xref: /openbmc/qemu/block/qcow2.c (revision a8f07376c9b3e5bce736bdcf6f49dc63fa4a516b)
1 /*
2  * Block driver for the QCOW version 2 format
3  *
4  * Copyright (c) 2004-2006 Fabrice Bellard
5  *
6  * Permission is hereby granted, free of charge, to any person obtaining a copy
7  * of this software and associated documentation files (the "Software"), to deal
8  * in the Software without restriction, including without limitation the rights
9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10  * copies of the Software, and to permit persons to whom the Software is
11  * furnished to do so, subject to the following conditions:
12  *
13  * The above copyright notice and this permission notice shall be included in
14  * all copies or substantial portions of the Software.
15  *
16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22  * THE SOFTWARE.
23  */
24 
25 #include "qemu/osdep.h"
26 
27 #include "block/qdict.h"
28 #include "sysemu/block-backend.h"
29 #include "qemu/main-loop.h"
30 #include "qemu/module.h"
31 #include "qcow2.h"
32 #include "qemu/error-report.h"
33 #include "qapi/error.h"
34 #include "qapi/qapi-events-block-core.h"
35 #include "qapi/qmp/qdict.h"
36 #include "qapi/qmp/qstring.h"
37 #include "trace.h"
38 #include "qemu/option_int.h"
39 #include "qemu/cutils.h"
40 #include "qemu/bswap.h"
41 #include "qapi/qobject-input-visitor.h"
42 #include "qapi/qapi-visit-block-core.h"
43 #include "crypto.h"
44 
45 /*
46   Differences with QCOW:
47 
48   - Support for multiple incremental snapshots.
49   - Memory management by reference counts.
50   - Clusters which have a reference count of one have the bit
51     QCOW_OFLAG_COPIED to optimize write performance.
52   - Size of compressed clusters is stored in sectors to reduce bit usage
53     in the cluster offsets.
54   - Support for storing additional data (such as the VM state) in the
55     snapshots.
56   - If a backing store is used, the cluster size is not constrained
57     (could be backported to QCOW).
58   - L2 tables have always a size of one cluster.
59 */
60 
61 
62 typedef struct {
63     uint32_t magic;
64     uint32_t len;
65 } QEMU_PACKED QCowExtension;
66 
67 #define  QCOW2_EXT_MAGIC_END 0
68 #define  QCOW2_EXT_MAGIC_BACKING_FORMAT 0xE2792ACA
69 #define  QCOW2_EXT_MAGIC_FEATURE_TABLE 0x6803f857
70 #define  QCOW2_EXT_MAGIC_CRYPTO_HEADER 0x0537be77
71 #define  QCOW2_EXT_MAGIC_BITMAPS 0x23852875
72 #define  QCOW2_EXT_MAGIC_DATA_FILE 0x44415441
73 
74 static int coroutine_fn
75 qcow2_co_preadv_compressed(BlockDriverState *bs,
76                            uint64_t file_cluster_offset,
77                            uint64_t offset,
78                            uint64_t bytes,
79                            QEMUIOVector *qiov,
80                            size_t qiov_offset);
81 
82 static int qcow2_probe(const uint8_t *buf, int buf_size, const char *filename)
83 {
84     const QCowHeader *cow_header = (const void *)buf;
85 
86     if (buf_size >= sizeof(QCowHeader) &&
87         be32_to_cpu(cow_header->magic) == QCOW_MAGIC &&
88         be32_to_cpu(cow_header->version) >= 2)
89         return 100;
90     else
91         return 0;
92 }
93 
94 
95 static ssize_t qcow2_crypto_hdr_read_func(QCryptoBlock *block, size_t offset,
96                                           uint8_t *buf, size_t buflen,
97                                           void *opaque, Error **errp)
98 {
99     BlockDriverState *bs = opaque;
100     BDRVQcow2State *s = bs->opaque;
101     ssize_t ret;
102 
103     if ((offset + buflen) > s->crypto_header.length) {
104         error_setg(errp, "Request for data outside of extension header");
105         return -1;
106     }
107 
108     ret = bdrv_pread(bs->file,
109                      s->crypto_header.offset + offset, buf, buflen);
110     if (ret < 0) {
111         error_setg_errno(errp, -ret, "Could not read encryption header");
112         return -1;
113     }
114     return ret;
115 }
116 
117 
118 static ssize_t qcow2_crypto_hdr_init_func(QCryptoBlock *block, size_t headerlen,
119                                           void *opaque, Error **errp)
120 {
121     BlockDriverState *bs = opaque;
122     BDRVQcow2State *s = bs->opaque;
123     int64_t ret;
124     int64_t clusterlen;
125 
126     ret = qcow2_alloc_clusters(bs, headerlen);
127     if (ret < 0) {
128         error_setg_errno(errp, -ret,
129                          "Cannot allocate cluster for LUKS header size %zu",
130                          headerlen);
131         return -1;
132     }
133 
134     s->crypto_header.length = headerlen;
135     s->crypto_header.offset = ret;
136 
137     /* Zero fill remaining space in cluster so it has predictable
138      * content in case of future spec changes */
139     clusterlen = size_to_clusters(s, headerlen) * s->cluster_size;
140     assert(qcow2_pre_write_overlap_check(bs, 0, ret, clusterlen, false) == 0);
141     ret = bdrv_pwrite_zeroes(bs->file,
142                              ret + headerlen,
143                              clusterlen - headerlen, 0);
144     if (ret < 0) {
145         error_setg_errno(errp, -ret, "Could not zero fill encryption header");
146         return -1;
147     }
148 
149     return ret;
150 }
151 
152 
153 static ssize_t qcow2_crypto_hdr_write_func(QCryptoBlock *block, size_t offset,
154                                            const uint8_t *buf, size_t buflen,
155                                            void *opaque, Error **errp)
156 {
157     BlockDriverState *bs = opaque;
158     BDRVQcow2State *s = bs->opaque;
159     ssize_t ret;
160 
161     if ((offset + buflen) > s->crypto_header.length) {
162         error_setg(errp, "Request for data outside of extension header");
163         return -1;
164     }
165 
166     ret = bdrv_pwrite(bs->file,
167                       s->crypto_header.offset + offset, buf, buflen);
168     if (ret < 0) {
169         error_setg_errno(errp, -ret, "Could not read encryption header");
170         return -1;
171     }
172     return ret;
173 }
174 
175 
176 /*
177  * read qcow2 extension and fill bs
178  * start reading from start_offset
179  * finish reading upon magic of value 0 or when end_offset reached
180  * unknown magic is skipped (future extension this version knows nothing about)
181  * return 0 upon success, non-0 otherwise
182  */
183 static int qcow2_read_extensions(BlockDriverState *bs, uint64_t start_offset,
184                                  uint64_t end_offset, void **p_feature_table,
185                                  int flags, bool *need_update_header,
186                                  Error **errp)
187 {
188     BDRVQcow2State *s = bs->opaque;
189     QCowExtension ext;
190     uint64_t offset;
191     int ret;
192     Qcow2BitmapHeaderExt bitmaps_ext;
193 
194     if (need_update_header != NULL) {
195         *need_update_header = false;
196     }
197 
198 #ifdef DEBUG_EXT
199     printf("qcow2_read_extensions: start=%ld end=%ld\n", start_offset, end_offset);
200 #endif
201     offset = start_offset;
202     while (offset < end_offset) {
203 
204 #ifdef DEBUG_EXT
205         /* Sanity check */
206         if (offset > s->cluster_size)
207             printf("qcow2_read_extension: suspicious offset %lu\n", offset);
208 
209         printf("attempting to read extended header in offset %lu\n", offset);
210 #endif
211 
212         ret = bdrv_pread(bs->file, offset, &ext, sizeof(ext));
213         if (ret < 0) {
214             error_setg_errno(errp, -ret, "qcow2_read_extension: ERROR: "
215                              "pread fail from offset %" PRIu64, offset);
216             return 1;
217         }
218         ext.magic = be32_to_cpu(ext.magic);
219         ext.len = be32_to_cpu(ext.len);
220         offset += sizeof(ext);
221 #ifdef DEBUG_EXT
222         printf("ext.magic = 0x%x\n", ext.magic);
223 #endif
224         if (offset > end_offset || ext.len > end_offset - offset) {
225             error_setg(errp, "Header extension too large");
226             return -EINVAL;
227         }
228 
229         switch (ext.magic) {
230         case QCOW2_EXT_MAGIC_END:
231             return 0;
232 
233         case QCOW2_EXT_MAGIC_BACKING_FORMAT:
234             if (ext.len >= sizeof(bs->backing_format)) {
235                 error_setg(errp, "ERROR: ext_backing_format: len=%" PRIu32
236                            " too large (>=%zu)", ext.len,
237                            sizeof(bs->backing_format));
238                 return 2;
239             }
240             ret = bdrv_pread(bs->file, offset, bs->backing_format, ext.len);
241             if (ret < 0) {
242                 error_setg_errno(errp, -ret, "ERROR: ext_backing_format: "
243                                  "Could not read format name");
244                 return 3;
245             }
246             bs->backing_format[ext.len] = '\0';
247             s->image_backing_format = g_strdup(bs->backing_format);
248 #ifdef DEBUG_EXT
249             printf("Qcow2: Got format extension %s\n", bs->backing_format);
250 #endif
251             break;
252 
253         case QCOW2_EXT_MAGIC_FEATURE_TABLE:
254             if (p_feature_table != NULL) {
255                 void* feature_table = g_malloc0(ext.len + 2 * sizeof(Qcow2Feature));
256                 ret = bdrv_pread(bs->file, offset , feature_table, ext.len);
257                 if (ret < 0) {
258                     error_setg_errno(errp, -ret, "ERROR: ext_feature_table: "
