xref: /openbmc/qemu/block/qcow2.c (revision 3073c6b99557042476add4ddbcc8c834ae70fce5)
1  /*
2   * Block driver for the QCOW version 2 format
3   *
4   * Copyright (c) 2004-2006 Fabrice Bellard
5   *
6   * Permission is hereby granted, free of charge, to any person obtaining a copy
7   * of this software and associated documentation files (the "Software"), to deal
8   * in the Software without restriction, including without limitation the rights
9   * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10   * copies of the Software, and to permit persons to whom the Software is
11   * furnished to do so, subject to the following conditions:
12   *
13   * The above copyright notice and this permission notice shall be included in
14   * all copies or substantial portions of the Software.
15   *
16   * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17   * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18   * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19   * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20   * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21   * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22   * THE SOFTWARE.
23   */
24  
25  #include "qemu/osdep.h"
26  
27  #include "block/qdict.h"
28  #include "sysemu/block-backend.h"
29  #include "qemu/main-loop.h"
30  #include "qemu/module.h"
31  #include "qcow2.h"
32  #include "qemu/error-report.h"
33  #include "qapi/error.h"
34  #include "qapi/qapi-events-block-core.h"
35  #include "qapi/qmp/qdict.h"
36  #include "qapi/qmp/qstring.h"
37  #include "trace.h"
38  #include "qemu/option_int.h"
39  #include "qemu/cutils.h"
40  #include "qemu/bswap.h"
41  #include "qemu/memalign.h"
42  #include "qapi/qobject-input-visitor.h"
43  #include "qapi/qapi-visit-block-core.h"
44  #include "crypto.h"
45  #include "block/aio_task.h"
46  #include "block/dirty-bitmap.h"
47  
48  /*
49    Differences with QCOW:
50  
51    - Support for multiple incremental snapshots.
52    - Memory management by reference counts.
53    - Clusters which have a reference count of one have the bit
54      QCOW_OFLAG_COPIED to optimize write performance.
55    - Size of compressed clusters is stored in sectors to reduce bit usage
56      in the cluster offsets.
57    - Support for storing additional data (such as the VM state) in the
58      snapshots.
59    - If a backing store is used, the cluster size is not constrained
60      (could be backported to QCOW).
61    - L2 tables have always a size of one cluster.
62  */
63  
64  
65  typedef struct {
66      uint32_t magic;
67      uint32_t len;
68  } QEMU_PACKED QCowExtension;
69  
70  #define  QCOW2_EXT_MAGIC_END 0
71  #define  QCOW2_EXT_MAGIC_BACKING_FORMAT 0xe2792aca
72  #define  QCOW2_EXT_MAGIC_FEATURE_TABLE 0x6803f857
73  #define  QCOW2_EXT_MAGIC_CRYPTO_HEADER 0x0537be77
74  #define  QCOW2_EXT_MAGIC_BITMAPS 0x23852875
75  #define  QCOW2_EXT_MAGIC_DATA_FILE 0x44415441
76  
77  static int coroutine_fn
78  qcow2_co_preadv_compressed(BlockDriverState *bs,
79                             uint64_t l2_entry,
80                             uint64_t offset,
81                             uint64_t bytes,
82                             QEMUIOVector *qiov,
83                             size_t qiov_offset);
84  
85  static int qcow2_probe(const uint8_t *buf, int buf_size, const char *filename)
86  {
87      const QCowHeader *cow_header = (const void *)buf;
88  
89      if (buf_size >= sizeof(QCowHeader) &&
90          be32_to_cpu(cow_header->magic) == QCOW_MAGIC &&
91          be32_to_cpu(cow_header->version) >= 2)
92          return 100;
93      else
94          return 0;
95  }
96  
97  
98  static int GRAPH_RDLOCK
99  qcow2_crypto_hdr_read_func(QCryptoBlock *block, size_t offset,
100                             uint8_t *buf, size_t buflen,
101                             void *opaque, Error **errp)
102  {
103      BlockDriverState *bs = opaque;
104      BDRVQcow2State *s = bs->opaque;
105      ssize_t ret;
106  
107      if ((offset + buflen) > s->crypto_header.length) {
108          error_setg(errp, "Request for data outside of extension header");
109          return -1;
110      }
111  
112      ret = bdrv_pread(bs->file, s->crypto_header.offset + offset, buflen, buf,
113                       0);
114      if (ret < 0) {
115          error_setg_errno(errp, -ret, "Could not read encryption header");
116          return -1;
117      }
118      return 0;
119  }
120  
121  
122  static int coroutine_fn GRAPH_RDLOCK
123  qcow2_crypto_hdr_init_func(QCryptoBlock *block, size_t headerlen, void *opaque,
124                             Error **errp)
125  {
126      BlockDriverState *bs = opaque;
127      BDRVQcow2State *s = bs->opaque;
128      int64_t ret;
129      int64_t clusterlen;
130  
131      ret = qcow2_alloc_clusters(bs, headerlen);
132      if (ret < 0) {
133          error_setg_errno(errp, -ret,
134                           "Cannot allocate cluster for LUKS header size %zu",
135                           headerlen);
136          return -1;
137      }
138  
139      s->crypto_header.length = headerlen;
140      s->crypto_header.offset = ret;
141  
142      /*
143       * Zero fill all space in cluster so it has predictable
144       * content, as we may not initialize some regions of the
145       * header (eg only 1 out of 8 key slots will be initialized)
146       */
147      clusterlen = size_to_clusters(s, headerlen) * s->cluster_size;
148      assert(qcow2_pre_write_overlap_check(bs, 0, ret, clusterlen, false) == 0);
149      ret = bdrv_co_pwrite_zeroes(bs->file, ret, clusterlen, 0);
150      if (ret < 0) {
151          error_setg_errno(errp, -ret, "Could not zero fill encryption header");
152          return -1;
153      }
154  
155      return 0;
156  }
157  
158  
159  /* The graph lock must be held when called in coroutine context */
160  static int coroutine_mixed_fn GRAPH_RDLOCK
161  qcow2_crypto_hdr_write_func(QCryptoBlock *block, size_t offset,
162                              const uint8_t *buf, size_t buflen,
163                              void *opaque, Error **errp)
164  {
165      BlockDriverState *bs = opaque;
166      BDRVQcow2State *s = bs->opaque;
167      ssize_t ret;
168  
169      if ((offset + buflen) > s->crypto_header.length) {
170          error_setg(errp, "Request for data outside of extension header");
171          return -1;
172      }
173  
174      ret = bdrv_pwrite(bs->file, s->crypto_header.offset + offset, buflen, buf,
175                        0);
176      if (ret < 0) {
177          error_setg_errno(errp, -ret, "Could not read encryption header");
178          return -1;
179      }
180      return 0;
181  }
182  
183  static QDict*
184  qcow2_extract_crypto_opts(QemuOpts *opts, const char *fmt, Error **errp)
185  {
186      QDict *cryptoopts_qdict;
187      QDict *opts_qdict;
188  
189      /* Extract "encrypt." options into a qdict */
190      opts_qdict = qemu_opts_to_qdict(opts, NULL);
191      qdict_extract_subqdict(opts_qdict, &cryptoopts_qdict, "encrypt.");
192      qobject_unref(opts_qdict);
193      qdict_put_str(cryptoopts_qdict, "format", fmt);
194      return cryptoopts_qdict;
195  }
196  
197  /*
198   * read qcow2 extension and fill bs
199   * start reading from start_offset
200   * finish reading upon magic of value 0 or when end_offset reached
201   * unknown magic is skipped (future extension this version knows nothing about)
202   * return 0 upon success, non-0 otherwise
203   */
204  static int coroutine_fn GRAPH_RDLOCK
205  qcow2_read_extensions(BlockDriverState *bs, uint64_t start_offset,
206                        uint64_t end_offset, void **p_feature_table,
207                        int flags, bool *need_update_header, Error **errp)
208  {
209      BDRVQcow2State *s = bs->opaque;
210      QCowExtension ext;
211      uint64_t offset;
212      int ret;
213      Qcow2BitmapHeaderExt bitmaps_ext;
214  
215      if (need_update_header != NULL) {
216          *need_update_header = false;
217      }
218  
219  #ifdef DEBUG_EXT
220      printf("qcow2_read_extensions: start=%ld end=%ld\n", start_offset, end_offset);
221  #endif
222      offset = start_offset;
223      while (offset < end_offset) {
224  
225  #ifdef DEBUG_EXT
226          /* Sanity check */
227          if (offset > s->cluster_size)
228              printf("qcow2_read_extension: suspicious offset %lu\n", offset);
229  
230          printf("attempting to read extended header in offset %lu\n", offset);
231  #endif
232  
233          ret = bdrv_co_pread(bs->file, offset, sizeof(ext), &ext, 0);
234          if (ret < 0) {
235              error_setg_errno(errp, -ret, "qcow2_read_extension: ERROR: "
236                               "pread fail from offset %" PRIu64, offset);
237              return 1;
238          }
239          ext.magic = be32_to_cpu(ext.magic);
240          ext.len = be32_to_cpu(ext.len);
241          offset += sizeof(ext);
242  #ifdef DEBUG_EXT
243          printf("ext.magic = 0x%x\n", ext.magic);
244  #endif
245          if (offset > end_offset || ext.len > end_offset - offset) {
246              error_setg(errp, "Header extension too large");
247              return -EINVAL;
248          }
249  
250          switch (ext.magic) {
251          case QCOW2_EXT_MAGIC_END:
252              return 0;
253  
254          case QCOW2_EXT_MAGIC_BACKING_FORMAT:
255              if (ext.len >= sizeof(bs->backing_format)) {
256                  error_setg(errp, "ERROR: ext_backing_format: len=%" PRIu32
257                             " too large (>=%zu)", ext.len,
258                             sizeof(bs->backing_format));
259                  return 2;
260              }
261              ret = bdrv_co_pread(bs->file, offset, ext.len, bs->backing_format, 0);
262              if (ret < 0) {
263                  error_setg_errno(errp, -ret, "ERROR: ext_backing_format: "
264                                   "Could not read format name");
265                  return 3;
266              }
267              bs->backing_format[ext.len] = '\0';
268              s->image_backing_format = g_strdup(bs->backing_format);
269  #ifdef DEBUG_EXT
270              printf("Qcow2: Got format extension %s\n", bs->backing_format);
271  #endif
272              break;
273  
274          case QCOW2_EXT_MAGIC_FEATURE_TABLE:
275              if (p_feature_table != NULL) {
276                  void *feature_table = g_malloc0(ext.len + 2 * sizeof(Qcow2Feature));
277                  ret = bdrv_co_pread(bs->file, offset, ext.len, feature_table, 0);
278                  if (ret < 0) {
279                      error_setg_errno(errp, -ret, "ERROR: ext_feature_table: "
280                                       "Could not read table");
281                      g_free(feature_table);
282                      return ret;
283                  }
284  
285                  *p_feature_table = feature_table;
286              }
287              break;
288  
289          case QCOW2_EXT_MAGIC_CRYPTO_HEADER: {
290              unsigned int cflags = 0;
291              if (s->crypt_method_header != QCOW_CRYPT_LUKS) {
292                  error_setg(errp, "CRYPTO header extension only "
293                             "expected with LUKS encryption method");
294                  return -EINVAL;
295              }
296              if (ext.len != sizeof(Qcow2CryptoHeaderExtension)) {
297                  error_setg(errp, "CRYPTO header extension size %u, "
298                             "but expected size %zu", ext.len,
299                             sizeof(Qcow2CryptoHeaderExtension));
300                  return -EINVAL;
301              }
302  
303              ret = bdrv_co_pread(bs->file, offset, ext.len, &s->crypto_header, 0);
304              if (ret < 0) {
305                  error_setg_errno(errp, -ret,
306                                   "Unable to read CRYPTO header extension");
307                  return ret;
308              }
309              s->crypto_header.offset = be64_to_cpu(s->crypto_header.offset);
310              s->crypto_header.length = be64_to_cpu(s->crypto_header.length);
311  
312              if ((s->crypto_header.offset % s->cluster_size) != 0) {
313                  error_setg(errp, "Encryption header offset '%" PRIu64 "' is "
314                             "not a multiple of cluster size '%u'",
315                             s->crypto_header.offset, s->cluster_size);
316                  return -EINVAL;
317              }
318  
319              if (flags & BDRV_O_NO_IO) {
320                  cflags |= QCRYPTO_BLOCK_OPEN_NO_IO;
321              }
322              s->crypto = qcrypto_block_open(s->crypto_opts, "encrypt.",
323                                             qcow2_crypto_hdr_read_func,
324                                             bs, cflags, errp);
325              if (!s->crypto) {
326                  return -EINVAL;
327              }
328          }   break;
329  
330          case QCOW2_EXT_MAGIC_BITMAPS:
331              if (ext.len != sizeof(bitmaps_ext)) {
332                  error_setg_errno(errp, -ret, "bitmaps_ext: "
333                                   "Invalid extension length");
334                  return -EINVAL;
335              }
336  
337              if (!(s->autoclear_features & QCOW2_AUTOCLEAR_BITMAPS)) {
338                  if (s->qcow_version < 3) {
339                      /* Let's be a bit more specific */
340                      warn_report("This qcow2 v2 image contains bitmaps, but "
341                                  "they may have been modified by a program "
342                                  "without persistent bitmap support; so now "
343                                  "they must all be considered inconsistent");
344                  } else {
345                      warn_report("a program lacking bitmap support "
346                                  "modified this file, so all bitmaps are now "
347                                  "considered inconsistent");
348                  }
349                  error_printf("Some clusters may be leaked, "
350                               "run 'qemu-img check -r' on the image "
351                               "file to fix.");
352                  if (need_update_header != NULL) {
353                      /* Updating is needed to drop invalid bitmap extension. */
354                      *need_update_header = true;
355                  }
356                  break;
357              }
358  
359              ret = bdrv_co_pread(bs->file, offset, ext.len, &bitmaps_ext, 0);
360              if (ret < 0) {
361                  error_setg_errno(errp, -ret, "bitmaps_ext: "
362                                   "Could not read ext header");
363                  return ret;
364              }
365  
366              if (bitmaps_ext.reserved32 != 0) {
367                  error_setg_errno(errp, -ret, "bitmaps_ext: "
368                                   "Reserved field is not zero");
369                  return -EINVAL;
370              }
371  
372              bitmaps_ext.nb_bitmaps = be32_to_cpu(bitmaps_ext.nb_bitmaps);
373              bitmaps_ext.bitmap_directory_size =
374                  be64_to_cpu(bitmaps_ext.bitmap_directory_size);
375              bitmaps_ext.bitmap_directory_offset =
376                  be64_to_cpu(bitmaps_ext.bitmap_directory_offset);
377  
378              if (bitmaps_ext.nb_bitmaps > QCOW2_MAX_BITMAPS) {
379                  error_setg(errp,
380                             "bitmaps_ext: Image has %" PRIu32 " bitmaps, "
381                             "exceeding the QEMU supported maximum of %d",
382                             bitmaps_ext.nb_bitmaps, QCOW2_MAX_BITMAPS);
383                  return -EINVAL;
384              }
385  
386              if (bitmaps_ext.nb_bitmaps == 0) {
387                  error_setg(errp, "found bitmaps extension with zero bitmaps");
388                  return -EINVAL;
389              }
390  
391              if (offset_into_cluster(s, bitmaps_ext.bitmap_directory_offset)) {
392                  error_setg(errp, "bitmaps_ext: "
393                                   "invalid bitmap directory offset");
394                  return -EINVAL;
395              }
396  
397              if (bitmaps_ext.bitmap_directory_size >
398                  QCOW2_MAX_BITMAP_DIRECTORY_SIZE) {
399                  error_setg(errp, "bitmaps_ext: "
400                                   "bitmap directory size (%" PRIu64 ") exceeds "
401                                   "the maximum supported size (%d)",
402                                   bitmaps_ext.bitmap_directory_size,
403                                   QCOW2_MAX_BITMAP_DIRECTORY_SIZE);
404                  return -EINVAL;
405              }
406  
407              s->nb_bitmaps = bitmaps_ext.nb_bitmaps;
408              s->bitmap_directory_offset =
409                      bitmaps_ext.bitmap_directory_offset;
410              s->bitmap_directory_size =
411                      bitmaps_ext.bitmap_directory_size;
412  
413  #ifdef DEBUG_EXT
414              printf("Qcow2: Got bitmaps extension: "
415                     "offset=%" PRIu64 " nb_bitmaps=%" PRIu32 "\n",
416                     s->bitmap_directory_offset, s->nb_bitmaps);
417  #endif
418              break;
419  
420          case QCOW2_EXT_MAGIC_DATA_FILE:
421          {
422              s->image_data_file = g_malloc0(ext.len + 1);
423              ret = bdrv_co_pread(bs->file, offset, ext.len, s->image_data_file, 0);
424              if (ret < 0) {
425                  error_setg_errno(errp, -ret,
426                                   "ERROR: Could not read data file name");
427                  return ret;
428              }
429  #ifdef DEBUG_EXT
430              printf("Qcow2: Got external data file %s\n", s->image_data_file);
431  #endif
432              break;
433          }
434  
435          default:
436              /* unknown magic - save it in case we need to rewrite the header */
437              /* If you add a new feature, make sure to also update the fast
438               * path of qcow2_make_empty() to deal with it. */
439              {
440                  Qcow2UnknownHeaderExtension *uext;
441  
442                  uext = g_malloc0(sizeof(*uext)  + ext.len);
443                  uext->magic = ext.magic;
444                  uext->len = ext.len;
445                  QLIST_INSERT_HEAD(&s->unknown_header_ext, uext, next);
446  
447                  ret = bdrv_co_pread(bs->file, offset, uext->len, uext->data, 0);
448                  if (ret < 0) {
449                      error_setg_errno(errp, -ret, "ERROR: unknown extension: "
450                                       "Could not read data");
451                      return ret;
452                  }
453              }
454              break;
455          }
456  
457          offset += ((ext.len + 7) & ~7);
458      }
459  
460      return 0;
461  }
462  
463  static void cleanup_unknown_header_ext(BlockDriverState *bs)
464  {
465      BDRVQcow2State *s = bs->opaque;
466      Qcow2UnknownHeaderExtension *uext, *next;
467  
468      QLIST_FOREACH_SAFE(uext, &s->unknown_header_ext, next, next) {
469          QLIST_REMOVE(uext, next);
470          g_free(uext);
471      }
472  }
473  
474  static void report_unsupported_feature(Error **errp, Qcow2Feature *table,
475                                         uint64_t mask)
476  {
477      g_autoptr(GString) features = g_string_sized_new(60);
478  
479      while (table && table->name[0] != '\0') {
480          if (table->type == QCOW2_FEAT_TYPE_INCOMPATIBLE) {
481              if (mask & (1ULL << table->bit)) {
482                  if (features->len > 0) {
483                      g_string_append(features, ", ");
484                  }
485                  g_string_append_printf(features, "%.46s", table->name);
486                  mask &= ~(1ULL << table->bit);
487              }
488          }
489          table++;
490      }
491  
492      if (mask) {
493          if (features->len > 0) {
494              g_string_append(features, ", ");
495          }
496          g_string_append_printf(features,
497                                 "Unknown incompatible feature: %" PRIx64, mask);
498      }
499  
500      error_setg(errp, "Unsupported qcow2 feature(s): %s", features->str);
501  }
502  
503  /*
504   * Sets the dirty bit and flushes afterwards if necessary.
505   *
506   * The incompatible_features bit is only set if the image file header was
507   * updated successfully.  Therefore it is not required to check the return
508   * value of this function.
509   */
510  int qcow2_mark_dirty(BlockDriverState *bs)
511  {
512      BDRVQcow2State *s = bs->opaque;
513      uint64_t val;
514      int ret;
515  
516      assert(s->qcow_version >= 3);
517  
518      if (s->incompatible_features & QCOW2_INCOMPAT_DIRTY) {
519          return 0; /* already dirty */
520      }
521  
522      val = cpu_to_be64(s->incompatible_features | QCOW2_INCOMPAT_DIRTY);
523      ret = bdrv_pwrite_sync(bs->file,
524                             offsetof(QCowHeader, incompatible_features),
525                             sizeof(val), &val, 0);
526      if (ret < 0) {
527          return ret;
528      }
529  
530      /* Only treat image as dirty if the header was updated successfully */
531      s->incompatible_features |= QCOW2_INCOMPAT_DIRTY;
532      return 0;
533  }
534  
535  /*
536   * Clears the dirty bit and flushes before if necessary.  Only call this
537   * function when there are no pending requests, it does not guard against
538   * concurrent requests dirtying the image.
539   */
540  static int GRAPH_RDLOCK qcow2_mark_clean(BlockDriverState *bs)
541  {
542      BDRVQcow2State *s = bs->opaque;
543  
544      if (s->incompatible_features & QCOW2_INCOMPAT_DIRTY) {
545          int ret;
546  
547          s->incompatible_features &= ~QCOW2_INCOMPAT_DIRTY;
548  
549          ret = qcow2_flush_caches(bs);
550          if (ret < 0) {
551              return ret;
552          }
553  
554          return qcow2_update_header(bs);
555      }
556      return 0;
557  }
558  
559  /*
560   * Marks the image as corrupt.
561   */
562  int qcow2_mark_corrupt(BlockDriverState *bs)
563  {
564      BDRVQcow2State *s = bs->opaque;
565  
566      s->incompatible_features |= QCOW2_INCOMPAT_CORRUPT;
567      return qcow2_update_header(bs);
568  }
569  
570  /*
571   * Marks the image as consistent, i.e., unsets the corrupt bit, and flushes
572   * before if necessary.
573   */
574  static int coroutine_fn GRAPH_RDLOCK
575  qcow2_mark_consistent(BlockDriverState *bs)
576  {
577      BDRVQcow2State *s = bs->opaque;
578  
579      if (s->incompatible_features & QCOW2_INCOMPAT_CORRUPT) {
580          int ret = qcow2_flush_caches(bs);
581          if (ret < 0) {
582              return ret;
583          }
584  
585          s->incompatible_features &= ~QCOW2_INCOMPAT_CORRUPT;
586          return qcow2_update_header(bs);
587      }
588      return 0;
589  }
590  
591  static void qcow2_add_check_result(BdrvCheckResult *out,
592                                     const BdrvCheckResult *src,
593                                     bool set_allocation_info)
594  {
595      out->corruptions += src->corruptions;
596      out->leaks += src->leaks;
597      out->check_errors += src->check_errors;
598      out->corruptions_fixed += src->corruptions_fixed;
599      out->leaks_fixed += src->leaks_fixed;
600  
601      if (set_allocation_info) {
602          out->image_end_offset = src->image_end_offset;
603          out->bfi = src->bfi;
604      }
605  }
606  
607  static int coroutine_fn GRAPH_RDLOCK
608  qcow2_co_check_locked(BlockDriverState *bs, BdrvCheckResult *result,
609                        BdrvCheckMode fix)
610  {
611      BdrvCheckResult snapshot_res = {};
612      BdrvCheckResult refcount_res = {};
613      int ret;
614  
615      memset(result, 0, sizeof(*result));
616  
617      ret = qcow2_check_read_snapshot_table(bs, &snapshot_res, fix);
618      if (ret < 0) {
619          qcow2_add_check_result(result, &snapshot_res, false);
620          return ret;
621      }
622  
623      ret = qcow2_check_refcounts(bs, &refcount_res, fix);
624      qcow2_add_check_result(result, &refcount_res, true);
625      if (ret < 0) {
626          qcow2_add_check_result(result, &snapshot_res, false);
627          return ret;
628      }
629  
630      ret = qcow2_check_fix_snapshot_table(bs, &snapshot_res, fix);
631      qcow2_add_check_result(result, &snapshot_res, false);
632      if (ret < 0) {
633          return ret;
634      }
635  
636      if (fix && result->check_errors == 0 && result->corruptions == 0) {
637          ret = qcow2_mark_clean(bs);
638          if (ret < 0) {
639              return ret;
640          }
641          return qcow2_mark_consistent(bs);
642      }
643      return ret;
644  }
645  
646  static int coroutine_fn GRAPH_RDLOCK
647  qcow2_co_check(BlockDriverState *bs, BdrvCheckResult *result,
648                 BdrvCheckMode fix)
649  {
650      BDRVQcow2State *s = bs->opaque;
651      int ret;
652  
653      qemu_co_mutex_lock(&s->lock);
654      ret = qcow2_co_check_locked(bs, result, fix);
655      qemu_co_mutex_unlock(&s->lock);
656      return ret;
657  }
658  
659  int qcow2_validate_table(BlockDriverState *bs, uint64_t offset,
660                           uint64_t entries, size_t entry_len,
661                           int64_t max_size_bytes, const char *table_name,
662                           Error **errp)
663  {
664      BDRVQcow2State *s = bs->opaque;
665  
666      if (entries > max_size_bytes / entry_len) {
667          error_setg(errp, "%s too large", table_name);
668          return -EFBIG;
669      }
670  
671      /* Use signed INT64_MAX as the maximum even for uint64_t header fields,
672       * because values will be passed to qemu functions taking int64_t. */
673      if ((INT64_MAX - entries * entry_len < offset) ||
674          (offset_into_cluster(s, offset) != 0)) {
675          error_setg(errp, "%s offset invalid", table_name);
676          return -EINVAL;
677      }
678  
679      return 0;
680  }
681  
682  static const char *const mutable_opts[] = {
683      QCOW2_OPT_LAZY_REFCOUNTS,
684      QCOW2_OPT_DISCARD_REQUEST,
685      QCOW2_OPT_DISCARD_SNAPSHOT,
686      QCOW2_OPT_DISCARD_OTHER,
687      QCOW2_OPT_DISCARD_NO_UNREF,
688      QCOW2_OPT_OVERLAP,
689      QCOW2_OPT_OVERLAP_TEMPLATE,
690      QCOW2_OPT_OVERLAP_MAIN_HEADER,
691      QCOW2_OPT_OVERLAP_ACTIVE_L1,
692      QCOW2_OPT_OVERLAP_ACTIVE_L2,
693      QCOW2_OPT_OVERLAP_REFCOUNT_TABLE,
694      QCOW2_OPT_OVERLAP_REFCOUNT_BLOCK,
695      QCOW2_OPT_OVERLAP_SNAPSHOT_TABLE,
696      QCOW2_OPT_OVERLAP_INACTIVE_L1,
697      QCOW2_OPT_OVERLAP_INACTIVE_L2,
698      QCOW2_OPT_OVERLAP_BITMAP_DIRECTORY,
699      QCOW2_OPT_CACHE_SIZE,
700      QCOW2_OPT_L2_CACHE_SIZE,
701      QCOW2_OPT_L2_CACHE_ENTRY_SIZE,
702      QCOW2_OPT_REFCOUNT_CACHE_SIZE,
703      QCOW2_OPT_CACHE_CLEAN_INTERVAL,
704      NULL
705  };
706  
707  static QemuOptsList qcow2_runtime_opts = {
708      .name = "qcow2",
709      .head = QTAILQ_HEAD_INITIALIZER(qcow2_runtime_opts.head),
710      .desc = {
711          {
712              .name = QCOW2_OPT_LAZY_REFCOUNTS,
713              .type = QEMU_OPT_BOOL,
714              .help = "Postpone refcount updates",
715          },
716          {
717              .name = QCOW2_OPT_DISCARD_REQUEST,
718              .type = QEMU_OPT_BOOL,
719              .help = "Pass guest discard requests to the layer below",
720          },
721          {
722              .name = QCOW2_OPT_DISCARD_SNAPSHOT,
723              .type = QEMU_OPT_BOOL,
724              .help = "Generate discard requests when snapshot related space "
725                      "is freed",
726          },
727          {
728              .name = QCOW2_OPT_DISCARD_OTHER,
729              .type = QEMU_OPT_BOOL,
730              .help = "Generate discard requests when other clusters are freed",
731          },
732          {
733              .name = QCOW2_OPT_DISCARD_NO_UNREF,
734              .type = QEMU_OPT_BOOL,
735              .help = "Do not unreference discarded clusters",
736          },
737          {
738              .name = QCOW2_OPT_OVERLAP,
739              .type = QEMU_OPT_STRING,
740              .help = "Selects which overlap checks to perform from a range of "
741                      "templates (none, constant, cached, all)",
742          },
743          {
744              .name = QCOW2_OPT_OVERLAP_TEMPLATE,
745              .type = QEMU_OPT_STRING,
746              .help = "Selects which overlap checks to perform from a range of "
747                      "templates (none, constant, cached, all)",
748          },
749          {
750              .name = QCOW2_OPT_OVERLAP_MAIN_HEADER,
751              .type = QEMU_OPT_BOOL,
752              .help = "Check for unintended writes into the main qcow2 header",
753          },
754          {
755              .name = QCOW2_OPT_OVERLAP_ACTIVE_L1,
756              .type = QEMU_OPT_BOOL,
757              .help = "Check for unintended writes into the active L1 table",
758          },
759          {
760              .name = QCOW2_OPT_OVERLAP_ACTIVE_L2,
761              .type = QEMU_OPT_BOOL,
762              .help = "Check for unintended writes into an active L2 table",
763          },
764          {
765              .name = QCOW2_OPT_OVERLAP_REFCOUNT_TABLE,
766              .type = QEMU_OPT_BOOL,
767              .help = "Check for unintended writes into the refcount table",
768          },
769          {
770              .name = QCOW2_OPT_OVERLAP_REFCOUNT_BLOCK,
771              .type = QEMU_OPT_BOOL,
772              .help = "Check for unintended writes into a refcount block",
773          },
774          {
775              .name = QCOW2_OPT_OVERLAP_SNAPSHOT_TABLE,
776              .type = QEMU_OPT_BOOL,
777              .help = "Check for unintended writes into the snapshot table",
778          },
779          {
780              .name = QCOW2_OPT_OVERLAP_INACTIVE_L1,
781              .type = QEMU_OPT_BOOL,
782              .help = "Check for unintended writes into an inactive L1 table",
783          },
784          {
785              .name = QCOW2_OPT_OVERLAP_INACTIVE_L2,
786              .type = QEMU_OPT_BOOL,
787              .help = "Check for unintended writes into an inactive L2 table",
788          },
789          {
790              .name = QCOW2_OPT_OVERLAP_BITMAP_DIRECTORY,
791              .type = QEMU_OPT_BOOL,
792              .help = "Check for unintended writes into the bitmap directory",
793          },
794          {
795              .name = QCOW2_OPT_CACHE_SIZE,
796              .type = QEMU_OPT_SIZE,
797              .help = "Maximum combined metadata (L2 tables and refcount blocks) "
798                      "cache size",
799          },
800          {
801              .name = QCOW2_OPT_L2_CACHE_SIZE,
802              .type = QEMU_OPT_SIZE,
803              .help = "Maximum L2 table cache size",
804          },
805          {
806              .name = QCOW2_OPT_L2_CACHE_ENTRY_SIZE,
807              .type = QEMU_OPT_SIZE,
808              .help = "Size of each entry in the L2 cache",
809          },
810          {
811              .name = QCOW2_OPT_REFCOUNT_CACHE_SIZE,
812              .type = QEMU_OPT_SIZE,
813              .help = "Maximum refcount block cache size",
814          },
815          {
816              .name = QCOW2_OPT_CACHE_CLEAN_INTERVAL,
817              .type = QEMU_OPT_NUMBER,
818              .help = "Clean unused cache entries after this time (in seconds)",
819          },
820          BLOCK_CRYPTO_OPT_DEF_KEY_SECRET("encrypt.",
821              "ID of secret providing qcow2 AES key or LUKS passphrase"),
822          { /* end of list */ }
823      },
824  };
825  
826  static const char *overlap_bool_option_names[QCOW2_OL_MAX_BITNR] = {
827      [QCOW2_OL_MAIN_HEADER_BITNR]      = QCOW2_OPT_OVERLAP_MAIN_HEADER,
828      [QCOW2_OL_ACTIVE_L1_BITNR]        = QCOW2_OPT_OVERLAP_ACTIVE_L1,
829      [QCOW2_OL_ACTIVE_L2_BITNR]        = QCOW2_OPT_OVERLAP_ACTIVE_L2,
830      [QCOW2_OL_REFCOUNT_TABLE_BITNR]   = QCOW2_OPT_OVERLAP_REFCOUNT_TABLE,
831      [QCOW2_OL_REFCOUNT_BLOCK_BITNR]   = QCOW2_OPT_OVERLAP_REFCOUNT_BLOCK,
832      [QCOW2_OL_SNAPSHOT_TABLE_BITNR]   = QCOW2_OPT_OVERLAP_SNAPSHOT_TABLE,
833      [QCOW2_OL_INACTIVE_L1_BITNR]      = QCOW2_OPT_OVERLAP_INACTIVE_L1,
834      [QCOW2_OL_INACTIVE_L2_BITNR]      = QCOW2_OPT_OVERLAP_INACTIVE_L2,
835      [QCOW2_OL_BITMAP_DIRECTORY_BITNR] = QCOW2_OPT_OVERLAP_BITMAP_DIRECTORY,
836  };
837  
838  static void cache_clean_timer_cb(void *opaque)
839  {
840      BlockDriverState *bs = opaque;
841      BDRVQcow2State *s = bs->opaque;
842      qcow2_cache_clean_unused(s->l2_table_cache);
843      qcow2_cache_clean_unused(s->refcount_block_cache);
844      timer_mod(s->cache_clean_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) +
845                (int64_t) s->cache_clean_interval * 1000);
846  }
847  
848  static void cache_clean_timer_init(BlockDriverState *bs, AioContext *context)
849  {
850      BDRVQcow2State *s = bs->opaque;
851      if (s->cache_clean_interval > 0) {
852          s->cache_clean_timer =
853              aio_timer_new_with_attrs(context, QEMU_CLOCK_VIRTUAL,
854                                       SCALE_MS, QEMU_TIMER_ATTR_EXTERNAL,
855                                       cache_clean_timer_cb, bs);
856          timer_mod(s->cache_clean_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) +
857                    (int64_t) s->cache_clean_interval * 1000);
858      }
859  }
860  
861  static void cache_clean_timer_del(BlockDriverState *bs)
862  {
863      BDRVQcow2State *s = bs->opaque;
864      if (s->cache_clean_timer) {
865          timer_free(s->cache_clean_timer);
866          s->cache_clean_timer = NULL;
867      }
868  }
869  
870  static void qcow2_detach_aio_context(BlockDriverState *bs)
871  {
872      cache_clean_timer_del(bs);
873  }
874  
875  static void qcow2_attach_aio_context(BlockDriverState *bs,
876                                       AioContext *new_context)
877  {
878      cache_clean_timer_init(bs, new_context);
879  }
880  
881  static bool read_cache_sizes(BlockDriverState *bs, QemuOpts *opts,
882                               uint64_t *l2_cache_size,
883                               uint64_t *l2_cache_entry_size,
884                               uint64_t *refcount_cache_size, Error **errp)
885  {
886      BDRVQcow2State *s = bs->opaque;
887      uint64_t combined_cache_size, l2_cache_max_setting;
888      bool l2_cache_size_set, refcount_cache_size_set, combined_cache_size_set;
889      bool l2_cache_entry_size_set;
890      int min_refcount_cache = MIN_REFCOUNT_CACHE_SIZE * s->cluster_size;
891      uint64_t virtual_disk_size = bs->total_sectors * BDRV_SECTOR_SIZE;
892      uint64_t max_l2_entries = DIV_ROUND_UP(virtual_disk_size, s->cluster_size);
893      /* An L2 table is always one cluster in size so the max cache size
894       * should be a multiple of the cluster size. */
895      uint64_t max_l2_cache = ROUND_UP(max_l2_entries * l2_entry_size(s),
896                                       s->cluster_size);
897  
898      combined_cache_size_set = qemu_opt_get(opts, QCOW2_OPT_CACHE_SIZE);
899      l2_cache_size_set = qemu_opt_get(opts, QCOW2_OPT_L2_CACHE_SIZE);
900      refcount_cache_size_set = qemu_opt_get(opts, QCOW2_OPT_REFCOUNT_CACHE_SIZE);
901      l2_cache_entry_size_set = qemu_opt_get(opts, QCOW2_OPT_L2_CACHE_ENTRY_SIZE);
902  
903      combined_cache_size = qemu_opt_get_size(opts, QCOW2_OPT_CACHE_SIZE, 0);
904      l2_cache_max_setting = qemu_opt_get_size(opts, QCOW2_OPT_L2_CACHE_SIZE,
905                                               DEFAULT_L2_CACHE_MAX_SIZE);
906      *refcount_cache_size = qemu_opt_get_size(opts,
907                                               QCOW2_OPT_REFCOUNT_CACHE_SIZE, 0);
908  
909      *l2_cache_entry_size = qemu_opt_get_size(
910          opts, QCOW2_OPT_L2_CACHE_ENTRY_SIZE, s->cluster_size);
911  
912      *l2_cache_size = MIN(max_l2_cache, l2_cache_max_setting);
913  
914      if (combined_cache_size_set) {
915          if (l2_cache_size_set && refcount_cache_size_set) {
916              error_setg(errp, QCOW2_OPT_CACHE_SIZE ", " QCOW2_OPT_L2_CACHE_SIZE
917                         " and " QCOW2_OPT_REFCOUNT_CACHE_SIZE " may not be set "
918                         "at the same time");
919              return false;
920          } else if (l2_cache_size_set &&
921                     (l2_cache_max_setting > combined_cache_size)) {
922              error_setg(errp, QCOW2_OPT_L2_CACHE_SIZE " may not exceed "
923                         QCOW2_OPT_CACHE_SIZE);
924              return false;
925          } else if (*refcount_cache_size > combined_cache_size) {
926              error_setg(errp, QCOW2_OPT_REFCOUNT_CACHE_SIZE " may not exceed "
927                         QCOW2_OPT_CACHE_SIZE);
928              return false;
929          }
930  
931          if (l2_cache_size_set) {
932              *refcount_cache_size = combined_cache_size - *l2_cache_size;
933          } else if (refcount_cache_size_set) {
934              *l2_cache_size = combined_cache_size - *refcount_cache_size;
935          } else {
936              /* Assign as much memory as possible to the L2 cache, and
937               * use the remainder for the refcount cache */
938              if (combined_cache_size >= max_l2_cache + min_refcount_cache) {
939                  *l2_cache_size = max_l2_cache;
940                  *refcount_cache_size = combined_cache_size - *l2_cache_size;
941              } else {
942                  *refcount_cache_size =
943                      MIN(combined_cache_size, min_refcount_cache);
944                  *l2_cache_size = combined_cache_size - *refcount_cache_size;
945              }
946          }
947      }
948  
949      /*
950       * If the L2 cache is not enough to cover the whole disk then
951       * default to 4KB entries. Smaller entries reduce the cost of
952       * loads and evictions and increase I/O performance.
