xref: /openbmc/qemu/block/qcow2.c (revision 38dc1294)
1 /*
2  * Block driver for the QCOW version 2 format
3  *
4  * Copyright (c) 2004-2006 Fabrice Bellard
5  *
6  * Permission is hereby granted, free of charge, to any person obtaining a copy
7  * of this software and associated documentation files (the "Software"), to deal
8  * in the Software without restriction, including without limitation the rights
9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10  * copies of the Software, and to permit persons to whom the Software is
11  * furnished to do so, subject to the following conditions:
12  *
13  * The above copyright notice and this permission notice shall be included in
14  * all copies or substantial portions of the Software.
15  *
16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22  * THE SOFTWARE.
23  */
24 
25 #include "qemu/osdep.h"
26 
27 #define ZLIB_CONST
28 #include <zlib.h>
29 
30 #include "block/block_int.h"
31 #include "block/qdict.h"
32 #include "sysemu/block-backend.h"
33 #include "qemu/module.h"
34 #include "qcow2.h"
35 #include "qemu/error-report.h"
36 #include "qapi/error.h"
37 #include "qapi/qapi-events-block-core.h"
38 #include "qapi/qmp/qdict.h"
39 #include "qapi/qmp/qstring.h"
40 #include "trace.h"
41 #include "qemu/option_int.h"
42 #include "qemu/cutils.h"
43 #include "qemu/bswap.h"
44 #include "qapi/qobject-input-visitor.h"
45 #include "qapi/qapi-visit-block-core.h"
46 #include "crypto.h"
47 #include "block/thread-pool.h"
48 
49 /*
50   Differences with QCOW:
51 
52   - Support for multiple incremental snapshots.
53   - Memory management by reference counts.
54   - Clusters which have a reference count of one have the bit
55     QCOW_OFLAG_COPIED to optimize write performance.
56   - Size of compressed clusters is stored in sectors to reduce bit usage
57     in the cluster offsets.
58   - Support for storing additional data (such as the VM state) in the
59     snapshots.
60   - If a backing store is used, the cluster size is not constrained
61     (could be backported to QCOW).
62   - L2 tables have always a size of one cluster.
63 */
64 
65 
66 typedef struct {
67     uint32_t magic;
68     uint32_t len;
69 } QEMU_PACKED QCowExtension;
70 
71 #define  QCOW2_EXT_MAGIC_END 0
72 #define  QCOW2_EXT_MAGIC_BACKING_FORMAT 0xE2792ACA
73 #define  QCOW2_EXT_MAGIC_FEATURE_TABLE 0x6803f857
74 #define  QCOW2_EXT_MAGIC_CRYPTO_HEADER 0x0537be77
75 #define  QCOW2_EXT_MAGIC_BITMAPS 0x23852875
76 #define  QCOW2_EXT_MAGIC_DATA_FILE 0x44415441
77 
78 static int coroutine_fn
79 qcow2_co_preadv_compressed(BlockDriverState *bs,
80                            uint64_t file_cluster_offset,
81                            uint64_t offset,
82                            uint64_t bytes,
83                            QEMUIOVector *qiov);
84 
85 static int qcow2_probe(const uint8_t *buf, int buf_size, const char *filename)
86 {
87     const QCowHeader *cow_header = (const void *)buf;
88 
89     if (buf_size >= sizeof(QCowHeader) &&
90         be32_to_cpu(cow_header->magic) == QCOW_MAGIC &&
91         be32_to_cpu(cow_header->version) >= 2)
92         return 100;
93     else
94         return 0;
95 }
96 
97 
98 static ssize_t qcow2_crypto_hdr_read_func(QCryptoBlock *block, size_t offset,
99                                           uint8_t *buf, size_t buflen,
100                                           void *opaque, Error **errp)
101 {
102     BlockDriverState *bs = opaque;
103     BDRVQcow2State *s = bs->opaque;
104     ssize_t ret;
105 
106     if ((offset + buflen) > s->crypto_header.length) {
107         error_setg(errp, "Request for data outside of extension header");
108         return -1;
109     }
110 
111     ret = bdrv_pread(bs->file,
112                      s->crypto_header.offset + offset, buf, buflen);
113     if (ret < 0) {
114         error_setg_errno(errp, -ret, "Could not read encryption header");
115         return -1;
116     }
117     return ret;
118 }
119 
120 
121 static ssize_t qcow2_crypto_hdr_init_func(QCryptoBlock *block, size_t headerlen,
122                                           void *opaque, Error **errp)
123 {
124     BlockDriverState *bs = opaque;
125     BDRVQcow2State *s = bs->opaque;
126     int64_t ret;
127     int64_t clusterlen;
128 
129     ret = qcow2_alloc_clusters(bs, headerlen);
130     if (ret < 0) {
131         error_setg_errno(errp, -ret,
132                          "Cannot allocate cluster for LUKS header size %zu",
133                          headerlen);
134         return -1;
135     }
136 
137     s->crypto_header.length = headerlen;
138     s->crypto_header.offset = ret;
139 
140     /* Zero fill remaining space in cluster so it has predictable
141      * content in case of future spec changes */
142     clusterlen = size_to_clusters(s, headerlen) * s->cluster_size;
143     assert(qcow2_pre_write_overlap_check(bs, 0, ret, clusterlen, false) == 0);
144     ret = bdrv_pwrite_zeroes(bs->file,
145                              ret + headerlen,
146                              clusterlen - headerlen, 0);
147     if (ret < 0) {
148         error_setg_errno(errp, -ret, "Could not zero fill encryption header");
149         return -1;
150     }
151 
152     return ret;
153 }
154 
155 
156 static ssize_t qcow2_crypto_hdr_write_func(QCryptoBlock *block, size_t offset,
157                                            const uint8_t *buf, size_t buflen,
158                                            void *opaque, Error **errp)
159 {
160     BlockDriverState *bs = opaque;
161     BDRVQcow2State *s = bs->opaque;
162     ssize_t ret;
163 
164     if ((offset + buflen) > s->crypto_header.length) {
165         error_setg(errp, "Request for data outside of extension header");
166         return -1;
167     }
168 
169     ret = bdrv_pwrite(bs->file,
170                       s->crypto_header.offset + offset, buf, buflen);
171     if (ret < 0) {
172         error_setg_errno(errp, -ret, "Could not read encryption header");
173         return -1;
174     }
175     return ret;
176 }
177 
178 
179 /*
180  * read qcow2 extension and fill bs
181  * start reading from start_offset
182  * finish reading upon magic of value 0 or when end_offset reached
183  * unknown magic is skipped (future extension this version knows nothing about)
184  * return 0 upon success, non-0 otherwise
185  */
186 static int qcow2_read_extensions(BlockDriverState *bs, uint64_t start_offset,
187                                  uint64_t end_offset, void **p_feature_table,
188                                  int flags, bool *need_update_header,
189                                  Error **errp)
190 {
191     BDRVQcow2State *s = bs->opaque;
192     QCowExtension ext;
193     uint64_t offset;
194     int ret;
195     Qcow2BitmapHeaderExt bitmaps_ext;
196 
197     if (need_update_header != NULL) {
198         *need_update_header = false;
199     }
200 
201 #ifdef DEBUG_EXT
202     printf("qcow2_read_extensions: start=%ld end=%ld\n", start_offset, end_offset);
203 #endif
204     offset = start_offset;
205     while (offset < end_offset) {
206 
207 #ifdef DEBUG_EXT
208         /* Sanity check */
209         if (offset > s->cluster_size)
210             printf("qcow2_read_extension: suspicious offset %lu\n", offset);
211 
212         printf("attempting to read extended header in offset %lu\n", offset);
213 #endif
214 
215         ret = bdrv_pread(bs->file, offset, &ext, sizeof(ext));
216         if (ret < 0) {
217             error_setg_errno(errp, -ret, "qcow2_read_extension: ERROR: "
218                              "pread fail from offset %" PRIu64, offset);
219             return 1;
220         }
221         ext.magic = be32_to_cpu(ext.magic);
222         ext.len = be32_to_cpu(ext.len);
223         offset += sizeof(ext);
224 #ifdef DEBUG_EXT
225         printf("ext.magic = 0x%x\n", ext.magic);
226 #endif
227         if (offset > end_offset || ext.len > end_offset - offset) {
228             error_setg(errp, "Header extension too large");
229             return -EINVAL;
230         }
231 
232         switch (ext.magic) {
233         case QCOW2_EXT_MAGIC_END:
234             return 0;
235 
236         case QCOW2_EXT_MAGIC_BACKING_FORMAT:
237             if (ext.len >= sizeof(bs->backing_format)) {
238                 error_setg(errp, "ERROR: ext_backing_format: len=%" PRIu32
239                            " too large (>=%zu)", ext.len,
240                            sizeof(bs->backing_format));
241                 return 2;
242             }
243             ret = bdrv_pread(bs->file, offset, bs->backing_format, ext.len);
244             if (ret < 0) {
245                 error_setg_errno(errp, -ret, "ERROR: ext_backing_format: "
246                                  "Could not read format name");
247                 return 3;
248             }
249             bs->backing_format[ext.len] = '\0';
250             s->image_backing_format = g_strdup(bs->backing_format);
251 #ifdef DEBUG_EXT
252             printf("Qcow2: Got format extension %s\n", bs->backing_format);
253 #endif
254             break;
255 
256         case QCOW2_EXT_MAGIC_FEATURE_TABLE:
257             if (p_feature_table != NULL) {
258                 void* feature_table = g_malloc0(ext.len + 2 * sizeof(Qcow2Feature));
259                 ret = bdrv_pread(bs->file, offset , feature_table, ext.len);
260                 if (ret < 0) {
261                     error_setg_errno(errp, -ret, "ERROR: ext_feature_table: "
262                                      "Could not read table");
263                     return ret;
264                 }
265 
266                 *p_feature_table = feature_table;
267             }
268             break;
269 
270         case QCOW2_EXT_MAGIC_CRYPTO_HEADER: {
271             unsigned int cflags = 0;
272             if (s->crypt_method_header != QCOW_CRYPT_LUKS) {
273                 error_setg(errp, "CRYPTO header extension only "
274                            "expected with LUKS encryption method");
275                 return -EINVAL;
276             }
277             if (ext.len != sizeof(Qcow2CryptoHeaderExtension)) {
278                 error_setg(errp, "CRYPTO header extension size %u, "
279                            "but expected size %zu", ext.len,
280                            sizeof(Qcow2CryptoHeaderExtension));
281                 return -EINVAL;
282             }
283 
284             ret = bdrv_pread(bs->file, offset, &s->crypto_header, ext.len);
285             if (ret < 0) {
286                 error_setg_errno(errp, -ret,
287                                  "Unable to read CRYPTO header extension");
288                 return ret;
289             }
290             s->crypto_header.offset = be64_to_cpu(s->crypto_header.offset);
291             s->crypto_header.length = be64_to_cpu(s->crypto_header.length);
292 
293             if ((s->crypto_header.offset % s->cluster_size) != 0) {
294                 error_setg(errp, "Encryption header offset '%" PRIu64 "' is "
295                            "not a multiple of cluster size '%u'",
296                            s->crypto_header.offset, s->cluster_size);
297                 return -EINVAL;
298             }
299 
300             if (flags & BDRV_O_NO_IO) {
301                 cflags |= QCRYPTO_BLOCK_OPEN_NO_IO;
302             }
303             s->crypto = qcrypto_block_open(s->crypto_opts, "encrypt.",
304                                            qcow2_crypto_hdr_read_func,
305                                            bs, cflags, 1, errp);
306             if (!s->crypto) {
307                 return -EINVAL;
308             }
309         }   break;
310 
311         case QCOW2_EXT_MAGIC_BITMAPS:
312             if (ext.len != sizeof(bitmaps_ext)) {
313                 error_setg_errno(errp, -ret, "bitmaps_ext: "
314                                  "Invalid extension length");
315                 return -EINVAL;
316             }
317 
318             if (!(s->autoclear_features & QCOW2_AUTOCLEAR_BITMAPS)) {
319                 if (s->qcow_version < 3) {
320                     /* Let's be a bit more specific */
321                     warn_report("This qcow2 v2 image contains bitmaps, but "
322                                 "they may have been modified by a program "
323                                 "without persistent bitmap support; so now "
324                                 "they must all be considered inconsistent");
325                 } else {
326                     warn_report("a program lacking bitmap support "
327                                 "modified this file, so all bitmaps are now "
328                                 "considered inconsistent");
329                 }
330                 error_printf("Some clusters may be leaked, "
331                              "run 'qemu-img check -r' on the image "
332                              "file to fix.");
333                 if (need_update_header != NULL) {
334                     /* Updating is needed to drop invalid bitmap extension. */
335                     *need_update_header = true;
336                 }
337                 break;
338             }
339 
340             ret = bdrv_pread(bs->file, offset, &bitmaps_ext, ext.len);
341             if (ret < 0) {
342                 error_setg_errno(errp, -ret, "bitmaps_ext: "
343                                  "Could not read ext header");
344                 return ret;
345             }
346 
347             if (bitmaps_ext.reserved32 != 0) {
348                 error_setg_errno(errp, -ret, "bitmaps_ext: "
349                                  "Reserved field is not zero");
350                 return -EINVAL;
351             }
352 
353             bitmaps_ext.nb_bitmaps = be32_to_cpu(bitmaps_ext.nb_bitmaps);
354             bitmaps_ext.bitmap_directory_size =
355                 be64_to_cpu(bitmaps_ext.bitmap_directory_size);
356             bitmaps_ext.bitmap_directory_offset =
357                 be64_to_cpu(bitmaps_ext.bitmap_directory_offset);
358 
359             if (bitmaps_ext.nb_bitmaps > QCOW2_MAX_BITMAPS) {
360                 error_setg(errp,
361                            "bitmaps_ext: Image has %" PRIu32 " bitmaps, "
362                            "exceeding the QEMU supported maximum of %d",
363                            bitmaps_ext.nb_bitmaps, QCOW2_MAX_BITMAPS);
364                 return -EINVAL;
365             }
366 
367             if (bitmaps_ext.nb_bitmaps == 0) {
368                 error_setg(errp, "found bitmaps extension with zero bitmaps");
369                 return -EINVAL;
370             }
371 
372             if (bitmaps_ext.bitmap_directory_offset & (s->cluster_size - 1)) {
373                 error_setg(errp, "bitmaps_ext: "
374                                  "invalid bitmap directory offset");
375                 return -EINVAL;
376             }
377 
378             if (bitmaps_ext.bitmap_directory_size >
379                 QCOW2_MAX_BITMAP_DIRECTORY_SIZE) {
380                 error_setg(errp, "bitmaps_ext: "
381                                  "bitmap directory size (%" PRIu64 ") exceeds "
382                                  "the maximum supported size (%d)",
383                                  bitmaps_ext.bitmap_directory_size,
384                                  QCOW2_MAX_BITMAP_DIRECTORY_SIZE);
385                 return -EINVAL;
386             }
387 
388             s->nb_bitmaps = bitmaps_ext.nb_bitmaps;
389             s->bitmap_directory_offset =
390                     bitmaps_ext.bitmap_directory_offset;
391             s->bitmap_directory_size =
392                     bitmaps_ext.bitmap_directory_size;
393 
394 #ifdef DEBUG_EXT
395             printf("Qcow2: Got bitmaps extension: "
396                    "offset=%" PRIu64 " nb_bitmaps=%" PRIu32 "\n",
397                    s->bitmap_directory_offset, s->nb_bitmaps);
398 #endif
399             break;
400 
401         case QCOW2_EXT_MAGIC_DATA_FILE:
402         {
403             s->image_data_file = g_malloc0(ext.len + 1);
404             ret = bdrv_pread(bs->file, offset, s->image_data_file, ext.len);
405             if (ret < 0) {
406                 error_setg_errno(errp, -ret,
407                                  "ERROR: Could not read data file name");
408                 return ret;
409             }
410 #ifdef DEBUG_EXT
411             printf("Qcow2: Got external data file %s\n", s->image_data_file);
412 #endif
413             break;
414         }
415 
416         default:
417             /* unknown magic - save it in case we need to rewrite the header */
418             /* If you add a new feature, make sure to also update the fast
419              * path of qcow2_make_empty() to deal with it. */
420             {
421                 Qcow2UnknownHeaderExtension *uext;
422 
423                 uext = g_malloc0(sizeof(*uext)  + ext.len);
424                 uext->magic = ext.magic;
425                 uext->len = ext.len;
426                 QLIST_INSERT_HEAD(&s->unknown_header_ext, uext, next);
427 
428                 ret = bdrv_pread(bs->file, offset , uext->data, uext->len);
429                 if (ret < 0) {
430                     error_setg_errno(errp, -ret, "ERROR: unknown extension: "
431                                      "Could not read data");
432                     return ret;
433                 }
434             }
435             break;
436         }
437 
438         offset += ((ext.len + 7) & ~7);
439     }
440 
441     return 0;
442 }
443 
444 static void cleanup_unknown_header_ext(BlockDriverState *bs)
445 {
446     BDRVQcow2State *s = bs->opaque;
447     Qcow2UnknownHeaderExtension *uext, *next;
448 
449     QLIST_FOREACH_SAFE(uext, &s->unknown_header_ext, next, next) {
450         QLIST_REMOVE(uext, next);
451         g_free(uext);
452     }
453 }
454 
455 static void report_unsupported_feature(Error **errp, Qcow2Feature *table,
456                                        uint64_t mask)
457 {
458     char *features = g_strdup("");
459     char *old;
460 
461     while (table && table->name[0] != '\0') {
462         if (table->type == QCOW2_FEAT_TYPE_INCOMPATIBLE) {
463             if (mask & (1ULL << table->bit)) {
464                 old = features;
465                 features = g_strdup_printf("%s%s%.46s", old, *old ? ", " : "",
466                                            table->name);
467                 g_free(old);
468                 mask &= ~(1ULL << table->bit);
469             }
470         }
471         table++;
472     }
473 
474     if (mask) {
475         old = features;
476         features = g_strdup_printf("%s%sUnknown incompatible feature: %" PRIx64,
477                                    old, *old ? ", " : "", mask);
478         g_free(old);
479     }
480 
481     error_setg(errp, "Unsupported qcow2 feature(s): %s", features);
482     g_free(features);
483 }
484 
485 /*
486  * Sets the dirty bit and flushes afterwards if necessary.
487  *
488  * The incompatible_features bit is only set if the image file header was
489  * updated successfully.  Therefore it is not required to check the return
490  * value of this function.
491  */
492 int qcow2_mark_dirty(BlockDriverState *bs)
493 {
494     BDRVQcow2State *s = bs->opaque;
495     uint64_t val;
496     int ret;
497 
498     assert(s->qcow_version >= 3);
499 
500     if (s->incompatible_features & QCOW2_INCOMPAT_DIRTY) {
501         return 0; /* already dirty */
502     }
503 
504     val = cpu_to_be64(s->incompatible_features | QCOW2_INCOMPAT_DIRTY);
505     ret = bdrv_pwrite(bs->file, offsetof(QCowHeader, incompatible_features),
506                       &val, sizeof(val));
507     if (ret < 0) {
508         return ret;
509     }
510     ret = bdrv_flush(bs->file->bs);
511     if (ret < 0) {
512         return ret;
513     }
514 
515     /* Only treat image as dirty if the header was updated successfully */
516     s->incompatible_features |= QCOW2_INCOMPAT_DIRTY;
517     return 0;
518 }
519 
520 /*
521  * Clears the dirty bit and flushes before if necessary.  Only call this
522  * function when there are no pending requests, it does not guard against
523  * concurrent requests dirtying the image.
524  */
525 static int qcow2_mark_clean(BlockDriverState *bs)
526 {
527     BDRVQcow2State *s = bs->opaque;
528 
529     if (s->incompatible_features & QCOW2_INCOMPAT_DIRTY) {
530         int ret;
531 
532         s->incompatible_features &= ~QCOW2_INCOMPAT_DIRTY;
533 
534         ret = qcow2_flush_caches(bs);
535         if (ret < 0) {
536             return ret;
537         }
538 
539         return qcow2_update_header(bs);
540     }
541     return 0;
542 }
543 
544 /*
545  * Marks the image as corrupt.
546  */
547 int qcow2_mark_corrupt(BlockDriverState *bs)
548 {
549     BDRVQcow2State *s = bs->opaque;
550 
551     s->incompatible_features |= QCOW2_INCOMPAT_CORRUPT;
552     return qcow2_update_header(bs);
553 }
554 
555 /*
556  * Marks the image as consistent, i.e., unsets the corrupt bit, and flushes
557  * before if necessary.