259                                      "Could not read table");
260                     return ret;
261                 }
262 
263                 *p_feature_table = feature_table;
264             }
265             break;
266 
267         case QCOW2_EXT_MAGIC_CRYPTO_HEADER: {
268             unsigned int cflags = 0;
269             if (s->crypt_method_header != QCOW_CRYPT_LUKS) {
270                 error_setg(errp, "CRYPTO header extension only "
271                            "expected with LUKS encryption method");
272                 return -EINVAL;
273             }
274             if (ext.len != sizeof(Qcow2CryptoHeaderExtension)) {
275                 error_setg(errp, "CRYPTO header extension size %u, "
276                            "but expected size %zu", ext.len,
277                            sizeof(Qcow2CryptoHeaderExtension));
278                 return -EINVAL;
279             }
280 
281             ret = bdrv_pread(bs->file, offset, &s->crypto_header, ext.len);
282             if (ret < 0) {
283                 error_setg_errno(errp, -ret,
284                                  "Unable to read CRYPTO header extension");
285                 return ret;
286             }
287             s->crypto_header.offset = be64_to_cpu(s->crypto_header.offset);
288             s->crypto_header.length = be64_to_cpu(s->crypto_header.length);
289 
290             if ((s->crypto_header.offset % s->cluster_size) != 0) {
291                 error_setg(errp, "Encryption header offset '%" PRIu64 "' is "
292                            "not a multiple of cluster size '%u'",
293                            s->crypto_header.offset, s->cluster_size);
294                 return -EINVAL;
295             }
296 
297             if (flags & BDRV_O_NO_IO) {
298                 cflags |= QCRYPTO_BLOCK_OPEN_NO_IO;
299             }
300             s->crypto = qcrypto_block_open(s->crypto_opts, "encrypt.",
301                                            qcow2_crypto_hdr_read_func,
302                                            bs, cflags, QCOW2_MAX_THREADS, errp);
303             if (!s->crypto) {
304                 return -EINVAL;
305             }
306         }   break;
307 
308         case QCOW2_EXT_MAGIC_BITMAPS:
309             if (ext.len != sizeof(bitmaps_ext)) {
310                 error_setg_errno(errp, -ret, "bitmaps_ext: "
311                                  "Invalid extension length");
312                 return -EINVAL;
313             }
314 
315             if (!(s->autoclear_features & QCOW2_AUTOCLEAR_BITMAPS)) {
316                 if (s->qcow_version < 3) {
317                     /* Let's be a bit more specific */
318                     warn_report("This qcow2 v2 image contains bitmaps, but "
319                                 "they may have been modified by a program "
320                                 "without persistent bitmap support; so now "
321                                 "they must all be considered inconsistent");
322                 } else {
323                     warn_report("a program lacking bitmap support "
324                                 "modified this file, so all bitmaps are now "
325                                 "considered inconsistent");
326                 }
327                 error_printf("Some clusters may be leaked, "
328                              "run 'qemu-img check -r' on the image "
329                              "file to fix.");
330                 if (need_update_header != NULL) {
331                     /* Updating is needed to drop invalid bitmap extension. */
332                     *need_update_header = true;
333                 }
334                 break;
335             }
336 
337             ret = bdrv_pread(bs->file, offset, &bitmaps_ext, ext.len);
338             if (ret < 0) {
339                 error_setg_errno(errp, -ret, "bitmaps_ext: "
340                                  "Could not read ext header");
341                 return ret;
342             }
343 
344             if (bitmaps_ext.reserved32 != 0) {
345                 error_setg_errno(errp, -ret, "bitmaps_ext: "
346                                  "Reserved field is not zero");
347                 return -EINVAL;
348             }
349 
350             bitmaps_ext.nb_bitmaps = be32_to_cpu(bitmaps_ext.nb_bitmaps);
351             bitmaps_ext.bitmap_directory_size =
352                 be64_to_cpu(bitmaps_ext.bitmap_directory_size);
353             bitmaps_ext.bitmap_directory_offset =
354                 be64_to_cpu(bitmaps_ext.bitmap_directory_offset);
355 
356             if (bitmaps_ext.nb_bitmaps > QCOW2_MAX_BITMAPS) {
357                 error_setg(errp,
358                            "bitmaps_ext: Image has %" PRIu32 " bitmaps, "
359                            "exceeding the QEMU supported maximum of %d",
360                            bitmaps_ext.nb_bitmaps, QCOW2_MAX_BITMAPS);
361                 return -EINVAL;
362             }
363 
364             if (bitmaps_ext.nb_bitmaps == 0) {
365                 error_setg(errp, "found bitmaps extension with zero bitmaps");
366                 return -EINVAL;
367             }
368 
369             if (bitmaps_ext.bitmap_directory_offset & (s->cluster_size - 1)) {
370                 error_setg(errp, "bitmaps_ext: "
371                                  "invalid bitmap directory offset");
372                 return -EINVAL;
373             }
374 
375             if (bitmaps_ext.bitmap_directory_size >
376                 QCOW2_MAX_BITMAP_DIRECTORY_SIZE) {
377                 error_setg(errp, "bitmaps_ext: "
378                                  "bitmap directory size (%" PRIu64 ") exceeds "
379                                  "the maximum supported size (%d)",
380                                  bitmaps_ext.bitmap_directory_size,
381                                  QCOW2_MAX_BITMAP_DIRECTORY_SIZE);
382                 return -EINVAL;
383             }
384 
385             s->nb_bitmaps = bitmaps_ext.nb_bitmaps;
386             s->bitmap_directory_offset =
387                     bitmaps_ext.bitmap_directory_offset;
388             s->bitmap_directory_size =
389                     bitmaps_ext.bitmap_directory_size;
390 
391 #ifdef DEBUG_EXT
392             printf("Qcow2: Got bitmaps extension: "
393                    "offset=%" PRIu64 " nb_bitmaps=%" PRIu32 "\n",
394                    s->bitmap_directory_offset, s->nb_bitmaps);
395 #endif
396             break;
397 
398         case QCOW2_EXT_MAGIC_DATA_FILE:
399         {
400             s->image_data_file = g_malloc0(ext.len + 1);
401             ret = bdrv_pread(bs->file, offset, s->image_data_file, ext.len);
402             if (ret < 0) {
403                 error_setg_errno(errp, -ret,
404                                  "ERROR: Could not read data file name");
405                 return ret;
406             }
407 #ifdef DEBUG_EXT
408             printf("Qcow2: Got external data file %s\n", s->image_data_file);
409 #endif
410             break;
411         }
412 
413         default:
414             /* unknown magic - save it in case we need to rewrite the header */
415             /* If you add a new feature, make sure to also update the fast
416              * path of qcow2_make_empty() to deal with it. */
417             {
418                 Qcow2UnknownHeaderExtension *uext;
419 
420                 uext = g_malloc0(sizeof(*uext)  + ext.len);
421                 uext->magic = ext.magic;
422                 uext->len = ext.len;
423                 QLIST_INSERT_HEAD(&s->unknown_header_ext, uext, next);
424 
425                 ret = bdrv_pread(bs->file, offset , uext->data, uext->len);
426                 if (ret < 0) {
427                     error_setg_errno(errp, -ret, "ERROR: unknown extension: "
428                                      "Could not read data");
429                     return ret;
430                 }
431             }
432             break;
433         }
434 
435         offset += ((ext.len + 7) & ~7);
436     }
437 
438     return 0;
439 }
440 
441 static void cleanup_unknown_header_ext(BlockDriverState *bs)
442 {
443     BDRVQcow2State *s = bs->opaque;
444     Qcow2UnknownHeaderExtension *uext, *next;
445 
446     QLIST_FOREACH_SAFE(uext, &s->unknown_header_ext, next, next) {
447         QLIST_REMOVE(uext, next);
448         g_free(uext);
449     }
450 }
451 
452 static void report_unsupported_feature(Error **errp, Qcow2Feature *table,
453                                        uint64_t mask)
454 {
455     char *features = g_strdup("");
456     char *old;
457 
458     while (table && table->name[0] != '\0') {
459         if (table->type == QCOW2_FEAT_TYPE_INCOMPATIBLE) {
460             if (mask & (1ULL << table->bit)) {
461                 old = features;
462                 features = g_strdup_printf("%s%s%.46s", old, *old ? ", " : "",
463                                            table->name);
464                 g_free(old);
465                 mask &= ~(1ULL << table->bit);
466             }
467         }
468         table++;
469     }
470 
471     if (mask) {
472         old = features;
473         features = g_strdup_printf("%s%sUnknown incompatible feature: %" PRIx64,
474                                    old, *old ? ", " : "", mask);
475         g_free(old);
476     }
477 
478     error_setg(errp, "Unsupported qcow2 feature(s): %s", features);
479     g_free(features);
480 }
481 
482 /*
483  * Sets the dirty bit and flushes afterwards if necessary.