953       */
954      if (*l2_cache_size < max_l2_cache && !l2_cache_entry_size_set) {
955          *l2_cache_entry_size = MIN(s->cluster_size, 4096);
956      }
957  
958      /* l2_cache_size and refcount_cache_size are ensured to have at least
959       * their minimum values in qcow2_update_options_prepare() */
960  
961      if (*l2_cache_entry_size < (1 << MIN_CLUSTER_BITS) ||
962          *l2_cache_entry_size > s->cluster_size ||
963          !is_power_of_2(*l2_cache_entry_size)) {
964          error_setg(errp, "L2 cache entry size must be a power of two "
965                     "between %d and the cluster size (%d)",
966                     1 << MIN_CLUSTER_BITS, s->cluster_size);
967          return false;
968      }
969  
970      return true;
971  }
972  
973  typedef struct Qcow2ReopenState {
974      Qcow2Cache *l2_table_cache;
975      Qcow2Cache *refcount_block_cache;
976      int l2_slice_size; /* Number of entries in a slice of the L2 table */
977      bool use_lazy_refcounts;
978      int overlap_check;
979      bool discard_passthrough[QCOW2_DISCARD_MAX];
980      bool discard_no_unref;
981      uint64_t cache_clean_interval;
982      QCryptoBlockOpenOptions *crypto_opts; /* Disk encryption runtime options */
983  } Qcow2ReopenState;
984  
985  static int GRAPH_RDLOCK
986  qcow2_update_options_prepare(BlockDriverState *bs, Qcow2ReopenState *r,
987                               QDict *options, int flags, Error **errp)
988  {
989      BDRVQcow2State *s = bs->opaque;
990      QemuOpts *opts = NULL;
991      const char *opt_overlap_check, *opt_overlap_check_template;
992      int overlap_check_template = 0;
993      uint64_t l2_cache_size, l2_cache_entry_size, refcount_cache_size;
994      int i;
995      const char *encryptfmt;
996      QDict *encryptopts = NULL;
997      int ret;
998  
999      qdict_extract_subqdict(options, &encryptopts, "encrypt.");
1000      encryptfmt = qdict_get_try_str(encryptopts, "format");
1001  
1002      opts = qemu_opts_create(&qcow2_runtime_opts, NULL, 0, &error_abort);
1003      if (!qemu_opts_absorb_qdict(opts, options, errp)) {
1004          ret = -EINVAL;
1005          goto fail;
1006      }
1007  
1008      /* get L2 table/refcount block cache size from command line options */
1009      if (!read_cache_sizes(bs, opts, &l2_cache_size, &l2_cache_entry_size,
1010                            &refcount_cache_size, errp)) {
1011          ret = -EINVAL;
1012          goto fail;
1013      }
1014  
1015      l2_cache_size /= l2_cache_entry_size;
1016      if (l2_cache_size < MIN_L2_CACHE_SIZE) {
1017          l2_cache_size = MIN_L2_CACHE_SIZE;
1018      }
1019      if (l2_cache_size > INT_MAX) {
1020          error_setg(errp, "L2 cache size too big");
1021          ret = -EINVAL;
1022          goto fail;
1023      }
1024  
1025      refcount_cache_size /= s->cluster_size;
1026      if (refcount_cache_size < MIN_REFCOUNT_CACHE_SIZE) {
1027          refcount_cache_size = MIN_REFCOUNT_CACHE_SIZE;
1028      }
1029      if (refcount_cache_size > INT_MAX) {
1030          error_setg(errp, "Refcount cache size too big");
1031          ret = -EINVAL;
1032          goto fail;
1033      }
1034  
1035      /* alloc new L2 table/refcount block cache, flush old one */
1036      if (s->l2_table_cache) {
1037          ret = qcow2_cache_flush(bs, s->l2_table_cache);
1038          if (ret) {
1039              error_setg_errno(errp, -ret, "Failed to flush the L2 table cache");
1040              goto fail;
1041          }
1042      }
1043  
1044      if (s->refcount_block_cache) {
1045          ret = qcow2_cache_flush(bs, s->refcount_block_cache);
1046          if (ret) {
1047              error_setg_errno(errp, -ret,
1048                               "Failed to flush the refcount block cache");
1049              goto fail;
1050          }
1051      }
1052  
1053      r->l2_slice_size = l2_cache_entry_size / l2_entry_size(s);
1054      r->l2_table_cache = qcow2_cache_create(bs, l2_cache_size,
1055                                             l2_cache_entry_size);
1056      r->refcount_block_cache = qcow2_cache_create(bs, refcount_cache_size,
1057                                                   s->cluster_size);
1058      if (r->l2_table_cache == NULL || r->refcount_block_cache == NULL) {
1059          error_setg(errp, "Could not allocate metadata caches");
1060          ret = -ENOMEM;
1061          goto fail;
1062      }
1063  
1064      /* New interval for cache cleanup timer */
1065      r->cache_clean_interval =
1066          qemu_opt_get_number(opts, QCOW2_OPT_CACHE_CLEAN_INTERVAL,
1067                              DEFAULT_CACHE_CLEAN_INTERVAL);
1068  #ifndef CONFIG_LINUX
1069      if (r->cache_clean_interval != 0) {
1070          error_setg(errp, QCOW2_OPT_CACHE_CLEAN_INTERVAL
1071                     " not supported on this host");
1072          ret = -EINVAL;
1073          goto fail;
1074      }
1075  #endif
1076      if (r->cache_clean_interval > UINT_MAX) {
1077          error_setg(errp, "Cache clean interval too big");
1078          ret = -EINVAL;
1079          goto fail;
1080      }
1081  
1082      /* lazy-refcounts; flush if going from enabled to disabled */
1083      r->use_lazy_refcounts = qemu_opt_get_bool(opts, QCOW2_OPT_LAZY_REFCOUNTS,
1084          (s->compatible_features & QCOW2_COMPAT_LAZY_REFCOUNTS));
1085      if (r->use_lazy_refcounts && s->qcow_version < 3) {
1086          error_setg(errp, "Lazy refcounts require a qcow2 image with at least "
1087                     "qemu 1.1 compatibility level");
1088          ret = -EINVAL;
1089          goto fail;
1090      }
1091  
1092      if (s->use_lazy_refcounts && !r->use_lazy_refcounts) {
1093          ret = qcow2_mark_clean(bs);
1094          if (ret < 0) {
1095              error_setg_errno(errp, -ret, "Failed to disable lazy refcounts");
1096              goto fail;
1097          }
1098      }
1099  
1100      /* Overlap check options */
1101      opt_overlap_check = qemu_opt_get(opts, QCOW2_OPT_OVERLAP);
1102      opt_overlap_check_template = qemu_opt_get(opts, QCOW2_OPT_OVERLAP_TEMPLATE);
1103      if (opt_overlap_check_template && opt_overlap_check &&
1104          strcmp(opt_overlap_check_template, opt_overlap_check))
1105      {
1106          error_setg(errp, "Conflicting values for qcow2 options '"
1107                     QCOW2_OPT_OVERLAP "' ('%s') and '" QCOW2_OPT_OVERLAP_TEMPLATE
1108                     "' ('%s')", opt_overlap_check, opt_overlap_check_template);
1109          ret = -EINVAL;
1110          goto fail;
1111      }
1112      if (!opt_overlap_check) {
1113          opt_overlap_check = opt_overlap_check_template ?: "cached";
1114      }
1115  
1116      if (!strcmp(opt_overlap_check, "none")) {
1117          overlap_check_template = 0;
1118      } else if (!strcmp(opt_overlap_check, "constant")) {
1119          overlap_check_template = QCOW2_OL_CONSTANT;
1120      } else if (!strcmp(opt_overlap_check, "cached")) {
1121          overlap_check_template = QCOW2_OL_CACHED;
1122      } else if (!strcmp(opt_overlap_check, "all")) {
1123          overlap_check_template = QCOW2_OL_ALL;
1124      } else {
1125          error_setg(errp, "Unsupported value '%s' for qcow2 option "
1126                     "'overlap-check'. Allowed are any of the following: "
1127                     "none, constant, cached, all", opt_overlap_check);
1128          ret = -EINVAL;
1129          goto fail;
1130      }
1131  
1132      r->overlap_check = 0;
1133      for (i = 0; i < QCOW2_OL_MAX_BITNR; i++) {
1134          /* overlap-check defines a template bitmask, but every flag may be
1135           * overwritten through the associated boolean option */
1136          r->overlap_check |=
1137              qemu_opt_get_bool(opts, overlap_bool_option_names[i],
1138                                overlap_check_template & (1 << i)) << i;
1139      }
1140  
1141      r->discard_passthrough[QCOW2_DISCARD_NEVER] = false;
1142      r->discard_passthrough[QCOW2_DISCARD_ALWAYS] = true;
1143      r->discard_passthrough[QCOW2_DISCARD_REQUEST] =
1144          qemu_opt_get_bool(opts, QCOW2_OPT_DISCARD_REQUEST,
1145                            flags & BDRV_O_UNMAP);
1146      r->discard_passthrough[QCOW2_DISCARD_SNAPSHOT] =
1147          qemu_opt_get_bool(opts, QCOW2_OPT_DISCARD_SNAPSHOT, true);
1148      r->discard_passthrough[QCOW2_DISCARD_OTHER] =
1149          qemu_opt_get_bool(opts, QCOW2_OPT_DISCARD_OTHER, false);
1150  
1151      r->discard_no_unref = qemu_opt_get_bool(opts, QCOW2_OPT_DISCARD_NO_UNREF,
1152                                              false);
1153      if (r->discard_no_unref && s->qcow_version < 3) {
1154          error_setg(errp,
1155                     "discard-no-unref is only supported since qcow2 version 3");
1156          ret = -EINVAL;
1157          goto fail;
1158      }
1159  
1160      switch (s->crypt_method_header) {
1161      case QCOW_CRYPT_NONE:
1162          if (encryptfmt) {
1163              error_setg(errp, "No encryption in image header, but options "
1164                         "specified format '%s'", encryptfmt);
1165              ret = -EINVAL;
1166              goto fail;
1167          }
1168          break;
1169  
1170      case QCOW_CRYPT_AES:
1171          if (encryptfmt && !g_str_equal(encryptfmt, "aes")) {
1172              error_setg(errp,
1173                         "Header reported 'aes' encryption format but "
1174                         "options specify '%s'", encryptfmt);
1175              ret = -EINVAL;
1176              goto fail;
1177          }
1178          qdict_put_str(encryptopts, "format", "qcow");
1179          r->crypto_opts = block_crypto_open_opts_init(encryptopts, errp);
1180          if (!r->crypto_opts) {
1181              ret = -EINVAL;
1182              goto fail;
1183          }
1184          break;
1185  
1186      case QCOW_CRYPT_LUKS:
1187          if (encryptfmt && !g_str_equal(encryptfmt, "luks")) {
1188              error_setg(errp,
1189                         "Header reported 'luks' encryption format but "
1190                         "options specify '%s'", encryptfmt);
1191              ret = -EINVAL;
1192              goto fail;
1193          }
1194          qdict_put_str(encryptopts, "format", "luks");
1195          r->crypto_opts = block_crypto_open_opts_init(encryptopts, errp);
1196          if (!r->crypto_opts) {
1197              ret = -EINVAL;
1198              goto fail;
1199          }
1200          break;
1201  
1202      default:
1203          error_setg(errp, "Unsupported encryption method %d",
1204                     s->crypt_method_header);
1205          ret = -EINVAL;
1206          goto fail;
1207      }
1208  
1209      ret = 0;
1210  fail:
1211      qobject_unref(encryptopts);
1212      qemu_opts_del(opts);
1213      opts = NULL;
1214      return ret;
1215  }
1216  
1217  static void qcow2_update_options_commit(BlockDriverState *bs,
1218                                          Qcow2ReopenState *r)
1219  {
1220      BDRVQcow2State *s = bs->opaque;
1221      int i;
1222  
1223      if (s->l2_table_cache) {
1224          qcow2_cache_destroy(s->l2_table_cache);
1225      }
1226      if (s->refcount_block_cache) {
1227          qcow2_cache_destroy(s->refcount_block_cache);
1228      }
1229      s->l2_table_cache = r->l2_table_cache;
1230      s->refcount_block_cache = r->refcount_block_cache;
1231      s->l2_slice_size = r->l2_slice_size;
1232  
1233      s->overlap_check = r->overlap_check;
1234      s->use_lazy_refcounts = r->use_lazy_refcounts;
1235  
1236      for (i = 0; i < QCOW2_DISCARD_MAX; i++) {
1237          s->discard_passthrough[i] = r->discard_passthrough[i];
1238      }
1239  
1240      s->discard_no_unref = r->discard_no_unref;
1241  
1242      if (s->cache_clean_interval != r->cache_clean_interval) {
1243          cache_clean_timer_del(bs);
1244          s->cache_clean_interval = r->cache_clean_interval;
1245          cache_clean_timer_init(bs, bdrv_get_aio_context(bs));
1246      }
1247  
1248      qapi_free_QCryptoBlockOpenOptions(s->crypto_opts);
1249      s->crypto_opts = r->crypto_opts;
1250  }
1251  
1252  static void qcow2_update_options_abort(BlockDriverState *bs,
1253                                         Qcow2ReopenState *r)
1254  {
1255      if (r->l2_table_cache) {
1256          qcow2_cache_destroy(r->l2_table_cache);
1257      }
1258      if (r->refcount_block_cache) {
1259          qcow2_cache_destroy(r->refcount_block_cache);
1260      }
1261      qapi_free_QCryptoBlockOpenOptions(r->crypto_opts);
1262  }
1263  
1264  static int coroutine_fn GRAPH_RDLOCK
1265  qcow2_update_options(BlockDriverState *bs, QDict *options, int flags,
1266                       Error **errp)
1267  {
1268      Qcow2ReopenState r = {};
1269      int ret;
1270  
1271      ret = qcow2_update_options_prepare(bs, &r, options, flags, errp);
1272      if (ret >= 0) {
1273          qcow2_update_options_commit(bs, &r);
1274      } else {
1275          qcow2_update_options_abort(bs, &r);
1276      }
1277  
1278      return ret;
1279  }
1280  
1281  static int validate_compression_type(BDRVQcow2State *s, Error **errp)
1282  {
1283      switch (s->compression_type) {
1284      case QCOW2_COMPRESSION_TYPE_ZLIB:
1285  #ifdef CONFIG_ZSTD
1286      case QCOW2_COMPRESSION_TYPE_ZSTD:
1287  #endif
1288          break;
1289  
1290      default:
1291          error_setg(errp, "qcow2: unknown compression type: %u",
1292                     s->compression_type);
1293          return -ENOTSUP;
1294      }
1295  
1296      /*
1297       * if the compression type differs from QCOW2_COMPRESSION_TYPE_ZLIB
1298       * the incompatible feature flag must be set
1299       */
1300      if (s->compression_type == QCOW2_COMPRESSION_TYPE_ZLIB) {
1301          if (s->incompatible_features & QCOW2_INCOMPAT_COMPRESSION) {
1302              error_setg(errp, "qcow2: Compression type incompatible feature "
1303                               "bit must not be set");
1304              return -EINVAL;
1305          }
1306      } else {
1307          if (!(s->incompatible_features & QCOW2_INCOMPAT_COMPRESSION)) {
1308              error_setg(errp, "qcow2: Compression type incompatible feature "
1309                               "bit must be set");
1310              return -EINVAL;
1311          }
1312      }
1313  
1314      return 0;
1315  }
1316  
1317  /* Called with s->lock held.  */
1318  static int coroutine_fn GRAPH_RDLOCK
1319  qcow2_do_open(BlockDriverState *bs, QDict *options, int flags,
1320                bool open_data_file, Error **errp)
1321  {
1322      ERRP_GUARD();
1323      BDRVQcow2State *s = bs->opaque;
1324      unsigned int len, i;
1325      int ret = 0;
1326      QCowHeader header;
1327      uint64_t ext_end;
1328      uint64_t l1_vm_state_index;
1329      bool update_header = false;
1330  
1331      ret = bdrv_co_pread(bs->file, 0, sizeof(header), &header, 0);
1332      if (ret < 0) {
1333          error_setg_errno(errp, -ret, "Could not read qcow2 header");
1334          goto fail;
1335      }
1336      header.magic = be32_to_cpu(header.magic);
1337      header.version = be32_to_cpu(header.version);
1338      header.backing_file_offset = be64_to_cpu(header.backing_file_offset);
1339      header.backing_file_size = be32_to_cpu(header.backing_file_size);
1340      header.size = be64_to_cpu(header.size);
1341      header.cluster_bits = be32_to_cpu(header.cluster_bits);
1342      header.crypt_method = be32_to_cpu(header.crypt_method);
1343      header.l1_table_offset = be64_to_cpu(header.l1_table_offset);
1344      header.l1_size = be32_to_cpu(header.l1_size);
1345      header.refcount_table_offset = be64_to_cpu(header.refcount_table_offset);
1346      header.refcount_table_clusters =
1347          be32_to_cpu(header.refcount_table_clusters);
1348      header.snapshots_offset = be64_to_cpu(header.snapshots_offset);
1349      header.nb_snapshots = be32_to_cpu(header.nb_snapshots);
1350  
1351      if (header.magic != QCOW_MAGIC) {
1352          error_setg(errp, "Image is not in qcow2 format");
1353          ret = -EINVAL;
1354          goto fail;
1355      }
1356      if (header.version < 2 || header.version > 3) {
1357          error_setg(errp, "Unsupported qcow2 version %" PRIu32, header.version);
1358          ret = -ENOTSUP;
1359          goto fail;
1360      }
1361  
1362      s->qcow_version = header.version;
1363  
1364      /* Initialise cluster size */
1365      if (header.cluster_bits < MIN_CLUSTER_BITS ||
1366          header.cluster_bits > MAX_CLUSTER_BITS) {
1367          error_setg(errp, "Unsupported cluster size: 2^%" PRIu32,
1368                     header.cluster_bits);
1369          ret = -EINVAL;
1370          goto fail;
1371      }
1372  
1373      s->cluster_bits = header.cluster_bits;
1374      s->cluster_size = 1 << s->cluster_bits;
1375  
1376      /* Initialise version 3 header fields */
1377      if (header.version == 2) {
1378          header.incompatible_features    = 0;
1379          header.compatible_features      = 0;
1380          header.autoclear_features       = 0;
1381          header.refcount_order           = 4;
1382          header.header_length            = 72;
1383      } else {
1384          header.incompatible_features =
1385              be64_to_cpu(header.incompatible_features);
1386          header.compatible_features = be64_to_cpu(header.compatible_features);
1387          header.autoclear_features = be64_to_cpu(header.autoclear_features);
1388          header.refcount_order = be32_to_cpu(header.refcount_order);
1389          header.header_length = be32_to_cpu(header.header_length);
1390  
1391          if (header.header_length < 104) {
1392              error_setg(errp, "qcow2 header too short");
1393              ret = -EINVAL;
1394              goto fail;
1395          }
1396      }
1397  
1398      if (header.header_length > s->cluster_size) {
1399          error_setg(errp, "qcow2 header exceeds cluster size");
1400          ret = -EINVAL;
1401          goto fail;
1402      }
1403  
1404      if (header.header_length > sizeof(header)) {
1405          s->unknown_header_fields_size = header.header_length - sizeof(header);
1406          s->unknown_header_fields = g_malloc(s->unknown_header_fields_size);
1407          ret = bdrv_co_pread(bs->file, sizeof(header),
1408                              s->unknown_header_fields_size,
1409                              s->unknown_header_fields, 0);
1410          if (ret < 0) {
1411              error_setg_errno(errp, -ret, "Could not read unknown qcow2 header "
1412                               "fields");
1413              goto fail;
1414          }
1415      }
1416  
1417      if (header.backing_file_offset > s->cluster_size) {
1418          error_setg(errp, "Invalid backing file offset");
1419          ret = -EINVAL;
1420          goto fail;
1421      }
1422  
1423      if (header.backing_file_offset) {
1424          ext_end = header.backing_file_offset;
1425      } else {
1426          ext_end = 1 << header.cluster_bits;
1427      }
1428  
1429      /* Handle feature bits */
1430      s->incompatible_features    = header.incompatible_features;
1431      s->compatible_features      = header.compatible_features;
1432      s->autoclear_features       = header.autoclear_features;
1433  
1434      /*
1435       * Handle compression type
1436       * Older qcow2 images don't contain the compression type header.
1437       * Distinguish them by the header length and use
1438       * the only valid (default) compression type in that case
1439       */
1440      if (header.header_length > offsetof(QCowHeader, compression_type)) {
1441          s->compression_type = header.compression_type;
1442      } else {
1443          s->compression_type = QCOW2_COMPRESSION_TYPE_ZLIB;
1444      }
1445  
1446      ret = validate_compression_type(s, errp);
1447      if (ret) {
1448          goto fail;
1449      }
1450  
1451      if (s->incompatible_features & ~QCOW2_INCOMPAT_MASK) {
1452          void *feature_table = NULL;
1453          qcow2_read_extensions(bs, header.header_length, ext_end,
1454                                &feature_table, flags, NULL, NULL);
1455          report_unsupported_feature(errp, feature_table,
1456                                     s->incompatible_features &
1457                                     ~QCOW2_INCOMPAT_MASK);
1458          ret = -ENOTSUP;
1459          g_free(feature_table);
1460          goto fail;
1461      }
1462  
1463      if (s->incompatible_features & QCOW2_INCOMPAT_CORRUPT) {
1464          /* Corrupt images may not be written to unless they are being repaired
1465           */
1466          if ((flags & BDRV_O_RDWR) && !(flags & BDRV_O_CHECK)) {
1467              error_setg(errp, "qcow2: Image is corrupt; cannot be opened "
1468                         "read/write");
1469              ret = -EACCES;
1470              goto fail;
1471          }
1472      }
1473  
1474      s->subclusters_per_cluster =
1475          has_subclusters(s) ? QCOW_EXTL2_SUBCLUSTERS_PER_CLUSTER : 1;
1476      s->subcluster_size = s->cluster_size / s->subclusters_per_cluster;
1477      s->subcluster_bits = ctz32(s->subcluster_size);
1478  
1479      if (s->subcluster_size < (1 << MIN_CLUSTER_BITS)) {
1480          error_setg(errp, "Unsupported subcluster size: %d", s->subcluster_size);
1481          ret = -EINVAL;
1482          goto fail;
1483      }
1484  
1485      /* Check support for various header values */
1486      if (header.refcount_order > 6) {
1487          error_setg(errp, "Reference count entry width too large; may not "
1488                     "exceed 64 bits");
1489          ret = -EINVAL;
1490          goto fail;
1491      }
1492      s->refcount_order = header.refcount_order;
1493      s->refcount_bits = 1 << s->refcount_order;
1494      s->refcount_max = UINT64_C(1) << (s->refcount_bits - 1);
1495      s->refcount_max += s->refcount_max - 1;
1496  
1497      s->crypt_method_header = header.crypt_method;
1498      if (s->crypt_method_header) {
1499          if (bdrv_uses_whitelist() &&
1500              s->crypt_method_header == QCOW_CRYPT_AES) {
1501              error_setg(errp,
1502                         "Use of AES-CBC encrypted qcow2 images is no longer "
1503                         "supported in system emulators");
1504              error_append_hint(errp,
1505                                "You can use 'qemu-img convert' to convert your "
1506                                "image to an alternative supported format, such "
1507                                "as unencrypted qcow2, or raw with the LUKS "
1508                                "format instead.\n");
1509              ret = -ENOSYS;
1510              goto fail;
1511          }
1512  
1513          if (s->crypt_method_header == QCOW_CRYPT_AES) {
1514              s->crypt_physical_offset = false;
1515          } else {
1516              /* Assuming LUKS and any future crypt methods we
1517               * add will all use physical offsets, due to the
1518               * fact that the alternative is insecure...  */
1519              s->crypt_physical_offset = true;
1520          }
1521  
1522          bs->encrypted = true;
1523      }
1524  
1525      s->l2_bits = s->cluster_bits - ctz32(l2_entry_size(s));
1526      s->l2_size = 1 << s->l2_bits;
1527      /* 2^(s->refcount_order - 3) is the refcount width in bytes */
1528      s->refcount_block_bits = s->cluster_bits - (s->refcount_order - 3);
1529      s->refcount_block_size = 1 << s->refcount_block_bits;
1530      bs->total_sectors = header.size / BDRV_SECTOR_SIZE;
1531      s->csize_shift = (62 - (s->cluster_bits - 8));
1532      s->csize_mask = (1 << (s->cluster_bits - 8)) - 1;
1533      s->cluster_offset_mask = (1LL << s->csize_shift) - 1;
1534  
1535      s->refcount_table_offset = header.refcount_table_offset;
1536      s->refcount_table_size =
1537          header.refcount_table_clusters << (s->cluster_bits - 3);
1538  
1539      if (header.refcount_table_clusters == 0 && !(flags & BDRV_O_CHECK)) {
1540          error_setg(errp, "Image does not contain a reference count table");
1541          ret = -EINVAL;
1542          goto fail;
1543      }
1544  
1545      ret = qcow2_validate_table(bs, s->refcount_table_offset,
1546                                 header.refcount_table_clusters,
1547                                 s->cluster_size, QCOW_MAX_REFTABLE_SIZE,
1548                                 "Reference count table", errp);
1549      if (ret < 0) {
1550          goto fail;
1551      }
1552  
1553      if (!(flags & BDRV_O_CHECK)) {
1554          /*
1555           * The total size in bytes of the snapshot table is checked in
1556           * qcow2_read_snapshots() because the size of each snapshot is
1557           * variable and we don't know it yet.
