xref: /openbmc/qemu/block/qcow2.c (revision 52f2b8961409be834abaee5189bff2cc9e372851)
1 /*
2  * Block driver for the QCOW version 2 format
3  *
4  * Copyright (c) 2004-2006 Fabrice Bellard
5  *
6  * Permission is hereby granted, free of charge, to any person obtaining a copy
7  * of this software and associated documentation files (the "Software"), to deal
8  * in the Software without restriction, including without limitation the rights
9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10  * copies of the Software, and to permit persons to whom the Software is
11  * furnished to do so, subject to the following conditions:
12  *
13  * The above copyright notice and this permission notice shall be included in
14  * all copies or substantial portions of the Software.
15  *
16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22  * THE SOFTWARE.
23  */
24 
25 #include "qemu/osdep.h"
26 
27 #include "block/qdict.h"
28 #include "sysemu/block-backend.h"
29 #include "qemu/module.h"
30 #include "qcow2.h"
31 #include "qemu/error-report.h"
32 #include "qapi/error.h"
33 #include "qapi/qapi-events-block-core.h"
34 #include "qapi/qmp/qdict.h"
35 #include "qapi/qmp/qstring.h"
36 #include "trace.h"
37 #include "qemu/option_int.h"
38 #include "qemu/cutils.h"
39 #include "qemu/bswap.h"
40 #include "qapi/qobject-input-visitor.h"
41 #include "qapi/qapi-visit-block-core.h"
42 #include "crypto.h"
43 
44 /*
45   Differences with QCOW:
46 
47   - Support for multiple incremental snapshots.
48   - Memory management by reference counts.
49   - Clusters which have a reference count of one have the bit
50     QCOW_OFLAG_COPIED to optimize write performance.
51   - Size of compressed clusters is stored in sectors to reduce bit usage
52     in the cluster offsets.
53   - Support for storing additional data (such as the VM state) in the
54     snapshots.
55   - If a backing store is used, the cluster size is not constrained
56     (could be backported to QCOW).
57   - L2 tables have always a size of one cluster.
58 */
59 
60 
61 typedef struct {
62     uint32_t magic;
63     uint32_t len;
64 } QEMU_PACKED QCowExtension;
65 
66 #define  QCOW2_EXT_MAGIC_END 0
67 #define  QCOW2_EXT_MAGIC_BACKING_FORMAT 0xE2792ACA
68 #define  QCOW2_EXT_MAGIC_FEATURE_TABLE 0x6803f857
69 #define  QCOW2_EXT_MAGIC_CRYPTO_HEADER 0x0537be77
70 #define  QCOW2_EXT_MAGIC_BITMAPS 0x23852875
71 #define  QCOW2_EXT_MAGIC_DATA_FILE 0x44415441
72 
73 static int coroutine_fn
74 qcow2_co_preadv_compressed(BlockDriverState *bs,
75                            uint64_t file_cluster_offset,
76                            uint64_t offset,
77                            uint64_t bytes,
78                            QEMUIOVector *qiov);
79 
80 static int qcow2_probe(const uint8_t *buf, int buf_size, const char *filename)
81 {
82     const QCowHeader *cow_header = (const void *)buf;
83 
84     if (buf_size >= sizeof(QCowHeader) &&
85         be32_to_cpu(cow_header->magic) == QCOW_MAGIC &&
86         be32_to_cpu(cow_header->version) >= 2)
87         return 100;
88     else
89         return 0;
90 }
91 
92 
93 static ssize_t qcow2_crypto_hdr_read_func(QCryptoBlock *block, size_t offset,
94                                           uint8_t *buf, size_t buflen,
95                                           void *opaque, Error **errp)
96 {
97     BlockDriverState *bs = opaque;
98     BDRVQcow2State *s = bs->opaque;
99     ssize_t ret;
100 
101     if ((offset + buflen) > s->crypto_header.length) {
102         error_setg(errp, "Request for data outside of extension header");
103         return -1;
104     }
105 
106     ret = bdrv_pread(bs->file,
107                      s->crypto_header.offset + offset, buf, buflen);
108     if (ret < 0) {
109         error_setg_errno(errp, -ret, "Could not read encryption header");
110         return -1;
111     }
112     return ret;
113 }
114 
115 
116 static ssize_t qcow2_crypto_hdr_init_func(QCryptoBlock *block, size_t headerlen,
117                                           void *opaque, Error **errp)
118 {
119     BlockDriverState *bs = opaque;
120     BDRVQcow2State *s = bs->opaque;
121     int64_t ret;
122     int64_t clusterlen;
123 
124     ret = qcow2_alloc_clusters(bs, headerlen);
125     if (ret < 0) {
126         error_setg_errno(errp, -ret,
127                          "Cannot allocate cluster for LUKS header size %zu",
128                          headerlen);
129         return -1;
130     }
131 
132     s->crypto_header.length = headerlen;
133     s->crypto_header.offset = ret;
134 
135     /* Zero fill remaining space in cluster so it has predictable
136      * content in case of future spec changes */
137     clusterlen = size_to_clusters(s, headerlen) * s->cluster_size;
138     assert(qcow2_pre_write_overlap_check(bs, 0, ret, clusterlen, false) == 0);
139     ret = bdrv_pwrite_zeroes(bs->file,
140                              ret + headerlen,
141                              clusterlen - headerlen, 0);
142     if (ret < 0) {
143         error_setg_errno(errp, -ret, "Could not zero fill encryption header");
144         return -1;
145     }
146 
147     return ret;
148 }
149 
150 
151 static ssize_t qcow2_crypto_hdr_write_func(QCryptoBlock *block, size_t offset,
152                                            const uint8_t *buf, size_t buflen,
153                                            void *opaque, Error **errp)
154 {
155     BlockDriverState *bs = opaque;
156     BDRVQcow2State *s = bs->opaque;
157     ssize_t ret;
158 
159     if ((offset + buflen) > s->crypto_header.length) {
160         error_setg(errp, "Request for data outside of extension header");
161         return -1;
162     }
163 
164     ret = bdrv_pwrite(bs->file,
165                       s->crypto_header.offset + offset, buf, buflen);
166     if (ret < 0) {
167         error_setg_errno(errp, -ret, "Could not read encryption header");
168         return -1;
169     }
170     return ret;
171 }
172 
173 
174 /*
175  * read qcow2 extension and fill bs
176  * start reading from start_offset
177  * finish reading upon magic of value 0 or when end_offset reached
178  * unknown magic is skipped (future extension this version knows nothing about)
179  * return 0 upon success, non-0 otherwise
180  */
181 static int qcow2_read_extensions(BlockDriverState *bs, uint64_t start_offset,
182                                  uint64_t end_offset, void **p_feature_table,
183                                  int flags, bool *need_update_header,
184                                  Error **errp)
185 {
186     BDRVQcow2State *s = bs->opaque;
187     QCowExtension ext;
188     uint64_t offset;
189     int ret;
190     Qcow2BitmapHeaderExt bitmaps_ext;
191 
192     if (need_update_header != NULL) {
193         *need_update_header = false;
194     }
195 
196 #ifdef DEBUG_EXT
197     printf("qcow2_read_extensions: start=%ld end=%ld\n", start_offset, end_offset);
198 #endif
199     offset = start_offset;
200     while (offset < end_offset) {
201 
202 #ifdef DEBUG_EXT
203         /* Sanity check */
204         if (offset > s->cluster_size)
205             printf("qcow2_read_extension: suspicious offset %lu\n", offset);
206 
207         printf("attempting to read extended header in offset %lu\n", offset);
208 #endif
209 
210         ret = bdrv_pread(bs->file, offset, &ext, sizeof(ext));
211         if (ret < 0) {
212             error_setg_errno(errp, -ret, "qcow2_read_extension: ERROR: "
213                              "pread fail from offset %" PRIu64, offset);
214             return 1;
215         }
216         ext.magic = be32_to_cpu(ext.magic);
217         ext.len = be32_to_cpu(ext.len);
218         offset += sizeof(ext);
219 #ifdef DEBUG_EXT
220         printf("ext.magic = 0x%x\n", ext.magic);
221 #endif
222         if (offset > end_offset || ext.len > end_offset - offset) {
223             error_setg(errp, "Header extension too large");
224             return -EINVAL;
225         }
226 
227         switch (ext.magic) {
228         case QCOW2_EXT_MAGIC_END:
229             return 0;
230 
231         case QCOW2_EXT_MAGIC_BACKING_FORMAT:
232             if (ext.len >= sizeof(bs->backing_format)) {
233                 error_setg(errp, "ERROR: ext_backing_format: len=%" PRIu32
234                            " too large (>=%zu)", ext.len,
235                            sizeof(bs->backing_format));
236                 return 2;
237             }
238             ret = bdrv_pread(bs->file, offset, bs->backing_format, ext.len);
239             if (ret < 0) {
240                 error_setg_errno(errp, -ret, "ERROR: ext_backing_format: "
241                                  "Could not read format name");
242                 return 3;
243             }
244             bs->backing_format[ext.len] = '\0';
245             s->image_backing_format = g_strdup(bs->backing_format);
246 #ifdef DEBUG_EXT
247             printf("Qcow2: Got format extension %s\n", bs->backing_format);
248 #endif
249             break;
250 
251         case QCOW2_EXT_MAGIC_FEATURE_TABLE:
252             if (p_feature_table != NULL) {
253                 void* feature_table = g_malloc0(ext.len + 2 * sizeof(Qcow2Feature));
254                 ret = bdrv_pread(bs->file, offset , feature_table, ext.len);
255                 if (ret < 0) {
256                     error_setg_errno(errp, -ret, "ERROR: ext_feature_table: "
257                                      "Could not read table");
258                     return ret;
259                 }
260 
261                 *p_feature_table = feature_table;
262             }
263             break;
264 
265         case QCOW2_EXT_MAGIC_CRYPTO_HEADER: {
266             unsigned int cflags = 0;
267             if (s->crypt_method_header != QCOW_CRYPT_LUKS) {
268                 error_setg(errp, "CRYPTO header extension only "
269                            "expected with LUKS encryption method");
270                 return -EINVAL;
271             }
272             if (ext.len != sizeof(Qcow2CryptoHeaderExtension)) {
273                 error_setg(errp, "CRYPTO header extension size %u, "
274                            "but expected size %zu", ext.len,
275                            sizeof(Qcow2CryptoHeaderExtension));
276                 return -EINVAL;
277             }
278 
279             ret = bdrv_pread(bs->file, offset, &s->crypto_header, ext.len);
280             if (ret < 0) {
281                 error_setg_errno(errp, -ret,
282                                  "Unable to read CRYPTO header extension");
283                 return ret;
284             }
285             s->crypto_header.offset = be64_to_cpu(s->crypto_header.offset);
286             s->crypto_header.length = be64_to_cpu(s->crypto_header.length);
287 
288             if ((s->crypto_header.offset % s->cluster_size) != 0) {
289                 error_setg(errp, "Encryption header offset '%" PRIu64 "' is "
290                            "not a multiple of cluster size '%u'",
291                            s->crypto_header.offset, s->cluster_size);
292                 return -EINVAL;
293             }
294 
295             if (flags & BDRV_O_NO_IO) {
296                 cflags |= QCRYPTO_BLOCK_OPEN_NO_IO;
297             }
298             s->crypto = qcrypto_block_open(s->crypto_opts, "encrypt.",
299                                            qcow2_crypto_hdr_read_func,
300                                            bs, cflags, QCOW2_MAX_THREADS, errp);
301             if (!s->crypto) {
302                 return -EINVAL;
303             }
304         }   break;
305 
306         case QCOW2_EXT_MAGIC_BITMAPS:
307             if (ext.len != sizeof(bitmaps_ext)) {
308                 error_setg_errno(errp, -ret, "bitmaps_ext: "
309                                  "Invalid extension length");
310                 return -EINVAL;
311             }
312 
313             if (!(s->autoclear_features & QCOW2_AUTOCLEAR_BITMAPS)) {
314                 if (s->qcow_version < 3) {
315                     /* Let's be a bit more specific */
316                     warn_report("This qcow2 v2 image contains bitmaps, but "
317                                 "they may have been modified by a program "
318                                 "without persistent bitmap support; so now "
319                                 "they must all be considered inconsistent");
320                 } else {
321                     warn_report("a program lacking bitmap support "
322                                 "modified this file, so all bitmaps are now "
323                                 "considered inconsistent");
324                 }
325                 error_printf("Some clusters may be leaked, "
326                              "run 'qemu-img check -r' on the image "
327                              "file to fix.");
328                 if (need_update_header != NULL) {
329                     /* Updating is needed to drop invalid bitmap extension. */
330                     *need_update_header = true;
331                 }
332                 break;
333             }
334 
335             ret = bdrv_pread(bs->file, offset, &bitmaps_ext, ext.len);
336             if (ret < 0) {
337                 error_setg_errno(errp, -ret, "bitmaps_ext: "
338                                  "Could not read ext header");
339                 return ret;
340             }
341 
342             if (bitmaps_ext.reserved32 != 0) {
343                 error_setg_errno(errp, -ret, "bitmaps_ext: "
344                                  "Reserved field is not zero");
345                 return -EINVAL;
346             }
347 
348             bitmaps_ext.nb_bitmaps = be32_to_cpu(bitmaps_ext.nb_bitmaps);
349             bitmaps_ext.bitmap_directory_size =
350                 be64_to_cpu(bitmaps_ext.bitmap_directory_size);
351             bitmaps_ext.bitmap_directory_offset =
352                 be64_to_cpu(bitmaps_ext.bitmap_directory_offset);
353 
354             if (bitmaps_ext.nb_bitmaps > QCOW2_MAX_BITMAPS) {
355                 error_setg(errp,
356                            "bitmaps_ext: Image has %" PRIu32 " bitmaps, "
357                            "exceeding the QEMU supported maximum of %d",
358                            bitmaps_ext.nb_bitmaps, QCOW2_MAX_BITMAPS);
359                 return -EINVAL;
360             }
361 
362             if (bitmaps_ext.nb_bitmaps == 0) {
363                 error_setg(errp, "found bitmaps extension with zero bitmaps");
364                 return -EINVAL;
365             }
366 
367             if (bitmaps_ext.bitmap_directory_offset & (s->cluster_size - 1)) {
368                 error_setg(errp, "bitmaps_ext: "
369                                  "invalid bitmap directory offset");
370                 return -EINVAL;
371             }
372 
373             if (bitmaps_ext.bitmap_directory_size >
374                 QCOW2_MAX_BITMAP_DIRECTORY_SIZE) {
375                 error_setg(errp, "bitmaps_ext: "
376                                  "bitmap directory size (%" PRIu64 ") exceeds "
377                                  "the maximum supported size (%d)",
378                                  bitmaps_ext.bitmap_directory_size,
379                                  QCOW2_MAX_BITMAP_DIRECTORY_SIZE);
380                 return -EINVAL;
381             }
382 
383             s->nb_bitmaps = bitmaps_ext.nb_bitmaps;
384             s->bitmap_directory_offset =
385                     bitmaps_ext.bitmap_directory_offset;
386             s->bitmap_directory_size =
387                     bitmaps_ext.bitmap_directory_size;
388 
389 #ifdef DEBUG_EXT
390             printf("Qcow2: Got bitmaps extension: "
391                    "offset=%" PRIu64 " nb_bitmaps=%" PRIu32 "\n",
392                    s->bitmap_directory_offset, s->nb_bitmaps);
393 #endif
394             break;
395 
396         case QCOW2_EXT_MAGIC_DATA_FILE:
397         {
398             s->image_data_file = g_malloc0(ext.len + 1);
399             ret = bdrv_pread(bs->file, offset, s->image_data_file, ext.len);
400             if (ret < 0) {
401                 error_setg_errno(errp, -ret,
402                                  "ERROR: Could not read data file name");
403                 return ret;
404             }
405 #ifdef DEBUG_EXT
406             printf("Qcow2: Got external data file %s\n", s->image_data_file);
407 #endif
408             break;
409         }
410 
411         default:
412             /* unknown magic - save it in case we need to rewrite the header */
413             /* If you add a new feature, make sure to also update the fast
414              * path of qcow2_make_empty() to deal with it. */
415             {
416                 Qcow2UnknownHeaderExtension *uext;
417 
418                 uext = g_malloc0(sizeof(*uext)  + ext.len);
419                 uext->magic = ext.magic;
420                 uext->len = ext.len;
421                 QLIST_INSERT_HEAD(&s->unknown_header_ext, uext, next);
422 
423                 ret = bdrv_pread(bs->file, offset , uext->data, uext->len);
424                 if (ret < 0) {
425                     error_setg_errno(errp, -ret, "ERROR: unknown extension: "
426                                      "Could not read data");
427                     return ret;
428                 }
429             }
430             break;
431         }
432 
433         offset += ((ext.len + 7) & ~7);
434     }
435 
436     return 0;
437 }
438 
439 static void cleanup_unknown_header_ext(BlockDriverState *bs)
440 {
441     BDRVQcow2State *s = bs->opaque;
442     Qcow2UnknownHeaderExtension *uext, *next;
443 
444     QLIST_FOREACH_SAFE(uext, &s->unknown_header_ext, next, next) {
445         QLIST_REMOVE(uext, next);
446         g_free(uext);
447     }
448 }
449 
450 static void report_unsupported_feature(Error **errp, Qcow2Feature *table,
451                                        uint64_t mask)
452 {
453     char *features = g_strdup("");
454     char *old;
455 
456     while (table && table->name[0] != '\0') {
457         if (table->type == QCOW2_FEAT_TYPE_INCOMPATIBLE) {
458             if (mask & (1ULL << table->bit)) {
459                 old = features;
460                 features = g_strdup_printf("%s%s%.46s", old, *old ? ", " : "",
461                                            table->name);
462                 g_free(old);
463                 mask &= ~(1ULL << table->bit);
464             }
465         }
466         table++;
467     }
468 
469     if (mask) {
470         old = features;
471         features = g_strdup_printf("%s%sUnknown incompatible feature: %" PRIx64,
472                                    old, *old ? ", " : "", mask);
473         g_free(old);
474     }
475 
476     error_setg(errp, "Unsupported qcow2 feature(s): %s", features);
477     g_free(features);
478 }
479 
480 /*
481  * Sets the dirty bit and flushes afterwards if necessary.
482  *
483  * The incompatible_features bit is only set if the image file header was
484  * updated successfully.  Therefore it is not required to check the return
485  * value of this function.
486  */
487 int qcow2_mark_dirty(BlockDriverState *bs)
488 {
489     BDRVQcow2State *s = bs->opaque;
490     uint64_t val;
491     int ret;
492 
493     assert(s->qcow_version >= 3);
494 
495     if (s->incompatible_features & QCOW2_INCOMPAT_DIRTY) {
496         return 0; /* already dirty */
497     }
498 
499     val = cpu_to_be64(s->incompatible_features | QCOW2_INCOMPAT_DIRTY);
500     ret = bdrv_pwrite(bs->file, offsetof(QCowHeader, incompatible_features),
501                       &val, sizeof(val));
502     if (ret < 0) {
503         return ret;
504     }
505     ret = bdrv_flush(bs->file->bs);
506     if (ret < 0) {
507         return ret;
508     }
509 
510     /* Only treat image as dirty if the header was updated successfully */
511     s->incompatible_features |= QCOW2_INCOMPAT_DIRTY;
512     return 0;
513 }
514 
515 /*
516  * Clears the dirty bit and flushes before if necessary.  Only call this
517  * function when there are no pending requests, it does not guard against
518  * concurrent requests dirtying the image.
519  */
520 static int qcow2_mark_clean(BlockDriverState *bs)
521 {
522     BDRVQcow2State *s = bs->opaque;
523 
524     if (s->incompatible_features & QCOW2_INCOMPAT_DIRTY) {
525         int ret;
526 
527         s->incompatible_features &= ~QCOW2_INCOMPAT_DIRTY;
528 
529         ret = qcow2_flush_caches(bs);
530         if (ret < 0) {
531             return ret;
532         }
533 
534         return qcow2_update_header(bs);
535     }
536     return 0;
537 }
538 
539 /*
540  * Marks the image as corrupt.
541  */
542 int qcow2_mark_corrupt(BlockDriverState *bs)
543 {
544     BDRVQcow2State *s = bs->opaque;
545 
546     s->incompatible_features |= QCOW2_INCOMPAT_CORRUPT;
547     return qcow2_update_header(bs);
548 }
549 
550 /*
551  * Marks the image as consistent, i.e., unsets the corrupt bit, and flushes
552  * before if necessary.