484  *
485  * The incompatible_features bit is only set if the image file header was
486  * updated successfully.  Therefore it is not required to check the return
487  * value of this function.
488  */
489 int qcow2_mark_dirty(BlockDriverState *bs)
490 {
491     BDRVQcow2State *s = bs->opaque;
492     uint64_t val;
493     int ret;
494 
495     assert(s->qcow_version >= 3);
496 
497     if (s->incompatible_features & QCOW2_INCOMPAT_DIRTY) {
498         return 0; /* already dirty */
499     }
500 
501     val = cpu_to_be64(s->incompatible_features | QCOW2_INCOMPAT_DIRTY);
502     ret = bdrv_pwrite(bs->file, offsetof(QCowHeader, incompatible_features),
503                       &val, sizeof(val));
504     if (ret < 0) {
505         return ret;
506     }
507     ret = bdrv_flush(bs->file->bs);
508     if (ret < 0) {
509         return ret;
510     }
511 
512     /* Only treat image as dirty if the header was updated successfully */
513     s->incompatible_features |= QCOW2_INCOMPAT_DIRTY;
514     return 0;
515 }
516 
517 /*
518  * Clears the dirty bit and flushes before if necessary.  Only call this
519  * function when there are no pending requests, it does not guard against
520  * concurrent requests dirtying the image.
521  */
522 static int qcow2_mark_clean(BlockDriverState *bs)
523 {
524     BDRVQcow2State *s = bs->opaque;
525 
526     if (s->incompatible_features & QCOW2_INCOMPAT_DIRTY) {
527         int ret;
528 
529         s->incompatible_features &= ~QCOW2_INCOMPAT_DIRTY;
530 
531         ret = qcow2_flush_caches(bs);
532         if (ret < 0) {
533             return ret;
534         }
535 
536         return qcow2_update_header(bs);
537     }
538     return 0;
539 }
540 
541 /*
542  * Marks the image as corrupt.
543  */
544 int qcow2_mark_corrupt(BlockDriverState *bs)
545 {
546     BDRVQcow2State *s = bs->opaque;
547 
548     s->incompatible_features |= QCOW2_INCOMPAT_CORRUPT;
549     return qcow2_update_header(bs);
550 }
551 
552 /*
553  * Marks the image as consistent, i.e., unsets the corrupt bit, and flushes
554  * before if necessary.
555  */
556 int qcow2_mark_consistent(BlockDriverState *bs)
557 {
558     BDRVQcow2State *s = bs->opaque;
559 
560     if (s->incompatible_features & QCOW2_INCOMPAT_CORRUPT) {
561         int ret = qcow2_flush_caches(bs);
562         if (ret < 0) {
563             return ret;
564         }
565 
566         s->incompatible_features &= ~QCOW2_INCOMPAT_CORRUPT;
567         return qcow2_update_header(bs);
568     }
569     return 0;
570 }
571 
572 static int coroutine_fn qcow2_co_check_locked(BlockDriverState *bs,
573                                               BdrvCheckResult *result,
574                                               BdrvCheckMode fix)
575 {
576     int ret = qcow2_check_refcounts(bs, result, fix);
577     if (ret < 0) {
578         return ret;
579     }
580 
581     if (fix && result->check_errors == 0 && result->corruptions == 0) {
582         ret = qcow2_mark_clean(bs);
583         if (ret < 0) {
584             return ret;
585         }
586         return qcow2_mark_consistent(bs);
587     }
588     return ret;
589 }
590 
591 static int coroutine_fn qcow2_co_check(BlockDriverState *bs,
592                                        BdrvCheckResult *result,
593                                        BdrvCheckMode fix)
594 {
595     BDRVQcow2State *s = bs->opaque;
596     int ret;
597 
598     qemu_co_mutex_lock(&s->lock);
599     ret = qcow2_co_check_locked(bs, result, fix);
600     qemu_co_mutex_unlock(&s->lock);
601     return ret;
602 }
603 
604 int qcow2_validate_table(BlockDriverState *bs, uint64_t offset,
605                          uint64_t entries, size_t entry_len,
606                          int64_t max_size_bytes, const char *table_name,
607                          Error **errp)
608 {
609     BDRVQcow2State *s = bs->opaque;
610 
611     if (entries > max_size_bytes / entry_len) {
612         error_setg(errp, "%s too large", table_name);
613         return -EFBIG;
614     }
615 
616     /* Use signed INT64_MAX as the maximum even for uint64_t header fields,
617      * because values will be passed to qemu functions taking int64_t. */
618     if ((INT64_MAX - entries * entry_len < offset) ||
619         (offset_into_cluster(s, offset) != 0)) {
620         error_setg(errp, "%s offset invalid", table_name);
621         return -EINVAL;
622     }
623 
624     return 0;
625 }
626 
627 static const char *const mutable_opts[] = {
628     QCOW2_OPT_LAZY_REFCOUNTS,
629     QCOW2_OPT_DISCARD_REQUEST,
630     QCOW2_OPT_DISCARD_SNAPSHOT,
631     QCOW2_OPT_DISCARD_OTHER,
632     QCOW2_OPT_OVERLAP,
633     QCOW2_OPT_OVERLAP_TEMPLATE,
634     QCOW2_OPT_OVERLAP_MAIN_HEADER,
635     QCOW2_OPT_OVERLAP_ACTIVE_L1,
636     QCOW2_OPT_OVERLAP_ACTIVE_L2,
637     QCOW2_OPT_OVERLAP_REFCOUNT_TABLE,
638     QCOW2_OPT_OVERLAP_REFCOUNT_BLOCK,
639     QCOW2_OPT_OVERLAP_SNAPSHOT_TABLE,
640     QCOW2_OPT_OVERLAP_INACTIVE_L1,
641     QCOW2_OPT_OVERLAP_INACTIVE_L2,
642     QCOW2_OPT_OVERLAP_BITMAP_DIRECTORY,
643     QCOW2_OPT_CACHE_SIZE,
644     QCOW2_OPT_L2_CACHE_SIZE,
645     QCOW2_OPT_L2_CACHE_ENTRY_SIZE,
646     QCOW2_OPT_REFCOUNT_CACHE_SIZE,
647     QCOW2_OPT_CACHE_CLEAN_INTERVAL,
648     NULL
649 };
650 
651 static QemuOptsList qcow2_runtime_opts = {
652     .name = "qcow2",
653     .head = QTAILQ_HEAD_INITIALIZER(qcow2_runtime_opts.head),
654     .desc = {
655         {
656             .name = QCOW2_OPT_LAZY_REFCOUNTS,
657             .type = QEMU_OPT_BOOL,
658             .help = "Postpone refcount updates",
659         },
660         {
661             .name = QCOW2_OPT_DISCARD_REQUEST,
662             .type = QEMU_OPT_BOOL,
663             .help = "Pass guest discard requests to the layer below",
664         },
665         {
666             .name = QCOW2_OPT_DISCARD_SNAPSHOT,
667             .type = QEMU_OPT_BOOL,
668             .help = "Generate discard requests when snapshot related space "
669                     "is freed",
670         },
671         {
672             .name = QCOW2_OPT_DISCARD_OTHER,
673             .type = QEMU_OPT_BOOL,
674             .help = "Generate discard requests when other clusters are freed",
675         },
676         {
677             .name = QCOW2_OPT_OVERLAP,
678             .type = QEMU_OPT_STRING,
679             .help = "Selects which overlap checks to perform from a range of "
680                     "templates (none, constant, cached, all)",
681         },
682         {
683             .name = QCOW2_OPT_OVERLAP_TEMPLATE,
684             .type = QEMU_OPT_STRING,
685             .help = "Selects which overlap checks to perform from a range of "
686                     "templates (none, constant, cached, all)",
687         },
688         {
689             .name = QCOW2_OPT_OVERLAP_MAIN_HEADER,
690             .type = QEMU_OPT_BOOL,
691             .help = "Check for unintended writes into the main qcow2 header",
692         },
693         {
694             .name = QCOW2_OPT_OVERLAP_ACTIVE_L1,
695             .type = QEMU_OPT_BOOL,
696             .help = "Check for unintended writes into the active L1 table",
697         },
698         {
699             .name = QCOW2_OPT_OVERLAP_ACTIVE_L2,
700             .type = QEMU_OPT_BOOL,
701             .help = "Check for unintended writes into an active L2 table",
702         },
703         {
704             .name = QCOW2_OPT_OVERLAP_REFCOUNT_TABLE,
705             .type = QEMU_OPT_BOOL,