1558           * Here we only check the offset and number of snapshots.
1559           */
1560          ret = qcow2_validate_table(bs, header.snapshots_offset,
1561                                     header.nb_snapshots,
1562                                     sizeof(QCowSnapshotHeader),
1563                                     sizeof(QCowSnapshotHeader) *
1564                                         QCOW_MAX_SNAPSHOTS,
1565                                     "Snapshot table", errp);
1566          if (ret < 0) {
1567              goto fail;
1568          }
1569      }
1570  
1571      /* read the level 1 table */
1572      ret = qcow2_validate_table(bs, header.l1_table_offset,
1573                                 header.l1_size, L1E_SIZE,
1574                                 QCOW_MAX_L1_SIZE, "Active L1 table", errp);
1575      if (ret < 0) {
1576          goto fail;
1577      }
1578      s->l1_size = header.l1_size;
1579      s->l1_table_offset = header.l1_table_offset;
1580  
1581      l1_vm_state_index = size_to_l1(s, header.size);
1582      if (l1_vm_state_index > INT_MAX) {
1583          error_setg(errp, "Image is too big");
1584          ret = -EFBIG;
1585          goto fail;
1586      }
1587      s->l1_vm_state_index = l1_vm_state_index;
1588  
1589      /* the L1 table must contain at least enough entries to put
1590         header.size bytes */
1591      if (s->l1_size < s->l1_vm_state_index) {
1592          error_setg(errp, "L1 table is too small");
1593          ret = -EINVAL;
1594          goto fail;
1595      }
1596  
1597      if (s->l1_size > 0) {
1598          s->l1_table = qemu_try_blockalign(bs->file->bs, s->l1_size * L1E_SIZE);
1599          if (s->l1_table == NULL) {
1600              error_setg(errp, "Could not allocate L1 table");
1601              ret = -ENOMEM;
1602              goto fail;
1603          }
1604          ret = bdrv_co_pread(bs->file, s->l1_table_offset, s->l1_size * L1E_SIZE,
1605                              s->l1_table, 0);
1606          if (ret < 0) {
1607              error_setg_errno(errp, -ret, "Could not read L1 table");
1608              goto fail;
1609          }
1610          for(i = 0;i < s->l1_size; i++) {
1611              s->l1_table[i] = be64_to_cpu(s->l1_table[i]);
1612          }
1613      }
1614  
1615      /* Parse driver-specific options */
1616      ret = qcow2_update_options(bs, options, flags, errp);
1617      if (ret < 0) {
1618          goto fail;
1619      }
1620  
1621      s->flags = flags;
1622  
1623      ret = qcow2_refcount_init(bs);
1624      if (ret != 0) {
1625          error_setg_errno(errp, -ret, "Could not initialize refcount handling");
1626          goto fail;
1627      }
1628  
1629      QLIST_INIT(&s->cluster_allocs);
1630      QTAILQ_INIT(&s->discards);
1631  
1632      /* read qcow2 extensions */
1633      if (qcow2_read_extensions(bs, header.header_length, ext_end, NULL,
1634                                flags, &update_header, errp)) {
1635          ret = -EINVAL;
1636          goto fail;
1637      }
1638  
1639      if (open_data_file && (flags & BDRV_O_NO_IO)) {
1640          /*
1641           * Don't open the data file for 'qemu-img info' so that it can be used
1642           * to verify that an untrusted qcow2 image doesn't refer to external
1643           * files.
1644           *
1645           * Note: This still makes has_data_file() return true.
1646           */
1647          if (s->incompatible_features & QCOW2_INCOMPAT_DATA_FILE) {
1648              s->data_file = NULL;
1649          } else {
1650              s->data_file = bs->file;
1651          }
1652          qdict_extract_subqdict(options, NULL, "data-file.");
1653          qdict_del(options, "data-file");
1654      } else if (open_data_file) {
1655          /* Open external data file */
1656          bdrv_graph_co_rdunlock();
1657          s->data_file = bdrv_co_open_child(NULL, options, "data-file", bs,
1658                                            &child_of_bds, BDRV_CHILD_DATA,
1659                                            true, errp);
1660          bdrv_graph_co_rdlock();
1661          if (*errp) {
1662              ret = -EINVAL;
1663              goto fail;
1664          }
1665  
1666          if (s->incompatible_features & QCOW2_INCOMPAT_DATA_FILE) {
1667              if (!s->data_file && s->image_data_file) {
1668                  bdrv_graph_co_rdunlock();
1669                  s->data_file = bdrv_co_open_child(s->image_data_file, options,
1670                                                    "data-file", bs,
1671                                                    &child_of_bds,
1672                                                    BDRV_CHILD_DATA, false, errp);
1673                  bdrv_graph_co_rdlock();
1674                  if (!s->data_file) {
1675                      ret = -EINVAL;
1676                      goto fail;
1677                  }
1678              }
1679              if (!s->data_file) {
1680                  error_setg(errp, "'data-file' is required for this image");
1681                  ret = -EINVAL;
1682                  goto fail;
1683              }
1684  
1685              /* No data here */
1686              bs->file->role &= ~BDRV_CHILD_DATA;
1687  
1688              /* Must succeed because we have given up permissions if anything */
1689              bdrv_child_refresh_perms(bs, bs->file, &error_abort);
1690          } else {
1691              if (s->data_file) {
1692                  error_setg(errp, "'data-file' can only be set for images with "
1693                                   "an external data file");
1694                  ret = -EINVAL;
1695                  goto fail;
1696              }
1697  
1698              s->data_file = bs->file;
1699  
1700              if (data_file_is_raw(bs)) {
1701                  error_setg(errp, "data-file-raw requires a data file");
1702                  ret = -EINVAL;
1703                  goto fail;
1704              }
1705          }
1706      }
1707  
1708      /* qcow2_read_extension may have set up the crypto context
1709       * if the crypt method needs a header region, some methods
1710       * don't need header extensions, so must check here
1711       */
1712      if (s->crypt_method_header && !s->crypto) {
1713          if (s->crypt_method_header == QCOW_CRYPT_AES) {
1714              unsigned int cflags = 0;
1715              if (flags & BDRV_O_NO_IO) {
1716                  cflags |= QCRYPTO_BLOCK_OPEN_NO_IO;
1717              }
1718              s->crypto = qcrypto_block_open(s->crypto_opts, "encrypt.",
1719                                             NULL, NULL, cflags, errp);
1720              if (!s->crypto) {
1721                  ret = -EINVAL;
1722                  goto fail;
1723              }
1724          } else if (!(flags & BDRV_O_NO_IO)) {
1725              error_setg(errp, "Missing CRYPTO header for crypt method %d",
1726                         s->crypt_method_header);
1727              ret = -EINVAL;
1728              goto fail;
1729          }
1730      }
1731  
1732      /* read the backing file name */
1733      if (header.backing_file_offset != 0) {
1734          len = header.backing_file_size;
1735          if (len > MIN(1023, s->cluster_size - header.backing_file_offset) ||
1736              len >= sizeof(bs->backing_file)) {
1737              error_setg(errp, "Backing file name too long");
1738              ret = -EINVAL;
1739              goto fail;
1740          }
1741  
1742          s->image_backing_file = g_malloc(len + 1);
1743          ret = bdrv_co_pread(bs->file, header.backing_file_offset, len,
1744                              s->image_backing_file, 0);
1745          if (ret < 0) {
1746              error_setg_errno(errp, -ret, "Could not read backing file name");
1747              goto fail;
1748          }
1749          s->image_backing_file[len] = '\0';
1750  
1751          /*
1752           * Update only when something has changed.  This function is called by
1753           * qcow2_co_invalidate_cache(), and we do not want to reset
1754           * auto_backing_file unless necessary.
1755           */
1756          if (!g_str_equal(s->image_backing_file, bs->backing_file)) {
1757              pstrcpy(bs->backing_file, sizeof(bs->backing_file),
1758                      s->image_backing_file);
1759              pstrcpy(bs->auto_backing_file, sizeof(bs->auto_backing_file),
1760                      s->image_backing_file);
1761          }
1762      }
1763  
1764      /*
1765       * Internal snapshots; skip reading them in check mode, because
1766       * we do not need them then, and we do not want to abort because
1767       * of a broken table.
1768       */
1769      if (!(flags & BDRV_O_CHECK)) {
1770          s->snapshots_offset = header.snapshots_offset;
1771          s->nb_snapshots = header.nb_snapshots;
1772  
1773          ret = qcow2_read_snapshots(bs, errp);
1774          if (ret < 0) {
1775              goto fail;
1776          }
1777      }
1778  
1779      /* Clear unknown autoclear feature bits */
1780      update_header |= s->autoclear_features & ~QCOW2_AUTOCLEAR_MASK;
1781      update_header = update_header && bdrv_is_writable(bs);
1782      if (update_header) {
1783          s->autoclear_features &= QCOW2_AUTOCLEAR_MASK;
1784      }
1785  
1786      /* == Handle persistent dirty bitmaps ==
1787       *
1788       * We want load dirty bitmaps in three cases:
1789       *
1790       * 1. Normal open of the disk in active mode, not related to invalidation
1791       *    after migration.
1792       *
1793       * 2. Invalidation of the target vm after pre-copy phase of migration, if
1794       *    bitmaps are _not_ migrating through migration channel, i.e.
1795       *    'dirty-bitmaps' capability is disabled.
1796       *
1797       * 3. Invalidation of source vm after failed or canceled migration.
1798       *    This is a very interesting case. There are two possible types of
1799       *    bitmaps:
1800       *
1801       *    A. Stored on inactivation and removed. They should be loaded from the
1802       *       image.
1803       *
1804       *    B. Not stored: not-persistent bitmaps and bitmaps, migrated through
1805       *       the migration channel (with dirty-bitmaps capability).
1806       *
1807       *    On the other hand, there are two possible sub-cases:
1808       *
1809       *    3.1 disk was changed by somebody else while were inactive. In this
1810       *        case all in-RAM dirty bitmaps (both persistent and not) are
1811       *        definitely invalid. And we don't have any method to determine
1812       *        this.
1813       *
1814       *        Simple and safe thing is to just drop all the bitmaps of type B on
1815       *        inactivation. But in this case we lose bitmaps in valid 4.2 case.
1816       *
1817       *        On the other hand, resuming source vm, if disk was already changed
1818       *        is a bad thing anyway: not only bitmaps, the whole vm state is
1819       *        out of sync with disk.
1820       *
1821       *        This means, that user or management tool, who for some reason
1822       *        decided to resume source vm, after disk was already changed by
1823       *        target vm, should at least drop all dirty bitmaps by hand.
1824       *
1825       *        So, we can ignore this case for now, but TODO: "generation"
1826       *        extension for qcow2, to determine, that image was changed after
1827       *        last inactivation. And if it is changed, we will drop (or at least
1828       *        mark as 'invalid' all the bitmaps of type B, both persistent
1829       *        and not).
1830       *
1831       *    3.2 disk was _not_ changed while were inactive. Bitmaps may be saved
1832       *        to disk ('dirty-bitmaps' capability disabled), or not saved
1833       *        ('dirty-bitmaps' capability enabled), but we don't need to care
1834       *        of: let's load bitmaps as always: stored bitmaps will be loaded,
1835       *        and not stored has flag IN_USE=1 in the image and will be skipped
1836       *        on loading.
1837       *
1838       * One remaining possible case when we don't want load bitmaps:
1839       *
1840       * 4. Open disk in inactive mode in target vm (bitmaps are migrating or
1841       *    will be loaded on invalidation, no needs try loading them before)
1842       */
1843  
1844      if (!(bdrv_get_flags(bs) & BDRV_O_INACTIVE)) {
1845          /* It's case 1, 2 or 3.2. Or 3.1 which is BUG in management layer. */
1846          bool header_updated;
1847          if (!qcow2_load_dirty_bitmaps(bs, &header_updated, errp)) {
1848              ret = -EINVAL;
1849              goto fail;
1850          }
1851  
1852          update_header = update_header && !header_updated;
1853      }
1854  
1855      if (update_header) {
1856          ret = qcow2_update_header(bs);
1857          if (ret < 0) {
1858              error_setg_errno(errp, -ret, "Could not update qcow2 header");
1859              goto fail;
1860          }
1861      }
1862  
1863      bs->supported_zero_flags = header.version >= 3 ?
1864                                 BDRV_REQ_MAY_UNMAP | BDRV_REQ_NO_FALLBACK : 0;
1865      bs->supported_truncate_flags = BDRV_REQ_ZERO_WRITE;
1866  
1867      /* Repair image if dirty */
1868      if (!(flags & BDRV_O_CHECK) && bdrv_is_writable(bs) &&
1869          (s->incompatible_features & QCOW2_INCOMPAT_DIRTY)) {
1870          BdrvCheckResult result = {0};
1871  
1872          ret = qcow2_co_check_locked(bs, &result,
1873                                      BDRV_FIX_ERRORS | BDRV_FIX_LEAKS);
1874          if (ret < 0 || result.check_errors) {
1875              if (ret >= 0) {
1876                  ret = -EIO;
1877              }
1878              error_setg_errno(errp, -ret, "Could not repair dirty image");
1879              goto fail;
1880          }
1881      }
1882  
1883  #ifdef DEBUG_ALLOC
1884      {
1885          BdrvCheckResult result = {0};
1886          qcow2_check_refcounts(bs, &result, 0);
1887      }
1888  #endif
1889  
1890      qemu_co_queue_init(&s->thread_task_queue);
1891  
1892      return ret;
1893  
1894   fail:
1895      g_free(s->image_data_file);
1896      if (open_data_file && has_data_file(bs)) {
1897          bdrv_graph_co_rdunlock();
1898          bdrv_co_unref_child(bs, s->data_file);
1899          bdrv_graph_co_rdlock();
1900          s->data_file = NULL;
1901      }
1902      g_free(s->unknown_header_fields);
1903      cleanup_unknown_header_ext(bs);
1904      qcow2_free_snapshots(bs);
1905      qcow2_refcount_close(bs);
1906      qemu_vfree(s->l1_table);
1907      /* else pre-write overlap checks in cache_destroy may crash */
1908      s->l1_table = NULL;
1909      cache_clean_timer_del(bs);
1910      if (s->l2_table_cache) {
1911          qcow2_cache_destroy(s->l2_table_cache);
1912      }
1913      if (s->refcount_block_cache) {
1914          qcow2_cache_destroy(s->refcount_block_cache);
1915      }
1916      qcrypto_block_free(s->crypto);
1917      qapi_free_QCryptoBlockOpenOptions(s->crypto_opts);
1918      return ret;
1919  }
1920  
1921  typedef struct QCow2OpenCo {
1922      BlockDriverState *bs;
1923      QDict *options;
1924      int flags;
1925      Error **errp;
1926      int ret;
1927  } QCow2OpenCo;
1928  
1929  static void coroutine_fn qcow2_open_entry(void *opaque)
1930  {
1931      QCow2OpenCo *qoc = opaque;
1932      BDRVQcow2State *s = qoc->bs->opaque;
1933  
1934      GRAPH_RDLOCK_GUARD();
1935  
1936      qemu_co_mutex_lock(&s->lock);
1937      qoc->ret = qcow2_do_open(qoc->bs, qoc->options, qoc->flags, true,
1938                               qoc->errp);
1939      qemu_co_mutex_unlock(&s->lock);
1940  
1941      aio_wait_kick();
1942  }
1943  
1944  static int qcow2_open(BlockDriverState *bs, QDict *options, int flags,
1945                        Error **errp)
1946  {
1947      BDRVQcow2State *s = bs->opaque;
1948      QCow2OpenCo qoc = {
1949          .bs = bs,
1950          .options = options,
1951          .flags = flags,
1952          .errp = errp,
1953          .ret = -EINPROGRESS
1954      };
1955      int ret;
1956  
1957      ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
1958      if (ret < 0) {
1959          return ret;
1960      }
1961  
1962      /* Initialise locks */
1963      qemu_co_mutex_init(&s->lock);
1964  
1965      assert(!qemu_in_coroutine());
1966      assert(qemu_get_current_aio_context() == qemu_get_aio_context());
1967  
1968      aio_co_enter(bdrv_get_aio_context(bs),
1969                   qemu_coroutine_create(qcow2_open_entry, &qoc));
1970      AIO_WAIT_WHILE_UNLOCKED(NULL, qoc.ret == -EINPROGRESS);
1971  
1972      return qoc.ret;
1973  }
1974  
1975  static void qcow2_refresh_limits(BlockDriverState *bs, Error **errp)
1976  {
1977      BDRVQcow2State *s = bs->opaque;
1978  
1979      if (bs->encrypted) {
1980          /* Encryption works on a sector granularity */
1981          bs->bl.request_alignment = qcrypto_block_get_sector_size(s->crypto);
1982      }
1983      bs->bl.pwrite_zeroes_alignment = s->subcluster_size;
1984      bs->bl.pdiscard_alignment = s->cluster_size;
1985  }
1986  
1987  static int GRAPH_UNLOCKED
1988  qcow2_reopen_prepare(BDRVReopenState *state,BlockReopenQueue *queue,
1989                       Error **errp)
1990  {
1991      BDRVQcow2State *s = state->bs->opaque;
1992      Qcow2ReopenState *r;
1993      int ret;
1994  
1995      GLOBAL_STATE_CODE();
1996      GRAPH_RDLOCK_GUARD_MAINLOOP();
1997  
1998      r = g_new0(Qcow2ReopenState, 1);
1999      state->opaque = r;
2000  
2001      ret = qcow2_update_options_prepare(state->bs, r, state->options,
2002                                         state->flags, errp);
2003      if (ret < 0) {
2004          goto fail;
2005      }
2006  
2007      /* We need to write out any unwritten data if we reopen read-only. */
2008      if ((state->flags & BDRV_O_RDWR) == 0) {
2009          ret = qcow2_reopen_bitmaps_ro(state->bs, errp);
2010          if (ret < 0) {
2011              goto fail;
2012          }
2013  
2014          ret = bdrv_flush(state->bs);
2015          if (ret < 0) {
2016              goto fail;
2017          }
2018  
2019          ret = qcow2_mark_clean(state->bs);
2020          if (ret < 0) {
2021              goto fail;
2022          }
2023      }
2024  
2025      /*
2026       * Without an external data file, s->data_file points to the same BdrvChild
2027       * as bs->file. It needs to be resynced after reopen because bs->file may
2028       * be changed. We can't use it in the meantime.
2029       */
2030      if (!has_data_file(state->bs)) {
2031          assert(s->data_file == state->bs->file);
2032          s->data_file = NULL;
2033      }
2034  
2035      return 0;
2036  
2037  fail:
2038      qcow2_update_options_abort(state->bs, r);
2039      g_free(r);
2040      return ret;
2041  }
2042  
2043  static void qcow2_reopen_commit(BDRVReopenState *state)
2044  {
2045      BDRVQcow2State *s = state->bs->opaque;
2046  
2047      GRAPH_RDLOCK_GUARD_MAINLOOP();
2048  
2049      qcow2_update_options_commit(state->bs, state->opaque);
2050      if (!s->data_file) {
2051          /*
2052           * If we don't have an external data file, s->data_file was cleared by
2053           * qcow2_reopen_prepare() and needs to be updated.
2054           */
2055          s->data_file = state->bs->file;
2056      }
2057      g_free(state->opaque);
2058  }
2059  
2060  static void qcow2_reopen_commit_post(BDRVReopenState *state)
2061  {
2062      GRAPH_RDLOCK_GUARD_MAINLOOP();
2063  
2064      if (state->flags & BDRV_O_RDWR) {
2065          Error *local_err = NULL;
2066  
2067          if (qcow2_reopen_bitmaps_rw(state->bs, &local_err) < 0) {
2068              /*
2069               * This is not fatal, bitmaps just left read-only, so all following
2070               * writes will fail. User can remove read-only bitmaps to unblock
2071               * writes or retry reopen.
2072               */
2073              error_reportf_err(local_err,
2074                                "%s: Failed to make dirty bitmaps writable: ",
2075                                bdrv_get_node_name(state->bs));
2076          }
2077      }
2078  }
2079  
2080  static void qcow2_reopen_abort(BDRVReopenState *state)
2081  {
2082      BDRVQcow2State *s = state->bs->opaque;
2083  
2084      GRAPH_RDLOCK_GUARD_MAINLOOP();
2085  
2086      if (!s->data_file) {
2087          /*
2088           * If we don't have an external data file, s->data_file was cleared by
2089           * qcow2_reopen_prepare() and needs to be restored.
2090           */
2091          s->data_file = state->bs->file;
2092      }
2093      qcow2_update_options_abort(state->bs, state->opaque);
2094      g_free(state->opaque);
2095  }
2096  
2097  static void qcow2_join_options(QDict *options, QDict *old_options)
2098  {
2099      bool has_new_overlap_template =
2100          qdict_haskey(options, QCOW2_OPT_OVERLAP) ||
2101          qdict_haskey(options, QCOW2_OPT_OVERLAP_TEMPLATE);
2102      bool has_new_total_cache_size =
2103          qdict_haskey(options, QCOW2_OPT_CACHE_SIZE);
2104      bool has_all_cache_options;
2105  
2106      /* New overlap template overrides all old overlap options */
2107      if (has_new_overlap_template) {
2108          qdict_del(old_options, QCOW2_OPT_OVERLAP);
2109          qdict_del(old_options, QCOW2_OPT_OVERLAP_TEMPLATE);
2110          qdict_del(old_options, QCOW2_OPT_OVERLAP_MAIN_HEADER);
2111          qdict_del(old_options, QCOW2_OPT_OVERLAP_ACTIVE_L1);
2112          qdict_del(old_options, QCOW2_OPT_OVERLAP_ACTIVE_L2);
2113          qdict_del(old_options, QCOW2_OPT_OVERLAP_REFCOUNT_TABLE);
2114          qdict_del(old_options, QCOW2_OPT_OVERLAP_REFCOUNT_BLOCK);
2115          qdict_del(old_options, QCOW2_OPT_OVERLAP_SNAPSHOT_TABLE);
2116          qdict_del(old_options, QCOW2_OPT_OVERLAP_INACTIVE_L1);
2117          qdict_del(old_options, QCOW2_OPT_OVERLAP_INACTIVE_L2);
2118      }
2119  
2120      /* New total cache size overrides all old options */
2121      if (qdict_haskey(options, QCOW2_OPT_CACHE_SIZE)) {
2122          qdict_del(old_options, QCOW2_OPT_L2_CACHE_SIZE);
2123          qdict_del(old_options, QCOW2_OPT_REFCOUNT_CACHE_SIZE);
2124      }
2125  
2126      qdict_join(options, old_options, false);
2127  
2128      /*
2129       * If after merging all cache size options are set, an old total size is
2130       * overwritten. Do keep all options, however, if all three are new. The
2131       * resulting error message is what we want to happen.
2132       */
2133      has_all_cache_options =
2134          qdict_haskey(options, QCOW2_OPT_CACHE_SIZE) ||
2135          qdict_haskey(options, QCOW2_OPT_L2_CACHE_SIZE) ||
2136          qdict_haskey(options, QCOW2_OPT_REFCOUNT_CACHE_SIZE);
2137  
2138      if (has_all_cache_options && !has_new_total_cache_size) {
2139          qdict_del(options, QCOW2_OPT_CACHE_SIZE);
2140      }
2141  }
2142  
2143  static int coroutine_fn GRAPH_RDLOCK
2144  qcow2_co_block_status(BlockDriverState *bs, bool want_zero, int64_t offset,
2145                        int64_t count, int64_t *pnum, int64_t *map,
2146                        BlockDriverState **file)
2147  {
2148      BDRVQcow2State *s = bs->opaque;
2149      uint64_t host_offset;
2150      unsigned int bytes;
2151      QCow2SubclusterType type;
2152      int ret, status = 0;
2153  
2154      qemu_co_mutex_lock(&s->lock);
2155  
2156      if (!s->metadata_preallocation_checked) {
2157          ret = qcow2_detect_metadata_preallocation(bs);
2158          s->metadata_preallocation = (ret == 1);
2159          s->metadata_preallocation_checked = true;
2160      }
2161  
2162      bytes = MIN(INT_MAX, count);
2163      ret = qcow2_get_host_offset(bs, offset, &bytes, &host_offset, &type);
2164      qemu_co_mutex_unlock(&s->lock);
2165      if (ret < 0) {
2166          return ret;
2167      }
2168  
2169      *pnum = bytes;
2170  
2171      if ((type == QCOW2_SUBCLUSTER_NORMAL ||
2172           type == QCOW2_SUBCLUSTER_ZERO_ALLOC ||
2173           type == QCOW2_SUBCLUSTER_UNALLOCATED_ALLOC) && !s->crypto) {
2174          *map = host_offset;
2175          *file = s->data_file->bs;
2176          status |= BDRV_BLOCK_OFFSET_VALID;
2177      }
2178      if (type == QCOW2_SUBCLUSTER_ZERO_PLAIN ||
2179          type == QCOW2_SUBCLUSTER_ZERO_ALLOC) {
2180          status |= BDRV_BLOCK_ZERO;
2181      } else if (type != QCOW2_SUBCLUSTER_UNALLOCATED_PLAIN &&
2182                 type != QCOW2_SUBCLUSTER_UNALLOCATED_ALLOC) {
2183          status |= BDRV_BLOCK_DATA;
2184      }
2185      if (s->metadata_preallocation && (status & BDRV_BLOCK_DATA) &&
2186          (status & BDRV_BLOCK_OFFSET_VALID))
2187      {
2188          status |= BDRV_BLOCK_RECURSE;
2189      }
2190      if (type == QCOW2_SUBCLUSTER_COMPRESSED) {
2191          status |= BDRV_BLOCK_COMPRESSED;
2192      }
2193      return status;
2194  }
2195  
2196  static int coroutine_fn GRAPH_RDLOCK
2197  qcow2_handle_l2meta(BlockDriverState *bs, QCowL2Meta **pl2meta, bool link_l2)
2198  {
2199      int ret = 0;
2200      QCowL2Meta *l2meta = *pl2meta;
2201  
2202      while (l2meta != NULL) {
2203          QCowL2Meta *next;
2204  
2205          if (link_l2) {
2206              ret = qcow2_alloc_cluster_link_l2(bs, l2meta);
2207              if (ret) {
2208                  goto out;
2209              }
2210          } else {
2211              qcow2_alloc_cluster_abort(bs, l2meta);
2212          }
2213  
2214          /* Take the request off the list of running requests */
2215          QLIST_REMOVE(l2meta, next_in_flight);
2216  
2217          qemu_co_queue_restart_all(&l2meta->dependent_requests);
2218  
2219          next = l2meta->next;
2220          g_free(l2meta);
2221          l2meta = next;
2222      }
2223  out:
2224      *pl2meta = l2meta;
2225      return ret;
2226  }
2227  
2228  static int coroutine_fn GRAPH_RDLOCK
2229  qcow2_co_preadv_encrypted(BlockDriverState *bs,
2230                             uint64_t host_offset,
2231                             uint64_t offset,
2232                             uint64_t bytes,
2233                             QEMUIOVector *qiov,
2234                             uint64_t qiov_offset)
2235  {
2236      int ret;
2237      BDRVQcow2State *s = bs->opaque;
2238      uint8_t *buf;
2239  
2240      assert(bs->encrypted && s->crypto);
2241      assert(bytes <= QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size);
2242  
2243      /*
2244       * For encrypted images, read everything into a temporary
2245       * contiguous buffer on which the AES functions can work.
2246       * Also, decryption in a separate buffer is better as it
2247       * prevents the guest from learning information about the
2248       * encrypted nature of the virtual disk.
2249       */
2250  
2251      buf = qemu_try_blockalign(s->data_file->bs, bytes);
2252      if (buf == NULL) {
2253          return -ENOMEM;
2254      }
2255  
2256      BLKDBG_CO_EVENT(bs->file, BLKDBG_READ_AIO);
2257      ret = bdrv_co_pread(s->data_file, host_offset, bytes, buf, 0);
2258      if (ret < 0) {
2259          goto fail;
2260      }
2261  
2262      if (qcow2_co_decrypt(bs, host_offset, offset, buf, bytes) < 0)
2263      {
2264          ret = -EIO;
2265          goto fail;
2266      }
2267      qemu_iovec_from_buf(qiov, qiov_offset, buf, bytes);
2268  
2269  fail:
2270      qemu_vfree(buf);
2271  
2272      return ret;
2273  }
2274  
2275  typedef struct Qcow2AioTask {
2276      AioTask task;
2277  
2278      BlockDriverState *bs;
2279      QCow2SubclusterType subcluster_type; /* only for read */
2280      uint64_t host_offset; /* or l2_entry for compressed read */
2281      uint64_t offset;
2282      uint64_t bytes;
2283      QEMUIOVector *qiov;
2284      uint64_t qiov_offset;
2285      QCowL2Meta *l2meta; /* only for write */
2286  } Qcow2AioTask;
2287  
2288  static coroutine_fn int qcow2_co_preadv_task_entry(AioTask *task);
2289  static coroutine_fn int qcow2_add_task(BlockDriverState *bs,
2290                                         AioTaskPool *pool,
2291                                         AioTaskFunc func,
2292                                         QCow2SubclusterType subcluster_type,
2293                                         uint64_t host_offset,
2294                                         uint64_t offset,
2295                                         uint64_t bytes,
2296                                         QEMUIOVector *qiov,
2297                                         size_t qiov_offset,
2298                                         QCowL2Meta *l2meta)
2299  {
2300      Qcow2AioTask local_task;
2301      Qcow2AioTask *task = pool ? g_new(Qcow2AioTask, 1) : &local_task;
2302  
2303      *task = (Qcow2AioTask) {
2304          .task.func = func,
2305          .bs = bs,
2306          .subcluster_type = subcluster_type,
2307          .qiov = qiov,
2308          .host_offset = host_offset,
2309          .offset = offset,
2310          .bytes = bytes,
2311          .qiov_offset = qiov_offset,
2312          .l2meta = l2meta,
2313      };
2314  
2315      trace_qcow2_add_task(qemu_coroutine_self(), bs, pool,
2316                           func == qcow2_co_preadv_task_entry ? "read" : "write",
2317                           subcluster_type, host_offset, offset, bytes,
2318                           qiov, qiov_offset);
2319  
2320      if (!pool) {
2321          return func(&task->task);
2322      }
2323  
2324      aio_task_pool_start_task(pool, &task->task);
2325  
2326      return 0;
2327  }
2328  
2329  static int coroutine_fn GRAPH_RDLOCK
2330  qcow2_co_preadv_task(BlockDriverState *bs, QCow2SubclusterType subc_type,
2331                       uint64_t host_offset, uint64_t offset, uint64_t bytes,
2332                       QEMUIOVector *qiov, size_t qiov_offset)
2333  {
2334      BDRVQcow2State *s = bs->opaque;
2335  
2336      switch (subc_type) {
2337      case QCOW2_SUBCLUSTER_ZERO_PLAIN:
2338      case QCOW2_SUBCLUSTER_ZERO_ALLOC:
2339          /* Both zero types are handled in qcow2_co_preadv_part */
2340          g_assert_not_reached();
2341  
2342      case QCOW2_SUBCLUSTER_UNALLOCATED_PLAIN:
2343      case QCOW2_SUBCLUSTER_UNALLOCATED_ALLOC:
2344          assert(bs->backing); /* otherwise handled in qcow2_co_preadv_part */
2345  
2346          BLKDBG_CO_EVENT(bs->file, BLKDBG_READ_BACKING_AIO);
2347          return bdrv_co_preadv_part(bs->backing, offset, bytes,
2348                                     qiov, qiov_offset, 0);
2349  
2350      case QCOW2_SUBCLUSTER_COMPRESSED:
2351          return qcow2_co_preadv_compressed(bs, host_offset,
2352                                            offset, bytes, qiov, qiov_offset);
2353  
2354      case QCOW2_SUBCLUSTER_NORMAL:
2355          if (bs->encrypted) {
2356              return qcow2_co_preadv_encrypted(bs, host_offset,
2357                                               offset, bytes, qiov, qiov_offset);
2358          }
2359  
2360          BLKDBG_CO_EVENT(bs->file, BLKDBG_READ_AIO);
2361          return bdrv_co_preadv_part(s->data_file, host_offset,
2362                                     bytes, qiov, qiov_offset, 0);
2363  
2364      default:
2365          g_assert_not_reached();
2366      }
2367  
2368      g_assert_not_reached();
2369  }
2370  
2371  /*
2372   * This function can count as GRAPH_RDLOCK because qcow2_co_preadv_part() holds
2373   * the graph lock and keeps it until this coroutine has terminated.