553  */
554 int qcow2_mark_consistent(BlockDriverState *bs)
555 {
556     BDRVQcow2State *s = bs->opaque;
557 
558     if (s->incompatible_features & QCOW2_INCOMPAT_CORRUPT) {
559         int ret = qcow2_flush_caches(bs);
560         if (ret < 0) {
561             return ret;
562         }
563 
564         s->incompatible_features &= ~QCOW2_INCOMPAT_CORRUPT;
565         return qcow2_update_header(bs);
566     }
567     return 0;
568 }
569 
570 static int coroutine_fn qcow2_co_check_locked(BlockDriverState *bs,
571                                               BdrvCheckResult *result,
572                                               BdrvCheckMode fix)
573 {
574     int ret = qcow2_check_refcounts(bs, result, fix);
575     if (ret < 0) {
576         return ret;
577     }
578 
579     if (fix && result->check_errors == 0 && result->corruptions == 0) {
580         ret = qcow2_mark_clean(bs);
581         if (ret < 0) {
582             return ret;
583         }
584         return qcow2_mark_consistent(bs);
585     }
586     return ret;
587 }
588 
589 static int coroutine_fn qcow2_co_check(BlockDriverState *bs,
590                                        BdrvCheckResult *result,
591                                        BdrvCheckMode fix)
592 {
593     BDRVQcow2State *s = bs->opaque;
594     int ret;
595 
596     qemu_co_mutex_lock(&s->lock);
597     ret = qcow2_co_check_locked(bs, result, fix);
598     qemu_co_mutex_unlock(&s->lock);
599     return ret;
600 }
601 
602 int qcow2_validate_table(BlockDriverState *bs, uint64_t offset,
603                          uint64_t entries, size_t entry_len,
604                          int64_t max_size_bytes, const char *table_name,
605                          Error **errp)
606 {
607     BDRVQcow2State *s = bs->opaque;
608 
609     if (entries > max_size_bytes / entry_len) {
610         error_setg(errp, "%s too large", table_name);
611         return -EFBIG;
612     }
613 
614     /* Use signed INT64_MAX as the maximum even for uint64_t header fields,
615      * because values will be passed to qemu functions taking int64_t. */
616     if ((INT64_MAX - entries * entry_len < offset) ||
617         (offset_into_cluster(s, offset) != 0)) {
618         error_setg(errp, "%s offset invalid", table_name);
619         return -EINVAL;
620     }
621 
622     return 0;
623 }
624 
625 static const char *const mutable_opts[] = {
626     QCOW2_OPT_LAZY_REFCOUNTS,
627     QCOW2_OPT_DISCARD_REQUEST,
628     QCOW2_OPT_DISCARD_SNAPSHOT,
629     QCOW2_OPT_DISCARD_OTHER,
630     QCOW2_OPT_OVERLAP,
631     QCOW2_OPT_OVERLAP_TEMPLATE,
632     QCOW2_OPT_OVERLAP_MAIN_HEADER,
633     QCOW2_OPT_OVERLAP_ACTIVE_L1,
634     QCOW2_OPT_OVERLAP_ACTIVE_L2,
635     QCOW2_OPT_OVERLAP_REFCOUNT_TABLE,
636     QCOW2_OPT_OVERLAP_REFCOUNT_BLOCK,
637     QCOW2_OPT_OVERLAP_SNAPSHOT_TABLE,
638     QCOW2_OPT_OVERLAP_INACTIVE_L1,
639     QCOW2_OPT_OVERLAP_INACTIVE_L2,
640     QCOW2_OPT_OVERLAP_BITMAP_DIRECTORY,
641     QCOW2_OPT_CACHE_SIZE,
642     QCOW2_OPT_L2_CACHE_SIZE,
643     QCOW2_OPT_L2_CACHE_ENTRY_SIZE,
644     QCOW2_OPT_REFCOUNT_CACHE_SIZE,
645     QCOW2_OPT_CACHE_CLEAN_INTERVAL,
646     NULL
647 };
648 
649 static QemuOptsList qcow2_runtime_opts = {
650     .name = "qcow2",
651     .head = QTAILQ_HEAD_INITIALIZER(qcow2_runtime_opts.head),
652     .desc = {
653         {
654             .name = QCOW2_OPT_LAZY_REFCOUNTS,
655             .type = QEMU_OPT_BOOL,
656             .help = "Postpone refcount updates",
657         },
658         {
659             .name = QCOW2_OPT_DISCARD_REQUEST,
660             .type = QEMU_OPT_BOOL,
661             .help = "Pass guest discard requests to the layer below",
662         },
663         {
664             .name = QCOW2_OPT_DISCARD_SNAPSHOT,
665             .type = QEMU_OPT_BOOL,
666             .help = "Generate discard requests when snapshot related space "
667                     "is freed",
668         },
669         {
670             .name = QCOW2_OPT_DISCARD_OTHER,
671             .type = QEMU_OPT_BOOL,
672             .help = "Generate discard requests when other clusters are freed",
673         },
674         {
675             .name = QCOW2_OPT_OVERLAP,
676             .type = QEMU_OPT_STRING,
677             .help = "Selects which overlap checks to perform from a range of "
678                     "templates (none, constant, cached, all)",
679         },
680         {
681             .name = QCOW2_OPT_OVERLAP_TEMPLATE,
682             .type = QEMU_OPT_STRING,
683             .help = "Selects which overlap checks to perform from a range of "
684                     "templates (none, constant, cached, all)",
685         },
686         {
687             .name = QCOW2_OPT_OVERLAP_MAIN_HEADER,
688             .type = QEMU_OPT_BOOL,
689             .help = "Check for unintended writes into the main qcow2 header",
690         },
691         {
692             .name = QCOW2_OPT_OVERLAP_ACTIVE_L1,
693             .type = QEMU_OPT_BOOL,
694             .help = "Check for unintended writes into the active L1 table",
695         },
696         {
697             .name = QCOW2_OPT_OVERLAP_ACTIVE_L2,
698             .type = QEMU_OPT_BOOL,
699             .help = "Check for unintended writes into an active L2 table",
700         },
701         {
702             .name = QCOW2_OPT_OVERLAP_REFCOUNT_TABLE,
703             .type = QEMU_OPT_BOOL,
704             .help = "Check for unintended writes into the refcount table",
705         },
706         {
707             .name = QCOW2_OPT_OVERLAP_REFCOUNT_BLOCK,
708             .type = QEMU_OPT_BOOL,
709             .help = "Check for unintended writes into a refcount block",
710         },
711         {
712             .name = QCOW2_OPT_OVERLAP_SNAPSHOT_TABLE,
713             .type = QEMU_OPT_BOOL,
714             .help = "Check for unintended writes into the snapshot table",
715         },
716         {
717             .name = QCOW2_OPT_OVERLAP_INACTIVE_L1,
718             .type = QEMU_OPT_BOOL,
719             .help = "Check for unintended writes into an inactive L1 table",
720         },
721         {
722             .name = QCOW2_OPT_OVERLAP_INACTIVE_L2,
723             .type = QEMU_OPT_BOOL,
724             .help = "Check for unintended writes into an inactive L2 table",
725         },
726         {
727             .name = QCOW2_OPT_OVERLAP_BITMAP_DIRECTORY,
728             .type = QEMU_OPT_BOOL,
729             .help = "Check for unintended writes into the bitmap directory",
730         },
731         {
732             .name = QCOW2_OPT_CACHE_SIZE,
733             .type = QEMU_OPT_SIZE,
734             .help = "Maximum combined metadata (L2 tables and refcount blocks) "
735                     "cache size",
736         },
737         {
738             .name = QCOW2_OPT_L2_CACHE_SIZE,
739             .type = QEMU_OPT_SIZE,
740             .help = "Maximum L2 table cache size",
741         },
742         {
743             .name = QCOW2_OPT_L2_CACHE_ENTRY_SIZE,
744             .type = QEMU_OPT_SIZE,
745             .help = "Size of each entry in the L2 cache",
746         },
747         {
748             .name = QCOW2_OPT_REFCOUNT_CACHE_SIZE,
749             .type = QEMU_OPT_SIZE,
750             .help = "Maximum refcount block cache size",
751         },
752         {
753             .name = QCOW2_OPT_CACHE_CLEAN_INTERVAL,
754             .type = QEMU_OPT_NUMBER,
755             .help = "Clean unused cache entries after this time (in seconds)",
756         },
757         BLOCK_CRYPTO_OPT_DEF_KEY_SECRET("encrypt.",
758             "ID of secret providing qcow2 AES key or LUKS passphrase"),
759         { /* end of list */ }
760     },
761 };
762 
763 static const char *overlap_bool_option_names[QCOW2_OL_MAX_BITNR] = {
764     [QCOW2_OL_MAIN_HEADER_BITNR]      = QCOW2_OPT_OVERLAP_MAIN_HEADER,
765     [QCOW2_OL_ACTIVE_L1_BITNR]        = QCOW2_OPT_OVERLAP_ACTIVE_L1,
766     [QCOW2_OL_ACTIVE_L2_BITNR]        = QCOW2_OPT_OVERLAP_ACTIVE_L2,
767     [QCOW2_OL_REFCOUNT_TABLE_BITNR]   = QCOW2_OPT_OVERLAP_REFCOUNT_TABLE,
768     [QCOW2_OL_REFCOUNT_BLOCK_BITNR]   = QCOW2_OPT_OVERLAP_REFCOUNT_BLOCK,
769     [QCOW2_OL_SNAPSHOT_TABLE_BITNR]   = QCOW2_OPT_OVERLAP_SNAPSHOT_TABLE,
770     [QCOW2_OL_INACTIVE_L1_BITNR]      = QCOW2_OPT_OVERLAP_INACTIVE_L1,
771     [QCOW2_OL_INACTIVE_L2_BITNR]      = QCOW2_OPT_OVERLAP_INACTIVE_L2,
772     [QCOW2_OL_BITMAP_DIRECTORY_BITNR] = QCOW2_OPT_OVERLAP_BITMAP_DIRECTORY,
773 };
774 
775 static void cache_clean_timer_cb(void *opaque)
776 {
777     BlockDriverState *bs = opaque;
778     BDRVQcow2State *s = bs->opaque;
779     qcow2_cache_clean_unused(s->l2_table_cache);
780     qcow2_cache_clean_unused(s->refcount_block_cache);
781     timer_mod(s->cache_clean_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) +
782               (int64_t) s->cache_clean_interval * 1000);
783 }
784 
785 static void cache_clean_timer_init(BlockDriverState *bs, AioContext *context)
786 {
787     BDRVQcow2State *s = bs->opaque;
788     if (s->cache_clean_interval > 0) {
789         s->cache_clean_timer = aio_timer_new(context, QEMU_CLOCK_VIRTUAL,
790                                              SCALE_MS, cache_clean_timer_cb,
791                                              bs);
792         timer_mod(s->cache_clean_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) +
793                   (int64_t) s->cache_clean_interval * 1000);
794     }
795 }
796 
797 static void cache_clean_timer_del(BlockDriverState *bs)
798 {
799     BDRVQcow2State *s = bs->opaque;
800     if (s->cache_clean_timer) {
801         timer_del(s->cache_clean_timer);
802         timer_free(s->cache_clean_timer);
803         s->cache_clean_timer = NULL;
804     }
805 }
806 
807 static void qcow2_detach_aio_context(BlockDriverState *bs)
808 {
809     cache_clean_timer_del(bs);
810 }
811 
812 static void qcow2_attach_aio_context(BlockDriverState *bs,
813                                      AioContext *new_context)
814 {
815     cache_clean_timer_init(bs, new_context);
816 }
817 
818 static void read_cache_sizes(BlockDriverState *bs, QemuOpts *opts,
819                              uint64_t *l2_cache_size,
820                              uint64_t *l2_cache_entry_size,
821                              uint64_t *refcount_cache_size, Error **errp)
822 {
823     BDRVQcow2State *s = bs->opaque;
824     uint64_t combined_cache_size, l2_cache_max_setting;
825     bool l2_cache_size_set, refcount_cache_size_set, combined_cache_size_set;
826     bool l2_cache_entry_size_set;
827     int min_refcount_cache = MIN_REFCOUNT_CACHE_SIZE * s->cluster_size;
828     uint64_t virtual_disk_size = bs->total_sectors * BDRV_SECTOR_SIZE;
829     uint64_t max_l2_cache = virtual_disk_size / (s->cluster_size / 8);
830 
831     combined_cache_size_set = qemu_opt_get(opts, QCOW2_OPT_CACHE_SIZE);
832     l2_cache_size_set = qemu_opt_get(opts, QCOW2_OPT_L2_CACHE_SIZE);
833     refcount_cache_size_set = qemu_opt_get(opts, QCOW2_OPT_REFCOUNT_CACHE_SIZE);
834     l2_cache_entry_size_set = qemu_opt_get(opts, QCOW2_OPT_L2_CACHE_ENTRY_SIZE);
835 
836     combined_cache_size = qemu_opt_get_size(opts, QCOW2_OPT_CACHE_SIZE, 0);
837     l2_cache_max_setting = qemu_opt_get_size(opts, QCOW2_OPT_L2_CACHE_SIZE,
838                                              DEFAULT_L2_CACHE_MAX_SIZE);
839     *refcount_cache_size = qemu_opt_get_size(opts,
840                                              QCOW2_OPT_REFCOUNT_CACHE_SIZE, 0);
841 
842     *l2_cache_entry_size = qemu_opt_get_size(
843         opts, QCOW2_OPT_L2_CACHE_ENTRY_SIZE, s->cluster_size);
844 
845     *l2_cache_size = MIN(max_l2_cache, l2_cache_max_setting);
846 
847     if (combined_cache_size_set) {
848         if (l2_cache_size_set && refcount_cache_size_set) {
849             error_setg(errp, QCOW2_OPT_CACHE_SIZE ", " QCOW2_OPT_L2_CACHE_SIZE
850                        " and " QCOW2_OPT_REFCOUNT_CACHE_SIZE " may not be set "
851                        "at the same time");
852             return;
853         } else if (l2_cache_size_set &&
854                    (l2_cache_max_setting > combined_cache_size)) {
855             error_setg(errp, QCOW2_OPT_L2_CACHE_SIZE " may not exceed "
856                        QCOW2_OPT_CACHE_SIZE);
857             return;
858         } else if (*refcount_cache_size > combined_cache_size) {
859             error_setg(errp, QCOW2_OPT_REFCOUNT_CACHE_SIZE " may not exceed "
860                        QCOW2_OPT_CACHE_SIZE);
861             return;
862         }
863 
864         if (l2_cache_size_set) {
865             *refcount_cache_size = combined_cache_size - *l2_cache_size;
866         } else if (refcount_cache_size_set) {
867             *l2_cache_size = combined_cache_size - *refcount_cache_size;
868         } else {
869             /* Assign as much memory as possible to the L2 cache, and
870              * use the remainder for the refcount cache */
871             if (combined_cache_size >= max_l2_cache + min_refcount_cache) {
872                 *l2_cache_size = max_l2_cache;
873                 *refcount_cache_size = combined_cache_size - *l2_cache_size;
874             } else {
875                 *refcount_cache_size =
876                     MIN(combined_cache_size, min_refcount_cache);
877                 *l2_cache_size = combined_cache_size - *refcount_cache_size;
878             }
879         }
880     }
881 
882     /*
883      * If the L2 cache is not enough to cover the whole disk then
884      * default to 4KB entries. Smaller entries reduce the cost of
885      * loads and evictions and increase I/O performance.
886      */
887     if (*l2_cache_size < max_l2_cache && !l2_cache_entry_size_set) {
888         *l2_cache_entry_size = MIN(s->cluster_size, 4096);
889     }
890 
891     /* l2_cache_size and refcount_cache_size are ensured to have at least
892      * their minimum values in qcow2_update_options_prepare() */
893 
894     if (*l2_cache_entry_size < (1 << MIN_CLUSTER_BITS) ||
895         *l2_cache_entry_size > s->cluster_size ||
896         !is_power_of_2(*l2_cache_entry_size)) {
897         error_setg(errp, "L2 cache entry size must be a power of two "
898                    "between %d and the cluster size (%d)",
899                    1 << MIN_CLUSTER_BITS, s->cluster_size);
900         return;
901     }
902 }
903 
904 typedef struct Qcow2ReopenState {
905     Qcow2Cache *l2_table_cache;
906     Qcow2Cache *refcount_block_cache;
907     int l2_slice_size; /* Number of entries in a slice of the L2 table */
908     bool use_lazy_refcounts;
909     int overlap_check;
910     bool discard_passthrough[QCOW2_DISCARD_MAX];
911     uint64_t cache_clean_interval;
912     QCryptoBlockOpenOptions *crypto_opts; /* Disk encryption runtime options */
913 } Qcow2ReopenState;
914 
915 static int qcow2_update_options_prepare(BlockDriverState *bs,
916                                         Qcow2ReopenState *r,
917                                         QDict *options, int flags,
918                                         Error **errp)
919 {
920     BDRVQcow2State *s = bs->opaque;
921     QemuOpts *opts = NULL;
922     const char *opt_overlap_check, *opt_overlap_check_template;
923     int overlap_check_template = 0;
924     uint64_t l2_cache_size, l2_cache_entry_size, refcount_cache_size;
925     int i;
926     const char *encryptfmt;
927     QDict *encryptopts = NULL;
928     Error *local_err = NULL;
929     int ret;
930 
931     qdict_extract_subqdict(options, &encryptopts, "encrypt.");
932     encryptfmt = qdict_get_try_str(encryptopts, "format");
933 
934     opts = qemu_opts_create(&qcow2_runtime_opts, NULL, 0, &error_abort);
935     qemu_opts_absorb_qdict(opts, options, &local_err);
936     if (local_err) {
937         error_propagate(errp, local_err);
938         ret = -EINVAL;
939         goto fail;
940     }
941 
942     /* get L2 table/refcount block cache size from command line options */
943     read_cache_sizes(bs, opts, &l2_cache_size, &l2_cache_entry_size,
944                      &refcount_cache_size, &local_err);
945     if (local_err) {
946         error_propagate(errp, local_err);
947         ret = -EINVAL;
948         goto fail;
949     }
950 
951     l2_cache_size /= l2_cache_entry_size;
952     if (l2_cache_size < MIN_L2_CACHE_SIZE) {
953         l2_cache_size = MIN_L2_CACHE_SIZE;
954     }
955     if (l2_cache_size > INT_MAX) {
956         error_setg(errp, "L2 cache size too big");
957         ret = -EINVAL;
958         goto fail;
959     }
960 
961     refcount_cache_size /= s->cluster_size;
962     if (refcount_cache_size < MIN_REFCOUNT_CACHE_SIZE) {
963         refcount_cache_size = MIN_REFCOUNT_CACHE_SIZE;
964     }
965     if (refcount_cache_size > INT_MAX) {
966         error_setg(errp, "Refcount cache size too big");
967         ret = -EINVAL;
968         goto fail;
969     }
970 
971     /* alloc new L2 table/refcount block cache, flush old one */
972     if (s->l2_table_cache) {
973         ret = qcow2_cache_flush(bs, s->l2_table_cache);
974         if (ret) {
975             error_setg_errno(errp, -ret, "Failed to flush the L2 table cache");
976             goto fail;
977         }
978     }
979 
980     if (s->refcount_block_cache) {
981         ret = qcow2_cache_flush(bs, s->refcount_block_cache);
982         if (ret) {
983             error_setg_errno(errp, -ret,
984                              "Failed to flush the refcount block cache");
985             goto fail;
986         }
987     }
988 
989     r->l2_slice_size = l2_cache_entry_size / sizeof(uint64_t);
990     r->l2_table_cache = qcow2_cache_create(bs, l2_cache_size,
991                                            l2_cache_entry_size);
992     r->refcount_block_cache = qcow2_cache_create(bs, refcount_cache_size,
993                                                  s->cluster_size);
994     if (r->l2_table_cache == NULL || r->refcount_block_cache == NULL) {
995         error_setg(errp, "Could not allocate metadata caches");
996         ret = -ENOMEM;
997         goto fail;
998     }
999 
1000     /* New interval for cache cleanup timer */
1001     r->cache_clean_interval =
1002         qemu_opt_get_number(opts, QCOW2_OPT_CACHE_CLEAN_INTERVAL,
1003                             DEFAULT_CACHE_CLEAN_INTERVAL);
1004 #ifndef CONFIG_LINUX
1005     if (r->cache_clean_interval != 0) {
1006         error_setg(errp, QCOW2_OPT_CACHE_CLEAN_INTERVAL
1007                    " not supported on this host");
1008         ret = -EINVAL;
1009         goto fail;
1010     }
1011 #endif
1012     if (r->cache_clean_interval > UINT_MAX) {
1013         error_setg(errp, "Cache clean interval too big");
1014         ret = -EINVAL;
1015         goto fail;
1016     }
1017 
1018     /* lazy-refcounts; flush if going from enabled to disabled */
1019     r->use_lazy_refcounts = qemu_opt_get_bool(opts, QCOW2_OPT_LAZY_REFCOUNTS,
1020         (s->compatible_features & QCOW2_COMPAT_LAZY_REFCOUNTS));
1021     if (r->use_lazy_refcounts && s->qcow_version < 3) {
1022         error_setg(errp, "Lazy refcounts require a qcow2 image with at least "
1023                    "qemu 1.1 compatibility level");
1024         ret = -EINVAL;
1025         goto fail;
1026     }
1027 
1028     if (s->use_lazy_refcounts && !r->use_lazy_refcounts) {
1029         ret = qcow2_mark_clean(bs);
1030         if (ret < 0) {
1031             error_setg_errno(errp, -ret, "Failed to disable lazy refcounts");
1032             goto fail;
1033         }
1034     }
1035 
1036     /* Overlap check options */
1037     opt_overlap_check = qemu_opt_get(opts, QCOW2_OPT_OVERLAP);
1038     opt_overlap_check_template = qemu_opt_get(opts, QCOW2_OPT_OVERLAP_TEMPLATE);
1039     if (opt_overlap_check_template && opt_overlap_check &&
1040         strcmp(opt_overlap_check_template, opt_overlap_check))
1041     {
1042         error_setg(errp, "Conflicting values for qcow2 options '"
1043                    QCOW2_OPT_OVERLAP "' ('%s') and '" QCOW2_OPT_OVERLAP_TEMPLATE
1044                    "' ('%s')", opt_overlap_check, opt_overlap_check_template);
1045         ret = -EINVAL;
1046         goto fail;
1047     }
1048     if (!opt_overlap_check) {
1049         opt_overlap_check = opt_overlap_check_template ?: "cached";
1050     }
1051 
1052     if (!strcmp(opt_overlap_check, "none")) {
1053         overlap_check_template = 0;
1054     } else if (!strcmp(opt_overlap_check, "constant")) {
1055         overlap_check_template = QCOW2_OL_CONSTANT;
1056     } else if (!strcmp(opt_overlap_check, "cached")) {
1057         overlap_check_template = QCOW2_OL_CACHED;
1058     } else if (!strcmp(opt_overlap_check, "all")) {
1059         overlap_check_template = QCOW2_OL_ALL;
1060     } else {
1061         error_setg(errp, "Unsupported value '%s' for qcow2 option "
1062                    "'overlap-check'. Allowed are any of the following: "
1063                    "none, constant, cached, all", opt_overlap_check);
1064         ret = -EINVAL;
1065         goto fail;
1066     }
1067 
1068     r->overlap_check = 0;
1069     for (i = 0; i < QCOW2_OL_MAX_BITNR; i++) {
1070         /* overlap-check defines a template bitmask, but every flag may be
1071          * overwritten through the associated boolean option */
1072         r->overlap_check |=
1073             qemu_opt_get_bool(opts, overlap_bool_option_names[i],
1074                               overlap_check_template & (1 << i)) << i;
1075     }
1076 
1077     r->discard_passthrough[QCOW2_DISCARD_NEVER] = false;
1078     r->discard_passthrough[QCOW2_DISCARD_ALWAYS] = true;
1079     r->discard_passthrough[QCOW2_DISCARD_REQUEST] =
1080         qemu_opt_get_bool(opts, QCOW2_OPT_DISCARD_REQUEST,
1081                           flags & BDRV_O_UNMAP);
1082     r->discard_passthrough[QCOW2_DISCARD_SNAPSHOT] =
1083         qemu_opt_get_bool(opts, QCOW2_OPT_DISCARD_SNAPSHOT, true);
1084     r->discard_passthrough[QCOW2_DISCARD_OTHER] =
1085         qemu_opt_get_bool(opts, QCOW2_OPT_DISCARD_OTHER, false);
1086 
1087     switch (s->crypt_method_header) {
1088     case QCOW_CRYPT_NONE:
1089         if (encryptfmt) {
1090             error_setg(errp, "No encryption in image header, but options "
1091                        "specified format '%s'", encryptfmt);
1092             ret = -EINVAL;
1093             goto fail;
1094         }
1095         break;
1096 
1097     case QCOW_CRYPT_AES:
1098         if (encryptfmt && !g_str_equal(encryptfmt, "aes")) {
1099             error_setg(errp,
1100                        "Header reported 'aes' encryption format but "
1101                        "options specify '%s'", encryptfmt);
1102             ret = -EINVAL;
1103             goto fail;
1104         }
1105         qdict_put_str(encryptopts, "format", "qcow");
1106         r->crypto_opts = block_crypto_open_opts_init(encryptopts, errp);
1107         break;
1108 
1109     case QCOW_CRYPT_LUKS:
1110         if (encryptfmt && !g_str_equal(encryptfmt, "luks")) {
1111             error_setg(errp,
1112                        "Header reported 'luks' encryption format but "
1113                        "options specify '%s'", encryptfmt);
1114             ret = -EINVAL;
1115             goto fail;
1116         }
1117         qdict_put_str(encryptopts, "format", "luks");
1118         r->crypto_opts = block_crypto_open_opts_init(encryptopts, errp);
1119         break;
1120 
1121     default:
1122         error_setg(errp, "Unsupported encryption method %d",
1123                    s->crypt_method_header);
1124         break;
1125     }
1126     if (s->crypt_method_header != QCOW_CRYPT_NONE && !r->crypto_opts) {
1127         ret = -EINVAL;
1128         goto fail;
1129     }
1130 
1131     ret = 0;
1132 fail:
1133     qobject_unref(encryptopts);
1134     qemu_opts_del(opts);
1135     opts = NULL;
1136     return ret;
1137 }
1138 
1139 static void qcow2_update_options_commit(BlockDriverState *bs,
1140                                         Qcow2ReopenState *r)
1141 {
1142     BDRVQcow2State *s = bs->opaque;
1143     int i;
1144 
1145     if (s->l2_table_cache) {
1146         qcow2_cache_destroy(s->l2_table_cache);
1147     }
1148     if (s->refcount_block_cache) {
1149         qcow2_cache_destroy(s->refcount_block_cache);
1150     }
1151     s->l2_table_cache = r->l2_table_cache;
1152     s->refcount_block_cache = r->refcount_block_cache;
1153     s->l2_slice_size = r->l2_slice_size;
1154 
1155     s->overlap_check = r->overlap_check;
1156     s->use_lazy_refcounts = r->use_lazy_refcounts;
1157 
1158     for (i = 0; i < QCOW2_DISCARD_MAX; i++) {
1159         s->discard_passthrough[i] = r->discard_passthrough[i];
1160     }
1161 
1162     if (s->cache_clean_interval != r->cache_clean_interval) {
1163         cache_clean_timer_del(bs);
1164         s->cache_clean_interval = r->cache_clean_interval;
1165         cache_clean_timer_init(bs, bdrv_get_aio_context(bs));
1166     }
1167 
1168     qapi_free_QCryptoBlockOpenOptions(s->crypto_opts);
1169     s->crypto_opts = r->crypto_opts;
1170 }
1171 
1172 static void qcow2_update_options_abort(BlockDriverState *bs,
1173                                        Qcow2ReopenState *r)
1174 {
1175     if (r->l2_table_cache) {
1176         qcow2_cache_destroy(r->l2_table_cache);
1177     }
1178     if (r->refcount_block_cache) {
1179         qcow2_cache_destroy(r->refcount_block_cache);
1180     }
1181     qapi_free_QCryptoBlockOpenOptions(r->crypto_opts);
1182 }
1183 
1184 static int qcow2_update_options(BlockDriverState *bs, QDict *options,
1185                                 int flags, Error **errp)
1186 {
1187     Qcow2ReopenState r = {};
1188     int ret;
1189 
1190     ret = qcow2_update_options_prepare(bs, &r, options, flags, errp);
1191     if (ret >= 0) {
1192         qcow2_update_options_commit(bs, &r);
1193     } else {
1194         qcow2_update_options_abort(bs, &r);
1195     }
1196 
1197     return ret;
1198 }
1199 
1200 /* Called with s->lock held.  */
1201 static int coroutine_fn qcow2_do_open(BlockDriverState *bs, QDict *options,
1202                                       int flags, Error **errp)
1203 {
1204     BDRVQcow2State *s = bs->opaque;
1205     unsigned int len, i;
1206     int ret = 0;
1207     QCowHeader header;
1208     Error *local_err = NULL;
1209     uint64_t ext_end;
1210     uint64_t l1_vm_state_index;
1211     bool update_header = false;
1212 
1213     ret = bdrv_pread(bs->file, 0, &header, sizeof(header));
1214     if (ret < 0) {
1215         error_setg_errno(errp, -ret, "Could not read qcow2 header");
1216         goto fail;
1217     }
1218     header.magic = be32_to_cpu(header.magic);
1219     header.version = be32_to_cpu(header.version);
1220     header.backing_file_offset = be64_to_cpu(header.backing_file_offset);
1221     header.backing_file_size = be32_to_cpu(header.backing_file_size);
1222     header.size = be64_to_cpu(header.size);
1223     header.cluster_bits = be32_to_cpu(header.cluster_bits);
1224     header.crypt_method = be32_to_cpu(header.crypt_method);
1225     header.l1_table_offset = be64_to_cpu(header.l1_table_offset);
1226     header.l1_size = be32_to_cpu(header.l1_size);
1227     header.refcount_table_offset = be64_to_cpu(header.refcount_table_offset);
1228     header.refcount_table_clusters =
1229         be32_to_cpu(header.refcount_table_clusters);
1230     header.snapshots_offset = be64_to_cpu(header.snapshots_offset);
1231     header.nb_snapshots = be32_to_cpu(header.nb_snapshots);
1232 
1233     if (header.magic != QCOW_MAGIC) {
1234         error_setg(errp, "Image is not in qcow2 format");
1235         ret = -EINVAL;
1236         goto fail;
1237     }
1238     if (header.version < 2 || header.version > 3) {
1239         error_setg(errp, "Unsupported qcow2 version %" PRIu32, header.version);
1240         ret = -ENOTSUP;
1241         goto fail;
1242     }
1243 
1244     s->qcow_version = header.version;
1245 
1246     /* Initialise cluster size */
1247     if (header.cluster_bits < MIN_CLUSTER_BITS ||
1248         header.cluster_bits > MAX_CLUSTER_BITS) {
1249         error_setg(errp, "Unsupported cluster size: 2^%" PRIu32,
1250                    header.cluster_bits);
1251         ret = -EINVAL;
1252         goto fail;
1253     }
1254 
1255     s->cluster_bits = header.cluster_bits;
1256     s->cluster_size = 1 << s->cluster_bits;
1257 
1258     /* Initialise version 3 header fields */
1259     if (header.version == 2) {
1260         header.incompatible_features    = 0;
1261         header.compatible_features      = 0;
1262         header.autoclear_features       = 0;
1263         header.refcount_order           = 4;
1264         header.header_length            = 72;
1265     } else {
1266         header.incompatible_features =
1267             be64_to_cpu(header.incompatible_features);
1268         header.compatible_features = be64_to_cpu(header.compatible_features);
1269         header.autoclear_features = be64_to_cpu(header.autoclear_features);
1270         header.refcount_order = be32_to_cpu(header.refcount_order);
1271         header.header_length = be32_to_cpu(header.header_length);
1272 
1273         if (header.header_length < 104) {
1274             error_setg(errp, "qcow2 header too short");
1275             ret = -EINVAL;
1276             goto fail;
1277         }
1278     }
1279 
1280     if (header.header_length > s->cluster_size) {
1281         error_setg(errp, "qcow2 header exceeds cluster size");
1282         ret = -EINVAL;
1283         goto fail;
1284     }
1285 
1286     if (header.header_length > sizeof(header)) {
1287         s->unknown_header_fields_size = header.header_length - sizeof(header);
1288         s->unknown_header_fields = g_malloc(s->unknown_header_fields_size);
1289         ret = bdrv_pread(bs->file, sizeof(header), s->unknown_header_fields,
1290                          s->unknown_header_fields_size);
1291         if (ret < 0) {
1292             error_setg_errno(errp, -ret, "Could not read unknown qcow2 header "
1293                              "fields");
1294             goto fail;
1295         }
1296     }
1297 
1298     if (header.backing_file_offset > s->cluster_size) {
1299         error_setg(errp, "Invalid backing file offset");
1300         ret = -EINVAL;
1301         goto fail;
1302     }
1303 
1304     if (header.backing_file_offset) {
1305         ext_end = header.backing_file_offset;
1306     } else {
1307         ext_end = 1 << header.cluster_bits;
1308     }
1309 
1310     /* Handle feature bits */
1311     s->incompatible_features    = header.incompatible_features;
1312     s->compatible_features      = header.compatible_features;
1313     s->autoclear_features       = header.autoclear_features;
1314 
1315     if (s->incompatible_features & ~QCOW2_INCOMPAT_MASK) {
1316         void *feature_table = NULL;
1317         qcow2_read_extensions(bs, header.header_length, ext_end,
1318                               &feature_table, flags, NULL, NULL);
1319         report_unsupported_feature(errp, feature_table,
1320                                    s->incompatible_features &
1321                                    ~QCOW2_INCOMPAT_MASK);
1322         ret = -ENOTSUP;
1323         g_free(feature_table);
1324         goto fail;
1325     }
1326 
1327     if (s->incompatible_features & QCOW2_INCOMPAT_CORRUPT) {
1328         /* Corrupt images may not be written to unless they are being repaired
1329          */
1330         if ((flags & BDRV_O_RDWR) && !(flags & BDRV_O_CHECK)) {
1331             error_setg(errp, "qcow2: Image is corrupt; cannot be opened "
1332                        "read/write");
1333             ret = -EACCES;
1334             goto fail;
1335         }
1336     }
1337 
1338     /* Check support for various header values */
1339     if (header.refcount_order > 6) {
1340         error_setg(errp, "Reference count entry width too large; may not "
1341                    "exceed 64 bits");
1342         ret = -EINVAL;
1343         goto fail;
1344     }
1345     s->refcount_order = header.refcount_order;
1346     s->refcount_bits = 1 << s->refcount_order;
1347     s->refcount_max = UINT64_C(1) << (s->refcount_bits - 1);
1348     s->refcount_max += s->refcount_max - 1;
1349 
1350     s->crypt_method_header = header.crypt_method;
1351     if (s->crypt_method_header) {
1352         if (bdrv_uses_whitelist() &&
1353             s->crypt_method_header == QCOW_CRYPT_AES) {
1354             error_setg(errp,
1355                        "Use of AES-CBC encrypted qcow2 images is no longer "
1356                        "supported in system emulators");
1357             error_append_hint(errp,
1358                               "You can use 'qemu-img convert' to convert your "
1359                               "image to an alternative supported format, such "
1360                               "as unencrypted qcow2, or raw with the LUKS "
1361                               "format instead.\n");
1362             ret = -ENOSYS;
1363             goto fail;
1364         }
1365 
1366         if (s->crypt_method_header == QCOW_CRYPT_AES) {
1367             s->crypt_physical_offset = false;
1368         } else {
1369             /* Assuming LUKS and any future crypt methods we
1370              * add will all use physical offsets, due to the
1371              * fact that the alternative is insecure...  */
1372             s->crypt_physical_offset = true;
1373         }
1374 
1375         bs->encrypted = true;
1376     }
1377 
1378     s->l2_bits = s->cluster_bits - 3; /* L2 is always one cluster */
1379     s->l2_size = 1 << s->l2_bits;
1380     /* 2^(s->refcount_order - 3) is the refcount width in bytes */
1381     s->refcount_block_bits = s->cluster_bits - (s->refcount_order - 3);
1382     s->refcount_block_size = 1 << s->refcount_block_bits;
1383     bs->total_sectors = header.size / BDRV_SECTOR_SIZE;
1384     s->csize_shift = (62 - (s->cluster_bits - 8));
1385     s->csize_mask = (1 << (s->cluster_bits - 8)) - 1;
1386     s->cluster_offset_mask = (1LL << s->csize_shift) - 1;
1387 
1388     s->refcount_table_offset = header.refcount_table_offset;
1389     s->refcount_table_size =
1390         header.refcount_table_clusters << (s->cluster_bits - 3);
1391 
1392     if (header.refcount_table_clusters == 0 && !(flags & BDRV_O_CHECK)) {
1393         error_setg(errp, "Image does not contain a reference count table");
1394         ret = -EINVAL;
1395         goto fail;
1396     }
1397 
1398     ret = qcow2_validate_table(bs, s->refcount_table_offset,
1399                                header.refcount_table_clusters,
1400                                s->cluster_size, QCOW_MAX_REFTABLE_SIZE,
1401                                "Reference count table", errp);
1402     if (ret < 0) {
1403         goto fail;
1404     }
1405 
1406     /* The total size in bytes of the snapshot table is checked in
1407      * qcow2_read_snapshots() because the size of each snapshot is
1408      * variable and we don't know it yet.