558  */
559 int qcow2_mark_consistent(BlockDriverState *bs)
560 {
561     BDRVQcow2State *s = bs->opaque;
562 
563     if (s->incompatible_features & QCOW2_INCOMPAT_CORRUPT) {
564         int ret = qcow2_flush_caches(bs);
565         if (ret < 0) {
566             return ret;
567         }
568 
569         s->incompatible_features &= ~QCOW2_INCOMPAT_CORRUPT;
570         return qcow2_update_header(bs);
571     }
572     return 0;
573 }
574 
575 static int coroutine_fn qcow2_co_check_locked(BlockDriverState *bs,
576                                               BdrvCheckResult *result,
577                                               BdrvCheckMode fix)
578 {
579     int ret = qcow2_check_refcounts(bs, result, fix);
580     if (ret < 0) {
581         return ret;
582     }
583 
584     if (fix && result->check_errors == 0 && result->corruptions == 0) {
585         ret = qcow2_mark_clean(bs);
586         if (ret < 0) {
587             return ret;
588         }
589         return qcow2_mark_consistent(bs);
590     }
591     return ret;
592 }
593 
594 static int coroutine_fn qcow2_co_check(BlockDriverState *bs,
595                                        BdrvCheckResult *result,
596                                        BdrvCheckMode fix)
597 {
598     BDRVQcow2State *s = bs->opaque;
599     int ret;
600 
601     qemu_co_mutex_lock(&s->lock);
602     ret = qcow2_co_check_locked(bs, result, fix);
603     qemu_co_mutex_unlock(&s->lock);
604     return ret;
605 }
606 
607 int qcow2_validate_table(BlockDriverState *bs, uint64_t offset,
608                          uint64_t entries, size_t entry_len,
609                          int64_t max_size_bytes, const char *table_name,
610                          Error **errp)
611 {
612     BDRVQcow2State *s = bs->opaque;
613 
614     if (entries > max_size_bytes / entry_len) {
615         error_setg(errp, "%s too large", table_name);
616         return -EFBIG;
617     }
618 
619     /* Use signed INT64_MAX as the maximum even for uint64_t header fields,
620      * because values will be passed to qemu functions taking int64_t. */
621     if ((INT64_MAX - entries * entry_len < offset) ||
622         (offset_into_cluster(s, offset) != 0)) {
623         error_setg(errp, "%s offset invalid", table_name);
624         return -EINVAL;
625     }
626 
627     return 0;
628 }
629 
630 static const char *const mutable_opts[] = {
631     QCOW2_OPT_LAZY_REFCOUNTS,
632     QCOW2_OPT_DISCARD_REQUEST,
633     QCOW2_OPT_DISCARD_SNAPSHOT,
634     QCOW2_OPT_DISCARD_OTHER,
635     QCOW2_OPT_OVERLAP,
636     QCOW2_OPT_OVERLAP_TEMPLATE,
637     QCOW2_OPT_OVERLAP_MAIN_HEADER,
638     QCOW2_OPT_OVERLAP_ACTIVE_L1,
639     QCOW2_OPT_OVERLAP_ACTIVE_L2,
640     QCOW2_OPT_OVERLAP_REFCOUNT_TABLE,
641     QCOW2_OPT_OVERLAP_REFCOUNT_BLOCK,
642     QCOW2_OPT_OVERLAP_SNAPSHOT_TABLE,
643     QCOW2_OPT_OVERLAP_INACTIVE_L1,
644     QCOW2_OPT_OVERLAP_INACTIVE_L2,
645     QCOW2_OPT_OVERLAP_BITMAP_DIRECTORY,
646     QCOW2_OPT_CACHE_SIZE,
647     QCOW2_OPT_L2_CACHE_SIZE,
648     QCOW2_OPT_L2_CACHE_ENTRY_SIZE,
649     QCOW2_OPT_REFCOUNT_CACHE_SIZE,
650     QCOW2_OPT_CACHE_CLEAN_INTERVAL,
651     NULL
652 };
653 
654 static QemuOptsList qcow2_runtime_opts = {
655     .name = "qcow2",
656     .head = QTAILQ_HEAD_INITIALIZER(qcow2_runtime_opts.head),
657     .desc = {
658         {
659             .name = QCOW2_OPT_LAZY_REFCOUNTS,
660             .type = QEMU_OPT_BOOL,
661             .help = "Postpone refcount updates",
662         },
663         {
664             .name = QCOW2_OPT_DISCARD_REQUEST,
665             .type = QEMU_OPT_BOOL,
666             .help = "Pass guest discard requests to the layer below",
667         },
668         {
669             .name = QCOW2_OPT_DISCARD_SNAPSHOT,
670             .type = QEMU_OPT_BOOL,
671             .help = "Generate discard requests when snapshot related space "
672                     "is freed",
673         },
674         {
675             .name = QCOW2_OPT_DISCARD_OTHER,
676             .type = QEMU_OPT_BOOL,
677             .help = "Generate discard requests when other clusters are freed",
678         },
679         {
680             .name = QCOW2_OPT_OVERLAP,
681             .type = QEMU_OPT_STRING,
682             .help = "Selects which overlap checks to perform from a range of "
683                     "templates (none, constant, cached, all)",
684         },
685         {
686             .name = QCOW2_OPT_OVERLAP_TEMPLATE,
687             .type = QEMU_OPT_STRING,
688             .help = "Selects which overlap checks to perform from a range of "
689                     "templates (none, constant, cached, all)",
690         },
691         {
692             .name = QCOW2_OPT_OVERLAP_MAIN_HEADER,
693             .type = QEMU_OPT_BOOL,
694             .help = "Check for unintended writes into the main qcow2 header",
695         },
696         {
697             .name = QCOW2_OPT_OVERLAP_ACTIVE_L1,
698             .type = QEMU_OPT_BOOL,
699             .help = "Check for unintended writes into the active L1 table",
700         },
701         {
702             .name = QCOW2_OPT_OVERLAP_ACTIVE_L2,
703             .type = QEMU_OPT_BOOL,
704             .help = "Check for unintended writes into an active L2 table",
705         },
706         {
707             .name = QCOW2_OPT_OVERLAP_REFCOUNT_TABLE,
708             .type = QEMU_OPT_BOOL,
709             .help = "Check for unintended writes into the refcount table",
710         },
711         {
712             .name = QCOW2_OPT_OVERLAP_REFCOUNT_BLOCK,
713             .type = QEMU_OPT_BOOL,
714             .help = "Check for unintended writes into a refcount block",
715         },
716         {
717             .name = QCOW2_OPT_OVERLAP_SNAPSHOT_TABLE,
718             .type = QEMU_OPT_BOOL,
719             .help = "Check for unintended writes into the snapshot table",
720         },
721         {
722             .name = QCOW2_OPT_OVERLAP_INACTIVE_L1,
723             .type = QEMU_OPT_BOOL,
724             .help = "Check for unintended writes into an inactive L1 table",
725         },
726         {
727             .name = QCOW2_OPT_OVERLAP_INACTIVE_L2,
728             .type = QEMU_OPT_BOOL,
729             .help = "Check for unintended writes into an inactive L2 table",
730         },
731         {
732             .name = QCOW2_OPT_OVERLAP_BITMAP_DIRECTORY,
733             .type = QEMU_OPT_BOOL,
734             .help = "Check for unintended writes into the bitmap directory",
735         },
736         {
737             .name = QCOW2_OPT_CACHE_SIZE,
738             .type = QEMU_OPT_SIZE,
739             .help = "Maximum combined metadata (L2 tables and refcount blocks) "
740                     "cache size",
741         },
742         {
743             .name = QCOW2_OPT_L2_CACHE_SIZE,
744             .type = QEMU_OPT_SIZE,
745             .help = "Maximum L2 table cache size",
746         },
747         {
748             .name = QCOW2_OPT_L2_CACHE_ENTRY_SIZE,
749             .type = QEMU_OPT_SIZE,
750             .help = "Size of each entry in the L2 cache",
751         },
752         {
753             .name = QCOW2_OPT_REFCOUNT_CACHE_SIZE,
754             .type = QEMU_OPT_SIZE,
755             .help = "Maximum refcount block cache size",
756         },
757         {
758             .name = QCOW2_OPT_CACHE_CLEAN_INTERVAL,
759             .type = QEMU_OPT_NUMBER,
760             .help = "Clean unused cache entries after this time (in seconds)",
761         },
762         BLOCK_CRYPTO_OPT_DEF_KEY_SECRET("encrypt.",
763             "ID of secret providing qcow2 AES key or LUKS passphrase"),
764         { /* end of list */ }
765     },
766 };
767 
768 static const char *overlap_bool_option_names[QCOW2_OL_MAX_BITNR] = {
769     [QCOW2_OL_MAIN_HEADER_BITNR]      = QCOW2_OPT_OVERLAP_MAIN_HEADER,
770     [QCOW2_OL_ACTIVE_L1_BITNR]        = QCOW2_OPT_OVERLAP_ACTIVE_L1,
771     [QCOW2_OL_ACTIVE_L2_BITNR]        = QCOW2_OPT_OVERLAP_ACTIVE_L2,
772     [QCOW2_OL_REFCOUNT_TABLE_BITNR]   = QCOW2_OPT_OVERLAP_REFCOUNT_TABLE,
773     [QCOW2_OL_REFCOUNT_BLOCK_BITNR]   = QCOW2_OPT_OVERLAP_REFCOUNT_BLOCK,
774     [QCOW2_OL_SNAPSHOT_TABLE_BITNR]   = QCOW2_OPT_OVERLAP_SNAPSHOT_TABLE,
775     [QCOW2_OL_INACTIVE_L1_BITNR]      = QCOW2_OPT_OVERLAP_INACTIVE_L1,
776     [QCOW2_OL_INACTIVE_L2_BITNR]      = QCOW2_OPT_OVERLAP_INACTIVE_L2,
777     [QCOW2_OL_BITMAP_DIRECTORY_BITNR] = QCOW2_OPT_OVERLAP_BITMAP_DIRECTORY,
778 };
779 
780 static void cache_clean_timer_cb(void *opaque)
781 {
782     BlockDriverState *bs = opaque;
783     BDRVQcow2State *s = bs->opaque;
784     qcow2_cache_clean_unused(s->l2_table_cache);
785     qcow2_cache_clean_unused(s->refcount_block_cache);
786     timer_mod(s->cache_clean_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) +
787               (int64_t) s->cache_clean_interval * 1000);
788 }
789 
790 static void cache_clean_timer_init(BlockDriverState *bs, AioContext *context)
791 {
792     BDRVQcow2State *s = bs->opaque;
793     if (s->cache_clean_interval > 0) {
794         s->cache_clean_timer = aio_timer_new(context, QEMU_CLOCK_VIRTUAL,
795                                              SCALE_MS, cache_clean_timer_cb,
796                                              bs);
797         timer_mod(s->cache_clean_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) +
798                   (int64_t) s->cache_clean_interval * 1000);
799     }
800 }
801 
802 static void cache_clean_timer_del(BlockDriverState *bs)
803 {
804     BDRVQcow2State *s = bs->opaque;
805     if (s->cache_clean_timer) {
806         timer_del(s->cache_clean_timer);
807         timer_free(s->cache_clean_timer);
808         s->cache_clean_timer = NULL;
809     }
810 }
811 
812 static void qcow2_detach_aio_context(BlockDriverState *bs)
813 {
814     cache_clean_timer_del(bs);
815 }
816 
817 static void qcow2_attach_aio_context(BlockDriverState *bs,
818                                      AioContext *new_context)
819 {
820     cache_clean_timer_init(bs, new_context);
821 }
822 
823 static void read_cache_sizes(BlockDriverState *bs, QemuOpts *opts,
824                              uint64_t *l2_cache_size,
825                              uint64_t *l2_cache_entry_size,
826                              uint64_t *refcount_cache_size, Error **errp)
827 {
828     BDRVQcow2State *s = bs->opaque;
829     uint64_t combined_cache_size, l2_cache_max_setting;
830     bool l2_cache_size_set, refcount_cache_size_set, combined_cache_size_set;
831     bool l2_cache_entry_size_set;
832     int min_refcount_cache = MIN_REFCOUNT_CACHE_SIZE * s->cluster_size;
833     uint64_t virtual_disk_size = bs->total_sectors * BDRV_SECTOR_SIZE;
834     uint64_t max_l2_cache = virtual_disk_size / (s->cluster_size / 8);
835 
836     combined_cache_size_set = qemu_opt_get(opts, QCOW2_OPT_CACHE_SIZE);
837     l2_cache_size_set = qemu_opt_get(opts, QCOW2_OPT_L2_CACHE_SIZE);
838     refcount_cache_size_set = qemu_opt_get(opts, QCOW2_OPT_REFCOUNT_CACHE_SIZE);
839     l2_cache_entry_size_set = qemu_opt_get(opts, QCOW2_OPT_L2_CACHE_ENTRY_SIZE);
840 
841     combined_cache_size = qemu_opt_get_size(opts, QCOW2_OPT_CACHE_SIZE, 0);
842     l2_cache_max_setting = qemu_opt_get_size(opts, QCOW2_OPT_L2_CACHE_SIZE,
843                                              DEFAULT_L2_CACHE_MAX_SIZE);
844     *refcount_cache_size = qemu_opt_get_size(opts,
845                                              QCOW2_OPT_REFCOUNT_CACHE_SIZE, 0);
846 
847     *l2_cache_entry_size = qemu_opt_get_size(
848         opts, QCOW2_OPT_L2_CACHE_ENTRY_SIZE, s->cluster_size);
849 
850     *l2_cache_size = MIN(max_l2_cache, l2_cache_max_setting);
851 
852     if (combined_cache_size_set) {
853         if (l2_cache_size_set && refcount_cache_size_set) {
854             error_setg(errp, QCOW2_OPT_CACHE_SIZE ", " QCOW2_OPT_L2_CACHE_SIZE
855                        " and " QCOW2_OPT_REFCOUNT_CACHE_SIZE " may not be set "
856                        "at the same time");
857             return;
858         } else if (l2_cache_size_set &&
859                    (l2_cache_max_setting > combined_cache_size)) {
860             error_setg(errp, QCOW2_OPT_L2_CACHE_SIZE " may not exceed "
861                        QCOW2_OPT_CACHE_SIZE);
862             return;
863         } else if (*refcount_cache_size > combined_cache_size) {
864             error_setg(errp, QCOW2_OPT_REFCOUNT_CACHE_SIZE " may not exceed "
865                        QCOW2_OPT_CACHE_SIZE);
866             return;
867         }
868 
869         if (l2_cache_size_set) {
870             *refcount_cache_size = combined_cache_size - *l2_cache_size;
871         } else if (refcount_cache_size_set) {
872             *l2_cache_size = combined_cache_size - *refcount_cache_size;
873         } else {
874             /* Assign as much memory as possible to the L2 cache, and
875              * use the remainder for the refcount cache */
876             if (combined_cache_size >= max_l2_cache + min_refcount_cache) {
877                 *l2_cache_size = max_l2_cache;
878                 *refcount_cache_size = combined_cache_size - *l2_cache_size;
879             } else {
880                 *refcount_cache_size =
881                     MIN(combined_cache_size, min_refcount_cache);
882                 *l2_cache_size = combined_cache_size - *refcount_cache_size;
883             }
884         }
885     }
886 
887     /*
888      * If the L2 cache is not enough to cover the whole disk then
889      * default to 4KB entries. Smaller entries reduce the cost of
890      * loads and evictions and increase I/O performance.
891      */
892     if (*l2_cache_size < max_l2_cache && !l2_cache_entry_size_set) {
893         *l2_cache_entry_size = MIN(s->cluster_size, 4096);
894     }
895 
896     /* l2_cache_size and refcount_cache_size are ensured to have at least
897      * their minimum values in qcow2_update_options_prepare() */
898 
899     if (*l2_cache_entry_size < (1 << MIN_CLUSTER_BITS) ||
900         *l2_cache_entry_size > s->cluster_size ||
901         !is_power_of_2(*l2_cache_entry_size)) {
902         error_setg(errp, "L2 cache entry size must be a power of two "
903                    "between %d and the cluster size (%d)",
904                    1 << MIN_CLUSTER_BITS, s->cluster_size);
905         return;
906     }
907 }
908 
909 typedef struct Qcow2ReopenState {
910     Qcow2Cache *l2_table_cache;
911     Qcow2Cache *refcount_block_cache;
912     int l2_slice_size; /* Number of entries in a slice of the L2 table */
913     bool use_lazy_refcounts;
914     int overlap_check;
915     bool discard_passthrough[QCOW2_DISCARD_MAX];
916     uint64_t cache_clean_interval;
917     QCryptoBlockOpenOptions *crypto_opts; /* Disk encryption runtime options */
918 } Qcow2ReopenState;
919 
920 static int qcow2_update_options_prepare(BlockDriverState *bs,
921                                         Qcow2ReopenState *r,
922                                         QDict *options, int flags,
923                                         Error **errp)
924 {
925     BDRVQcow2State *s = bs->opaque;
926     QemuOpts *opts = NULL;
927     const char *opt_overlap_check, *opt_overlap_check_template;
928     int overlap_check_template = 0;
929     uint64_t l2_cache_size, l2_cache_entry_size, refcount_cache_size;
930     int i;
931     const char *encryptfmt;
932     QDict *encryptopts = NULL;
933     Error *local_err = NULL;
934     int ret;
935 
936     qdict_extract_subqdict(options, &encryptopts, "encrypt.");
937     encryptfmt = qdict_get_try_str(encryptopts, "format");
938 
939     opts = qemu_opts_create(&qcow2_runtime_opts, NULL, 0, &error_abort);
940     qemu_opts_absorb_qdict(opts, options, &local_err);
941     if (local_err) {
942         error_propagate(errp, local_err);
943         ret = -EINVAL;
944         goto fail;
945     }
946 
947     /* get L2 table/refcount block cache size from command line options */
948     read_cache_sizes(bs, opts, &l2_cache_size, &l2_cache_entry_size,
949                      &refcount_cache_size, &local_err);
950     if (local_err) {
951         error_propagate(errp, local_err);
952         ret = -EINVAL;
953         goto fail;
954     }
955 
956     l2_cache_size /= l2_cache_entry_size;
957     if (l2_cache_size < MIN_L2_CACHE_SIZE) {
958         l2_cache_size = MIN_L2_CACHE_SIZE;
959     }
960     if (l2_cache_size > INT_MAX) {
961         error_setg(errp, "L2 cache size too big");
962         ret = -EINVAL;
963         goto fail;
964     }
965 
966     refcount_cache_size /= s->cluster_size;
967     if (refcount_cache_size < MIN_REFCOUNT_CACHE_SIZE) {
968         refcount_cache_size = MIN_REFCOUNT_CACHE_SIZE;
969     }
970     if (refcount_cache_size > INT_MAX) {
971         error_setg(errp, "Refcount cache size too big");
972         ret = -EINVAL;
973         goto fail;
974     }
975 
976     /* alloc new L2 table/refcount block cache, flush old one */
977     if (s->l2_table_cache) {
978         ret = qcow2_cache_flush(bs, s->l2_table_cache);
979         if (ret) {
980             error_setg_errno(errp, -ret, "Failed to flush the L2 table cache");
981             goto fail;
982         }
983     }
984 
985     if (s->refcount_block_cache) {
986         ret = qcow2_cache_flush(bs, s->refcount_block_cache);
987         if (ret) {
988             error_setg_errno(errp, -ret,
989                              "Failed to flush the refcount block cache");
990             goto fail;
991         }
992     }
993 
994     r->l2_slice_size = l2_cache_entry_size / sizeof(uint64_t);
995     r->l2_table_cache = qcow2_cache_create(bs, l2_cache_size,
996                                            l2_cache_entry_size);
997     r->refcount_block_cache = qcow2_cache_create(bs, refcount_cache_size,
998                                                  s->cluster_size);
999     if (r->l2_table_cache == NULL || r->refcount_block_cache == NULL) {
1000         error_setg(errp, "Could not allocate metadata caches");
1001         ret = -ENOMEM;
1002         goto fail;
1003     }
1004 
1005     /* New interval for cache cleanup timer */
1006     r->cache_clean_interval =
1007         qemu_opt_get_number(opts, QCOW2_OPT_CACHE_CLEAN_INTERVAL,
1008                             DEFAULT_CACHE_CLEAN_INTERVAL);
1009 #ifndef CONFIG_LINUX
1010     if (r->cache_clean_interval != 0) {
1011         error_setg(errp, QCOW2_OPT_CACHE_CLEAN_INTERVAL
1012                    " not supported on this host");
1013         ret = -EINVAL;
1014         goto fail;
1015     }
1016 #endif
1017     if (r->cache_clean_interval > UINT_MAX) {
1018         error_setg(errp, "Cache clean interval too big");
1019         ret = -EINVAL;
1020         goto fail;
1021     }
1022 
1023     /* lazy-refcounts; flush if going from enabled to disabled */
1024     r->use_lazy_refcounts = qemu_opt_get_bool(opts, QCOW2_OPT_LAZY_REFCOUNTS,
1025         (s->compatible_features & QCOW2_COMPAT_LAZY_REFCOUNTS));
1026     if (r->use_lazy_refcounts && s->qcow_version < 3) {
1027         error_setg(errp, "Lazy refcounts require a qcow2 image with at least "
1028                    "qemu 1.1 compatibility level");
1029         ret = -EINVAL;
1030         goto fail;
1031     }
1032 
1033     if (s->use_lazy_refcounts && !r->use_lazy_refcounts) {
1034         ret = qcow2_mark_clean(bs);
1035         if (ret < 0) {
1036             error_setg_errno(errp, -ret, "Failed to disable lazy refcounts");
1037             goto fail;
1038         }
1039     }
1040 
1041     /* Overlap check options */
1042     opt_overlap_check = qemu_opt_get(opts, QCOW2_OPT_OVERLAP);
1043     opt_overlap_check_template = qemu_opt_get(opts, QCOW2_OPT_OVERLAP_TEMPLATE);
1044     if (opt_overlap_check_template && opt_overlap_check &&
1045         strcmp(opt_overlap_check_template, opt_overlap_check))
1046     {
1047         error_setg(errp, "Conflicting values for qcow2 options '"
1048                    QCOW2_OPT_OVERLAP "' ('%s') and '" QCOW2_OPT_OVERLAP_TEMPLATE
1049                    "' ('%s')", opt_overlap_check, opt_overlap_check_template);
1050         ret = -EINVAL;
1051         goto fail;
1052     }
1053     if (!opt_overlap_check) {
1054         opt_overlap_check = opt_overlap_check_template ?: "cached";
1055     }
1056 
1057     if (!strcmp(opt_overlap_check, "none")) {
1058         overlap_check_template = 0;
1059     } else if (!strcmp(opt_overlap_check, "constant")) {
1060         overlap_check_template = QCOW2_OL_CONSTANT;
1061     } else if (!strcmp(opt_overlap_check, "cached")) {
1062         overlap_check_template = QCOW2_OL_CACHED;
1063     } else if (!strcmp(opt_overlap_check, "all")) {
1064         overlap_check_template = QCOW2_OL_ALL;
1065     } else {
1066         error_setg(errp, "Unsupported value '%s' for qcow2 option "
1067                    "'overlap-check'. Allowed are any of the following: "
1068                    "none, constant, cached, all", opt_overlap_check);
1069         ret = -EINVAL;
1070         goto fail;
1071     }
1072 
1073     r->overlap_check = 0;
1074     for (i = 0; i < QCOW2_OL_MAX_BITNR; i++) {
1075         /* overlap-check defines a template bitmask, but every flag may be
1076          * overwritten through the associated boolean option */
1077         r->overlap_check |=
1078             qemu_opt_get_bool(opts, overlap_bool_option_names[i],
1079                               overlap_check_template & (1 << i)) << i;
1080     }
1081 
1082     r->discard_passthrough[QCOW2_DISCARD_NEVER] = false;
1083     r->discard_passthrough[QCOW2_DISCARD_ALWAYS] = true;
1084     r->discard_passthrough[QCOW2_DISCARD_REQUEST] =
1085         qemu_opt_get_bool(opts, QCOW2_OPT_DISCARD_REQUEST,
1086                           flags & BDRV_O_UNMAP);
1087     r->discard_passthrough[QCOW2_DISCARD_SNAPSHOT] =
1088         qemu_opt_get_bool(opts, QCOW2_OPT_DISCARD_SNAPSHOT, true);
1089     r->discard_passthrough[QCOW2_DISCARD_OTHER] =
1090         qemu_opt_get_bool(opts, QCOW2_OPT_DISCARD_OTHER, false);
1091 
1092     switch (s->crypt_method_header) {
1093     case QCOW_CRYPT_NONE:
1094         if (encryptfmt) {
1095             error_setg(errp, "No encryption in image header, but options "
1096                        "specified format '%s'", encryptfmt);
1097             ret = -EINVAL;
1098             goto fail;
1099         }
1100         break;
1101 
1102     case QCOW_CRYPT_AES:
1103         if (encryptfmt && !g_str_equal(encryptfmt, "aes")) {
1104             error_setg(errp,
1105                        "Header reported 'aes' encryption format but "
1106                        "options specify '%s'", encryptfmt);
1107             ret = -EINVAL;
1108             goto fail;
1109         }
1110         qdict_put_str(encryptopts, "format", "qcow");
1111         r->crypto_opts = block_crypto_open_opts_init(encryptopts, errp);
1112         break;
1113 
1114     case QCOW_CRYPT_LUKS:
1115         if (encryptfmt && !g_str_equal(encryptfmt, "luks")) {
1116             error_setg(errp,
1117                        "Header reported 'luks' encryption format but "
1118                        "options specify '%s'", encryptfmt);
1119             ret = -EINVAL;
1120             goto fail;
1121         }
1122         qdict_put_str(encryptopts, "format", "luks");
1123         r->crypto_opts = block_crypto_open_opts_init(encryptopts, errp);
1124         break;
1125 
1126     default:
1127         error_setg(errp, "Unsupported encryption method %d",
1128                    s->crypt_method_header);
1129         break;
1130     }
1131     if (s->crypt_method_header != QCOW_CRYPT_NONE && !r->crypto_opts) {
1132         ret = -EINVAL;
1133         goto fail;
1134     }
1135 
1136     ret = 0;
1137 fail:
1138     qobject_unref(encryptopts);
1139     qemu_opts_del(opts);
1140     opts = NULL;
1141     return ret;
1142 }
1143 
1144 static void qcow2_update_options_commit(BlockDriverState *bs,
1145                                         Qcow2ReopenState *r)
1146 {
1147     BDRVQcow2State *s = bs->opaque;
1148     int i;
1149 
1150     if (s->l2_table_cache) {
1151         qcow2_cache_destroy(s->l2_table_cache);
1152     }
1153     if (s->refcount_block_cache) {
1154         qcow2_cache_destroy(s->refcount_block_cache);
1155     }
1156     s->l2_table_cache = r->l2_table_cache;
1157     s->refcount_block_cache = r->refcount_block_cache;
1158     s->l2_slice_size = r->l2_slice_size;
1159 
1160     s->overlap_check = r->overlap_check;
1161     s->use_lazy_refcounts = r->use_lazy_refcounts;
1162 
1163     for (i = 0; i < QCOW2_DISCARD_MAX; i++) {
1164         s->discard_passthrough[i] = r->discard_passthrough[i];
1165     }
1166 
1167     if (s->cache_clean_interval != r->cache_clean_interval) {
1168         cache_clean_timer_del(bs);
1169         s->cache_clean_interval = r->cache_clean_interval;
1170         cache_clean_timer_init(bs, bdrv_get_aio_context(bs));
1171     }
1172 
1173     qapi_free_QCryptoBlockOpenOptions(s->crypto_opts);
1174     s->crypto_opts = r->crypto_opts;
1175 }
1176 
1177 static void qcow2_update_options_abort(BlockDriverState *bs,
1178                                        Qcow2ReopenState *r)
1179 {
1180     if (r->l2_table_cache) {
1181         qcow2_cache_destroy(r->l2_table_cache);
1182     }
1183     if (r->refcount_block_cache) {
1184         qcow2_cache_destroy(r->refcount_block_cache);
1185     }
1186     qapi_free_QCryptoBlockOpenOptions(r->crypto_opts);
1187 }
1188 
1189 static int qcow2_update_options(BlockDriverState *bs, QDict *options,
1190                                 int flags, Error **errp)
1191 {
1192     Qcow2ReopenState r = {};
1193     int ret;
1194 
1195     ret = qcow2_update_options_prepare(bs, &r, options, flags, errp);
1196     if (ret >= 0) {
1197         qcow2_update_options_commit(bs, &r);
1198     } else {
1199         qcow2_update_options_abort(bs, &r);
1200     }
1201 
1202     return ret;
1203 }
1204 
1205 /* Called with s->lock held.  */
1206 static int coroutine_fn qcow2_do_open(BlockDriverState *bs, QDict *options,
1207                                       int flags, Error **errp)
1208 {
1209     BDRVQcow2State *s = bs->opaque;
1210     unsigned int len, i;
1211     int ret = 0;
1212     QCowHeader header;
1213     Error *local_err = NULL;
1214     uint64_t ext_end;
1215     uint64_t l1_vm_state_index;
1216     bool update_header = false;
1217 
1218     ret = bdrv_pread(bs->file, 0, &header, sizeof(header));
1219     if (ret < 0) {
1220         error_setg_errno(errp, -ret, "Could not read qcow2 header");
1221         goto fail;
1222     }
1223     header.magic = be32_to_cpu(header.magic);
1224     header.version = be32_to_cpu(header.version);
1225     header.backing_file_offset = be64_to_cpu(header.backing_file_offset);
1226     header.backing_file_size = be32_to_cpu(header.backing_file_size);
1227     header.size = be64_to_cpu(header.size);
1228     header.cluster_bits = be32_to_cpu(header.cluster_bits);
1229     header.crypt_method = be32_to_cpu(header.crypt_method);
1230     header.l1_table_offset = be64_to_cpu(header.l1_table_offset);
1231     header.l1_size = be32_to_cpu(header.l1_size);
1232     header.refcount_table_offset = be64_to_cpu(header.refcount_table_offset);
1233     header.refcount_table_clusters =
1234         be32_to_cpu(header.refcount_table_clusters);
1235     header.snapshots_offset = be64_to_cpu(header.snapshots_offset);
1236     header.nb_snapshots = be32_to_cpu(header.nb_snapshots);
1237 
1238     if (header.magic != QCOW_MAGIC) {
1239         error_setg(errp, "Image is not in qcow2 format");
1240         ret = -EINVAL;
1241         goto fail;
1242     }
1243     if (header.version < 2 || header.version > 3) {
1244         error_setg(errp, "Unsupported qcow2 version %" PRIu32, header.version);
1245         ret = -ENOTSUP;
1246         goto fail;
1247     }
1248 
1249     s->qcow_version = header.version;
1250 
1251     /* Initialise cluster size */
1252     if (header.cluster_bits < MIN_CLUSTER_BITS ||
1253         header.cluster_bits > MAX_CLUSTER_BITS) {
1254         error_setg(errp, "Unsupported cluster size: 2^%" PRIu32,
1255                    header.cluster_bits);
1256         ret = -EINVAL;
1257         goto fail;
1258     }
1259 
1260     s->cluster_bits = header.cluster_bits;
1261     s->cluster_size = 1 << s->cluster_bits;
1262 
1263     /* Initialise version 3 header fields */
1264     if (header.version == 2) {
1265         header.incompatible_features    = 0;
1266         header.compatible_features      = 0;
1267         header.autoclear_features       = 0;
1268         header.refcount_order           = 4;
1269         header.header_length            = 72;
1270     } else {
1271         header.incompatible_features =
1272             be64_to_cpu(header.incompatible_features);
1273         header.compatible_features = be64_to_cpu(header.compatible_features);
1274         header.autoclear_features = be64_to_cpu(header.autoclear_features);
1275         header.refcount_order = be32_to_cpu(header.refcount_order);
1276         header.header_length = be32_to_cpu(header.header_length);
1277 
1278         if (header.header_length < 104) {
1279             error_setg(errp, "qcow2 header too short");
1280             ret = -EINVAL;
1281             goto fail;
1282         }
1283     }
1284 
1285     if (header.header_length > s->cluster_size) {
1286         error_setg(errp, "qcow2 header exceeds cluster size");
1287         ret = -EINVAL;
1288         goto fail;
1289     }
1290 
1291     if (header.header_length > sizeof(header)) {
1292         s->unknown_header_fields_size = header.header_length - sizeof(header);
1293         s->unknown_header_fields = g_malloc(s->unknown_header_fields_size);
1294         ret = bdrv_pread(bs->file, sizeof(header), s->unknown_header_fields,
1295                          s->unknown_header_fields_size);
1296         if (ret < 0) {
1297             error_setg_errno(errp, -ret, "Could not read unknown qcow2 header "
1298                              "fields");
1299             goto fail;
1300         }
1301     }
1302 
1303     if (header.backing_file_offset > s->cluster_size) {
1304         error_setg(errp, "Invalid backing file offset");
1305         ret = -EINVAL;
1306         goto fail;
1307     }
1308 
1309     if (header.backing_file_offset) {
1310         ext_end = header.backing_file_offset;
1311     } else {
1312         ext_end = 1 << header.cluster_bits;
1313     }
1314 
1315     /* Handle feature bits */
1316     s->incompatible_features    = header.incompatible_features;
1317     s->compatible_features      = header.compatible_features;
1318     s->autoclear_features       = header.autoclear_features;
1319 
1320     if (s->incompatible_features & ~QCOW2_INCOMPAT_MASK) {
1321         void *feature_table = NULL;
1322         qcow2_read_extensions(bs, header.header_length, ext_end,
1323                               &feature_table, flags, NULL, NULL);
1324         report_unsupported_feature(errp, feature_table,
1325                                    s->incompatible_features &
1326                                    ~QCOW2_INCOMPAT_MASK);
1327         ret = -ENOTSUP;
1328         g_free(feature_table);
1329         goto fail;
1330     }
1331 
1332     if (s->incompatible_features & QCOW2_INCOMPAT_CORRUPT) {
1333         /* Corrupt images may not be written to unless they are being repaired
1334          */
1335         if ((flags & BDRV_O_RDWR) && !(flags & BDRV_O_CHECK)) {
1336             error_setg(errp, "qcow2: Image is corrupt; cannot be opened "
1337                        "read/write");
1338             ret = -EACCES;
1339             goto fail;
1340         }
1341     }
1342 
1343     /* Check support for various header values */
1344     if (header.refcount_order > 6) {
1345         error_setg(errp, "Reference count entry width too large; may not "
1346                    "exceed 64 bits");
1347         ret = -EINVAL;
1348         goto fail;
1349     }
1350     s->refcount_order = header.refcount_order;
1351     s->refcount_bits = 1 << s->refcount_order;
1352     s->refcount_max = UINT64_C(1) << (s->refcount_bits - 1);
1353     s->refcount_max += s->refcount_max - 1;
1354 
1355     s->crypt_method_header = header.crypt_method;
1356     if (s->crypt_method_header) {
1357         if (bdrv_uses_whitelist() &&
1358             s->crypt_method_header == QCOW_CRYPT_AES) {
1359             error_setg(errp,
1360                        "Use of AES-CBC encrypted qcow2 images is no longer "
1361                        "supported in system emulators");
1362             error_append_hint(errp,
1363                               "You can use 'qemu-img convert' to convert your "
1364                               "image to an alternative supported format, such "
1365                               "as unencrypted qcow2, or raw with the LUKS "
1366                               "format instead.\n");
1367             ret = -ENOSYS;
1368             goto fail;
1369         }
1370 
1371         if (s->crypt_method_header == QCOW_CRYPT_AES) {
1372             s->crypt_physical_offset = false;
1373         } else {
1374             /* Assuming LUKS and any future crypt methods we
1375              * add will all use physical offsets, due to the
1376              * fact that the alternative is insecure...  */
1377             s->crypt_physical_offset = true;
1378         }
1379 
1380         bs->encrypted = true;
1381     }
1382 
1383     s->l2_bits = s->cluster_bits - 3; /* L2 is always one cluster */
1384     s->l2_size = 1 << s->l2_bits;
1385     /* 2^(s->refcount_order - 3) is the refcount width in bytes */
1386     s->refcount_block_bits = s->cluster_bits - (s->refcount_order - 3);
1387     s->refcount_block_size = 1 << s->refcount_block_bits;
1388     bs->total_sectors = header.size / BDRV_SECTOR_SIZE;
1389     s->csize_shift = (62 - (s->cluster_bits - 8));
1390     s->csize_mask = (1 << (s->cluster_bits - 8)) - 1;
1391     s->cluster_offset_mask = (1LL << s->csize_shift) - 1;
1392 
1393     s->refcount_table_offset = header.refcount_table_offset;
1394     s->refcount_table_size =
1395         header.refcount_table_clusters << (s->cluster_bits - 3);
1396 
1397     if (header.refcount_table_clusters == 0 && !(flags & BDRV_O_CHECK)) {
1398         error_setg(errp, "Image does not contain a reference count table");
1399         ret = -EINVAL;
1400         goto fail;
1401     }
1402 
1403     ret = qcow2_validate_table(bs, s->refcount_table_offset,
1404                                header.refcount_table_clusters,
1405                                s->cluster_size, QCOW_MAX_REFTABLE_SIZE,
1406                                "Reference count table", errp);
1407     if (ret < 0) {
1408         goto fail;
1409     }
1410 
1411     /* The total size in bytes of the snapshot table is checked in
1412      * qcow2_read_snapshots() because the size of each snapshot is
1413      * variable and we don't know it yet.