706             .help = "Check for unintended writes into the refcount table",
707         },
708         {
709             .name = QCOW2_OPT_OVERLAP_REFCOUNT_BLOCK,
710             .type = QEMU_OPT_BOOL,
711             .help = "Check for unintended writes into a refcount block",
712         },
713         {
714             .name = QCOW2_OPT_OVERLAP_SNAPSHOT_TABLE,
715             .type = QEMU_OPT_BOOL,
716             .help = "Check for unintended writes into the snapshot table",
717         },
718         {
719             .name = QCOW2_OPT_OVERLAP_INACTIVE_L1,
720             .type = QEMU_OPT_BOOL,
721             .help = "Check for unintended writes into an inactive L1 table",
722         },
723         {
724             .name = QCOW2_OPT_OVERLAP_INACTIVE_L2,
725             .type = QEMU_OPT_BOOL,
726             .help = "Check for unintended writes into an inactive L2 table",
727         },
728         {
729             .name = QCOW2_OPT_OVERLAP_BITMAP_DIRECTORY,
730             .type = QEMU_OPT_BOOL,
731             .help = "Check for unintended writes into the bitmap directory",
732         },
733         {
734             .name = QCOW2_OPT_CACHE_SIZE,
735             .type = QEMU_OPT_SIZE,
736             .help = "Maximum combined metadata (L2 tables and refcount blocks) "
737                     "cache size",
738         },
739         {
740             .name = QCOW2_OPT_L2_CACHE_SIZE,
741             .type = QEMU_OPT_SIZE,
742             .help = "Maximum L2 table cache size",
743         },
744         {
745             .name = QCOW2_OPT_L2_CACHE_ENTRY_SIZE,
746             .type = QEMU_OPT_SIZE,
747             .help = "Size of each entry in the L2 cache",
748         },
749         {
750             .name = QCOW2_OPT_REFCOUNT_CACHE_SIZE,
751             .type = QEMU_OPT_SIZE,
752             .help = "Maximum refcount block cache size",
753         },
754         {
755             .name = QCOW2_OPT_CACHE_CLEAN_INTERVAL,
756             .type = QEMU_OPT_NUMBER,
757             .help = "Clean unused cache entries after this time (in seconds)",
758         },
759         BLOCK_CRYPTO_OPT_DEF_KEY_SECRET("encrypt.",
760             "ID of secret providing qcow2 AES key or LUKS passphrase"),
761         { /* end of list */ }
762     },
763 };
764 
765 static const char *overlap_bool_option_names[QCOW2_OL_MAX_BITNR] = {
766     [QCOW2_OL_MAIN_HEADER_BITNR]      = QCOW2_OPT_OVERLAP_MAIN_HEADER,
767     [QCOW2_OL_ACTIVE_L1_BITNR]        = QCOW2_OPT_OVERLAP_ACTIVE_L1,
768     [QCOW2_OL_ACTIVE_L2_BITNR]        = QCOW2_OPT_OVERLAP_ACTIVE_L2,
769     [QCOW2_OL_REFCOUNT_TABLE_BITNR]   = QCOW2_OPT_OVERLAP_REFCOUNT_TABLE,
770     [QCOW2_OL_REFCOUNT_BLOCK_BITNR]   = QCOW2_OPT_OVERLAP_REFCOUNT_BLOCK,
771     [QCOW2_OL_SNAPSHOT_TABLE_BITNR]   = QCOW2_OPT_OVERLAP_SNAPSHOT_TABLE,
772     [QCOW2_OL_INACTIVE_L1_BITNR]      = QCOW2_OPT_OVERLAP_INACTIVE_L1,
773     [QCOW2_OL_INACTIVE_L2_BITNR]      = QCOW2_OPT_OVERLAP_INACTIVE_L2,
774     [QCOW2_OL_BITMAP_DIRECTORY_BITNR] = QCOW2_OPT_OVERLAP_BITMAP_DIRECTORY,
775 };
776 
777 static void cache_clean_timer_cb(void *opaque)
778 {
779     BlockDriverState *bs = opaque;
780     BDRVQcow2State *s = bs->opaque;
781     qcow2_cache_clean_unused(s->l2_table_cache);
782     qcow2_cache_clean_unused(s->refcount_block_cache);
783     timer_mod(s->cache_clean_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) +
784               (int64_t) s->cache_clean_interval * 1000);
785 }
786 
787 static void cache_clean_timer_init(BlockDriverState *bs, AioContext *context)
788 {
789     BDRVQcow2State *s = bs->opaque;
790     if (s->cache_clean_interval > 0) {
791         s->cache_clean_timer = aio_timer_new(context, QEMU_CLOCK_VIRTUAL,
792                                              SCALE_MS, cache_clean_timer_cb,
793                                              bs);
794         timer_mod(s->cache_clean_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) +
795                   (int64_t) s->cache_clean_interval * 1000);
796     }
797 }
798 
799 static void cache_clean_timer_del(BlockDriverState *bs)
800 {
801     BDRVQcow2State *s = bs->opaque;
802     if (s->cache_clean_timer) {
803         timer_del(s->cache_clean_timer);
804         timer_free(s->cache_clean_timer);
805         s->cache_clean_timer = NULL;
806     }
807 }
808 
809 static void qcow2_detach_aio_context(BlockDriverState *bs)
810 {
811     cache_clean_timer_del(bs);
812 }
813 
814 static void qcow2_attach_aio_context(BlockDriverState *bs,
815                                      AioContext *new_context)
816 {
817     cache_clean_timer_init(bs, new_context);
818 }
819 
820 static void read_cache_sizes(BlockDriverState *bs, QemuOpts *opts,
821                              uint64_t *l2_cache_size,
822                              uint64_t *l2_cache_entry_size,
823                              uint64_t *refcount_cache_size, Error **errp)
824 {
825     BDRVQcow2State *s = bs->opaque;
826     uint64_t combined_cache_size, l2_cache_max_setting;
827     bool l2_cache_size_set, refcount_cache_size_set, combined_cache_size_set;
828     bool l2_cache_entry_size_set;
829     int min_refcount_cache = MIN_REFCOUNT_CACHE_SIZE * s->cluster_size;
830     uint64_t virtual_disk_size = bs->total_sectors * BDRV_SECTOR_SIZE;
831     uint64_t max_l2_entries = DIV_ROUND_UP(virtual_disk_size, s->cluster_size);
832     /* An L2 table is always one cluster in size so the max cache size
833      * should be a multiple of the cluster size. */
834     uint64_t max_l2_cache = ROUND_UP(max_l2_entries * sizeof(uint64_t),
835                                      s->cluster_size);
836 
837     combined_cache_size_set = qemu_opt_get(opts, QCOW2_OPT_CACHE_SIZE);
838     l2_cache_size_set = qemu_opt_get(opts, QCOW2_OPT_L2_CACHE_SIZE);
839     refcount_cache_size_set = qemu_opt_get(opts, QCOW2_OPT_REFCOUNT_CACHE_SIZE);
840     l2_cache_entry_size_set = qemu_opt_get(opts, QCOW2_OPT_L2_CACHE_ENTRY_SIZE);
841 
842     combined_cache_size = qemu_opt_get_size(opts, QCOW2_OPT_CACHE_SIZE, 0);
843     l2_cache_max_setting = qemu_opt_get_size(opts, QCOW2_OPT_L2_CACHE_SIZE,
844                                              DEFAULT_L2_CACHE_MAX_SIZE);
845     *refcount_cache_size = qemu_opt_get_size(opts,
846                                              QCOW2_OPT_REFCOUNT_CACHE_SIZE, 0);
847 
848     *l2_cache_entry_size = qemu_opt_get_size(
849         opts, QCOW2_OPT_L2_CACHE_ENTRY_SIZE, s->cluster_size);
850 
851     *l2_cache_size = MIN(max_l2_cache, l2_cache_max_setting);
852 
853     if (combined_cache_size_set) {
854         if (l2_cache_size_set && refcount_cache_size_set) {
855             error_setg(errp, QCOW2_OPT_CACHE_SIZE ", " QCOW2_OPT_L2_CACHE_SIZE
856                        " and " QCOW2_OPT_REFCOUNT_CACHE_SIZE " may not be set "
857                        "at the same time");
858             return;
859         } else if (l2_cache_size_set &&
860                    (l2_cache_max_setting > combined_cache_size)) {
861             error_setg(errp, QCOW2_OPT_L2_CACHE_SIZE " may not exceed "
862                        QCOW2_OPT_CACHE_SIZE);
863             return;
864         } else if (*refcount_cache_size > combined_cache_size) {
865             error_setg(errp, QCOW2_OPT_REFCOUNT_CACHE_SIZE " may not exceed "
866                        QCOW2_OPT_CACHE_SIZE);
867             return;
868         }
869 
870         if (l2_cache_size_set) {