1409      * Here we only check the offset and number of snapshots. */
1410     ret = qcow2_validate_table(bs, header.snapshots_offset,
1411                                header.nb_snapshots,
1412                                sizeof(QCowSnapshotHeader),
1413                                sizeof(QCowSnapshotHeader) * QCOW_MAX_SNAPSHOTS,
1414                                "Snapshot table", errp);
1415     if (ret < 0) {
1416         goto fail;
1417     }
1418 
1419     /* read the level 1 table */
1420     ret = qcow2_validate_table(bs, header.l1_table_offset,
1421                                header.l1_size, sizeof(uint64_t),
1422                                QCOW_MAX_L1_SIZE, "Active L1 table", errp);
1423     if (ret < 0) {
1424         goto fail;
1425     }
1426     s->l1_size = header.l1_size;
1427     s->l1_table_offset = header.l1_table_offset;
1428 
1429     l1_vm_state_index = size_to_l1(s, header.size);
1430     if (l1_vm_state_index > INT_MAX) {
1431         error_setg(errp, "Image is too big");
1432         ret = -EFBIG;
1433         goto fail;
1434     }
1435     s->l1_vm_state_index = l1_vm_state_index;
1436 
1437     /* the L1 table must contain at least enough entries to put
1438        header.size bytes */
1439     if (s->l1_size < s->l1_vm_state_index) {
1440         error_setg(errp, "L1 table is too small");
1441         ret = -EINVAL;
1442         goto fail;
1443     }
1444 
1445     if (s->l1_size > 0) {
1446         s->l1_table = qemu_try_blockalign(bs->file->bs,
1447             ROUND_UP(s->l1_size * sizeof(uint64_t), 512));
1448         if (s->l1_table == NULL) {
1449             error_setg(errp, "Could not allocate L1 table");
1450             ret = -ENOMEM;
1451             goto fail;
1452         }
1453         ret = bdrv_pread(bs->file, s->l1_table_offset, s->l1_table,
1454                          s->l1_size * sizeof(uint64_t));
1455         if (ret < 0) {
1456             error_setg_errno(errp, -ret, "Could not read L1 table");
1457             goto fail;
1458         }
1459         for(i = 0;i < s->l1_size; i++) {
1460             s->l1_table[i] = be64_to_cpu(s->l1_table[i]);
1461         }
1462     }
1463 
1464     /* Parse driver-specific options */
1465     ret = qcow2_update_options(bs, options, flags, errp);
1466     if (ret < 0) {
1467         goto fail;
1468     }
1469 
1470     s->flags = flags;
1471 
1472     ret = qcow2_refcount_init(bs);
1473     if (ret != 0) {
1474         error_setg_errno(errp, -ret, "Could not initialize refcount handling");
1475         goto fail;
1476     }
1477 
1478     QLIST_INIT(&s->cluster_allocs);
1479     QTAILQ_INIT(&s->discards);
1480 
1481     /* read qcow2 extensions */
1482     if (qcow2_read_extensions(bs, header.header_length, ext_end, NULL,
1483                               flags, &update_header, &local_err)) {
1484         error_propagate(errp, local_err);
1485         ret = -EINVAL;
1486         goto fail;
1487     }
1488 
1489     /* Open external data file */
1490     s->data_file = bdrv_open_child(NULL, options, "data-file", bs, &child_file,
1491                                    true, &local_err);
1492     if (local_err) {
1493         error_propagate(errp, local_err);
1494         ret = -EINVAL;
1495         goto fail;
1496     }
1497 
1498     if (s->incompatible_features & QCOW2_INCOMPAT_DATA_FILE) {
1499         if (!s->data_file && s->image_data_file) {
1500             s->data_file = bdrv_open_child(s->image_data_file, options,
1501                                            "data-file", bs, &child_file,
1502                                            false, errp);
1503             if (!s->data_file) {
1504                 ret = -EINVAL;
1505                 goto fail;
1506             }
1507         }
1508         if (!s->data_file) {
1509             error_setg(errp, "'data-file' is required for this image");
1510             ret = -EINVAL;
1511             goto fail;
1512         }
1513     } else {
1514         if (s->data_file) {
1515             error_setg(errp, "'data-file' can only be set for images with an "
1516                              "external data file");
1517             ret = -EINVAL;
1518             goto fail;
1519         }
1520 
1521         s->data_file = bs->file;
1522 
1523         if (data_file_is_raw(bs)) {
1524             error_setg(errp, "data-file-raw requires a data file");
1525             ret = -EINVAL;
1526             goto fail;
1527         }
1528     }
1529 
1530     /* qcow2_read_extension may have set up the crypto context
1531      * if the crypt method needs a header region, some methods
1532      * don't need header extensions, so must check here
1533      */
1534     if (s->crypt_method_header && !s->crypto) {
1535         if (s->crypt_method_header == QCOW_CRYPT_AES) {
1536             unsigned int cflags = 0;
1537             if (flags & BDRV_O_NO_IO) {
1538                 cflags |= QCRYPTO_BLOCK_OPEN_NO_IO;
1539             }
1540             s->crypto = qcrypto_block_open(s->crypto_opts, "encrypt.",
1541                                            NULL, NULL, cflags,
1542                                            QCOW2_MAX_THREADS, errp);
1543             if (!s->crypto) {
1544                 ret = -EINVAL;
1545                 goto fail;
1546             }
1547         } else if (!(flags & BDRV_O_NO_IO)) {
1548             error_setg(errp, "Missing CRYPTO header for crypt method %d",
1549                        s->crypt_method_header);
1550             ret = -EINVAL;
1551             goto fail;
1552         }
1553     }
1554 
1555     /* read the backing file name */
1556     if (header.backing_file_offset != 0) {
1557         len = header.backing_file_size;
1558         if (len > MIN(1023, s->cluster_size - header.backing_file_offset) ||
1559             len >= sizeof(bs->backing_file)) {
1560             error_setg(errp, "Backing file name too long");
1561             ret = -EINVAL;
1562             goto fail;
1563         }
1564         ret = bdrv_pread(bs->file, header.backing_file_offset,
1565                          bs->auto_backing_file, len);
1566         if (ret < 0) {
1567             error_setg_errno(errp, -ret, "Could not read backing file name");
1568             goto fail;
1569         }
1570         bs->auto_backing_file[len] = '\0';
1571         pstrcpy(bs->backing_file, sizeof(bs->backing_file),
1572                 bs->auto_backing_file);
1573         s->image_backing_file = g_strdup(bs->auto_backing_file);
1574     }
1575 
1576     /* Internal snapshots */
1577     s->snapshots_offset = header.snapshots_offset;
1578     s->nb_snapshots = header.nb_snapshots;
1579 
1580     ret = qcow2_read_snapshots(bs);
1581     if (ret < 0) {
1582         error_setg_errno(errp, -ret, "Could not read snapshots");
1583         goto fail;
1584     }
1585 
1586     /* Clear unknown autoclear feature bits */
1587     update_header |= s->autoclear_features & ~QCOW2_AUTOCLEAR_MASK;
1588     update_header =
1589         update_header && !bs->read_only && !(flags & BDRV_O_INACTIVE);
1590     if (update_header) {
1591         s->autoclear_features &= QCOW2_AUTOCLEAR_MASK;
1592     }
1593 
1594     /* == Handle persistent dirty bitmaps ==
1595      *
1596      * We want load dirty bitmaps in three cases:
1597      *
1598      * 1. Normal open of the disk in active mode, not related to invalidation
1599      *    after migration.
1600      *
1601      * 2. Invalidation of the target vm after pre-copy phase of migration, if
1602      *    bitmaps are _not_ migrating through migration channel, i.e.
1603      *    'dirty-bitmaps' capability is disabled.
1604      *
1605      * 3. Invalidation of source vm after failed or canceled migration.
1606      *    This is a very interesting case. There are two possible types of
1607      *    bitmaps:
1608      *
1609      *    A. Stored on inactivation and removed. They should be loaded from the
1610      *       image.
1611      *
1612      *    B. Not stored: not-persistent bitmaps and bitmaps, migrated through
1613      *       the migration channel (with dirty-bitmaps capability).
1614      *
1615      *    On the other hand, there are two possible sub-cases:
1616      *
1617      *    3.1 disk was changed by somebody else while were inactive. In this
1618      *        case all in-RAM dirty bitmaps (both persistent and not) are
1619      *        definitely invalid. And we don't have any method to determine
1620      *        this.
1621      *
1622      *        Simple and safe thing is to just drop all the bitmaps of type B on
1623      *        inactivation. But in this case we lose bitmaps in valid 4.2 case.
1624      *
1625      *        On the other hand, resuming source vm, if disk was already changed
1626      *        is a bad thing anyway: not only bitmaps, the whole vm state is
1627      *        out of sync with disk.
1628      *
1629      *        This means, that user or management tool, who for some reason
1630      *        decided to resume source vm, after disk was already changed by
1631      *        target vm, should at least drop all dirty bitmaps by hand.
1632      *
1633      *        So, we can ignore this case for now, but TODO: "generation"
1634      *        extension for qcow2, to determine, that image was changed after
1635      *        last inactivation. And if it is changed, we will drop (or at least
1636      *        mark as 'invalid' all the bitmaps of type B, both persistent
1637      *        and not).
1638      *
1639      *    3.2 disk was _not_ changed while were inactive. Bitmaps may be saved
1640      *        to disk ('dirty-bitmaps' capability disabled), or not saved
1641      *        ('dirty-bitmaps' capability enabled), but we don't need to care
1642      *        of: let's load bitmaps as always: stored bitmaps will be loaded,
1643      *        and not stored has flag IN_USE=1 in the image and will be skipped
1644      *        on loading.
1645      *
1646      * One remaining possible case when we don't want load bitmaps:
1647      *
1648      * 4. Open disk in inactive mode in target vm (bitmaps are migrating or
1649      *    will be loaded on invalidation, no needs try loading them before)
1650      */
1651 
1652     if (!(bdrv_get_flags(bs) & BDRV_O_INACTIVE)) {
1653         /* It's case 1, 2 or 3.2. Or 3.1 which is BUG in management layer. */
1654         bool header_updated = qcow2_load_dirty_bitmaps(bs, &local_err);
1655 
1656         update_header = update_header && !header_updated;
1657     }
1658     if (local_err != NULL) {
1659         error_propagate(errp, local_err);
1660         ret = -EINVAL;
1661         goto fail;
1662     }
1663 
1664     if (update_header) {
1665         ret = qcow2_update_header(bs);
1666         if (ret < 0) {
1667             error_setg_errno(errp, -ret, "Could not update qcow2 header");
1668             goto fail;
1669         }
1670     }
1671 
1672     bs->supported_zero_flags = header.version >= 3 ? BDRV_REQ_MAY_UNMAP : 0;
1673 
1674     /* Repair image if dirty */
1675     if (!(flags & (BDRV_O_CHECK | BDRV_O_INACTIVE)) && !bs->read_only &&
1676         (s->incompatible_features & QCOW2_INCOMPAT_DIRTY)) {
1677         BdrvCheckResult result = {0};
1678 
1679         ret = qcow2_co_check_locked(bs, &result,
1680                                     BDRV_FIX_ERRORS | BDRV_FIX_LEAKS);
1681         if (ret < 0 || result.check_errors) {
1682             if (ret >= 0) {
1683                 ret = -EIO;
1684             }
1685             error_setg_errno(errp, -ret, "Could not repair dirty image");
1686             goto fail;
1687         }
1688     }
1689 
1690 #ifdef DEBUG_ALLOC
1691     {
1692         BdrvCheckResult result = {0};
1693         qcow2_check_refcounts(bs, &result, 0);
1694     }
1695 #endif
1696 
1697     qemu_co_queue_init(&s->thread_task_queue);
1698 
1699     return ret;
1700 
1701  fail:
1702     g_free(s->image_data_file);
1703     if (has_data_file(bs)) {
1704         bdrv_unref_child(bs, s->data_file);
1705     }
1706     g_free(s->unknown_header_fields);
1707     cleanup_unknown_header_ext(bs);
1708     qcow2_free_snapshots(bs);
1709     qcow2_refcount_close(bs);
1710     qemu_vfree(s->l1_table);
1711     /* else pre-write overlap checks in cache_destroy may crash */
1712     s->l1_table = NULL;
1713     cache_clean_timer_del(bs);
1714     if (s->l2_table_cache) {
1715         qcow2_cache_destroy(s->l2_table_cache);
1716     }
1717     if (s->refcount_block_cache) {
1718         qcow2_cache_destroy(s->refcount_block_cache);
1719     }
1720     qcrypto_block_free(s->crypto);
1721     qapi_free_QCryptoBlockOpenOptions(s->crypto_opts);
1722     return ret;
1723 }
1724 
1725 typedef struct QCow2OpenCo {
1726     BlockDriverState *bs;
1727     QDict *options;
1728     int flags;
1729     Error **errp;
1730     int ret;
1731 } QCow2OpenCo;
1732 
1733 static void coroutine_fn qcow2_open_entry(void *opaque)
1734 {
1735     QCow2OpenCo *qoc = opaque;
1736     BDRVQcow2State *s = qoc->bs->opaque;
1737 
1738     qemu_co_mutex_lock(&s->lock);
1739     qoc->ret = qcow2_do_open(qoc->bs, qoc->options, qoc->flags, qoc->errp);
1740     qemu_co_mutex_unlock(&s->lock);
1741 }
1742 
1743 static int qcow2_open(BlockDriverState *bs, QDict *options, int flags,
1744                       Error **errp)
1745 {
1746     BDRVQcow2State *s = bs->opaque;
1747     QCow2OpenCo qoc = {
1748         .bs = bs,
1749         .options = options,
1750         .flags = flags,
1751         .errp = errp,
1752         .ret = -EINPROGRESS
1753     };
1754 
1755     bs->file = bdrv_open_child(NULL, options, "file", bs, &child_file,
1756                                false, errp);
1757     if (!bs->file) {
1758         return -EINVAL;
1759     }
1760 
1761     /* Initialise locks */
1762     qemu_co_mutex_init(&s->lock);
1763 
1764     if (qemu_in_coroutine()) {
1765         /* From bdrv_co_create.  */
1766         qcow2_open_entry(&qoc);
1767     } else {
1768         assert(qemu_get_current_aio_context() == qemu_get_aio_context());
1769         qemu_coroutine_enter(qemu_coroutine_create(qcow2_open_entry, &qoc));
1770         BDRV_POLL_WHILE(bs, qoc.ret == -EINPROGRESS);
1771     }
1772     return qoc.ret;
1773 }
1774 
1775 static void qcow2_refresh_limits(BlockDriverState *bs, Error **errp)
1776 {
1777     BDRVQcow2State *s = bs->opaque;
1778 
1779     if (bs->encrypted) {
1780         /* Encryption works on a sector granularity */
1781         bs->bl.request_alignment = qcrypto_block_get_sector_size(s->crypto);
1782     }
1783     bs->bl.pwrite_zeroes_alignment = s->cluster_size;
1784     bs->bl.pdiscard_alignment = s->cluster_size;
1785 }
1786 
1787 static int qcow2_reopen_prepare(BDRVReopenState *state,
1788                                 BlockReopenQueue *queue, Error **errp)
1789 {
1790     Qcow2ReopenState *r;
1791     int ret;
1792 
1793     r = g_new0(Qcow2ReopenState, 1);
1794     state->opaque = r;
1795 
1796     ret = qcow2_update_options_prepare(state->bs, r, state->options,
1797                                        state->flags, errp);
1798     if (ret < 0) {
1799         goto fail;
1800     }
1801 
1802     /* We need to write out any unwritten data if we reopen read-only. */
1803     if ((state->flags & BDRV_O_RDWR) == 0) {
1804         ret = qcow2_reopen_bitmaps_ro(state->bs, errp);
1805         if (ret < 0) {
1806             goto fail;
1807         }
1808 
1809         ret = bdrv_flush(state->bs);
1810         if (ret < 0) {
1811             goto fail;
1812         }
1813 
1814         ret = qcow2_mark_clean(state->bs);
1815         if (ret < 0) {
1816             goto fail;
1817         }
1818     }
1819 
1820     return 0;
1821 
1822 fail:
1823     qcow2_update_options_abort(state->bs, r);
1824     g_free(r);
1825     return ret;
1826 }
1827 
1828 static void qcow2_reopen_commit(BDRVReopenState *state)
1829 {
1830     qcow2_update_options_commit(state->bs, state->opaque);
1831     g_free(state->opaque);
1832 }
1833 
1834 static void qcow2_reopen_abort(BDRVReopenState *state)
1835 {
1836     qcow2_update_options_abort(state->bs, state->opaque);
1837     g_free(state->opaque);
1838 }
1839 
1840 static void qcow2_join_options(QDict *options, QDict *old_options)
1841 {
1842     bool has_new_overlap_template =
1843         qdict_haskey(options, QCOW2_OPT_OVERLAP) ||
1844         qdict_haskey(options, QCOW2_OPT_OVERLAP_TEMPLATE);
1845     bool has_new_total_cache_size =
1846         qdict_haskey(options, QCOW2_OPT_CACHE_SIZE);
1847     bool has_all_cache_options;
1848 
1849     /* New overlap template overrides all old overlap options */
1850     if (has_new_overlap_template) {
1851         qdict_del(old_options, QCOW2_OPT_OVERLAP);
1852         qdict_del(old_options, QCOW2_OPT_OVERLAP_TEMPLATE);
1853         qdict_del(old_options, QCOW2_OPT_OVERLAP_MAIN_HEADER);
1854         qdict_del(old_options, QCOW2_OPT_OVERLAP_ACTIVE_L1);
1855         qdict_del(old_options, QCOW2_OPT_OVERLAP_ACTIVE_L2);
1856         qdict_del(old_options, QCOW2_OPT_OVERLAP_REFCOUNT_TABLE);
1857         qdict_del(old_options, QCOW2_OPT_OVERLAP_REFCOUNT_BLOCK);
1858         qdict_del(old_options, QCOW2_OPT_OVERLAP_SNAPSHOT_TABLE);
1859         qdict_del(old_options, QCOW2_OPT_OVERLAP_INACTIVE_L1);
1860         qdict_del(old_options, QCOW2_OPT_OVERLAP_INACTIVE_L2);
1861     }
1862 
1863     /* New total cache size overrides all old options */
1864     if (qdict_haskey(options, QCOW2_OPT_CACHE_SIZE)) {
1865         qdict_del(old_options, QCOW2_OPT_L2_CACHE_SIZE);
1866         qdict_del(old_options, QCOW2_OPT_REFCOUNT_CACHE_SIZE);
1867     }
1868 
1869     qdict_join(options, old_options, false);
1870 
1871     /*
1872      * If after merging all cache size options are set, an old total size is
1873      * overwritten. Do keep all options, however, if all three are new. The
1874      * resulting error message is what we want to happen.