1414      * Here we only check the offset and number of snapshots. */
1415     ret = qcow2_validate_table(bs, header.snapshots_offset,
1416                                header.nb_snapshots,
1417                                sizeof(QCowSnapshotHeader),
1418                                sizeof(QCowSnapshotHeader) * QCOW_MAX_SNAPSHOTS,
1419                                "Snapshot table", errp);
1420     if (ret < 0) {
1421         goto fail;
1422     }
1423 
1424     /* read the level 1 table */
1425     ret = qcow2_validate_table(bs, header.l1_table_offset,
1426                                header.l1_size, sizeof(uint64_t),
1427                                QCOW_MAX_L1_SIZE, "Active L1 table", errp);
1428     if (ret < 0) {
1429         goto fail;
1430     }
1431     s->l1_size = header.l1_size;
1432     s->l1_table_offset = header.l1_table_offset;
1433 
1434     l1_vm_state_index = size_to_l1(s, header.size);
1435     if (l1_vm_state_index > INT_MAX) {
1436         error_setg(errp, "Image is too big");
1437         ret = -EFBIG;
1438         goto fail;
1439     }
1440     s->l1_vm_state_index = l1_vm_state_index;
1441 
1442     /* the L1 table must contain at least enough entries to put
1443        header.size bytes */
1444     if (s->l1_size < s->l1_vm_state_index) {
1445         error_setg(errp, "L1 table is too small");
1446         ret = -EINVAL;
1447         goto fail;
1448     }
1449 
1450     if (s->l1_size > 0) {
1451         s->l1_table = qemu_try_blockalign(bs->file->bs,
1452             ROUND_UP(s->l1_size * sizeof(uint64_t), 512));
1453         if (s->l1_table == NULL) {
1454             error_setg(errp, "Could not allocate L1 table");
1455             ret = -ENOMEM;
1456             goto fail;
1457         }
1458         ret = bdrv_pread(bs->file, s->l1_table_offset, s->l1_table,
1459                          s->l1_size * sizeof(uint64_t));
1460         if (ret < 0) {
1461             error_setg_errno(errp, -ret, "Could not read L1 table");
1462             goto fail;
1463         }
1464         for(i = 0;i < s->l1_size; i++) {
1465             s->l1_table[i] = be64_to_cpu(s->l1_table[i]);
1466         }
1467     }
1468 
1469     /* Parse driver-specific options */
1470     ret = qcow2_update_options(bs, options, flags, errp);
1471     if (ret < 0) {
1472         goto fail;
1473     }
1474 
1475     s->flags = flags;
1476 
1477     ret = qcow2_refcount_init(bs);
1478     if (ret != 0) {
1479         error_setg_errno(errp, -ret, "Could not initialize refcount handling");
1480         goto fail;
1481     }
1482 
1483     QLIST_INIT(&s->cluster_allocs);
1484     QTAILQ_INIT(&s->discards);
1485 
1486     /* read qcow2 extensions */
1487     if (qcow2_read_extensions(bs, header.header_length, ext_end, NULL,
1488                               flags, &update_header, &local_err)) {
1489         error_propagate(errp, local_err);
1490         ret = -EINVAL;
1491         goto fail;
1492     }
1493 
1494     /* Open external data file */
1495     s->data_file = bdrv_open_child(NULL, options, "data-file", bs, &child_file,
1496                                    true, &local_err);
1497     if (local_err) {
1498         error_propagate(errp, local_err);
1499         ret = -EINVAL;
1500         goto fail;
1501     }
1502 
1503     if (s->incompatible_features & QCOW2_INCOMPAT_DATA_FILE) {
1504         if (!s->data_file && s->image_data_file) {
1505             s->data_file = bdrv_open_child(s->image_data_file, options,
1506                                            "data-file", bs, &child_file,
1507                                            false, errp);
1508             if (!s->data_file) {
1509                 ret = -EINVAL;
1510                 goto fail;
1511             }
1512         }
1513         if (!s->data_file) {
1514             error_setg(errp, "'data-file' is required for this image");
1515             ret = -EINVAL;
1516             goto fail;
1517         }
1518     } else {
1519         if (s->data_file) {
1520             error_setg(errp, "'data-file' can only be set for images with an "
1521                              "external data file");
1522             ret = -EINVAL;
1523             goto fail;
1524         }
1525 
1526         s->data_file = bs->file;
1527 
1528         if (data_file_is_raw(bs)) {
1529             error_setg(errp, "data-file-raw requires a data file");
1530             ret = -EINVAL;
1531             goto fail;
1532         }
1533     }
1534 
1535     /* qcow2_read_extension may have set up the crypto context
1536      * if the crypt method needs a header region, some methods
1537      * don't need header extensions, so must check here
1538      */
1539     if (s->crypt_method_header && !s->crypto) {
1540         if (s->crypt_method_header == QCOW_CRYPT_AES) {
1541             unsigned int cflags = 0;
1542             if (flags & BDRV_O_NO_IO) {
1543                 cflags |= QCRYPTO_BLOCK_OPEN_NO_IO;
1544             }
1545             s->crypto = qcrypto_block_open(s->crypto_opts, "encrypt.",
1546                                            NULL, NULL, cflags, 1, errp);
1547             if (!s->crypto) {
1548                 ret = -EINVAL;
1549                 goto fail;
1550             }
1551         } else if (!(flags & BDRV_O_NO_IO)) {
1552             error_setg(errp, "Missing CRYPTO header for crypt method %d",
1553                        s->crypt_method_header);
1554             ret = -EINVAL;
1555             goto fail;
1556         }
1557     }
1558 
1559     /* read the backing file name */
1560     if (header.backing_file_offset != 0) {
1561         len = header.backing_file_size;
1562         if (len > MIN(1023, s->cluster_size - header.backing_file_offset) ||
1563             len >= sizeof(bs->backing_file)) {
1564             error_setg(errp, "Backing file name too long");
1565             ret = -EINVAL;
1566             goto fail;
1567         }
1568         ret = bdrv_pread(bs->file, header.backing_file_offset,
1569                          bs->auto_backing_file, len);
1570         if (ret < 0) {
1571             error_setg_errno(errp, -ret, "Could not read backing file name");
1572             goto fail;
1573         }
1574         bs->auto_backing_file[len] = '\0';
1575         pstrcpy(bs->backing_file, sizeof(bs->backing_file),
1576                 bs->auto_backing_file);
1577         s->image_backing_file = g_strdup(bs->auto_backing_file);
1578     }
1579 
1580     /* Internal snapshots */
1581     s->snapshots_offset = header.snapshots_offset;
1582     s->nb_snapshots = header.nb_snapshots;
1583 
1584     ret = qcow2_read_snapshots(bs);
1585     if (ret < 0) {
1586         error_setg_errno(errp, -ret, "Could not read snapshots");
1587         goto fail;
1588     }
1589 
1590     /* Clear unknown autoclear feature bits */
1591     update_header |= s->autoclear_features & ~QCOW2_AUTOCLEAR_MASK;
1592     update_header =
1593         update_header && !bs->read_only && !(flags & BDRV_O_INACTIVE);
1594     if (update_header) {
1595         s->autoclear_features &= QCOW2_AUTOCLEAR_MASK;
1596     }
1597 
1598     /* == Handle persistent dirty bitmaps ==
1599      *
1600      * We want load dirty bitmaps in three cases:
1601      *
1602      * 1. Normal open of the disk in active mode, not related to invalidation
1603      *    after migration.
1604      *
1605      * 2. Invalidation of the target vm after pre-copy phase of migration, if
1606      *    bitmaps are _not_ migrating through migration channel, i.e.
1607      *    'dirty-bitmaps' capability is disabled.
1608      *
1609      * 3. Invalidation of source vm after failed or canceled migration.
1610      *    This is a very interesting case. There are two possible types of
1611      *    bitmaps:
1612      *
1613      *    A. Stored on inactivation and removed. They should be loaded from the
1614      *       image.
1615      *
1616      *    B. Not stored: not-persistent bitmaps and bitmaps, migrated through
1617      *       the migration channel (with dirty-bitmaps capability).
1618      *
1619      *    On the other hand, there are two possible sub-cases:
1620      *
1621      *    3.1 disk was changed by somebody else while were inactive. In this
1622      *        case all in-RAM dirty bitmaps (both persistent and not) are
1623      *        definitely invalid. And we don't have any method to determine
1624      *        this.
1625      *
1626      *        Simple and safe thing is to just drop all the bitmaps of type B on
1627      *        inactivation. But in this case we lose bitmaps in valid 4.2 case.
1628      *
1629      *        On the other hand, resuming source vm, if disk was already changed
1630      *        is a bad thing anyway: not only bitmaps, the whole vm state is
1631      *        out of sync with disk.
1632      *
1633      *        This means, that user or management tool, who for some reason
1634      *        decided to resume source vm, after disk was already changed by
1635      *        target vm, should at least drop all dirty bitmaps by hand.
1636      *
1637      *        So, we can ignore this case for now, but TODO: "generation"
1638      *        extension for qcow2, to determine, that image was changed after
1639      *        last inactivation. And if it is changed, we will drop (or at least
1640      *        mark as 'invalid' all the bitmaps of type B, both persistent
1641      *        and not).
1642      *
1643      *    3.2 disk was _not_ changed while were inactive. Bitmaps may be saved
1644      *        to disk ('dirty-bitmaps' capability disabled), or not saved
1645      *        ('dirty-bitmaps' capability enabled), but we don't need to care
1646      *        of: let's load bitmaps as always: stored bitmaps will be loaded,
1647      *        and not stored has flag IN_USE=1 in the image and will be skipped
1648      *        on loading.
1649      *
1650      * One remaining possible case when we don't want load bitmaps:
1651      *
1652      * 4. Open disk in inactive mode in target vm (bitmaps are migrating or
1653      *    will be loaded on invalidation, no needs try loading them before)
1654      */
1655 
1656     if (!(bdrv_get_flags(bs) & BDRV_O_INACTIVE)) {
1657         /* It's case 1, 2 or 3.2. Or 3.1 which is BUG in management layer. */
1658         bool header_updated = qcow2_load_dirty_bitmaps(bs, &local_err);
1659 
1660         update_header = update_header && !header_updated;
1661     }
1662     if (local_err != NULL) {
1663         error_propagate(errp, local_err);
1664         ret = -EINVAL;
1665         goto fail;
1666     }
1667 
1668     if (update_header) {
1669         ret = qcow2_update_header(bs);
1670         if (ret < 0) {
1671             error_setg_errno(errp, -ret, "Could not update qcow2 header");
1672             goto fail;
1673         }
1674     }
1675 
1676     bs->supported_zero_flags = header.version >= 3 ? BDRV_REQ_MAY_UNMAP : 0;
1677 
1678     /* Repair image if dirty */
1679     if (!(flags & (BDRV_O_CHECK | BDRV_O_INACTIVE)) && !bs->read_only &&
1680         (s->incompatible_features & QCOW2_INCOMPAT_DIRTY)) {
1681         BdrvCheckResult result = {0};
1682 
1683         ret = qcow2_co_check_locked(bs, &result,
1684                                     BDRV_FIX_ERRORS | BDRV_FIX_LEAKS);
1685         if (ret < 0 || result.check_errors) {
1686             if (ret >= 0) {
1687                 ret = -EIO;
1688             }
1689             error_setg_errno(errp, -ret, "Could not repair dirty image");
1690             goto fail;
1691         }
1692     }
1693 
1694 #ifdef DEBUG_ALLOC
1695     {
1696         BdrvCheckResult result = {0};
1697         qcow2_check_refcounts(bs, &result, 0);
1698     }
1699 #endif
1700 
1701     qemu_co_queue_init(&s->compress_wait_queue);
1702 
1703     return ret;
1704 
1705  fail:
1706     g_free(s->image_data_file);
1707     if (has_data_file(bs)) {
1708         bdrv_unref_child(bs, s->data_file);
1709     }
1710     g_free(s->unknown_header_fields);
1711     cleanup_unknown_header_ext(bs);
1712     qcow2_free_snapshots(bs);
1713     qcow2_refcount_close(bs);
1714     qemu_vfree(s->l1_table);
1715     /* else pre-write overlap checks in cache_destroy may crash */
1716     s->l1_table = NULL;
1717     cache_clean_timer_del(bs);
1718     if (s->l2_table_cache) {
1719         qcow2_cache_destroy(s->l2_table_cache);
1720     }
1721     if (s->refcount_block_cache) {
1722         qcow2_cache_destroy(s->refcount_block_cache);
1723     }
1724     qcrypto_block_free(s->crypto);
1725     qapi_free_QCryptoBlockOpenOptions(s->crypto_opts);
1726     return ret;
1727 }
1728 
1729 typedef struct QCow2OpenCo {
1730     BlockDriverState *bs;
1731     QDict *options;
1732     int flags;
1733     Error **errp;
1734     int ret;
1735 } QCow2OpenCo;
1736 
1737 static void coroutine_fn qcow2_open_entry(void *opaque)
1738 {
1739     QCow2OpenCo *qoc = opaque;
1740     BDRVQcow2State *s = qoc->bs->opaque;
1741 
1742     qemu_co_mutex_lock(&s->lock);
1743     qoc->ret = qcow2_do_open(qoc->bs, qoc->options, qoc->flags, qoc->errp);
1744     qemu_co_mutex_unlock(&s->lock);
1745 }
1746 
1747 static int qcow2_open(BlockDriverState *bs, QDict *options, int flags,
1748                       Error **errp)
1749 {
1750     BDRVQcow2State *s = bs->opaque;
1751     QCow2OpenCo qoc = {
1752         .bs = bs,
1753         .options = options,
1754         .flags = flags,
1755         .errp = errp,
1756         .ret = -EINPROGRESS
1757     };
1758 
1759     bs->file = bdrv_open_child(NULL, options, "file", bs, &child_file,
1760                                false, errp);
1761     if (!bs->file) {
1762         return -EINVAL;
1763     }
1764 
1765     /* Initialise locks */
1766     qemu_co_mutex_init(&s->lock);
1767 
1768     if (qemu_in_coroutine()) {
1769         /* From bdrv_co_create.  */
1770         qcow2_open_entry(&qoc);
1771     } else {
1772         assert(qemu_get_current_aio_context() == qemu_get_aio_context());
1773         qemu_coroutine_enter(qemu_coroutine_create(qcow2_open_entry, &qoc));
1774         BDRV_POLL_WHILE(bs, qoc.ret == -EINPROGRESS);
1775     }
1776     return qoc.ret;
1777 }
1778 
1779 static void qcow2_refresh_limits(BlockDriverState *bs, Error **errp)
1780 {
1781     BDRVQcow2State *s = bs->opaque;
1782 
1783     if (bs->encrypted) {
1784         /* Encryption works on a sector granularity */
1785         bs->bl.request_alignment = qcrypto_block_get_sector_size(s->crypto);
1786     }
1787     bs->bl.pwrite_zeroes_alignment = s->cluster_size;
1788     bs->bl.pdiscard_alignment = s->cluster_size;
1789 }
1790 
1791 static int qcow2_reopen_prepare(BDRVReopenState *state,
1792                                 BlockReopenQueue *queue, Error **errp)
1793 {
1794     Qcow2ReopenState *r;
1795     int ret;
1796 
1797     r = g_new0(Qcow2ReopenState, 1);
1798     state->opaque = r;
1799 
1800     ret = qcow2_update_options_prepare(state->bs, r, state->options,
1801                                        state->flags, errp);
1802     if (ret < 0) {
1803         goto fail;
1804     }
1805 
1806     /* We need to write out any unwritten data if we reopen read-only. */
1807     if ((state->flags & BDRV_O_RDWR) == 0) {
1808         ret = qcow2_reopen_bitmaps_ro(state->bs, errp);
1809         if (ret < 0) {
1810             goto fail;
1811         }
1812 
1813         ret = bdrv_flush(state->bs);
1814         if (ret < 0) {
1815             goto fail;
1816         }
1817 
1818         ret = qcow2_mark_clean(state->bs);
1819         if (ret < 0) {
1820             goto fail;
1821         }
1822     }
1823 
1824     return 0;
1825 
1826 fail:
1827     qcow2_update_options_abort(state->bs, r);
1828     g_free(r);
1829     return ret;
1830 }
1831 
1832 static void qcow2_reopen_commit(BDRVReopenState *state)
1833 {
1834     qcow2_update_options_commit(state->bs, state->opaque);
1835     g_free(state->opaque);
1836 }
1837 
1838 static void qcow2_reopen_abort(BDRVReopenState *state)
1839 {
1840     qcow2_update_options_abort(state->bs, state->opaque);
1841     g_free(state->opaque);
1842 }
1843 
1844 static void qcow2_join_options(QDict *options, QDict *old_options)
1845 {
1846     bool has_new_overlap_template =
1847         qdict_haskey(options, QCOW2_OPT_OVERLAP) ||
1848         qdict_haskey(options, QCOW2_OPT_OVERLAP_TEMPLATE);
1849     bool has_new_total_cache_size =
1850         qdict_haskey(options, QCOW2_OPT_CACHE_SIZE);
1851     bool has_all_cache_options;
1852 
1853     /* New overlap template overrides all old overlap options */
1854     if (has_new_overlap_template) {
1855         qdict_del(old_options, QCOW2_OPT_OVERLAP);
1856         qdict_del(old_options, QCOW2_OPT_OVERLAP_TEMPLATE);
1857         qdict_del(old_options, QCOW2_OPT_OVERLAP_MAIN_HEADER);
1858         qdict_del(old_options, QCOW2_OPT_OVERLAP_ACTIVE_L1);
1859         qdict_del(old_options, QCOW2_OPT_OVERLAP_ACTIVE_L2);
1860         qdict_del(old_options, QCOW2_OPT_OVERLAP_REFCOUNT_TABLE);
1861         qdict_del(old_options, QCOW2_OPT_OVERLAP_REFCOUNT_BLOCK);
1862         qdict_del(old_options, QCOW2_OPT_OVERLAP_SNAPSHOT_TABLE);
1863         qdict_del(old_options, QCOW2_OPT_OVERLAP_INACTIVE_L1);
1864         qdict_del(old_options, QCOW2_OPT_OVERLAP_INACTIVE_L2);
1865     }
1866 
1867     /* New total cache size overrides all old options */
1868     if (qdict_haskey(options, QCOW2_OPT_CACHE_SIZE)) {
1869         qdict_del(old_options, QCOW2_OPT_L2_CACHE_SIZE);
1870         qdict_del(old_options, QCOW2_OPT_REFCOUNT_CACHE_SIZE);
1871     }
1872 
1873     qdict_join(options, old_options, false);
1874 
1875     /*
1876      * If after merging all cache size options are set, an old total size is
1877      * overwritten. Do keep all options, however, if all three are new. The
1878      * resulting error message is what we want to happen.
1879      */
1880     has_all_cache_options =
1881         qdict_haskey(options, QCOW2_OPT_CACHE_SIZE) ||
1882         qdict_haskey(options, QCOW2_OPT_L2_CACHE_SIZE) ||
1883         qdict_haskey(options, QCOW2_OPT_REFCOUNT_CACHE_SIZE);
1884 
1885     if (has_all_cache_options && !has_new_total_cache_size) {
1886         qdict_del(options, QCOW2_OPT_CACHE_SIZE);
1887     }
1888 }
1889 
1890 static int coroutine_fn qcow2_co_block_status(BlockDriverState *bs,
1891                                               bool want_zero,
1892                                               int64_t offset, int64_t count,
1893                                               int64_t *pnum, int64_t *map,
1894                                               BlockDriverState **file)
1895 {
1896     BDRVQcow2State *s = bs->opaque;
1897     uint64_t cluster_offset;
1898     int index_in_cluster, ret;
1899     unsigned int bytes;
1900     int status = 0;
1901 
1902     bytes = MIN(INT_MAX, count);
1903     qemu_co_mutex_lock(&s->lock);
1904     ret = qcow2_get_cluster_offset(bs, offset, &bytes, &cluster_offset);
1905     qemu_co_mutex_unlock(&s->lock);
1906     if (ret < 0) {
1907         return ret;
1908     }
1909 
1910     *pnum = bytes;
1911 
1912     if ((ret == QCOW2_CLUSTER_NORMAL || ret == QCOW2_CLUSTER_ZERO_ALLOC) &&
1913         !s->crypto) {
1914         index_in_cluster = offset & (s->cluster_size - 1);
1915         *map = cluster_offset | index_in_cluster;
1916         *file = s->data_file->bs;
1917         status |= BDRV_BLOCK_OFFSET_VALID;
1918     }
1919     if (ret == QCOW2_CLUSTER_ZERO_PLAIN || ret == QCOW2_CLUSTER_ZERO_ALLOC) {
1920         status |= BDRV_BLOCK_ZERO;
1921     } else if (ret != QCOW2_CLUSTER_UNALLOCATED) {
1922         status |= BDRV_BLOCK_DATA;
1923     }
1924     return status;
1925 }
1926 
1927 static coroutine_fn int qcow2_handle_l2meta(BlockDriverState *bs,
1928                                             QCowL2Meta **pl2meta,
1929                                             bool link_l2)
1930 {
1931     int ret = 0;
1932     QCowL2Meta *l2meta = *pl2meta;
1933 
1934     while (l2meta != NULL) {
1935         QCowL2Meta *next;
1936 
1937         if (link_l2) {
1938             ret = qcow2_alloc_cluster_link_l2(bs, l2meta);
1939             if (ret) {
1940                 goto out;
1941             }
1942         } else {
1943             qcow2_alloc_cluster_abort(bs, l2meta);
1944         }
1945 
1946         /* Take the request off the list of running requests */
1947         if (l2meta->nb_clusters != 0) {
1948             QLIST_REMOVE(l2meta, next_in_flight);
1949         }
1950 
1951         qemu_co_queue_restart_all(&l2meta->dependent_requests);
1952 
1953         next = l2meta->next;
1954         g_free(l2meta);
1955         l2meta = next;
1956     }
1957 out:
1958     *pl2meta = l2meta;
1959     return ret;
1960 }
1961 
1962 static coroutine_fn int qcow2_co_preadv(BlockDriverState *bs, uint64_t offset,
1963                                         uint64_t bytes, QEMUIOVector *qiov,
1964                                         int flags)
1965 {
1966     BDRVQcow2State *s = bs->opaque;
1967     int offset_in_cluster;
1968     int ret;
1969     unsigned int cur_bytes; /* number of bytes in current iteration */
1970     uint64_t cluster_offset = 0;
1971     uint64_t bytes_done = 0;
1972     QEMUIOVector hd_qiov;
1973     uint8_t *cluster_data = NULL;
1974 
1975     qemu_iovec_init(&hd_qiov, qiov->niov);
1976 
1977     qemu_co_mutex_lock(&s->lock);
1978 
1979     while (bytes != 0) {
1980 
1981         /* prepare next request */
1982         cur_bytes = MIN(bytes, INT_MAX);
1983         if (s->crypto) {
1984             cur_bytes = MIN(cur_bytes,
1985                             QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size);
1986         }
1987 
1988         ret = qcow2_get_cluster_offset(bs, offset, &cur_bytes, &cluster_offset);
1989         if (ret < 0) {
1990             goto fail;
1991         }
1992 
1993         offset_in_cluster = offset_into_cluster(s, offset);
1994 
1995         qemu_iovec_reset(&hd_qiov);
1996         qemu_iovec_concat(&hd_qiov, qiov, bytes_done, cur_bytes);
1997 
1998         switch (ret) {
1999         case QCOW2_CLUSTER_UNALLOCATED:
2000 
2001             if (bs->backing) {
2002                 BLKDBG_EVENT(bs->file, BLKDBG_READ_BACKING_AIO);
2003                 qemu_co_mutex_unlock(&s->lock);
2004                 ret = bdrv_co_preadv(bs->backing, offset, cur_bytes,
2005                                      &hd_qiov, 0);
2006                 qemu_co_mutex_lock(&s->lock);
2007                 if (ret < 0) {
2008                     goto fail;
2009                 }
2010             } else {
2011                 /* Note: in this case, no need to wait */
2012                 qemu_iovec_memset(&hd_qiov, 0, 0, cur_bytes);
2013             }
2014             break;
2015 
2016         case QCOW2_CLUSTER_ZERO_PLAIN:
2017         case QCOW2_CLUSTER_ZERO_ALLOC:
2018             qemu_iovec_memset(&hd_qiov, 0, 0, cur_bytes);
2019             break;
2020 
2021         case QCOW2_CLUSTER_COMPRESSED:
2022             qemu_co_mutex_unlock(&s->lock);
2023             ret = qcow2_co_preadv_compressed(bs, cluster_offset,
2024                                              offset, cur_bytes,
2025                                              &hd_qiov);
2026             qemu_co_mutex_lock(&s->lock);
2027             if (ret < 0) {
2028                 goto fail;
2029             }
2030 
2031             break;
2032 
2033         case QCOW2_CLUSTER_NORMAL:
2034             if ((cluster_offset & 511) != 0) {
2035                 ret = -EIO;
2036                 goto fail;
2037             }
2038 
2039             if (bs->encrypted) {
2040                 assert(s->crypto);
2041 
2042                 /*
2043                  * For encrypted images, read everything into a temporary
2044                  * contiguous buffer on which the AES functions can work.