871             *refcount_cache_size = combined_cache_size - *l2_cache_size;
872         } else if (refcount_cache_size_set) {
873             *l2_cache_size = combined_cache_size - *refcount_cache_size;
874         } else {
875             /* Assign as much memory as possible to the L2 cache, and
876              * use the remainder for the refcount cache */
877             if (combined_cache_size >= max_l2_cache + min_refcount_cache) {
878                 *l2_cache_size = max_l2_cache;
879                 *refcount_cache_size = combined_cache_size - *l2_cache_size;
880             } else {
881                 *refcount_cache_size =
882                     MIN(combined_cache_size, min_refcount_cache);
883                 *l2_cache_size = combined_cache_size - *refcount_cache_size;
884             }
885         }
886     }
887 
888     /*
889      * If the L2 cache is not enough to cover the whole disk then
890      * default to 4KB entries. Smaller entries reduce the cost of
891      * loads and evictions and increase I/O performance.
892      */
893     if (*l2_cache_size < max_l2_cache && !l2_cache_entry_size_set) {
894         *l2_cache_entry_size = MIN(s->cluster_size, 4096);
895     }
896 
897     /* l2_cache_size and refcount_cache_size are ensured to have at least
898      * their minimum values in qcow2_update_options_prepare() */
899 
900     if (*l2_cache_entry_size < (1 << MIN_CLUSTER_BITS) ||
901         *l2_cache_entry_size > s->cluster_size ||
902         !is_power_of_2(*l2_cache_entry_size)) {
903         error_setg(errp, "L2 cache entry size must be a power of two "
904                    "between %d and the cluster size (%d)",
905                    1 << MIN_CLUSTER_BITS, s->cluster_size);
906         return;
907     }
908 }
909 
910 typedef struct Qcow2ReopenState {
911     Qcow2Cache *l2_table_cache;
912     Qcow2Cache *refcount_block_cache;
913     int l2_slice_size; /* Number of entries in a slice of the L2 table */
914     bool use_lazy_refcounts;
915     int overlap_check;
916     bool discard_passthrough[QCOW2_DISCARD_MAX];
917     uint64_t cache_clean_interval;
918     QCryptoBlockOpenOptions *crypto_opts; /* Disk encryption runtime options */
919 } Qcow2ReopenState;
920 
921 static int qcow2_update_options_prepare(BlockDriverState *bs,
922                                         Qcow2ReopenState *r,
923                                         QDict *options, int flags,
924                                         Error **errp)
925 {
926     BDRVQcow2State *s = bs->opaque;
927     QemuOpts *opts = NULL;
928     const char *opt_overlap_check, *opt_overlap_check_template;
929     int overlap_check_template = 0;
930     uint64_t l2_cache_size, l2_cache_entry_size, refcount_cache_size;
931     int i;
932     const char *encryptfmt;
933     QDict *encryptopts = NULL;
934     Error *local_err = NULL;
935     int ret;
936 
937     qdict_extract_subqdict(options, &encryptopts, "encrypt.");
938     encryptfmt = qdict_get_try_str(encryptopts, "format");
939 
940     opts = qemu_opts_create(&qcow2_runtime_opts, NULL, 0, &error_abort);
941     qemu_opts_absorb_qdict(opts, options, &local_err);
942     if (local_err) {
943         error_propagate(errp, local_err);
944         ret = -EINVAL;
945         goto fail;
946     }
947 
948     /* get L2 table/refcount block cache size from command line options */
949     read_cache_sizes(bs, opts, &l2_cache_size, &l2_cache_entry_size,
950                      &refcount_cache_size, &local_err);
951     if (local_err) {
952         error_propagate(errp, local_err);
953         ret = -EINVAL;
954         goto fail;
955     }
956 
957     l2_cache_size /= l2_cache_entry_size;
958     if (l2_cache_size < MIN_L2_CACHE_SIZE) {
959         l2_cache_size = MIN_L2_CACHE_SIZE;
960     }
961     if (l2_cache_size > INT_MAX) {
962         error_setg(errp, "L2 cache size too big");
963         ret = -EINVAL;
964         goto fail;
965     }
966 
967     refcount_cache_size /= s->cluster_size;
968     if (refcount_cache_size < MIN_REFCOUNT_CACHE_SIZE) {
969         refcount_cache_size = MIN_REFCOUNT_CACHE_SIZE;
970     }
971     if (refcount_cache_size > INT_MAX) {
972         error_setg(errp, "Refcount cache size too big");
973         ret = -EINVAL;
974         goto fail;
975     }
976 
977     /* alloc new L2 table/refcount block cache, flush old one */
978     if (s->l2_table_cache) {
979         ret = qcow2_cache_flush(bs, s->l2_table_cache);
980         if (ret) {
981             error_setg_errno(errp, -ret, "Failed to flush the L2 table cache");
982             goto fail;
983         }
984     }
985 
986     if (s->refcount_block_cache) {
987         ret = qcow2_cache_flush(bs, s->refcount_block_cache);
988         if (ret) {
989             error_setg_errno(errp, -ret,
990                              "Failed to flush the refcount block cache");
991             goto fail;
992         }
993     }
994 
995     r->l2_slice_size = l2_cache_entry_size / sizeof(uint64_t);
996     r->l2_table_cache = qcow2_cache_create(bs, l2_cache_size,
997                                            l2_cache_entry_size);
998     r->refcount_block_cache = qcow2_cache_create(bs, refcount_cache_size,
999                                                  s->cluster_size);
1000     if (r->l2_table_cache == NULL || r->refcount_block_cache == NULL) {
1001         error_setg(errp, "Could not allocate metadata caches");
1002         ret = -ENOMEM;
1003         goto fail;
1004     }
1005 
1006     /* New interval for cache cleanup timer */
1007     r->cache_clean_interval =
1008         qemu_opt_get_number(opts, QCOW2_OPT_CACHE_CLEAN_INTERVAL,
1009                             DEFAULT_CACHE_CLEAN_INTERVAL);
1010 #ifndef CONFIG_LINUX
1011     if (r->cache_clean_interval != 0) {
1012         error_setg(errp, QCOW2_OPT_CACHE_CLEAN_INTERVAL
1013                    " not supported on this host");
1014         ret = -EINVAL;
1015         goto fail;
1016     }
1017 #endif
1018     if (r->cache_clean_interval > UINT_MAX) {
1019         error_setg(errp, "Cache clean interval too big");
1020         ret = -EINVAL;
1021         goto fail;
1022     }
1023 
1024     /* lazy-refcounts; flush if going from enabled to disabled */
1025     r->use_lazy_refcounts = qemu_opt_get_bool(opts, QCOW2_OPT_LAZY_REFCOUNTS,
1026         (s->compatible_features & QCOW2_COMPAT_LAZY_REFCOUNTS));
1027     if (r->use_lazy_refcounts && s->qcow_version < 3) {
1028         error_setg(errp, "Lazy refcounts require a qcow2 image with at least "
1029                    "qemu 1.1 compatibility level");
1030         ret = -EINVAL;
1031         goto fail;
1032     }
1033 
1034     if (s->use_lazy_refcounts && !r->use_lazy_refcounts) {
1035         ret = qcow2_mark_clean(bs);
1036         if (ret < 0) {
1037             error_setg_errno(errp, -ret, "Failed to disable lazy refcounts");
1038             goto fail;
1039         }
1040     }
1041 
1042     /* Overlap check options */
1043     opt_overlap_check = qemu_opt_get(opts, QCOW2_OPT_OVERLAP);
1044     opt_overlap_check_template = qemu_opt_get(opts, QCOW2_OPT_OVERLAP_TEMPLATE);
1045     if (opt_overlap_check_template && opt_overlap_check &&
1046         strcmp(opt_overlap_check_template, opt_overlap_check))
1047     {
1048         error_setg(errp, "Conflicting values for qcow2 options '"
1049                    QCOW2_OPT_OVERLAP "' ('%s') and '" QCOW2_OPT_OVERLAP_TEMPLATE
1050                    "' ('%s')", opt_overlap_check, opt_overlap_check_template);