1875      */
1876     has_all_cache_options =
1877         qdict_haskey(options, QCOW2_OPT_CACHE_SIZE) ||
1878         qdict_haskey(options, QCOW2_OPT_L2_CACHE_SIZE) ||
1879         qdict_haskey(options, QCOW2_OPT_REFCOUNT_CACHE_SIZE);
1880 
1881     if (has_all_cache_options && !has_new_total_cache_size) {
1882         qdict_del(options, QCOW2_OPT_CACHE_SIZE);
1883     }
1884 }
1885 
1886 static int coroutine_fn qcow2_co_block_status(BlockDriverState *bs,
1887                                               bool want_zero,
1888                                               int64_t offset, int64_t count,
1889                                               int64_t *pnum, int64_t *map,
1890                                               BlockDriverState **file)
1891 {
1892     BDRVQcow2State *s = bs->opaque;
1893     uint64_t cluster_offset;
1894     int index_in_cluster, ret;
1895     unsigned int bytes;
1896     int status = 0;
1897 
1898     bytes = MIN(INT_MAX, count);
1899     qemu_co_mutex_lock(&s->lock);
1900     ret = qcow2_get_cluster_offset(bs, offset, &bytes, &cluster_offset);
1901     qemu_co_mutex_unlock(&s->lock);
1902     if (ret < 0) {
1903         return ret;
1904     }
1905 
1906     *pnum = bytes;
1907 
1908     if ((ret == QCOW2_CLUSTER_NORMAL || ret == QCOW2_CLUSTER_ZERO_ALLOC) &&
1909         !s->crypto) {
1910         index_in_cluster = offset & (s->cluster_size - 1);
1911         *map = cluster_offset | index_in_cluster;
1912         *file = s->data_file->bs;
1913         status |= BDRV_BLOCK_OFFSET_VALID;
1914     }
1915     if (ret == QCOW2_CLUSTER_ZERO_PLAIN || ret == QCOW2_CLUSTER_ZERO_ALLOC) {
1916         status |= BDRV_BLOCK_ZERO;
1917     } else if (ret != QCOW2_CLUSTER_UNALLOCATED) {
1918         status |= BDRV_BLOCK_DATA;
1919     }
1920     return status;
1921 }
1922 
1923 static coroutine_fn int qcow2_handle_l2meta(BlockDriverState *bs,
1924                                             QCowL2Meta **pl2meta,
1925                                             bool link_l2)
1926 {
1927     int ret = 0;
1928     QCowL2Meta *l2meta = *pl2meta;
1929 
1930     while (l2meta != NULL) {
1931         QCowL2Meta *next;
1932 
1933         if (link_l2) {
1934             ret = qcow2_alloc_cluster_link_l2(bs, l2meta);
1935             if (ret) {
1936                 goto out;
1937             }
1938         } else {
1939             qcow2_alloc_cluster_abort(bs, l2meta);
1940         }
1941 
1942         /* Take the request off the list of running requests */
1943         if (l2meta->nb_clusters != 0) {
1944             QLIST_REMOVE(l2meta, next_in_flight);
1945         }
1946 
1947         qemu_co_queue_restart_all(&l2meta->dependent_requests);
1948 
1949         next = l2meta->next;
1950         g_free(l2meta);
1951         l2meta = next;
1952     }
1953 out:
1954     *pl2meta = l2meta;
1955     return ret;
1956 }
1957 
1958 static coroutine_fn int qcow2_co_preadv(BlockDriverState *bs, uint64_t offset,
1959                                         uint64_t bytes, QEMUIOVector *qiov,
1960                                         int flags)
1961 {
1962     BDRVQcow2State *s = bs->opaque;
1963     int offset_in_cluster;
1964     int ret;
1965     unsigned int cur_bytes; /* number of bytes in current iteration */
1966     uint64_t cluster_offset = 0;
1967     uint64_t bytes_done = 0;
1968     QEMUIOVector hd_qiov;
1969     uint8_t *cluster_data = NULL;
1970 
1971     qemu_iovec_init(&hd_qiov, qiov->niov);
1972 
1973     while (bytes != 0) {
1974 
1975         /* prepare next request */
1976         cur_bytes = MIN(bytes, INT_MAX);
1977         if (s->crypto) {
1978             cur_bytes = MIN(cur_bytes,
1979                             QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size);
1980         }
1981 
1982         qemu_co_mutex_lock(&s->lock);
1983         ret = qcow2_get_cluster_offset(bs, offset, &cur_bytes, &cluster_offset);
1984         qemu_co_mutex_unlock(&s->lock);
1985         if (ret < 0) {
1986             goto fail;
1987         }
1988 
1989         offset_in_cluster = offset_into_cluster(s, offset);
1990 
1991         qemu_iovec_reset(&hd_qiov);
1992         qemu_iovec_concat(&hd_qiov, qiov, bytes_done, cur_bytes);
1993 
1994         switch (ret) {
1995         case QCOW2_CLUSTER_UNALLOCATED:
1996 
1997             if (bs->backing) {
1998                 BLKDBG_EVENT(bs->file, BLKDBG_READ_BACKING_AIO);
1999                 ret = bdrv_co_preadv(bs->backing, offset, cur_bytes,
2000                                      &hd_qiov, 0);
2001                 if (ret < 0) {
2002                     goto fail;
2003                 }
2004             } else {
2005                 /* Note: in this case, no need to wait */
2006                 qemu_iovec_memset(&hd_qiov, 0, 0, cur_bytes);
2007             }
2008             break;
2009 
2010         case QCOW2_CLUSTER_ZERO_PLAIN:
2011         case QCOW2_CLUSTER_ZERO_ALLOC:
2012             qemu_iovec_memset(&hd_qiov, 0, 0, cur_bytes);
2013             break;
2014 
2015         case QCOW2_CLUSTER_COMPRESSED:
2016             ret = qcow2_co_preadv_compressed(bs, cluster_offset,
2017                                              offset, cur_bytes,
2018                                              &hd_qiov);
2019             if (ret < 0) {
2020                 goto fail;
2021             }
2022 
2023             break;
2024 
2025         case QCOW2_CLUSTER_NORMAL:
2026             if ((cluster_offset & 511) != 0) {
2027                 ret = -EIO;
2028                 goto fail;
2029             }
2030 
2031             if (bs->encrypted) {
2032                 assert(s->crypto);
2033 
2034                 /*
2035                  * For encrypted images, read everything into a temporary
2036                  * contiguous buffer on which the AES functions can work.
2037                  */
2038                 if (!cluster_data) {
2039                     cluster_data =
2040                         qemu_try_blockalign(s->data_file->bs,
2041                                             QCOW_MAX_CRYPT_CLUSTERS
2042                                             * s->cluster_size);
2043                     if (cluster_data == NULL) {
2044                         ret = -ENOMEM;
2045                         goto fail;
2046                     }
2047                 }
2048 
2049                 assert(cur_bytes <= QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size);
2050                 qemu_iovec_reset(&hd_qiov);
2051                 qemu_iovec_add(&hd_qiov, cluster_data, cur_bytes);
2052             }
2053 
2054             BLKDBG_EVENT(bs->file, BLKDBG_READ_AIO);
2055             ret = bdrv_co_preadv(s->data_file,
2056                                  cluster_offset + offset_in_cluster,
2057                                  cur_bytes, &hd_qiov, 0);
2058             if (ret < 0) {
2059                 goto fail;
2060             }
2061             if (bs->encrypted) {
2062                 assert(s->crypto);
2063                 assert((offset & (BDRV_SECTOR_SIZE - 1)) == 0);
2064                 assert((cur_bytes & (BDRV_SECTOR_SIZE - 1)) == 0);
2065                 if (qcow2_co_decrypt(bs, cluster_offset, offset,
2066                                      cluster_data, cur_bytes) < 0) {
2067                     ret = -EIO;
2068                     goto fail;
2069                 }
2070                 qemu_iovec_from_buf(qiov, bytes_done, cluster_data, cur_bytes);
2071             }
2072             break;
2073 
2074         default:
2075             g_assert_not_reached();
2076             ret = -EIO;
2077             goto fail;
2078         }
2079 
2080         bytes -= cur_bytes;
2081         offset += cur_bytes;
2082         bytes_done += cur_bytes;
2083     }
2084     ret = 0;
2085 
2086 fail:
2087     qemu_iovec_destroy(&hd_qiov);
2088     qemu_vfree(cluster_data);
2089 
2090     return ret;
2091 }
2092 
2093 /* Check if it's possible to merge a write request with the writing of
2094  * the data from the COW regions */
2095 static bool merge_cow(uint64_t offset, unsigned bytes,
2096                       QEMUIOVector *hd_qiov, QCowL2Meta *l2meta)
2097 {
2098     QCowL2Meta *m;
2099 
2100     for (m = l2meta; m != NULL; m = m->next) {
2101         /* If both COW regions are empty then there's nothing to merge */
2102         if (m->cow_start.nb_bytes == 0 && m->cow_end.nb_bytes == 0) {
2103             continue;
2104         }
2105 
2106         /* If COW regions are handled already, skip this too */
2107         if (m->skip_cow) {
2108             continue;
2109         }
2110 
2111         /* The data (middle) region must be immediately after the
2112          * start region */
2113         if (l2meta_cow_start(m) + m->cow_start.nb_bytes != offset) {
2114             continue;
2115         }
2116 
2117         /* The end region must be immediately after the data (middle)
2118          * region */
2119         if (m->offset + m->cow_end.offset != offset + bytes) {
2120             continue;
2121         }
2122 
2123         /* Make sure that adding both COW regions to the QEMUIOVector
2124          * does not exceed IOV_MAX */
2125         if (hd_qiov->niov > IOV_MAX - 2) {
2126             continue;
2127         }
2128 
2129         m->data_qiov = hd_qiov;
2130         return true;
2131     }
2132 
2133     return false;
2134 }
2135 
2136 static bool is_unallocated(BlockDriverState *bs, int64_t offset, int64_t bytes)
2137 {
2138     int64_t nr;
2139     return !bytes ||
2140         (!bdrv_is_allocated_above(bs, NULL, offset, bytes, &nr) && nr == bytes);
2141 }
2142 
2143 static bool is_zero_cow(BlockDriverState *bs, QCowL2Meta *m)
2144 {
2145     /*
2146      * This check is designed for optimization shortcut so it must be
2147      * efficient.
2148      * Instead of is_zero(), use is_unallocated() as it is faster (but not
2149      * as accurate and can result in false negatives).
2150      */
2151     return is_unallocated(bs, m->offset + m->cow_start.offset,
2152                           m->cow_start.nb_bytes) &&
2153            is_unallocated(bs, m->offset + m->cow_end.offset,
2154                           m->cow_end.nb_bytes);
2155 }
2156 
2157 static int handle_alloc_space(BlockDriverState *bs, QCowL2Meta *l2meta)
2158 {
2159     BDRVQcow2State *s = bs->opaque;
2160     QCowL2Meta *m;
2161 
2162     if (!(s->data_file->bs->supported_zero_flags & BDRV_REQ_NO_FALLBACK)) {
2163         return 0;
2164     }
2165 
2166     if (bs->encrypted) {
2167         return 0;
2168     }
2169 
2170     for (m = l2meta; m != NULL; m = m->next) {
2171         int ret;
2172 
2173         if (!m->cow_start.nb_bytes && !m->cow_end.nb_bytes) {
2174             continue;
2175         }
2176 
2177         if (!is_zero_cow(bs, m)) {
2178             continue;
2179         }
2180 
2181         /*
2182          * instead of writing zero COW buffers,
2183          * efficiently zero out the whole clusters
2184          */
2185 
2186         ret = qcow2_pre_write_overlap_check(bs, 0, m->alloc_offset,
2187                                             m->nb_clusters * s->cluster_size,
2188                                             true);
2189         if (ret < 0) {
2190             return ret;
2191         }
2192 
2193         BLKDBG_EVENT(bs->file, BLKDBG_CLUSTER_ALLOC_SPACE);
2194         ret = bdrv_co_pwrite_zeroes(s->data_file, m->alloc_offset,
2195                                     m->nb_clusters * s->cluster_size,
2196                                     BDRV_REQ_NO_FALLBACK);
2197         if (ret < 0) {
2198             if (ret != -ENOTSUP && ret != -EAGAIN) {
2199                 return ret;
2200             }
2201             continue;
2202         }
2203 
2204         trace_qcow2_skip_cow(qemu_coroutine_self(), m->offset, m->nb_clusters);
2205         m->skip_cow = true;
2206     }
2207     return 0;
2208 }
2209 
2210 static coroutine_fn int qcow2_co_pwritev(BlockDriverState *bs, uint64_t offset,
2211                                          uint64_t bytes, QEMUIOVector *qiov,
2212                                          int flags)
2213 {
2214     BDRVQcow2State *s = bs->opaque;
2215     int offset_in_cluster;
2216     int ret;
2217     unsigned int cur_bytes; /* number of sectors in current iteration */
2218     uint64_t cluster_offset;
2219     QEMUIOVector hd_qiov;
2220     uint64_t bytes_done = 0;
2221     uint8_t *cluster_data = NULL;
2222     QCowL2Meta *l2meta = NULL;
2223 
2224     trace_qcow2_writev_start_req(qemu_coroutine_self(), offset, bytes);
2225 
2226     qemu_iovec_init(&hd_qiov, qiov->niov);
2227 
2228     qemu_co_mutex_lock(&s->lock);
2229 
2230     while (bytes != 0) {
2231 
2232         l2meta = NULL;
2233 
2234         trace_qcow2_writev_start_part(qemu_coroutine_self());
2235         offset_in_cluster = offset_into_cluster(s, offset);
2236         cur_bytes = MIN(bytes, INT_MAX);
2237         if (bs->encrypted) {
2238             cur_bytes = MIN(cur_bytes,
2239                             QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size
2240                             - offset_in_cluster);
2241         }
2242 
2243         ret = qcow2_alloc_cluster_offset(bs, offset, &cur_bytes,
2244                                          &cluster_offset, &l2meta);
2245         if (ret < 0) {
2246             goto out_locked;
2247         }
2248 
2249         assert((cluster_offset & 511) == 0);
2250 
2251         ret = qcow2_pre_write_overlap_check(bs, 0,
2252                                             cluster_offset + offset_in_cluster,
2253                                             cur_bytes, true);
2254         if (ret < 0) {
2255             goto out_locked;
2256         }
2257 
2258         qemu_co_mutex_unlock(&s->lock);
2259 
2260         qemu_iovec_reset(&hd_qiov);
2261         qemu_iovec_concat(&hd_qiov, qiov, bytes_done, cur_bytes);
2262 
2263         if (bs->encrypted) {
2264             assert(s->crypto);
2265             if (!cluster_data) {
2266                 cluster_data = qemu_try_blockalign(bs->file->bs,
2267                                                    QCOW_MAX_CRYPT_CLUSTERS
2268                                                    * s->cluster_size);
2269                 if (cluster_data == NULL) {
2270                     ret = -ENOMEM;
2271                     goto out_unlocked;
2272                 }
2273             }
2274 
2275             assert(hd_qiov.size <=
2276                    QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size);
2277             qemu_iovec_to_buf(&hd_qiov, 0, cluster_data, hd_qiov.size);
2278 
2279             if (qcow2_co_encrypt(bs, cluster_offset, offset,
2280                                  cluster_data, cur_bytes) < 0) {
2281                 ret = -EIO;
2282                 goto out_unlocked;
2283             }
2284 
2285             qemu_iovec_reset(&hd_qiov);
2286             qemu_iovec_add(&hd_qiov, cluster_data, cur_bytes);
2287         }
2288 
2289         /* Try to efficiently initialize the physical space with zeroes */
2290         ret = handle_alloc_space(bs, l2meta);
2291         if (ret < 0) {
2292             goto out_unlocked;
2293         }
2294 
2295         /* If we need to do COW, check if it's possible to merge the
2296          * writing of the guest data together with that of the COW regions.
2297          * If it's not possible (or not necessary) then write the
2298          * guest data now. */
2299         if (!merge_cow(offset, cur_bytes, &hd_qiov, l2meta)) {
2300             BLKDBG_EVENT(bs->file, BLKDBG_WRITE_AIO);
2301             trace_qcow2_writev_data(qemu_coroutine_self(),
2302                                     cluster_offset + offset_in_cluster);
2303             ret = bdrv_co_pwritev(s->data_file,
2304                                   cluster_offset + offset_in_cluster,
2305                                   cur_bytes, &hd_qiov, 0);
2306             if (ret < 0) {
2307                 goto out_unlocked;
2308             }
2309         }
2310 
2311         qemu_co_mutex_lock(&s->lock);
2312 
2313         ret = qcow2_handle_l2meta(bs, &l2meta, true);
2314         if (ret) {
2315             goto out_locked;
2316         }
2317 
2318         bytes -= cur_bytes;
2319         offset += cur_bytes;
2320         bytes_done += cur_bytes;
2321         trace_qcow2_writev_done_part(qemu_coroutine_self(), cur_bytes);
2322     }
2323     ret = 0;
2324     goto out_locked;
2325 
2326 out_unlocked:
2327     qemu_co_mutex_lock(&s->lock);
2328 
2329 out_locked:
2330     qcow2_handle_l2meta(bs, &l2meta, false);
2331 
2332     qemu_co_mutex_unlock(&s->lock);
2333 
2334     qemu_iovec_destroy(&hd_qiov);
2335     qemu_vfree(cluster_data);
2336     trace_qcow2_writev_done_req(qemu_coroutine_self(), ret);
2337 
2338     return ret;
2339 }
2340 
2341 static int qcow2_inactivate(BlockDriverState *bs)
2342 {
2343     BDRVQcow2State *s = bs->opaque;
2344     int ret, result = 0;
2345     Error *local_err = NULL;
2346 
2347     qcow2_store_persistent_dirty_bitmaps(bs, &local_err);
2348     if (local_err != NULL) {
2349         result = -EINVAL;
2350         error_reportf_err(local_err, "Lost persistent bitmaps during "
2351                           "inactivation of node '%s': ",
2352                           bdrv_get_device_or_node_name(bs));
2353     }
2354 
2355     ret = qcow2_cache_flush(bs, s->l2_table_cache);
2356     if (ret) {
2357         result = ret;
2358         error_report("Failed to flush the L2 table cache: %s",
2359                      strerror(-ret));
2360     }
2361 
2362     ret = qcow2_cache_flush(bs, s->refcount_block_cache);
2363     if (ret) {
2364         result = ret;
2365         error_report("Failed to flush the refcount block cache: %s",
2366                      strerror(-ret));
2367     }
2368 
2369     if (result == 0) {
2370         qcow2_mark_clean(bs);
2371     }
2372 
2373     return result;
2374 }
2375 
2376 static void qcow2_close(BlockDriverState *bs)
2377 {
2378     BDRVQcow2State *s = bs->opaque;
2379     qemu_vfree(s->l1_table);
2380     /* else pre-write overlap checks in cache_destroy may crash */
2381     s->l1_table = NULL;
2382 
2383     if (!(s->flags & BDRV_O_INACTIVE)) {
2384         qcow2_inactivate(bs);
2385     }
2386 
2387     cache_clean_timer_del(bs);
2388     qcow2_cache_destroy(s->l2_table_cache);
2389     qcow2_cache_destroy(s->refcount_block_cache);
2390 
2391     qcrypto_block_free(s->crypto);
2392     s->crypto = NULL;
2393 
2394     g_free(s->unknown_header_fields);
2395     cleanup_unknown_header_ext(bs);
2396 
2397     g_free(s->image_data_file);
2398     g_free(s->image_backing_file);
2399     g_free(s->image_backing_format);
2400 
2401     if (has_data_file(bs)) {
2402         bdrv_unref_child(bs, s->data_file);
2403     }
2404 
2405     qcow2_refcount_close(bs);
2406     qcow2_free_snapshots(bs);
2407 }
2408 
2409 static void coroutine_fn qcow2_co_invalidate_cache(BlockDriverState *bs,
2410                                                    Error **errp)
2411 {
2412     BDRVQcow2State *s = bs->opaque;
2413     int flags = s->flags;
2414     QCryptoBlock *crypto = NULL;
2415     QDict *options;
2416     Error *local_err = NULL;
2417     int ret;
2418 
2419     /*
2420      * Backing files are read-only which makes all of their metadata immutable,
2421      * that means we don't have to worry about reopening them here.
2422      */
2423 
2424     crypto = s->crypto;
2425     s->crypto = NULL;
2426 
2427     qcow2_close(bs);
2428 
2429     memset(s, 0, sizeof(BDRVQcow2State));
2430     options = qdict_clone_shallow(bs->options);
2431 
2432     flags &= ~BDRV_O_INACTIVE;
2433     qemu_co_mutex_lock(&s->lock);
2434     ret = qcow2_do_open(bs, options, flags, &local_err);
2435     qemu_co_mutex_unlock(&s->lock);
2436     qobject_unref(options);
2437     if (local_err) {
2438         error_propagate_prepend(errp, local_err,
2439                                 "Could not reopen qcow2 layer: ");
2440         bs->drv = NULL;
2441         return;
2442     } else if (ret < 0) {
2443         error_setg_errno(errp, -ret, "Could not reopen qcow2 layer");
2444         bs->drv = NULL;
2445         return;
2446     }
2447 
2448     s->crypto = crypto;
2449 }
2450 
2451 static size_t header_ext_add(char *buf, uint32_t magic, const void *s,
2452     size_t len, size_t buflen)
2453 {
2454     QCowExtension *ext_backing_fmt = (QCowExtension*) buf;
2455     size_t ext_len = sizeof(QCowExtension) + ((len + 7) & ~7);
2456 
2457     if (buflen < ext_len) {
2458         return -ENOSPC;
2459     }
2460 
2461     *ext_backing_fmt = (QCowExtension) {
2462         .magic  = cpu_to_be32(magic),
2463         .len    = cpu_to_be32(len),
2464     };
2465 
2466     if (len) {
2467         memcpy(buf + sizeof(QCowExtension), s, len);
2468     }
2469 
2470     return ext_len;
2471 }
2472 
2473 /*
2474  * Updates the qcow2 header, including the variable length parts of it, i.e.
2475  * the backing file name and all extensions. qcow2 was not designed to allow
2476  * such changes, so if we run out of space (we can only use the first cluster)
2477  * this function may fail.
2478  *
2479  * Returns 0 on success, -errno in error cases.
2480  */
2481 int qcow2_update_header(BlockDriverState *bs)
2482 {
2483     BDRVQcow2State *s = bs->opaque;
2484     QCowHeader *header;
2485     char *buf;
2486     size_t buflen = s->cluster_size;
2487     int ret;
2488     uint64_t total_size;
2489     uint32_t refcount_table_clusters;
2490     size_t header_length;
2491     Qcow2UnknownHeaderExtension *uext;
2492 
2493     buf = qemu_blockalign(bs, buflen);
2494 
2495     /* Header structure */
2496     header = (QCowHeader*) buf;
2497 
2498     if (buflen < sizeof(*header)) {
2499         ret = -ENOSPC;
2500         goto fail;
2501     }
2502 
2503     header_length = sizeof(*header) + s->unknown_header_fields_size;
2504     total_size = bs->total_sectors * BDRV_SECTOR_SIZE;
2505     refcount_table_clusters = s->refcount_table_size >> (s->cluster_bits - 3);
2506 
2507     *header = (QCowHeader) {
2508         /* Version 2 fields */
2509         .magic                  = cpu_to_be32(QCOW_MAGIC),
2510         .version                = cpu_to_be32(s->qcow_version),
2511         .backing_file_offset    = 0,
2512         .backing_file_size      = 0,
2513         .cluster_bits           = cpu_to_be32(s->cluster_bits),
2514         .size                   = cpu_to_be64(total_size),
2515         .crypt_method           = cpu_to_be32(s->crypt_method_header),
2516         .l1_size                = cpu_to_be32(s->l1_size),
2517         .l1_table_offset        = cpu_to_be64(s->l1_table_offset),
2518         .refcount_table_offset  = cpu_to_be64(s->refcount_table_offset),
2519         .refcount_table_clusters = cpu_to_be32(refcount_table_clusters),
2520         .nb_snapshots           = cpu_to_be32(s->nb_snapshots),
2521         .snapshots_offset       = cpu_to_be64(s->snapshots_offset),
2522 
2523         /* Version 3 fields */
2524         .incompatible_features  = cpu_to_be64(s->incompatible_features),
2525         .compatible_features    = cpu_to_be64(s->compatible_features),
2526         .autoclear_features     = cpu_to_be64(s->autoclear_features),
2527         .refcount_order         = cpu_to_be32(s->refcount_order),
2528         .header_length          = cpu_to_be32(header_length),
2529     };
2530 
2531     /* For older versions, write a shorter header */
2532     switch (s->qcow_version) {
2533     case 2:
2534         ret = offsetof(QCowHeader, incompatible_features);
2535         break;
2536     case 3:
2537         ret = sizeof(*header);
2538         break;
2539     default:
2540         ret = -EINVAL;
2541         goto fail;
2542     }
2543 
2544     buf += ret;
2545     buflen -= ret;
2546     memset(buf, 0, buflen);
2547 
2548     /* Preserve any unknown field in the header */
2549     if (s->unknown_header_fields_size) {
2550         if (buflen < s->unknown_header_fields_size) {
2551             ret = -ENOSPC;
2552             goto fail;
2553         }
2554 
2555         memcpy(buf, s->unknown_header_fields, s->unknown_header_fields_size);
2556         buf += s->unknown_header_fields_size;
2557         buflen -= s->unknown_header_fields_size;
2558     }
2559 
2560     /* Backing file format header extension */
2561     if (s->image_backing_format) {
2562         ret = header_ext_add(buf, QCOW2_EXT_MAGIC_BACKING_FORMAT,
2563                              s->image_backing_format,
2564                              strlen(s->image_backing_format),
2565                              buflen);
2566         if (ret < 0) {
2567             goto fail;
2568         }
2569 
2570         buf += ret;
2571         buflen -= ret;
2572     }
2573 
2574     /* External data file header extension */
2575     if (has_data_file(bs) && s->image_data_file) {
2576         ret = header_ext_add(buf, QCOW2_EXT_MAGIC_DATA_FILE,
2577                              s->image_data_file, strlen(s->image_data_file),
2578                              buflen);
2579         if (ret < 0) {
2580             goto fail;
2581         }
2582 
2583         buf += ret;
2584         buflen -= ret;
2585     }
2586 
2587     /* Full disk encryption header pointer extension */
2588     if (s->crypto_header.offset != 0) {
2589         s->crypto_header.offset = cpu_to_be64(s->crypto_header.offset);
2590         s->crypto_header.length = cpu_to_be64(s->crypto_header.length);
2591         ret = header_ext_add(buf, QCOW2_EXT_MAGIC_CRYPTO_HEADER,
2592                              &s->crypto_header, sizeof(s->crypto_header),
2593                              buflen);
2594         s->crypto_header.offset = be64_to_cpu(s->crypto_header.offset);
2595         s->crypto_header.length = be64_to_cpu(s->crypto_header.length);
2596         if (ret < 0) {
2597             goto fail;
2598         }
2599         buf += ret;
2600         buflen -= ret;
2601     }
2602 
2603     /* Feature table */
2604     if (s->qcow_version >= 3) {
2605         Qcow2Feature features[] = {
2606             {
2607                 .type = QCOW2_FEAT_TYPE_INCOMPATIBLE,
2608                 .bit  = QCOW2_INCOMPAT_DIRTY_BITNR,
2609                 .name = "dirty bit",
2610             },
2611             {
2612                 .type = QCOW2_FEAT_TYPE_INCOMPATIBLE,
2613                 .bit  = QCOW2_INCOMPAT_CORRUPT_BITNR,
2614                 .name = "corrupt bit",
2615             },
2616             {
2617                 .type = QCOW2_FEAT_TYPE_INCOMPATIBLE,
2618                 .bit  = QCOW2_INCOMPAT_DATA_FILE_BITNR,
2619                 .name = "external data file",
2620             },
2621             {
2622                 .type = QCOW2_FEAT_TYPE_COMPATIBLE,
2623                 .bit  = QCOW2_COMPAT_LAZY_REFCOUNTS_BITNR,
2624                 .name = "lazy refcounts",
2625             },
2626         };
2627 
2628         ret = header_ext_add(buf, QCOW2_EXT_MAGIC_FEATURE_TABLE,
2629                              features, sizeof(features), buflen);
2630         if (ret < 0) {
2631             goto fail;
2632         }
2633         buf += ret;
2634         buflen -= ret;
2635     }
2636 
2637     /* Bitmap extension */
2638     if (s->nb_bitmaps > 0) {
2639         Qcow2BitmapHeaderExt bitmaps_header = {
2640             .nb_bitmaps = cpu_to_be32(s->nb_bitmaps),
2641             .bitmap_directory_size =
2642                     cpu_to_be64(s->bitmap_directory_size),
2643             .bitmap_directory_offset =
2644                     cpu_to_be64(s->bitmap_directory_offset)
2645         };
2646         ret = header_ext_add(buf, QCOW2_EXT_MAGIC_BITMAPS,
2647                              &bitmaps_header, sizeof(bitmaps_header),
2648                              buflen);
2649         if (ret < 0) {
2650             goto fail;
2651         }
2652         buf += ret;
2653         buflen -= ret;
2654     }
2655 
2656     /* Keep unknown header extensions */
2657     QLIST_FOREACH(uext, &s->unknown_header_ext, next) {
2658         ret = header_ext_add(buf, uext->magic, uext->data, uext->len, buflen);
2659         if (ret < 0) {
2660             goto fail;
2661         }
2662 
2663         buf += ret;
2664         buflen -= ret;
2665     }
2666 
2667     /* End of header extensions */
2668     ret = header_ext_add(buf, QCOW2_EXT_MAGIC_END, NULL, 0, buflen);
2669     if (ret < 0) {
2670         goto fail;
2671     }
2672 
2673     buf += ret;
2674     buflen -= ret;
2675 
2676     /* Backing file name */
2677     if (s->image_backing_file) {
2678         size_t backing_file_len = strlen(s->image_backing_file);
2679 
2680         if (buflen < backing_file_len) {
2681             ret = -ENOSPC;
2682             goto fail;
2683         }
2684 
2685         /* Using strncpy is ok here, since buf is not NUL-terminated. */
2686         strncpy(buf, s->image_backing_file, buflen);
2687 
2688         header->backing_file_offset = cpu_to_be64(buf - ((char*) header));
2689         header->backing_file_size   = cpu_to_be32(backing_file_len);
2690     }
2691 
2692     /* Write the new header */
2693     ret = bdrv_pwrite(bs->file, 0, header, s->cluster_size);
2694     if (ret < 0) {
2695         goto fail;
2696     }
2697 
2698     ret = 0;
2699 fail:
2700     qemu_vfree(header);
2701     return ret;
2702 }
2703 
2704 static int qcow2_change_backing_file(BlockDriverState *bs,
2705     const char *backing_file, const char *backing_fmt)
2706 {
2707     BDRVQcow2State *s = bs->opaque;
2708 
2709     /* Adding a backing file means that the external data file alone won't be
2710      * enough to make sense of the content */
2711     if (backing_file && data_file_is_raw(bs)) {
2712         return -EINVAL;
2713     }
2714 
2715     if (backing_file && strlen(backing_file) > 1023) {
2716         return -EINVAL;
2717     }
2718 
2719     pstrcpy(bs->auto_backing_file, sizeof(bs->auto_backing_file),
2720             backing_file ?: "");
2721     pstrcpy(bs->backing_file, sizeof(bs->backing_file), backing_file ?: "");
2722     pstrcpy(bs->backing_format, sizeof(bs->backing_format), backing_fmt ?: "");
2723 
2724     g_free(s->image_backing_file);
2725     g_free(s->image_backing_format);
2726 
2727     s->image_backing_file = backing_file ? g_strdup(bs->backing_file) : NULL;
2728     s->image_backing_format = backing_fmt ? g_strdup(bs->backing_format) : NULL;
2729 
2730     return qcow2_update_header(bs);
2731 }
2732 
2733 static int qcow2_crypt_method_from_format(const char *encryptfmt)
2734 {
2735     if (g_str_equal(encryptfmt, "luks")) {
2736         return QCOW_CRYPT_LUKS;
2737     } else if (g_str_equal(encryptfmt, "aes")) {
2738         return QCOW_CRYPT_AES;
2739     } else {
2740         return -EINVAL;
2741     }
2742 }
2743 
2744 static int qcow2_set_up_encryption(BlockDriverState *bs,
2745                                    QCryptoBlockCreateOptions *cryptoopts,
2746                                    Error **errp)
2747 {
2748     BDRVQcow2State *s = bs->opaque;
2749     QCryptoBlock *crypto = NULL;
2750     int fmt, ret;
2751 
2752     switch (cryptoopts->format) {
2753     case Q_CRYPTO_BLOCK_FORMAT_LUKS:
2754         fmt = QCOW_CRYPT_LUKS;
2755         break;
2756     case Q_CRYPTO_BLOCK_FORMAT_QCOW:
2757         fmt = QCOW_CRYPT_AES;
2758         break;
2759     default:
2760         error_setg(errp, "Crypto format not supported in qcow2");
2761         return -EINVAL;
2762     }
2763 
2764     s->crypt_method_header = fmt;
2765 
2766     crypto = qcrypto_block_create(cryptoopts, "encrypt.",
2767                                   qcow2_crypto_hdr_init_func,
2768                                   qcow2_crypto_hdr_write_func,
2769                                   bs, errp);
2770     if (!crypto) {
2771         return -EINVAL;
2772     }
2773 
2774     ret = qcow2_update_header(bs);
2775     if (ret < 0) {
2776         error_setg_errno(errp, -ret, "Could not write encryption header");
2777         goto out;
2778     }
2779 
2780     ret = 0;
2781  out:
2782     qcrypto_block_free(crypto);
2783     return ret;
2784 }
2785 
2786 /**
2787  * Preallocates metadata structures for data clusters between @offset (in the
2788  * guest disk) and @new_length (which is thus generally the new guest disk
2789  * size).