2045                  */
2046                 if (!cluster_data) {
2047                     cluster_data =
2048                         qemu_try_blockalign(s->data_file->bs,
2049                                             QCOW_MAX_CRYPT_CLUSTERS
2050                                             * s->cluster_size);
2051                     if (cluster_data == NULL) {
2052                         ret = -ENOMEM;
2053                         goto fail;
2054                     }
2055                 }
2056 
2057                 assert(cur_bytes <= QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size);
2058                 qemu_iovec_reset(&hd_qiov);
2059                 qemu_iovec_add(&hd_qiov, cluster_data, cur_bytes);
2060             }
2061 
2062             BLKDBG_EVENT(bs->file, BLKDBG_READ_AIO);
2063             qemu_co_mutex_unlock(&s->lock);
2064             ret = bdrv_co_preadv(s->data_file,
2065                                  cluster_offset + offset_in_cluster,
2066                                  cur_bytes, &hd_qiov, 0);
2067             qemu_co_mutex_lock(&s->lock);
2068             if (ret < 0) {
2069                 goto fail;
2070             }
2071             if (bs->encrypted) {
2072                 assert(s->crypto);
2073                 assert((offset & (BDRV_SECTOR_SIZE - 1)) == 0);
2074                 assert((cur_bytes & (BDRV_SECTOR_SIZE - 1)) == 0);
2075                 if (qcrypto_block_decrypt(s->crypto,
2076                                           (s->crypt_physical_offset ?
2077                                            cluster_offset + offset_in_cluster :
2078                                            offset),
2079                                           cluster_data,
2080                                           cur_bytes,
2081                                           NULL) < 0) {
2082                     ret = -EIO;
2083                     goto fail;
2084                 }
2085                 qemu_iovec_from_buf(qiov, bytes_done, cluster_data, cur_bytes);
2086             }
2087             break;
2088 
2089         default:
2090             g_assert_not_reached();
2091             ret = -EIO;
2092             goto fail;
2093         }
2094 
2095         bytes -= cur_bytes;
2096         offset += cur_bytes;
2097         bytes_done += cur_bytes;
2098     }
2099     ret = 0;
2100 
2101 fail:
2102     qemu_co_mutex_unlock(&s->lock);
2103 
2104     qemu_iovec_destroy(&hd_qiov);
2105     qemu_vfree(cluster_data);
2106 
2107     return ret;
2108 }
2109 
2110 /* Check if it's possible to merge a write request with the writing of
2111  * the data from the COW regions */
2112 static bool merge_cow(uint64_t offset, unsigned bytes,
2113                       QEMUIOVector *hd_qiov, QCowL2Meta *l2meta)
2114 {
2115     QCowL2Meta *m;
2116 
2117     for (m = l2meta; m != NULL; m = m->next) {
2118         /* If both COW regions are empty then there's nothing to merge */
2119         if (m->cow_start.nb_bytes == 0 && m->cow_end.nb_bytes == 0) {
2120             continue;
2121         }
2122 
2123         /* The data (middle) region must be immediately after the
2124          * start region */
2125         if (l2meta_cow_start(m) + m->cow_start.nb_bytes != offset) {
2126             continue;
2127         }
2128 
2129         /* The end region must be immediately after the data (middle)
2130          * region */
2131         if (m->offset + m->cow_end.offset != offset + bytes) {
2132             continue;
2133         }
2134 
2135         /* Make sure that adding both COW regions to the QEMUIOVector
2136          * does not exceed IOV_MAX */
2137         if (hd_qiov->niov > IOV_MAX - 2) {
2138             continue;
2139         }
2140 
2141         m->data_qiov = hd_qiov;
2142         return true;
2143     }
2144 
2145     return false;
2146 }
2147 
2148 static coroutine_fn int qcow2_co_pwritev(BlockDriverState *bs, uint64_t offset,
2149                                          uint64_t bytes, QEMUIOVector *qiov,
2150                                          int flags)
2151 {
2152     BDRVQcow2State *s = bs->opaque;
2153     int offset_in_cluster;
2154     int ret;
2155     unsigned int cur_bytes; /* number of sectors in current iteration */
2156     uint64_t cluster_offset;
2157     QEMUIOVector hd_qiov;
2158     uint64_t bytes_done = 0;
2159     uint8_t *cluster_data = NULL;
2160     QCowL2Meta *l2meta = NULL;
2161 
2162     trace_qcow2_writev_start_req(qemu_coroutine_self(), offset, bytes);
2163 
2164     qemu_iovec_init(&hd_qiov, qiov->niov);
2165 
2166     qemu_co_mutex_lock(&s->lock);
2167 
2168     while (bytes != 0) {
2169 
2170         l2meta = NULL;
2171 
2172         trace_qcow2_writev_start_part(qemu_coroutine_self());
2173         offset_in_cluster = offset_into_cluster(s, offset);
2174         cur_bytes = MIN(bytes, INT_MAX);
2175         if (bs->encrypted) {
2176             cur_bytes = MIN(cur_bytes,
2177                             QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size
2178                             - offset_in_cluster);
2179         }
2180 
2181         ret = qcow2_alloc_cluster_offset(bs, offset, &cur_bytes,
2182                                          &cluster_offset, &l2meta);
2183         if (ret < 0) {
2184             goto fail;
2185         }
2186 
2187         assert((cluster_offset & 511) == 0);
2188 
2189         qemu_iovec_reset(&hd_qiov);
2190         qemu_iovec_concat(&hd_qiov, qiov, bytes_done, cur_bytes);
2191 
2192         if (bs->encrypted) {
2193             assert(s->crypto);
2194             if (!cluster_data) {
2195                 cluster_data = qemu_try_blockalign(bs->file->bs,
2196                                                    QCOW_MAX_CRYPT_CLUSTERS
2197                                                    * s->cluster_size);
2198                 if (cluster_data == NULL) {
2199                     ret = -ENOMEM;
2200                     goto fail;
2201                 }
2202             }
2203 
2204             assert(hd_qiov.size <=
2205                    QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size);
2206             qemu_iovec_to_buf(&hd_qiov, 0, cluster_data, hd_qiov.size);
2207 
2208             if (qcrypto_block_encrypt(s->crypto,
2209                                       (s->crypt_physical_offset ?
2210                                        cluster_offset + offset_in_cluster :
2211                                        offset),
2212                                       cluster_data,
2213                                       cur_bytes, NULL) < 0) {
2214                 ret = -EIO;
2215                 goto fail;
2216             }
2217 
2218             qemu_iovec_reset(&hd_qiov);
2219             qemu_iovec_add(&hd_qiov, cluster_data, cur_bytes);
2220         }
2221 
2222         ret = qcow2_pre_write_overlap_check(bs, 0,
2223                 cluster_offset + offset_in_cluster, cur_bytes, true);
2224         if (ret < 0) {
2225             goto fail;
2226         }
2227 
2228         /* If we need to do COW, check if it's possible to merge the
2229          * writing of the guest data together with that of the COW regions.
2230          * If it's not possible (or not necessary) then write the
2231          * guest data now. */
2232         if (!merge_cow(offset, cur_bytes, &hd_qiov, l2meta)) {
2233             qemu_co_mutex_unlock(&s->lock);
2234             BLKDBG_EVENT(bs->file, BLKDBG_WRITE_AIO);
2235             trace_qcow2_writev_data(qemu_coroutine_self(),
2236                                     cluster_offset + offset_in_cluster);
2237             ret = bdrv_co_pwritev(s->data_file,
2238                                   cluster_offset + offset_in_cluster,
2239                                   cur_bytes, &hd_qiov, 0);
2240             qemu_co_mutex_lock(&s->lock);
2241             if (ret < 0) {
2242                 goto fail;
2243             }
2244         }
2245 
2246         ret = qcow2_handle_l2meta(bs, &l2meta, true);
2247         if (ret) {
2248             goto fail;
2249         }
2250 
2251         bytes -= cur_bytes;
2252         offset += cur_bytes;
2253         bytes_done += cur_bytes;
2254         trace_qcow2_writev_done_part(qemu_coroutine_self(), cur_bytes);
2255     }
2256     ret = 0;
2257 
2258 fail:
2259     qcow2_handle_l2meta(bs, &l2meta, false);
2260 
2261     qemu_co_mutex_unlock(&s->lock);
2262 
2263     qemu_iovec_destroy(&hd_qiov);
2264     qemu_vfree(cluster_data);
2265     trace_qcow2_writev_done_req(qemu_coroutine_self(), ret);
2266 
2267     return ret;
2268 }
2269 
2270 static int qcow2_inactivate(BlockDriverState *bs)
2271 {
2272     BDRVQcow2State *s = bs->opaque;
2273     int ret, result = 0;
2274     Error *local_err = NULL;
2275 
2276     qcow2_store_persistent_dirty_bitmaps(bs, &local_err);
2277     if (local_err != NULL) {
2278         result = -EINVAL;
2279         error_reportf_err(local_err, "Lost persistent bitmaps during "
2280                           "inactivation of node '%s': ",
2281                           bdrv_get_device_or_node_name(bs));
2282     }
2283 
2284     ret = qcow2_cache_flush(bs, s->l2_table_cache);
2285     if (ret) {
2286         result = ret;
2287         error_report("Failed to flush the L2 table cache: %s",
2288                      strerror(-ret));
2289     }
2290 
2291     ret = qcow2_cache_flush(bs, s->refcount_block_cache);
2292     if (ret) {
2293         result = ret;
2294         error_report("Failed to flush the refcount block cache: %s",
2295                      strerror(-ret));
2296     }
2297 
2298     if (result == 0) {
2299         qcow2_mark_clean(bs);
2300     }
2301 
2302     return result;
2303 }
2304 
2305 static void qcow2_close(BlockDriverState *bs)
2306 {
2307     BDRVQcow2State *s = bs->opaque;
2308     qemu_vfree(s->l1_table);
2309     /* else pre-write overlap checks in cache_destroy may crash */
2310     s->l1_table = NULL;
2311 
2312     if (!(s->flags & BDRV_O_INACTIVE)) {
2313         qcow2_inactivate(bs);
2314     }
2315 
2316     cache_clean_timer_del(bs);
2317     qcow2_cache_destroy(s->l2_table_cache);
2318     qcow2_cache_destroy(s->refcount_block_cache);
2319 
2320     qcrypto_block_free(s->crypto);
2321     s->crypto = NULL;
2322 
2323     g_free(s->unknown_header_fields);
2324     cleanup_unknown_header_ext(bs);
2325 
2326     g_free(s->image_data_file);
2327     g_free(s->image_backing_file);
2328     g_free(s->image_backing_format);
2329 
2330     if (has_data_file(bs)) {
2331         bdrv_unref_child(bs, s->data_file);
2332     }
2333 
2334     qcow2_refcount_close(bs);
2335     qcow2_free_snapshots(bs);
2336 }
2337 
2338 static void coroutine_fn qcow2_co_invalidate_cache(BlockDriverState *bs,
2339                                                    Error **errp)
2340 {
2341     BDRVQcow2State *s = bs->opaque;
2342     int flags = s->flags;
2343     QCryptoBlock *crypto = NULL;
2344     QDict *options;
2345     Error *local_err = NULL;
2346     int ret;
2347 
2348     /*
2349      * Backing files are read-only which makes all of their metadata immutable,
2350      * that means we don't have to worry about reopening them here.
2351      */
2352 
2353     crypto = s->crypto;
2354     s->crypto = NULL;
2355 
2356     qcow2_close(bs);
2357 
2358     memset(s, 0, sizeof(BDRVQcow2State));
2359     options = qdict_clone_shallow(bs->options);
2360 
2361     flags &= ~BDRV_O_INACTIVE;
2362     qemu_co_mutex_lock(&s->lock);
2363     ret = qcow2_do_open(bs, options, flags, &local_err);
2364     qemu_co_mutex_unlock(&s->lock);
2365     qobject_unref(options);
2366     if (local_err) {
2367         error_propagate_prepend(errp, local_err,
2368                                 "Could not reopen qcow2 layer: ");
2369         bs->drv = NULL;
2370         return;
2371     } else if (ret < 0) {
2372         error_setg_errno(errp, -ret, "Could not reopen qcow2 layer");
2373         bs->drv = NULL;
2374         return;
2375     }
2376 
2377     s->crypto = crypto;
2378 }
2379 
2380 static size_t header_ext_add(char *buf, uint32_t magic, const void *s,
2381     size_t len, size_t buflen)
2382 {
2383     QCowExtension *ext_backing_fmt = (QCowExtension*) buf;
2384     size_t ext_len = sizeof(QCowExtension) + ((len + 7) & ~7);
2385 
2386     if (buflen < ext_len) {
2387         return -ENOSPC;
2388     }
2389 
2390     *ext_backing_fmt = (QCowExtension) {
2391         .magic  = cpu_to_be32(magic),
2392         .len    = cpu_to_be32(len),
2393     };
2394 
2395     if (len) {
2396         memcpy(buf + sizeof(QCowExtension), s, len);
2397     }
2398 
2399     return ext_len;
2400 }
2401 
2402 /*
2403  * Updates the qcow2 header, including the variable length parts of it, i.e.
2404  * the backing file name and all extensions. qcow2 was not designed to allow
2405  * such changes, so if we run out of space (we can only use the first cluster)
2406  * this function may fail.
2407  *
2408  * Returns 0 on success, -errno in error cases.
2409  */
2410 int qcow2_update_header(BlockDriverState *bs)
2411 {
2412     BDRVQcow2State *s = bs->opaque;
2413     QCowHeader *header;
2414     char *buf;
2415     size_t buflen = s->cluster_size;
2416     int ret;
2417     uint64_t total_size;
2418     uint32_t refcount_table_clusters;
2419     size_t header_length;
2420     Qcow2UnknownHeaderExtension *uext;
2421 
2422     buf = qemu_blockalign(bs, buflen);
2423 
2424     /* Header structure */
2425     header = (QCowHeader*) buf;
2426 
2427     if (buflen < sizeof(*header)) {
2428         ret = -ENOSPC;
2429         goto fail;
2430     }
2431 
2432     header_length = sizeof(*header) + s->unknown_header_fields_size;
2433     total_size = bs->total_sectors * BDRV_SECTOR_SIZE;
2434     refcount_table_clusters = s->refcount_table_size >> (s->cluster_bits - 3);
2435 
2436     *header = (QCowHeader) {
2437         /* Version 2 fields */
2438         .magic                  = cpu_to_be32(QCOW_MAGIC),
2439         .version                = cpu_to_be32(s->qcow_version),
2440         .backing_file_offset    = 0,
2441         .backing_file_size      = 0,
2442         .cluster_bits           = cpu_to_be32(s->cluster_bits),
2443         .size                   = cpu_to_be64(total_size),
2444         .crypt_method           = cpu_to_be32(s->crypt_method_header),
2445         .l1_size                = cpu_to_be32(s->l1_size),
2446         .l1_table_offset        = cpu_to_be64(s->l1_table_offset),
2447         .refcount_table_offset  = cpu_to_be64(s->refcount_table_offset),
2448         .refcount_table_clusters = cpu_to_be32(refcount_table_clusters),
2449         .nb_snapshots           = cpu_to_be32(s->nb_snapshots),
2450         .snapshots_offset       = cpu_to_be64(s->snapshots_offset),
2451 
2452         /* Version 3 fields */
2453         .incompatible_features  = cpu_to_be64(s->incompatible_features),
2454         .compatible_features    = cpu_to_be64(s->compatible_features),
2455         .autoclear_features     = cpu_to_be64(s->autoclear_features),
2456         .refcount_order         = cpu_to_be32(s->refcount_order),
2457         .header_length          = cpu_to_be32(header_length),
2458     };
2459 
2460     /* For older versions, write a shorter header */
2461     switch (s->qcow_version) {
2462     case 2:
2463         ret = offsetof(QCowHeader, incompatible_features);
2464         break;
2465     case 3:
2466         ret = sizeof(*header);
2467         break;
2468     default:
2469         ret = -EINVAL;
2470         goto fail;
2471     }
2472 
2473     buf += ret;
2474     buflen -= ret;
2475     memset(buf, 0, buflen);
2476 
2477     /* Preserve any unknown field in the header */
2478     if (s->unknown_header_fields_size) {
2479         if (buflen < s->unknown_header_fields_size) {
2480             ret = -ENOSPC;
2481             goto fail;
2482         }
2483 
2484         memcpy(buf, s->unknown_header_fields, s->unknown_header_fields_size);
2485         buf += s->unknown_header_fields_size;
2486         buflen -= s->unknown_header_fields_size;
2487     }
2488 
2489     /* Backing file format header extension */
2490     if (s->image_backing_format) {
2491         ret = header_ext_add(buf, QCOW2_EXT_MAGIC_BACKING_FORMAT,
2492                              s->image_backing_format,
2493                              strlen(s->image_backing_format),
2494                              buflen);
2495         if (ret < 0) {
2496             goto fail;
2497         }
2498 
2499         buf += ret;
2500         buflen -= ret;
2501     }
2502 
2503     /* External data file header extension */
2504     if (has_data_file(bs) && s->image_data_file) {
2505         ret = header_ext_add(buf, QCOW2_EXT_MAGIC_DATA_FILE,
2506                              s->image_data_file, strlen(s->image_data_file),
2507                              buflen);
2508         if (ret < 0) {
2509             goto fail;
2510         }
2511 
2512         buf += ret;
2513         buflen -= ret;
2514     }
2515 
2516     /* Full disk encryption header pointer extension */
2517     if (s->crypto_header.offset != 0) {
2518         s->crypto_header.offset = cpu_to_be64(s->crypto_header.offset);
2519         s->crypto_header.length = cpu_to_be64(s->crypto_header.length);
2520         ret = header_ext_add(buf, QCOW2_EXT_MAGIC_CRYPTO_HEADER,
2521                              &s->crypto_header, sizeof(s->crypto_header),
2522                              buflen);
2523         s->crypto_header.offset = be64_to_cpu(s->crypto_header.offset);
2524         s->crypto_header.length = be64_to_cpu(s->crypto_header.length);
2525         if (ret < 0) {
2526             goto fail;
2527         }
2528         buf += ret;
2529         buflen -= ret;
2530     }
2531 
2532     /* Feature table */
2533     if (s->qcow_version >= 3) {
2534         Qcow2Feature features[] = {
2535             {
2536                 .type = QCOW2_FEAT_TYPE_INCOMPATIBLE,
2537                 .bit  = QCOW2_INCOMPAT_DIRTY_BITNR,
2538                 .name = "dirty bit",
2539             },
2540             {
2541                 .type = QCOW2_FEAT_TYPE_INCOMPATIBLE,
2542                 .bit  = QCOW2_INCOMPAT_CORRUPT_BITNR,
2543                 .name = "corrupt bit",
2544             },
2545             {
2546                 .type = QCOW2_FEAT_TYPE_INCOMPATIBLE,
2547                 .bit  = QCOW2_INCOMPAT_DATA_FILE_BITNR,
2548                 .name = "external data file",
2549             },
2550             {
2551                 .type = QCOW2_FEAT_TYPE_COMPATIBLE,
2552                 .bit  = QCOW2_COMPAT_LAZY_REFCOUNTS_BITNR,
2553                 .name = "lazy refcounts",
2554             },
2555         };
2556 
2557         ret = header_ext_add(buf, QCOW2_EXT_MAGIC_FEATURE_TABLE,
2558                              features, sizeof(features), buflen);
2559         if (ret < 0) {
2560             goto fail;
2561         }
2562         buf += ret;
2563         buflen -= ret;
2564     }
2565 
2566     /* Bitmap extension */
2567     if (s->nb_bitmaps > 0) {
2568         Qcow2BitmapHeaderExt bitmaps_header = {
2569             .nb_bitmaps = cpu_to_be32(s->nb_bitmaps),
2570             .bitmap_directory_size =
2571                     cpu_to_be64(s->bitmap_directory_size),
2572             .bitmap_directory_offset =
2573                     cpu_to_be64(s->bitmap_directory_offset)
2574         };
2575         ret = header_ext_add(buf, QCOW2_EXT_MAGIC_BITMAPS,
2576                              &bitmaps_header, sizeof(bitmaps_header),
2577                              buflen);
2578         if (ret < 0) {
2579             goto fail;
2580         }
2581         buf += ret;
2582         buflen -= ret;
2583     }
2584 
2585     /* Keep unknown header extensions */
2586     QLIST_FOREACH(uext, &s->unknown_header_ext, next) {
2587         ret = header_ext_add(buf, uext->magic, uext->data, uext->len, buflen);
2588         if (ret < 0) {
2589             goto fail;
2590         }
2591 
2592         buf += ret;
2593         buflen -= ret;
2594     }
2595 
2596     /* End of header extensions */
2597     ret = header_ext_add(buf, QCOW2_EXT_MAGIC_END, NULL, 0, buflen);
2598     if (ret < 0) {
2599         goto fail;
2600     }
2601 
2602     buf += ret;
2603     buflen -= ret;
2604 
2605     /* Backing file name */
2606     if (s->image_backing_file) {
2607         size_t backing_file_len = strlen(s->image_backing_file);
2608 
2609         if (buflen < backing_file_len) {
2610             ret = -ENOSPC;
2611             goto fail;
2612         }
2613 
2614         /* Using strncpy is ok here, since buf is not NUL-terminated. */
2615         strncpy(buf, s->image_backing_file, buflen);
2616 
2617         header->backing_file_offset = cpu_to_be64(buf - ((char*) header));
2618         header->backing_file_size   = cpu_to_be32(backing_file_len);
2619     }
2620 
2621     /* Write the new header */
2622     ret = bdrv_pwrite(bs->file, 0, header, s->cluster_size);
2623     if (ret < 0) {
2624         goto fail;
2625     }
2626 
2627     ret = 0;
2628 fail:
2629     qemu_vfree(header);
2630     return ret;
2631 }
2632 
2633 static int qcow2_change_backing_file(BlockDriverState *bs,
2634     const char *backing_file, const char *backing_fmt)
2635 {
2636     BDRVQcow2State *s = bs->opaque;
2637 
2638     /* Adding a backing file means that the external data file alone won't be
2639      * enough to make sense of the content */
2640     if (backing_file && data_file_is_raw(bs)) {
2641         return -EINVAL;
2642     }
2643 
2644     if (backing_file && strlen(backing_file) > 1023) {
2645         return -EINVAL;
2646     }
2647 
2648     pstrcpy(bs->auto_backing_file, sizeof(bs->auto_backing_file),
2649             backing_file ?: "");
2650     pstrcpy(bs->backing_file, sizeof(bs->backing_file), backing_file ?: "");
2651     pstrcpy(bs->backing_format, sizeof(bs->backing_format), backing_fmt ?: "");
2652 
2653     g_free(s->image_backing_file);
2654     g_free(s->image_backing_format);
2655 
2656     s->image_backing_file = backing_file ? g_strdup(bs->backing_file) : NULL;
2657     s->image_backing_format = backing_fmt ? g_strdup(bs->backing_format) : NULL;
2658 
2659     return qcow2_update_header(bs);
2660 }
2661 
2662 static int qcow2_crypt_method_from_format(const char *encryptfmt)
2663 {
2664     if (g_str_equal(encryptfmt, "luks")) {
2665         return QCOW_CRYPT_LUKS;
2666     } else if (g_str_equal(encryptfmt, "aes")) {
2667         return QCOW_CRYPT_AES;
2668     } else {
2669         return -EINVAL;
2670     }
2671 }
2672 
2673 static int qcow2_set_up_encryption(BlockDriverState *bs,
2674                                    QCryptoBlockCreateOptions *cryptoopts,
2675                                    Error **errp)
2676 {
2677     BDRVQcow2State *s = bs->opaque;
2678     QCryptoBlock *crypto = NULL;
2679     int fmt, ret;
2680 
2681     switch (cryptoopts->format) {
2682     case Q_CRYPTO_BLOCK_FORMAT_LUKS:
2683         fmt = QCOW_CRYPT_LUKS;
2684         break;
2685     case Q_CRYPTO_BLOCK_FORMAT_QCOW:
2686         fmt = QCOW_CRYPT_AES;
2687         break;
2688     default:
2689         error_setg(errp, "Crypto format not supported in qcow2");
2690         return -EINVAL;
2691     }
2692 
2693     s->crypt_method_header = fmt;
2694 
2695     crypto = qcrypto_block_create(cryptoopts, "encrypt.",
2696                                   qcow2_crypto_hdr_init_func,
2697                                   qcow2_crypto_hdr_write_func,
2698                                   bs, errp);
2699     if (!crypto) {
2700         return -EINVAL;
2701     }
2702 
2703     ret = qcow2_update_header(bs);
2704     if (ret < 0) {
2705         error_setg_errno(errp, -ret, "Could not write encryption header");
2706         goto out;
2707     }
2708 
2709     ret = 0;
2710  out:
2711     qcrypto_block_free(crypto);
2712     return ret;
2713 }
2714 
2715 /**
2716  * Preallocates metadata structures for data clusters between @offset (in the
2717  * guest disk) and @new_length (which is thus generally the new guest disk
2718  * size).