2374   */
2375  static int coroutine_fn GRAPH_RDLOCK qcow2_co_preadv_task_entry(AioTask *task)
2376  {
2377      Qcow2AioTask *t = container_of(task, Qcow2AioTask, task);
2378  
2379      assert(!t->l2meta);
2380  
2381      return qcow2_co_preadv_task(t->bs, t->subcluster_type,
2382                                  t->host_offset, t->offset, t->bytes,
2383                                  t->qiov, t->qiov_offset);
2384  }
2385  
2386  static int coroutine_fn GRAPH_RDLOCK
2387  qcow2_co_preadv_part(BlockDriverState *bs, int64_t offset, int64_t bytes,
2388                       QEMUIOVector *qiov, size_t qiov_offset,
2389                       BdrvRequestFlags flags)
2390  {
2391      BDRVQcow2State *s = bs->opaque;
2392      int ret = 0;
2393      unsigned int cur_bytes; /* number of bytes in current iteration */
2394      uint64_t host_offset = 0;
2395      QCow2SubclusterType type;
2396      AioTaskPool *aio = NULL;
2397  
2398      while (bytes != 0 && aio_task_pool_status(aio) == 0) {
2399          /* prepare next request */
2400          cur_bytes = MIN(bytes, INT_MAX);
2401          if (s->crypto) {
2402              cur_bytes = MIN(cur_bytes,
2403                              QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size);
2404          }
2405  
2406          qemu_co_mutex_lock(&s->lock);
2407          ret = qcow2_get_host_offset(bs, offset, &cur_bytes,
2408                                      &host_offset, &type);
2409          qemu_co_mutex_unlock(&s->lock);
2410          if (ret < 0) {
2411              goto out;
2412          }
2413  
2414          if (type == QCOW2_SUBCLUSTER_ZERO_PLAIN ||
2415              type == QCOW2_SUBCLUSTER_ZERO_ALLOC ||
2416              (type == QCOW2_SUBCLUSTER_UNALLOCATED_PLAIN && !bs->backing) ||
2417              (type == QCOW2_SUBCLUSTER_UNALLOCATED_ALLOC && !bs->backing))
2418          {
2419              qemu_iovec_memset(qiov, qiov_offset, 0, cur_bytes);
2420          } else {
2421              if (!aio && cur_bytes != bytes) {
2422                  aio = aio_task_pool_new(QCOW2_MAX_WORKERS);
2423              }
2424              ret = qcow2_add_task(bs, aio, qcow2_co_preadv_task_entry, type,
2425                                   host_offset, offset, cur_bytes,
2426                                   qiov, qiov_offset, NULL);
2427              if (ret < 0) {
2428                  goto out;
2429              }
2430          }
2431  
2432          bytes -= cur_bytes;
2433          offset += cur_bytes;
2434          qiov_offset += cur_bytes;
2435      }
2436  
2437  out:
2438      if (aio) {
2439          aio_task_pool_wait_all(aio);
2440          if (ret == 0) {
2441              ret = aio_task_pool_status(aio);
2442          }
2443          g_free(aio);
2444      }
2445  
2446      return ret;
2447  }
2448  
2449  /* Check if it's possible to merge a write request with the writing of
2450   * the data from the COW regions */
2451  static bool merge_cow(uint64_t offset, unsigned bytes,
2452                        QEMUIOVector *qiov, size_t qiov_offset,
2453                        QCowL2Meta *l2meta)
2454  {
2455      QCowL2Meta *m;
2456  
2457      for (m = l2meta; m != NULL; m = m->next) {
2458          /* If both COW regions are empty then there's nothing to merge */
2459          if (m->cow_start.nb_bytes == 0 && m->cow_end.nb_bytes == 0) {
2460              continue;
2461          }
2462  
2463          /* If COW regions are handled already, skip this too */
2464          if (m->skip_cow) {
2465              continue;
2466          }
2467  
2468          /*
2469           * The write request should start immediately after the first
2470           * COW region. This does not always happen because the area
2471           * touched by the request can be larger than the one defined
2472           * by @m (a single request can span an area consisting of a
2473           * mix of previously unallocated and allocated clusters, that
2474           * is why @l2meta is a list).
2475           */
2476          if (l2meta_cow_start(m) + m->cow_start.nb_bytes != offset) {
2477              /* In this case the request starts before this region */
2478              assert(offset < l2meta_cow_start(m));
2479              assert(m->cow_start.nb_bytes == 0);
2480              continue;
2481          }
2482  
2483          /* The write request should end immediately before the second
2484           * COW region (see above for why it does not always happen) */
2485          if (m->offset + m->cow_end.offset != offset + bytes) {
2486              assert(offset + bytes > m->offset + m->cow_end.offset);
2487              assert(m->cow_end.nb_bytes == 0);
2488              continue;
2489          }
2490  
2491          /* Make sure that adding both COW regions to the QEMUIOVector
2492           * does not exceed IOV_MAX */
2493          if (qemu_iovec_subvec_niov(qiov, qiov_offset, bytes) > IOV_MAX - 2) {
2494              continue;
2495          }
2496  
2497          m->data_qiov = qiov;
2498          m->data_qiov_offset = qiov_offset;
2499          return true;
2500      }
2501  
2502      return false;
2503  }
2504  
2505  /*
2506   * Return 1 if the COW regions read as zeroes, 0 if not, < 0 on error.
2507   * Note that returning 0 does not guarantee non-zero data.
2508   */
2509  static int coroutine_fn GRAPH_RDLOCK
2510  is_zero_cow(BlockDriverState *bs, QCowL2Meta *m)
2511  {
2512      /*
2513       * This check is designed for optimization shortcut so it must be
2514       * efficient.
2515       * Instead of is_zero(), use bdrv_co_is_zero_fast() as it is
2516       * faster (but not as accurate and can result in false negatives).
2517       */
2518      int ret = bdrv_co_is_zero_fast(bs, m->offset + m->cow_start.offset,
2519                                     m->cow_start.nb_bytes);
2520      if (ret <= 0) {
2521          return ret;
2522      }
2523  
2524      return bdrv_co_is_zero_fast(bs, m->offset + m->cow_end.offset,
2525                                  m->cow_end.nb_bytes);
2526  }
2527  
2528  static int coroutine_fn GRAPH_RDLOCK
2529  handle_alloc_space(BlockDriverState *bs, QCowL2Meta *l2meta)
2530  {
2531      BDRVQcow2State *s = bs->opaque;
2532      QCowL2Meta *m;
2533  
2534      if (!(s->data_file->bs->supported_zero_flags & BDRV_REQ_NO_FALLBACK)) {
2535          return 0;
2536      }
2537  
2538      if (bs->encrypted) {
2539          return 0;
2540      }
2541  
2542      for (m = l2meta; m != NULL; m = m->next) {
2543          int ret;
2544          uint64_t start_offset = m->alloc_offset + m->cow_start.offset;
2545          unsigned nb_bytes = m->cow_end.offset + m->cow_end.nb_bytes -
2546              m->cow_start.offset;
2547  
2548          if (!m->cow_start.nb_bytes && !m->cow_end.nb_bytes) {
2549              continue;
2550          }
2551  
2552          ret = is_zero_cow(bs, m);
2553          if (ret < 0) {
2554              return ret;
2555          } else if (ret == 0) {
2556              continue;
2557          }
2558  
2559          /*
2560           * instead of writing zero COW buffers,
2561           * efficiently zero out the whole clusters
2562           */
2563  
2564          ret = qcow2_pre_write_overlap_check(bs, 0, start_offset, nb_bytes,
2565                                              true);
2566          if (ret < 0) {
2567              return ret;
2568          }
2569  
2570          BLKDBG_CO_EVENT(bs->file, BLKDBG_CLUSTER_ALLOC_SPACE);
2571          ret = bdrv_co_pwrite_zeroes(s->data_file, start_offset, nb_bytes,
2572                                      BDRV_REQ_NO_FALLBACK);
2573          if (ret < 0) {
2574              if (ret != -ENOTSUP && ret != -EAGAIN) {
2575                  return ret;
2576              }
2577              continue;
2578          }
2579  
2580          trace_qcow2_skip_cow(qemu_coroutine_self(), m->offset, m->nb_clusters);
2581          m->skip_cow = true;
2582      }
2583      return 0;
2584  }
2585  
2586  /*
2587   * qcow2_co_pwritev_task
2588   * Called with s->lock unlocked
2589   * l2meta  - if not NULL, qcow2_co_pwritev_task() will consume it. Caller must
2590   *           not use it somehow after qcow2_co_pwritev_task() call
2591   */
2592  static coroutine_fn GRAPH_RDLOCK
2593  int qcow2_co_pwritev_task(BlockDriverState *bs, uint64_t host_offset,
2594                            uint64_t offset, uint64_t bytes, QEMUIOVector *qiov,
2595                            uint64_t qiov_offset, QCowL2Meta *l2meta)
2596  {
2597      int ret;
2598      BDRVQcow2State *s = bs->opaque;
2599      void *crypt_buf = NULL;
2600      QEMUIOVector encrypted_qiov;
2601  
2602      if (bs->encrypted) {
2603          assert(s->crypto);
2604          assert(bytes <= QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size);
2605          crypt_buf = qemu_try_blockalign(bs->file->bs, bytes);
2606          if (crypt_buf == NULL) {
2607              ret = -ENOMEM;
2608              goto out_unlocked;
2609          }
2610          qemu_iovec_to_buf(qiov, qiov_offset, crypt_buf, bytes);
2611  
2612          if (qcow2_co_encrypt(bs, host_offset, offset, crypt_buf, bytes) < 0) {
2613              ret = -EIO;
2614              goto out_unlocked;
2615          }
2616  
2617          qemu_iovec_init_buf(&encrypted_qiov, crypt_buf, bytes);
2618          qiov = &encrypted_qiov;
2619          qiov_offset = 0;
2620      }
2621  
2622      /* Try to efficiently initialize the physical space with zeroes */
2623      ret = handle_alloc_space(bs, l2meta);
2624      if (ret < 0) {
2625          goto out_unlocked;
2626      }
2627  
2628      /*
2629       * If we need to do COW, check if it's possible to merge the
2630       * writing of the guest data together with that of the COW regions.
2631       * If it's not possible (or not necessary) then write the
2632       * guest data now.
2633       */
2634      if (!merge_cow(offset, bytes, qiov, qiov_offset, l2meta)) {
2635          BLKDBG_CO_EVENT(bs->file, BLKDBG_WRITE_AIO);
2636          trace_qcow2_writev_data(qemu_coroutine_self(), host_offset);
2637          ret = bdrv_co_pwritev_part(s->data_file, host_offset,
2638                                     bytes, qiov, qiov_offset, 0);
2639          if (ret < 0) {
2640              goto out_unlocked;
2641          }
2642      }
2643  
2644      qemu_co_mutex_lock(&s->lock);
2645  
2646      ret = qcow2_handle_l2meta(bs, &l2meta, true);
2647      goto out_locked;
2648  
2649  out_unlocked:
2650      qemu_co_mutex_lock(&s->lock);
2651  
2652  out_locked:
2653      qcow2_handle_l2meta(bs, &l2meta, false);
2654      qemu_co_mutex_unlock(&s->lock);
2655  
2656      qemu_vfree(crypt_buf);
2657  
2658      return ret;
2659  }
2660  
2661  /*
2662   * This function can count as GRAPH_RDLOCK because qcow2_co_pwritev_part() holds
2663   * the graph lock and keeps it until this coroutine has terminated.
2664   */
2665  static coroutine_fn GRAPH_RDLOCK int qcow2_co_pwritev_task_entry(AioTask *task)
2666  {
2667      Qcow2AioTask *t = container_of(task, Qcow2AioTask, task);
2668  
2669      assert(!t->subcluster_type);
2670  
2671      return qcow2_co_pwritev_task(t->bs, t->host_offset,
2672                                   t->offset, t->bytes, t->qiov, t->qiov_offset,
2673                                   t->l2meta);
2674  }
2675  
2676  static int coroutine_fn GRAPH_RDLOCK
2677  qcow2_co_pwritev_part(BlockDriverState *bs, int64_t offset, int64_t bytes,
2678                        QEMUIOVector *qiov, size_t qiov_offset,
2679                        BdrvRequestFlags flags)
2680  {
2681      BDRVQcow2State *s = bs->opaque;
2682      int offset_in_cluster;
2683      int ret;
2684      unsigned int cur_bytes; /* number of sectors in current iteration */
2685      uint64_t host_offset;
2686      QCowL2Meta *l2meta = NULL;
2687      AioTaskPool *aio = NULL;
2688  
2689      trace_qcow2_writev_start_req(qemu_coroutine_self(), offset, bytes);
2690  
2691      while (bytes != 0 && aio_task_pool_status(aio) == 0) {
2692  
2693          l2meta = NULL;
2694  
2695          trace_qcow2_writev_start_part(qemu_coroutine_self());
2696          offset_in_cluster = offset_into_cluster(s, offset);
2697          cur_bytes = MIN(bytes, INT_MAX);
2698          if (bs->encrypted) {
2699              cur_bytes = MIN(cur_bytes,
2700                              QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size
2701                              - offset_in_cluster);
2702          }
2703  
2704          qemu_co_mutex_lock(&s->lock);
2705  
2706          ret = qcow2_alloc_host_offset(bs, offset, &cur_bytes,
2707                                        &host_offset, &l2meta);
2708          if (ret < 0) {
2709              goto out_locked;
2710          }
2711  
2712          ret = qcow2_pre_write_overlap_check(bs, 0, host_offset,
2713                                              cur_bytes, true);
2714          if (ret < 0) {
2715              goto out_locked;
2716          }
2717  
2718          qemu_co_mutex_unlock(&s->lock);
2719  
2720          if (!aio && cur_bytes != bytes) {
2721              aio = aio_task_pool_new(QCOW2_MAX_WORKERS);
2722          }
2723          ret = qcow2_add_task(bs, aio, qcow2_co_pwritev_task_entry, 0,
2724                               host_offset, offset,
2725                               cur_bytes, qiov, qiov_offset, l2meta);
2726          l2meta = NULL; /* l2meta is consumed by qcow2_co_pwritev_task() */
2727          if (ret < 0) {
2728              goto fail_nometa;
2729          }
2730  
2731          bytes -= cur_bytes;
2732          offset += cur_bytes;
2733          qiov_offset += cur_bytes;
2734          trace_qcow2_writev_done_part(qemu_coroutine_self(), cur_bytes);
2735      }
2736      ret = 0;
2737  
2738      qemu_co_mutex_lock(&s->lock);
2739  
2740  out_locked:
2741      qcow2_handle_l2meta(bs, &l2meta, false);
2742  
2743      qemu_co_mutex_unlock(&s->lock);
2744  
2745  fail_nometa:
2746      if (aio) {
2747          aio_task_pool_wait_all(aio);
2748          if (ret == 0) {
2749              ret = aio_task_pool_status(aio);
2750          }
2751          g_free(aio);
2752      }
2753  
2754      trace_qcow2_writev_done_req(qemu_coroutine_self(), ret);
2755  
2756      return ret;
2757  }
2758  
2759  static int GRAPH_RDLOCK qcow2_inactivate(BlockDriverState *bs)
2760  {
2761      BDRVQcow2State *s = bs->opaque;
2762      int ret, result = 0;
2763      Error *local_err = NULL;
2764  
2765      qcow2_store_persistent_dirty_bitmaps(bs, true, &local_err);
2766      if (local_err != NULL) {
2767          result = -EINVAL;
2768          error_reportf_err(local_err, "Lost persistent bitmaps during "
2769                            "inactivation of node '%s': ",
2770                            bdrv_get_device_or_node_name(bs));
2771      }
2772  
2773      ret = qcow2_cache_flush(bs, s->l2_table_cache);
2774      if (ret) {
2775          result = ret;
2776          error_report("Failed to flush the L2 table cache: %s",
2777                       strerror(-ret));
2778      }
2779  
2780      ret = qcow2_cache_flush(bs, s->refcount_block_cache);
2781      if (ret) {
2782          result = ret;
2783          error_report("Failed to flush the refcount block cache: %s",
2784                       strerror(-ret));
2785      }
2786  
2787      if (result == 0) {
2788          qcow2_mark_clean(bs);
2789      }
2790  
2791      return result;
2792  }
2793  
2794  static void coroutine_mixed_fn GRAPH_RDLOCK
2795  qcow2_do_close(BlockDriverState *bs, bool close_data_file)
2796  {
2797      BDRVQcow2State *s = bs->opaque;
2798      qemu_vfree(s->l1_table);
2799      /* else pre-write overlap checks in cache_destroy may crash */
2800      s->l1_table = NULL;
2801  
2802      if (!(s->flags & BDRV_O_INACTIVE)) {
2803          qcow2_inactivate(bs);
2804      }
2805  
2806      cache_clean_timer_del(bs);
2807      qcow2_cache_destroy(s->l2_table_cache);
2808      qcow2_cache_destroy(s->refcount_block_cache);
2809  
2810      qcrypto_block_free(s->crypto);
2811      s->crypto = NULL;
2812      qapi_free_QCryptoBlockOpenOptions(s->crypto_opts);
2813  
2814      g_free(s->unknown_header_fields);
2815      cleanup_unknown_header_ext(bs);
2816  
2817      g_free(s->image_data_file);
2818      g_free(s->image_backing_file);
2819      g_free(s->image_backing_format);
2820  
2821      if (close_data_file && has_data_file(bs)) {
2822          GLOBAL_STATE_CODE();
2823          bdrv_graph_rdunlock_main_loop();
2824          bdrv_graph_wrlock();
2825          bdrv_unref_child(bs, s->data_file);
2826          bdrv_graph_wrunlock();
2827          s->data_file = NULL;
2828          bdrv_graph_rdlock_main_loop();
2829      }
2830  
2831      qcow2_refcount_close(bs);
2832      qcow2_free_snapshots(bs);
2833  }
2834  
2835  static void GRAPH_UNLOCKED qcow2_close(BlockDriverState *bs)
2836  {
2837      GLOBAL_STATE_CODE();
2838      GRAPH_RDLOCK_GUARD_MAINLOOP();
2839  
2840      qcow2_do_close(bs, true);
2841  }
2842  
2843  static void coroutine_fn GRAPH_RDLOCK
2844  qcow2_co_invalidate_cache(BlockDriverState *bs, Error **errp)
2845  {
2846      ERRP_GUARD();
2847      BDRVQcow2State *s = bs->opaque;
2848      BdrvChild *data_file;
2849      int flags = s->flags;
2850      QCryptoBlock *crypto = NULL;
2851      QDict *options;
2852      int ret;
2853  
2854      /*
2855       * Backing files are read-only which makes all of their metadata immutable,
2856       * that means we don't have to worry about reopening them here.
2857       */
2858  
2859      crypto = s->crypto;
2860      s->crypto = NULL;
2861  
2862      /*
2863       * Do not reopen s->data_file (i.e., have qcow2_do_close() not close it,
2864       * and then prevent qcow2_do_open() from opening it), because this function
2865       * runs in the I/O path and as such we must not invoke global-state
2866       * functions like bdrv_unref_child() and bdrv_open_child().
2867       */
2868  
2869      qcow2_do_close(bs, false);
2870  
2871      data_file = s->data_file;
2872      memset(s, 0, sizeof(BDRVQcow2State));
2873      s->data_file = data_file;
2874  
2875      options = qdict_clone_shallow(bs->options);
2876  
2877      flags &= ~BDRV_O_INACTIVE;
2878      qemu_co_mutex_lock(&s->lock);
2879      ret = qcow2_do_open(bs, options, flags, false, errp);
2880      qemu_co_mutex_unlock(&s->lock);
2881      qobject_unref(options);
2882      if (ret < 0) {
2883          error_prepend(errp, "Could not reopen qcow2 layer: ");
2884          bs->drv = NULL;
2885          return;
2886      }
2887  
2888      s->crypto = crypto;
2889  }
2890  
2891  static size_t header_ext_add(char *buf, uint32_t magic, const void *s,
2892      size_t len, size_t buflen)
2893  {
2894      QCowExtension *ext_backing_fmt = (QCowExtension*) buf;
2895      size_t ext_len = sizeof(QCowExtension) + ((len + 7) & ~7);
2896  
2897      if (buflen < ext_len) {
2898          return -ENOSPC;
2899      }
2900  
2901      *ext_backing_fmt = (QCowExtension) {
2902          .magic  = cpu_to_be32(magic),
2903          .len    = cpu_to_be32(len),
2904      };
2905  
2906      if (len) {
2907          memcpy(buf + sizeof(QCowExtension), s, len);
2908      }
2909  
2910      return ext_len;
2911  }
2912  
2913  /*
2914   * Updates the qcow2 header, including the variable length parts of it, i.e.
2915   * the backing file name and all extensions. qcow2 was not designed to allow
2916   * such changes, so if we run out of space (we can only use the first cluster)
2917   * this function may fail.
2918   *
2919   * Returns 0 on success, -errno in error cases.
2920   */
2921  int qcow2_update_header(BlockDriverState *bs)
2922  {
2923      BDRVQcow2State *s = bs->opaque;
2924      QCowHeader *header;
2925      char *buf;
2926      size_t buflen = s->cluster_size;
2927      int ret;
2928      uint64_t total_size;
2929      uint32_t refcount_table_clusters;
2930      size_t header_length;
2931      Qcow2UnknownHeaderExtension *uext;
2932  
2933      buf = qemu_blockalign(bs, buflen);
2934  
2935      /* Header structure */
2936      header = (QCowHeader*) buf;
2937  
2938      if (buflen < sizeof(*header)) {
2939          ret = -ENOSPC;
2940          goto fail;
2941      }
2942  
2943      header_length = sizeof(*header) + s->unknown_header_fields_size;
2944      total_size = bs->total_sectors * BDRV_SECTOR_SIZE;
2945      refcount_table_clusters = s->refcount_table_size >> (s->cluster_bits - 3);
2946  
2947      ret = validate_compression_type(s, NULL);
2948      if (ret) {
2949          goto fail;
2950      }
2951  
2952      *header = (QCowHeader) {
2953          /* Version 2 fields */
2954          .magic                  = cpu_to_be32(QCOW_MAGIC),
2955          .version                = cpu_to_be32(s->qcow_version),
2956          .backing_file_offset    = 0,
2957          .backing_file_size      = 0,
2958          .cluster_bits           = cpu_to_be32(s->cluster_bits),
2959          .size                   = cpu_to_be64(total_size),
2960          .crypt_method           = cpu_to_be32(s->crypt_method_header),
2961          .l1_size                = cpu_to_be32(s->l1_size),
2962          .l1_table_offset        = cpu_to_be64(s->l1_table_offset),
2963          .refcount_table_offset  = cpu_to_be64(s->refcount_table_offset),
2964          .refcount_table_clusters = cpu_to_be32(refcount_table_clusters),
2965          .nb_snapshots           = cpu_to_be32(s->nb_snapshots),
2966          .snapshots_offset       = cpu_to_be64(s->snapshots_offset),
2967  
2968          /* Version 3 fields */
2969          .incompatible_features  = cpu_to_be64(s->incompatible_features),
2970          .compatible_features    = cpu_to_be64(s->compatible_features),
2971          .autoclear_features     = cpu_to_be64(s->autoclear_features),
2972          .refcount_order         = cpu_to_be32(s->refcount_order),
2973          .header_length          = cpu_to_be32(header_length),
2974          .compression_type       = s->compression_type,
2975      };
2976  
2977      /* For older versions, write a shorter header */
2978      switch (s->qcow_version) {
2979      case 2:
2980          ret = offsetof(QCowHeader, incompatible_features);
2981          break;
2982      case 3:
2983          ret = sizeof(*header);
2984          break;
2985      default:
2986          ret = -EINVAL;
2987          goto fail;
2988      }
2989  
2990      buf += ret;
2991      buflen -= ret;
2992      memset(buf, 0, buflen);
2993  
2994      /* Preserve any unknown field in the header */
2995      if (s->unknown_header_fields_size) {
2996          if (buflen < s->unknown_header_fields_size) {
2997              ret = -ENOSPC;
2998              goto fail;
2999          }
3000  
3001          memcpy(buf, s->unknown_header_fields, s->unknown_header_fields_size);
3002          buf += s->unknown_header_fields_size;
3003          buflen -= s->unknown_header_fields_size;
3004      }
3005  
3006      /* Backing file format header extension */
3007      if (s->image_backing_format) {
3008          ret = header_ext_add(buf, QCOW2_EXT_MAGIC_BACKING_FORMAT,
3009                               s->image_backing_format,
3010                               strlen(s->image_backing_format),
3011                               buflen);
3012          if (ret < 0) {
3013              goto fail;
3014          }
3015  
3016          buf += ret;
3017          buflen -= ret;
3018      }
3019  
3020      /* External data file header extension */
3021      if (has_data_file(bs) && s->image_data_file) {
3022          ret = header_ext_add(buf, QCOW2_EXT_MAGIC_DATA_FILE,
3023                               s->image_data_file, strlen(s->image_data_file),
3024                               buflen);
3025          if (ret < 0) {
3026              goto fail;
3027          }
3028  
3029          buf += ret;
3030          buflen -= ret;
3031      }
3032  
3033      /* Full disk encryption header pointer extension */
3034      if (s->crypto_header.offset != 0) {
3035          s->crypto_header.offset = cpu_to_be64(s->crypto_header.offset);
3036          s->crypto_header.length = cpu_to_be64(s->crypto_header.length);
3037          ret = header_ext_add(buf, QCOW2_EXT_MAGIC_CRYPTO_HEADER,
3038                               &s->crypto_header, sizeof(s->crypto_header),
3039                               buflen);
3040          s->crypto_header.offset = be64_to_cpu(s->crypto_header.offset);
3041          s->crypto_header.length = be64_to_cpu(s->crypto_header.length);
3042          if (ret < 0) {
3043              goto fail;
3044          }
3045          buf += ret;
3046          buflen -= ret;
3047      }
3048  
3049      /*
3050       * Feature table.  A mere 8 feature names occupies 392 bytes, and
3051       * when coupled with the v3 minimum header of 104 bytes plus the
3052       * 8-byte end-of-extension marker, that would leave only 8 bytes
3053       * for a backing file name in an image with 512-byte clusters.
3054       * Thus, we choose to omit this header for cluster sizes 4k and
3055       * smaller.