2790  *
2791  * Returns: 0 on success, -errno on failure.
2792  */
2793 static int coroutine_fn preallocate_co(BlockDriverState *bs, uint64_t offset,
2794                                        uint64_t new_length, PreallocMode mode,
2795                                        Error **errp)
2796 {
2797     BDRVQcow2State *s = bs->opaque;
2798     uint64_t bytes;
2799     uint64_t host_offset = 0;
2800     int64_t file_length;
2801     unsigned int cur_bytes;
2802     int ret;
2803     QCowL2Meta *meta;
2804 
2805     assert(offset <= new_length);
2806     bytes = new_length - offset;
2807 
2808     while (bytes) {
2809         cur_bytes = MIN(bytes, QEMU_ALIGN_DOWN(INT_MAX, s->cluster_size));
2810         ret = qcow2_alloc_cluster_offset(bs, offset, &cur_bytes,
2811                                          &host_offset, &meta);
2812         if (ret < 0) {
2813             error_setg_errno(errp, -ret, "Allocating clusters failed");
2814             return ret;
2815         }
2816 
2817         while (meta) {
2818             QCowL2Meta *next = meta->next;
2819 
2820             ret = qcow2_alloc_cluster_link_l2(bs, meta);
2821             if (ret < 0) {
2822                 error_setg_errno(errp, -ret, "Mapping clusters failed");
2823                 qcow2_free_any_clusters(bs, meta->alloc_offset,
2824                                         meta->nb_clusters, QCOW2_DISCARD_NEVER);
2825                 return ret;
2826             }
2827 
2828             /* There are no dependent requests, but we need to remove our
2829              * request from the list of in-flight requests */
2830             QLIST_REMOVE(meta, next_in_flight);
2831 
2832             g_free(meta);
2833             meta = next;
2834         }
2835 
2836         /* TODO Preallocate data if requested */
2837 
2838         bytes -= cur_bytes;
2839         offset += cur_bytes;
2840     }
2841 
2842     /*
2843      * It is expected that the image file is large enough to actually contain
2844      * all of the allocated clusters (otherwise we get failing reads after
2845      * EOF). Extend the image to the last allocated sector.
2846      */
2847     file_length = bdrv_getlength(s->data_file->bs);
2848     if (file_length < 0) {
2849         error_setg_errno(errp, -file_length, "Could not get file size");
2850         return file_length;
2851     }
2852 
2853     if (host_offset + cur_bytes > file_length) {
2854         if (mode == PREALLOC_MODE_METADATA) {
2855             mode = PREALLOC_MODE_OFF;
2856         }
2857         ret = bdrv_co_truncate(s->data_file, host_offset + cur_bytes, mode,
2858                                errp);
2859         if (ret < 0) {
2860             return ret;
2861         }
2862     }
2863 
2864     return 0;
2865 }
2866 
2867 /* qcow2_refcount_metadata_size:
2868  * @clusters: number of clusters to refcount (including data and L1/L2 tables)
2869  * @cluster_size: size of a cluster, in bytes
2870  * @refcount_order: refcount bits power-of-2 exponent
2871  * @generous_increase: allow for the refcount table to be 1.5x as large as it
2872  *                     needs to be
2873  *
2874  * Returns: Number of bytes required for refcount blocks and table metadata.
2875  */
2876 int64_t qcow2_refcount_metadata_size(int64_t clusters, size_t cluster_size,
2877                                      int refcount_order, bool generous_increase,
2878                                      uint64_t *refblock_count)
2879 {
2880     /*
2881      * Every host cluster is reference-counted, including metadata (even
2882      * refcount metadata is recursively included).
2883      *
2884      * An accurate formula for the size of refcount metadata size is difficult
2885      * to derive.  An easier method of calculation is finding the fixed point
2886      * where no further refcount blocks or table clusters are required to
2887      * reference count every cluster.
2888      */
2889     int64_t blocks_per_table_cluster = cluster_size / sizeof(uint64_t);
2890     int64_t refcounts_per_block = cluster_size * 8 / (1 << refcount_order);
2891     int64_t table = 0;  /* number of refcount table clusters */
2892     int64_t blocks = 0; /* number of refcount block clusters */
2893     int64_t last;
2894     int64_t n = 0;
2895 
2896     do {
2897         last = n;
2898         blocks = DIV_ROUND_UP(clusters + table + blocks, refcounts_per_block);
2899         table = DIV_ROUND_UP(blocks, blocks_per_table_cluster);
2900         n = clusters + blocks + table;
2901 
2902         if (n == last && generous_increase) {
2903             clusters += DIV_ROUND_UP(table, 2);
2904             n = 0; /* force another loop */
2905             generous_increase = false;
2906         }
2907     } while (n != last);
2908 
2909     if (refblock_count) {
2910         *refblock_count = blocks;
2911     }
2912 
2913     return (blocks + table) * cluster_size;
2914 }
2915 
2916 /**
2917  * qcow2_calc_prealloc_size:
2918  * @total_size: virtual disk size in bytes
2919  * @cluster_size: cluster size in bytes
2920  * @refcount_order: refcount bits power-of-2 exponent
2921  *
2922  * Returns: Total number of bytes required for the fully allocated image
2923  * (including metadata).
2924  */
2925 static int64_t qcow2_calc_prealloc_size(int64_t total_size,
2926                                         size_t cluster_size,
2927                                         int refcount_order)
2928 {
2929     int64_t meta_size = 0;
2930     uint64_t nl1e, nl2e;
2931     int64_t aligned_total_size = ROUND_UP(total_size, cluster_size);
2932 
2933     /* header: 1 cluster */
2934     meta_size += cluster_size;
2935 
2936     /* total size of L2 tables */
2937     nl2e = aligned_total_size / cluster_size;
2938     nl2e = ROUND_UP(nl2e, cluster_size / sizeof(uint64_t));
2939     meta_size += nl2e * sizeof(uint64_t);
2940 
2941     /* total size of L1 tables */
2942     nl1e = nl2e * sizeof(uint64_t) / cluster_size;
2943     nl1e = ROUND_UP(nl1e, cluster_size / sizeof(uint64_t));
2944     meta_size += nl1e * sizeof(uint64_t);
2945 
2946     /* total size of refcount table and blocks */
2947     meta_size += qcow2_refcount_metadata_size(
2948             (meta_size + aligned_total_size) / cluster_size,
2949             cluster_size, refcount_order, false, NULL);
2950 
2951     return meta_size + aligned_total_size;
2952 }
2953 
2954 static bool validate_cluster_size(size_t cluster_size, Error **errp)
2955 {
2956     int cluster_bits = ctz32(cluster_size);
2957     if (cluster_bits < MIN_CLUSTER_BITS || cluster_bits > MAX_CLUSTER_BITS ||
2958         (1 << cluster_bits) != cluster_size)
2959     {
2960         error_setg(errp, "Cluster size must be a power of two between %d and "
2961                    "%dk", 1 << MIN_CLUSTER_BITS, 1 << (MAX_CLUSTER_BITS - 10));
2962         return false;
2963     }
2964     return true;
2965 }
2966 
2967 static size_t qcow2_opt_get_cluster_size_del(QemuOpts *opts, Error **errp)
2968 {
2969     size_t cluster_size;
2970 
2971     cluster_size = qemu_opt_get_size_del(opts, BLOCK_OPT_CLUSTER_SIZE,
2972                                          DEFAULT_CLUSTER_SIZE);
2973     if (!validate_cluster_size(cluster_size, errp)) {
2974         return 0;
2975     }
2976     return cluster_size;
2977 }
2978 
2979 static int qcow2_opt_get_version_del(QemuOpts *opts, Error **errp)
2980 {
2981     char *buf;
2982     int ret;
2983 
2984     buf = qemu_opt_get_del(opts, BLOCK_OPT_COMPAT_LEVEL);
2985     if (!buf) {
2986         ret = 3; /* default */
2987     } else if (!strcmp(buf, "0.10")) {
2988         ret = 2;
2989     } else if (!strcmp(buf, "1.1")) {
2990         ret = 3;
2991     } else {
2992         error_setg(errp, "Invalid compatibility level: '%s'", buf);
2993         ret = -EINVAL;
2994     }
2995     g_free(buf);
2996     return ret;
2997 }
2998 
2999 static uint64_t qcow2_opt_get_refcount_bits_del(QemuOpts *opts, int version,
3000                                                 Error **errp)
3001 {
3002     uint64_t refcount_bits;
3003 
3004     refcount_bits = qemu_opt_get_number_del(opts, BLOCK_OPT_REFCOUNT_BITS, 16);
3005     if (refcount_bits > 64 || !is_power_of_2(refcount_bits)) {
3006         error_setg(errp, "Refcount width must be a power of two and may not "
3007                    "exceed 64 bits");
3008         return 0;
3009     }
3010 
3011     if (version < 3 && refcount_bits != 16) {
3012         error_setg(errp, "Different refcount widths than 16 bits require "
3013                    "compatibility level 1.1 or above (use compat=1.1 or "
3014                    "greater)");
3015         return 0;
3016     }
3017 
3018     return refcount_bits;
3019 }
3020 
3021 static int coroutine_fn
3022 qcow2_co_create(BlockdevCreateOptions *create_options, Error **errp)
3023 {
3024     BlockdevCreateOptionsQcow2 *qcow2_opts;
3025     QDict *options;
3026 
3027     /*
3028      * Open the image file and write a minimal qcow2 header.
3029      *
3030      * We keep things simple and start with a zero-sized image. We also
3031      * do without refcount blocks or a L1 table for now. We'll fix the
3032      * inconsistency later.
3033      *
3034      * We do need a refcount table because growing the refcount table means
3035      * allocating two new refcount blocks - the seconds of which would be at
3036      * 2 GB for 64k clusters, and we don't want to have a 2 GB initial file
3037      * size for any qcow2 image.
3038      */
3039     BlockBackend *blk = NULL;
3040     BlockDriverState *bs = NULL;
3041     BlockDriverState *data_bs = NULL;
3042     QCowHeader *header;
3043     size_t cluster_size;
3044     int version;
3045     int refcount_order;
3046     uint64_t* refcount_table;
3047     Error *local_err = NULL;
3048     int ret;
3049 
3050     assert(create_options->driver == BLOCKDEV_DRIVER_QCOW2);
3051     qcow2_opts = &create_options->u.qcow2;
3052 
3053     bs = bdrv_open_blockdev_ref(qcow2_opts->file, errp);
3054     if (bs == NULL) {
3055         return -EIO;
3056     }
3057 
3058     /* Validate options and set default values */
3059     if (!QEMU_IS_ALIGNED(qcow2_opts->size, BDRV_SECTOR_SIZE)) {
3060         error_setg(errp, "Image size must be a multiple of 512 bytes");
3061         ret = -EINVAL;
3062         goto out;
3063     }
3064 
3065     if (qcow2_opts->has_version) {
3066         switch (qcow2_opts->version) {
3067         case BLOCKDEV_QCOW2_VERSION_V2:
3068             version = 2;
3069             break;
3070         case BLOCKDEV_QCOW2_VERSION_V3:
3071             version = 3;
3072             break;
3073         default:
3074             g_assert_not_reached();
3075         }
3076     } else {
3077         version = 3;
3078     }
3079 
3080     if (qcow2_opts->has_cluster_size) {
3081         cluster_size = qcow2_opts->cluster_size;
3082     } else {
3083         cluster_size = DEFAULT_CLUSTER_SIZE;
3084     }
3085 
3086     if (!validate_cluster_size(cluster_size, errp)) {
3087         ret = -EINVAL;
3088         goto out;
3089     }
3090 
3091     if (!qcow2_opts->has_preallocation) {
3092         qcow2_opts->preallocation = PREALLOC_MODE_OFF;
3093     }
3094     if (qcow2_opts->has_backing_file &&
3095         qcow2_opts->preallocation != PREALLOC_MODE_OFF)
3096     {
3097         error_setg(errp, "Backing file and preallocation cannot be used at "
3098                    "the same time");
3099         ret = -EINVAL;
3100         goto out;
3101     }
3102     if (qcow2_opts->has_backing_fmt && !qcow2_opts->has_backing_file) {
3103         error_setg(errp, "Backing format cannot be used without backing file");
3104         ret = -EINVAL;
3105         goto out;
3106     }
3107 
3108     if (!qcow2_opts->has_lazy_refcounts) {
3109         qcow2_opts->lazy_refcounts = false;
3110     }
3111     if (version < 3 && qcow2_opts->lazy_refcounts) {
3112         error_setg(errp, "Lazy refcounts only supported with compatibility "
3113                    "level 1.1 and above (use version=v3 or greater)");
3114         ret = -EINVAL;
3115         goto out;
3116     }
3117 
3118     if (!qcow2_opts->has_refcount_bits) {
3119         qcow2_opts->refcount_bits = 16;
3120     }
3121     if (qcow2_opts->refcount_bits > 64 ||
3122         !is_power_of_2(qcow2_opts->refcount_bits))
3123     {
3124         error_setg(errp, "Refcount width must be a power of two and may not "
3125                    "exceed 64 bits");
3126         ret = -EINVAL;
3127         goto out;
3128     }
3129     if (version < 3 && qcow2_opts->refcount_bits != 16) {
3130         error_setg(errp, "Different refcount widths than 16 bits require "
3131                    "compatibility level 1.1 or above (use version=v3 or "
3132                    "greater)");
3133         ret = -EINVAL;
3134         goto out;
3135     }
3136     refcount_order = ctz32(qcow2_opts->refcount_bits);
3137 
3138     if (qcow2_opts->data_file_raw && !qcow2_opts->data_file) {
3139         error_setg(errp, "data-file-raw requires data-file");
3140         ret = -EINVAL;
3141         goto out;
3142     }
3143     if (qcow2_opts->data_file_raw && qcow2_opts->has_backing_file) {
3144         error_setg(errp, "Backing file and data-file-raw cannot be used at "
3145                    "the same time");
3146         ret = -EINVAL;
3147         goto out;
3148     }
3149 
3150     if (qcow2_opts->data_file) {
3151         if (version < 3) {
3152             error_setg(errp, "External data files are only supported with "
3153                        "compatibility level 1.1 and above (use version=v3 or "
3154                        "greater)");
3155             ret = -EINVAL;
3156             goto out;
3157         }
3158         data_bs = bdrv_open_blockdev_ref(qcow2_opts->data_file, errp);
3159         if (data_bs == NULL) {
3160             ret = -EIO;
3161             goto out;
3162         }
3163     }
3164 
3165     /* Create BlockBackend to write to the image */
3166     blk = blk_new(BLK_PERM_WRITE | BLK_PERM_RESIZE, BLK_PERM_ALL);
3167     ret = blk_insert_bs(blk, bs, errp);
3168     if (ret < 0) {
3169         goto out;
3170     }
3171     blk_set_allow_write_beyond_eof(blk, true);
3172 
3173     /* Clear the protocol layer and preallocate it if necessary */
3174     ret = blk_truncate(blk, 0, PREALLOC_MODE_OFF, errp);
3175     if (ret < 0) {
3176         goto out;
3177     }
3178 
3179     /* Write the header */
3180     QEMU_BUILD_BUG_ON((1 << MIN_CLUSTER_BITS) < sizeof(*header));
3181     header = g_malloc0(cluster_size);
3182     *header = (QCowHeader) {
3183         .magic                      = cpu_to_be32(QCOW_MAGIC),
3184         .version                    = cpu_to_be32(version),
3185         .cluster_bits               = cpu_to_be32(ctz32(cluster_size)),
3186         .size                       = cpu_to_be64(0),
3187         .l1_table_offset            = cpu_to_be64(0),
3188         .l1_size                    = cpu_to_be32(0),
3189         .refcount_table_offset      = cpu_to_be64(cluster_size),
3190         .refcount_table_clusters    = cpu_to_be32(1),
3191         .refcount_order             = cpu_to_be32(refcount_order),
3192         .header_length              = cpu_to_be32(sizeof(*header)),
3193     };
3194 
3195     /* We'll update this to correct value later */
3196     header->crypt_method = cpu_to_be32(QCOW_CRYPT_NONE);
3197 
3198     if (qcow2_opts->lazy_refcounts) {
3199         header->compatible_features |=
3200             cpu_to_be64(QCOW2_COMPAT_LAZY_REFCOUNTS);
3201     }
3202     if (data_bs) {
3203         header->incompatible_features |=
3204             cpu_to_be64(QCOW2_INCOMPAT_DATA_FILE);
3205     }
3206     if (qcow2_opts->data_file_raw) {
3207         header->autoclear_features |=
3208             cpu_to_be64(QCOW2_AUTOCLEAR_DATA_FILE_RAW);
3209     }
3210 
3211     ret = blk_pwrite(blk, 0, header, cluster_size, 0);
3212     g_free(header);
3213     if (ret < 0) {
3214         error_setg_errno(errp, -ret, "Could not write qcow2 header");
3215         goto out;
3216     }
3217 
3218     /* Write a refcount table with one refcount block */
3219     refcount_table = g_malloc0(2 * cluster_size);
3220     refcount_table[0] = cpu_to_be64(2 * cluster_size);
3221     ret = blk_pwrite(blk, cluster_size, refcount_table, 2 * cluster_size, 0);
3222     g_free(refcount_table);
3223 
3224     if (ret < 0) {
3225         error_setg_errno(errp, -ret, "Could not write refcount table");
3226         goto out;
3227     }
3228 
3229     blk_unref(blk);
3230     blk = NULL;
3231 
3232     /*
3233      * And now open the image and make it consistent first (i.e. increase the
3234      * refcount of the cluster that is occupied by the header and the refcount
3235      * table)
3236      */
3237     options = qdict_new();
3238     qdict_put_str(options, "driver", "qcow2");
3239     qdict_put_str(options, "file", bs->node_name);
3240     if (data_bs) {
3241         qdict_put_str(options, "data-file", data_bs->node_name);
3242     }
3243     blk = blk_new_open(NULL, NULL, options,
3244                        BDRV_O_RDWR | BDRV_O_RESIZE | BDRV_O_NO_FLUSH,
3245                        &local_err);
3246     if (blk == NULL) {
3247         error_propagate(errp, local_err);
3248         ret = -EIO;
3249         goto out;
3250     }
3251 
3252     ret = qcow2_alloc_clusters(blk_bs(blk), 3 * cluster_size);
3253     if (ret < 0) {
3254         error_setg_errno(errp, -ret, "Could not allocate clusters for qcow2 "
3255                          "header and refcount table");
3256         goto out;
3257 
3258     } else if (ret != 0) {
3259         error_report("Huh, first cluster in empty image is already in use?");
3260         abort();
3261     }
3262 
3263     /* Set the external data file if necessary */
3264     if (data_bs) {
3265         BDRVQcow2State *s = blk_bs(blk)->opaque;
3266         s->image_data_file = g_strdup(data_bs->filename);
3267     }
3268 
3269     /* Create a full header (including things like feature table) */
3270     ret = qcow2_update_header(blk_bs(blk));
3271     if (ret < 0) {
3272         error_setg_errno(errp, -ret, "Could not update qcow2 header");
3273         goto out;
3274     }
3275 
3276     /* Okay, now that we have a valid image, let's give it the right size */
3277     ret = blk_truncate(blk, qcow2_opts->size, qcow2_opts->preallocation, errp);
3278     if (ret < 0) {
3279         error_prepend(errp, "Could not resize image: ");
3280         goto out;
3281     }
3282 
3283     /* Want a backing file? There you go.*/
3284     if (qcow2_opts->has_backing_file) {
3285         const char *backing_format = NULL;
3286 
3287         if (qcow2_opts->has_backing_fmt) {
3288             backing_format = BlockdevDriver_str(qcow2_opts->backing_fmt);
3289         }
3290 
3291         ret = bdrv_change_backing_file(blk_bs(blk), qcow2_opts->backing_file,
3292                                        backing_format);
3293         if (ret < 0) {
3294             error_setg_errno(errp, -ret, "Could not assign backing file '%s' "
3295                              "with format '%s'", qcow2_opts->backing_file,
3296                              backing_format);
3297             goto out;
3298         }
3299     }
3300 
3301     /* Want encryption? There you go. */
3302     if (qcow2_opts->has_encrypt) {
3303         ret = qcow2_set_up_encryption(blk_bs(blk), qcow2_opts->encrypt, errp);
3304         if (ret < 0) {
3305             goto out;
3306         }
3307     }
3308 
3309     blk_unref(blk);
3310     blk = NULL;
3311 
3312     /* Reopen the image without BDRV_O_NO_FLUSH to flush it before returning.
3313      * Using BDRV_O_NO_IO, since encryption is now setup we don't want to
3314      * have to setup decryption context. We're not doing any I/O on the top
3315      * level BlockDriverState, only lower layers, where BDRV_O_NO_IO does
3316      * not have effect.