2719  *
2720  * Returns: 0 on success, -errno on failure.
2721  */
2722 static int coroutine_fn preallocate_co(BlockDriverState *bs, uint64_t offset,
2723                                        uint64_t new_length, PreallocMode mode,
2724                                        Error **errp)
2725 {
2726     BDRVQcow2State *s = bs->opaque;
2727     uint64_t bytes;
2728     uint64_t host_offset = 0;
2729     int64_t file_length;
2730     unsigned int cur_bytes;
2731     int ret;
2732     QCowL2Meta *meta;
2733 
2734     assert(offset <= new_length);
2735     bytes = new_length - offset;
2736 
2737     while (bytes) {
2738         cur_bytes = MIN(bytes, QEMU_ALIGN_DOWN(INT_MAX, s->cluster_size));
2739         ret = qcow2_alloc_cluster_offset(bs, offset, &cur_bytes,
2740                                          &host_offset, &meta);
2741         if (ret < 0) {
2742             error_setg_errno(errp, -ret, "Allocating clusters failed");
2743             return ret;
2744         }
2745 
2746         while (meta) {
2747             QCowL2Meta *next = meta->next;
2748 
2749             ret = qcow2_alloc_cluster_link_l2(bs, meta);
2750             if (ret < 0) {
2751                 error_setg_errno(errp, -ret, "Mapping clusters failed");
2752                 qcow2_free_any_clusters(bs, meta->alloc_offset,
2753                                         meta->nb_clusters, QCOW2_DISCARD_NEVER);
2754                 return ret;
2755             }
2756 
2757             /* There are no dependent requests, but we need to remove our
2758              * request from the list of in-flight requests */
2759             QLIST_REMOVE(meta, next_in_flight);
2760 
2761             g_free(meta);
2762             meta = next;
2763         }
2764 
2765         /* TODO Preallocate data if requested */
2766 
2767         bytes -= cur_bytes;
2768         offset += cur_bytes;
2769     }
2770 
2771     /*
2772      * It is expected that the image file is large enough to actually contain
2773      * all of the allocated clusters (otherwise we get failing reads after
2774      * EOF). Extend the image to the last allocated sector.
2775      */
2776     file_length = bdrv_getlength(s->data_file->bs);
2777     if (file_length < 0) {
2778         error_setg_errno(errp, -file_length, "Could not get file size");
2779         return file_length;
2780     }
2781 
2782     if (host_offset + cur_bytes > file_length) {
2783         if (mode == PREALLOC_MODE_METADATA) {
2784             mode = PREALLOC_MODE_OFF;
2785         }
2786         ret = bdrv_co_truncate(s->data_file, host_offset + cur_bytes, mode,
2787                                errp);
2788         if (ret < 0) {
2789             return ret;
2790         }
2791     }
2792 
2793     return 0;
2794 }
2795 
2796 /* qcow2_refcount_metadata_size:
2797  * @clusters: number of clusters to refcount (including data and L1/L2 tables)
2798  * @cluster_size: size of a cluster, in bytes
2799  * @refcount_order: refcount bits power-of-2 exponent
2800  * @generous_increase: allow for the refcount table to be 1.5x as large as it
2801  *                     needs to be
2802  *
2803  * Returns: Number of bytes required for refcount blocks and table metadata.
2804  */
2805 int64_t qcow2_refcount_metadata_size(int64_t clusters, size_t cluster_size,
2806                                      int refcount_order, bool generous_increase,
2807                                      uint64_t *refblock_count)
2808 {
2809     /*
2810      * Every host cluster is reference-counted, including metadata (even
2811      * refcount metadata is recursively included).
2812      *
2813      * An accurate formula for the size of refcount metadata size is difficult
2814      * to derive.  An easier method of calculation is finding the fixed point
2815      * where no further refcount blocks or table clusters are required to
2816      * reference count every cluster.
2817      */
2818     int64_t blocks_per_table_cluster = cluster_size / sizeof(uint64_t);
2819     int64_t refcounts_per_block = cluster_size * 8 / (1 << refcount_order);
2820     int64_t table = 0;  /* number of refcount table clusters */
2821     int64_t blocks = 0; /* number of refcount block clusters */
2822     int64_t last;
2823     int64_t n = 0;
2824 
2825     do {
2826         last = n;
2827         blocks = DIV_ROUND_UP(clusters + table + blocks, refcounts_per_block);
2828         table = DIV_ROUND_UP(blocks, blocks_per_table_cluster);
2829         n = clusters + blocks + table;
2830 
2831         if (n == last && generous_increase) {
2832             clusters += DIV_ROUND_UP(table, 2);
2833             n = 0; /* force another loop */
2834             generous_increase = false;
2835         }
2836     } while (n != last);
2837 
2838     if (refblock_count) {
2839         *refblock_count = blocks;
2840     }
2841 
2842     return (blocks + table) * cluster_size;
2843 }
2844 
2845 /**
2846  * qcow2_calc_prealloc_size:
2847  * @total_size: virtual disk size in bytes
2848  * @cluster_size: cluster size in bytes
2849  * @refcount_order: refcount bits power-of-2 exponent
2850  *
2851  * Returns: Total number of bytes required for the fully allocated image
2852  * (including metadata).
2853  */
2854 static int64_t qcow2_calc_prealloc_size(int64_t total_size,
2855                                         size_t cluster_size,
2856                                         int refcount_order)
2857 {
2858     int64_t meta_size = 0;
2859     uint64_t nl1e, nl2e;
2860     int64_t aligned_total_size = ROUND_UP(total_size, cluster_size);
2861 
2862     /* header: 1 cluster */
2863     meta_size += cluster_size;
2864 
2865     /* total size of L2 tables */
2866     nl2e = aligned_total_size / cluster_size;
2867     nl2e = ROUND_UP(nl2e, cluster_size / sizeof(uint64_t));
2868     meta_size += nl2e * sizeof(uint64_t);
2869 
2870     /* total size of L1 tables */
2871     nl1e = nl2e * sizeof(uint64_t) / cluster_size;
2872     nl1e = ROUND_UP(nl1e, cluster_size / sizeof(uint64_t));
2873     meta_size += nl1e * sizeof(uint64_t);
2874 
2875     /* total size of refcount table and blocks */
2876     meta_size += qcow2_refcount_metadata_size(
2877             (meta_size + aligned_total_size) / cluster_size,
2878             cluster_size, refcount_order, false, NULL);
2879 
2880     return meta_size + aligned_total_size;
2881 }
2882 
2883 static bool validate_cluster_size(size_t cluster_size, Error **errp)
2884 {
2885     int cluster_bits = ctz32(cluster_size);
2886     if (cluster_bits < MIN_CLUSTER_BITS || cluster_bits > MAX_CLUSTER_BITS ||
2887         (1 << cluster_bits) != cluster_size)
2888     {
2889         error_setg(errp, "Cluster size must be a power of two between %d and "
2890                    "%dk", 1 << MIN_CLUSTER_BITS, 1 << (MAX_CLUSTER_BITS - 10));
2891         return false;
2892     }
2893     return true;
2894 }
2895 
2896 static size_t qcow2_opt_get_cluster_size_del(QemuOpts *opts, Error **errp)
2897 {
2898     size_t cluster_size;
2899 
2900     cluster_size = qemu_opt_get_size_del(opts, BLOCK_OPT_CLUSTER_SIZE,
2901                                          DEFAULT_CLUSTER_SIZE);
2902     if (!validate_cluster_size(cluster_size, errp)) {
2903         return 0;
2904     }
2905     return cluster_size;
2906 }
2907 
2908 static int qcow2_opt_get_version_del(QemuOpts *opts, Error **errp)
2909 {
2910     char *buf;
2911     int ret;
2912 
2913     buf = qemu_opt_get_del(opts, BLOCK_OPT_COMPAT_LEVEL);
2914     if (!buf) {
2915         ret = 3; /* default */
2916     } else if (!strcmp(buf, "0.10")) {
2917         ret = 2;
2918     } else if (!strcmp(buf, "1.1")) {
2919         ret = 3;
2920     } else {
2921         error_setg(errp, "Invalid compatibility level: '%s'", buf);
2922         ret = -EINVAL;
2923     }
2924     g_free(buf);
2925     return ret;
2926 }
2927 
2928 static uint64_t qcow2_opt_get_refcount_bits_del(QemuOpts *opts, int version,
2929                                                 Error **errp)
2930 {
2931     uint64_t refcount_bits;
2932 
2933     refcount_bits = qemu_opt_get_number_del(opts, BLOCK_OPT_REFCOUNT_BITS, 16);
2934     if (refcount_bits > 64 || !is_power_of_2(refcount_bits)) {
2935         error_setg(errp, "Refcount width must be a power of two and may not "
2936                    "exceed 64 bits");
2937         return 0;
2938     }
2939 
2940     if (version < 3 && refcount_bits != 16) {
2941         error_setg(errp, "Different refcount widths than 16 bits require "
2942                    "compatibility level 1.1 or above (use compat=1.1 or "
2943                    "greater)");
2944         return 0;
2945     }
2946 
2947     return refcount_bits;
2948 }
2949 
2950 static int coroutine_fn
2951 qcow2_co_create(BlockdevCreateOptions *create_options, Error **errp)
2952 {
2953     BlockdevCreateOptionsQcow2 *qcow2_opts;
2954     QDict *options;
2955 
2956     /*
2957      * Open the image file and write a minimal qcow2 header.
2958      *
2959      * We keep things simple and start with a zero-sized image. We also
2960      * do without refcount blocks or a L1 table for now. We'll fix the
2961      * inconsistency later.
2962      *
2963      * We do need a refcount table because growing the refcount table means
2964      * allocating two new refcount blocks - the seconds of which would be at
2965      * 2 GB for 64k clusters, and we don't want to have a 2 GB initial file
2966      * size for any qcow2 image.
2967      */
2968     BlockBackend *blk = NULL;
2969     BlockDriverState *bs = NULL;
2970     BlockDriverState *data_bs = NULL;
2971     QCowHeader *header;
2972     size_t cluster_size;
2973     int version;
2974     int refcount_order;
2975     uint64_t* refcount_table;
2976     Error *local_err = NULL;
2977     int ret;
2978 
2979     assert(create_options->driver == BLOCKDEV_DRIVER_QCOW2);
2980     qcow2_opts = &create_options->u.qcow2;
2981 
2982     bs = bdrv_open_blockdev_ref(qcow2_opts->file, errp);
2983     if (bs == NULL) {
2984         return -EIO;
2985     }
2986 
2987     /* Validate options and set default values */
2988     if (!QEMU_IS_ALIGNED(qcow2_opts->size, BDRV_SECTOR_SIZE)) {
2989         error_setg(errp, "Image size must be a multiple of 512 bytes");
2990         ret = -EINVAL;
2991         goto out;
2992     }
2993 
2994     if (qcow2_opts->has_version) {
2995         switch (qcow2_opts->version) {
2996         case BLOCKDEV_QCOW2_VERSION_V2:
2997             version = 2;
2998             break;
2999         case BLOCKDEV_QCOW2_VERSION_V3:
3000             version = 3;
3001             break;
3002         default:
3003             g_assert_not_reached();
3004         }
3005     } else {
3006         version = 3;
3007     }
3008 
3009     if (qcow2_opts->has_cluster_size) {
3010         cluster_size = qcow2_opts->cluster_size;
3011     } else {
3012         cluster_size = DEFAULT_CLUSTER_SIZE;
3013     }
3014 
3015     if (!validate_cluster_size(cluster_size, errp)) {
3016         ret = -EINVAL;
3017         goto out;
3018     }
3019 
3020     if (!qcow2_opts->has_preallocation) {
3021         qcow2_opts->preallocation = PREALLOC_MODE_OFF;
3022     }
3023     if (qcow2_opts->has_backing_file &&
3024         qcow2_opts->preallocation != PREALLOC_MODE_OFF)
3025     {
3026         error_setg(errp, "Backing file and preallocation cannot be used at "
3027                    "the same time");
3028         ret = -EINVAL;
3029         goto out;
3030     }
3031     if (qcow2_opts->has_backing_fmt && !qcow2_opts->has_backing_file) {
3032         error_setg(errp, "Backing format cannot be used without backing file");
3033         ret = -EINVAL;
3034         goto out;
3035     }
3036 
3037     if (!qcow2_opts->has_lazy_refcounts) {
3038         qcow2_opts->lazy_refcounts = false;
3039     }
3040     if (version < 3 && qcow2_opts->lazy_refcounts) {
3041         error_setg(errp, "Lazy refcounts only supported with compatibility "
3042                    "level 1.1 and above (use version=v3 or greater)");
3043         ret = -EINVAL;
3044         goto out;
3045     }
3046 
3047     if (!qcow2_opts->has_refcount_bits) {
3048         qcow2_opts->refcount_bits = 16;
3049     }
3050     if (qcow2_opts->refcount_bits > 64 ||
3051         !is_power_of_2(qcow2_opts->refcount_bits))
3052     {
3053         error_setg(errp, "Refcount width must be a power of two and may not "
3054                    "exceed 64 bits");
3055         ret = -EINVAL;
3056         goto out;
3057     }
3058     if (version < 3 && qcow2_opts->refcount_bits != 16) {
3059         error_setg(errp, "Different refcount widths than 16 bits require "
3060                    "compatibility level 1.1 or above (use version=v3 or "
3061                    "greater)");
3062         ret = -EINVAL;
3063         goto out;
3064     }
3065     refcount_order = ctz32(qcow2_opts->refcount_bits);
3066 
3067     if (qcow2_opts->data_file_raw && !qcow2_opts->data_file) {
3068         error_setg(errp, "data-file-raw requires data-file");
3069         ret = -EINVAL;
3070         goto out;
3071     }
3072     if (qcow2_opts->data_file_raw && qcow2_opts->has_backing_file) {
3073         error_setg(errp, "Backing file and data-file-raw cannot be used at "
3074                    "the same time");
3075         ret = -EINVAL;
3076         goto out;
3077     }
3078 
3079     if (qcow2_opts->data_file) {
3080         if (version < 3) {
3081             error_setg(errp, "External data files are only supported with "
3082                        "compatibility level 1.1 and above (use version=v3 or "
3083                        "greater)");
3084             ret = -EINVAL;
3085             goto out;
3086         }
3087         data_bs = bdrv_open_blockdev_ref(qcow2_opts->data_file, errp);
3088         if (data_bs == NULL) {
3089             ret = -EIO;
3090             goto out;
3091         }
3092     }
3093 
3094     /* Create BlockBackend to write to the image */
3095     blk = blk_new(BLK_PERM_WRITE | BLK_PERM_RESIZE, BLK_PERM_ALL);
3096     ret = blk_insert_bs(blk, bs, errp);
3097     if (ret < 0) {
3098         goto out;
3099     }
3100     blk_set_allow_write_beyond_eof(blk, true);
3101 
3102     /* Clear the protocol layer and preallocate it if necessary */
3103     ret = blk_truncate(blk, 0, PREALLOC_MODE_OFF, errp);
3104     if (ret < 0) {
3105         goto out;
3106     }
3107 
3108     /* Write the header */
3109     QEMU_BUILD_BUG_ON((1 << MIN_CLUSTER_BITS) < sizeof(*header));
3110     header = g_malloc0(cluster_size);
3111     *header = (QCowHeader) {
3112         .magic                      = cpu_to_be32(QCOW_MAGIC),
3113         .version                    = cpu_to_be32(version),
3114         .cluster_bits               = cpu_to_be32(ctz32(cluster_size)),
3115         .size                       = cpu_to_be64(0),
3116         .l1_table_offset            = cpu_to_be64(0),
3117         .l1_size                    = cpu_to_be32(0),
3118         .refcount_table_offset      = cpu_to_be64(cluster_size),
3119         .refcount_table_clusters    = cpu_to_be32(1),
3120         .refcount_order             = cpu_to_be32(refcount_order),
3121         .header_length              = cpu_to_be32(sizeof(*header)),
3122     };
3123 
3124     /* We'll update this to correct value later */
3125     header->crypt_method = cpu_to_be32(QCOW_CRYPT_NONE);
3126 
3127     if (qcow2_opts->lazy_refcounts) {
3128         header->compatible_features |=
3129             cpu_to_be64(QCOW2_COMPAT_LAZY_REFCOUNTS);
3130     }
3131     if (data_bs) {
3132         header->incompatible_features |=
3133             cpu_to_be64(QCOW2_INCOMPAT_DATA_FILE);
3134     }
3135     if (qcow2_opts->data_file_raw) {
3136         header->autoclear_features |=
3137             cpu_to_be64(QCOW2_AUTOCLEAR_DATA_FILE_RAW);
3138     }
3139 
3140     ret = blk_pwrite(blk, 0, header, cluster_size, 0);
3141     g_free(header);
3142     if (ret < 0) {
3143         error_setg_errno(errp, -ret, "Could not write qcow2 header");
3144         goto out;
3145     }
3146 
3147     /* Write a refcount table with one refcount block */
3148     refcount_table = g_malloc0(2 * cluster_size);
3149     refcount_table[0] = cpu_to_be64(2 * cluster_size);
3150     ret = blk_pwrite(blk, cluster_size, refcount_table, 2 * cluster_size, 0);
3151     g_free(refcount_table);
3152 
3153     if (ret < 0) {
3154         error_setg_errno(errp, -ret, "Could not write refcount table");
3155         goto out;
3156     }
3157 
3158     blk_unref(blk);
3159     blk = NULL;
3160 
3161     /*
3162      * And now open the image and make it consistent first (i.e. increase the
3163      * refcount of the cluster that is occupied by the header and the refcount
3164      * table)
3165      */
3166     options = qdict_new();
3167     qdict_put_str(options, "driver", "qcow2");
3168     qdict_put_str(options, "file", bs->node_name);
3169     if (data_bs) {
3170         qdict_put_str(options, "data-file", data_bs->node_name);
3171     }
3172     blk = blk_new_open(NULL, NULL, options,
3173                        BDRV_O_RDWR | BDRV_O_RESIZE | BDRV_O_NO_FLUSH,
3174                        &local_err);
3175     if (blk == NULL) {
3176         error_propagate(errp, local_err);
3177         ret = -EIO;
3178         goto out;
3179     }
3180 
3181     ret = qcow2_alloc_clusters(blk_bs(blk), 3 * cluster_size);
3182     if (ret < 0) {
3183         error_setg_errno(errp, -ret, "Could not allocate clusters for qcow2 "
3184                          "header and refcount table");
3185         goto out;
3186 
3187     } else if (ret != 0) {
3188         error_report("Huh, first cluster in empty image is already in use?");
3189         abort();
3190     }
3191 
3192     /* Set the external data file if necessary */
3193     if (data_bs) {
3194         BDRVQcow2State *s = blk_bs(blk)->opaque;
3195         s->image_data_file = g_strdup(data_bs->filename);
3196     }
3197 
3198     /* Create a full header (including things like feature table) */
3199     ret = qcow2_update_header(blk_bs(blk));
3200     if (ret < 0) {
3201         error_setg_errno(errp, -ret, "Could not update qcow2 header");
3202         goto out;
3203     }
3204 
3205     /* Okay, now that we have a valid image, let's give it the right size */
3206     ret = blk_truncate(blk, qcow2_opts->size, qcow2_opts->preallocation, errp);
3207     if (ret < 0) {
3208         error_prepend(errp, "Could not resize image: ");
3209         goto out;
3210     }
3211 
3212     /* Want a backing file? There you go.*/
3213     if (qcow2_opts->has_backing_file) {
3214         const char *backing_format = NULL;
3215 
3216         if (qcow2_opts->has_backing_fmt) {
3217             backing_format = BlockdevDriver_str(qcow2_opts->backing_fmt);
3218         }
3219 
3220         ret = bdrv_change_backing_file(blk_bs(blk), qcow2_opts->backing_file,
3221                                        backing_format);
3222         if (ret < 0) {
3223             error_setg_errno(errp, -ret, "Could not assign backing file '%s' "
3224                              "with format '%s'", qcow2_opts->backing_file,
3225                              backing_format);
3226             goto out;
3227         }
3228     }
3229 
3230     /* Want encryption? There you go. */
3231     if (qcow2_opts->has_encrypt) {
3232         ret = qcow2_set_up_encryption(blk_bs(blk), qcow2_opts->encrypt, errp);
3233         if (ret < 0) {
3234             goto out;
3235         }
3236     }
3237 
3238     blk_unref(blk);
3239     blk = NULL;
3240 
3241     /* Reopen the image without BDRV_O_NO_FLUSH to flush it before returning.
3242      * Using BDRV_O_NO_IO, since encryption is now setup we don't want to
3243      * have to setup decryption context. We're not doing any I/O on the top
3244      * level BlockDriverState, only lower layers, where BDRV_O_NO_IO does
3245      * not have effect.