1051         ret = -EINVAL;
1052         goto fail;
1053     }
1054     if (!opt_overlap_check) {
1055         opt_overlap_check = opt_overlap_check_template ?: "cached";
1056     }
1057 
1058     if (!strcmp(opt_overlap_check, "none")) {
1059         overlap_check_template = 0;
1060     } else if (!strcmp(opt_overlap_check, "constant")) {
1061         overlap_check_template = QCOW2_OL_CONSTANT;
1062     } else if (!strcmp(opt_overlap_check, "cached")) {
1063         overlap_check_template = QCOW2_OL_CACHED;
1064     } else if (!strcmp(opt_overlap_check, "all")) {
1065         overlap_check_template = QCOW2_OL_ALL;
1066     } else {
1067         error_setg(errp, "Unsupported value '%s' for qcow2 option "
1068                    "'overlap-check'. Allowed are any of the following: "
1069                    "none, constant, cached, all", opt_overlap_check);
1070         ret = -EINVAL;
1071         goto fail;
1072     }
1073 
1074     r->overlap_check = 0;
1075     for (i = 0; i < QCOW2_OL_MAX_BITNR; i++) {
1076         /* overlap-check defines a template bitmask, but every flag may be
1077          * overwritten through the associated boolean option */
1078         r->overlap_check |=
1079             qemu_opt_get_bool(opts, overlap_bool_option_names[i],
1080                               overlap_check_template & (1 << i)) << i;
1081     }
1082 
1083     r->discard_passthrough[QCOW2_DISCARD_NEVER] = false;
1084     r->discard_passthrough[QCOW2_DISCARD_ALWAYS] = true;
1085     r->discard_passthrough[QCOW2_DISCARD_REQUEST] =
1086         qemu_opt_get_bool(opts, QCOW2_OPT_DISCARD_REQUEST,
1087                           flags & BDRV_O_UNMAP);
1088     r->discard_passthrough[QCOW2_DISCARD_SNAPSHOT] =
1089         qemu_opt_get_bool(opts, QCOW2_OPT_DISCARD_SNAPSHOT, true);
1090     r->discard_passthrough[QCOW2_DISCARD_OTHER] =
1091         qemu_opt_get_bool(opts, QCOW2_OPT_DISCARD_OTHER, false);
1092 
1093     switch (s->crypt_method_header) {
1094     case QCOW_CRYPT_NONE:
1095         if (encryptfmt) {
1096             error_setg(errp, "No encryption in image header, but options "
1097                        "specified format '%s'", encryptfmt);
1098             ret = -EINVAL;
1099             goto fail;
1100         }
1101         break;
1102 
1103     case QCOW_CRYPT_AES:
1104         if (encryptfmt && !g_str_equal(encryptfmt, "aes")) {
1105             error_setg(errp,
1106                        "Header reported 'aes' encryption format but "
1107                        "options specify '%s'", encryptfmt);
1108             ret = -EINVAL;
1109             goto fail;
1110         }
1111         qdict_put_str(encryptopts, "format", "qcow");
1112         r->crypto_opts = block_crypto_open_opts_init(encryptopts, errp);
1113         break;
1114 
1115     case QCOW_CRYPT_LUKS:
1116         if (encryptfmt && !g_str_equal(encryptfmt, "luks")) {
1117             error_setg(errp,
1118                        "Header reported 'luks' encryption format but "
1119                        "options specify '%s'", encryptfmt);
1120             ret = -EINVAL;
1121             goto fail;
1122         }
1123         qdict_put_str(encryptopts, "format", "luks");
1124         r->crypto_opts = block_crypto_open_opts_init(encryptopts, errp);
1125         break;
1126 
1127     default:
1128         error_setg(errp, "Unsupported encryption method %d",
1129                    s->crypt_method_header);
1130         break;
1131     }
1132     if (s->crypt_method_header != QCOW_CRYPT_NONE && !r->crypto_opts) {
1133         ret = -EINVAL;
1134         goto fail;
1135     }
1136 
1137     ret = 0;
1138 fail:
1139     qobject_unref(encryptopts);
1140     qemu_opts_del(opts);
1141     opts = NULL;
1142     return ret;
1143 }
1144 
1145 static void qcow2_update_options_commit(BlockDriverState *bs,
1146                                         Qcow2ReopenState *r)
1147 {
1148     BDRVQcow2State *s = bs->opaque;
1149     int i;
1150 
1151     if (s->l2_table_cache) {
1152         qcow2_cache_destroy(s->l2_table_cache);
1153     }
1154     if (s->refcount_block_cache) {
1155         qcow2_cache_destroy(s->refcount_block_cache);
1156     }
1157     s->l2_table_cache = r->l2_table_cache;
1158     s->refcount_block_cache = r->refcount_block_cache;
1159     s->l2_slice_size = r->l2_slice_size;
1160 
1161     s->overlap_check = r->overlap_check;
1162     s->use_lazy_refcounts = r->use_lazy_refcounts;
1163 
1164     for (i = 0; i < QCOW2_DISCARD_MAX; i++) {
1165         s->discard_passthrough[i] = r->discard_passthrough[i];
1166     }
1167 
1168     if (s->cache_clean_interval != r->cache_clean_interval) {
1169         cache_clean_timer_del(bs);
1170         s->cache_clean_interval = r->cache_clean_interval;
1171         cache_clean_timer_init(bs, bdrv_get_aio_context(bs));
1172     }
1173 
1174     qapi_free_QCryptoBlockOpenOptions(s->crypto_opts);
1175     s->crypto_opts = r->crypto_opts;
1176 }
1177 
1178 static void qcow2_update_options_abort(BlockDriverState *bs,
1179                                        Qcow2ReopenState *r)
1180 {
1181     if (r->l2_table_cache) {
1182         qcow2_cache_destroy(r->l2_table_cache);
1183     }
1184     if (r->refcount_block_cache) {
1185         qcow2_cache_destroy(r->refcount_block_cache);
1186     }
1187     qapi_free_QCryptoBlockOpenOptions(r->crypto_opts);
1188 }
1189 
1190 static int qcow2_update_options(BlockDriverState *bs, QDict *options,
1191                                 int flags, Error **errp)
1192 {
1193     Qcow2ReopenState r = {};
1194     int ret;
1195 
1196     ret = qcow2_update_options_prepare(bs, &r, options, flags, errp);
1197     if (ret >= 0) {
1198         qcow2_update_options_commit(bs, &r);
1199     } else {
1200         qcow2_update_options_abort(bs, &r);
1201     }
1202 
1203     return ret;
1204 }
1205 
1206 /* Called with s->lock held.  */
1207 static int coroutine_fn qcow2_do_open(BlockDriverState *bs, QDict *options,
1208                                       int flags, Error **errp)
1209 {
1210     BDRVQcow2State *s = bs->opaque;
1211     unsigned int len, i;
1212     int ret = 0;
1213     QCowHeader header;
1214     Error *local_err = NULL;
1215     uint64_t ext_end;
1216     uint64_t l1_vm_state_index;
1217     bool update_header = false;
1218 
1219     ret = bdrv_pread(bs->file, 0, &header, sizeof(header));
1220     if (ret < 0) {
1221         error_setg_errno(errp, -ret, "Could not read qcow2 header");
1222         goto fail;
1223     }
1224     header.magic = be32_to_cpu(header.magic);
1225     header.version = be32_to_cpu(header.version);
1226     header.backing_file_offset = be64_to_cpu(header.backing_file_offset);
1227     header.backing_file_size = be32_to_cpu(header.backing_file_size);
1228     header.size = be64_to_cpu(header.size);
1229     header.cluster_bits = be32_to_cpu(header.cluster_bits);
1230     header.crypt_method = be32_to_cpu(header.crypt_method);
1231     header.l1_table_offset = be64_to_cpu(header.l1_table_offset);
1232     header.l1_size = be32_to_cpu(header.l1_size);
1233     header.refcount_table_offset = be64_to_cpu(header.refcount_table_offset);
1234     header.refcount_table_clusters =
1235         be32_to_cpu(header.refcount_table_clusters);
1236     header.snapshots_offset = be64_to_cpu(header.snapshots_offset);
1237     header.nb_snapshots = be32_to_cpu(header.nb_snapshots);
1238 
1239     if (header.magic != QCOW_MAGIC) {