3317      */
3318     options = qdict_new();
3319     qdict_put_str(options, "driver", "qcow2");
3320     qdict_put_str(options, "file", bs->node_name);
3321     if (data_bs) {
3322         qdict_put_str(options, "data-file", data_bs->node_name);
3323     }
3324     blk = blk_new_open(NULL, NULL, options,
3325                        BDRV_O_RDWR | BDRV_O_NO_BACKING | BDRV_O_NO_IO,
3326                        &local_err);
3327     if (blk == NULL) {
3328         error_propagate(errp, local_err);
3329         ret = -EIO;
3330         goto out;
3331     }
3332 
3333     ret = 0;
3334 out:
3335     blk_unref(blk);
3336     bdrv_unref(bs);
3337     bdrv_unref(data_bs);
3338     return ret;
3339 }
3340 
3341 static int coroutine_fn qcow2_co_create_opts(const char *filename, QemuOpts *opts,
3342                                              Error **errp)
3343 {
3344     BlockdevCreateOptions *create_options = NULL;
3345     QDict *qdict;
3346     Visitor *v;
3347     BlockDriverState *bs = NULL;
3348     BlockDriverState *data_bs = NULL;
3349     Error *local_err = NULL;
3350     const char *val;
3351     int ret;
3352 
3353     /* Only the keyval visitor supports the dotted syntax needed for
3354      * encryption, so go through a QDict before getting a QAPI type. Ignore
3355      * options meant for the protocol layer so that the visitor doesn't
3356      * complain. */
3357     qdict = qemu_opts_to_qdict_filtered(opts, NULL, bdrv_qcow2.create_opts,
3358                                         true);
3359 
3360     /* Handle encryption options */
3361     val = qdict_get_try_str(qdict, BLOCK_OPT_ENCRYPT);
3362     if (val && !strcmp(val, "on")) {
3363         qdict_put_str(qdict, BLOCK_OPT_ENCRYPT, "qcow");
3364     } else if (val && !strcmp(val, "off")) {
3365         qdict_del(qdict, BLOCK_OPT_ENCRYPT);
3366     }
3367 
3368     val = qdict_get_try_str(qdict, BLOCK_OPT_ENCRYPT_FORMAT);
3369     if (val && !strcmp(val, "aes")) {
3370         qdict_put_str(qdict, BLOCK_OPT_ENCRYPT_FORMAT, "qcow");
3371     }
3372 
3373     /* Convert compat=0.10/1.1 into compat=v2/v3, to be renamed into
3374      * version=v2/v3 below. */
3375     val = qdict_get_try_str(qdict, BLOCK_OPT_COMPAT_LEVEL);
3376     if (val && !strcmp(val, "0.10")) {
3377         qdict_put_str(qdict, BLOCK_OPT_COMPAT_LEVEL, "v2");
3378     } else if (val && !strcmp(val, "1.1")) {
3379         qdict_put_str(qdict, BLOCK_OPT_COMPAT_LEVEL, "v3");
3380     }
3381 
3382     /* Change legacy command line options into QMP ones */
3383     static const QDictRenames opt_renames[] = {
3384         { BLOCK_OPT_BACKING_FILE,       "backing-file" },
3385         { BLOCK_OPT_BACKING_FMT,        "backing-fmt" },
3386         { BLOCK_OPT_CLUSTER_SIZE,       "cluster-size" },
3387         { BLOCK_OPT_LAZY_REFCOUNTS,     "lazy-refcounts" },
3388         { BLOCK_OPT_REFCOUNT_BITS,      "refcount-bits" },
3389         { BLOCK_OPT_ENCRYPT,            BLOCK_OPT_ENCRYPT_FORMAT },
3390         { BLOCK_OPT_COMPAT_LEVEL,       "version" },
3391         { BLOCK_OPT_DATA_FILE_RAW,      "data-file-raw" },
3392         { NULL, NULL },
3393     };
3394 
3395     if (!qdict_rename_keys(qdict, opt_renames, errp)) {
3396         ret = -EINVAL;
3397         goto finish;
3398     }
3399 
3400     /* Create and open the file (protocol layer) */
3401     ret = bdrv_create_file(filename, opts, errp);
3402     if (ret < 0) {
3403         goto finish;
3404     }
3405 
3406     bs = bdrv_open(filename, NULL, NULL,
3407                    BDRV_O_RDWR | BDRV_O_RESIZE | BDRV_O_PROTOCOL, errp);
3408     if (bs == NULL) {
3409         ret = -EIO;
3410         goto finish;
3411     }
3412 
3413     /* Create and open an external data file (protocol layer) */
3414     val = qdict_get_try_str(qdict, BLOCK_OPT_DATA_FILE);
3415     if (val) {
3416         ret = bdrv_create_file(val, opts, errp);
3417         if (ret < 0) {
3418             goto finish;
3419         }
3420 
3421         data_bs = bdrv_open(val, NULL, NULL,
3422                             BDRV_O_RDWR | BDRV_O_RESIZE | BDRV_O_PROTOCOL,
3423                             errp);
3424         if (data_bs == NULL) {
3425             ret = -EIO;
3426             goto finish;
3427         }
3428 
3429         qdict_del(qdict, BLOCK_OPT_DATA_FILE);
3430         qdict_put_str(qdict, "data-file", data_bs->node_name);
3431     }
3432 
3433     /* Set 'driver' and 'node' options */
3434     qdict_put_str(qdict, "driver", "qcow2");
3435     qdict_put_str(qdict, "file", bs->node_name);
3436 
3437     /* Now get the QAPI type BlockdevCreateOptions */
3438     v = qobject_input_visitor_new_flat_confused(qdict, errp);
3439     if (!v) {
3440         ret = -EINVAL;
3441         goto finish;
3442     }
3443 
3444     visit_type_BlockdevCreateOptions(v, NULL, &create_options, &local_err);
3445     visit_free(v);
3446 
3447     if (local_err) {
3448         error_propagate(errp, local_err);
3449         ret = -EINVAL;
3450         goto finish;
3451     }
3452 
3453     /* Silently round up size */
3454     create_options->u.qcow2.size = ROUND_UP(create_options->u.qcow2.size,
3455                                             BDRV_SECTOR_SIZE);
3456 
3457     /* Create the qcow2 image (format layer) */
3458     ret = qcow2_co_create(create_options, errp);
3459     if (ret < 0) {
3460         goto finish;
3461     }
3462 
3463     ret = 0;
3464 finish:
3465     qobject_unref(qdict);
3466     bdrv_unref(bs);
3467     bdrv_unref(data_bs);
3468     qapi_free_BlockdevCreateOptions(create_options);
3469     return ret;
3470 }
3471 
3472 
3473 static bool is_zero(BlockDriverState *bs, int64_t offset, int64_t bytes)
3474 {
3475     int64_t nr;
3476     int res;
3477 
3478     /* Clamp to image length, before checking status of underlying sectors */
3479     if (offset + bytes > bs->total_sectors * BDRV_SECTOR_SIZE) {
3480         bytes = bs->total_sectors * BDRV_SECTOR_SIZE - offset;
3481     }
3482 
3483     if (!bytes) {
3484         return true;
3485     }
3486     res = bdrv_block_status_above(bs, NULL, offset, bytes, &nr, NULL, NULL);
3487     return res >= 0 && (res & BDRV_BLOCK_ZERO) && nr == bytes;
3488 }
3489 
3490 static coroutine_fn int qcow2_co_pwrite_zeroes(BlockDriverState *bs,
3491     int64_t offset, int bytes, BdrvRequestFlags flags)
3492 {
3493     int ret;
3494     BDRVQcow2State *s = bs->opaque;
3495 
3496     uint32_t head = offset % s->cluster_size;
3497     uint32_t tail = (offset + bytes) % s->cluster_size;
3498 
3499     trace_qcow2_pwrite_zeroes_start_req(qemu_coroutine_self(), offset, bytes);
3500     if (offset + bytes == bs->total_sectors * BDRV_SECTOR_SIZE) {
3501         tail = 0;
3502     }
3503 
3504     if (head || tail) {
3505         uint64_t off;
3506         unsigned int nr;
3507 
3508         assert(head + bytes <= s->cluster_size);
3509 
3510         /* check whether remainder of cluster already reads as zero */
3511         if (!(is_zero(bs, offset - head, head) &&
3512               is_zero(bs, offset + bytes,
3513                       tail ? s->cluster_size - tail : 0))) {
3514             return -ENOTSUP;
3515         }
3516 
3517         qemu_co_mutex_lock(&s->lock);
3518         /* We can have new write after previous check */
3519         offset = QEMU_ALIGN_DOWN(offset, s->cluster_size);
3520         bytes = s->cluster_size;
3521         nr = s->cluster_size;
3522         ret = qcow2_get_cluster_offset(bs, offset, &nr, &off);
3523         if (ret != QCOW2_CLUSTER_UNALLOCATED &&
3524             ret != QCOW2_CLUSTER_ZERO_PLAIN &&
3525             ret != QCOW2_CLUSTER_ZERO_ALLOC) {
3526             qemu_co_mutex_unlock(&s->lock);
3527             return -ENOTSUP;
3528         }
3529     } else {
3530         qemu_co_mutex_lock(&s->lock);
3531     }
3532 
3533     trace_qcow2_pwrite_zeroes(qemu_coroutine_self(), offset, bytes);
3534 
3535     /* Whatever is left can use real zero clusters */
3536     ret = qcow2_cluster_zeroize(bs, offset, bytes, flags);
3537     qemu_co_mutex_unlock(&s->lock);
3538 
3539     return ret;
3540 }
3541 
3542 static coroutine_fn int qcow2_co_pdiscard(BlockDriverState *bs,
3543                                           int64_t offset, int bytes)
3544 {
3545     int ret;
3546     BDRVQcow2State *s = bs->opaque;
3547 
3548     if (!QEMU_IS_ALIGNED(offset | bytes, s->cluster_size)) {
3549         assert(bytes < s->cluster_size);
3550         /* Ignore partial clusters, except for the special case of the
3551          * complete partial cluster at the end of an unaligned file */
3552         if (!QEMU_IS_ALIGNED(offset, s->cluster_size) ||
3553             offset + bytes != bs->total_sectors * BDRV_SECTOR_SIZE) {
3554             return -ENOTSUP;
3555         }
3556     }
3557 
3558     qemu_co_mutex_lock(&s->lock);
3559     ret = qcow2_cluster_discard(bs, offset, bytes, QCOW2_DISCARD_REQUEST,
3560                                 false);
3561     qemu_co_mutex_unlock(&s->lock);
3562     return ret;
3563 }
3564 
3565 static int coroutine_fn
3566 qcow2_co_copy_range_from(BlockDriverState *bs,
3567                          BdrvChild *src, uint64_t src_offset,
3568                          BdrvChild *dst, uint64_t dst_offset,
3569                          uint64_t bytes, BdrvRequestFlags read_flags,
3570                          BdrvRequestFlags write_flags)
3571 {
3572     BDRVQcow2State *s = bs->opaque;
3573     int ret;
3574     unsigned int cur_bytes; /* number of bytes in current iteration */
3575     BdrvChild *child = NULL;
3576     BdrvRequestFlags cur_write_flags;
3577 
3578     assert(!bs->encrypted);
3579     qemu_co_mutex_lock(&s->lock);
3580 
3581     while (bytes != 0) {
3582         uint64_t copy_offset = 0;
3583         /* prepare next request */
3584         cur_bytes = MIN(bytes, INT_MAX);
3585         cur_write_flags = write_flags;
3586 
3587         ret = qcow2_get_cluster_offset(bs, src_offset, &cur_bytes, &copy_offset);
3588         if (ret < 0) {
3589             goto out;
3590         }
3591 
3592         switch (ret) {
3593         case QCOW2_CLUSTER_UNALLOCATED:
3594             if (bs->backing && bs->backing->bs) {
3595                 int64_t backing_length = bdrv_getlength(bs->backing->bs);
3596                 if (src_offset >= backing_length) {
3597                     cur_write_flags |= BDRV_REQ_ZERO_WRITE;
3598                 } else {
3599                     child = bs->backing;
3600                     cur_bytes = MIN(cur_bytes, backing_length - src_offset);
3601                     copy_offset = src_offset;
3602                 }
3603             } else {
3604                 cur_write_flags |= BDRV_REQ_ZERO_WRITE;
3605             }
3606             break;
3607 
3608         case QCOW2_CLUSTER_ZERO_PLAIN:
3609         case QCOW2_CLUSTER_ZERO_ALLOC:
3610             cur_write_flags |= BDRV_REQ_ZERO_WRITE;
3611             break;
3612 
3613         case QCOW2_CLUSTER_COMPRESSED:
3614             ret = -ENOTSUP;
3615             goto out;
3616 
3617         case QCOW2_CLUSTER_NORMAL:
3618             child = s->data_file;
3619             copy_offset += offset_into_cluster(s, src_offset);
3620             if ((copy_offset & 511) != 0) {
3621                 ret = -EIO;
3622                 goto out;
3623             }
3624             break;
3625 
3626         default:
3627             abort();
3628         }
3629         qemu_co_mutex_unlock(&s->lock);
3630         ret = bdrv_co_copy_range_from(child,
3631                                       copy_offset,
3632                                       dst, dst_offset,
3633                                       cur_bytes, read_flags, cur_write_flags);
3634         qemu_co_mutex_lock(&s->lock);
3635         if (ret < 0) {
3636             goto out;
3637         }
3638 
3639         bytes -= cur_bytes;
3640         src_offset += cur_bytes;
3641         dst_offset += cur_bytes;
3642     }
3643     ret = 0;
3644 
3645 out:
3646     qemu_co_mutex_unlock(&s->lock);
3647     return ret;
3648 }
3649 
3650 static int coroutine_fn
3651 qcow2_co_copy_range_to(BlockDriverState *bs,
3652                        BdrvChild *src, uint64_t src_offset,
3653                        BdrvChild *dst, uint64_t dst_offset,
3654                        uint64_t bytes, BdrvRequestFlags read_flags,
3655                        BdrvRequestFlags write_flags)
3656 {
3657     BDRVQcow2State *s = bs->opaque;
3658     int offset_in_cluster;
3659     int ret;
3660     unsigned int cur_bytes; /* number of sectors in current iteration */
3661     uint64_t cluster_offset;
3662     QCowL2Meta *l2meta = NULL;
3663 
3664     assert(!bs->encrypted);
3665 
3666     qemu_co_mutex_lock(&s->lock);
3667 
3668     while (bytes != 0) {
3669 
3670         l2meta = NULL;
3671 
3672         offset_in_cluster = offset_into_cluster(s, dst_offset);
3673         cur_bytes = MIN(bytes, INT_MAX);
3674 
3675         /* TODO:
3676          * If src->bs == dst->bs, we could simply copy by incrementing
3677          * the refcnt, without copying user data.
3678          * Or if src->bs == dst->bs->backing->bs, we could copy by discarding. */
3679         ret = qcow2_alloc_cluster_offset(bs, dst_offset, &cur_bytes,
3680                                          &cluster_offset, &l2meta);
3681         if (ret < 0) {
3682             goto fail;
3683         }
3684 
3685         assert((cluster_offset & 511) == 0);
3686 
3687         ret = qcow2_pre_write_overlap_check(bs, 0,
3688                 cluster_offset + offset_in_cluster, cur_bytes, true);
3689         if (ret < 0) {
3690             goto fail;
3691         }
3692 
3693         qemu_co_mutex_unlock(&s->lock);
3694         ret = bdrv_co_copy_range_to(src, src_offset,
3695                                     s->data_file,
3696                                     cluster_offset + offset_in_cluster,
3697                                     cur_bytes, read_flags, write_flags);
3698         qemu_co_mutex_lock(&s->lock);
3699         if (ret < 0) {
3700             goto fail;
3701         }
3702 
3703         ret = qcow2_handle_l2meta(bs, &l2meta, true);
3704         if (ret) {
3705             goto fail;
3706         }
3707 
3708         bytes -= cur_bytes;
3709         src_offset += cur_bytes;
3710         dst_offset += cur_bytes;
3711     }
3712     ret = 0;
3713 
3714 fail:
3715     qcow2_handle_l2meta(bs, &l2meta, false);
3716 
3717     qemu_co_mutex_unlock(&s->lock);
3718 
3719     trace_qcow2_writev_done_req(qemu_coroutine_self(), ret);
3720 
3721     return ret;
3722 }
3723 
3724 static int coroutine_fn qcow2_co_truncate(BlockDriverState *bs, int64_t offset,
3725                                           PreallocMode prealloc, Error **errp)
3726 {
3727     BDRVQcow2State *s = bs->opaque;
3728     uint64_t old_length;
3729     int64_t new_l1_size;
3730     int ret;
3731     QDict *options;
3732 
3733     if (prealloc != PREALLOC_MODE_OFF && prealloc != PREALLOC_MODE_METADATA &&
3734         prealloc != PREALLOC_MODE_FALLOC && prealloc != PREALLOC_MODE_FULL)
3735     {
3736         error_setg(errp, "Unsupported preallocation mode '%s'",
3737                    PreallocMode_str(prealloc));
3738         return -ENOTSUP;
3739     }
3740 
3741     if (offset & 511) {
3742         error_setg(errp, "The new size must be a multiple of 512");
3743         return -EINVAL;
3744     }
3745 
3746     qemu_co_mutex_lock(&s->lock);
3747 
3748     /* cannot proceed if image has snapshots */
3749     if (s->nb_snapshots) {
3750         error_setg(errp, "Can't resize an image which has snapshots");
3751         ret = -ENOTSUP;
3752         goto fail;
3753     }
3754 
3755     /* cannot proceed if image has bitmaps */
3756     if (qcow2_truncate_bitmaps_check(bs, errp)) {
3757         ret = -ENOTSUP;
3758         goto fail;
3759     }
3760 
3761     old_length = bs->total_sectors * BDRV_SECTOR_SIZE;
3762     new_l1_size = size_to_l1(s, offset);
3763 
3764     if (offset < old_length) {
3765         int64_t last_cluster, old_file_size;
3766         if (prealloc != PREALLOC_MODE_OFF) {
3767             error_setg(errp,
3768                        "Preallocation can't be used for shrinking an image");
3769             ret = -EINVAL;
3770             goto fail;
3771         }
3772 
3773         ret = qcow2_cluster_discard(bs, ROUND_UP(offset, s->cluster_size),
3774                                     old_length - ROUND_UP(offset,
3775                                                           s->cluster_size),
3776                                     QCOW2_DISCARD_ALWAYS, true);
3777         if (ret < 0) {
3778             error_setg_errno(errp, -ret, "Failed to discard cropped clusters");
3779             goto fail;
3780         }
3781 
3782         ret = qcow2_shrink_l1_table(bs, new_l1_size);
3783         if (ret < 0) {
3784             error_setg_errno(errp, -ret,
3785                              "Failed to reduce the number of L2 tables");
3786             goto fail;
3787         }
3788 
3789         ret = qcow2_shrink_reftable(bs);
3790         if (ret < 0) {
3791             error_setg_errno(errp, -ret,
3792                              "Failed to discard unused refblocks");
3793             goto fail;
3794         }
3795 
3796         old_file_size = bdrv_getlength(bs->file->bs);
3797         if (old_file_size < 0) {
3798             error_setg_errno(errp, -old_file_size,
3799                              "Failed to inquire current file length");
3800             ret = old_file_size;
3801             goto fail;
3802         }
3803         last_cluster = qcow2_get_last_cluster(bs, old_file_size);
3804         if (last_cluster < 0) {
3805             error_setg_errno(errp, -last_cluster,
3806                              "Failed to find the last cluster");
3807             ret = last_cluster;
3808             goto fail;
3809         }
3810         if ((last_cluster + 1) * s->cluster_size < old_file_size) {
3811             Error *local_err = NULL;
3812 
3813             bdrv_co_truncate(bs->file, (last_cluster + 1) * s->cluster_size,
3814                              PREALLOC_MODE_OFF, &local_err);
3815             if (local_err) {
3816                 warn_reportf_err(local_err,
3817                                  "Failed to truncate the tail of the image: ");
3818             }
3819         }
3820     } else {
3821         ret = qcow2_grow_l1_table(bs, new_l1_size, true);
3822         if (ret < 0) {
3823             error_setg_errno(errp, -ret, "Failed to grow the L1 table");
3824             goto fail;
3825         }
3826     }
3827 
3828     switch (prealloc) {
3829     case PREALLOC_MODE_OFF:
3830         if (has_data_file(bs)) {
3831             ret = bdrv_co_truncate(s->data_file, offset, prealloc, errp);
3832             if (ret < 0) {
3833                 goto fail;
3834             }
3835         }
3836         break;
3837 
3838     case PREALLOC_MODE_METADATA:
3839         ret = preallocate_co(bs, old_length, offset, prealloc, errp);
3840         if (ret < 0) {
3841             goto fail;
3842         }
3843         break;
3844 
3845     case PREALLOC_MODE_FALLOC:
3846     case PREALLOC_MODE_FULL:
3847     {
3848         int64_t allocation_start, host_offset, guest_offset;
3849         int64_t clusters_allocated;
3850         int64_t old_file_size, new_file_size;
3851         uint64_t nb_new_data_clusters, nb_new_l2_tables;
3852 
3853         /* With a data file, preallocation means just allocating the metadata
3854          * and forwarding the truncate request to the data file */
3855         if (has_data_file(bs)) {
3856             ret = preallocate_co(bs, old_length, offset, prealloc, errp);
3857             if (ret < 0) {
3858                 goto fail;
3859             }
3860             break;
3861         }
3862 
3863         old_file_size = bdrv_getlength(bs->file->bs);
3864         if (old_file_size < 0) {
3865             error_setg_errno(errp, -old_file_size,
3866                              "Failed to inquire current file length");
3867             ret = old_file_size;
3868             goto fail;
3869         }
3870         old_file_size = ROUND_UP(old_file_size, s->cluster_size);
3871 
3872         nb_new_data_clusters = DIV_ROUND_UP(offset - old_length,
3873                                             s->cluster_size);
3874 
3875         /* This is an overestimation; we will not actually allocate space for
3876          * these in the file but just make sure the new refcount structures are
3877          * able to cover them so we will not have to allocate new refblocks
3878          * while entering the data blocks in the potentially new L2 tables.