3056       */
3057      if (s->qcow_version >= 3 && s->cluster_size > 4096) {
3058          static const Qcow2Feature features[] = {
3059              {
3060                  .type = QCOW2_FEAT_TYPE_INCOMPATIBLE,
3061                  .bit  = QCOW2_INCOMPAT_DIRTY_BITNR,
3062                  .name = "dirty bit",
3063              },
3064              {
3065                  .type = QCOW2_FEAT_TYPE_INCOMPATIBLE,
3066                  .bit  = QCOW2_INCOMPAT_CORRUPT_BITNR,
3067                  .name = "corrupt bit",
3068              },
3069              {
3070                  .type = QCOW2_FEAT_TYPE_INCOMPATIBLE,
3071                  .bit  = QCOW2_INCOMPAT_DATA_FILE_BITNR,
3072                  .name = "external data file",
3073              },
3074              {
3075                  .type = QCOW2_FEAT_TYPE_INCOMPATIBLE,
3076                  .bit  = QCOW2_INCOMPAT_COMPRESSION_BITNR,
3077                  .name = "compression type",
3078              },
3079              {
3080                  .type = QCOW2_FEAT_TYPE_INCOMPATIBLE,
3081                  .bit  = QCOW2_INCOMPAT_EXTL2_BITNR,
3082                  .name = "extended L2 entries",
3083              },
3084              {
3085                  .type = QCOW2_FEAT_TYPE_COMPATIBLE,
3086                  .bit  = QCOW2_COMPAT_LAZY_REFCOUNTS_BITNR,
3087                  .name = "lazy refcounts",
3088              },
3089              {
3090                  .type = QCOW2_FEAT_TYPE_AUTOCLEAR,
3091                  .bit  = QCOW2_AUTOCLEAR_BITMAPS_BITNR,
3092                  .name = "bitmaps",
3093              },
3094              {
3095                  .type = QCOW2_FEAT_TYPE_AUTOCLEAR,
3096                  .bit  = QCOW2_AUTOCLEAR_DATA_FILE_RAW_BITNR,
3097                  .name = "raw external data",
3098              },
3099          };
3100  
3101          ret = header_ext_add(buf, QCOW2_EXT_MAGIC_FEATURE_TABLE,
3102                               features, sizeof(features), buflen);
3103          if (ret < 0) {
3104              goto fail;
3105          }
3106          buf += ret;
3107          buflen -= ret;
3108      }
3109  
3110      /* Bitmap extension */
3111      if (s->nb_bitmaps > 0) {
3112          Qcow2BitmapHeaderExt bitmaps_header = {
3113              .nb_bitmaps = cpu_to_be32(s->nb_bitmaps),
3114              .bitmap_directory_size =
3115                      cpu_to_be64(s->bitmap_directory_size),
3116              .bitmap_directory_offset =
3117                      cpu_to_be64(s->bitmap_directory_offset)
3118          };
3119          ret = header_ext_add(buf, QCOW2_EXT_MAGIC_BITMAPS,
3120                               &bitmaps_header, sizeof(bitmaps_header),
3121                               buflen);
3122          if (ret < 0) {
3123              goto fail;
3124          }
3125          buf += ret;
3126          buflen -= ret;
3127      }
3128  
3129      /* Keep unknown header extensions */
3130      QLIST_FOREACH(uext, &s->unknown_header_ext, next) {
3131          ret = header_ext_add(buf, uext->magic, uext->data, uext->len, buflen);
3132          if (ret < 0) {
3133              goto fail;
3134          }
3135  
3136          buf += ret;
3137          buflen -= ret;
3138      }
3139  
3140      /* End of header extensions */
3141      ret = header_ext_add(buf, QCOW2_EXT_MAGIC_END, NULL, 0, buflen);
3142      if (ret < 0) {
3143          goto fail;
3144      }
3145  
3146      buf += ret;
3147      buflen -= ret;
3148  
3149      /* Backing file name */
3150      if (s->image_backing_file) {
3151          size_t backing_file_len = strlen(s->image_backing_file);
3152  
3153          if (buflen < backing_file_len) {
3154              ret = -ENOSPC;
3155              goto fail;
3156          }
3157  
3158          /* Using strncpy is ok here, since buf is not NUL-terminated. */
3159          strncpy(buf, s->image_backing_file, buflen);
3160  
3161          header->backing_file_offset = cpu_to_be64(buf - ((char*) header));
3162          header->backing_file_size   = cpu_to_be32(backing_file_len);
3163      }
3164  
3165      /* Write the new header */
3166      ret = bdrv_pwrite(bs->file, 0, s->cluster_size, header, 0);
3167      if (ret < 0) {
3168          goto fail;
3169      }
3170  
3171      ret = 0;
3172  fail:
3173      qemu_vfree(header);
3174      return ret;
3175  }
3176  
3177  static int coroutine_fn GRAPH_RDLOCK
3178  qcow2_co_change_backing_file(BlockDriverState *bs, const char *backing_file,
3179                               const char *backing_fmt)
3180  {
3181      BDRVQcow2State *s = bs->opaque;
3182  
3183      /* Adding a backing file means that the external data file alone won't be
3184       * enough to make sense of the content */
3185      if (backing_file && data_file_is_raw(bs)) {
3186          return -EINVAL;
3187      }
3188  
3189      if (backing_file && strlen(backing_file) > 1023) {
3190          return -EINVAL;
3191      }
3192  
3193      pstrcpy(bs->auto_backing_file, sizeof(bs->auto_backing_file),
3194              backing_file ?: "");
3195      pstrcpy(bs->backing_file, sizeof(bs->backing_file), backing_file ?: "");
3196      pstrcpy(bs->backing_format, sizeof(bs->backing_format), backing_fmt ?: "");
3197  
3198      g_free(s->image_backing_file);
3199      g_free(s->image_backing_format);
3200  
3201      s->image_backing_file = backing_file ? g_strdup(bs->backing_file) : NULL;
3202      s->image_backing_format = backing_fmt ? g_strdup(bs->backing_format) : NULL;
3203  
3204      return qcow2_update_header(bs);
3205  }
3206  
3207  static int coroutine_fn GRAPH_RDLOCK
3208  qcow2_set_up_encryption(BlockDriverState *bs,
3209                          QCryptoBlockCreateOptions *cryptoopts,
3210                          Error **errp)
3211  {
3212      BDRVQcow2State *s = bs->opaque;
3213      QCryptoBlock *crypto = NULL;
3214      int fmt, ret;
3215  
3216      switch (cryptoopts->format) {
3217      case QCRYPTO_BLOCK_FORMAT_LUKS:
3218          fmt = QCOW_CRYPT_LUKS;
3219          break;
3220      case QCRYPTO_BLOCK_FORMAT_QCOW:
3221          fmt = QCOW_CRYPT_AES;
3222          break;
3223      default:
3224          error_setg(errp, "Crypto format not supported in qcow2");
3225          return -EINVAL;
3226      }
3227  
3228      s->crypt_method_header = fmt;
3229  
3230      crypto = qcrypto_block_create(cryptoopts, "encrypt.",
3231                                    qcow2_crypto_hdr_init_func,
3232                                    qcow2_crypto_hdr_write_func,
3233                                    bs, 0, errp);
3234      if (!crypto) {
3235          return -EINVAL;
3236      }
3237  
3238      ret = qcow2_update_header(bs);
3239      if (ret < 0) {
3240          error_setg_errno(errp, -ret, "Could not write encryption header");
3241          goto out;
3242      }
3243  
3244      ret = 0;
3245   out:
3246      qcrypto_block_free(crypto);
3247      return ret;
3248  }
3249  
3250  /**
3251   * Preallocates metadata structures for data clusters between @offset (in the
3252   * guest disk) and @new_length (which is thus generally the new guest disk
3253   * size).
3254   *
3255   * Returns: 0 on success, -errno on failure.
3256   */
3257  static int coroutine_fn GRAPH_RDLOCK
3258  preallocate_co(BlockDriverState *bs, uint64_t offset, uint64_t new_length,
3259                 PreallocMode mode, Error **errp)
3260  {
3261      BDRVQcow2State *s = bs->opaque;
3262      uint64_t bytes;
3263      uint64_t host_offset = 0;
3264      int64_t file_length;
3265      unsigned int cur_bytes;
3266      int ret;
3267      QCowL2Meta *meta = NULL, *m;
3268  
3269      assert(offset <= new_length);
3270      bytes = new_length - offset;
3271  
3272      while (bytes) {
3273          cur_bytes = MIN(bytes, QEMU_ALIGN_DOWN(INT_MAX, s->cluster_size));
3274          ret = qcow2_alloc_host_offset(bs, offset, &cur_bytes,
3275                                        &host_offset, &meta);
3276          if (ret < 0) {
3277              error_setg_errno(errp, -ret, "Allocating clusters failed");
3278              goto out;
3279          }
3280  
3281          for (m = meta; m != NULL; m = m->next) {
3282              m->prealloc = true;
3283          }
3284  
3285          ret = qcow2_handle_l2meta(bs, &meta, true);
3286          if (ret < 0) {
3287              error_setg_errno(errp, -ret, "Mapping clusters failed");
3288              goto out;
3289          }
3290  
3291          /* TODO Preallocate data if requested */
3292  
3293          bytes -= cur_bytes;
3294          offset += cur_bytes;
3295      }
3296  
3297      /*
3298       * It is expected that the image file is large enough to actually contain
3299       * all of the allocated clusters (otherwise we get failing reads after
3300       * EOF). Extend the image to the last allocated sector.
3301       */
3302      file_length = bdrv_co_getlength(s->data_file->bs);
3303      if (file_length < 0) {
3304          error_setg_errno(errp, -file_length, "Could not get file size");
3305          ret = file_length;
3306          goto out;
3307      }
3308  
3309      if (host_offset + cur_bytes > file_length) {
3310          if (mode == PREALLOC_MODE_METADATA) {
3311              mode = PREALLOC_MODE_OFF;
3312          }
3313          ret = bdrv_co_truncate(s->data_file, host_offset + cur_bytes, false,
3314                                 mode, 0, errp);
3315          if (ret < 0) {
3316              goto out;
3317          }
3318      }
3319  
3320      ret = 0;
3321  
3322  out:
3323      qcow2_handle_l2meta(bs, &meta, false);
3324      return ret;
3325  }
3326  
3327  /* qcow2_refcount_metadata_size:
3328   * @clusters: number of clusters to refcount (including data and L1/L2 tables)
3329   * @cluster_size: size of a cluster, in bytes
3330   * @refcount_order: refcount bits power-of-2 exponent
3331   * @generous_increase: allow for the refcount table to be 1.5x as large as it
3332   *                     needs to be
3333   *
3334   * Returns: Number of bytes required for refcount blocks and table metadata.
3335   */
3336  int64_t qcow2_refcount_metadata_size(int64_t clusters, size_t cluster_size,
3337                                       int refcount_order, bool generous_increase,
3338                                       uint64_t *refblock_count)
3339  {
3340      /*
3341       * Every host cluster is reference-counted, including metadata (even
3342       * refcount metadata is recursively included).
3343       *
3344       * An accurate formula for the size of refcount metadata size is difficult
3345       * to derive.  An easier method of calculation is finding the fixed point
3346       * where no further refcount blocks or table clusters are required to
3347       * reference count every cluster.
3348       */
3349      int64_t blocks_per_table_cluster = cluster_size / REFTABLE_ENTRY_SIZE;
3350      int64_t refcounts_per_block = cluster_size * 8 / (1 << refcount_order);
3351      int64_t table = 0;  /* number of refcount table clusters */
3352      int64_t blocks = 0; /* number of refcount block clusters */
3353      int64_t last;
3354      int64_t n = 0;
3355  
3356      do {
3357          last = n;
3358          blocks = DIV_ROUND_UP(clusters + table + blocks, refcounts_per_block);
3359          table = DIV_ROUND_UP(blocks, blocks_per_table_cluster);
3360          n = clusters + blocks + table;
3361  
3362          if (n == last && generous_increase) {
3363              clusters += DIV_ROUND_UP(table, 2);
3364              n = 0; /* force another loop */
3365              generous_increase = false;
3366          }
3367      } while (n != last);
3368  
3369      if (refblock_count) {
3370          *refblock_count = blocks;
3371      }
3372  
3373      return (blocks + table) * cluster_size;
3374  }
3375  
3376  /**
3377   * qcow2_calc_prealloc_size:
3378   * @total_size: virtual disk size in bytes
3379   * @cluster_size: cluster size in bytes
3380   * @refcount_order: refcount bits power-of-2 exponent
3381   * @extended_l2: true if the image has extended L2 entries
3382   *
3383   * Returns: Total number of bytes required for the fully allocated image
3384   * (including metadata).
3385   */
3386  static int64_t qcow2_calc_prealloc_size(int64_t total_size,
3387                                          size_t cluster_size,
3388                                          int refcount_order,
3389                                          bool extended_l2)
3390  {
3391      int64_t meta_size = 0;
3392      uint64_t nl1e, nl2e;
3393      int64_t aligned_total_size = ROUND_UP(total_size, cluster_size);
3394      size_t l2e_size = extended_l2 ? L2E_SIZE_EXTENDED : L2E_SIZE_NORMAL;
3395  
3396      /* header: 1 cluster */
3397      meta_size += cluster_size;
3398  
3399      /* total size of L2 tables */
3400      nl2e = aligned_total_size / cluster_size;
3401      nl2e = ROUND_UP(nl2e, cluster_size / l2e_size);
3402      meta_size += nl2e * l2e_size;
3403  
3404      /* total size of L1 tables */
3405      nl1e = nl2e * l2e_size / cluster_size;
3406      nl1e = ROUND_UP(nl1e, cluster_size / L1E_SIZE);
3407      meta_size += nl1e * L1E_SIZE;
3408  
3409      /* total size of refcount table and blocks */
3410      meta_size += qcow2_refcount_metadata_size(
3411              (meta_size + aligned_total_size) / cluster_size,
3412              cluster_size, refcount_order, false, NULL);
3413  
3414      return meta_size + aligned_total_size;
3415  }
3416  
3417  static bool validate_cluster_size(size_t cluster_size, bool extended_l2,
3418                                    Error **errp)
3419  {
3420      int cluster_bits = ctz32(cluster_size);
3421      if (cluster_bits < MIN_CLUSTER_BITS || cluster_bits > MAX_CLUSTER_BITS ||
3422          (1 << cluster_bits) != cluster_size)
3423      {
3424          error_setg(errp, "Cluster size must be a power of two between %d and "
3425                     "%dk", 1 << MIN_CLUSTER_BITS, 1 << (MAX_CLUSTER_BITS - 10));
3426          return false;
3427      }
3428  
3429      if (extended_l2) {
3430          unsigned min_cluster_size =
3431              (1 << MIN_CLUSTER_BITS) * QCOW_EXTL2_SUBCLUSTERS_PER_CLUSTER;
3432          if (cluster_size < min_cluster_size) {
3433              error_setg(errp, "Extended L2 entries are only supported with "
3434                         "cluster sizes of at least %u bytes", min_cluster_size);
3435              return false;
3436          }
3437      }
3438  
3439      return true;
3440  }
3441  
3442  static size_t qcow2_opt_get_cluster_size_del(QemuOpts *opts, bool extended_l2,
3443                                               Error **errp)
3444  {
3445      size_t cluster_size;
3446  
3447      cluster_size = qemu_opt_get_size_del(opts, BLOCK_OPT_CLUSTER_SIZE,
3448                                           DEFAULT_CLUSTER_SIZE);
3449      if (!validate_cluster_size(cluster_size, extended_l2, errp)) {
3450          return 0;
3451      }
3452      return cluster_size;
3453  }
3454  
3455  static int qcow2_opt_get_version_del(QemuOpts *opts, Error **errp)
3456  {
3457      char *buf;
3458      int ret;
3459  
3460      buf = qemu_opt_get_del(opts, BLOCK_OPT_COMPAT_LEVEL);
3461      if (!buf) {
3462          ret = 3; /* default */
3463      } else if (!strcmp(buf, "0.10")) {
3464          ret = 2;
3465      } else if (!strcmp(buf, "1.1")) {
3466          ret = 3;
3467      } else {
3468          error_setg(errp, "Invalid compatibility level: '%s'", buf);
3469          ret = -EINVAL;
3470      }
3471      g_free(buf);
3472      return ret;
3473  }
3474  
3475  static uint64_t qcow2_opt_get_refcount_bits_del(QemuOpts *opts, int version,
3476                                                  Error **errp)
3477  {
3478      uint64_t refcount_bits;
3479  
3480      refcount_bits = qemu_opt_get_number_del(opts, BLOCK_OPT_REFCOUNT_BITS, 16);
3481      if (refcount_bits > 64 || !is_power_of_2(refcount_bits)) {
3482          error_setg(errp, "Refcount width must be a power of two and may not "
3483                     "exceed 64 bits");
3484          return 0;
3485      }
3486  
3487      if (version < 3 && refcount_bits != 16) {
3488          error_setg(errp, "Different refcount widths than 16 bits require "
3489                     "compatibility level 1.1 or above (use compat=1.1 or "
3490                     "greater)");
3491          return 0;
3492      }
3493  
3494      return refcount_bits;
3495  }
3496  
3497  static int coroutine_fn GRAPH_UNLOCKED
3498  qcow2_co_create(BlockdevCreateOptions *create_options, Error **errp)
3499  {
3500      ERRP_GUARD();
3501      BlockdevCreateOptionsQcow2 *qcow2_opts;
3502      QDict *options;
3503  
3504      /*
3505       * Open the image file and write a minimal qcow2 header.
3506       *
3507       * We keep things simple and start with a zero-sized image. We also
3508       * do without refcount blocks or a L1 table for now. We'll fix the
3509       * inconsistency later.
3510       *
3511       * We do need a refcount table because growing the refcount table means
3512       * allocating two new refcount blocks - the second of which would be at
3513       * 2 GB for 64k clusters, and we don't want to have a 2 GB initial file
3514       * size for any qcow2 image.
3515       */
3516      BlockBackend *blk = NULL;
3517      BlockDriverState *bs = NULL;
3518      BlockDriverState *data_bs = NULL;
3519      QCowHeader *header;
3520      size_t cluster_size;
3521      int version;
3522      int refcount_order;
3523      uint64_t *refcount_table;
3524      int ret;
3525      uint8_t compression_type = QCOW2_COMPRESSION_TYPE_ZLIB;
3526  
3527      assert(create_options->driver == BLOCKDEV_DRIVER_QCOW2);
3528      qcow2_opts = &create_options->u.qcow2;
3529  
3530      bs = bdrv_co_open_blockdev_ref(qcow2_opts->file, errp);
3531      if (bs == NULL) {
3532          return -EIO;
3533      }
3534  
3535      /* Validate options and set default values */
3536      if (!QEMU_IS_ALIGNED(qcow2_opts->size, BDRV_SECTOR_SIZE)) {
3537          error_setg(errp, "Image size must be a multiple of %u bytes",
3538                     (unsigned) BDRV_SECTOR_SIZE);
3539          ret = -EINVAL;
3540          goto out;
3541      }
3542  
3543      if (qcow2_opts->has_version) {
3544          switch (qcow2_opts->version) {
3545          case BLOCKDEV_QCOW2_VERSION_V2:
3546              version = 2;
3547              break;
3548          case BLOCKDEV_QCOW2_VERSION_V3:
3549              version = 3;
3550              break;
3551          default:
3552              g_assert_not_reached();
3553          }
3554      } else {
3555          version = 3;
3556      }
3557  
3558      if (qcow2_opts->has_cluster_size) {
3559          cluster_size = qcow2_opts->cluster_size;
3560      } else {
3561          cluster_size = DEFAULT_CLUSTER_SIZE;
3562      }
3563  
3564      if (!qcow2_opts->has_extended_l2) {
3565          qcow2_opts->extended_l2 = false;
3566      }
3567      if (qcow2_opts->extended_l2) {
3568          if (version < 3) {
3569              error_setg(errp, "Extended L2 entries are only supported with "
3570                         "compatibility level 1.1 and above (use version=v3 or "
3571                         "greater)");
3572              ret = -EINVAL;
3573              goto out;
3574          }
3575      }
3576  
3577      if (!validate_cluster_size(cluster_size, qcow2_opts->extended_l2, errp)) {
3578          ret = -EINVAL;
3579          goto out;
3580      }
3581  
3582      if (!qcow2_opts->has_preallocation) {
3583          qcow2_opts->preallocation = PREALLOC_MODE_OFF;
3584      }
3585      if (qcow2_opts->backing_file &&
3586          qcow2_opts->preallocation != PREALLOC_MODE_OFF &&
3587          !qcow2_opts->extended_l2)
3588      {
3589          error_setg(errp, "Backing file and preallocation can only be used at "
3590                     "the same time if extended_l2 is on");
3591          ret = -EINVAL;
3592          goto out;
3593      }
3594      if (qcow2_opts->has_backing_fmt && !qcow2_opts->backing_file) {
3595          error_setg(errp, "Backing format cannot be used without backing file");
3596          ret = -EINVAL;
3597          goto out;
3598      }
3599  
3600      if (!qcow2_opts->has_lazy_refcounts) {
3601          qcow2_opts->lazy_refcounts = false;
3602      }
3603      if (version < 3 && qcow2_opts->lazy_refcounts) {
3604          error_setg(errp, "Lazy refcounts only supported with compatibility "
3605                     "level 1.1 and above (use version=v3 or greater)");
3606          ret = -EINVAL;
3607          goto out;
3608      }
3609  
3610      if (!qcow2_opts->has_refcount_bits) {
3611          qcow2_opts->refcount_bits = 16;
3612      }
3613      if (qcow2_opts->refcount_bits > 64 ||
3614          !is_power_of_2(qcow2_opts->refcount_bits))
3615      {
3616          error_setg(errp, "Refcount width must be a power of two and may not "
3617                     "exceed 64 bits");
3618          ret = -EINVAL;
3619          goto out;
3620      }
3621      if (version < 3 && qcow2_opts->refcount_bits != 16) {
3622          error_setg(errp, "Different refcount widths than 16 bits require "
3623                     "compatibility level 1.1 or above (use version=v3 or "
3624                     "greater)");
3625          ret = -EINVAL;
3626          goto out;
3627      }
3628      refcount_order = ctz32(qcow2_opts->refcount_bits);
3629  
3630      if (qcow2_opts->data_file_raw && !qcow2_opts->data_file) {
3631          error_setg(errp, "data-file-raw requires data-file");
3632          ret = -EINVAL;
3633          goto out;
3634      }
3635      if (qcow2_opts->data_file_raw && qcow2_opts->backing_file) {
3636          error_setg(errp, "Backing file and data-file-raw cannot be used at "
3637                     "the same time");
3638          ret = -EINVAL;
3639          goto out;
3640      }
3641      if (qcow2_opts->data_file_raw &&
3642          qcow2_opts->preallocation == PREALLOC_MODE_OFF)
3643      {
3644          /*
3645           * data-file-raw means that "the external data file can be
3646           * read as a consistent standalone raw image without looking
3647           * at the qcow2 metadata."  It does not say that the metadata
3648           * must be ignored, though (and the qcow2 driver in fact does
3649           * not ignore it), so the L1/L2 tables must be present and
3650           * give a 1:1 mapping, so you get the same result regardless
3651           * of whether you look at the metadata or whether you ignore
3652           * it.
3653           */
3654          qcow2_opts->preallocation = PREALLOC_MODE_METADATA;
3655  
3656          /*
3657           * Cannot use preallocation with backing files, but giving a
3658           * backing file when specifying data_file_raw is an error
3659           * anyway.
3660           */
3661          assert(!qcow2_opts->backing_file);
3662      }
3663  
3664      if (qcow2_opts->data_file) {
3665          if (version < 3) {
3666              error_setg(errp, "External data files are only supported with "
3667                         "compatibility level 1.1 and above (use version=v3 or "
3668                         "greater)");
3669              ret = -EINVAL;
3670              goto out;
3671          }
3672          data_bs = bdrv_co_open_blockdev_ref(qcow2_opts->data_file, errp);
3673          if (data_bs == NULL) {
3674              ret = -EIO;
3675              goto out;
3676          }
3677      }
3678  
3679      if (qcow2_opts->has_compression_type &&
3680          qcow2_opts->compression_type != QCOW2_COMPRESSION_TYPE_ZLIB) {
3681  
3682          ret = -EINVAL;
3683  
3684          if (version < 3) {
3685              error_setg(errp, "Non-zlib compression type is only supported with "
3686                         "compatibility level 1.1 and above (use version=v3 or "
3687                         "greater)");
3688              goto out;
3689          }
3690  
3691          switch (qcow2_opts->compression_type) {
3692  #ifdef CONFIG_ZSTD
3693          case QCOW2_COMPRESSION_TYPE_ZSTD:
3694              break;
3695  #endif
3696          default:
3697              error_setg(errp, "Unknown compression type");
3698              goto out;
3699          }
3700  
3701          compression_type = qcow2_opts->compression_type;
3702      }
3703  
3704      /* Create BlockBackend to write to the image */
3705      blk = blk_co_new_with_bs(bs, BLK_PERM_WRITE | BLK_PERM_RESIZE, BLK_PERM_ALL,
3706                               errp);
3707      if (!blk) {
3708          ret = -EPERM;
3709          goto out;
3710      }
3711      blk_set_allow_write_beyond_eof(blk, true);
3712  
3713      /* Write the header */
3714      QEMU_BUILD_BUG_ON((1 << MIN_CLUSTER_BITS) < sizeof(*header));
3715      header = g_malloc0(cluster_size);
3716      *header = (QCowHeader) {
3717          .magic                      = cpu_to_be32(QCOW_MAGIC),
3718          .version                    = cpu_to_be32(version),
3719          .cluster_bits               = cpu_to_be32(ctz32(cluster_size)),
3720          .size                       = cpu_to_be64(0),
3721          .l1_table_offset            = cpu_to_be64(0),
3722          .l1_size                    = cpu_to_be32(0),
3723          .refcount_table_offset      = cpu_to_be64(cluster_size),
3724          .refcount_table_clusters    = cpu_to_be32(1),
3725          .refcount_order             = cpu_to_be32(refcount_order),
3726          /* don't deal with endianness since compression_type is 1 byte long */
3727          .compression_type           = compression_type,
3728          .header_length              = cpu_to_be32(sizeof(*header)),
3729      };
3730  
3731      /* We'll update this to correct value later */
3732      header->crypt_method = cpu_to_be32(QCOW_CRYPT_NONE);
3733  
3734      if (qcow2_opts->lazy_refcounts) {
3735          header->compatible_features |=
3736              cpu_to_be64(QCOW2_COMPAT_LAZY_REFCOUNTS);
3737      }
3738      if (data_bs) {
3739          header->incompatible_features |=
3740              cpu_to_be64(QCOW2_INCOMPAT_DATA_FILE);
3741      }
3742      if (qcow2_opts->data_file_raw) {
3743          header->autoclear_features |=
3744              cpu_to_be64(QCOW2_AUTOCLEAR_DATA_FILE_RAW);
3745      }
3746      if (compression_type != QCOW2_COMPRESSION_TYPE_ZLIB) {
3747          header->incompatible_features |=
3748              cpu_to_be64(QCOW2_INCOMPAT_COMPRESSION);
3749      }
3750  
3751      if (qcow2_opts->extended_l2) {
3752          header->incompatible_features |=
3753              cpu_to_be64(QCOW2_INCOMPAT_EXTL2);
3754      }
3755  
3756      ret = blk_co_pwrite(blk, 0, cluster_size, header, 0);
3757      g_free(header);
3758      if (ret < 0) {
3759          error_setg_errno(errp, -ret, "Could not write qcow2 header");
3760          goto out;
3761      }
3762  
3763      /* Write a refcount table with one refcount block */
3764      refcount_table = g_malloc0(2 * cluster_size);
3765      refcount_table[0] = cpu_to_be64(2 * cluster_size);
3766      ret = blk_co_pwrite(blk, cluster_size, 2 * cluster_size, refcount_table, 0);
3767      g_free(refcount_table);
3768  
3769      if (ret < 0) {
3770          error_setg_errno(errp, -ret, "Could not write refcount table");
3771          goto out;
3772      }
3773  
3774      blk_co_unref(blk);
3775      blk = NULL;
3776  
3777      /*
3778       * And now open the image and make it consistent first (i.e. increase the
3779       * refcount of the cluster that is occupied by the header and the refcount
3780       * table)
3781       */
3782      options = qdict_new();
3783      qdict_put_str(options, "driver", "qcow2");
3784      qdict_put_str(options, "file", bs->node_name);
3785      if (data_bs) {
3786          qdict_put_str(options, "data-file", data_bs->node_name);
3787      }
3788      blk = blk_co_new_open(NULL, NULL, options,
3789                            BDRV_O_RDWR | BDRV_O_RESIZE | BDRV_O_NO_FLUSH,
3790                            errp);
3791      if (blk == NULL) {
3792          ret = -EIO;
3793          goto out;
3794      }
3795  
3796      bdrv_graph_co_rdlock();
3797      ret = qcow2_alloc_clusters(blk_bs(blk), 3 * cluster_size);
3798      if (ret < 0) {
3799          bdrv_graph_co_rdunlock();
3800          error_setg_errno(errp, -ret, "Could not allocate clusters for qcow2 "
3801                           "header and refcount table");
3802          goto out;
3803  
3804      } else if (ret != 0) {
3805          error_report("Huh, first cluster in empty image is already in use?");
3806          abort();
3807      }
3808  
3809      /* Set the external data file if necessary */
3810      if (data_bs) {
3811          BDRVQcow2State *s = blk_bs(blk)->opaque;
3812          s->image_data_file = g_strdup(data_bs->filename);
3813      }
3814  
3815      /* Create a full header (including things like feature table) */
3816      ret = qcow2_update_header(blk_bs(blk));
3817      bdrv_graph_co_rdunlock();
3818  
3819      if (ret < 0) {
3820          error_setg_errno(errp, -ret, "Could not update qcow2 header");
3821          goto out;
3822      }
3823  
3824      /* Okay, now that we have a valid image, let's give it the right size */
3825      ret = blk_co_truncate(blk, qcow2_opts->size, false,
3826                            qcow2_opts->preallocation, 0, errp);
3827      if (ret < 0) {
3828          error_prepend(errp, "Could not resize image: ");
3829          goto out;
3830      }
3831  
3832      /* Want a backing file? There you go. */
3833      if (qcow2_opts->backing_file) {
3834          const char *backing_format = NULL;
3835  
3836          if (qcow2_opts->has_backing_fmt) {
3837              backing_format = BlockdevDriver_str(qcow2_opts->backing_fmt);
3838          }
3839  
3840          bdrv_graph_co_rdlock();
3841          ret = bdrv_co_change_backing_file(blk_bs(blk), qcow2_opts->backing_file,
3842                                            backing_format, false);
3843          bdrv_graph_co_rdunlock();
3844  
3845          if (ret < 0) {
3846              error_setg_errno(errp, -ret, "Could not assign backing file '%s' "
3847                               "with format '%s'", qcow2_opts->backing_file,
3848                               backing_format);
3849              goto out;
3850          }
3851      }
3852  
3853      /* Want encryption? There you go. */
3854      if (qcow2_opts->encrypt) {
3855          bdrv_graph_co_rdlock();
3856          ret = qcow2_set_up_encryption(blk_bs(blk), qcow2_opts->encrypt, errp);
3857          bdrv_graph_co_rdunlock();
3858  
3859          if (ret < 0) {
3860              goto out;
3861          }
3862      }
3863  
3864      blk_co_unref(blk);
3865      blk = NULL;
3866  
3867      /* Reopen the image without BDRV_O_NO_FLUSH to flush it before returning.
3868       * Using BDRV_O_NO_IO, since encryption is now setup we don't want to
3869       * have to setup decryption context. We're not doing any I/O on the top
3870       * level BlockDriverState, only lower layers, where BDRV_O_NO_IO does
3871       * not have effect.