1240         error_setg(errp, "Image is not in qcow2 format");
1241         ret = -EINVAL;
1242         goto fail;
1243     }
1244     if (header.version < 2 || header.version > 3) {
1245         error_setg(errp, "Unsupported qcow2 version %" PRIu32, header.version);
1246         ret = -ENOTSUP;
1247         goto fail;
1248     }
1249 
1250     s->qcow_version = header.version;
1251 
1252     /* Initialise cluster size */
1253     if (header.cluster_bits < MIN_CLUSTER_BITS ||
1254         header.cluster_bits > MAX_CLUSTER_BITS) {
1255         error_setg(errp, "Unsupported cluster size: 2^%" PRIu32,
1256                    header.cluster_bits);
1257         ret = -EINVAL;
1258         goto fail;
1259     }
1260 
1261     s->cluster_bits = header.cluster_bits;
1262     s->cluster_size = 1 << s->cluster_bits;
1263 
1264     /* Initialise version 3 header fields */
1265     if (header.version == 2) {
1266         header.incompatible_features    = 0;
1267         header.compatible_features      = 0;
1268         header.autoclear_features       = 0;
1269         header.refcount_order           = 4;
1270         header.header_length            = 72;
1271     } else {
1272         header.incompatible_features =
1273             be64_to_cpu(header.incompatible_features);
1274         header.compatible_features = be64_to_cpu(header.compatible_features);
1275         header.autoclear_features = be64_to_cpu(header.autoclear_features);
1276         header.refcount_order = be32_to_cpu(header.refcount_order);
1277         header.header_length = be32_to_cpu(header.header_length);
1278 
1279         if (header.header_length < 104) {
1280             error_setg(errp, "qcow2 header too short");
1281             ret = -EINVAL;
1282             goto fail;
1283         }
1284     }
1285 
1286     if (header.header_length > s->cluster_size) {
1287         error_setg(errp, "qcow2 header exceeds cluster size");
1288         ret = -EINVAL;
1289         goto fail;
1290     }
1291 
1292     if (header.header_length > sizeof(header)) {
1293         s->unknown_header_fields_size = header.header_length - sizeof(header);
1294         s->unknown_header_fields = g_malloc(s->unknown_header_fields_size);
1295         ret = bdrv_pread(bs->file, sizeof(header), s->unknown_header_fields,
1296                          s->unknown_header_fields_size);
1297         if (ret < 0) {
1298             error_setg_errno(errp, -ret, "Could not read unknown qcow2 header "
1299                              "fields");
1300             goto fail;
1301         }
1302     }
1303 
1304     if (header.backing_file_offset > s->cluster_size) {
1305         error_setg(errp, "Invalid backing file offset");
1306         ret = -EINVAL;
1307         goto fail;
1308     }
1309 
1310     if (header.backing_file_offset) {
1311         ext_end = header.backing_file_offset;
1312     } else {
1313         ext_end = 1 << header.cluster_bits;
1314     }
1315 
1316     /* Handle feature bits */
1317     s->incompatible_features    = header.incompatible_features;
1318     s->compatible_features      = header.compatible_features;
1319     s->autoclear_features       = header.autoclear_features;
1320 
1321     if (s->incompatible_features & ~QCOW2_INCOMPAT_MASK) {
1322         void *feature_table = NULL;
1323         qcow2_read_extensions(bs, header.header_length, ext_end,
1324                               &feature_table, flags, NULL, NULL);
1325         report_unsupported_feature(errp, feature_table,
1326                                    s->incompatible_features &
1327                                    ~QCOW2_INCOMPAT_MASK);
1328         ret = -ENOTSUP;
1329         g_free(feature_table);
1330         goto fail;
1331     }
1332 
1333     if (s->incompatible_features & QCOW2_INCOMPAT_CORRUPT) {
1334         /* Corrupt images may not be written to unless they are being repaired
1335          */
1336         if ((flags & BDRV_O_RDWR) && !(flags & BDRV_O_CHECK)) {
1337             error_setg(errp, "qcow2: Image is corrupt; cannot be opened "
1338                        "read/write");
1339             ret = -EACCES;
1340             goto fail;
1341         }
1342     }
1343 
1344     /* Check support for various header values */
1345     if (header.refcount_order > 6) {
1346         error_setg(errp, "Reference count entry width too large; may not "
1347                    "exceed 64 bits");
1348         ret = -EINVAL;
1349         goto fail;
1350     }
1351     s->refcount_order = header.refcount_order;
1352     s->refcount_bits = 1 << s->refcount_order;
1353     s->refcount_max = UINT64_C(1) << (s->refcount_bits - 1);
1354     s->refcount_max += s->refcount_max - 1;
1355 
1356     s->crypt_method_header = header.crypt_method;
1357     if (s->crypt_method_header) {
1358         if (bdrv_uses_whitelist() &&
1359             s->crypt_method_header == QCOW_CRYPT_AES) {
1360             error_setg(errp,
1361                        "Use of AES-CBC encrypted qcow2 images is no longer "
1362                        "supported in system emulators");
1363             error_append_hint(errp,
1364                               "You can use 'qemu-img convert' to convert your "
1365                               "image to an alternative supported format, such "
1366                               "as unencrypted qcow2, or raw with the LUKS "
1367                               "format instead.\n");
1368             ret = -ENOSYS;
1369             goto fail;
1370         }
1371 
1372         if (s->crypt_method_header == QCOW_CRYPT_AES) {
1373             s->crypt_physical_offset = false;
1374         } else {
1375             /* Assuming LUKS and any future crypt methods we
1376              * add will all use physical offsets, due to the
1377              * fact that the alternative is insecure...  */
1378             s->crypt_physical_offset = true;
1379         }
1380 
1381         bs->encrypted = true;
1382     }
1383 
1384     s->l2_bits = s->cluster_bits - 3; /* L2 is always one cluster */
1385     s->l2_size = 1 << s->l2_bits;
1386     /* 2^(s->refcount_order - 3) is the refcount width in bytes */
1387     s->refcount_block_bits = s->cluster_bits - (s->refcount_order - 3);
1388     s->refcount_block_size = 1 << s->refcount_block_bits;
1389     bs->total_sectors = header.size / BDRV_SECTOR_SIZE;
1390     s->csize_shift = (62 - (s->cluster_bits - 8));
1391     s->csize_mask = (1 << (s->cluster_bits - 8)) - 1;
1392     s->cluster_offset_mask = (1LL << s->csize_shift) - 1;
1393 
1394     s->refcount_table_offset = header.refcount_table_offset;
1395     s->refcount_table_size =
1396         header.refcount_table_clusters << (s->cluster_bits - 3);
1397 
1398     if (header.refcount_table_clusters == 0 && !(flags & BDRV_O_CHECK)) {
1399         error_setg(errp, "Image does not contain a reference count table");
1400         ret = -EINVAL;
1401         goto fail;
1402     }
1403 
1404     ret = qcow2_validate_table(bs, s->refcount_table_offset,
1405                                header.refcount_table_clusters,
1406                                s->cluster_size, QCOW_MAX_REFTABLE_SIZE,
1407                                "Reference count table", errp);
1408     if (ret < 0) {
1409         goto fail;
1410     }
1411 
1412     /* The total size in bytes of the snapshot table is checked in
1413      * qcow2_read_snapshots() because the size of each snapshot is
1414      * variable and we don't know it yet.