3246      */
3247     options = qdict_new();
3248     qdict_put_str(options, "driver", "qcow2");
3249     qdict_put_str(options, "file", bs->node_name);
3250     if (data_bs) {
3251         qdict_put_str(options, "data-file", data_bs->node_name);
3252     }
3253     blk = blk_new_open(NULL, NULL, options,
3254                        BDRV_O_RDWR | BDRV_O_NO_BACKING | BDRV_O_NO_IO,
3255                        &local_err);
3256     if (blk == NULL) {
3257         error_propagate(errp, local_err);
3258         ret = -EIO;
3259         goto out;
3260     }
3261 
3262     ret = 0;
3263 out:
3264     blk_unref(blk);
3265     bdrv_unref(bs);
3266     bdrv_unref(data_bs);
3267     return ret;
3268 }
3269 
3270 static int coroutine_fn qcow2_co_create_opts(const char *filename, QemuOpts *opts,
3271                                              Error **errp)
3272 {
3273     BlockdevCreateOptions *create_options = NULL;
3274     QDict *qdict;
3275     Visitor *v;
3276     BlockDriverState *bs = NULL;
3277     BlockDriverState *data_bs = NULL;
3278     Error *local_err = NULL;
3279     const char *val;
3280     int ret;
3281 
3282     /* Only the keyval visitor supports the dotted syntax needed for
3283      * encryption, so go through a QDict before getting a QAPI type. Ignore
3284      * options meant for the protocol layer so that the visitor doesn't
3285      * complain. */
3286     qdict = qemu_opts_to_qdict_filtered(opts, NULL, bdrv_qcow2.create_opts,
3287                                         true);
3288 
3289     /* Handle encryption options */
3290     val = qdict_get_try_str(qdict, BLOCK_OPT_ENCRYPT);
3291     if (val && !strcmp(val, "on")) {
3292         qdict_put_str(qdict, BLOCK_OPT_ENCRYPT, "qcow");
3293     } else if (val && !strcmp(val, "off")) {
3294         qdict_del(qdict, BLOCK_OPT_ENCRYPT);
3295     }
3296 
3297     val = qdict_get_try_str(qdict, BLOCK_OPT_ENCRYPT_FORMAT);
3298     if (val && !strcmp(val, "aes")) {
3299         qdict_put_str(qdict, BLOCK_OPT_ENCRYPT_FORMAT, "qcow");
3300     }
3301 
3302     /* Convert compat=0.10/1.1 into compat=v2/v3, to be renamed into
3303      * version=v2/v3 below. */
3304     val = qdict_get_try_str(qdict, BLOCK_OPT_COMPAT_LEVEL);
3305     if (val && !strcmp(val, "0.10")) {
3306         qdict_put_str(qdict, BLOCK_OPT_COMPAT_LEVEL, "v2");
3307     } else if (val && !strcmp(val, "1.1")) {
3308         qdict_put_str(qdict, BLOCK_OPT_COMPAT_LEVEL, "v3");
3309     }
3310 
3311     /* Change legacy command line options into QMP ones */
3312     static const QDictRenames opt_renames[] = {
3313         { BLOCK_OPT_BACKING_FILE,       "backing-file" },
3314         { BLOCK_OPT_BACKING_FMT,        "backing-fmt" },
3315         { BLOCK_OPT_CLUSTER_SIZE,       "cluster-size" },
3316         { BLOCK_OPT_LAZY_REFCOUNTS,     "lazy-refcounts" },
3317         { BLOCK_OPT_REFCOUNT_BITS,      "refcount-bits" },
3318         { BLOCK_OPT_ENCRYPT,            BLOCK_OPT_ENCRYPT_FORMAT },
3319         { BLOCK_OPT_COMPAT_LEVEL,       "version" },
3320         { BLOCK_OPT_DATA_FILE_RAW,      "data-file-raw" },
3321         { NULL, NULL },
3322     };
3323 
3324     if (!qdict_rename_keys(qdict, opt_renames, errp)) {
3325         ret = -EINVAL;
3326         goto finish;
3327     }
3328 
3329     /* Create and open the file (protocol layer) */
3330     ret = bdrv_create_file(filename, opts, errp);
3331     if (ret < 0) {
3332         goto finish;
3333     }
3334 
3335     bs = bdrv_open(filename, NULL, NULL,
3336                    BDRV_O_RDWR | BDRV_O_RESIZE | BDRV_O_PROTOCOL, errp);
3337     if (bs == NULL) {
3338         ret = -EIO;
3339         goto finish;
3340     }
3341 
3342     /* Create and open an external data file (protocol layer) */
3343     val = qdict_get_try_str(qdict, BLOCK_OPT_DATA_FILE);
3344     if (val) {
3345         ret = bdrv_create_file(val, opts, errp);
3346         if (ret < 0) {
3347             goto finish;
3348         }
3349 
3350         data_bs = bdrv_open(val, NULL, NULL,
3351                             BDRV_O_RDWR | BDRV_O_RESIZE | BDRV_O_PROTOCOL,
3352                             errp);
3353         if (data_bs == NULL) {
3354             ret = -EIO;
3355             goto finish;
3356         }
3357 
3358         qdict_del(qdict, BLOCK_OPT_DATA_FILE);
3359         qdict_put_str(qdict, "data-file", data_bs->node_name);
3360     }
3361 
3362     /* Set 'driver' and 'node' options */
3363     qdict_put_str(qdict, "driver", "qcow2");
3364     qdict_put_str(qdict, "file", bs->node_name);
3365 
3366     /* Now get the QAPI type BlockdevCreateOptions */
3367     v = qobject_input_visitor_new_flat_confused(qdict, errp);
3368     if (!v) {
3369         ret = -EINVAL;
3370         goto finish;
3371     }
3372 
3373     visit_type_BlockdevCreateOptions(v, NULL, &create_options, &local_err);
3374     visit_free(v);
3375 
3376     if (local_err) {
3377         error_propagate(errp, local_err);
3378         ret = -EINVAL;
3379         goto finish;
3380     }
3381 
3382     /* Silently round up size */
3383     create_options->u.qcow2.size = ROUND_UP(create_options->u.qcow2.size,
3384                                             BDRV_SECTOR_SIZE);
3385 
3386     /* Create the qcow2 image (format layer) */
3387     ret = qcow2_co_create(create_options, errp);
3388     if (ret < 0) {
3389         goto finish;
3390     }
3391 
3392     ret = 0;
3393 finish:
3394     qobject_unref(qdict);
3395     bdrv_unref(bs);
3396     bdrv_unref(data_bs);
3397     qapi_free_BlockdevCreateOptions(create_options);
3398     return ret;
3399 }
3400 
3401 
3402 static bool is_zero(BlockDriverState *bs, int64_t offset, int64_t bytes)
3403 {
3404     int64_t nr;
3405     int res;
3406 
3407     /* Clamp to image length, before checking status of underlying sectors */
3408     if (offset + bytes > bs->total_sectors * BDRV_SECTOR_SIZE) {
3409         bytes = bs->total_sectors * BDRV_SECTOR_SIZE - offset;
3410     }
3411 
3412     if (!bytes) {
3413         return true;
3414     }
3415     res = bdrv_block_status_above(bs, NULL, offset, bytes, &nr, NULL, NULL);
3416     return res >= 0 && (res & BDRV_BLOCK_ZERO) && nr == bytes;
3417 }
3418 
3419 static coroutine_fn int qcow2_co_pwrite_zeroes(BlockDriverState *bs,
3420     int64_t offset, int bytes, BdrvRequestFlags flags)
3421 {
3422     int ret;
3423     BDRVQcow2State *s = bs->opaque;
3424 
3425     uint32_t head = offset % s->cluster_size;
3426     uint32_t tail = (offset + bytes) % s->cluster_size;
3427 
3428     trace_qcow2_pwrite_zeroes_start_req(qemu_coroutine_self(), offset, bytes);
3429     if (offset + bytes == bs->total_sectors * BDRV_SECTOR_SIZE) {
3430         tail = 0;
3431     }
3432 
3433     if (head || tail) {
3434         uint64_t off;
3435         unsigned int nr;
3436 
3437         assert(head + bytes <= s->cluster_size);
3438 
3439         /* check whether remainder of cluster already reads as zero */
3440         if (!(is_zero(bs, offset - head, head) &&
3441               is_zero(bs, offset + bytes,
3442                       tail ? s->cluster_size - tail : 0))) {
3443             return -ENOTSUP;
3444         }
3445 
3446         qemu_co_mutex_lock(&s->lock);
3447         /* We can have new write after previous check */
3448         offset = QEMU_ALIGN_DOWN(offset, s->cluster_size);
3449         bytes = s->cluster_size;
3450         nr = s->cluster_size;
3451         ret = qcow2_get_cluster_offset(bs, offset, &nr, &off);
3452         if (ret != QCOW2_CLUSTER_UNALLOCATED &&
3453             ret != QCOW2_CLUSTER_ZERO_PLAIN &&
3454             ret != QCOW2_CLUSTER_ZERO_ALLOC) {
3455             qemu_co_mutex_unlock(&s->lock);
3456             return -ENOTSUP;
3457         }
3458     } else {
3459         qemu_co_mutex_lock(&s->lock);
3460     }
3461 
3462     trace_qcow2_pwrite_zeroes(qemu_coroutine_self(), offset, bytes);
3463 
3464     /* Whatever is left can use real zero clusters */
3465     ret = qcow2_cluster_zeroize(bs, offset, bytes, flags);
3466     qemu_co_mutex_unlock(&s->lock);
3467 
3468     return ret;
3469 }
3470 
3471 static coroutine_fn int qcow2_co_pdiscard(BlockDriverState *bs,
3472                                           int64_t offset, int bytes)
3473 {
3474     int ret;
3475     BDRVQcow2State *s = bs->opaque;
3476 
3477     if (!QEMU_IS_ALIGNED(offset | bytes, s->cluster_size)) {
3478         assert(bytes < s->cluster_size);
3479         /* Ignore partial clusters, except for the special case of the
3480          * complete partial cluster at the end of an unaligned file */
3481         if (!QEMU_IS_ALIGNED(offset, s->cluster_size) ||
3482             offset + bytes != bs->total_sectors * BDRV_SECTOR_SIZE) {
3483             return -ENOTSUP;
3484         }
3485     }
3486 
3487     qemu_co_mutex_lock(&s->lock);
3488     ret = qcow2_cluster_discard(bs, offset, bytes, QCOW2_DISCARD_REQUEST,
3489                                 false);
3490     qemu_co_mutex_unlock(&s->lock);
3491     return ret;
3492 }
3493 
3494 static int coroutine_fn
3495 qcow2_co_copy_range_from(BlockDriverState *bs,
3496                          BdrvChild *src, uint64_t src_offset,
3497                          BdrvChild *dst, uint64_t dst_offset,
3498                          uint64_t bytes, BdrvRequestFlags read_flags,
3499                          BdrvRequestFlags write_flags)
3500 {
3501     BDRVQcow2State *s = bs->opaque;
3502     int ret;
3503     unsigned int cur_bytes; /* number of bytes in current iteration */
3504     BdrvChild *child = NULL;
3505     BdrvRequestFlags cur_write_flags;
3506 
3507     assert(!bs->encrypted);
3508     qemu_co_mutex_lock(&s->lock);
3509 
3510     while (bytes != 0) {
3511         uint64_t copy_offset = 0;
3512         /* prepare next request */
3513         cur_bytes = MIN(bytes, INT_MAX);
3514         cur_write_flags = write_flags;
3515 
3516         ret = qcow2_get_cluster_offset(bs, src_offset, &cur_bytes, &copy_offset);
3517         if (ret < 0) {
3518             goto out;
3519         }
3520 
3521         switch (ret) {
3522         case QCOW2_CLUSTER_UNALLOCATED:
3523             if (bs->backing && bs->backing->bs) {
3524                 int64_t backing_length = bdrv_getlength(bs->backing->bs);
3525                 if (src_offset >= backing_length) {
3526                     cur_write_flags |= BDRV_REQ_ZERO_WRITE;
3527                 } else {
3528                     child = bs->backing;
3529                     cur_bytes = MIN(cur_bytes, backing_length - src_offset);
3530                     copy_offset = src_offset;
3531                 }
3532             } else {
3533                 cur_write_flags |= BDRV_REQ_ZERO_WRITE;
3534             }
3535             break;
3536 
3537         case QCOW2_CLUSTER_ZERO_PLAIN:
3538         case QCOW2_CLUSTER_ZERO_ALLOC:
3539             cur_write_flags |= BDRV_REQ_ZERO_WRITE;
3540             break;
3541 
3542         case QCOW2_CLUSTER_COMPRESSED:
3543             ret = -ENOTSUP;
3544             goto out;
3545 
3546         case QCOW2_CLUSTER_NORMAL:
3547             child = s->data_file;
3548             copy_offset += offset_into_cluster(s, src_offset);
3549             if ((copy_offset & 511) != 0) {
3550                 ret = -EIO;
3551                 goto out;
3552             }
3553             break;
3554 
3555         default:
3556             abort();
3557         }
3558         qemu_co_mutex_unlock(&s->lock);
3559         ret = bdrv_co_copy_range_from(child,
3560                                       copy_offset,
3561                                       dst, dst_offset,
3562                                       cur_bytes, read_flags, cur_write_flags);
3563         qemu_co_mutex_lock(&s->lock);
3564         if (ret < 0) {
3565             goto out;
3566         }
3567 
3568         bytes -= cur_bytes;
3569         src_offset += cur_bytes;
3570         dst_offset += cur_bytes;
3571     }
3572     ret = 0;
3573 
3574 out:
3575     qemu_co_mutex_unlock(&s->lock);
3576     return ret;
3577 }
3578 
3579 static int coroutine_fn
3580 qcow2_co_copy_range_to(BlockDriverState *bs,
3581                        BdrvChild *src, uint64_t src_offset,
3582                        BdrvChild *dst, uint64_t dst_offset,
3583                        uint64_t bytes, BdrvRequestFlags read_flags,
3584                        BdrvRequestFlags write_flags)
3585 {
3586     BDRVQcow2State *s = bs->opaque;
3587     int offset_in_cluster;
3588     int ret;
3589     unsigned int cur_bytes; /* number of sectors in current iteration */
3590     uint64_t cluster_offset;
3591     QCowL2Meta *l2meta = NULL;
3592 
3593     assert(!bs->encrypted);
3594 
3595     qemu_co_mutex_lock(&s->lock);
3596 
3597     while (bytes != 0) {
3598 
3599         l2meta = NULL;
3600 
3601         offset_in_cluster = offset_into_cluster(s, dst_offset);
3602         cur_bytes = MIN(bytes, INT_MAX);
3603 
3604         /* TODO:
3605          * If src->bs == dst->bs, we could simply copy by incrementing
3606          * the refcnt, without copying user data.
3607          * Or if src->bs == dst->bs->backing->bs, we could copy by discarding. */
3608         ret = qcow2_alloc_cluster_offset(bs, dst_offset, &cur_bytes,
3609                                          &cluster_offset, &l2meta);
3610         if (ret < 0) {
3611             goto fail;
3612         }
3613 
3614         assert((cluster_offset & 511) == 0);
3615 
3616         ret = qcow2_pre_write_overlap_check(bs, 0,
3617                 cluster_offset + offset_in_cluster, cur_bytes, true);
3618         if (ret < 0) {
3619             goto fail;
3620         }
3621 
3622         qemu_co_mutex_unlock(&s->lock);
3623         ret = bdrv_co_copy_range_to(src, src_offset,
3624                                     s->data_file,
3625                                     cluster_offset + offset_in_cluster,
3626                                     cur_bytes, read_flags, write_flags);
3627         qemu_co_mutex_lock(&s->lock);
3628         if (ret < 0) {
3629             goto fail;
3630         }
3631 
3632         ret = qcow2_handle_l2meta(bs, &l2meta, true);
3633         if (ret) {
3634             goto fail;
3635         }
3636 
3637         bytes -= cur_bytes;
3638         src_offset += cur_bytes;
3639         dst_offset += cur_bytes;
3640     }
3641     ret = 0;
3642 
3643 fail:
3644     qcow2_handle_l2meta(bs, &l2meta, false);
3645 
3646     qemu_co_mutex_unlock(&s->lock);
3647 
3648     trace_qcow2_writev_done_req(qemu_coroutine_self(), ret);
3649 
3650     return ret;
3651 }
3652 
3653 static int coroutine_fn qcow2_co_truncate(BlockDriverState *bs, int64_t offset,
3654                                           PreallocMode prealloc, Error **errp)
3655 {
3656     BDRVQcow2State *s = bs->opaque;
3657     uint64_t old_length;
3658     int64_t new_l1_size;
3659     int ret;
3660     QDict *options;
3661 
3662     if (prealloc != PREALLOC_MODE_OFF && prealloc != PREALLOC_MODE_METADATA &&
3663         prealloc != PREALLOC_MODE_FALLOC && prealloc != PREALLOC_MODE_FULL)
3664     {
3665         error_setg(errp, "Unsupported preallocation mode '%s'",
3666                    PreallocMode_str(prealloc));
3667         return -ENOTSUP;
3668     }
3669 
3670     if (offset & 511) {
3671         error_setg(errp, "The new size must be a multiple of 512");
3672         return -EINVAL;
3673     }
3674 
3675     qemu_co_mutex_lock(&s->lock);
3676 
3677     /* cannot proceed if image has snapshots */
3678     if (s->nb_snapshots) {
3679         error_setg(errp, "Can't resize an image which has snapshots");
3680         ret = -ENOTSUP;
3681         goto fail;
3682     }
3683 
3684     /* cannot proceed if image has bitmaps */
3685     if (qcow2_truncate_bitmaps_check(bs, errp)) {
3686         ret = -ENOTSUP;
3687         goto fail;
3688     }
3689 
3690     old_length = bs->total_sectors * BDRV_SECTOR_SIZE;
3691     new_l1_size = size_to_l1(s, offset);
3692 
3693     if (offset < old_length) {
3694         int64_t last_cluster, old_file_size;
3695         if (prealloc != PREALLOC_MODE_OFF) {
3696             error_setg(errp,
3697                        "Preallocation can't be used for shrinking an image");
3698             ret = -EINVAL;
3699             goto fail;
3700         }
3701 
3702         ret = qcow2_cluster_discard(bs, ROUND_UP(offset, s->cluster_size),
3703                                     old_length - ROUND_UP(offset,
3704                                                           s->cluster_size),
3705                                     QCOW2_DISCARD_ALWAYS, true);
3706         if (ret < 0) {
3707             error_setg_errno(errp, -ret, "Failed to discard cropped clusters");
3708             goto fail;
3709         }
3710 
3711         ret = qcow2_shrink_l1_table(bs, new_l1_size);
3712         if (ret < 0) {
3713             error_setg_errno(errp, -ret,
3714                              "Failed to reduce the number of L2 tables");
3715             goto fail;
3716         }
3717 
3718         ret = qcow2_shrink_reftable(bs);
3719         if (ret < 0) {
3720             error_setg_errno(errp, -ret,
3721                              "Failed to discard unused refblocks");
3722             goto fail;
3723         }
3724 
3725         old_file_size = bdrv_getlength(bs->file->bs);
3726         if (old_file_size < 0) {
3727             error_setg_errno(errp, -old_file_size,
3728                              "Failed to inquire current file length");
3729             ret = old_file_size;
3730             goto fail;
3731         }
3732         last_cluster = qcow2_get_last_cluster(bs, old_file_size);
3733         if (last_cluster < 0) {
3734             error_setg_errno(errp, -last_cluster,
3735                              "Failed to find the last cluster");
3736             ret = last_cluster;
3737             goto fail;
3738         }
3739         if ((last_cluster + 1) * s->cluster_size < old_file_size) {
3740             Error *local_err = NULL;
3741 
3742             bdrv_co_truncate(bs->file, (last_cluster + 1) * s->cluster_size,
3743                              PREALLOC_MODE_OFF, &local_err);
3744             if (local_err) {
3745                 warn_reportf_err(local_err,
3746                                  "Failed to truncate the tail of the image: ");
3747             }
3748         }
3749     } else {
3750         ret = qcow2_grow_l1_table(bs, new_l1_size, true);
3751         if (ret < 0) {
3752             error_setg_errno(errp, -ret, "Failed to grow the L1 table");
3753             goto fail;
3754         }
3755     }
3756 
3757     switch (prealloc) {
3758     case PREALLOC_MODE_OFF:
3759         if (has_data_file(bs)) {
3760             ret = bdrv_co_truncate(s->data_file, offset, prealloc, errp);
3761             if (ret < 0) {
3762                 goto fail;
3763             }
3764         }
3765         break;
3766 
3767     case PREALLOC_MODE_METADATA:
3768         ret = preallocate_co(bs, old_length, offset, prealloc, errp);
3769         if (ret < 0) {
3770             goto fail;
3771         }
3772         break;
3773 
3774     case PREALLOC_MODE_FALLOC:
3775     case PREALLOC_MODE_FULL:
3776     {
3777         int64_t allocation_start, host_offset, guest_offset;
3778         int64_t clusters_allocated;
3779         int64_t old_file_size, new_file_size;
3780         uint64_t nb_new_data_clusters, nb_new_l2_tables;
3781 
3782         /* With a data file, preallocation means just allocating the metadata
3783          * and forwarding the truncate request to the data file */
3784         if (has_data_file(bs)) {
3785             ret = preallocate_co(bs, old_length, offset, prealloc, errp);
3786             if (ret < 0) {
3787                 goto fail;
3788             }
3789             break;
3790         }
3791 
3792         old_file_size = bdrv_getlength(bs->file->bs);
3793         if (old_file_size < 0) {
3794             error_setg_errno(errp, -old_file_size,
3795                              "Failed to inquire current file length");
3796             ret = old_file_size;
3797             goto fail;
3798         }
3799         old_file_size = ROUND_UP(old_file_size, s->cluster_size);
3800 
3801         nb_new_data_clusters = DIV_ROUND_UP(offset - old_length,
3802                                             s->cluster_size);
3803 
3804         /* This is an overestimation; we will not actually allocate space for
3805          * these in the file but just make sure the new refcount structures are
3806          * able to cover them so we will not have to allocate new refblocks
3807          * while entering the data blocks in the potentially new L2 tables.
3808          * (We do not actually care where the L2 tables are placed. Maybe they
3809          *  are already allocated or they can be placed somewhere before
3810          *  @old_file_size. It does not matter because they will be fully
3811          *  allocated automatically, so they do not need to be covered by the
3812          *  preallocation. All that matters is that we will not have to allocate
3813          *  new refcount structures for them.) */
3814         nb_new_l2_tables = DIV_ROUND_UP(nb_new_data_clusters,
3815                                         s->cluster_size / sizeof(uint64_t));
3816         /* The cluster range may not be aligned to L2 boundaries, so add one L2
3817          * table for a potential head/tail */
3818         nb_new_l2_tables++;
3819 
3820         allocation_start = qcow2_refcount_area(bs, old_file_size,
3821                                                nb_new_data_clusters +
3822                                                nb_new_l2_tables,
3823                                                true, 0, 0);
3824         if (allocation_start < 0) {
3825             error_setg_errno(errp, -allocation_start,
3826                              "Failed to resize refcount structures");
3827             ret = allocation_start;
3828             goto fail;
3829         }
3830 
3831         clusters_allocated = qcow2_alloc_clusters_at(bs, allocation_start,
3832                                                      nb_new_data_clusters);
3833         if (clusters_allocated < 0) {
3834             error_setg_errno(errp, -clusters_allocated,
3835                              "Failed to allocate data clusters");
3836             ret = clusters_allocated;
3837             goto fail;
3838         }
3839 
3840         assert(clusters_allocated == nb_new_data_clusters);
3841 
3842         /* Allocate the data area */
3843         new_file_size = allocation_start +
3844                         nb_new_data_clusters * s->cluster_size;
3845         ret = bdrv_co_truncate(bs->file, new_file_size, prealloc, errp);
3846         if (ret < 0) {
3847             error_prepend(errp, "Failed to resize underlying file: ");
3848             qcow2_free_clusters(bs, allocation_start,
3849                                 nb_new_data_clusters * s->cluster_size,
3850                                 QCOW2_DISCARD_OTHER);
3851             goto fail;
3852         }
3853 
3854         /* Create the necessary L2 entries */
3855         host_offset = allocation_start;
3856         guest_offset = old_length;
3857         while (nb_new_data_clusters) {
3858             int64_t nb_clusters = MIN(
3859                 nb_new_data_clusters,
3860                 s->l2_slice_size - offset_to_l2_slice_index(s, guest_offset));
3861             QCowL2Meta allocation = {
3862                 .offset       = guest_offset,
3863                 .alloc_offset = host_offset,
3864                 .nb_clusters  = nb_clusters,
3865             };
3866             qemu_co_queue_init(&allocation.dependent_requests);
3867 
3868             ret = qcow2_alloc_cluster_link_l2(bs, &allocation);
3869             if (ret < 0) {
3870                 error_setg_errno(errp, -ret, "Failed to update L2 tables");
3871                 qcow2_free_clusters(bs, host_offset,
3872                                     nb_new_data_clusters * s->cluster_size,
3873                                     QCOW2_DISCARD_OTHER);
3874                 goto fail;
3875             }
3876 
3877             guest_offset += nb_clusters * s->cluster_size;
3878             host_offset += nb_clusters * s->cluster_size;
3879             nb_new_data_clusters -= nb_clusters;
3880         }
3881         break;
3882     }
3883 
3884     default:
3885         g_assert_not_reached();
3886     }
3887 
3888     if (prealloc != PREALLOC_MODE_OFF) {
3889         /* Flush metadata before actually changing the image size */
3890         ret = qcow2_write_caches(bs);
3891         if (ret < 0) {
3892             error_setg_errno(errp, -ret,
3893                              "Failed to flush the preallocated area to disk");
3894             goto fail;
3895         }
3896     }
3897 
3898     bs->total_sectors = offset / BDRV_SECTOR_SIZE;
3899 
3900     /* write updated header.size */
3901     offset = cpu_to_be64(offset);
3902     ret = bdrv_pwrite_sync(bs->file, offsetof(QCowHeader, size),
3903                            &offset, sizeof(uint64_t));
3904     if (ret < 0) {
3905         error_setg_errno(errp, -ret, "Failed to update the image size");
3906         goto fail;
3907     }
3908 
3909     s->l1_vm_state_index = new_l1_size;
3910 
3911     /* Update cache sizes */
3912     options = qdict_clone_shallow(bs->options);
3913     ret = qcow2_update_options(bs, options, s->flags, errp);
3914     qobject_unref(options);
3915     if (ret < 0) {
3916         goto fail;
3917     }
3918     ret = 0;
3919 fail:
3920     qemu_co_mutex_unlock(&s->lock);
3921     return ret;
3922 }
3923 
3924 /*
3925  * qcow2_compress()
3926  *
3927  * @dest - destination buffer, @dest_size bytes
3928  * @src - source buffer, @src_size bytes
3929  *
3930  * Returns: compressed size on success
3931  *          -ENOMEM destination buffer is not enough to store compressed data
3932  *          -EIO    on any other error
3933  */
3934 static ssize_t qcow2_compress(void *dest, size_t dest_size,
3935                               const void *src, size_t src_size)
3936 {
3937     ssize_t ret;
3938     z_stream strm;
3939 
3940     /* best compression, small window, no zlib header */
3941     memset(&strm, 0, sizeof(strm));
3942     ret = deflateInit2(&strm, Z_DEFAULT_COMPRESSION, Z_DEFLATED,
3943                        -12, 9, Z_DEFAULT_STRATEGY);
3944     if (ret != Z_OK) {
3945         return -EIO;
3946     }
3947 
3948     /* strm.next_in is not const in old zlib versions, such as those used on
3949      * OpenBSD/NetBSD, so cast the const away */
3950     strm.avail_in = src_size;
3951     strm.next_in = (void *) src;
3952     strm.avail_out = dest_size;
3953     strm.next_out = dest;
3954 
3955     ret = deflate(&strm, Z_FINISH);
3956     if (ret == Z_STREAM_END) {
3957         ret = dest_size - strm.avail_out;
3958     } else {
3959         ret = (ret == Z_OK ? -ENOMEM : -EIO);
3960     }
3961 
3962     deflateEnd(&strm);
3963 
3964     return ret;
3965 }
3966 
3967 /*
3968  * qcow2_decompress()
3969  *
3970  * Decompress some data (not more than @src_size bytes) to produce exactly
3971  * @dest_size bytes.