3872       */
3873      options = qdict_new();
3874      qdict_put_str(options, "driver", "qcow2");
3875      qdict_put_str(options, "file", bs->node_name);
3876      if (data_bs) {
3877          qdict_put_str(options, "data-file", data_bs->node_name);
3878      }
3879      blk = blk_co_new_open(NULL, NULL, options,
3880                            BDRV_O_RDWR | BDRV_O_NO_BACKING | BDRV_O_NO_IO,
3881                            errp);
3882      if (blk == NULL) {
3883          ret = -EIO;
3884          goto out;
3885      }
3886  
3887      ret = 0;
3888  out:
3889      blk_co_unref(blk);
3890      bdrv_co_unref(bs);
3891      bdrv_co_unref(data_bs);
3892      return ret;
3893  }
3894  
3895  static int coroutine_fn GRAPH_UNLOCKED
3896  qcow2_co_create_opts(BlockDriver *drv, const char *filename, QemuOpts *opts,
3897                       Error **errp)
3898  {
3899      BlockdevCreateOptions *create_options = NULL;
3900      QDict *qdict;
3901      Visitor *v;
3902      BlockDriverState *bs = NULL;
3903      BlockDriverState *data_bs = NULL;
3904      const char *val;
3905      int ret;
3906  
3907      /* Only the keyval visitor supports the dotted syntax needed for
3908       * encryption, so go through a QDict before getting a QAPI type. Ignore
3909       * options meant for the protocol layer so that the visitor doesn't
3910       * complain. */
3911      qdict = qemu_opts_to_qdict_filtered(opts, NULL, bdrv_qcow2.create_opts,
3912                                          true);
3913  
3914      /* Handle encryption options */
3915      val = qdict_get_try_str(qdict, BLOCK_OPT_ENCRYPT);
3916      if (val && !strcmp(val, "on")) {
3917          qdict_put_str(qdict, BLOCK_OPT_ENCRYPT, "qcow");
3918      } else if (val && !strcmp(val, "off")) {
3919          qdict_del(qdict, BLOCK_OPT_ENCRYPT);
3920      }
3921  
3922      val = qdict_get_try_str(qdict, BLOCK_OPT_ENCRYPT_FORMAT);
3923      if (val && !strcmp(val, "aes")) {
3924          qdict_put_str(qdict, BLOCK_OPT_ENCRYPT_FORMAT, "qcow");
3925      }
3926  
3927      /* Convert compat=0.10/1.1 into compat=v2/v3, to be renamed into
3928       * version=v2/v3 below. */
3929      val = qdict_get_try_str(qdict, BLOCK_OPT_COMPAT_LEVEL);
3930      if (val && !strcmp(val, "0.10")) {
3931          qdict_put_str(qdict, BLOCK_OPT_COMPAT_LEVEL, "v2");
3932      } else if (val && !strcmp(val, "1.1")) {
3933          qdict_put_str(qdict, BLOCK_OPT_COMPAT_LEVEL, "v3");
3934      }
3935  
3936      /* Change legacy command line options into QMP ones */
3937      static const QDictRenames opt_renames[] = {
3938          { BLOCK_OPT_BACKING_FILE,       "backing-file" },
3939          { BLOCK_OPT_BACKING_FMT,        "backing-fmt" },
3940          { BLOCK_OPT_CLUSTER_SIZE,       "cluster-size" },
3941          { BLOCK_OPT_LAZY_REFCOUNTS,     "lazy-refcounts" },
3942          { BLOCK_OPT_EXTL2,              "extended-l2" },
3943          { BLOCK_OPT_REFCOUNT_BITS,      "refcount-bits" },
3944          { BLOCK_OPT_ENCRYPT,            BLOCK_OPT_ENCRYPT_FORMAT },
3945          { BLOCK_OPT_COMPAT_LEVEL,       "version" },
3946          { BLOCK_OPT_DATA_FILE_RAW,      "data-file-raw" },
3947          { BLOCK_OPT_COMPRESSION_TYPE,   "compression-type" },
3948          { NULL, NULL },
3949      };
3950  
3951      if (!qdict_rename_keys(qdict, opt_renames, errp)) {
3952          ret = -EINVAL;
3953          goto finish;
3954      }
3955  
3956      /* Create and open the file (protocol layer) */
3957      ret = bdrv_co_create_file(filename, opts, errp);
3958      if (ret < 0) {
3959          goto finish;
3960      }
3961  
3962      bs = bdrv_co_open(filename, NULL, NULL,
3963                        BDRV_O_RDWR | BDRV_O_RESIZE | BDRV_O_PROTOCOL, errp);
3964      if (bs == NULL) {
3965          ret = -EIO;
3966          goto finish;
3967      }
3968  
3969      /* Create and open an external data file (protocol layer) */
3970      val = qdict_get_try_str(qdict, BLOCK_OPT_DATA_FILE);
3971      if (val) {
3972          ret = bdrv_co_create_file(val, opts, errp);
3973          if (ret < 0) {
3974              goto finish;
3975          }
3976  
3977          data_bs = bdrv_co_open(val, NULL, NULL,
3978                                 BDRV_O_RDWR | BDRV_O_RESIZE | BDRV_O_PROTOCOL,
3979                                 errp);
3980          if (data_bs == NULL) {
3981              ret = -EIO;
3982              goto finish;
3983          }
3984  
3985          qdict_del(qdict, BLOCK_OPT_DATA_FILE);
3986          qdict_put_str(qdict, "data-file", data_bs->node_name);
3987      }
3988  
3989      /* Set 'driver' and 'node' options */
3990      qdict_put_str(qdict, "driver", "qcow2");
3991      qdict_put_str(qdict, "file", bs->node_name);
3992  
3993      /* Now get the QAPI type BlockdevCreateOptions */
3994      v = qobject_input_visitor_new_flat_confused(qdict, errp);
3995      if (!v) {
3996          ret = -EINVAL;
3997          goto finish;
3998      }
3999  
4000      visit_type_BlockdevCreateOptions(v, NULL, &create_options, errp);
4001      visit_free(v);
4002      if (!create_options) {
4003          ret = -EINVAL;
4004          goto finish;
4005      }
4006  
4007      /* Silently round up size */
4008      create_options->u.qcow2.size = ROUND_UP(create_options->u.qcow2.size,
4009                                              BDRV_SECTOR_SIZE);
4010  
4011      /* Create the qcow2 image (format layer) */
4012      ret = qcow2_co_create(create_options, errp);
4013  finish:
4014      if (ret < 0) {
4015          bdrv_graph_co_rdlock();
4016          bdrv_co_delete_file_noerr(bs);
4017          bdrv_co_delete_file_noerr(data_bs);
4018          bdrv_graph_co_rdunlock();
4019      } else {
4020          ret = 0;
4021      }
4022  
4023      qobject_unref(qdict);
4024      bdrv_co_unref(bs);
4025      bdrv_co_unref(data_bs);
4026      qapi_free_BlockdevCreateOptions(create_options);
4027      return ret;
4028  }
4029  
4030  
4031  static bool coroutine_fn GRAPH_RDLOCK
4032  is_zero(BlockDriverState *bs, int64_t offset, int64_t bytes)
4033  {
4034      int64_t nr;
4035      int res;
4036  
4037      /* Clamp to image length, before checking status of underlying sectors */
4038      if (offset + bytes > bs->total_sectors * BDRV_SECTOR_SIZE) {
4039          bytes = bs->total_sectors * BDRV_SECTOR_SIZE - offset;
4040      }
4041  
4042      if (!bytes) {
4043          return true;
4044      }
4045  
4046      /*
4047       * bdrv_block_status_above doesn't merge different types of zeros, for
4048       * example, zeros which come from the region which is unallocated in
4049       * the whole backing chain, and zeros which come because of a short
4050       * backing file. So, we need a loop.
4051       */
4052      do {
4053          res = bdrv_co_block_status_above(bs, NULL, offset, bytes, &nr, NULL, NULL);
4054          offset += nr;
4055          bytes -= nr;
4056      } while (res >= 0 && (res & BDRV_BLOCK_ZERO) && nr && bytes);
4057  
4058      return res >= 0 && (res & BDRV_BLOCK_ZERO) && bytes == 0;
4059  }
4060  
4061  static int coroutine_fn GRAPH_RDLOCK
4062  qcow2_co_pwrite_zeroes(BlockDriverState *bs, int64_t offset, int64_t bytes,
4063                         BdrvRequestFlags flags)
4064  {
4065      int ret;
4066      BDRVQcow2State *s = bs->opaque;
4067  
4068      uint32_t head = offset_into_subcluster(s, offset);
4069      uint32_t tail = ROUND_UP(offset + bytes, s->subcluster_size) -
4070          (offset + bytes);
4071  
4072      trace_qcow2_pwrite_zeroes_start_req(qemu_coroutine_self(), offset, bytes);
4073      if (offset + bytes == bs->total_sectors * BDRV_SECTOR_SIZE) {
4074          tail = 0;
4075      }
4076  
4077      if (head || tail) {
4078          uint64_t off;
4079          unsigned int nr;
4080          QCow2SubclusterType type;
4081  
4082          assert(head + bytes + tail <= s->subcluster_size);
4083  
4084          /* check whether remainder of cluster already reads as zero */
4085          if (!(is_zero(bs, offset - head, head) &&
4086                is_zero(bs, offset + bytes, tail))) {
4087              return -ENOTSUP;
4088          }
4089  
4090          qemu_co_mutex_lock(&s->lock);
4091          /* We can have new write after previous check */
4092          offset -= head;
4093          bytes = s->subcluster_size;
4094          nr = s->subcluster_size;
4095          ret = qcow2_get_host_offset(bs, offset, &nr, &off, &type);
4096          if (ret < 0 ||
4097              (type != QCOW2_SUBCLUSTER_UNALLOCATED_PLAIN &&
4098               type != QCOW2_SUBCLUSTER_UNALLOCATED_ALLOC &&
4099               type != QCOW2_SUBCLUSTER_ZERO_PLAIN &&
4100               type != QCOW2_SUBCLUSTER_ZERO_ALLOC)) {
4101              qemu_co_mutex_unlock(&s->lock);
4102              return ret < 0 ? ret : -ENOTSUP;
4103          }
4104      } else {
4105          qemu_co_mutex_lock(&s->lock);
4106      }
4107  
4108      trace_qcow2_pwrite_zeroes(qemu_coroutine_self(), offset, bytes);
4109  
4110      /* Whatever is left can use real zero subclusters */
4111      ret = qcow2_subcluster_zeroize(bs, offset, bytes, flags);
4112      qemu_co_mutex_unlock(&s->lock);
4113  
4114      return ret;
4115  }
4116  
4117  static int coroutine_fn GRAPH_RDLOCK
4118  qcow2_co_pdiscard(BlockDriverState *bs, int64_t offset, int64_t bytes)
4119  {
4120      int ret;
4121      BDRVQcow2State *s = bs->opaque;
4122  
4123      /* If the image does not support QCOW_OFLAG_ZERO then discarding
4124       * clusters could expose stale data from the backing file. */
4125      if (s->qcow_version < 3 && bs->backing) {
4126          return -ENOTSUP;
4127      }
4128  
4129      if (!QEMU_IS_ALIGNED(offset | bytes, s->cluster_size)) {
4130          assert(bytes < s->cluster_size);
4131          /* Ignore partial clusters, except for the special case of the
4132           * complete partial cluster at the end of an unaligned file */
4133          if (!QEMU_IS_ALIGNED(offset, s->cluster_size) ||
4134              offset + bytes != bs->total_sectors * BDRV_SECTOR_SIZE) {
4135              return -ENOTSUP;
4136          }
4137      }
4138  
4139      qemu_co_mutex_lock(&s->lock);
4140      ret = qcow2_cluster_discard(bs, offset, bytes, QCOW2_DISCARD_REQUEST,
4141                                  false);
4142      qemu_co_mutex_unlock(&s->lock);
4143      return ret;
4144  }
4145  
4146  static int coroutine_fn GRAPH_RDLOCK
4147  qcow2_co_copy_range_from(BlockDriverState *bs,
4148                           BdrvChild *src, int64_t src_offset,
4149                           BdrvChild *dst, int64_t dst_offset,
4150                           int64_t bytes, BdrvRequestFlags read_flags,
4151                           BdrvRequestFlags write_flags)
4152  {
4153      BDRVQcow2State *s = bs->opaque;
4154      int ret;
4155      unsigned int cur_bytes; /* number of bytes in current iteration */
4156      BdrvChild *child = NULL;
4157      BdrvRequestFlags cur_write_flags;
4158  
4159      assert(!bs->encrypted);
4160      qemu_co_mutex_lock(&s->lock);
4161  
4162      while (bytes != 0) {
4163          uint64_t copy_offset = 0;
4164          QCow2SubclusterType type;
4165          /* prepare next request */
4166          cur_bytes = MIN(bytes, INT_MAX);
4167          cur_write_flags = write_flags;
4168  
4169          ret = qcow2_get_host_offset(bs, src_offset, &cur_bytes,
4170                                      &copy_offset, &type);
4171          if (ret < 0) {
4172              goto out;
4173          }
4174  
4175          switch (type) {
4176          case QCOW2_SUBCLUSTER_UNALLOCATED_PLAIN:
4177          case QCOW2_SUBCLUSTER_UNALLOCATED_ALLOC:
4178              if (bs->backing && bs->backing->bs) {
4179                  int64_t backing_length = bdrv_co_getlength(bs->backing->bs);
4180                  if (src_offset >= backing_length) {
4181                      cur_write_flags |= BDRV_REQ_ZERO_WRITE;
4182                  } else {
4183                      child = bs->backing;
4184                      cur_bytes = MIN(cur_bytes, backing_length - src_offset);
4185                      copy_offset = src_offset;
4186                  }
4187              } else {
4188                  cur_write_flags |= BDRV_REQ_ZERO_WRITE;
4189              }
4190              break;
4191  
4192          case QCOW2_SUBCLUSTER_ZERO_PLAIN:
4193          case QCOW2_SUBCLUSTER_ZERO_ALLOC:
4194              cur_write_flags |= BDRV_REQ_ZERO_WRITE;
4195              break;
4196  
4197          case QCOW2_SUBCLUSTER_COMPRESSED:
4198              ret = -ENOTSUP;
4199              goto out;
4200  
4201          case QCOW2_SUBCLUSTER_NORMAL:
4202              child = s->data_file;
4203              break;
4204  
4205          default:
4206              abort();
4207          }
4208          qemu_co_mutex_unlock(&s->lock);
4209          ret = bdrv_co_copy_range_from(child,
4210                                        copy_offset,
4211                                        dst, dst_offset,
4212                                        cur_bytes, read_flags, cur_write_flags);
4213          qemu_co_mutex_lock(&s->lock);
4214          if (ret < 0) {
4215              goto out;
4216          }
4217  
4218          bytes -= cur_bytes;
4219          src_offset += cur_bytes;
4220          dst_offset += cur_bytes;
4221      }
4222      ret = 0;
4223  
4224  out:
4225      qemu_co_mutex_unlock(&s->lock);
4226      return ret;
4227  }
4228  
4229  static int coroutine_fn GRAPH_RDLOCK
4230  qcow2_co_copy_range_to(BlockDriverState *bs,
4231                         BdrvChild *src, int64_t src_offset,
4232                         BdrvChild *dst, int64_t dst_offset,
4233                         int64_t bytes, BdrvRequestFlags read_flags,
4234                         BdrvRequestFlags write_flags)
4235  {
4236      BDRVQcow2State *s = bs->opaque;
4237      int ret;
4238      unsigned int cur_bytes; /* number of sectors in current iteration */
4239      uint64_t host_offset;
4240      QCowL2Meta *l2meta = NULL;
4241  
4242      assert(!bs->encrypted);
4243  
4244      qemu_co_mutex_lock(&s->lock);
4245  
4246      while (bytes != 0) {
4247  
4248          l2meta = NULL;
4249  
4250          cur_bytes = MIN(bytes, INT_MAX);
4251  
4252          /* TODO:
4253           * If src->bs == dst->bs, we could simply copy by incrementing
4254           * the refcnt, without copying user data.
4255           * Or if src->bs == dst->bs->backing->bs, we could copy by discarding. */
4256          ret = qcow2_alloc_host_offset(bs, dst_offset, &cur_bytes,
4257                                        &host_offset, &l2meta);
4258          if (ret < 0) {
4259              goto fail;
4260          }
4261  
4262          ret = qcow2_pre_write_overlap_check(bs, 0, host_offset, cur_bytes,
4263                                              true);
4264          if (ret < 0) {
4265              goto fail;
4266          }
4267  
4268          qemu_co_mutex_unlock(&s->lock);
4269          ret = bdrv_co_copy_range_to(src, src_offset, s->data_file, host_offset,
4270                                      cur_bytes, read_flags, write_flags);
4271          qemu_co_mutex_lock(&s->lock);
4272          if (ret < 0) {
4273              goto fail;
4274          }
4275  
4276          ret = qcow2_handle_l2meta(bs, &l2meta, true);
4277          if (ret) {
4278              goto fail;
4279          }
4280  
4281          bytes -= cur_bytes;
4282          src_offset += cur_bytes;
4283          dst_offset += cur_bytes;
4284      }
4285      ret = 0;
4286  
4287  fail:
4288      qcow2_handle_l2meta(bs, &l2meta, false);
4289  
4290      qemu_co_mutex_unlock(&s->lock);
4291  
4292      trace_qcow2_writev_done_req(qemu_coroutine_self(), ret);
4293  
4294      return ret;
4295  }
4296  
4297  static int coroutine_fn GRAPH_RDLOCK
4298  qcow2_co_truncate(BlockDriverState *bs, int64_t offset, bool exact,
4299                    PreallocMode prealloc, BdrvRequestFlags flags, Error **errp)
4300  {
4301      ERRP_GUARD();
4302      BDRVQcow2State *s = bs->opaque;
4303      uint64_t old_length;
4304      int64_t new_l1_size;
4305      int ret;
4306      QDict *options;
4307  
4308      if (prealloc != PREALLOC_MODE_OFF && prealloc != PREALLOC_MODE_METADATA &&
4309          prealloc != PREALLOC_MODE_FALLOC && prealloc != PREALLOC_MODE_FULL)
4310      {
4311          error_setg(errp, "Unsupported preallocation mode '%s'",
4312                     PreallocMode_str(prealloc));
4313          return -ENOTSUP;
4314      }
4315  
4316      if (!QEMU_IS_ALIGNED(offset, BDRV_SECTOR_SIZE)) {
4317          error_setg(errp, "The new size must be a multiple of %u",
4318                     (unsigned) BDRV_SECTOR_SIZE);
4319          return -EINVAL;
4320      }
4321  
4322      qemu_co_mutex_lock(&s->lock);
4323  
4324      /*
4325       * Even though we store snapshot size for all images, it was not
4326       * required until v3, so it is not safe to proceed for v2.
4327       */
4328      if (s->nb_snapshots && s->qcow_version < 3) {
4329          error_setg(errp, "Can't resize a v2 image which has snapshots");
4330          ret = -ENOTSUP;
4331          goto fail;
4332      }
4333  
4334      /* See qcow2-bitmap.c for which bitmap scenarios prevent a resize. */
4335      if (qcow2_truncate_bitmaps_check(bs, errp)) {
4336          ret = -ENOTSUP;
4337          goto fail;
4338      }
4339  
4340      old_length = bs->total_sectors * BDRV_SECTOR_SIZE;
4341      new_l1_size = size_to_l1(s, offset);
4342  
4343      if (offset < old_length) {
4344          int64_t last_cluster, old_file_size;
4345          if (prealloc != PREALLOC_MODE_OFF) {
4346              error_setg(errp,
4347                         "Preallocation can't be used for shrinking an image");
4348              ret = -EINVAL;
4349              goto fail;
4350          }
4351  
4352          ret = qcow2_cluster_discard(bs, ROUND_UP(offset, s->cluster_size),
4353                                      old_length - ROUND_UP(offset,
4354                                                            s->cluster_size),
4355                                      QCOW2_DISCARD_ALWAYS, true);
4356          if (ret < 0) {
4357              error_setg_errno(errp, -ret, "Failed to discard cropped clusters");
4358              goto fail;
4359          }
4360  
4361          ret = qcow2_shrink_l1_table(bs, new_l1_size);
4362          if (ret < 0) {
4363              error_setg_errno(errp, -ret,
4364                               "Failed to reduce the number of L2 tables");
4365              goto fail;
4366          }
4367  
4368          ret = qcow2_shrink_reftable(bs);
4369          if (ret < 0) {
4370              error_setg_errno(errp, -ret,
4371                               "Failed to discard unused refblocks");
4372              goto fail;
4373          }
4374  
4375          old_file_size = bdrv_co_getlength(bs->file->bs);
4376          if (old_file_size < 0) {
4377              error_setg_errno(errp, -old_file_size,
4378                               "Failed to inquire current file length");
4379              ret = old_file_size;
4380              goto fail;
4381          }
4382          last_cluster = qcow2_get_last_cluster(bs, old_file_size);
4383          if (last_cluster < 0) {
4384              error_setg_errno(errp, -last_cluster,
4385                               "Failed to find the last cluster");
4386              ret = last_cluster;
4387              goto fail;
4388          }
4389          if ((last_cluster + 1) * s->cluster_size < old_file_size) {
4390              Error *local_err = NULL;
4391  
4392              /*
4393               * Do not pass @exact here: It will not help the user if
4394               * we get an error here just because they wanted to shrink
4395               * their qcow2 image (on a block device) with qemu-img.
4396               * (And on the qcow2 layer, the @exact requirement is
4397               * always fulfilled, so there is no need to pass it on.)
4398               */
4399              bdrv_co_truncate(bs->file, (last_cluster + 1) * s->cluster_size,
4400                               false, PREALLOC_MODE_OFF, 0, &local_err);
4401              if (local_err) {
4402                  warn_reportf_err(local_err,
4403                                   "Failed to truncate the tail of the image: ");
4404              }
4405          }
4406      } else {
4407          ret = qcow2_grow_l1_table(bs, new_l1_size, true);
4408          if (ret < 0) {
4409              error_setg_errno(errp, -ret, "Failed to grow the L1 table");
4410              goto fail;
4411          }
4412  
4413          if (data_file_is_raw(bs) && prealloc == PREALLOC_MODE_OFF) {
4414              /*
4415               * When creating a qcow2 image with data-file-raw, we enforce
4416               * at least prealloc=metadata, so that the L1/L2 tables are
4417               * fully allocated and reading from the data file will return
4418               * the same data as reading from the qcow2 image.  When the
4419               * image is grown, we must consequently preallocate the
4420               * metadata structures to cover the added area.
4421               */
4422              prealloc = PREALLOC_MODE_METADATA;
4423          }
4424      }
4425  
4426      switch (prealloc) {
4427      case PREALLOC_MODE_OFF:
4428          if (has_data_file(bs)) {
4429              /*
4430               * If the caller wants an exact resize, the external data
4431               * file should be resized to the exact target size, too,
4432               * so we pass @exact here.
4433               */
4434              ret = bdrv_co_truncate(s->data_file, offset, exact, prealloc, 0,
4435                                     errp);
4436              if (ret < 0) {
4437                  goto fail;
4438              }
4439          }
4440          break;
4441  
4442      case PREALLOC_MODE_METADATA:
4443          ret = preallocate_co(bs, old_length, offset, prealloc, errp);
4444          if (ret < 0) {
4445              goto fail;
4446          }
4447          break;
4448  
4449      case PREALLOC_MODE_FALLOC:
4450      case PREALLOC_MODE_FULL:
4451      {
4452          int64_t allocation_start, host_offset, guest_offset;
4453          int64_t clusters_allocated;
4454          int64_t old_file_size, last_cluster, new_file_size;
4455          uint64_t nb_new_data_clusters, nb_new_l2_tables;
4456          bool subclusters_need_allocation = false;
4457  
4458          /* With a data file, preallocation means just allocating the metadata
4459           * and forwarding the truncate request to the data file */
4460          if (has_data_file(bs)) {
4461              ret = preallocate_co(bs, old_length, offset, prealloc, errp);
4462              if (ret < 0) {
4463                  goto fail;
4464              }
4465              break;
4466          }
4467  
4468          old_file_size = bdrv_co_getlength(bs->file->bs);
4469          if (old_file_size < 0) {
4470              error_setg_errno(errp, -old_file_size,
4471                               "Failed to inquire current file length");
4472              ret = old_file_size;
4473              goto fail;
4474          }
4475  
4476          last_cluster = qcow2_get_last_cluster(bs, old_file_size);
4477          if (last_cluster >= 0) {
4478              old_file_size = (last_cluster + 1) * s->cluster_size;
4479          } else {
4480              old_file_size = ROUND_UP(old_file_size, s->cluster_size);
4481          }
4482  
4483          nb_new_data_clusters = (ROUND_UP(offset, s->cluster_size) -
4484              start_of_cluster(s, old_length)) >> s->cluster_bits;
4485  
4486          /* This is an overestimation; we will not actually allocate space for
4487           * these in the file but just make sure the new refcount structures are
4488           * able to cover them so we will not have to allocate new refblocks
4489           * while entering the data blocks in the potentially new L2 tables.
4490           * (We do not actually care where the L2 tables are placed. Maybe they
4491           *  are already allocated or they can be placed somewhere before
4492           *  @old_file_size. It does not matter because they will be fully
4493           *  allocated automatically, so they do not need to be covered by the
4494           *  preallocation. All that matters is that we will not have to allocate
4495           *  new refcount structures for them.) */
4496          nb_new_l2_tables = DIV_ROUND_UP(nb_new_data_clusters,
4497                                          s->cluster_size / l2_entry_size(s));
4498          /* The cluster range may not be aligned to L2 boundaries, so add one L2
4499           * table for a potential head/tail */
4500          nb_new_l2_tables++;
4501  
4502          allocation_start = qcow2_refcount_area(bs, old_file_size,
4503                                                 nb_new_data_clusters +
4504                                                 nb_new_l2_tables,
4505                                                 true, 0, 0);
4506          if (allocation_start < 0) {
4507              error_setg_errno(errp, -allocation_start,
4508                               "Failed to resize refcount structures");
4509              ret = allocation_start;
4510              goto fail;
4511          }
4512  
4513          clusters_allocated = qcow2_alloc_clusters_at(bs, allocation_start,
4514                                                       nb_new_data_clusters);
4515          if (clusters_allocated < 0) {
4516              error_setg_errno(errp, -clusters_allocated,
4517                               "Failed to allocate data clusters");
4518              ret = clusters_allocated;
4519              goto fail;
4520          }
4521  
4522          assert(clusters_allocated == nb_new_data_clusters);
4523  
4524          /* Allocate the data area */
4525          new_file_size = allocation_start +
4526                          nb_new_data_clusters * s->cluster_size;
4527          /*
4528           * Image file grows, so @exact does not matter.
4529           *
4530           * If we need to zero out the new area, try first whether the protocol
4531           * driver can already take care of this.
4532           */
4533          if (flags & BDRV_REQ_ZERO_WRITE) {
4534              ret = bdrv_co_truncate(bs->file, new_file_size, false, prealloc,
4535                                     BDRV_REQ_ZERO_WRITE, NULL);
4536              if (ret >= 0) {
4537                  flags &= ~BDRV_REQ_ZERO_WRITE;
4538                  /* Ensure that we read zeroes and not backing file data */
4539                  subclusters_need_allocation = true;
4540              }
4541          } else {
4542              ret = -1;
4543          }
4544          if (ret < 0) {
4545              ret = bdrv_co_truncate(bs->file, new_file_size, false, prealloc, 0,
4546                                     errp);
4547          }
4548          if (ret < 0) {
4549              error_prepend(errp, "Failed to resize underlying file: ");
4550              qcow2_free_clusters(bs, allocation_start,
4551                                  nb_new_data_clusters * s->cluster_size,
4552                                  QCOW2_DISCARD_OTHER);
4553              goto fail;
4554          }
4555  
4556          /* Create the necessary L2 entries */
4557          host_offset = allocation_start;
4558          guest_offset = old_length;
4559          while (nb_new_data_clusters) {
4560              int64_t nb_clusters = MIN(
4561                  nb_new_data_clusters,
4562                  s->l2_slice_size - offset_to_l2_slice_index(s, guest_offset));
4563              unsigned cow_start_length = offset_into_cluster(s, guest_offset);
4564              QCowL2Meta allocation;
4565              guest_offset = start_of_cluster(s, guest_offset);
4566              allocation = (QCowL2Meta) {
4567                  .offset       = guest_offset,
4568                  .alloc_offset = host_offset,
4569                  .nb_clusters  = nb_clusters,
4570                  .cow_start    = {
4571                      .offset       = 0,
4572                      .nb_bytes     = cow_start_length,
4573                  },
4574                  .cow_end      = {
4575                      .offset       = nb_clusters << s->cluster_bits,
4576                      .nb_bytes     = 0,
4577                  },
4578                  .prealloc     = !subclusters_need_allocation,
4579              };
4580              qemu_co_queue_init(&allocation.dependent_requests);
4581  
4582              ret = qcow2_alloc_cluster_link_l2(bs, &allocation);
4583              if (ret < 0) {
4584                  error_setg_errno(errp, -ret, "Failed to update L2 tables");
4585                  qcow2_free_clusters(bs, host_offset,
4586                                      nb_new_data_clusters * s->cluster_size,
4587                                      QCOW2_DISCARD_OTHER);
4588                  goto fail;
4589              }
4590  
4591              guest_offset += nb_clusters * s->cluster_size;
4592              host_offset += nb_clusters * s->cluster_size;
4593              nb_new_data_clusters -= nb_clusters;
4594          }
4595          break;
4596      }
4597  
4598      default:
4599          g_assert_not_reached();
4600      }
4601  
4602      if ((flags & BDRV_REQ_ZERO_WRITE) && offset > old_length) {
4603          uint64_t zero_start = QEMU_ALIGN_UP(old_length, s->subcluster_size);
4604  
4605          /*
4606           * Use zero clusters as much as we can. qcow2_subcluster_zeroize()
4607           * requires a subcluster-aligned start. The end may be unaligned if
4608           * it is at the end of the image (which it is here).
4609           */
4610          if (offset > zero_start) {
4611              ret = qcow2_subcluster_zeroize(bs, zero_start, offset - zero_start,
4612                                             0);
4613              if (ret < 0) {
4614                  error_setg_errno(errp, -ret, "Failed to zero out new clusters");
4615                  goto fail;
4616              }
4617          }
4618  
4619          /* Write explicit zeros for the unaligned head */
4620          if (zero_start > old_length) {
4621              uint64_t len = MIN(zero_start, offset) - old_length;
4622              uint8_t *buf = qemu_blockalign0(bs, len);
4623              QEMUIOVector qiov;
4624              qemu_iovec_init_buf(&qiov, buf, len);
4625  
4626              qemu_co_mutex_unlock(&s->lock);
4627              ret = qcow2_co_pwritev_part(bs, old_length, len, &qiov, 0, 0);
4628              qemu_co_mutex_lock(&s->lock);
4629  
4630              qemu_vfree(buf);
4631              if (ret < 0) {
4632                  error_setg_errno(errp, -ret, "Failed to zero out the new area");
4633                  goto fail;
4634              }
4635          }
4636      }
4637  
4638      if (prealloc != PREALLOC_MODE_OFF) {
4639          /* Flush metadata before actually changing the image size */
4640          ret = qcow2_write_caches(bs);
4641          if (ret < 0) {
4642              error_setg_errno(errp, -ret,
4643                               "Failed to flush the preallocated area to disk");
4644              goto fail;
4645          }
4646      }
4647  
4648      bs->total_sectors = offset / BDRV_SECTOR_SIZE;
4649  
4650      /* write updated header.size */
4651      offset = cpu_to_be64(offset);
4652      ret = bdrv_co_pwrite_sync(bs->file, offsetof(QCowHeader, size),
4653                                sizeof(offset), &offset, 0);
4654      if (ret < 0) {
4655          error_setg_errno(errp, -ret, "Failed to update the image size");
4656          goto fail;
4657      }
4658  
4659      s->l1_vm_state_index = new_l1_size;
4660  
4661      /* Update cache sizes */
4662      options = qdict_clone_shallow(bs->options);
4663      ret = qcow2_update_options(bs, options, s->flags, errp);
4664      qobject_unref(options);
4665      if (ret < 0) {
4666          goto fail;
4667      }
4668      ret = 0;
4669  fail:
4670      qemu_co_mutex_unlock(&s->lock);
4671      return ret;
4672  }
4673  
4674  static int coroutine_fn GRAPH_RDLOCK
4675  qcow2_co_pwritev_compressed_task(BlockDriverState *bs,
4676                                   uint64_t offset, uint64_t bytes,
4677                                   QEMUIOVector *qiov, size_t qiov_offset)
4678  {
4679      BDRVQcow2State *s = bs->opaque;
4680      int ret;
4681      ssize_t out_len;
4682      uint8_t *buf, *out_buf;
4683      uint64_t cluster_offset;
4684  
4685      assert(bytes == s->cluster_size || (bytes < s->cluster_size &&
4686             (offset + bytes == bs->total_sectors << BDRV_SECTOR_BITS)));
4687  
4688      buf = qemu_blockalign(bs, s->cluster_size);
4689      if (bytes < s->cluster_size) {
4690          /* Zero-pad last write if image size is not cluster aligned */
4691          memset(buf + bytes, 0, s->cluster_size - bytes);
4692      }
4693      qemu_iovec_to_buf(qiov, qiov_offset, buf, bytes);
4694  
4695      out_buf = g_malloc(s->cluster_size);
4696  
4697      out_len = qcow2_co_compress(bs, out_buf, s->cluster_size - 1,
4698                                  buf, s->cluster_size);
4699      if (out_len == -ENOMEM) {
4700          /* could not compress: write normal cluster */
4701          ret = qcow2_co_pwritev_part(bs, offset, bytes, qiov, qiov_offset, 0);
4702          if (ret < 0) {
4703              goto fail;
4704          }
4705          goto success;
4706      } else if (out_len < 0) {
4707          ret = -EINVAL;
4708          goto fail;
4709      }
4710  
4711      qemu_co_mutex_lock(&s->lock);
4712      ret = qcow2_alloc_compressed_cluster_offset(bs, offset, out_len,
4713                                                  &cluster_offset);
4714      if (ret < 0) {
4715          qemu_co_mutex_unlock(&s->lock);
4716          goto fail;
4717      }
4718  
4719      ret = qcow2_pre_write_overlap_check(bs, 0, cluster_offset, out_len, true);
4720      qemu_co_mutex_unlock(&s->lock);
4721      if (ret < 0) {
4722          goto fail;
4723      }
4724  
4725      BLKDBG_CO_EVENT(s->data_file, BLKDBG_WRITE_COMPRESSED);
4726      ret = bdrv_co_pwrite(s->data_file, cluster_offset, out_len, out_buf, 0);
4727      if (ret < 0) {
4728          goto fail;
4729      }
4730  success:
4731      ret = 0;
4732  fail:
4733      qemu_vfree(buf);
4734      g_free(out_buf);
4735      return ret;
4736  }
4737  
4738  /*
4739   * This function can count as GRAPH_RDLOCK because
4740   * qcow2_co_pwritev_compressed_part() holds the graph lock and keeps it until
4741   * this coroutine has terminated.