3879          * (We do not actually care where the L2 tables are placed. Maybe they
3880          *  are already allocated or they can be placed somewhere before
3881          *  @old_file_size. It does not matter because they will be fully
3882          *  allocated automatically, so they do not need to be covered by the
3883          *  preallocation. All that matters is that we will not have to allocate
3884          *  new refcount structures for them.) */
3885         nb_new_l2_tables = DIV_ROUND_UP(nb_new_data_clusters,
3886                                         s->cluster_size / sizeof(uint64_t));
3887         /* The cluster range may not be aligned to L2 boundaries, so add one L2
3888          * table for a potential head/tail */
3889         nb_new_l2_tables++;
3890 
3891         allocation_start = qcow2_refcount_area(bs, old_file_size,
3892                                                nb_new_data_clusters +
3893                                                nb_new_l2_tables,
3894                                                true, 0, 0);
3895         if (allocation_start < 0) {
3896             error_setg_errno(errp, -allocation_start,
3897                              "Failed to resize refcount structures");
3898             ret = allocation_start;
3899             goto fail;
3900         }
3901 
3902         clusters_allocated = qcow2_alloc_clusters_at(bs, allocation_start,
3903                                                      nb_new_data_clusters);
3904         if (clusters_allocated < 0) {
3905             error_setg_errno(errp, -clusters_allocated,
3906                              "Failed to allocate data clusters");
3907             ret = clusters_allocated;
3908             goto fail;
3909         }
3910 
3911         assert(clusters_allocated == nb_new_data_clusters);
3912 
3913         /* Allocate the data area */
3914         new_file_size = allocation_start +
3915                         nb_new_data_clusters * s->cluster_size;
3916         ret = bdrv_co_truncate(bs->file, new_file_size, prealloc, errp);
3917         if (ret < 0) {
3918             error_prepend(errp, "Failed to resize underlying file: ");
3919             qcow2_free_clusters(bs, allocation_start,
3920                                 nb_new_data_clusters * s->cluster_size,
3921                                 QCOW2_DISCARD_OTHER);
3922             goto fail;
3923         }
3924 
3925         /* Create the necessary L2 entries */
3926         host_offset = allocation_start;
3927         guest_offset = old_length;
3928         while (nb_new_data_clusters) {
3929             int64_t nb_clusters = MIN(
3930                 nb_new_data_clusters,
3931                 s->l2_slice_size - offset_to_l2_slice_index(s, guest_offset));
3932             QCowL2Meta allocation = {
3933                 .offset       = guest_offset,
3934                 .alloc_offset = host_offset,
3935                 .nb_clusters  = nb_clusters,
3936             };
3937             qemu_co_queue_init(&allocation.dependent_requests);
3938 
3939             ret = qcow2_alloc_cluster_link_l2(bs, &allocation);
3940             if (ret < 0) {
3941                 error_setg_errno(errp, -ret, "Failed to update L2 tables");
3942                 qcow2_free_clusters(bs, host_offset,
3943                                     nb_new_data_clusters * s->cluster_size,
3944                                     QCOW2_DISCARD_OTHER);
3945                 goto fail;
3946             }
3947 
3948             guest_offset += nb_clusters * s->cluster_size;
3949             host_offset += nb_clusters * s->cluster_size;
3950             nb_new_data_clusters -= nb_clusters;
3951         }
3952         break;
3953     }
3954 
3955     default:
3956         g_assert_not_reached();
3957     }
3958 
3959     if (prealloc != PREALLOC_MODE_OFF) {
3960         /* Flush metadata before actually changing the image size */
3961         ret = qcow2_write_caches(bs);
3962         if (ret < 0) {
3963             error_setg_errno(errp, -ret,
3964                              "Failed to flush the preallocated area to disk");
3965             goto fail;
3966         }
3967     }
3968 
3969     bs->total_sectors = offset / BDRV_SECTOR_SIZE;
3970 
3971     /* write updated header.size */
3972     offset = cpu_to_be64(offset);
3973     ret = bdrv_pwrite_sync(bs->file, offsetof(QCowHeader, size),
3974                            &offset, sizeof(uint64_t));
3975     if (ret < 0) {
3976         error_setg_errno(errp, -ret, "Failed to update the image size");
3977         goto fail;
3978     }
3979 
3980     s->l1_vm_state_index = new_l1_size;
3981 
3982     /* Update cache sizes */
3983     options = qdict_clone_shallow(bs->options);
3984     ret = qcow2_update_options(bs, options, s->flags, errp);
3985     qobject_unref(options);
3986     if (ret < 0) {
3987         goto fail;
3988     }
3989     ret = 0;
3990 fail:
3991     qemu_co_mutex_unlock(&s->lock);
3992     return ret;
3993 }
3994 
3995 /* XXX: put compressed sectors first, then all the cluster aligned
3996    tables to avoid losing bytes in alignment */
3997 static coroutine_fn int
3998 qcow2_co_pwritev_compressed(BlockDriverState *bs, uint64_t offset,
3999                             uint64_t bytes, QEMUIOVector *qiov)
4000 {
4001     BDRVQcow2State *s = bs->opaque;
4002     int ret;
4003     ssize_t out_len;
4004     uint8_t *buf, *out_buf;
4005     uint64_t cluster_offset;
4006 
4007     if (has_data_file(bs)) {
4008         return -ENOTSUP;
4009     }
4010 
4011     if (bytes == 0) {
4012         /* align end of file to a sector boundary to ease reading with
4013            sector based I/Os */
4014         int64_t len = bdrv_getlength(bs->file->bs);
4015         if (len < 0) {
4016             return len;
4017         }
4018         return bdrv_co_truncate(bs->file, len, PREALLOC_MODE_OFF, NULL);
4019     }
4020 
4021     if (offset_into_cluster(s, offset)) {
4022         return -EINVAL;
4023     }
4024 
4025     buf = qemu_blockalign(bs, s->cluster_size);
4026     if (bytes != s->cluster_size) {
4027         if (bytes > s->cluster_size ||
4028             offset + bytes != bs->total_sectors << BDRV_SECTOR_BITS)
4029         {
4030             qemu_vfree(buf);
4031             return -EINVAL;
4032         }
4033         /* Zero-pad last write if image size is not cluster aligned */
4034         memset(buf + bytes, 0, s->cluster_size - bytes);
4035     }
4036     qemu_iovec_to_buf(qiov, 0, buf, bytes);
4037 
4038     out_buf = g_malloc(s->cluster_size);
4039 
4040     out_len = qcow2_co_compress(bs, out_buf, s->cluster_size - 1,
4041                                 buf, s->cluster_size);
4042     if (out_len == -ENOMEM) {
4043         /* could not compress: write normal cluster */
4044         ret = qcow2_co_pwritev(bs, offset, bytes, qiov, 0);
4045         if (ret < 0) {
4046             goto fail;
4047         }
4048         goto success;
4049     } else if (out_len < 0) {
4050         ret = -EINVAL;
4051         goto fail;
4052     }
4053 
4054     qemu_co_mutex_lock(&s->lock);
4055     ret = qcow2_alloc_compressed_cluster_offset(bs, offset, out_len,
4056                                                 &cluster_offset);
4057     if (ret < 0) {
4058         qemu_co_mutex_unlock(&s->lock);
4059         goto fail;
4060     }
4061 
4062     ret = qcow2_pre_write_overlap_check(bs, 0, cluster_offset, out_len, true);
4063     qemu_co_mutex_unlock(&s->lock);
4064     if (ret < 0) {
4065         goto fail;
4066     }
4067 
4068     BLKDBG_EVENT(s->data_file, BLKDBG_WRITE_COMPRESSED);
4069     ret = bdrv_co_pwrite(s->data_file, cluster_offset, out_len, out_buf, 0);
4070     if (ret < 0) {
4071         goto fail;
4072     }
4073 success:
4074     ret = 0;
4075 fail:
4076     qemu_vfree(buf);
4077     g_free(out_buf);
4078     return ret;
4079 }
4080 
4081 static int coroutine_fn
4082 qcow2_co_preadv_compressed(BlockDriverState *bs,
4083                            uint64_t file_cluster_offset,
4084                            uint64_t offset,
4085                            uint64_t bytes,
4086                            QEMUIOVector *qiov)
4087 {
4088     BDRVQcow2State *s = bs->opaque;
4089     int ret = 0, csize, nb_csectors;
4090     uint64_t coffset;
4091     uint8_t *buf, *out_buf;
4092     int offset_in_cluster = offset_into_cluster(s, offset);
4093 
4094     coffset = file_cluster_offset & s->cluster_offset_mask;
4095     nb_csectors = ((file_cluster_offset >> s->csize_shift) & s->csize_mask) + 1;
4096     csize = nb_csectors * QCOW2_COMPRESSED_SECTOR_SIZE -
4097         (coffset & ~QCOW2_COMPRESSED_SECTOR_MASK);
4098 
4099     buf = g_try_malloc(csize);
4100     if (!buf) {
4101         return -ENOMEM;
4102     }
4103 
4104     out_buf = qemu_blockalign(bs, s->cluster_size);
4105 
4106     BLKDBG_EVENT(bs->file, BLKDBG_READ_COMPRESSED);
4107     ret = bdrv_co_pread(bs->file, coffset, csize, buf, 0);
4108     if (ret < 0) {
4109         goto fail;
4110     }
4111 
4112     if (qcow2_co_decompress(bs, out_buf, s->cluster_size, buf, csize) < 0) {
4113         ret = -EIO;
4114         goto fail;
4115     }
4116 
4117     qemu_iovec_from_buf(qiov, 0, out_buf + offset_in_cluster, bytes);
4118 
4119 fail:
4120     qemu_vfree(out_buf);
4121     g_free(buf);
4122 
4123     return ret;
4124 }
4125 
4126 static int make_completely_empty(BlockDriverState *bs)
4127 {
4128     BDRVQcow2State *s = bs->opaque;
4129     Error *local_err = NULL;
4130     int ret, l1_clusters;
4131     int64_t offset;
4132     uint64_t *new_reftable = NULL;
4133     uint64_t rt_entry, l1_size2;
4134     struct {
4135         uint64_t l1_offset;
4136         uint64_t reftable_offset;
4137         uint32_t reftable_clusters;
4138     } QEMU_PACKED l1_ofs_rt_ofs_cls;
4139 
4140     ret = qcow2_cache_empty(bs, s->l2_table_cache);
4141     if (ret < 0) {
4142         goto fail;
4143     }
4144 
4145     ret = qcow2_cache_empty(bs, s->refcount_block_cache);
4146     if (ret < 0) {
4147         goto fail;
4148     }
4149 
4150     /* Refcounts will be broken utterly */
4151     ret = qcow2_mark_dirty(bs);
4152     if (ret < 0) {
4153         goto fail;
4154     }
4155 
4156     BLKDBG_EVENT(bs->file, BLKDBG_L1_UPDATE);
4157 
4158     l1_clusters = DIV_ROUND_UP(s->l1_size, s->cluster_size / sizeof(uint64_t));
4159     l1_size2 = (uint64_t)s->l1_size * sizeof(uint64_t);
4160 
4161     /* After this call, neither the in-memory nor the on-disk refcount
4162      * information accurately describe the actual references */
4163 
4164     ret = bdrv_pwrite_zeroes(bs->file, s->l1_table_offset,
4165                              l1_clusters * s->cluster_size, 0);
4166     if (ret < 0) {
4167         goto fail_broken_refcounts;
4168     }
4169     memset(s->l1_table, 0, l1_size2);
4170 
4171     BLKDBG_EVENT(bs->file, BLKDBG_EMPTY_IMAGE_PREPARE);
4172 
4173     /* Overwrite enough clusters at the beginning of the sectors to place
4174      * the refcount table, a refcount block and the L1 table in; this may
4175      * overwrite parts of the existing refcount and L1 table, which is not
4176      * an issue because the dirty flag is set, complete data loss is in fact
4177      * desired and partial data loss is consequently fine as well */
4178     ret = bdrv_pwrite_zeroes(bs->file, s->cluster_size,
4179                              (2 + l1_clusters) * s->cluster_size, 0);
4180     /* This call (even if it failed overall) may have overwritten on-disk
4181      * refcount structures; in that case, the in-memory refcount information
4182      * will probably differ from the on-disk information which makes the BDS
4183      * unusable */
4184     if (ret < 0) {
4185         goto fail_broken_refcounts;
4186     }
4187 
4188     BLKDBG_EVENT(bs->file, BLKDBG_L1_UPDATE);
4189     BLKDBG_EVENT(bs->file, BLKDBG_REFTABLE_UPDATE);
4190 
4191     /* "Create" an empty reftable (one cluster) directly after the image
4192      * header and an empty L1 table three clusters after the image header;
4193      * the cluster between those two will be used as the first refblock */
4194     l1_ofs_rt_ofs_cls.l1_offset = cpu_to_be64(3 * s->cluster_size);
4195     l1_ofs_rt_ofs_cls.reftable_offset = cpu_to_be64(s->cluster_size);
4196     l1_ofs_rt_ofs_cls.reftable_clusters = cpu_to_be32(1);
4197     ret = bdrv_pwrite_sync(bs->file, offsetof(QCowHeader, l1_table_offset),
4198                            &l1_ofs_rt_ofs_cls, sizeof(l1_ofs_rt_ofs_cls));
4199     if (ret < 0) {
4200         goto fail_broken_refcounts;
4201     }
4202 
4203     s->l1_table_offset = 3 * s->cluster_size;
4204 
4205     new_reftable = g_try_new0(uint64_t, s->cluster_size / sizeof(uint64_t));
4206     if (!new_reftable) {
4207         ret = -ENOMEM;
4208         goto fail_broken_refcounts;
4209     }
4210 
4211     s->refcount_table_offset = s->cluster_size;
4212     s->refcount_table_size   = s->cluster_size / sizeof(uint64_t);
4213     s->max_refcount_table_index = 0;
4214 
4215     g_free(s->refcount_table);
4216     s->refcount_table = new_reftable;
4217     new_reftable = NULL;
4218 
4219     /* Now the in-memory refcount information again corresponds to the on-disk
4220      * information (reftable is empty and no refblocks (the refblock cache is
4221      * empty)); however, this means some clusters (e.g. the image header) are
4222      * referenced, but not refcounted, but the normal qcow2 code assumes that
4223      * the in-memory information is always correct */
4224 
4225     BLKDBG_EVENT(bs->file, BLKDBG_REFBLOCK_ALLOC);
4226 
4227     /* Enter the first refblock into the reftable */
4228     rt_entry = cpu_to_be64(2 * s->cluster_size);
4229     ret = bdrv_pwrite_sync(bs->file, s->cluster_size,
4230                            &rt_entry, sizeof(rt_entry));
4231     if (ret < 0) {
4232         goto fail_broken_refcounts;
4233     }
4234     s->refcount_table[0] = 2 * s->cluster_size;
4235 
4236     s->free_cluster_index = 0;
4237     assert(3 + l1_clusters <= s->refcount_block_size);
4238     offset = qcow2_alloc_clusters(bs, 3 * s->cluster_size + l1_size2);
4239     if (offset < 0) {
4240         ret = offset;
4241         goto fail_broken_refcounts;
4242     } else if (offset > 0) {
4243         error_report("First cluster in emptied image is in use");
4244         abort();
4245     }
4246 
4247     /* Now finally the in-memory information corresponds to the on-disk
4248      * structures and is correct */
4249     ret = qcow2_mark_clean(bs);
4250     if (ret < 0) {
4251         goto fail;
4252     }
4253 
4254     ret = bdrv_truncate(bs->file, (3 + l1_clusters) * s->cluster_size,
4255                         PREALLOC_MODE_OFF, &local_err);
4256     if (ret < 0) {
4257         error_report_err(local_err);
4258         goto fail;
4259     }
4260 
4261     return 0;
4262 
4263 fail_broken_refcounts:
4264     /* The BDS is unusable at this point. If we wanted to make it usable, we
4265      * would have to call qcow2_refcount_close(), qcow2_refcount_init(),
4266      * qcow2_check_refcounts(), qcow2_refcount_close() and qcow2_refcount_init()
4267      * again. However, because the functions which could have caused this error
4268      * path to be taken are used by those functions as well, it's very likely
4269      * that that sequence will fail as well. Therefore, just eject the BDS. */
4270     bs->drv = NULL;
4271 
4272 fail:
4273     g_free(new_reftable);
4274     return ret;
4275 }
4276 
4277 static int qcow2_make_empty(BlockDriverState *bs)
4278 {
4279     BDRVQcow2State *s = bs->opaque;
4280     uint64_t offset, end_offset;
4281     int step = QEMU_ALIGN_DOWN(INT_MAX, s->cluster_size);
4282     int l1_clusters, ret = 0;
4283 
4284     l1_clusters = DIV_ROUND_UP(s->l1_size, s->cluster_size / sizeof(uint64_t));
4285 
4286     if (s->qcow_version >= 3 && !s->snapshots && !s->nb_bitmaps &&
4287         3 + l1_clusters <= s->refcount_block_size &&
4288         s->crypt_method_header != QCOW_CRYPT_LUKS &&
4289         !has_data_file(bs)) {
4290         /* The following function only works for qcow2 v3 images (it
4291          * requires the dirty flag) and only as long as there are no
4292          * features that reserve extra clusters (such as snapshots,
4293          * LUKS header, or persistent bitmaps), because it completely
4294          * empties the image.  Furthermore, the L1 table and three
4295          * additional clusters (image header, refcount table, one
4296          * refcount block) have to fit inside one refcount block. It
4297          * only resets the image file, i.e. does not work with an
4298          * external data file. */
4299         return make_completely_empty(bs);
4300     }
4301 
4302     /* This fallback code simply discards every active cluster; this is slow,
4303      * but works in all cases */
4304     end_offset = bs->total_sectors * BDRV_SECTOR_SIZE;
4305     for (offset = 0; offset < end_offset; offset += step) {
4306         /* As this function is generally used after committing an external
4307          * snapshot, QCOW2_DISCARD_SNAPSHOT seems appropriate. Also, the
4308          * default action for this kind of discard is to pass the discard,
4309          * which will ideally result in an actually smaller image file, as
4310          * is probably desired. */
4311         ret = qcow2_cluster_discard(bs, offset, MIN(step, end_offset - offset),
4312                                     QCOW2_DISCARD_SNAPSHOT, true);
4313         if (ret < 0) {
4314             break;
4315         }
4316     }
4317 
4318     return ret;
4319 }
4320 
4321 static coroutine_fn int qcow2_co_flush_to_os(BlockDriverState *bs)
4322 {
4323     BDRVQcow2State *s = bs->opaque;
4324     int ret;
4325 
4326     qemu_co_mutex_lock(&s->lock);
4327     ret = qcow2_write_caches(bs);
4328     qemu_co_mutex_unlock(&s->lock);
4329 
4330     return ret;
4331 }
4332 
4333 static ssize_t qcow2_measure_crypto_hdr_init_func(QCryptoBlock *block,
4334         size_t headerlen, void *opaque, Error **errp)
4335 {
4336     size_t *headerlenp = opaque;
4337 
4338     /* Stash away the payload size */
4339     *headerlenp = headerlen;
4340     return 0;
4341 }
4342 
4343 static ssize_t qcow2_measure_crypto_hdr_write_func(QCryptoBlock *block,
4344         size_t offset, const uint8_t *buf, size_t buflen,
4345         void *opaque, Error **errp)
4346 {
4347     /* Discard the bytes, we're not actually writing to an image */
4348     return buflen;
4349 }
4350 
4351 /* Determine the number of bytes for the LUKS payload */
4352 static bool qcow2_measure_luks_headerlen(QemuOpts *opts, size_t *len,
4353                                          Error **errp)
4354 {
4355     QDict *opts_qdict;
4356     QDict *cryptoopts_qdict;
4357     QCryptoBlockCreateOptions *cryptoopts;
4358     QCryptoBlock *crypto;
4359 
4360     /* Extract "encrypt." options into a qdict */
4361     opts_qdict = qemu_opts_to_qdict(opts, NULL);
4362     qdict_extract_subqdict(opts_qdict, &cryptoopts_qdict, "encrypt.");
4363     qobject_unref(opts_qdict);
4364 
4365     /* Build QCryptoBlockCreateOptions object from qdict */
4366     qdict_put_str(cryptoopts_qdict, "format", "luks");
4367     cryptoopts = block_crypto_create_opts_init(cryptoopts_qdict, errp);
4368     qobject_unref(cryptoopts_qdict);
4369     if (!cryptoopts) {
4370         return false;
4371     }
4372 
4373     /* Fake LUKS creation in order to determine the payload size */
4374     crypto = qcrypto_block_create(cryptoopts, "encrypt.",
4375                                   qcow2_measure_crypto_hdr_init_func,
4376                                   qcow2_measure_crypto_hdr_write_func,
4377                                   len, errp);
4378     qapi_free_QCryptoBlockCreateOptions(cryptoopts);
4379     if (!crypto) {
4380         return false;
4381     }
4382 
4383     qcrypto_block_free(crypto);
4384     return true;
4385 }
4386 
4387 static BlockMeasureInfo *qcow2_measure(QemuOpts *opts, BlockDriverState *in_bs,
4388                                        Error **errp)
4389 {
4390     Error *local_err = NULL;
4391     BlockMeasureInfo *info;
4392     uint64_t required = 0; /* bytes that contribute to required size */
4393     uint64_t virtual_size; /* disk size as seen by guest */
4394     uint64_t refcount_bits;
4395     uint64_t l2_tables;
4396     uint64_t luks_payload_size = 0;
4397     size_t cluster_size;
4398     int version;
4399     char *optstr;
4400     PreallocMode prealloc;
4401     bool has_backing_file;
4402     bool has_luks;
4403 
4404     /* Parse image creation options */
4405     cluster_size = qcow2_opt_get_cluster_size_del(opts, &local_err);
4406     if (local_err) {
4407         goto err;
4408     }
4409 
4410     version = qcow2_opt_get_version_del(opts, &local_err);
4411     if (local_err) {
4412         goto err;
4413     }
4414 
4415     refcount_bits = qcow2_opt_get_refcount_bits_del(opts, version, &local_err);
4416     if (local_err) {
4417         goto err;
4418     }
4419 
4420     optstr = qemu_opt_get_del(opts, BLOCK_OPT_PREALLOC);
4421     prealloc = qapi_enum_parse(&PreallocMode_lookup, optstr,
4422                                PREALLOC_MODE_OFF, &local_err);
4423     g_free(optstr);
4424     if (local_err) {
4425         goto err;
4426     }
4427 
4428     optstr = qemu_opt_get_del(opts, BLOCK_OPT_BACKING_FILE);
4429     has_backing_file = !!optstr;
4430     g_free(optstr);
4431 
4432     optstr = qemu_opt_get_del(opts, BLOCK_OPT_ENCRYPT_FORMAT);
4433     has_luks = optstr && strcmp(optstr, "luks") == 0;
4434     g_free(optstr);
4435 
4436     if (has_luks) {
4437         size_t headerlen;
4438 
4439         if (!qcow2_measure_luks_headerlen(opts, &headerlen, &local_err)) {
4440             goto err;
4441         }
4442 
4443         luks_payload_size = ROUND_UP(headerlen, cluster_size);
4444     }
4445 
4446     virtual_size = qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0);
4447     virtual_size = ROUND_UP(virtual_size, cluster_size);
4448 
4449     /* Check that virtual disk size is valid */
4450     l2_tables = DIV_ROUND_UP(virtual_size / cluster_size,
4451                              cluster_size / sizeof(uint64_t));
4452     if (l2_tables * sizeof(uint64_t) > QCOW_MAX_L1_SIZE) {
4453         error_setg(&local_err, "The image size is too large "
4454                                "(try using a larger cluster size)");
4455         goto err;
4456     }
4457 
4458     /* Account for input image */
4459     if (in_bs) {
4460         int64_t ssize = bdrv_getlength(in_bs);
4461         if (ssize < 0) {
4462             error_setg_errno(&local_err, -ssize,
4463                              "Unable to get image virtual_size");
4464             goto err;
4465         }
4466 
4467         virtual_size = ROUND_UP(ssize, cluster_size);
4468 
4469         if (has_backing_file) {
4470             /* We don't how much of the backing chain is shared by the input
4471              * image and the new image file.  In the worst case the new image's
4472              * backing file has nothing in common with the input image.  Be
4473              * conservative and assume all clusters need to be written.
4474              */
4475             required = virtual_size;
4476         } else {
4477             int64_t offset;
4478             int64_t pnum = 0;
4479 
4480             for (offset = 0; offset < ssize; offset += pnum) {
4481                 int ret;
4482 
4483                 ret = bdrv_block_status_above(in_bs, NULL, offset,
4484                                               ssize - offset, &pnum, NULL,
4485                                               NULL);
4486                 if (ret < 0) {
4487                     error_setg_errno(&local_err, -ret,
4488                                      "Unable to get block status");
4489                     goto err;
4490                 }
4491 
4492                 if (ret & BDRV_BLOCK_ZERO) {
4493                     /* Skip zero regions (safe with no backing file) */
4494                 } else if ((ret & (BDRV_BLOCK_DATA | BDRV_BLOCK_ALLOCATED)) ==
4495                            (BDRV_BLOCK_DATA | BDRV_BLOCK_ALLOCATED)) {
4496                     /* Extend pnum to end of cluster for next iteration */
4497                     pnum = ROUND_UP(offset + pnum, cluster_size) - offset;
4498 
4499                     /* Count clusters we've seen */
4500                     required += offset % cluster_size + pnum;
4501                 }
4502             }
4503         }
4504     }
4505 
4506     /* Take into account preallocation.  Nothing special is needed for
4507      * PREALLOC_MODE_METADATA since metadata is always counted.
4508      */
4509     if (prealloc == PREALLOC_MODE_FULL || prealloc == PREALLOC_MODE_FALLOC) {
4510         required = virtual_size;
4511     }
4512 
4513     info = g_new(BlockMeasureInfo, 1);
4514     info->fully_allocated =
4515         qcow2_calc_prealloc_size(virtual_size, cluster_size,
4516                                  ctz32(refcount_bits)) + luks_payload_size;
4517 
4518     /* Remove data clusters that are not required.  This overestimates the
4519      * required size because metadata needed for the fully allocated file is
4520      * still counted.
4521      */
4522     info->required = info->fully_allocated - virtual_size + required;
4523     return info;
4524 
4525 err:
4526     error_propagate(errp, local_err);
4527     return NULL;
4528 }
4529 
4530 static int qcow2_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
4531 {
4532     BDRVQcow2State *s = bs->opaque;
4533     bdi->unallocated_blocks_are_zero = true;
4534     bdi->cluster_size = s->cluster_size;
4535     bdi->vm_state_offset = qcow2_vm_state_offset(s);
4536     return 0;
4537 }
4538 
4539 static ImageInfoSpecific *qcow2_get_specific_info(BlockDriverState *bs,
4540                                                   Error **errp)
4541 {
4542     BDRVQcow2State *s = bs->opaque;
4543     ImageInfoSpecific *spec_info;
4544     QCryptoBlockInfo *encrypt_info = NULL;
4545     Error *local_err = NULL;
4546 
4547     if (s->crypto != NULL) {
4548         encrypt_info = qcrypto_block_get_info(s->crypto, &local_err);
4549         if (local_err) {
4550             error_propagate(errp, local_err);
4551             return NULL;
4552         }
4553     }
4554 
4555     spec_info = g_new(ImageInfoSpecific, 1);
4556     *spec_info = (ImageInfoSpecific){
4557         .type  = IMAGE_INFO_SPECIFIC_KIND_QCOW2,
4558         .u.qcow2.data = g_new0(ImageInfoSpecificQCow2, 1),
4559     };
4560     if (s->qcow_version == 2) {
4561         *spec_info->u.qcow2.data = (ImageInfoSpecificQCow2){
4562             .compat             = g_strdup("0.10"),
4563             .refcount_bits      = s->refcount_bits,
4564         };
4565     } else if (s->qcow_version == 3) {
4566         Qcow2BitmapInfoList *bitmaps;
4567         bitmaps = qcow2_get_bitmap_info_list(bs, &local_err);
4568         if (local_err) {
4569             error_propagate(errp, local_err);
4570             qapi_free_ImageInfoSpecific(spec_info);
4571             return NULL;
4572         }
4573         *spec_info->u.qcow2.data = (ImageInfoSpecificQCow2){
4574             .compat             = g_strdup("1.1"),
4575             .lazy_refcounts     = s->compatible_features &
4576                                   QCOW2_COMPAT_LAZY_REFCOUNTS,
4577             .has_lazy_refcounts = true,
4578             .corrupt            = s->incompatible_features &
4579                                   QCOW2_INCOMPAT_CORRUPT,
4580             .has_corrupt        = true,
4581             .refcount_bits      = s->refcount_bits,
4582             .has_bitmaps        = !!bitmaps,
4583             .bitmaps            = bitmaps,
4584             .has_data_file      = !!s->image_data_file,
4585             .data_file          = g_strdup(s->image_data_file),
4586             .has_data_file_raw  = has_data_file(bs),
4587             .data_file_raw      = data_file_is_raw(bs),
4588         };
4589     } else {
4590         /* if this assertion fails, this probably means a new version was
4591          * added without having it covered here */
4592         assert(false);
4593     }
4594 
4595     if (encrypt_info) {
4596         ImageInfoSpecificQCow2Encryption *qencrypt =
4597             g_new(ImageInfoSpecificQCow2Encryption, 1);
4598         switch (encrypt_info->format) {
4599         case Q_CRYPTO_BLOCK_FORMAT_QCOW:
4600             qencrypt->format = BLOCKDEV_QCOW2_ENCRYPTION_FORMAT_AES;
4601             break;
4602         case Q_CRYPTO_BLOCK_FORMAT_LUKS:
4603             qencrypt->format = BLOCKDEV_QCOW2_ENCRYPTION_FORMAT_LUKS;
4604             qencrypt->u.luks = encrypt_info->u.luks;
4605             break;
4606         default:
4607             abort();
4608         }
4609         /* Since we did shallow copy above, erase any pointers
4610          * in the original info */
4611         memset(&encrypt_info->u, 0, sizeof(encrypt_info->u));
4612         qapi_free_QCryptoBlockInfo(encrypt_info);
4613 
4614         spec_info->u.qcow2.data->has_encrypt = true;
4615         spec_info->u.qcow2.data->encrypt = qencrypt;
4616     }
4617 
4618     return spec_info;
4619 }
4620 
4621 static int qcow2_save_vmstate(BlockDriverState *bs, QEMUIOVector *qiov,
4622                               int64_t pos)
4623 {
4624     BDRVQcow2State *s = bs->opaque;
4625 
4626     BLKDBG_EVENT(bs->file, BLKDBG_VMSTATE_SAVE);
4627     return bs->drv->bdrv_co_pwritev(bs, qcow2_vm_state_offset(s) + pos,
4628                                     qiov->size, qiov, 0);
4629 }
4630 
4631 static int qcow2_load_vmstate(BlockDriverState *bs, QEMUIOVector *qiov,
4632                               int64_t pos)
4633 {
4634     BDRVQcow2State *s = bs->opaque;
4635 
4636     BLKDBG_EVENT(bs->file, BLKDBG_VMSTATE_LOAD);
4637     return bs->drv->bdrv_co_preadv(bs, qcow2_vm_state_offset(s) + pos,
4638                                    qiov->size, qiov, 0);
4639 }
4640 
4641 /*
4642  * Downgrades an image's version. To achieve this, any incompatible features
4643  * have to be removed.