3972  *
3973  * @dest - destination buffer, @dest_size bytes
3974  * @src - source buffer, @src_size bytes
3975  *
3976  * Returns: 0 on success
3977  *          -1 on fail
3978  */
3979 static ssize_t qcow2_decompress(void *dest, size_t dest_size,
3980                                 const void *src, size_t src_size)
3981 {
3982     int ret = 0;
3983     z_stream strm;
3984 
3985     memset(&strm, 0, sizeof(strm));
3986     strm.avail_in = src_size;
3987     strm.next_in = (void *) src;
3988     strm.avail_out = dest_size;
3989     strm.next_out = dest;
3990 
3991     ret = inflateInit2(&strm, -12);
3992     if (ret != Z_OK) {
3993         return -1;
3994     }
3995 
3996     ret = inflate(&strm, Z_FINISH);
3997     if ((ret != Z_STREAM_END && ret != Z_BUF_ERROR) || strm.avail_out != 0) {
3998         /* We approve Z_BUF_ERROR because we need @dest buffer to be filled, but
3999          * @src buffer may be processed partly (because in qcow2 we know size of
4000          * compressed data with precision of one sector) */
4001         ret = -1;
4002     }
4003 
4004     inflateEnd(&strm);
4005 
4006     return ret;
4007 }
4008 
4009 #define MAX_COMPRESS_THREADS 4
4010 
4011 typedef ssize_t (*Qcow2CompressFunc)(void *dest, size_t dest_size,
4012                                      const void *src, size_t src_size);
4013 typedef struct Qcow2CompressData {
4014     void *dest;
4015     size_t dest_size;
4016     const void *src;
4017     size_t src_size;
4018     ssize_t ret;
4019 
4020     Qcow2CompressFunc func;
4021 } Qcow2CompressData;
4022 
4023 static int qcow2_compress_pool_func(void *opaque)
4024 {
4025     Qcow2CompressData *data = opaque;
4026 
4027     data->ret = data->func(data->dest, data->dest_size,
4028                            data->src, data->src_size);
4029 
4030     return 0;
4031 }
4032 
4033 static void qcow2_compress_complete(void *opaque, int ret)
4034 {
4035     qemu_coroutine_enter(opaque);
4036 }
4037 
4038 static ssize_t coroutine_fn
4039 qcow2_co_do_compress(BlockDriverState *bs, void *dest, size_t dest_size,
4040                      const void *src, size_t src_size, Qcow2CompressFunc func)
4041 {
4042     BDRVQcow2State *s = bs->opaque;
4043     BlockAIOCB *acb;
4044     ThreadPool *pool = aio_get_thread_pool(bdrv_get_aio_context(bs));
4045     Qcow2CompressData arg = {
4046         .dest = dest,
4047         .dest_size = dest_size,
4048         .src = src,
4049         .src_size = src_size,
4050         .func = func,
4051     };
4052 
4053     while (s->nb_compress_threads >= MAX_COMPRESS_THREADS) {
4054         qemu_co_queue_wait(&s->compress_wait_queue, NULL);
4055     }
4056 
4057     s->nb_compress_threads++;
4058     acb = thread_pool_submit_aio(pool, qcow2_compress_pool_func, &arg,
4059                                  qcow2_compress_complete,
4060                                  qemu_coroutine_self());
4061 
4062     if (!acb) {
4063         s->nb_compress_threads--;
4064         return -EINVAL;
4065     }
4066     qemu_coroutine_yield();
4067     s->nb_compress_threads--;
4068     qemu_co_queue_next(&s->compress_wait_queue);
4069 
4070     return arg.ret;
4071 }
4072 
4073 static ssize_t coroutine_fn
4074 qcow2_co_compress(BlockDriverState *bs, void *dest, size_t dest_size,
4075                   const void *src, size_t src_size)
4076 {
4077     return qcow2_co_do_compress(bs, dest, dest_size, src, src_size,
4078                                 qcow2_compress);
4079 }
4080 
4081 static ssize_t coroutine_fn
4082 qcow2_co_decompress(BlockDriverState *bs, void *dest, size_t dest_size,
4083                     const void *src, size_t src_size)
4084 {
4085     return qcow2_co_do_compress(bs, dest, dest_size, src, src_size,
4086                                 qcow2_decompress);
4087 }
4088 
4089 /* XXX: put compressed sectors first, then all the cluster aligned
4090    tables to avoid losing bytes in alignment */
4091 static coroutine_fn int
4092 qcow2_co_pwritev_compressed(BlockDriverState *bs, uint64_t offset,
4093                             uint64_t bytes, QEMUIOVector *qiov)
4094 {
4095     BDRVQcow2State *s = bs->opaque;
4096     int ret;
4097     ssize_t out_len;
4098     uint8_t *buf, *out_buf;
4099     uint64_t cluster_offset;
4100 
4101     if (has_data_file(bs)) {
4102         return -ENOTSUP;
4103     }
4104 
4105     if (bytes == 0) {
4106         /* align end of file to a sector boundary to ease reading with
4107            sector based I/Os */
4108         int64_t len = bdrv_getlength(bs->file->bs);
4109         if (len < 0) {
4110             return len;
4111         }
4112         return bdrv_co_truncate(bs->file, len, PREALLOC_MODE_OFF, NULL);
4113     }
4114 
4115     if (offset_into_cluster(s, offset)) {
4116         return -EINVAL;
4117     }
4118 
4119     buf = qemu_blockalign(bs, s->cluster_size);
4120     if (bytes != s->cluster_size) {
4121         if (bytes > s->cluster_size ||
4122             offset + bytes != bs->total_sectors << BDRV_SECTOR_BITS)
4123         {
4124             qemu_vfree(buf);
4125             return -EINVAL;
4126         }
4127         /* Zero-pad last write if image size is not cluster aligned */
4128         memset(buf + bytes, 0, s->cluster_size - bytes);
4129     }
4130     qemu_iovec_to_buf(qiov, 0, buf, bytes);
4131 
4132     out_buf = g_malloc(s->cluster_size);
4133 
4134     out_len = qcow2_co_compress(bs, out_buf, s->cluster_size - 1,
4135                                 buf, s->cluster_size);
4136     if (out_len == -ENOMEM) {
4137         /* could not compress: write normal cluster */
4138         ret = qcow2_co_pwritev(bs, offset, bytes, qiov, 0);
4139         if (ret < 0) {
4140             goto fail;
4141         }
4142         goto success;
4143     } else if (out_len < 0) {
4144         ret = -EINVAL;
4145         goto fail;
4146     }
4147 
4148     qemu_co_mutex_lock(&s->lock);
4149     ret = qcow2_alloc_compressed_cluster_offset(bs, offset, out_len,
4150                                                 &cluster_offset);
4151     if (ret < 0) {
4152         qemu_co_mutex_unlock(&s->lock);
4153         goto fail;
4154     }
4155 
4156     ret = qcow2_pre_write_overlap_check(bs, 0, cluster_offset, out_len, true);
4157     qemu_co_mutex_unlock(&s->lock);
4158     if (ret < 0) {
4159         goto fail;
4160     }
4161 
4162     BLKDBG_EVENT(s->data_file, BLKDBG_WRITE_COMPRESSED);
4163     ret = bdrv_co_pwrite(s->data_file, cluster_offset, out_len, out_buf, 0);
4164     if (ret < 0) {
4165         goto fail;
4166     }
4167 success:
4168     ret = 0;
4169 fail:
4170     qemu_vfree(buf);
4171     g_free(out_buf);
4172     return ret;
4173 }
4174 
4175 static int coroutine_fn
4176 qcow2_co_preadv_compressed(BlockDriverState *bs,
4177                            uint64_t file_cluster_offset,
4178                            uint64_t offset,
4179                            uint64_t bytes,
4180                            QEMUIOVector *qiov)
4181 {
4182     BDRVQcow2State *s = bs->opaque;
4183     int ret = 0, csize, nb_csectors;
4184     uint64_t coffset;
4185     uint8_t *buf, *out_buf;
4186     int offset_in_cluster = offset_into_cluster(s, offset);
4187 
4188     coffset = file_cluster_offset & s->cluster_offset_mask;
4189     nb_csectors = ((file_cluster_offset >> s->csize_shift) & s->csize_mask) + 1;
4190     csize = nb_csectors * QCOW2_COMPRESSED_SECTOR_SIZE -
4191         (coffset & ~QCOW2_COMPRESSED_SECTOR_MASK);
4192 
4193     buf = g_try_malloc(csize);
4194     if (!buf) {
4195         return -ENOMEM;
4196     }
4197 
4198     out_buf = qemu_blockalign(bs, s->cluster_size);
4199 
4200     BLKDBG_EVENT(bs->file, BLKDBG_READ_COMPRESSED);
4201     ret = bdrv_co_pread(bs->file, coffset, csize, buf, 0);
4202     if (ret < 0) {
4203         goto fail;
4204     }
4205 
4206     if (qcow2_co_decompress(bs, out_buf, s->cluster_size, buf, csize) < 0) {
4207         ret = -EIO;
4208         goto fail;
4209     }
4210 
4211     qemu_iovec_from_buf(qiov, 0, out_buf + offset_in_cluster, bytes);
4212 
4213 fail:
4214     qemu_vfree(out_buf);
4215     g_free(buf);
4216 
4217     return ret;
4218 }
4219 
4220 static int make_completely_empty(BlockDriverState *bs)
4221 {
4222     BDRVQcow2State *s = bs->opaque;
4223     Error *local_err = NULL;
4224     int ret, l1_clusters;
4225     int64_t offset;
4226     uint64_t *new_reftable = NULL;
4227     uint64_t rt_entry, l1_size2;
4228     struct {
4229         uint64_t l1_offset;
4230         uint64_t reftable_offset;
4231         uint32_t reftable_clusters;
4232     } QEMU_PACKED l1_ofs_rt_ofs_cls;
4233 
4234     ret = qcow2_cache_empty(bs, s->l2_table_cache);
4235     if (ret < 0) {
4236         goto fail;
4237     }
4238 
4239     ret = qcow2_cache_empty(bs, s->refcount_block_cache);
4240     if (ret < 0) {
4241         goto fail;
4242     }
4243 
4244     /* Refcounts will be broken utterly */
4245     ret = qcow2_mark_dirty(bs);
4246     if (ret < 0) {
4247         goto fail;
4248     }
4249 
4250     BLKDBG_EVENT(bs->file, BLKDBG_L1_UPDATE);
4251 
4252     l1_clusters = DIV_ROUND_UP(s->l1_size, s->cluster_size / sizeof(uint64_t));
4253     l1_size2 = (uint64_t)s->l1_size * sizeof(uint64_t);
4254 
4255     /* After this call, neither the in-memory nor the on-disk refcount
4256      * information accurately describe the actual references */
4257 
4258     ret = bdrv_pwrite_zeroes(bs->file, s->l1_table_offset,
4259                              l1_clusters * s->cluster_size, 0);
4260     if (ret < 0) {
4261         goto fail_broken_refcounts;
4262     }
4263     memset(s->l1_table, 0, l1_size2);
4264 
4265     BLKDBG_EVENT(bs->file, BLKDBG_EMPTY_IMAGE_PREPARE);
4266 
4267     /* Overwrite enough clusters at the beginning of the sectors to place
4268      * the refcount table, a refcount block and the L1 table in; this may
4269      * overwrite parts of the existing refcount and L1 table, which is not
4270      * an issue because the dirty flag is set, complete data loss is in fact
4271      * desired and partial data loss is consequently fine as well */
4272     ret = bdrv_pwrite_zeroes(bs->file, s->cluster_size,
4273                              (2 + l1_clusters) * s->cluster_size, 0);
4274     /* This call (even if it failed overall) may have overwritten on-disk
4275      * refcount structures; in that case, the in-memory refcount information
4276      * will probably differ from the on-disk information which makes the BDS
4277      * unusable */
4278     if (ret < 0) {
4279         goto fail_broken_refcounts;
4280     }
4281 
4282     BLKDBG_EVENT(bs->file, BLKDBG_L1_UPDATE);
4283     BLKDBG_EVENT(bs->file, BLKDBG_REFTABLE_UPDATE);
4284 
4285     /* "Create" an empty reftable (one cluster) directly after the image
4286      * header and an empty L1 table three clusters after the image header;
4287      * the cluster between those two will be used as the first refblock */
4288     l1_ofs_rt_ofs_cls.l1_offset = cpu_to_be64(3 * s->cluster_size);
4289     l1_ofs_rt_ofs_cls.reftable_offset = cpu_to_be64(s->cluster_size);
4290     l1_ofs_rt_ofs_cls.reftable_clusters = cpu_to_be32(1);
4291     ret = bdrv_pwrite_sync(bs->file, offsetof(QCowHeader, l1_table_offset),
4292                            &l1_ofs_rt_ofs_cls, sizeof(l1_ofs_rt_ofs_cls));
4293     if (ret < 0) {
4294         goto fail_broken_refcounts;
4295     }
4296 
4297     s->l1_table_offset = 3 * s->cluster_size;
4298 
4299     new_reftable = g_try_new0(uint64_t, s->cluster_size / sizeof(uint64_t));
4300     if (!new_reftable) {
4301         ret = -ENOMEM;
4302         goto fail_broken_refcounts;
4303     }
4304 
4305     s->refcount_table_offset = s->cluster_size;
4306     s->refcount_table_size   = s->cluster_size / sizeof(uint64_t);
4307     s->max_refcount_table_index = 0;
4308 
4309     g_free(s->refcount_table);
4310     s->refcount_table = new_reftable;
4311     new_reftable = NULL;
4312 
4313     /* Now the in-memory refcount information again corresponds to the on-disk
4314      * information (reftable is empty and no refblocks (the refblock cache is
4315      * empty)); however, this means some clusters (e.g. the image header) are
4316      * referenced, but not refcounted, but the normal qcow2 code assumes that
4317      * the in-memory information is always correct */
4318 
4319     BLKDBG_EVENT(bs->file, BLKDBG_REFBLOCK_ALLOC);
4320 
4321     /* Enter the first refblock into the reftable */
4322     rt_entry = cpu_to_be64(2 * s->cluster_size);
4323     ret = bdrv_pwrite_sync(bs->file, s->cluster_size,
4324                            &rt_entry, sizeof(rt_entry));
4325     if (ret < 0) {
4326         goto fail_broken_refcounts;
4327     }
4328     s->refcount_table[0] = 2 * s->cluster_size;
4329 
4330     s->free_cluster_index = 0;
4331     assert(3 + l1_clusters <= s->refcount_block_size);
4332     offset = qcow2_alloc_clusters(bs, 3 * s->cluster_size + l1_size2);
4333     if (offset < 0) {
4334         ret = offset;
4335         goto fail_broken_refcounts;
4336     } else if (offset > 0) {
4337         error_report("First cluster in emptied image is in use");
4338         abort();
4339     }
4340 
4341     /* Now finally the in-memory information corresponds to the on-disk
4342      * structures and is correct */
4343     ret = qcow2_mark_clean(bs);
4344     if (ret < 0) {
4345         goto fail;
4346     }
4347 
4348     ret = bdrv_truncate(bs->file, (3 + l1_clusters) * s->cluster_size,
4349                         PREALLOC_MODE_OFF, &local_err);
4350     if (ret < 0) {
4351         error_report_err(local_err);
4352         goto fail;
4353     }
4354 
4355     return 0;
4356 
4357 fail_broken_refcounts:
4358     /* The BDS is unusable at this point. If we wanted to make it usable, we
4359      * would have to call qcow2_refcount_close(), qcow2_refcount_init(),
4360      * qcow2_check_refcounts(), qcow2_refcount_close() and qcow2_refcount_init()
4361      * again. However, because the functions which could have caused this error
4362      * path to be taken are used by those functions as well, it's very likely
4363      * that that sequence will fail as well. Therefore, just eject the BDS. */
4364     bs->drv = NULL;
4365 
4366 fail:
4367     g_free(new_reftable);
4368     return ret;
4369 }
4370 
4371 static int qcow2_make_empty(BlockDriverState *bs)
4372 {
4373     BDRVQcow2State *s = bs->opaque;
4374     uint64_t offset, end_offset;
4375     int step = QEMU_ALIGN_DOWN(INT_MAX, s->cluster_size);
4376     int l1_clusters, ret = 0;
4377 
4378     l1_clusters = DIV_ROUND_UP(s->l1_size, s->cluster_size / sizeof(uint64_t));
4379 
4380     if (s->qcow_version >= 3 && !s->snapshots && !s->nb_bitmaps &&
4381         3 + l1_clusters <= s->refcount_block_size &&
4382         s->crypt_method_header != QCOW_CRYPT_LUKS &&
4383         !has_data_file(bs)) {
4384         /* The following function only works for qcow2 v3 images (it
4385          * requires the dirty flag) and only as long as there are no
4386          * features that reserve extra clusters (such as snapshots,
4387          * LUKS header, or persistent bitmaps), because it completely
4388          * empties the image.  Furthermore, the L1 table and three
4389          * additional clusters (image header, refcount table, one
4390          * refcount block) have to fit inside one refcount block. It
4391          * only resets the image file, i.e. does not work with an
4392          * external data file. */
4393         return make_completely_empty(bs);
4394     }
4395 
4396     /* This fallback code simply discards every active cluster; this is slow,
4397      * but works in all cases */
4398     end_offset = bs->total_sectors * BDRV_SECTOR_SIZE;
4399     for (offset = 0; offset < end_offset; offset += step) {
4400         /* As this function is generally used after committing an external
4401          * snapshot, QCOW2_DISCARD_SNAPSHOT seems appropriate. Also, the
4402          * default action for this kind of discard is to pass the discard,
4403          * which will ideally result in an actually smaller image file, as
4404          * is probably desired. */
4405         ret = qcow2_cluster_discard(bs, offset, MIN(step, end_offset - offset),
4406                                     QCOW2_DISCARD_SNAPSHOT, true);
4407         if (ret < 0) {
4408             break;
4409         }
4410     }
4411 
4412     return ret;
4413 }
4414 
4415 static coroutine_fn int qcow2_co_flush_to_os(BlockDriverState *bs)
4416 {
4417     BDRVQcow2State *s = bs->opaque;
4418     int ret;
4419 
4420     qemu_co_mutex_lock(&s->lock);
4421     ret = qcow2_write_caches(bs);
4422     qemu_co_mutex_unlock(&s->lock);
4423 
4424     return ret;
4425 }
4426 
4427 static ssize_t qcow2_measure_crypto_hdr_init_func(QCryptoBlock *block,
4428         size_t headerlen, void *opaque, Error **errp)
4429 {
4430     size_t *headerlenp = opaque;
4431 
4432     /* Stash away the payload size */
4433     *headerlenp = headerlen;
4434     return 0;
4435 }
4436 
4437 static ssize_t qcow2_measure_crypto_hdr_write_func(QCryptoBlock *block,
4438         size_t offset, const uint8_t *buf, size_t buflen,
4439         void *opaque, Error **errp)
4440 {
4441     /* Discard the bytes, we're not actually writing to an image */
4442     return buflen;
4443 }
4444 
4445 /* Determine the number of bytes for the LUKS payload */
4446 static bool qcow2_measure_luks_headerlen(QemuOpts *opts, size_t *len,
4447                                          Error **errp)
4448 {
4449     QDict *opts_qdict;
4450     QDict *cryptoopts_qdict;
4451     QCryptoBlockCreateOptions *cryptoopts;
4452     QCryptoBlock *crypto;
4453 
4454     /* Extract "encrypt." options into a qdict */
4455     opts_qdict = qemu_opts_to_qdict(opts, NULL);
4456     qdict_extract_subqdict(opts_qdict, &cryptoopts_qdict, "encrypt.");
4457     qobject_unref(opts_qdict);
4458 
4459     /* Build QCryptoBlockCreateOptions object from qdict */
4460     qdict_put_str(cryptoopts_qdict, "format", "luks");
4461     cryptoopts = block_crypto_create_opts_init(cryptoopts_qdict, errp);
4462     qobject_unref(cryptoopts_qdict);
4463     if (!cryptoopts) {
4464         return false;
4465     }
4466 
4467     /* Fake LUKS creation in order to determine the payload size */
4468     crypto = qcrypto_block_create(cryptoopts, "encrypt.",
4469                                   qcow2_measure_crypto_hdr_init_func,
4470                                   qcow2_measure_crypto_hdr_write_func,
4471                                   len, errp);
4472     qapi_free_QCryptoBlockCreateOptions(cryptoopts);
4473     if (!crypto) {
4474         return false;
4475     }
4476 
4477     qcrypto_block_free(crypto);
4478     return true;
4479 }
4480 
4481 static BlockMeasureInfo *qcow2_measure(QemuOpts *opts, BlockDriverState *in_bs,
4482                                        Error **errp)
4483 {
4484     Error *local_err = NULL;
4485     BlockMeasureInfo *info;
4486     uint64_t required = 0; /* bytes that contribute to required size */
4487     uint64_t virtual_size; /* disk size as seen by guest */
4488     uint64_t refcount_bits;
4489     uint64_t l2_tables;
4490     uint64_t luks_payload_size = 0;
4491     size_t cluster_size;
4492     int version;
4493     char *optstr;
4494     PreallocMode prealloc;
4495     bool has_backing_file;
4496     bool has_luks;
4497 
4498     /* Parse image creation options */
4499     cluster_size = qcow2_opt_get_cluster_size_del(opts, &local_err);
4500     if (local_err) {
4501         goto err;
4502     }
4503 
4504     version = qcow2_opt_get_version_del(opts, &local_err);
4505     if (local_err) {
4506         goto err;
4507     }
4508 
4509     refcount_bits = qcow2_opt_get_refcount_bits_del(opts, version, &local_err);
4510     if (local_err) {
4511         goto err;
4512     }
4513 
4514     optstr = qemu_opt_get_del(opts, BLOCK_OPT_PREALLOC);
4515     prealloc = qapi_enum_parse(&PreallocMode_lookup, optstr,
4516                                PREALLOC_MODE_OFF, &local_err);
4517     g_free(optstr);
4518     if (local_err) {
4519         goto err;
4520     }
4521 
4522     optstr = qemu_opt_get_del(opts, BLOCK_OPT_BACKING_FILE);
4523     has_backing_file = !!optstr;
4524     g_free(optstr);
4525 
4526     optstr = qemu_opt_get_del(opts, BLOCK_OPT_ENCRYPT_FORMAT);
4527     has_luks = optstr && strcmp(optstr, "luks") == 0;
4528     g_free(optstr);
4529 
4530     if (has_luks) {
4531         size_t headerlen;
4532 
4533         if (!qcow2_measure_luks_headerlen(opts, &headerlen, &local_err)) {
4534             goto err;
4535         }
4536 
4537         luks_payload_size = ROUND_UP(headerlen, cluster_size);
4538     }
4539 
4540     virtual_size = qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0);
4541     virtual_size = ROUND_UP(virtual_size, cluster_size);
4542 
4543     /* Check that virtual disk size is valid */
4544     l2_tables = DIV_ROUND_UP(virtual_size / cluster_size,
4545                              cluster_size / sizeof(uint64_t));
4546     if (l2_tables * sizeof(uint64_t) > QCOW_MAX_L1_SIZE) {
4547         error_setg(&local_err, "The image size is too large "
4548                                "(try using a larger cluster size)");
4549         goto err;
4550     }
4551 
4552     /* Account for input image */
4553     if (in_bs) {
4554         int64_t ssize = bdrv_getlength(in_bs);
4555         if (ssize < 0) {
4556             error_setg_errno(&local_err, -ssize,
4557                              "Unable to get image virtual_size");
4558             goto err;
4559         }
4560 
4561         virtual_size = ROUND_UP(ssize, cluster_size);
4562 
4563         if (has_backing_file) {
4564             /* We don't how much of the backing chain is shared by the input
4565              * image and the new image file.  In the worst case the new image's
4566              * backing file has nothing in common with the input image.  Be
4567              * conservative and assume all clusters need to be written.
4568              */
4569             required = virtual_size;
4570         } else {
4571             int64_t offset;
4572             int64_t pnum = 0;
4573 
4574             for (offset = 0; offset < ssize; offset += pnum) {
4575                 int ret;
4576 
4577                 ret = bdrv_block_status_above(in_bs, NULL, offset,
4578                                               ssize - offset, &pnum, NULL,
4579                                               NULL);
4580                 if (ret < 0) {
4581                     error_setg_errno(&local_err, -ret,
4582                                      "Unable to get block status");
4583                     goto err;
4584                 }
4585 
4586                 if (ret & BDRV_BLOCK_ZERO) {
4587                     /* Skip zero regions (safe with no backing file) */
4588                 } else if ((ret & (BDRV_BLOCK_DATA | BDRV_BLOCK_ALLOCATED)) ==
4589                            (BDRV_BLOCK_DATA | BDRV_BLOCK_ALLOCATED)) {
4590                     /* Extend pnum to end of cluster for next iteration */
4591                     pnum = ROUND_UP(offset + pnum, cluster_size) - offset;
4592 
4593                     /* Count clusters we've seen */
4594                     required += offset % cluster_size + pnum;
4595                 }
4596             }
4597         }
4598     }
4599 
4600     /* Take into account preallocation.  Nothing special is needed for
4601      * PREALLOC_MODE_METADATA since metadata is always counted.
4602      */
4603     if (prealloc == PREALLOC_MODE_FULL || prealloc == PREALLOC_MODE_FALLOC) {
4604         required = virtual_size;
4605     }
4606 
4607     info = g_new(BlockMeasureInfo, 1);
4608     info->fully_allocated =
4609         qcow2_calc_prealloc_size(virtual_size, cluster_size,
4610                                  ctz32(refcount_bits)) + luks_payload_size;
4611 
4612     /* Remove data clusters that are not required.  This overestimates the
4613      * required size because metadata needed for the fully allocated file is
4614      * still counted.
4615      */
4616     info->required = info->fully_allocated - virtual_size + required;
4617     return info;
4618 
4619 err:
4620     error_propagate(errp, local_err);
4621     return NULL;
4622 }
4623 
4624 static int qcow2_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
4625 {
4626     BDRVQcow2State *s = bs->opaque;
4627     bdi->unallocated_blocks_are_zero = true;
4628     bdi->cluster_size = s->cluster_size;
4629     bdi->vm_state_offset = qcow2_vm_state_offset(s);
4630     return 0;
4631 }
4632 
4633 static ImageInfoSpecific *qcow2_get_specific_info(BlockDriverState *bs,
4634                                                   Error **errp)
4635 {
4636     BDRVQcow2State *s = bs->opaque;
4637     ImageInfoSpecific *spec_info;
4638     QCryptoBlockInfo *encrypt_info = NULL;
4639     Error *local_err = NULL;
4640 
4641     if (s->crypto != NULL) {
4642         encrypt_info = qcrypto_block_get_info(s->crypto, &local_err);
4643         if (local_err) {
4644             error_propagate(errp, local_err);
4645             return NULL;
4646         }
4647     }
4648 
4649     spec_info = g_new(ImageInfoSpecific, 1);
4650     *spec_info = (ImageInfoSpecific){
4651         .type  = IMAGE_INFO_SPECIFIC_KIND_QCOW2,
4652         .u.qcow2.data = g_new0(ImageInfoSpecificQCow2, 1),
4653     };
4654     if (s->qcow_version == 2) {
4655         *spec_info->u.qcow2.data = (ImageInfoSpecificQCow2){
4656             .compat             = g_strdup("0.10"),
4657             .refcount_bits      = s->refcount_bits,
4658         };
4659     } else if (s->qcow_version == 3) {
4660         Qcow2BitmapInfoList *bitmaps;
4661         bitmaps = qcow2_get_bitmap_info_list(bs, &local_err);
4662         if (local_err) {
4663             error_propagate(errp, local_err);
4664             qapi_free_ImageInfoSpecific(spec_info);
4665             return NULL;
4666         }
4667         *spec_info->u.qcow2.data = (ImageInfoSpecificQCow2){
4668             .compat             = g_strdup("1.1"),
4669             .lazy_refcounts     = s->compatible_features &
4670                                   QCOW2_COMPAT_LAZY_REFCOUNTS,
4671             .has_lazy_refcounts = true,
4672             .corrupt            = s->incompatible_features &
4673                                   QCOW2_INCOMPAT_CORRUPT,
4674             .has_corrupt        = true,
4675             .refcount_bits      = s->refcount_bits,
4676             .has_bitmaps        = !!bitmaps,
4677             .bitmaps            = bitmaps,
4678             .has_data_file      = !!s->image_data_file,
4679             .data_file          = g_strdup(s->image_data_file),
4680             .has_data_file_raw  = has_data_file(bs),
4681             .data_file_raw      = data_file_is_raw(bs),
4682         };
4683     } else {
4684         /* if this assertion fails, this probably means a new version was
4685          * added without having it covered here */
4686         assert(false);
4687     }
4688 
4689     if (encrypt_info) {
4690         ImageInfoSpecificQCow2Encryption *qencrypt =
4691             g_new(ImageInfoSpecificQCow2Encryption, 1);
4692         switch (encrypt_info->format) {
4693         case Q_CRYPTO_BLOCK_FORMAT_QCOW:
4694             qencrypt->format = BLOCKDEV_QCOW2_ENCRYPTION_FORMAT_AES;
4695             break;
4696         case Q_CRYPTO_BLOCK_FORMAT_LUKS:
4697             qencrypt->format = BLOCKDEV_QCOW2_ENCRYPTION_FORMAT_LUKS;
4698             qencrypt->u.luks = encrypt_info->u.luks;
4699             break;
4700         default:
4701             abort();
4702         }
4703         /* Since we did shallow copy above, erase any pointers
4704          * in the original info */
4705         memset(&encrypt_info->u, 0, sizeof(encrypt_info->u));
4706         qapi_free_QCryptoBlockInfo(encrypt_info);
4707 
4708         spec_info->u.qcow2.data->has_encrypt = true;
4709         spec_info->u.qcow2.data->encrypt = qencrypt;
4710     }
4711 
4712     return spec_info;
4713 }
4714 
4715 static int qcow2_save_vmstate(BlockDriverState *bs, QEMUIOVector *qiov,
4716                               int64_t pos)
4717 {
4718     BDRVQcow2State *s = bs->opaque;
4719 
4720     BLKDBG_EVENT(bs->file, BLKDBG_VMSTATE_SAVE);
4721     return bs->drv->bdrv_co_pwritev(bs, qcow2_vm_state_offset(s) + pos,
4722                                     qiov->size, qiov, 0);
4723 }
4724 
4725 static int qcow2_load_vmstate(BlockDriverState *bs, QEMUIOVector *qiov,
4726                               int64_t pos)
4727 {
4728     BDRVQcow2State *s = bs->opaque;
4729 
4730     BLKDBG_EVENT(bs->file, BLKDBG_VMSTATE_LOAD);
4731     return bs->drv->bdrv_co_preadv(bs, qcow2_vm_state_offset(s) + pos,
4732                                    qiov->size, qiov, 0);
4733 }
4734 
4735 /*
4736  * Downgrades an image's version. To achieve this, any incompatible features
4737  * have to be removed.