4742   */
4743  static int coroutine_fn GRAPH_RDLOCK
4744  qcow2_co_pwritev_compressed_task_entry(AioTask *task)
4745  {
4746      Qcow2AioTask *t = container_of(task, Qcow2AioTask, task);
4747  
4748      assert(!t->subcluster_type && !t->l2meta);
4749  
4750      return qcow2_co_pwritev_compressed_task(t->bs, t->offset, t->bytes, t->qiov,
4751                                              t->qiov_offset);
4752  }
4753  
4754  /*
4755   * XXX: put compressed sectors first, then all the cluster aligned
4756   * tables to avoid losing bytes in alignment
4757   */
4758  static int coroutine_fn GRAPH_RDLOCK
4759  qcow2_co_pwritev_compressed_part(BlockDriverState *bs,
4760                                   int64_t offset, int64_t bytes,
4761                                   QEMUIOVector *qiov, size_t qiov_offset)
4762  {
4763      BDRVQcow2State *s = bs->opaque;
4764      AioTaskPool *aio = NULL;
4765      int ret = 0;
4766  
4767      if (has_data_file(bs)) {
4768          return -ENOTSUP;
4769      }
4770  
4771      if (bytes == 0) {
4772          /*
4773           * align end of file to a sector boundary to ease reading with
4774           * sector based I/Os
4775           */
4776          int64_t len = bdrv_co_getlength(bs->file->bs);
4777          if (len < 0) {
4778              return len;
4779          }
4780          return bdrv_co_truncate(bs->file, len, false, PREALLOC_MODE_OFF, 0,
4781                                  NULL);
4782      }
4783  
4784      if (offset_into_cluster(s, offset)) {
4785          return -EINVAL;
4786      }
4787  
4788      if (offset_into_cluster(s, bytes) &&
4789          (offset + bytes) != (bs->total_sectors << BDRV_SECTOR_BITS)) {
4790          return -EINVAL;
4791      }
4792  
4793      while (bytes && aio_task_pool_status(aio) == 0) {
4794          uint64_t chunk_size = MIN(bytes, s->cluster_size);
4795  
4796          if (!aio && chunk_size != bytes) {
4797              aio = aio_task_pool_new(QCOW2_MAX_WORKERS);
4798          }
4799  
4800          ret = qcow2_add_task(bs, aio, qcow2_co_pwritev_compressed_task_entry,
4801                               0, 0, offset, chunk_size, qiov, qiov_offset, NULL);
4802          if (ret < 0) {
4803              break;
4804          }
4805          qiov_offset += chunk_size;
4806          offset += chunk_size;
4807          bytes -= chunk_size;
4808      }
4809  
4810      if (aio) {
4811          aio_task_pool_wait_all(aio);
4812          if (ret == 0) {
4813              ret = aio_task_pool_status(aio);
4814          }
4815          g_free(aio);
4816      }
4817  
4818      return ret;
4819  }
4820  
4821  static int coroutine_fn GRAPH_RDLOCK
4822  qcow2_co_preadv_compressed(BlockDriverState *bs,
4823                             uint64_t l2_entry,
4824                             uint64_t offset,
4825                             uint64_t bytes,
4826                             QEMUIOVector *qiov,
4827                             size_t qiov_offset)
4828  {
4829      BDRVQcow2State *s = bs->opaque;
4830      int ret = 0, csize;
4831      uint64_t coffset;
4832      uint8_t *buf, *out_buf;
4833      int offset_in_cluster = offset_into_cluster(s, offset);
4834  
4835      qcow2_parse_compressed_l2_entry(bs, l2_entry, &coffset, &csize);
4836  
4837      buf = g_try_malloc(csize);
4838      if (!buf) {
4839          return -ENOMEM;
4840      }
4841  
4842      out_buf = qemu_blockalign(bs, s->cluster_size);
4843  
4844      BLKDBG_CO_EVENT(bs->file, BLKDBG_READ_COMPRESSED);
4845      ret = bdrv_co_pread(bs->file, coffset, csize, buf, 0);
4846      if (ret < 0) {
4847          goto fail;
4848      }
4849  
4850      if (qcow2_co_decompress(bs, out_buf, s->cluster_size, buf, csize) < 0) {
4851          ret = -EIO;
4852          goto fail;
4853      }
4854  
4855      qemu_iovec_from_buf(qiov, qiov_offset, out_buf + offset_in_cluster, bytes);
4856  
4857  fail:
4858      qemu_vfree(out_buf);
4859      g_free(buf);
4860  
4861      return ret;
4862  }
4863  
4864  static int GRAPH_RDLOCK make_completely_empty(BlockDriverState *bs)
4865  {
4866      BDRVQcow2State *s = bs->opaque;
4867      Error *local_err = NULL;
4868      int ret, l1_clusters;
4869      int64_t offset;
4870      uint64_t *new_reftable = NULL;
4871      uint64_t rt_entry, l1_size2;
4872      struct {
4873          uint64_t l1_offset;
4874          uint64_t reftable_offset;
4875          uint32_t reftable_clusters;
4876      } QEMU_PACKED l1_ofs_rt_ofs_cls;
4877  
4878      ret = qcow2_cache_empty(bs, s->l2_table_cache);
4879      if (ret < 0) {
4880          goto fail;
4881      }
4882  
4883      ret = qcow2_cache_empty(bs, s->refcount_block_cache);
4884      if (ret < 0) {
4885          goto fail;
4886      }
4887  
4888      /* Refcounts will be broken utterly */
4889      ret = qcow2_mark_dirty(bs);
4890      if (ret < 0) {
4891          goto fail;
4892      }
4893  
4894      BLKDBG_EVENT(bs->file, BLKDBG_L1_UPDATE);
4895  
4896      l1_clusters = DIV_ROUND_UP(s->l1_size, s->cluster_size / L1E_SIZE);
4897      l1_size2 = (uint64_t)s->l1_size * L1E_SIZE;
4898  
4899      /* After this call, neither the in-memory nor the on-disk refcount
4900       * information accurately describe the actual references */
4901  
4902      ret = bdrv_pwrite_zeroes(bs->file, s->l1_table_offset,
4903                               l1_clusters * s->cluster_size, 0);
4904      if (ret < 0) {
4905          goto fail_broken_refcounts;
4906      }
4907      memset(s->l1_table, 0, l1_size2);
4908  
4909      BLKDBG_EVENT(bs->file, BLKDBG_EMPTY_IMAGE_PREPARE);
4910  
4911      /* Overwrite enough clusters at the beginning of the sectors to place
4912       * the refcount table, a refcount block and the L1 table in; this may
4913       * overwrite parts of the existing refcount and L1 table, which is not
4914       * an issue because the dirty flag is set, complete data loss is in fact
4915       * desired and partial data loss is consequently fine as well */
4916      ret = bdrv_pwrite_zeroes(bs->file, s->cluster_size,
4917                               (2 + l1_clusters) * s->cluster_size, 0);
4918      /* This call (even if it failed overall) may have overwritten on-disk
4919       * refcount structures; in that case, the in-memory refcount information
4920       * will probably differ from the on-disk information which makes the BDS
4921       * unusable */
4922      if (ret < 0) {
4923          goto fail_broken_refcounts;
4924      }
4925  
4926      BLKDBG_EVENT(bs->file, BLKDBG_L1_UPDATE);
4927      BLKDBG_EVENT(bs->file, BLKDBG_REFTABLE_UPDATE);
4928  
4929      /* "Create" an empty reftable (one cluster) directly after the image
4930       * header and an empty L1 table three clusters after the image header;
4931       * the cluster between those two will be used as the first refblock */
4932      l1_ofs_rt_ofs_cls.l1_offset = cpu_to_be64(3 * s->cluster_size);
4933      l1_ofs_rt_ofs_cls.reftable_offset = cpu_to_be64(s->cluster_size);
4934      l1_ofs_rt_ofs_cls.reftable_clusters = cpu_to_be32(1);
4935      ret = bdrv_pwrite_sync(bs->file, offsetof(QCowHeader, l1_table_offset),
4936                             sizeof(l1_ofs_rt_ofs_cls), &l1_ofs_rt_ofs_cls, 0);
4937      if (ret < 0) {
4938          goto fail_broken_refcounts;
4939      }
4940  
4941      s->l1_table_offset = 3 * s->cluster_size;
4942  
4943      new_reftable = g_try_new0(uint64_t, s->cluster_size / REFTABLE_ENTRY_SIZE);
4944      if (!new_reftable) {
4945          ret = -ENOMEM;
4946          goto fail_broken_refcounts;
4947      }
4948  
4949      s->refcount_table_offset = s->cluster_size;
4950      s->refcount_table_size   = s->cluster_size / REFTABLE_ENTRY_SIZE;
4951      s->max_refcount_table_index = 0;
4952  
4953      g_free(s->refcount_table);
4954      s->refcount_table = new_reftable;
4955      new_reftable = NULL;
4956  
4957      /* Now the in-memory refcount information again corresponds to the on-disk
4958       * information (reftable is empty and no refblocks (the refblock cache is
4959       * empty)); however, this means some clusters (e.g. the image header) are
4960       * referenced, but not refcounted, but the normal qcow2 code assumes that
4961       * the in-memory information is always correct */
4962  
4963      BLKDBG_EVENT(bs->file, BLKDBG_REFBLOCK_ALLOC);
4964  
4965      /* Enter the first refblock into the reftable */
4966      rt_entry = cpu_to_be64(2 * s->cluster_size);
4967      ret = bdrv_pwrite_sync(bs->file, s->cluster_size, sizeof(rt_entry),
4968                             &rt_entry, 0);
4969      if (ret < 0) {
4970          goto fail_broken_refcounts;
4971      }
4972      s->refcount_table[0] = 2 * s->cluster_size;
4973  
4974      s->free_cluster_index = 0;
4975      assert(3 + l1_clusters <= s->refcount_block_size);
4976      offset = qcow2_alloc_clusters(bs, 3 * s->cluster_size + l1_size2);
4977      if (offset < 0) {
4978          ret = offset;
4979          goto fail_broken_refcounts;
4980      } else if (offset > 0) {
4981          error_report("First cluster in emptied image is in use");
4982          abort();
4983      }
4984  
4985      /* Now finally the in-memory information corresponds to the on-disk
4986       * structures and is correct */
4987      ret = qcow2_mark_clean(bs);
4988      if (ret < 0) {
4989          goto fail;
4990      }
4991  
4992      ret = bdrv_truncate(bs->file, (3 + l1_clusters) * s->cluster_size, false,
4993                          PREALLOC_MODE_OFF, 0, &local_err);
4994      if (ret < 0) {
4995          error_report_err(local_err);
4996          goto fail;
4997      }
4998  
4999      return 0;
5000  
5001  fail_broken_refcounts:
5002      /* The BDS is unusable at this point. If we wanted to make it usable, we
5003       * would have to call qcow2_refcount_close(), qcow2_refcount_init(),
5004       * qcow2_check_refcounts(), qcow2_refcount_close() and qcow2_refcount_init()
5005       * again. However, because the functions which could have caused this error
5006       * path to be taken are used by those functions as well, it's very likely
5007       * that that sequence will fail as well. Therefore, just eject the BDS. */
5008      bs->drv = NULL;
5009  
5010  fail:
5011      g_free(new_reftable);
5012      return ret;
5013  }
5014  
5015  static int GRAPH_RDLOCK qcow2_make_empty(BlockDriverState *bs)
5016  {
5017      BDRVQcow2State *s = bs->opaque;
5018      uint64_t offset, end_offset;
5019      int step = QEMU_ALIGN_DOWN(INT_MAX, s->cluster_size);
5020      int l1_clusters, ret = 0;
5021  
5022      l1_clusters = DIV_ROUND_UP(s->l1_size, s->cluster_size / L1E_SIZE);
5023  
5024      if (s->qcow_version >= 3 && !s->snapshots && !s->nb_bitmaps &&
5025          3 + l1_clusters <= s->refcount_block_size &&
5026          s->crypt_method_header != QCOW_CRYPT_LUKS &&
5027          !has_data_file(bs)) {
5028          /* The following function only works for qcow2 v3 images (it
5029           * requires the dirty flag) and only as long as there are no
5030           * features that reserve extra clusters (such as snapshots,
5031           * LUKS header, or persistent bitmaps), because it completely
5032           * empties the image.  Furthermore, the L1 table and three
5033           * additional clusters (image header, refcount table, one
5034           * refcount block) have to fit inside one refcount block. It
5035           * only resets the image file, i.e. does not work with an
5036           * external data file. */
5037          return make_completely_empty(bs);
5038      }
5039  
5040      /* This fallback code simply discards every active cluster; this is slow,
5041       * but works in all cases */
5042      end_offset = bs->total_sectors * BDRV_SECTOR_SIZE;
5043      for (offset = 0; offset < end_offset; offset += step) {
5044          /* As this function is generally used after committing an external
5045           * snapshot, QCOW2_DISCARD_SNAPSHOT seems appropriate. Also, the
5046           * default action for this kind of discard is to pass the discard,
5047           * which will ideally result in an actually smaller image file, as
5048           * is probably desired. */
5049          ret = qcow2_cluster_discard(bs, offset, MIN(step, end_offset - offset),
5050                                      QCOW2_DISCARD_SNAPSHOT, true);
5051          if (ret < 0) {
5052              break;
5053          }
5054      }
5055  
5056      return ret;
5057  }
5058  
5059  static coroutine_fn GRAPH_RDLOCK int qcow2_co_flush_to_os(BlockDriverState *bs)
5060  {
5061      BDRVQcow2State *s = bs->opaque;
5062      int ret;
5063  
5064      qemu_co_mutex_lock(&s->lock);
5065      ret = qcow2_write_caches(bs);
5066      qemu_co_mutex_unlock(&s->lock);
5067  
5068      return ret;
5069  }
5070  
5071  static BlockMeasureInfo *qcow2_measure(QemuOpts *opts, BlockDriverState *in_bs,
5072                                         Error **errp)
5073  {
5074      Error *local_err = NULL;
5075      BlockMeasureInfo *info;
5076      uint64_t required = 0; /* bytes that contribute to required size */
5077      uint64_t virtual_size; /* disk size as seen by guest */
5078      uint64_t refcount_bits;
5079      uint64_t l2_tables;
5080      uint64_t luks_payload_size = 0;
5081      size_t cluster_size;
5082      int version;
5083      char *optstr;
5084      PreallocMode prealloc;
5085      bool has_backing_file;
5086      bool has_luks;
5087      bool extended_l2;
5088      size_t l2e_size;
5089  
5090      /* Parse image creation options */
5091      extended_l2 = qemu_opt_get_bool_del(opts, BLOCK_OPT_EXTL2, false);
5092  
5093      cluster_size = qcow2_opt_get_cluster_size_del(opts, extended_l2,
5094                                                    &local_err);
5095      if (local_err) {
5096          goto err;
5097      }
5098  
5099      version = qcow2_opt_get_version_del(opts, &local_err);
5100      if (local_err) {
5101          goto err;
5102      }
5103  
5104      refcount_bits = qcow2_opt_get_refcount_bits_del(opts, version, &local_err);
5105      if (local_err) {
5106          goto err;
5107      }
5108  
5109      optstr = qemu_opt_get_del(opts, BLOCK_OPT_PREALLOC);
5110      prealloc = qapi_enum_parse(&PreallocMode_lookup, optstr,
5111                                 PREALLOC_MODE_OFF, &local_err);
5112      g_free(optstr);
5113      if (local_err) {
5114          goto err;
5115      }
5116  
5117      optstr = qemu_opt_get_del(opts, BLOCK_OPT_BACKING_FILE);
5118      has_backing_file = !!optstr;
5119      g_free(optstr);
5120  
5121      optstr = qemu_opt_get_del(opts, BLOCK_OPT_ENCRYPT_FORMAT);
5122      has_luks = optstr && strcmp(optstr, "luks") == 0;
5123      g_free(optstr);
5124  
5125      if (has_luks) {
5126          g_autoptr(QCryptoBlockCreateOptions) create_opts = NULL;
5127          QDict *cryptoopts = qcow2_extract_crypto_opts(opts, "luks", errp);
5128          size_t headerlen;
5129  
5130          create_opts = block_crypto_create_opts_init(cryptoopts, errp);
5131          qobject_unref(cryptoopts);
5132          if (!create_opts) {
5133              goto err;
5134          }
5135  
5136          if (!qcrypto_block_calculate_payload_offset(create_opts,
5137                                                      "encrypt.",
5138                                                      &headerlen,
5139                                                      &local_err)) {
5140              goto err;
5141          }
5142  
5143          luks_payload_size = ROUND_UP(headerlen, cluster_size);
5144      }
5145  
5146      virtual_size = qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0);
5147      virtual_size = ROUND_UP(virtual_size, cluster_size);
5148  
5149      /* Check that virtual disk size is valid */
5150      l2e_size = extended_l2 ? L2E_SIZE_EXTENDED : L2E_SIZE_NORMAL;
5151      l2_tables = DIV_ROUND_UP(virtual_size / cluster_size,
5152                               cluster_size / l2e_size);
5153      if (l2_tables * L1E_SIZE > QCOW_MAX_L1_SIZE) {
5154          error_setg(&local_err, "The image size is too large "
5155                                 "(try using a larger cluster size)");
5156          goto err;
5157      }
5158  
5159      /* Account for input image */
5160      if (in_bs) {
5161          int64_t ssize = bdrv_getlength(in_bs);
5162          if (ssize < 0) {
5163              error_setg_errno(&local_err, -ssize,
5164                               "Unable to get image virtual_size");
5165              goto err;
5166          }
5167  
5168          virtual_size = ROUND_UP(ssize, cluster_size);
5169  
5170          if (has_backing_file) {
5171              /* We don't how much of the backing chain is shared by the input
5172               * image and the new image file.  In the worst case the new image's
5173               * backing file has nothing in common with the input image.  Be
5174               * conservative and assume all clusters need to be written.
5175               */
5176              required = virtual_size;
5177          } else {
5178              int64_t offset;
5179              int64_t pnum = 0;
5180  
5181              for (offset = 0; offset < ssize; offset += pnum) {
5182                  int ret;
5183  
5184                  ret = bdrv_block_status_above(in_bs, NULL, offset,
5185                                                ssize - offset, &pnum, NULL,
5186                                                NULL);
5187                  if (ret < 0) {
5188                      error_setg_errno(&local_err, -ret,
5189                                       "Unable to get block status");
5190                      goto err;
5191                  }
5192  
5193                  if (ret & BDRV_BLOCK_ZERO) {
5194                      /* Skip zero regions (safe with no backing file) */
5195                  } else if ((ret & (BDRV_BLOCK_DATA | BDRV_BLOCK_ALLOCATED)) ==
5196                             (BDRV_BLOCK_DATA | BDRV_BLOCK_ALLOCATED)) {
5197                      /* Extend pnum to end of cluster for next iteration */
5198                      pnum = ROUND_UP(offset + pnum, cluster_size) - offset;
5199  
5200                      /* Count clusters we've seen */
5201                      required += offset % cluster_size + pnum;
5202                  }
5203              }
5204          }
5205      }
5206  
5207      /* Take into account preallocation.  Nothing special is needed for
5208       * PREALLOC_MODE_METADATA since metadata is always counted.
5209       */
5210      if (prealloc == PREALLOC_MODE_FULL || prealloc == PREALLOC_MODE_FALLOC) {
5211          required = virtual_size;
5212      }
5213  
5214      info = g_new0(BlockMeasureInfo, 1);
5215      info->fully_allocated = luks_payload_size +
5216          qcow2_calc_prealloc_size(virtual_size, cluster_size,
5217                                   ctz32(refcount_bits), extended_l2);
5218  
5219      /*
5220       * Remove data clusters that are not required.  This overestimates the
5221       * required size because metadata needed for the fully allocated file is
5222       * still counted.  Show bitmaps only if both source and destination
5223       * would support them.
5224       */
5225      info->required = info->fully_allocated - virtual_size + required;
5226      info->has_bitmaps = version >= 3 && in_bs &&
5227          bdrv_supports_persistent_dirty_bitmap(in_bs);
5228      if (info->has_bitmaps) {
5229          info->bitmaps = qcow2_get_persistent_dirty_bitmap_size(in_bs,
5230                                                                 cluster_size);
5231      }
5232      return info;
5233  
5234  err:
5235      error_propagate(errp, local_err);
5236      return NULL;
5237  }
5238  
5239  static int coroutine_fn
5240  qcow2_co_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
5241  {
5242      BDRVQcow2State *s = bs->opaque;
5243      bdi->cluster_size = s->cluster_size;
5244      bdi->subcluster_size = s->subcluster_size;
5245      bdi->vm_state_offset = qcow2_vm_state_offset(s);
5246      bdi->is_dirty = s->incompatible_features & QCOW2_INCOMPAT_DIRTY;
5247      return 0;
5248  }
5249  
5250  static ImageInfoSpecific * GRAPH_RDLOCK
5251  qcow2_get_specific_info(BlockDriverState *bs, Error **errp)
5252  {
5253      BDRVQcow2State *s = bs->opaque;
5254      ImageInfoSpecific *spec_info;
5255      QCryptoBlockInfo *encrypt_info = NULL;
5256  
5257      if (s->crypto != NULL) {
5258          encrypt_info = qcrypto_block_get_info(s->crypto, errp);
5259          if (!encrypt_info) {
5260              return NULL;
5261          }
5262      }
5263  
5264      spec_info = g_new(ImageInfoSpecific, 1);
5265      *spec_info = (ImageInfoSpecific){
5266          .type  = IMAGE_INFO_SPECIFIC_KIND_QCOW2,
5267          .u.qcow2.data = g_new0(ImageInfoSpecificQCow2, 1),
5268      };
5269      if (s->qcow_version == 2) {
5270          *spec_info->u.qcow2.data = (ImageInfoSpecificQCow2){
5271              .compat             = g_strdup("0.10"),
5272              .refcount_bits      = s->refcount_bits,
5273          };
5274      } else if (s->qcow_version == 3) {
5275          Qcow2BitmapInfoList *bitmaps;
5276          if (!qcow2_get_bitmap_info_list(bs, &bitmaps, errp)) {
5277              qapi_free_ImageInfoSpecific(spec_info);
5278              qapi_free_QCryptoBlockInfo(encrypt_info);
5279              return NULL;
5280          }
5281          *spec_info->u.qcow2.data = (ImageInfoSpecificQCow2){
5282              .compat             = g_strdup("1.1"),
5283              .lazy_refcounts     = s->compatible_features &
5284                                    QCOW2_COMPAT_LAZY_REFCOUNTS,
5285              .has_lazy_refcounts = true,
5286              .corrupt            = s->incompatible_features &
5287                                    QCOW2_INCOMPAT_CORRUPT,
5288              .has_corrupt        = true,
5289              .has_extended_l2    = true,
5290              .extended_l2        = has_subclusters(s),
5291              .refcount_bits      = s->refcount_bits,
5292              .has_bitmaps        = !!bitmaps,
5293              .bitmaps            = bitmaps,
5294              .data_file          = g_strdup(s->image_data_file),
5295              .has_data_file_raw  = has_data_file(bs),
5296              .data_file_raw      = data_file_is_raw(bs),
5297              .compression_type   = s->compression_type,
5298          };
5299      } else {
5300          /* if this assertion fails, this probably means a new version was
5301           * added without having it covered here */
5302          g_assert_not_reached();
5303      }
5304  
5305      if (encrypt_info) {
5306          ImageInfoSpecificQCow2Encryption *qencrypt =
5307              g_new(ImageInfoSpecificQCow2Encryption, 1);
5308          switch (encrypt_info->format) {
5309          case QCRYPTO_BLOCK_FORMAT_QCOW:
5310              qencrypt->format = BLOCKDEV_QCOW2_ENCRYPTION_FORMAT_AES;
5311              break;
5312          case QCRYPTO_BLOCK_FORMAT_LUKS:
5313              qencrypt->format = BLOCKDEV_QCOW2_ENCRYPTION_FORMAT_LUKS;
5314              qencrypt->u.luks = encrypt_info->u.luks;
5315              break;
5316          default:
5317              abort();
5318          }
5319          /* Since we did shallow copy above, erase any pointers
5320           * in the original info */
5321          memset(&encrypt_info->u, 0, sizeof(encrypt_info->u));
5322          qapi_free_QCryptoBlockInfo(encrypt_info);
5323  
5324          spec_info->u.qcow2.data->encrypt = qencrypt;
5325      }
5326  
5327      return spec_info;
5328  }
5329  
5330  static int coroutine_mixed_fn GRAPH_RDLOCK
5331  qcow2_has_zero_init(BlockDriverState *bs)
5332  {
5333      BDRVQcow2State *s = bs->opaque;
5334      bool preallocated;
5335  
5336      if (qemu_in_coroutine()) {
5337          qemu_co_mutex_lock(&s->lock);
5338      }
5339      /*
5340       * Check preallocation status: Preallocated images have all L2
5341       * tables allocated, nonpreallocated images have none.  It is
5342       * therefore enough to check the first one.
5343       */
5344      preallocated = s->l1_size > 0 && s->l1_table[0] != 0;
5345      if (qemu_in_coroutine()) {
5346          qemu_co_mutex_unlock(&s->lock);
5347      }
5348  
5349      if (!preallocated) {
5350          return 1;
5351      } else if (bs->encrypted) {
5352          return 0;
5353      } else {
5354          return bdrv_has_zero_init(s->data_file->bs);
5355      }
5356  }
5357  
5358  /*
5359   * Check the request to vmstate. On success return
5360   *      qcow2_vm_state_offset(bs) + @pos
5361   */
5362  static int64_t qcow2_check_vmstate_request(BlockDriverState *bs,
5363                                             QEMUIOVector *qiov, int64_t pos)
5364  {
5365      BDRVQcow2State *s = bs->opaque;
5366      int64_t vmstate_offset = qcow2_vm_state_offset(s);
5367      int ret;
5368  
5369      /* Incoming requests must be OK */
5370      bdrv_check_qiov_request(pos, qiov->size, qiov, 0, &error_abort);
5371  
5372      if (INT64_MAX - pos < vmstate_offset) {
5373          return -EIO;
5374      }
5375  
5376      pos += vmstate_offset;
5377      ret = bdrv_check_qiov_request(pos, qiov->size, qiov, 0, NULL);
5378      if (ret < 0) {
5379          return ret;
5380      }
5381  
5382      return pos;
5383  }
5384  
5385  static int coroutine_fn GRAPH_RDLOCK
5386  qcow2_co_save_vmstate(BlockDriverState *bs, QEMUIOVector *qiov, int64_t pos)
5387  {
5388      int64_t offset = qcow2_check_vmstate_request(bs, qiov, pos);
5389      if (offset < 0) {
5390          return offset;
5391      }
5392  
5393      BLKDBG_CO_EVENT(bs->file, BLKDBG_VMSTATE_SAVE);
5394      return bs->drv->bdrv_co_pwritev_part(bs, offset, qiov->size, qiov, 0, 0);
5395  }
5396  
5397  static int coroutine_fn GRAPH_RDLOCK
5398  qcow2_co_load_vmstate(BlockDriverState *bs, QEMUIOVector *qiov, int64_t pos)
5399  {
5400      int64_t offset = qcow2_check_vmstate_request(bs, qiov, pos);
5401      if (offset < 0) {
5402          return offset;
5403      }
5404  
5405      BLKDBG_CO_EVENT(bs->file, BLKDBG_VMSTATE_LOAD);
5406      return bs->drv->bdrv_co_preadv_part(bs, offset, qiov->size, qiov, 0, 0);
5407  }
5408  
5409  static int GRAPH_RDLOCK qcow2_has_compressed_clusters(BlockDriverState *bs)
5410  {
5411      int64_t offset = 0;
5412      int64_t bytes = bdrv_getlength(bs);
5413  
5414      if (bytes < 0) {
5415          return bytes;
5416      }
5417  
5418      while (bytes != 0) {
5419          int ret;
5420          QCow2SubclusterType type;
5421          unsigned int cur_bytes = MIN(INT_MAX, bytes);
5422          uint64_t host_offset;
5423  
5424          ret = qcow2_get_host_offset(bs, offset, &cur_bytes, &host_offset,
5425                                      &type);
5426          if (ret < 0) {
5427              return ret;
5428          }
5429  
5430          if (type == QCOW2_SUBCLUSTER_COMPRESSED) {
5431              return 1;
5432          }
5433  
5434          offset += cur_bytes;
5435          bytes -= cur_bytes;
5436      }
5437  
5438      return 0;
5439  }
5440  
5441  /*
5442   * Downgrades an image's version. To achieve this, any incompatible features
5443   * have to be removed.
5444   */
5445  static int GRAPH_RDLOCK
5446  qcow2_downgrade(BlockDriverState *bs, int target_version,
5447                  BlockDriverAmendStatusCB *status_cb, void *cb_opaque,
5448                  Error **errp)
5449  {
5450      BDRVQcow2State *s = bs->opaque;
5451      int current_version = s->qcow_version;
5452      int ret;
5453      int i;
5454  
5455      /* This is qcow2_downgrade(), not qcow2_upgrade() */
5456      assert(target_version < current_version);
5457  
5458      /* There are no other versions (now) that you can downgrade to */
5459      assert(target_version == 2);
5460  
5461      if (s->refcount_order != 4) {
5462          error_setg(errp, "compat=0.10 requires refcount_bits=16");
5463          return -ENOTSUP;
5464      }
5465  
5466      if (has_data_file(bs)) {
5467          error_setg(errp, "Cannot downgrade an image with a data file");
5468          return -ENOTSUP;
5469      }
5470  
5471      /*
5472       * If any internal snapshot has a different size than the current
5473       * image size, or VM state size that exceeds 32 bits, downgrading
5474       * is unsafe.  Even though we would still use v3-compliant output
5475       * to preserve that data, other v2 programs might not realize
5476       * those optional fields are important.
