab)
679 {
680     BDRVQcow2State *s = bs->opaque;
681     QEMUSnapshotInfo *sn_tab, *sn_info;
682     QCowSnapshot *sn;
683     int i;
684 
685     if (has_data_file(bs)) {
686         return -ENOTSUP;
687     }
688     if (!s->nb_snapshots) {
689         *psn_tab = NULL;
690         return s->nb_snapshots;
691     }
692 
693     sn_tab = g_new0(QEMUSnapshotInfo, s->nb_snapshots);
694     for(i = 0; i < s->nb_snapshots; i++) {
695         sn_info = sn_tab + i;
696         sn = s->snapshots + i;
697         pstrcpy(sn_info->id_str, sizeof(sn_info->id_str),
698                 sn->id_str);
699         pstrcpy(sn_info->name, sizeof(sn_info->name),
700                 sn->name);
701         sn_info->vm_state_size = sn->vm_state_size;
702         sn_info->date_sec = sn->date_sec;
703         sn_info->date_nsec = sn->date_nsec;
704         sn_info->vm_clock_nsec = sn->vm_clock_nsec;
705     }
706     *psn_tab = sn_tab;
707     return s->nb_snapshots;
708 }
709 
710 int qcow2_snapshot_load_tmp(BlockDriverState *bs,
711                             const char *snapshot_id,
712                             const char *name,
713                             Error **errp)
714 {
715     int i, snapshot_index;
716     BDRVQcow2State *s = bs->opaque;
717     QCowSnapshot *sn;
718     uint64_t *new_l1_table;
719     int new_l1_bytes;
720     int ret;
721 
722     assert(bs->read_only);
723 
724     /* Search the snapshot */
725     snapshot_index = find_snapshot_by_id_and_name(bs, snapshot_id, name);
726     if (snapshot_index < 0) {
727         error_setg(errp,
728                    "Can't find snapshot");
729         return -ENOENT;
730     }
731     sn = &s->snapshots[snapshot_index];
732 
733     /* Allocate and read in the snapshot's L1 table */
734     ret = qcow2_validate_table(bs, sn->l1_table_offset, sn->l1_size,
735                                sizeof(uint64_t), QCOW_MAX_L1_SIZE,
736                                "Snapshot L1 table", errp);
737     if (ret < 0) {
738         return ret;
739     }
740     new_l1_bytes = sn->l1_size * sizeof(uint64_t);
741     new_l1_table = qemu_try_blockalign(bs->file->bs,
742                                        ROUND_UP(new_l1_bytes, 512));
743     if (new_l1_table == NULL) {
744         return -ENOMEM;
745     }
746 
747     ret = bdrv_pread(bs->file, sn->l1_table_offset,
748                      new_l1_table, new_l1_bytes);
749     if (ret < 0) {
750         error_setg(errp, "Failed to read l1 table for snapshot");
751         qemu_vfree(new_l1_table);
752         return ret;
753     }
754 
755     /* Switch the L1 table */
756     qemu_vfree(s->l1_table);
757 
758     s->l1_size = sn->l1_size;
759     s->l1_table_offset = sn->l1_table_offset;
760     s->l1_table = new_l1_table;
761 
762     for(i = 0;i < s->l1_size; i++) {
763         be64_to_cpus(&s->l1_table[i]);
764     }
765 
766     return 0;
767 }
768