4738  */
4739 static int qcow2_downgrade(BlockDriverState *bs, int target_version,
4740                            BlockDriverAmendStatusCB *status_cb, void *cb_opaque,
4741                            Error **errp)
4742 {
4743     BDRVQcow2State *s = bs->opaque;
4744     int current_version = s->qcow_version;
4745     int ret;
4746 
4747     /* This is qcow2_downgrade(), not qcow2_upgrade() */
4748     assert(target_version < current_version);
4749 
4750     /* There are no other versions (now) that you can downgrade to */
4751     assert(target_version == 2);
4752 
4753     if (s->refcount_order != 4) {
4754         error_setg(errp, "compat=0.10 requires refcount_bits=16");
4755         return -ENOTSUP;
4756     }
4757 
4758     if (has_data_file(bs)) {
4759         error_setg(errp, "Cannot downgrade an image with a data file");
4760         return -ENOTSUP;
4761     }
4762 
4763     /* clear incompatible features */
4764     if (s->incompatible_features & QCOW2_INCOMPAT_DIRTY) {
4765         ret = qcow2_mark_clean(bs);
4766         if (ret < 0) {
4767             error_setg_errno(errp, -ret, "Failed to make the image clean");
4768             return ret;
4769         }
4770     }
4771 
4772     /* with QCOW2_INCOMPAT_CORRUPT, it is pretty much impossible to get here in
4773      * the first place; if that happens nonetheless, returning -ENOTSUP is the
4774      * best thing to do anyway */
4775 
4776     if (s->incompatible_features) {
4777         error_setg(errp, "Cannot downgrade an image with incompatible features "
4778                    "%#" PRIx64 " set", s->incompatible_features);
4779         return -ENOTSUP;
4780     }
4781 
4782     /* since we can ignore compatible features, we can set them to 0 as well */
4783     s->compatible_features = 0;
4784     /* if lazy refcounts have been used, they have already been fixed through
4785      * clearing the dirty flag */
4786 
4787     /* clearing autoclear features is trivial */
4788     s->autoclear_features = 0;
4789 
4790     ret = qcow2_expand_zero_clusters(bs, status_cb, cb_opaque);
4791     if (ret < 0) {
4792         error_setg_errno(errp, -ret, "Failed to turn zero into data clusters");
4793         return ret;
4794     }
4795 
4796     s->qcow_version = target_version;
4797     ret = qcow2_update_header(bs);
4798     if (ret < 0) {
4799         s->qcow_version = current_version;
4800         error_setg_errno(errp, -ret, "Failed to update the image header");
4801         return ret;
4802     }
4803     return 0;
4804 }
4805 
4806 typedef enum Qcow2AmendOperation {
4807     /* This is the value Qcow2AmendHelperCBInfo::last_operation will be
4808      * statically initialized to so that the helper CB can discern the first
4809      * invocation from an operation change */
4810     QCOW2_NO_OPERATION = 0,
4811 
4812     QCOW2_CHANGING_REFCOUNT_ORDER,
4813     QCOW2_DOWNGRADING,
4814 } Qcow2AmendOperation;
4815 
4816 typedef struct Qcow2AmendHelperCBInfo {
4817     /* The code coordinating the amend operations should only modify
4818      * these four fields; the rest will be managed by the CB */
4819     BlockDriverAmendStatusCB *original_status_cb;
4820     void *original_cb_opaque;
4821 
4822     Qcow2AmendOperation current_operation;
4823 
4824     /* Total number of operations to perform (only set once) */
4825     int total_operations;
4826 
4827     /* The following fields are managed by the CB */
4828 
4829     /* Number of operations completed */
4830     int operations_completed;
4831 
4832     /* Cumulative offset of all completed operations */
4833     int64_t offset_completed;
4834 
4835     Qcow2AmendOperation last_operation;
4836     int64_t last_work_size;
4837 } Qcow2AmendHelperCBInfo;
4838 
4839 static void qcow2_amend_helper_cb(BlockDriverState *bs,
4840                                   int64_t operation_offset,
4841                                   int64_t operation_work_size, void *opaque)
4842 {
4843     Qcow2AmendHelperCBInfo *info = opaque;
4844     int64_t current_work_size;
4845     int64_t projected_work_size;
4846 
4847     if (info->current_operation != info->last_operation) {
4848         if (info->last_operation != QCOW2_NO_OPERATION) {
4849             info->offset_completed += info->last_work_size;
4850             info->operations_completed++;
4851         }
4852 
4853         info->last_operation = info->current_operation;
4854     }
4855 
4856     assert(info->total_operations > 0);
4857     assert(info->operations_completed < info->total_operations);
4858 
4859     info->last_work_size = operation_work_size;
4860 
4861     current_work_size = info->offset_completed + operation_work_size;
4862 
4863     /* current_work_size is the total work size for (operations_completed + 1)
4864      * operations (which includes this one), so multiply it by the number of
4865      * operations not covered and divide it by the number of operations
4866      * covered to get a projection for the operations not covered */
4867     projected_work_size = current_work_size * (info->total_operations -
4868                                                info->operations_completed - 1)
4869                                             / (info->operations_completed + 1);
4870 
4871     info->original_status_cb(bs, info->offset_completed + operation_offset,
4872                              current_work_size + projected_work_size,
4873                              info->original_cb_opaque);
4874 }
4875 
4876 static int qcow2_amend_options(BlockDriverState *bs, QemuOpts *opts,
4877                                BlockDriverAmendStatusCB *status_cb,
4878                                void *cb_opaque,
4879                                Error **errp)
4880 {
4881     BDRVQcow2State *s = bs->opaque;
4882     int old_version = s->qcow_version, new_version = old_version;
4883     uint64_t new_size = 0;
4884     const char *backing_file = NULL, *backing_format = NULL, *data_file = NULL;
4885     bool lazy_refcounts = s->use_lazy_refcounts;
4886     bool data_file_raw = data_file_is_raw(bs);
4887     const char *compat = NULL;
4888     uint64_t cluster_size = s->cluster_size;
4889     bool encrypt;
4890     int encformat;
4891     int refcount_bits = s->refcount_bits;
4892     int ret;
4893     QemuOptDesc *desc = opts->list->desc;
4894     Qcow2AmendHelperCBInfo helper_cb_info;
4895 
4896     while (desc && desc->name) {
4897         if (!qemu_opt_find(opts, desc->name)) {
4898             /* only change explicitly defined options */
4899             desc++;
4900             continue;
4901         }
4902 
4903         if (!strcmp(desc->name, BLOCK_OPT_COMPAT_LEVEL)) {
4904             compat = qemu_opt_get(opts, BLOCK_OPT_COMPAT_LEVEL);
4905             if (!compat) {
4906                 /* preserve default */
4907             } else if (!strcmp(compat, "0.10")) {
4908                 new_version = 2;
4909             } else if (!strcmp(compat, "1.1")) {
4910                 new_version = 3;
4911             } else {
4912                 error_setg(errp, "Unknown compatibility level %s", compat);
4913                 return -EINVAL;
4914             }
4915         } else if (!strcmp(desc->name, BLOCK_OPT_PREALLOC)) {
4916             error_setg(errp, "Cannot change preallocation mode");
4917             return -ENOTSUP;
4918         } else if (!strcmp(desc->name, BLOCK_OPT_SIZE)) {
4919             new_size = qemu_opt_get_size(opts, BLOCK_OPT_SIZE, 0);
4920         } else if (!strcmp(desc->name, BLOCK_OPT_BACKING_FILE)) {
4921             backing_file = qemu_opt_get(opts, BLOCK_OPT_BACKING_FILE);
4922         } else if (!strcmp(desc->name, BLOCK_OPT_BACKING_FMT)) {
4923             backing_format = qemu_opt_get(opts, BLOCK_OPT_BACKING_FMT);
4924         } else if (!strcmp(desc->name, BLOCK_OPT_ENCRYPT)) {
4925             encrypt = qemu_opt_get_bool(opts, BLOCK_OPT_ENCRYPT,
4926                                         !!s->crypto);
4927 
4928             if (encrypt != !!s->crypto) {
4929                 error_setg(errp,
4930                            "Changing the encryption flag is not supported");
4931                 return -ENOTSUP;
4932             }
4933         } else if (!strcmp(desc->name, BLOCK_OPT_ENCRYPT_FORMAT)) {
4934             encformat = qcow2_crypt_method_from_format(
4935                 qemu_opt_get(opts, BLOCK_OPT_ENCRYPT_FORMAT));
4936 
4937             if (encformat != s->crypt_method_header) {
4938                 error_setg(errp,
4939                            "Changing the encryption format is not supported");
4940                 return -ENOTSUP;
4941             }
4942         } else if (g_str_has_prefix(desc->name, "encrypt.")) {
4943             error_setg(errp,
4944                        "Changing the encryption parameters is not supported");
4945             return -ENOTSUP;
4946         } else if (!strcmp(desc->name, BLOCK_OPT_CLUSTER_SIZE)) {
4947             cluster_size = qemu_opt_get_size(opts, BLOCK_OPT_CLUSTER_SIZE,
4948                                              cluster_size);
4949             if (cluster_size != s->cluster_size) {
4950                 error_setg(errp, "Changing the cluster size is not supported");
4951                 return -ENOTSUP;
4952             }
4953         } else if (!strcmp(desc->name, BLOCK_OPT_LAZY_REFCOUNTS)) {
4954             lazy_refcounts = qemu_opt_get_bool(opts, BLOCK_OPT_LAZY_REFCOUNTS,
4955                                                lazy_refcounts);
4956         } else if (!strcmp(desc->name, BLOCK_OPT_REFCOUNT_BITS)) {
4957             refcount_bits = qemu_opt_get_number(opts, BLOCK_OPT_REFCOUNT_BITS,
4958                                                 refcount_bits);
4959 
4960             if (refcount_bits <= 0 || refcount_bits > 64 ||
4961                 !is_power_of_2(refcount_bits))
4962             {
4963                 error_setg(errp, "Refcount width must be a power of two and "
4964                            "may not exceed 64 bits");
4965                 return -EINVAL;
4966             }
4967         } else if (!strcmp(desc->name, BLOCK_OPT_DATA_FILE)) {
4968             data_file = qemu_opt_get(opts, BLOCK_OPT_DATA_FILE);
4969             if (data_file && !has_data_file(bs)) {
4970                 error_setg(errp, "data-file can only be set for images that "
4971                                  "use an external data file");
4972                 return -EINVAL;
4973             }
4974         } else if (!strcmp(desc->name, BLOCK_OPT_DATA_FILE_RAW)) {
4975             data_file_raw = qemu_opt_get_bool(opts, BLOCK_OPT_DATA_FILE_RAW,
4976                                               data_file_raw);
4977             if (data_file_raw && !data_file_is_raw(bs)) {
4978                 error_setg(errp, "data-file-raw cannot be set on existing "
4979                                  "images");
4980                 return -EINVAL;
4981             }
4982         } else {
4983             /* if this point is reached, this probably means a new option was
4984              * added without having it covered here */
4985             abort();
4986         }
4987 
4988         desc++;
4989     }
4990 
4991     helper_cb_info = (Qcow2AmendHelperCBInfo){
4992         .original_status_cb = status_cb,
4993         .original_cb_opaque = cb_opaque,
4994         .total_operations = (new_version < old_version)
4995                           + (s->refcount_bits != refcount_bits)
4996     };
4997 
4998     /* Upgrade first (some features may require compat=1.1) */
4999     if (new_version > old_version) {
5000         s->qcow_version = new_version;
5001         ret = qcow2_update_header(bs);
5002         if (ret < 0) {
5003             s->qcow_version = old_version;
5004             error_setg_errno(errp, -ret, "Failed to update the image header");
5005             return ret;
5006         }
5007     }
5008 
5009     if (s->refcount_bits != refcount_bits) {
5010         int refcount_order = ctz32(refcount_bits);
5011 
5012         if (new_version < 3 && refcount_bits != 16) {
5013             error_setg(errp, "Refcount widths other than 16 bits require "
5014                        "compatibility level 1.1 or above (use compat=1.1 or "
5015                        "greater)");
5016             return -EINVAL;
5017         }
5018 
5019         helper_cb_info.current_operation = QCOW2_CHANGING_REFCOUNT_ORDER;
5020         ret = qcow2_change_refcount_order(bs, refcount_order,
5021                                           &qcow2_amend_helper_cb,
5022                                           &helper_cb_info, errp);
5023         if (ret < 0) {
5024             return ret;
5025         }
5026     }
5027 
5028     /* data-file-raw blocks backing files, so clear it first if requested */
5029     if (data_file_raw) {
5030         s->autoclear_features |= QCOW2_AUTOCLEAR_DATA_FILE_RAW;
5031     } else {
5032         s->autoclear_features &= ~QCOW2_AUTOCLEAR_DATA_FILE_RAW;
5033     }
5034 
5035     if (data_file) {
5036         g_free(s->image_data_file);
5037         s->image_data_file = *data_file ? g_strdup(data_file) : NULL;
5038     }
5039 
5040     ret = qcow2_update_header(bs);
5041     if (ret < 0) {
5042         error_setg_errno(errp, -ret, "Failed to update the image header");
5043         return ret;
5044     }
5045 
5046     if (backing_file || backing_format) {
5047         ret = qcow2_change_backing_file(bs,
5048                     backing_file ?: s->image_backing_file,
5049                     backing_format ?: s->image_backing_format);
5050         if (ret < 0) {
5051             error_setg_errno(errp, -ret, "Failed to change the backing file");
5052             return ret;
5053         }
5054     }
5055 
5056     if (s->use_lazy_refcounts != lazy_refcounts) {
5057         if (lazy_refcounts) {
5058             if (new_version < 3) {
5059                 error_setg(errp, "Lazy refcounts only supported with "
5060                            "compatibility level 1.1 and above (use compat=1.1 "
5061                            "or greater)");
5062                 return -EINVAL;
5063             }
5064             s->compatible_features |= QCOW2_COMPAT_LAZY_REFCOUNTS;
5065             ret = qcow2_update_header(bs);
5066             if (ret < 0) {
5067                 s->compatible_features &= ~QCOW2_COMPAT_LAZY_REFCOUNTS;
5068                 error_setg_errno(errp, -ret, "Failed to update the image header");
5069                 return ret;
5070             }
5071             s->use_lazy_refcounts = true;
5072         } else {
5073             /* make image clean first */
5074             ret = qcow2_mark_clean(bs);
5075             if (ret < 0) {
5076                 error_setg_errno(errp, -ret, "Failed to make the image clean");
5077                 return ret;
5078             }
5079             /* now disallow lazy refcounts */
5080             s->compatible_features &= ~QCOW2_COMPAT_LAZY_REFCOUNTS;
5081             ret = qcow2_update_header(bs);
5082             if (ret < 0) {
5083                 s->compatible_features |= QCOW2_COMPAT_LAZY_REFCOUNTS;
5084                 error_setg_errno(errp, -ret, "Failed to update the image header");
5085                 return ret;
5086             }
5087             s->use_lazy_refcounts = false;
5088         }
5089     }
5090 
5091     if (new_size) {
5092         BlockBackend *blk = blk_new(BLK_PERM_RESIZE, BLK_PERM_ALL);
5093         ret = blk_insert_bs(blk, bs, errp);
5094         if (ret < 0) {
5095             blk_unref(blk);
5096             return ret;
5097         }
5098 
5099         ret = blk_truncate(blk, new_size, PREALLOC_MODE_OFF, errp);
5100         blk_unref(blk);
5101         if (ret < 0) {
5102             return ret;
5103         }
5104     }
5105 
5106     /* Downgrade last (so unsupported features can be removed before) */
5107     if (new_version < old_version) {
5108         helper_cb_info.current_operation = QCOW2_DOWNGRADING;
5109         ret = qcow2_downgrade(bs, new_version, &qcow2_amend_helper_cb,
5110                               &helper_cb_info, errp);
5111         if (ret < 0) {
5112             return ret;
5113         }
5114     }
5115 
5116     return 0;
5117 }
5118 
5119 /*
5120  * If offset or size are negative, respectively, they will not be included in
5121  * the BLOCK_IMAGE_CORRUPTED event emitted.
5122  * fatal will be ignored for read-only BDS; corruptions found there will always
5123  * be considered non-fatal.
5124  */
5125 void qcow2_signal_corruption(BlockDriverState *bs, bool fatal, int64_t offset,
5126                              int64_t size, const char *message_format, ...)
5127 {
5128     BDRVQcow2State *s = bs->opaque;
5129     const char *node_name;
5130     char *message;
5131     va_list ap;
5132 
5133     fatal = fatal && bdrv_is_writable(bs);
5134 
5135     if (s->signaled_corruption &&
5136         (!fatal || (s->incompatible_features & QCOW2_INCOMPAT_CORRUPT)))
5137     {
5138         return;
5139     }
5140 
5141     va_start(ap, message_format);
5142     message = g_strdup_vprintf(message_format, ap);
5143     va_end(ap);
5144 
5145     if (fatal) {
5146         fprintf(stderr, "qcow2: Marking image as corrupt: %s; further "
5147                 "corruption events will be suppressed\n", message);
5148     } else {
5149         fprintf(stderr, "qcow2: Image is corrupt: %s; further non-fatal "
5150                 "corruption events will be suppressed\n", message);
5151     }
5152 
5153     node_name = bdrv_get_node_name(bs);
5154     qapi_event_send_block_image_corrupted(bdrv_get_device_name(bs),
5155                                           *node_name != '\0', node_name,
5156                                           message, offset >= 0, offset,
5157                                           size >= 0, size,
5158                                           fatal);
5159     g_free(message);
5160 
5161     if (fatal) {
5162         qcow2_mark_corrupt(bs);
5163         bs->drv = NULL; /* make BDS unusable */
5164     }
5165 
5166     s->signaled_corruption = true;
5167 }
5168 
5169 static QemuOptsList qcow2_create_opts = {
5170     .name = "qcow2-create-opts",
5171     .head = QTAILQ_HEAD_INITIALIZER(qcow2_create_opts.head),
5172     .desc = {
5173         {
5174             .name = BLOCK_OPT_SIZE,
5175             .type = QEMU_OPT_SIZE,
5176             .help = "Virtual disk size"
5177         },
5178         {
5179             .name = BLOCK_OPT_COMPAT_LEVEL,
5180             .type = QEMU_OPT_STRING,
5181             .help = "Compatibility level (0.10 or 1.1)"
5182         },
5183         {
5184             .name = BLOCK_OPT_BACKING_FILE,
5185             .type = QEMU_OPT_STRING,
5186             .help = "File name of a base image"
5187         },
5188         {
5189             .name = BLOCK_OPT_BACKING_FMT,
5190             .type = QEMU_OPT_STRING,
5191             .help = "Image format of the base image"
5192         },
5193         {
5194             .name = BLOCK_OPT_DATA_FILE,
5195             .type = QEMU_OPT_STRING,
5196             .help = "File name of an external data file"
5197         },
5198         {
5199             .name = BLOCK_OPT_DATA_FILE_RAW,
5200             .type = QEMU_OPT_BOOL,
5201             .help = "The external data file must stay valid as a raw image"
5202         },
5203         {
5204             .name = BLOCK_OPT_ENCRYPT,
5205             .type = QEMU_OPT_BOOL,
5206             .help = "Encrypt the image with format 'aes'. (Deprecated "
5207                     "in favor of " BLOCK_OPT_ENCRYPT_FORMAT "=aes)",
5208         },
5209         {
5210             .name = BLOCK_OPT_ENCRYPT_FORMAT,
5211             .type = QEMU_OPT_STRING,
5212             .help = "Encrypt the image, format choices: 'aes', 'luks'",
5213         },
5214         BLOCK_CRYPTO_OPT_DEF_KEY_SECRET("encrypt.",
5215             "ID of secret providing qcow AES key or LUKS passphrase"),
5216         BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_ALG("encrypt."),
5217         BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_MODE("encrypt."),
5218         BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_ALG("encrypt."),
5219         BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_HASH_ALG("encrypt."),
5220         BLOCK_CRYPTO_OPT_DEF_LUKS_HASH_ALG("encrypt."),
5221         BLOCK_CRYPTO_OPT_DEF_LUKS_ITER_TIME("encrypt."),
5222         {
5223             .name = BLOCK_OPT_CLUSTER_SIZE,
5224             .type = QEMU_OPT_SIZE,
5225             .help = "qcow2 cluster size",
5226             .def_value_str = stringify(DEFAULT_CLUSTER_SIZE)
5227         },
5228         {
5229             .name = BLOCK_OPT_PREALLOC,
5230             .type = QEMU_OPT_STRING,
5231             .help = "Preallocation mode (allowed values: off, metadata, "
5232                     "falloc, full)"
5233         },
5234         {
5235             .name = BLOCK_OPT_LAZY_REFCOUNTS,
5236             .type = QEMU_OPT_BOOL,
5237             .help = "Postpone refcount updates",
5238             .def_value_str = "off"
5239         },
5240         {
5241             .name = BLOCK_OPT_REFCOUNT_BITS,
5242             .type = QEMU_OPT_NUMBER,
5243             .help = "Width of a reference count entry in bits",
5244             .def_value_str = "16"
5245         },
5246         { /* end of list */ }
5247     }
5248 };
5249 
5250 static const char *const qcow2_strong_runtime_opts[] = {
5251     "encrypt." BLOCK_CRYPTO_OPT_QCOW_KEY_SECRET,
5252 
5253     NULL
5254 };
5255 
5256 BlockDriver bdrv_qcow2 = {
5257     .format_name        = "qcow2",
5258     .instance_size      = sizeof(BDRVQcow2State),
5259     .bdrv_probe         = qcow2_probe,
5260     .bdrv_open          = qcow2_open,
5261     .bdrv_close         = qcow2_close,
5262     .bdrv_reopen_prepare  = qcow2_reopen_prepare,
5263     .bdrv_reopen_commit   = qcow2_reopen_commit,
5264     .bdrv_reopen_abort    = qcow2_reopen_abort,
5265     .bdrv_join_options    = qcow2_join_options,
5266     .bdrv_child_perm      = bdrv_format_default_perms,
5267     .bdrv_co_create_opts  = qcow2_co_create_opts,
5268     .bdrv_co_create       = qcow2_co_create,
5269     .bdrv_has_zero_init = bdrv_has_zero_init_1,
5270     .bdrv_co_block_status = qcow2_co_block_status,
5271 
5272     .bdrv_co_preadv         = qcow2_co_preadv,
5273     .bdrv_co_pwritev        = qcow2_co_pwritev,
5274     .bdrv_co_flush_to_os    = qcow2_co_flush_to_os,
5275 
5276     .bdrv_co_pwrite_zeroes  = qcow2_co_pwrite_zeroes,
5277     .bdrv_co_pdiscard       = qcow2_co_pdiscard,
5278     .bdrv_co_copy_range_from = qcow2_co_copy_range_from,
5279     .bdrv_co_copy_range_to  = qcow2_co_copy_range_to,
5280     .bdrv_co_truncate       = qcow2_co_truncate,
5281     .bdrv_co_pwritev_compressed = qcow2_co_pwritev_compressed,
5282     .bdrv_make_empty        = qcow2_make_empty,
5283 
5284     .bdrv_snapshot_create   = qcow2_snapshot_create,
5285     .bdrv_snapshot_goto     = qcow2_snapshot_goto,
5286     .bdrv_snapshot_delete   = qcow2_snapshot_delete,
5287     .bdrv_snapshot_list     = qcow2_snapshot_list,
5288     .bdrv_snapshot_load_tmp = qcow2_snapshot_load_tmp,
5289     .bdrv_measure           = qcow2_measure,
5290     .bdrv_get_info          = qcow2_get_info,
5291     .bdrv_get_specific_info = qcow2_get_specific_info,
5292 
5293     .bdrv_save_vmstate    = qcow2_save_vmstate,
5294     .bdrv_load_vmstate    = qcow2_load_vmstate,
5295 
5296     .supports_backing           = true,
5297     .bdrv_change_backing_file   = qcow2_change_backing_file,
5298 
5299     .bdrv_refresh_limits        = qcow2_refresh_limits,
5300     .bdrv_co_invalidate_cache   = qcow2_co_invalidate_cache,
5301     .bdrv_inactivate            = qcow2_inactivate,
5302 
5303     .create_opts         = &qcow2_create_opts,
5304     .strong_runtime_opts = qcow2_strong_runtime_opts,
5305     .mutable_opts        = mutable_opts,
5306     .bdrv_co_check       = qcow2_co_check,
5307     .bdrv_amend_options  = qcow2_amend_options,
5308 
5309     .bdrv_detach_aio_context  = qcow2_detach_aio_context,
5310     .bdrv_attach_aio_context  = qcow2_attach_aio_context,
5311 
5312     .bdrv_reopen_bitmaps_rw = qcow2_reopen_bitmaps_rw,
5313     .bdrv_can_store_new_dirty_bitmap = qcow2_can_store_new_dirty_bitmap,
5314     .bdrv_remove_persistent_dirty_bitmap = qcow2_remove_persistent_dirty_bitmap,
5315 };
5316 
5317 static void bdrv_qcow2_init(void)
5318 {
5319     bdrv_register(&bdrv_qcow2);
5320 }
5321 
5322 block_init(bdrv_qcow2_init);
5323