4644  */
4645 static int qcow2_downgrade(BlockDriverState *bs, int target_version,
4646                            BlockDriverAmendStatusCB *status_cb, void *cb_opaque,
4647                            Error **errp)
4648 {
4649     BDRVQcow2State *s = bs->opaque;
4650     int current_version = s->qcow_version;
4651     int ret;
4652 
4653     /* This is qcow2_downgrade(), not qcow2_upgrade() */
4654     assert(target_version < current_version);
4655 
4656     /* There are no other versions (now) that you can downgrade to */
4657     assert(target_version == 2);
4658 
4659     if (s->refcount_order != 4) {
4660         error_setg(errp, "compat=0.10 requires refcount_bits=16");
4661         return -ENOTSUP;
4662     }
4663 
4664     if (has_data_file(bs)) {
4665         error_setg(errp, "Cannot downgrade an image with a data file");
4666         return -ENOTSUP;
4667     }
4668 
4669     /* clear incompatible features */
4670     if (s->incompatible_features & QCOW2_INCOMPAT_DIRTY) {
4671         ret = qcow2_mark_clean(bs);
4672         if (ret < 0) {
4673             error_setg_errno(errp, -ret, "Failed to make the image clean");
4674             return ret;
4675         }
4676     }
4677 
4678     /* with QCOW2_INCOMPAT_CORRUPT, it is pretty much impossible to get here in
4679      * the first place; if that happens nonetheless, returning -ENOTSUP is the
4680      * best thing to do anyway */
4681 
4682     if (s->incompatible_features) {
4683         error_setg(errp, "Cannot downgrade an image with incompatible features "
4684                    "%#" PRIx64 " set", s->incompatible_features);
4685         return -ENOTSUP;
4686     }
4687 
4688     /* since we can ignore compatible features, we can set them to 0 as well */
4689     s->compatible_features = 0;
4690     /* if lazy refcounts have been used, they have already been fixed through
4691      * clearing the dirty flag */
4692 
4693     /* clearing autoclear features is trivial */
4694     s->autoclear_features = 0;
4695 
4696     ret = qcow2_expand_zero_clusters(bs, status_cb, cb_opaque);
4697     if (ret < 0) {
4698         error_setg_errno(errp, -ret, "Failed to turn zero into data clusters");
4699         return ret;
4700     }
4701 
4702     s->qcow_version = target_version;
4703     ret = qcow2_update_header(bs);
4704     if (ret < 0) {
4705         s->qcow_version = current_version;
4706         error_setg_errno(errp, -ret, "Failed to update the image header");
4707         return ret;
4708     }
4709     return 0;
4710 }
4711 
4712 typedef enum Qcow2AmendOperation {
4713     /* This is the value Qcow2AmendHelperCBInfo::last_operation will be
4714      * statically initialized to so that the helper CB can discern the first
4715      * invocation from an operation change */
4716     QCOW2_NO_OPERATION = 0,
4717 
4718     QCOW2_CHANGING_REFCOUNT_ORDER,
4719     QCOW2_DOWNGRADING,
4720 } Qcow2AmendOperation;
4721 
4722 typedef struct Qcow2AmendHelperCBInfo {
4723     /* The code coordinating the amend operations should only modify
4724      * these four fields; the rest will be managed by the CB */
4725     BlockDriverAmendStatusCB *original_status_cb;
4726     void *original_cb_opaque;
4727 
4728     Qcow2AmendOperation current_operation;
4729 
4730     /* Total number of operations to perform (only set once) */
4731     int total_operations;
4732 
4733     /* The following fields are managed by the CB */
4734 
4735     /* Number of operations completed */
4736     int operations_completed;
4737 
4738     /* Cumulative offset of all completed operations */
4739     int64_t offset_completed;
4740 
4741     Qcow2AmendOperation last_operation;
4742     int64_t last_work_size;
4743 } Qcow2AmendHelperCBInfo;
4744 
4745 static void qcow2_amend_helper_cb(BlockDriverState *bs,
4746                                   int64_t operation_offset,
4747                                   int64_t operation_work_size, void *opaque)
4748 {
4749     Qcow2AmendHelperCBInfo *info = opaque;
4750     int64_t current_work_size;
4751     int64_t projected_work_size;
4752 
4753     if (info->current_operation != info->last_operation) {
4754         if (info->last_operation != QCOW2_NO_OPERATION) {
4755             info->offset_completed += info->last_work_size;
4756             info->operations_completed++;
4757         }
4758 
4759         info->last_operation = info->current_operation;
4760     }
4761 
4762     assert(info->total_operations > 0);
4763     assert(info->operations_completed < info->total_operations);
4764 
4765     info->last_work_size = operation_work_size;
4766 
4767     current_work_size = info->offset_completed + operation_work_size;
4768 
4769     /* current_work_size is the total work size for (operations_completed + 1)
4770      * operations (which includes this one), so multiply it by the number of
4771      * operations not covered and divide it by the number of operations
4772      * covered to get a projection for the operations not covered */
4773     projected_work_size = current_work_size * (info->total_operations -
4774                                                info->operations_completed - 1)
4775                                             / (info->operations_completed + 1);
4776 
4777     info->original_status_cb(bs, info->offset_completed + operation_offset,
4778                              current_work_size + projected_work_size,
4779                              info->original_cb_opaque);
4780 }
4781 
4782 static int qcow2_amend_options(BlockDriverState *bs, QemuOpts *opts,
4783                                BlockDriverAmendStatusCB *status_cb,
4784                                void *cb_opaque,
4785                                Error **errp)
4786 {
4787     BDRVQcow2State *s = bs->opaque;
4788     int old_version = s->qcow_version, new_version = old_version;
4789     uint64_t new_size = 0;
4790     const char *backing_file = NULL, *backing_format = NULL, *data_file = NULL;
4791     bool lazy_refcounts = s->use_lazy_refcounts;
4792     bool data_file_raw = data_file_is_raw(bs);
4793     const char *compat = NULL;
4794     uint64_t cluster_size = s->cluster_size;
4795     bool encrypt;
4796     int encformat;
4797     int refcount_bits = s->refcount_bits;
4798     int ret;
4799     QemuOptDesc *desc = opts->list->desc;
4800     Qcow2AmendHelperCBInfo helper_cb_info;
4801 
4802     while (desc && desc->name) {
4803         if (!qemu_opt_find(opts, desc->name)) {
4804             /* only change explicitly defined options */
4805             desc++;
4806             continue;
4807         }
4808 
4809         if (!strcmp(desc->name, BLOCK_OPT_COMPAT_LEVEL)) {
4810             compat = qemu_opt_get(opts, BLOCK_OPT_COMPAT_LEVEL);
4811             if (!compat) {
4812                 /* preserve default */
4813             } else if (!strcmp(compat, "0.10")) {
4814                 new_version = 2;
4815             } else if (!strcmp(compat, "1.1")) {
4816                 new_version = 3;
4817             } else {
4818                 error_setg(errp, "Unknown compatibility level %s", compat);
4819                 return -EINVAL;
4820             }
4821         } else if (!strcmp(desc->name, BLOCK_OPT_PREALLOC)) {
4822             error_setg(errp, "Cannot change preallocation mode");
4823             return -ENOTSUP;
4824         } else if (!strcmp(desc->name, BLOCK_OPT_SIZE)) {
4825             new_size = qemu_opt_get_size(opts, BLOCK_OPT_SIZE, 0);
4826         } else if (!strcmp(desc->name, BLOCK_OPT_BACKING_FILE)) {
4827             backing_file = qemu_opt_get(opts, BLOCK_OPT_BACKING_FILE);
4828         } else if (!strcmp(desc->name, BLOCK_OPT_BACKING_FMT)) {
4829             backing_format = qemu_opt_get(opts, BLOCK_OPT_BACKING_FMT);
4830         } else if (!strcmp(desc->name, BLOCK_OPT_ENCRYPT)) {
4831             encrypt = qemu_opt_get_bool(opts, BLOCK_OPT_ENCRYPT,
4832                                         !!s->crypto);
4833 
4834             if (encrypt != !!s->crypto) {
4835                 error_setg(errp,
4836                            "Changing the encryption flag is not supported");
4837                 return -ENOTSUP;
4838             }
4839         } else if (!strcmp(desc->name, BLOCK_OPT_ENCRYPT_FORMAT)) {
4840             encformat = qcow2_crypt_method_from_format(
4841                 qemu_opt_get(opts, BLOCK_OPT_ENCRYPT_FORMAT));
4842 
4843             if (encformat != s->crypt_method_header) {
4844                 error_setg(errp,
4845                            "Changing the encryption format is not supported");
4846                 return -ENOTSUP;
4847             }
4848         } else if (g_str_has_prefix(desc->name, "encrypt.")) {
4849             error_setg(errp,
4850                        "Changing the encryption parameters is not supported");
4851             return -ENOTSUP;
4852         } else if (!strcmp(desc->name, BLOCK_OPT_CLUSTER_SIZE)) {
4853             cluster_size = qemu_opt_get_size(opts, BLOCK_OPT_CLUSTER_SIZE,
4854                                              cluster_size);
4855             if (cluster_size != s->cluster_size) {
4856                 error_setg(errp, "Changing the cluster size is not supported");
4857                 return -ENOTSUP;
4858             }
4859         } else if (!strcmp(desc->name, BLOCK_OPT_LAZY_REFCOUNTS)) {
4860             lazy_refcounts = qemu_opt_get_bool(opts, BLOCK_OPT_LAZY_REFCOUNTS,
4861                                                lazy_refcounts);
4862         } else if (!strcmp(desc->name, BLOCK_OPT_REFCOUNT_BITS)) {
4863             refcount_bits = qemu_opt_get_number(opts, BLOCK_OPT_REFCOUNT_BITS,
4864                                                 refcount_bits);
4865 
4866             if (refcount_bits <= 0 || refcount_bits > 64 ||
4867                 !is_power_of_2(refcount_bits))
4868             {
4869                 error_setg(errp, "Refcount width must be a power of two and "
4870                            "may not exceed 64 bits");
4871                 return -EINVAL;
4872             }
4873         } else if (!strcmp(desc->name, BLOCK_OPT_DATA_FILE)) {
4874             data_file = qemu_opt_get(opts, BLOCK_OPT_DATA_FILE);
4875             if (data_file && !has_data_file(bs)) {
4876                 error_setg(errp, "data-file can only be set for images that "
4877                                  "use an external data file");
4878                 return -EINVAL;
4879             }
4880         } else if (!strcmp(desc->name, BLOCK_OPT_DATA_FILE_RAW)) {
4881             data_file_raw = qemu_opt_get_bool(opts, BLOCK_OPT_DATA_FILE_RAW,
4882                                               data_file_raw);
4883             if (data_file_raw && !data_file_is_raw(bs)) {
4884                 error_setg(errp, "data-file-raw cannot be set on existing "
4885                                  "images");
4886                 return -EINVAL;
4887             }
4888         } else {
4889             /* if this point is reached, this probably means a new option was
4890              * added without having it covered here */
4891             abort();
4892         }
4893 
4894         desc++;
4895     }
4896 
4897     helper_cb_info = (Qcow2AmendHelperCBInfo){
4898         .original_status_cb = status_cb,
4899         .original_cb_opaque = cb_opaque,
4900         .total_operations = (new_version < old_version)
4901                           + (s->refcount_bits != refcount_bits)
4902     };
4903 
4904     /* Upgrade first (some features may require compat=1.1) */
4905     if (new_version > old_version) {
4906         s->qcow_version = new_version;
4907         ret = qcow2_update_header(bs);
4908         if (ret < 0) {
4909             s->qcow_version = old_version;
4910             error_setg_errno(errp, -ret, "Failed to update the image header");
4911             return ret;
4912         }
4913     }
4914 
4915     if (s->refcount_bits != refcount_bits) {
4916         int refcount_order = ctz32(refcount_bits);
4917 
4918         if (new_version < 3 && refcount_bits != 16) {
4919             error_setg(errp, "Refcount widths other than 16 bits require "
4920                        "compatibility level 1.1 or above (use compat=1.1 or "
4921                        "greater)");
4922             return -EINVAL;
4923         }
4924 
4925         helper_cb_info.current_operation = QCOW2_CHANGING_REFCOUNT_ORDER;
4926         ret = qcow2_change_refcount_order(bs, refcount_order,
4927                                           &qcow2_amend_helper_cb,
4928                                           &helper_cb_info, errp);
4929         if (ret < 0) {
4930             return ret;
4931         }
4932     }
4933 
4934     /* data-file-raw blocks backing files, so clear it first if requested */
4935     if (data_file_raw) {
4936         s->autoclear_features |= QCOW2_AUTOCLEAR_DATA_FILE_RAW;
4937     } else {
4938         s->autoclear_features &= ~QCOW2_AUTOCLEAR_DATA_FILE_RAW;
4939     }
4940 
4941     if (data_file) {
4942         g_free(s->image_data_file);
4943         s->image_data_file = *data_file ? g_strdup(data_file) : NULL;
4944     }
4945 
4946     ret = qcow2_update_header(bs);
4947     if (ret < 0) {
4948         error_setg_errno(errp, -ret, "Failed to update the image header");
4949         return ret;
4950     }
4951 
4952     if (backing_file || backing_format) {
4953         ret = qcow2_change_backing_file(bs,
4954                     backing_file ?: s->image_backing_file,
4955                     backing_format ?: s->image_backing_format);
4956         if (ret < 0) {
4957             error_setg_errno(errp, -ret, "Failed to change the backing file");
4958             return ret;
4959         }
4960     }
4961 
4962     if (s->use_lazy_refcounts != lazy_refcounts) {
4963         if (lazy_refcounts) {
4964             if (new_version < 3) {
4965                 error_setg(errp, "Lazy refcounts only supported with "
4966                            "compatibility level 1.1 and above (use compat=1.1 "
4967                            "or greater)");
4968                 return -EINVAL;
4969             }
4970             s->compatible_features |= QCOW2_COMPAT_LAZY_REFCOUNTS;
4971             ret = qcow2_update_header(bs);
4972             if (ret < 0) {
4973                 s->compatible_features &= ~QCOW2_COMPAT_LAZY_REFCOUNTS;
4974                 error_setg_errno(errp, -ret, "Failed to update the image header");
4975                 return ret;
4976             }
4977             s->use_lazy_refcounts = true;
4978         } else {
4979             /* make image clean first */
4980             ret = qcow2_mark_clean(bs);
4981             if (ret < 0) {
4982                 error_setg_errno(errp, -ret, "Failed to make the image clean");
4983                 return ret;
4984             }
4985             /* now disallow lazy refcounts */
4986             s->compatible_features &= ~QCOW2_COMPAT_LAZY_REFCOUNTS;
4987             ret = qcow2_update_header(bs);
4988             if (ret < 0) {
4989                 s->compatible_features |= QCOW2_COMPAT_LAZY_REFCOUNTS;
4990                 error_setg_errno(errp, -ret, "Failed to update the image header");
4991                 return ret;
4992             }
4993             s->use_lazy_refcounts = false;
4994         }
4995     }
4996 
4997     if (new_size) {
4998         BlockBackend *blk = blk_new(BLK_PERM_RESIZE, BLK_PERM_ALL);
4999         ret = blk_insert_bs(blk, bs, errp);
5000         if (ret < 0) {
5001             blk_unref(blk);
5002             return ret;
5003         }
5004 
5005         ret = blk_truncate(blk, new_size, PREALLOC_MODE_OFF, errp);
5006         blk_unref(blk);
5007         if (ret < 0) {
5008             return ret;
5009         }
5010     }
5011 
5012     /* Downgrade last (so unsupported features can be removed before) */
5013     if (new_version < old_version) {
5014         helper_cb_info.current_operation = QCOW2_DOWNGRADING;
5015         ret = qcow2_downgrade(bs, new_version, &qcow2_amend_helper_cb,
5016                               &helper_cb_info, errp);
5017         if (ret < 0) {
5018             return ret;
5019         }
5020     }
5021 
5022     return 0;
5023 }
5024 
5025 /*
5026  * If offset or size are negative, respectively, they will not be included in
5027  * the BLOCK_IMAGE_CORRUPTED event emitted.
5028  * fatal will be ignored for read-only BDS; corruptions found there will always
5029  * be considered non-fatal.
5030  */
5031 void qcow2_signal_corruption(BlockDriverState *bs, bool fatal, int64_t offset,
5032                              int64_t size, const char *message_format, ...)
5033 {
5034     BDRVQcow2State *s = bs->opaque;
5035     const char *node_name;
5036     char *message;
5037     va_list ap;
5038 
5039     fatal = fatal && bdrv_is_writable(bs);
5040 
5041     if (s->signaled_corruption &&
5042         (!fatal || (s->incompatible_features & QCOW2_INCOMPAT_CORRUPT)))
5043     {
5044         return;
5045     }
5046 
5047     va_start(ap, message_format);
5048     message = g_strdup_vprintf(message_format, ap);
5049     va_end(ap);
5050 
5051     if (fatal) {
5052         fprintf(stderr, "qcow2: Marking image as corrupt: %s; further "
5053                 "corruption events will be suppressed\n", message);
5054     } else {
5055         fprintf(stderr, "qcow2: Image is corrupt: %s; further non-fatal "
5056                 "corruption events will be suppressed\n", message);
5057     }
5058 
5059     node_name = bdrv_get_node_name(bs);
5060     qapi_event_send_block_image_corrupted(bdrv_get_device_name(bs),
5061                                           *node_name != '\0', node_name,
5062                                           message, offset >= 0, offset,
5063                                           size >= 0, size,
5064                                           fatal);
5065     g_free(message);
5066 
5067     if (fatal) {
5068         qcow2_mark_corrupt(bs);
5069         bs->drv = NULL; /* make BDS unusable */
5070     }
5071 
5072     s->signaled_corruption = true;
5073 }
5074 
5075 static QemuOptsList qcow2_create_opts = {
5076     .name = "qcow2-create-opts",
5077     .head = QTAILQ_HEAD_INITIALIZER(qcow2_create_opts.head),
5078     .desc = {
5079         {
5080             .name = BLOCK_OPT_SIZE,
5081             .type = QEMU_OPT_SIZE,
5082             .help = "Virtual disk size"
5083         },
5084         {
5085             .name = BLOCK_OPT_COMPAT_LEVEL,
5086             .type = QEMU_OPT_STRING,
5087             .help = "Compatibility level (0.10 or 1.1)"
5088         },
5089         {
5090             .name = BLOCK_OPT_BACKING_FILE,
5091             .type = QEMU_OPT_STRING,
5092             .help = "File name of a base image"
5093         },
5094         {
5095             .name = BLOCK_OPT_BACKING_FMT,
5096             .type = QEMU_OPT_STRING,
5097             .help = "Image format of the base image"
5098         },
5099         {
5100             .name = BLOCK_OPT_DATA_FILE,
5101             .type = QEMU_OPT_STRING,
5102             .help = "File name of an external data file"
5103         },
5104         {
5105             .name = BLOCK_OPT_DATA_FILE_RAW,
5106             .type = QEMU_OPT_BOOL,
5107             .help = "The external data file must stay valid as a raw image"
5108         },
5109         {
5110             .name = BLOCK_OPT_ENCRYPT,
5111             .type = QEMU_OPT_BOOL,
5112             .help = "Encrypt the image with format 'aes'. (Deprecated "
5113                     "in favor of " BLOCK_OPT_ENCRYPT_FORMAT "=aes)",
5114         },
5115         {
5116             .name = BLOCK_OPT_ENCRYPT_FORMAT,
5117             .type = QEMU_OPT_STRING,
5118             .help = "Encrypt the image, format choices: 'aes', 'luks'",
5119         },
5120         BLOCK_CRYPTO_OPT_DEF_KEY_SECRET("encrypt.",
5121             "ID of secret providing qcow AES key or LUKS passphrase"),
5122         BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_ALG("encrypt."),
5123         BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_MODE("encrypt."),
5124         BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_ALG("encrypt."),
5125         BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_HASH_ALG("encrypt."),
5126         BLOCK_CRYPTO_OPT_DEF_LUKS_HASH_ALG("encrypt."),
5127         BLOCK_CRYPTO_OPT_DEF_LUKS_ITER_TIME("encrypt."),
5128         {
5129             .name = BLOCK_OPT_CLUSTER_SIZE,
5130             .type = QEMU_OPT_SIZE,
5131             .help = "qcow2 cluster size",
5132             .def_value_str = stringify(DEFAULT_CLUSTER_SIZE)
5133         },
5134         {
5135             .name = BLOCK_OPT_PREALLOC,
5136             .type = QEMU_OPT_STRING,
5137             .help = "Preallocation mode (allowed values: off, metadata, "
5138                     "falloc, full)"
5139         },
5140         {
5141             .name = BLOCK_OPT_LAZY_REFCOUNTS,
5142             .type = QEMU_OPT_BOOL,
5143             .help = "Postpone refcount updates",
5144             .def_value_str = "off"
5145         },
5146         {
5147             .name = BLOCK_OPT_REFCOUNT_BITS,
5148             .type = QEMU_OPT_NUMBER,
5149             .help = "Width of a reference count entry in bits",
5150             .def_value_str = "16"
5151         },
5152         { /* end of list */ }
5153     }
5154 };
5155 
5156 static const char *const qcow2_strong_runtime_opts[] = {
5157     "encrypt." BLOCK_CRYPTO_OPT_QCOW_KEY_SECRET,
5158 
5159     NULL
5160 };
5161 
5162 BlockDriver bdrv_qcow2 = {
5163     .format_name        = "qcow2",
5164     .instance_size      = sizeof(BDRVQcow2State),
5165     .bdrv_probe         = qcow2_probe,
5166     .bdrv_open          = qcow2_open,
5167     .bdrv_close         = qcow2_close,
5168     .bdrv_reopen_prepare  = qcow2_reopen_prepare,
5169     .bdrv_reopen_commit   = qcow2_reopen_commit,
5170     .bdrv_reopen_abort    = qcow2_reopen_abort,
5171     .bdrv_join_options    = qcow2_join_options,
5172     .bdrv_child_perm      = bdrv_format_default_perms,
5173     .bdrv_co_create_opts  = qcow2_co_create_opts,
5174     .bdrv_co_create       = qcow2_co_create,
5175     .bdrv_has_zero_init = bdrv_has_zero_init_1,
5176     .bdrv_co_block_status = qcow2_co_block_status,
5177 
5178     .bdrv_co_preadv         = qcow2_co_preadv,
5179     .bdrv_co_pwritev        = qcow2_co_pwritev,
5180     .bdrv_co_flush_to_os    = qcow2_co_flush_to_os,
5181 
5182     .bdrv_co_pwrite_zeroes  = qcow2_co_pwrite_zeroes,
5183     .bdrv_co_pdiscard       = qcow2_co_pdiscard,
5184     .bdrv_co_copy_range_from = qcow2_co_copy_range_from,
5185     .bdrv_co_copy_range_to  = qcow2_co_copy_range_to,
5186     .bdrv_co_truncate       = qcow2_co_truncate,
5187     .bdrv_co_pwritev_compressed = qcow2_co_pwritev_compressed,
5188     .bdrv_make_empty        = qcow2_make_empty,
5189 
5190     .bdrv_snapshot_create   = qcow2_snapshot_create,
5191     .bdrv_snapshot_goto     = qcow2_snapshot_goto,
5192     .bdrv_snapshot_delete   = qcow2_snapshot_delete,
5193     .bdrv_snapshot_list     = qcow2_snapshot_list,
5194     .bdrv_snapshot_load_tmp = qcow2_snapshot_load_tmp,
5195     .bdrv_measure           = qcow2_measure,
5196     .bdrv_get_info          = qcow2_get_info,
5197     .bdrv_get_specific_info = qcow2_get_specific_info,
5198 
5199     .bdrv_save_vmstate    = qcow2_save_vmstate,
5200     .bdrv_load_vmstate    = qcow2_load_vmstate,
5201 
5202     .supports_backing           = true,
5203     .bdrv_change_backing_file   = qcow2_change_backing_file,
5204 
5205     .bdrv_refresh_limits        = qcow2_refresh_limits,
5206     .bdrv_co_invalidate_cache   = qcow2_co_invalidate_cache,
5207     .bdrv_inactivate            = qcow2_inactivate,
5208 
5209     .create_opts         = &qcow2_create_opts,
5210     .strong_runtime_opts = qcow2_strong_runtime_opts,
5211     .mutable_opts        = mutable_opts,
5212     .bdrv_co_check       = qcow2_co_check,
5213     .bdrv_amend_options  = qcow2_amend_options,
5214 
5215     .bdrv_detach_aio_context  = qcow2_detach_aio_context,
5216     .bdrv_attach_aio_context  = qcow2_attach_aio_context,
5217 
5218     .bdrv_reopen_bitmaps_rw = qcow2_reopen_bitmaps_rw,
5219     .bdrv_can_store_new_dirty_bitmap = qcow2_can_store_new_dirty_bitmap,
5220     .bdrv_remove_persistent_dirty_bitmap = qcow2_remove_persistent_dirty_bitmap,
5221 };
5222 
5223 static void bdrv_qcow2_init(void)
5224 {
5225     bdrv_register(&bdrv_qcow2);
5226 }
5227 
5228 block_init(bdrv_qcow2_init);
5229