5477       */
5478      for (i = 0; i < s->nb_snapshots; i++) {
5479          if (s->snapshots[i].vm_state_size > UINT32_MAX ||
5480              s->snapshots[i].disk_size != bs->total_sectors * BDRV_SECTOR_SIZE) {
5481              error_setg(errp, "Internal snapshots prevent downgrade of image");
5482              return -ENOTSUP;
5483          }
5484      }
5485  
5486      /* clear incompatible features */
5487      if (s->incompatible_features & QCOW2_INCOMPAT_DIRTY) {
5488          ret = qcow2_mark_clean(bs);
5489          if (ret < 0) {
5490              error_setg_errno(errp, -ret, "Failed to make the image clean");
5491              return ret;
5492          }
5493      }
5494  
5495      /* with QCOW2_INCOMPAT_CORRUPT, it is pretty much impossible to get here in
5496       * the first place; if that happens nonetheless, returning -ENOTSUP is the
5497       * best thing to do anyway */
5498  
5499      if (s->incompatible_features & ~QCOW2_INCOMPAT_COMPRESSION) {
5500          error_setg(errp, "Cannot downgrade an image with incompatible features "
5501                     "0x%" PRIx64 " set",
5502                     s->incompatible_features & ~QCOW2_INCOMPAT_COMPRESSION);
5503          return -ENOTSUP;
5504      }
5505  
5506      /* since we can ignore compatible features, we can set them to 0 as well */
5507      s->compatible_features = 0;
5508      /* if lazy refcounts have been used, they have already been fixed through
5509       * clearing the dirty flag */
5510  
5511      /* clearing autoclear features is trivial */
5512      s->autoclear_features = 0;
5513  
5514      ret = qcow2_expand_zero_clusters(bs, status_cb, cb_opaque);
5515      if (ret < 0) {
5516          error_setg_errno(errp, -ret, "Failed to turn zero into data clusters");
5517          return ret;
5518      }
5519  
5520      if (s->incompatible_features & QCOW2_INCOMPAT_COMPRESSION) {
5521          ret = qcow2_has_compressed_clusters(bs);
5522          if (ret < 0) {
5523              error_setg(errp, "Failed to check block status");
5524              return -EINVAL;
5525          }
5526          if (ret) {
5527              error_setg(errp, "Cannot downgrade an image with zstd compression "
5528                         "type and existing compressed clusters");
5529              return -ENOTSUP;
5530          }
5531          /*
5532           * No compressed clusters for now, so just chose default zlib
5533           * compression.
5534           */
5535          s->incompatible_features &= ~QCOW2_INCOMPAT_COMPRESSION;
5536          s->compression_type = QCOW2_COMPRESSION_TYPE_ZLIB;
5537      }
5538  
5539      assert(s->incompatible_features == 0);
5540  
5541      s->qcow_version = target_version;
5542      ret = qcow2_update_header(bs);
5543      if (ret < 0) {
5544          s->qcow_version = current_version;
5545          error_setg_errno(errp, -ret, "Failed to update the image header");
5546          return ret;
5547      }
5548      return 0;
5549  }
5550  
5551  /*
5552   * Upgrades an image's version.  While newer versions encompass all
5553   * features of older versions, some things may have to be presented
5554   * differently.
5555   */
5556  static int GRAPH_RDLOCK
5557  qcow2_upgrade(BlockDriverState *bs, int target_version,
5558                BlockDriverAmendStatusCB *status_cb, void *cb_opaque,
5559                Error **errp)
5560  {
5561      BDRVQcow2State *s = bs->opaque;
5562      bool need_snapshot_update;
5563      int current_version = s->qcow_version;
5564      int i;
5565      int ret;
5566  
5567      /* This is qcow2_upgrade(), not qcow2_downgrade() */
5568      assert(target_version > current_version);
5569  
5570      /* There are no other versions (yet) that you can upgrade to */
5571      assert(target_version == 3);
5572  
5573      status_cb(bs, 0, 2, cb_opaque);
5574  
5575      /*
5576       * In v2, snapshots do not need to have extra data.  v3 requires
5577       * the 64-bit VM state size and the virtual disk size to be
5578       * present.
5579       * qcow2_write_snapshots() will always write the list in the
5580       * v3-compliant format.
5581       */
5582      need_snapshot_update = false;
5583      for (i = 0; i < s->nb_snapshots; i++) {
5584          if (s->snapshots[i].extra_data_size <
5585              sizeof_field(QCowSnapshotExtraData, vm_state_size_large) +
5586              sizeof_field(QCowSnapshotExtraData, disk_size))
5587          {
5588              need_snapshot_update = true;
5589              break;
5590          }
5591      }
5592      if (need_snapshot_update) {
5593          ret = qcow2_write_snapshots(bs);
5594          if (ret < 0) {
5595              error_setg_errno(errp, -ret, "Failed to update the snapshot table");
5596              return ret;
5597          }
5598      }
5599      status_cb(bs, 1, 2, cb_opaque);
5600  
5601      s->qcow_version = target_version;
5602      ret = qcow2_update_header(bs);
5603      if (ret < 0) {
5604          s->qcow_version = current_version;
5605          error_setg_errno(errp, -ret, "Failed to update the image header");
5606          return ret;
5607      }
5608      status_cb(bs, 2, 2, cb_opaque);
5609  
5610      return 0;
5611  }
5612  
5613  typedef enum Qcow2AmendOperation {
5614      /* This is the value Qcow2AmendHelperCBInfo::last_operation will be
5615       * statically initialized to so that the helper CB can discern the first
5616       * invocation from an operation change */
5617      QCOW2_NO_OPERATION = 0,
5618  
5619      QCOW2_UPGRADING,
5620      QCOW2_UPDATING_ENCRYPTION,
5621      QCOW2_CHANGING_REFCOUNT_ORDER,
5622      QCOW2_DOWNGRADING,
5623  } Qcow2AmendOperation;
5624  
5625  typedef struct Qcow2AmendHelperCBInfo {
5626      /* The code coordinating the amend operations should only modify
5627       * these four fields; the rest will be managed by the CB */
5628      BlockDriverAmendStatusCB *original_status_cb;
5629      void *original_cb_opaque;
5630  
5631      Qcow2AmendOperation current_operation;
5632  
5633      /* Total number of operations to perform (only set once) */
5634      int total_operations;
5635  
5636      /* The following fields are managed by the CB */
5637  
5638      /* Number of operations completed */
5639      int operations_completed;
5640  
5641      /* Cumulative offset of all completed operations */
5642      int64_t offset_completed;
5643  
5644      Qcow2AmendOperation last_operation;
5645      int64_t last_work_size;
5646  } Qcow2AmendHelperCBInfo;
5647  
5648  static void qcow2_amend_helper_cb(BlockDriverState *bs,
5649                                    int64_t operation_offset,
5650                                    int64_t operation_work_size, void *opaque)
5651  {
5652      Qcow2AmendHelperCBInfo *info = opaque;
5653      int64_t current_work_size;
5654      int64_t projected_work_size;
5655  
5656      if (info->current_operation != info->last_operation) {
5657          if (info->last_operation != QCOW2_NO_OPERATION) {
5658              info->offset_completed += info->last_work_size;
5659              info->operations_completed++;
5660          }
5661  
5662          info->last_operation = info->current_operation;
5663      }
5664  
5665      assert(info->total_operations > 0);
5666      assert(info->operations_completed < info->total_operations);
5667  
5668      info->last_work_size = operation_work_size;
5669  
5670      current_work_size = info->offset_completed + operation_work_size;
5671  
5672      /* current_work_size is the total work size for (operations_completed + 1)
5673       * operations (which includes this one), so multiply it by the number of
5674       * operations not covered and divide it by the number of operations
5675       * covered to get a projection for the operations not covered */
5676      projected_work_size = current_work_size * (info->total_operations -
5677                                                 info->operations_completed - 1)
5678                                              / (info->operations_completed + 1);
5679  
5680      info->original_status_cb(bs, info->offset_completed + operation_offset,
5681                               current_work_size + projected_work_size,
5682                               info->original_cb_opaque);
5683  }
5684  
5685  static int GRAPH_RDLOCK
5686  qcow2_amend_options(BlockDriverState *bs, QemuOpts *opts,
5687                      BlockDriverAmendStatusCB *status_cb, void *cb_opaque,
5688                      bool force, Error **errp)
5689  {
5690      BDRVQcow2State *s = bs->opaque;
5691      int old_version = s->qcow_version, new_version = old_version;
5692      uint64_t new_size = 0;
5693      const char *backing_file = NULL, *backing_format = NULL, *data_file = NULL;
5694      bool lazy_refcounts = s->use_lazy_refcounts;
5695      bool data_file_raw = data_file_is_raw(bs);
5696      const char *compat = NULL;
5697      int refcount_bits = s->refcount_bits;
5698      int ret;
5699      QemuOptDesc *desc = opts->list->desc;
5700      Qcow2AmendHelperCBInfo helper_cb_info;
5701      bool encryption_update = false;
5702  
5703      while (desc && desc->name) {
5704          if (!qemu_opt_find(opts, desc->name)) {
5705              /* only change explicitly defined options */
5706              desc++;
5707              continue;
5708          }
5709  
5710          if (!strcmp(desc->name, BLOCK_OPT_COMPAT_LEVEL)) {
5711              compat = qemu_opt_get(opts, BLOCK_OPT_COMPAT_LEVEL);
5712              if (!compat) {
5713                  /* preserve default */
5714              } else if (!strcmp(compat, "0.10") || !strcmp(compat, "v2")) {
5715                  new_version = 2;
5716              } else if (!strcmp(compat, "1.1") || !strcmp(compat, "v3")) {
5717                  new_version = 3;
5718              } else {
5719                  error_setg(errp, "Unknown compatibility level %s", compat);
5720                  return -EINVAL;
5721              }
5722          } else if (!strcmp(desc->name, BLOCK_OPT_SIZE)) {
5723              new_size = qemu_opt_get_size(opts, BLOCK_OPT_SIZE, 0);
5724          } else if (!strcmp(desc->name, BLOCK_OPT_BACKING_FILE)) {
5725              backing_file = qemu_opt_get(opts, BLOCK_OPT_BACKING_FILE);
5726          } else if (!strcmp(desc->name, BLOCK_OPT_BACKING_FMT)) {
5727              backing_format = qemu_opt_get(opts, BLOCK_OPT_BACKING_FMT);
5728          } else if (g_str_has_prefix(desc->name, "encrypt.")) {
5729              if (!s->crypto) {
5730                  error_setg(errp,
5731                             "Can't amend encryption options - encryption not present");
5732                  return -EINVAL;
5733              }
5734              if (s->crypt_method_header != QCOW_CRYPT_LUKS) {
5735                  error_setg(errp,
5736                             "Only LUKS encryption options can be amended");
5737                  return -ENOTSUP;
5738              }
5739              encryption_update = true;
5740          } else if (!strcmp(desc->name, BLOCK_OPT_LAZY_REFCOUNTS)) {
5741              lazy_refcounts = qemu_opt_get_bool(opts, BLOCK_OPT_LAZY_REFCOUNTS,
5742                                                 lazy_refcounts);
5743          } else if (!strcmp(desc->name, BLOCK_OPT_REFCOUNT_BITS)) {
5744              refcount_bits = qemu_opt_get_number(opts, BLOCK_OPT_REFCOUNT_BITS,
5745                                                  refcount_bits);
5746  
5747              if (refcount_bits <= 0 || refcount_bits > 64 ||
5748                  !is_power_of_2(refcount_bits))
5749              {
5750                  error_setg(errp, "Refcount width must be a power of two and "
5751                             "may not exceed 64 bits");
5752                  return -EINVAL;
5753              }
5754          } else if (!strcmp(desc->name, BLOCK_OPT_DATA_FILE)) {
5755              data_file = qemu_opt_get(opts, BLOCK_OPT_DATA_FILE);
5756              if (data_file && !has_data_file(bs)) {
5757                  error_setg(errp, "data-file can only be set for images that "
5758                                   "use an external data file");
5759                  return -EINVAL;
5760              }
5761          } else if (!strcmp(desc->name, BLOCK_OPT_DATA_FILE_RAW)) {
5762              data_file_raw = qemu_opt_get_bool(opts, BLOCK_OPT_DATA_FILE_RAW,
5763                                                data_file_raw);
5764              if (data_file_raw && !data_file_is_raw(bs)) {
5765                  error_setg(errp, "data-file-raw cannot be set on existing "
5766                                   "images");
5767                  return -EINVAL;
5768              }
5769          } else {
5770              /* if this point is reached, this probably means a new option was
5771               * added without having it covered here */
5772              abort();
5773          }
5774  
5775          desc++;
5776      }
5777  
5778      helper_cb_info = (Qcow2AmendHelperCBInfo){
5779          .original_status_cb = status_cb,
5780          .original_cb_opaque = cb_opaque,
5781          .total_operations = (new_version != old_version)
5782                            + (s->refcount_bits != refcount_bits) +
5783                              (encryption_update == true)
5784      };
5785  
5786      /* Upgrade first (some features may require compat=1.1) */
5787      if (new_version > old_version) {
5788          helper_cb_info.current_operation = QCOW2_UPGRADING;
5789          ret = qcow2_upgrade(bs, new_version, &qcow2_amend_helper_cb,
5790                              &helper_cb_info, errp);
5791          if (ret < 0) {
5792              return ret;
5793          }
5794      }
5795  
5796      if (encryption_update) {
5797          QDict *amend_opts_dict;
5798          QCryptoBlockAmendOptions *amend_opts;
5799  
5800          helper_cb_info.current_operation = QCOW2_UPDATING_ENCRYPTION;
5801          amend_opts_dict = qcow2_extract_crypto_opts(opts, "luks", errp);
5802          if (!amend_opts_dict) {
5803              return -EINVAL;
5804          }
5805          amend_opts = block_crypto_amend_opts_init(amend_opts_dict, errp);
5806          qobject_unref(amend_opts_dict);
5807          if (!amend_opts) {
5808              return -EINVAL;
5809          }
5810          ret = qcrypto_block_amend_options(s->crypto,
5811                                            qcow2_crypto_hdr_read_func,
5812                                            qcow2_crypto_hdr_write_func,
5813                                            bs,
5814                                            amend_opts,
5815                                            force,
5816                                            errp);
5817          qapi_free_QCryptoBlockAmendOptions(amend_opts);
5818          if (ret < 0) {
5819              return ret;
5820          }
5821      }
5822  
5823      if (s->refcount_bits != refcount_bits) {
5824          int refcount_order = ctz32(refcount_bits);
5825  
5826          if (new_version < 3 && refcount_bits != 16) {
5827              error_setg(errp, "Refcount widths other than 16 bits require "
5828                         "compatibility level 1.1 or above (use compat=1.1 or "
5829                         "greater)");
5830              return -EINVAL;
5831          }
5832  
5833          helper_cb_info.current_operation = QCOW2_CHANGING_REFCOUNT_ORDER;
5834          ret = qcow2_change_refcount_order(bs, refcount_order,
5835                                            &qcow2_amend_helper_cb,
5836                                            &helper_cb_info, errp);
5837          if (ret < 0) {
5838              return ret;
5839          }
5840      }
5841  
5842      /* data-file-raw blocks backing files, so clear it first if requested */
5843      if (data_file_raw) {
5844          s->autoclear_features |= QCOW2_AUTOCLEAR_DATA_FILE_RAW;
5845      } else {
5846          s->autoclear_features &= ~QCOW2_AUTOCLEAR_DATA_FILE_RAW;
5847      }
5848  
5849      if (data_file) {
5850          g_free(s->image_data_file);
5851          s->image_data_file = *data_file ? g_strdup(data_file) : NULL;
5852      }
5853  
5854      ret = qcow2_update_header(bs);
5855      if (ret < 0) {
5856          error_setg_errno(errp, -ret, "Failed to update the image header");
5857          return ret;
5858      }
5859  
5860      if (backing_file || backing_format) {
5861          if (g_strcmp0(backing_file, s->image_backing_file) ||
5862              g_strcmp0(backing_format, s->image_backing_format)) {
5863              error_setg(errp, "Cannot amend the backing file");
5864              error_append_hint(errp,
5865                                "You can use 'qemu-img rebase' instead.\n");
5866              return -EINVAL;
5867          }
5868      }
5869  
5870      if (s->use_lazy_refcounts != lazy_refcounts) {
5871          if (lazy_refcounts) {
5872              if (new_version < 3) {
5873                  error_setg(errp, "Lazy refcounts only supported with "
5874                             "compatibility level 1.1 and above (use compat=1.1 "
5875                             "or greater)");
5876                  return -EINVAL;
5877              }
5878              s->compatible_features |= QCOW2_COMPAT_LAZY_REFCOUNTS;
5879              ret = qcow2_update_header(bs);
5880              if (ret < 0) {
5881                  s->compatible_features &= ~QCOW2_COMPAT_LAZY_REFCOUNTS;
5882                  error_setg_errno(errp, -ret, "Failed to update the image header");
5883                  return ret;
5884              }
5885              s->use_lazy_refcounts = true;
5886          } else {
5887              /* make image clean first */
5888              ret = qcow2_mark_clean(bs);
5889              if (ret < 0) {
5890                  error_setg_errno(errp, -ret, "Failed to make the image clean");
5891                  return ret;
5892              }
5893              /* now disallow lazy refcounts */
5894              s->compatible_features &= ~QCOW2_COMPAT_LAZY_REFCOUNTS;
5895              ret = qcow2_update_header(bs);
5896              if (ret < 0) {
5897                  s->compatible_features |= QCOW2_COMPAT_LAZY_REFCOUNTS;
5898                  error_setg_errno(errp, -ret, "Failed to update the image header");
5899                  return ret;
5900              }
5901              s->use_lazy_refcounts = false;
5902          }
5903      }
5904  
5905      if (new_size) {
5906          BlockBackend *blk = blk_new_with_bs(bs, BLK_PERM_RESIZE, BLK_PERM_ALL,
5907                                              errp);
5908          if (!blk) {
5909              return -EPERM;
5910          }
5911  
5912          /*
5913           * Amending image options should ensure that the image has
5914           * exactly the given new values, so pass exact=true here.
5915           */
5916          ret = blk_truncate(blk, new_size, true, PREALLOC_MODE_OFF, 0, errp);
5917          blk_unref(blk);
5918          if (ret < 0) {
5919              return ret;
5920          }
5921      }
5922  
5923      /* Downgrade last (so unsupported features can be removed before) */
5924      if (new_version < old_version) {
5925          helper_cb_info.current_operation = QCOW2_DOWNGRADING;
5926          ret = qcow2_downgrade(bs, new_version, &qcow2_amend_helper_cb,
5927                                &helper_cb_info, errp);
5928          if (ret < 0) {
5929              return ret;
5930          }
5931      }
5932  
5933      return 0;
5934  }
5935  
5936  static int coroutine_fn qcow2_co_amend(BlockDriverState *bs,
5937                                         BlockdevAmendOptions *opts,
5938                                         bool force,
5939                                         Error **errp)
5940  {
5941      BlockdevAmendOptionsQcow2 *qopts = &opts->u.qcow2;
5942      BDRVQcow2State *s = bs->opaque;
5943      int ret = 0;
5944  
5945      if (qopts->encrypt) {
5946          if (!s->crypto) {
5947              error_setg(errp, "image is not encrypted, can't amend");
5948              return -EOPNOTSUPP;
5949          }
5950  
5951          if (qopts->encrypt->format != QCRYPTO_BLOCK_FORMAT_LUKS) {
5952              error_setg(errp,
5953                         "Amend can't be used to change the qcow2 encryption format");
5954              return -EOPNOTSUPP;
5955          }
5956  
5957          if (s->crypt_method_header != QCOW_CRYPT_LUKS) {
5958              error_setg(errp,
5959                         "Only LUKS encryption options can be amended for qcow2 with blockdev-amend");
5960              return -EOPNOTSUPP;
5961          }
5962  
5963          ret = qcrypto_block_amend_options(s->crypto,
5964                                            qcow2_crypto_hdr_read_func,
5965                                            qcow2_crypto_hdr_write_func,
5966                                            bs,
5967                                            qopts->encrypt,
5968                                            force,
5969                                            errp);
5970      }
5971      return ret;
5972  }
5973  
5974  /*
5975   * If offset or size are negative, respectively, they will not be included in
5976   * the BLOCK_IMAGE_CORRUPTED event emitted.
5977   * fatal will be ignored for read-only BDS; corruptions found there will always
5978   * be considered non-fatal.
5979   */
5980  void qcow2_signal_corruption(BlockDriverState *bs, bool fatal, int64_t offset,
5981                               int64_t size, const char *message_format, ...)
5982  {
5983      BDRVQcow2State *s = bs->opaque;
5984      const char *node_name;
5985      char *message;
5986      va_list ap;
5987  
5988      fatal = fatal && bdrv_is_writable(bs);
5989  
5990      if (s->signaled_corruption &&
5991          (!fatal || (s->incompatible_features & QCOW2_INCOMPAT_CORRUPT)))
5992      {
5993          return;
5994      }
5995  
5996      va_start(ap, message_format);
5997      message = g_strdup_vprintf(message_format, ap);
5998      va_end(ap);
5999  
6000      if (fatal) {
6001          fprintf(stderr, "qcow2: Marking image as corrupt: %s; further "
6002                  "corruption events will be suppressed\n", message);
6003      } else {
6004          fprintf(stderr, "qcow2: Image is corrupt: %s; further non-fatal "
6005                  "corruption events will be suppressed\n", message);
6006      }
6007  
6008      node_name = bdrv_get_node_name(bs);
6009      qapi_event_send_block_image_corrupted(bdrv_get_device_name(bs),
6010                                            *node_name ? node_name : NULL,
6011                                            message, offset >= 0, offset,
6012                                            size >= 0, size,
6013                                            fatal);
6014      g_free(message);
6015  
6016      if (fatal) {
6017          qcow2_mark_corrupt(bs);
6018          bs->drv = NULL; /* make BDS unusable */
6019      }
6020  
6021      s->signaled_corruption = true;
6022  }
6023  
6024  #define QCOW_COMMON_OPTIONS                                         \
6025      {                                                               \
6026          .name = BLOCK_OPT_SIZE,                                     \
6027          .type = QEMU_OPT_SIZE,                                      \
6028          .help = "Virtual disk size"                                 \
6029      },                                                              \
6030      {                                                               \
6031          .name = BLOCK_OPT_COMPAT_LEVEL,                             \
6032          .type = QEMU_OPT_STRING,                                    \
6033          .help = "Compatibility level (v2 [0.10] or v3 [1.1])"       \
6034      },                                                              \
6035      {                                                               \
6036          .name = BLOCK_OPT_BACKING_FILE,                             \
6037          .type = QEMU_OPT_STRING,                                    \
6038          .help = "File name of a base image"                         \
6039      },                                                              \
6040      {                                                               \
6041          .name = BLOCK_OPT_BACKING_FMT,                              \
6042          .type = QEMU_OPT_STRING,                                    \
6043          .help = "Image format of the base image"                    \
6044      },                                                              \
6045      {                                                               \
6046          .name = BLOCK_OPT_DATA_FILE,                                \
6047          .type = QEMU_OPT_STRING,                                    \
6048          .help = "File name of an external data file"                \
6049      },                                                              \
6050      {                                                               \
6051          .name = BLOCK_OPT_DATA_FILE_RAW,                            \
6052          .type = QEMU_OPT_BOOL,                                      \
6053          .help = "The external data file must stay valid "           \
6054                  "as a raw image"                                    \
6055      },                                                              \
6056      {                                                               \
6057          .name = BLOCK_OPT_LAZY_REFCOUNTS,                           \
6058          .type = QEMU_OPT_BOOL,                                      \
6059          .help = "Postpone refcount updates",                        \
6060          .def_value_str = "off"                                      \
6061      },                                                              \
6062      {                                                               \
6063          .name = BLOCK_OPT_REFCOUNT_BITS,                            \
6064          .type = QEMU_OPT_NUMBER,                                    \
6065          .help = "Width of a reference count entry in bits",         \
6066          .def_value_str = "16"                                       \
6067      }
6068  
6069  static QemuOptsList qcow2_create_opts = {
6070      .name = "qcow2-create-opts",
6071      .head = QTAILQ_HEAD_INITIALIZER(qcow2_create_opts.head),
6072      .desc = {
6073          {                                                               \
6074              .name = BLOCK_OPT_ENCRYPT,                                  \
6075              .type = QEMU_OPT_BOOL,                                      \
6076              .help = "Encrypt the image with format 'aes'. (Deprecated " \
6077                      "in favor of " BLOCK_OPT_ENCRYPT_FORMAT "=aes)",    \
6078          },                                                              \
6079          {                                                               \
6080              .name = BLOCK_OPT_ENCRYPT_FORMAT,                           \
6081              .type = QEMU_OPT_STRING,                                    \
6082              .help = "Encrypt the image, format choices: 'aes', 'luks'", \
6083          },                                                              \
6084          BLOCK_CRYPTO_OPT_DEF_KEY_SECRET("encrypt.",                     \
6085              "ID of secret providing qcow AES key or LUKS passphrase"),  \
6086          BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_ALG("encrypt."),               \
6087          BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_MODE("encrypt."),              \
6088          BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_ALG("encrypt."),                \
6089          BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_HASH_ALG("encrypt."),           \
6090          BLOCK_CRYPTO_OPT_DEF_LUKS_HASH_ALG("encrypt."),                 \
6091          BLOCK_CRYPTO_OPT_DEF_LUKS_ITER_TIME("encrypt."),                \
6092          {                                                               \
6093              .name = BLOCK_OPT_CLUSTER_SIZE,                             \
6094              .type = QEMU_OPT_SIZE,                                      \
6095              .help = "qcow2 cluster size",                               \
6096              .def_value_str = stringify(DEFAULT_CLUSTER_SIZE)            \
6097          },                                                              \
6098          {                                                               \
6099              .name = BLOCK_OPT_EXTL2,                                    \
6100              .type = QEMU_OPT_BOOL,                                      \
6101              .help = "Extended L2 tables",                               \
6102              .def_value_str = "off"                                      \
6103          },                                                              \
6104          {                                                               \
6105              .name = BLOCK_OPT_PREALLOC,                                 \
6106              .type = QEMU_OPT_STRING,                                    \
6107              .help = "Preallocation mode (allowed values: off, "         \
6108                      "metadata, falloc, full)"                           \
6109          },                                                              \
6110          {                                                               \
6111              .name = BLOCK_OPT_COMPRESSION_TYPE,                         \
6112              .type = QEMU_OPT_STRING,                                    \
6113              .help = "Compression method used for image cluster "        \
6114                      "compression",                                      \
6115              .def_value_str = "zlib"                                     \
6116          },
6117          QCOW_COMMON_OPTIONS,
6118          { /* end of list */ }
6119      }
6120  };
6121  
6122  static QemuOptsList qcow2_amend_opts = {
6123      .name = "qcow2-amend-opts",
6124      .head = QTAILQ_HEAD_INITIALIZER(qcow2_amend_opts.head),
6125      .desc = {
6126          BLOCK_CRYPTO_OPT_DEF_LUKS_STATE("encrypt."),
6127          BLOCK_CRYPTO_OPT_DEF_LUKS_KEYSLOT("encrypt."),
6128          BLOCK_CRYPTO_OPT_DEF_LUKS_OLD_SECRET("encrypt."),
6129          BLOCK_CRYPTO_OPT_DEF_LUKS_NEW_SECRET("encrypt."),
6130          BLOCK_CRYPTO_OPT_DEF_LUKS_ITER_TIME("encrypt."),
6131          QCOW_COMMON_OPTIONS,
6132          { /* end of list */ }
6133      }
6134  };
6135  
6136  static const char *const qcow2_strong_runtime_opts[] = {
6137      "encrypt." BLOCK_CRYPTO_OPT_QCOW_KEY_SECRET,
6138  
6139      NULL
6140  };
6141  
6142  BlockDriver bdrv_qcow2 = {
6143      .format_name                        = "qcow2",
6144      .instance_size                      = sizeof(BDRVQcow2State),
6145      .bdrv_probe                         = qcow2_probe,
6146      .bdrv_open                          = qcow2_open,
6147      .bdrv_close                         = qcow2_close,
6148      .bdrv_reopen_prepare                = qcow2_reopen_prepare,
6149      .bdrv_reopen_commit                 = qcow2_reopen_commit,
6150      .bdrv_reopen_commit_post            = qcow2_reopen_commit_post,
6151      .bdrv_reopen_abort                  = qcow2_reopen_abort,
6152      .bdrv_join_options                  = qcow2_join_options,
6153      .bdrv_child_perm                    = bdrv_default_perms,
6154      .bdrv_co_create_opts                = qcow2_co_create_opts,
6155      .bdrv_co_create                     = qcow2_co_create,
6156      .bdrv_has_zero_init                 = qcow2_has_zero_init,
6157      .bdrv_co_block_status               = qcow2_co_block_status,
6158  
6159      .bdrv_co_preadv_part                = qcow2_co_preadv_part,
6160      .bdrv_co_pwritev_part               = qcow2_co_pwritev_part,
6161      .bdrv_co_flush_to_os                = qcow2_co_flush_to_os,
6162  
6163      .bdrv_co_pwrite_zeroes              = qcow2_co_pwrite_zeroes,
6164      .bdrv_co_pdiscard                   = qcow2_co_pdiscard,
6165      .bdrv_co_copy_range_from            = qcow2_co_copy_range_from,
6166      .bdrv_co_copy_range_to              = qcow2_co_copy_range_to,
6167      .bdrv_co_truncate                   = qcow2_co_truncate,
6168      .bdrv_co_pwritev_compressed_part    = qcow2_co_pwritev_compressed_part,
6169      .bdrv_make_empty                    = qcow2_make_empty,
6170  
6171      .bdrv_snapshot_create               = qcow2_snapshot_create,
6172      .bdrv_snapshot_goto                 = qcow2_snapshot_goto,
6173      .bdrv_snapshot_delete               = qcow2_snapshot_delete,
6174      .bdrv_snapshot_list                 = qcow2_snapshot_list,
6175      .bdrv_snapshot_load_tmp             = qcow2_snapshot_load_tmp,
6176      .bdrv_measure                       = qcow2_measure,
6177      .bdrv_co_get_info                   = qcow2_co_get_info,
6178      .bdrv_get_specific_info             = qcow2_get_specific_info,
6179  
6180      .bdrv_co_save_vmstate               = qcow2_co_save_vmstate,
6181      .bdrv_co_load_vmstate               = qcow2_co_load_vmstate,
6182  
6183      .is_format                          = true,
6184      .supports_backing                   = true,
6185      .bdrv_co_change_backing_file        = qcow2_co_change_backing_file,
6186  
6187      .bdrv_refresh_limits                = qcow2_refresh_limits,
6188      .bdrv_co_invalidate_cache           = qcow2_co_invalidate_cache,
6189      .bdrv_inactivate                    = qcow2_inactivate,
6190  
6191      .create_opts                        = &qcow2_create_opts,
6192      .amend_opts                         = &qcow2_amend_opts,
6193      .strong_runtime_opts                = qcow2_strong_runtime_opts,
6194      .mutable_opts                       = mutable_opts,
6195      .bdrv_co_check                      = qcow2_co_check,
6196      .bdrv_amend_options                 = qcow2_amend_options,
6197      .bdrv_co_amend                      = qcow2_co_amend,
6198  
6199      .bdrv_detach_aio_context            = qcow2_detach_aio_context,
6200      .bdrv_attach_aio_context            = qcow2_attach_aio_context,
6201  
6202      .bdrv_supports_persistent_dirty_bitmap =
6203              qcow2_supports_persistent_dirty_bitmap,
6204      .bdrv_co_can_store_new_dirty_bitmap = qcow2_co_can_store_new_dirty_bitmap,
6205      .bdrv_co_remove_persistent_dirty_bitmap =
6206              qcow2_co_remove_persistent_dirty_bitmap,
6207  };
6208  
6209  static void bdrv_qcow2_init(void)
6210  {
6211      bdrv_register(&bdrv_qcow2);
6212  }
6213  
6214  block_init(bdrv_qcow2_init);
6215