1415      * Here we only check the offset and number of snapshots. */
1416     ret = qcow2_validate_table(bs, header.snapshots_offset,
1417                                header.nb_snapshots,
1418                                sizeof(QCowSnapshotHeader),
1419                                sizeof(QCowSnapshotHeader) * QCOW_MAX_SNAPSHOTS,
1420                                "Snapshot table", errp);
1421     if (ret < 0) {
1422         goto fail;
1423     }
1424 
1425     /* read the level 1 table */
1426     ret = qcow2_validate_table(bs, header.l1_table_offset,
1427                                header.l1_size, sizeof(uint64_t),
1428                                QCOW_MAX_L1_SIZE, "Active L1 table", errp);
1429     if (ret < 0) {
1430         goto fail;
1431     }
1432     s->l1_size = header.l1_size;
1433     s->l1_table_offset = header.l1_table_offset;
1434 
1435     l1_vm_state_index = size_to_l1(s, header.size);
1436     if (l1_vm_state_index > INT_MAX) {
1437         error_setg(errp, "Image is too big");
1438         ret = -EFBIG;
1439         goto fail;
1440     }
1441     s->l1_vm_state_index = l1_vm_state_index;
1442 
1443     /* the L1 table must contain at least enough entries to put
1444        header.size bytes */
1445     if (s->l1_size < s->l1_vm_state_index) {
1446         error_setg(errp, "L1 table is too small");
1447         ret = -EINVAL;
1448         goto fail;
1449     }
1450 
1451     if (s->l1_size > 0) {
1452         s->l1_table = qemu_try_blockalign(bs->file->bs,
1453             ROUND_UP(s->l1_size * sizeof(uint64_t), 512));
1454         if (s->l1_table == NULL) {
1455             error_setg(errp, "Could not allocate L1 table");
1456             ret = -ENOMEM;
1457             goto fail;
1458         }
1459         ret = bdrv_pread(bs->file, s->l1_table_offset, s->l1_table,
1460                          s->l1_size * sizeof(uint64_t));
1461         if (ret < 0) {
1462             error_setg_errno(errp, -ret, "Could not read L1 table");
1463             goto fail;
1464         }
1465         for(i = 0;i < s->l1_size; i++) {
1466             s->l1_table[i] = be64_to_cpu(s->l1_table[i]);
1467         }
1468     }
1469 
1470     /* Parse driver-specific options */
1471     ret = qcow2_update_options(bs, options, flags, errp);
1472     if (ret < 0) {
1473         goto fail;
1474     }
1475 
1476     s->flags = flags;
1477 
1478     ret = qcow2_refcount_init(bs);
1479     if (ret != 0) {
1480         error_setg_errno(errp, -ret, "Could not initialize refcount handling");
1481         goto fail;
1482     }
1483 
1484     QLIST_INIT(&s->cluster_allocs);
1485     QTAILQ_INIT(&s->discards);
1486 
1487     /* read qcow2 extensions */
1488     if (qcow2_read_extensions(bs, header.header_length, ext_end, NULL,
1489                               flags, &update_header, &local_err)) {
1490         error_propagate(errp, local_err);
1491         ret = -EINVAL;
1492         goto fail;
1493     }
1494 
1495     /* Open external data file */
1496     s->data_file = bdrv_open_child(NULL, options, "data-file", bs, &child_file,
1497                                    true, &local_err);
1498     if (local_err) {
1499         error_propagate(errp, local_err);
1500         ret = -EINVAL;
1501         goto fail;
1502     }
1503 
1504     if (s->incompatible_features & QCOW2_INCOMPAT_DATA_FILE) {
1505         if (!s->data_file && s->image_data_file) {
1506             s->data_file = bdrv_open_child(s->image_data_file, options,
1507                                            "data-file", bs, &child_file,
1508                                            false, errp);
1509             if (!s->data_file) {
1510                 ret = -EINVAL;
1511                 goto fail;
1512             }
1513         }
1514         if (!s->data_file) {
1515             error_setg(errp, "'data-file' is required for this image");
1516             ret = -EINVAL;
1517             goto fail;
1518         }
1519     } else {
1520         if (s->data_file) {
1521             error_setg(errp, "'data-file' can only be set for images with an "
1522                              "external data file");
1523             ret = -EINVAL;
1524             goto fail;
1525         }
1526 
1527         s->data_file = bs->file;
1528 
1529         if (data_file_is_raw(bs)) {
1530             error_setg(errp, "data-file-raw requires a data file");
1531             ret = -EINVAL;
1532             goto fail;
1533         }
1534     }
1535 
1536     /* qcow2_read_extension may have set up the crypto context
1537      * if the crypt method needs a header region, some methods
1538      * don't need header extensions, so must check here
1539      */
1540     if (s->crypt_method_header && !s->crypto) {
1541         if (s->crypt_method_header == QCOW_CRYPT_AES) {
1542             unsigned int cflags = 0;
1543             if (flags & BDRV_O_NO_IO) {
1544                 cflags |= QCRYPTO_BLOCK_OPEN_NO_IO;
1545             }
1546             s->crypto = qcrypto_block_open(s->crypto_opts, "encrypt.",
1547                                            NULL, NULL, cflags,
1548                                            QCOW2_MAX_THREADS, errp);
1549             if (!s->crypto) {
1550                 ret = -EINVAL;
1551                 goto fail;
1552             }
1553         } else if (!(flags & BDRV_O_NO_IO)) {
1554             error_setg(errp, "Missing CRYPTO header for crypt method %d",
1555                        s->crypt_method_header);
1556             ret = -EINVAL;
1557             goto fail;
1558         }
1559     }
1560 
1561     /* read the backing file name */
1562     if (header.backing_file_offset != 0) {
1563         len = header.backing_file_size;
1564         if (len > MIN(1023, s->cluster_size - header.backing_file_offset) ||
1565             len >= sizeof(bs->backing_file)) {
1566             error_setg(errp, "Backing file name too long");
1567             ret = -EINVAL;
1568             goto fail;
1569         }
1570         ret = bdrv_pread(bs->file, header.backing_file_offset,
1571                          bs->auto_backing_file, len);
1572         if (ret < 0) {
1573             error_setg_errno(errp, -ret, "Could not read backing file name");
1574             goto fail;
1575         }
1576         bs->auto_backing_file[len] = '\0';
1577         pstrcpy(bs->backing_file, sizeof(bs->backing_file),
1578                 bs->auto_backing_file);
1579         s->image_backing_file = g_strdup(bs->auto_backing_file);
1580     }
1581 
1582     /* Internal snapshots */
1583     s->snapshots_offset = header.snapshots_offset;
1584     s->nb_snapshots = header.nb_snapshots;
1585 
1586     ret = qcow2_read_snapshots(bs);
1587     if (ret < 0) {
1588         error_setg_errno(errp, -ret, "Could not read snapshots");
1589         goto fail;
1590     }
1591 
1592     /* Clear unknown autoclear feature bits */
1593     update_header |= s->autoclear_features & ~QCOW2_AUTOCLEAR_MASK;
1594     update_header =
1595         update_header && !bs->read_only && !(flags & BDRV_O_INACTIVE);
1596     if (update_header) {
1597         s->autoclear_features &= QCOW2_AUTOCLEAR_MASK;
1598     }
1599 
1600     /* == Handle persistent dirty bitmaps ==
1601      *
1602      * We want load dirty bitmaps in three cases:
1603      *
1604      * 1. Normal open of the disk in active mode, not related to invalidation
1605      *    after migration.
1606      *
1607      * 2. Invalidation of the target vm after pre-copy phase of migration, if
1608      *    bitmaps are _not_ migrating through migration channel, i.e.
1609      *    'dirty-bitmaps' capability is disabled.
1610      *
1611      * 3. Invalidation of source vm after failed or canceled migration.
1612      *    This is a very interesting case. There are two possible types of
1613      *    bitmaps:
1614      *
1615      *    A. Stored on inactivation and removed. They should be loaded from the
1616      *       image.
1617      *
1618      *    B. Not stored: not-persistent bitmaps and bitmaps, migrated through
1619      *       the migration channel (with dirty-bitmaps capability).
1620      *
1621      *    On the other hand, there are two possible sub-cases:
1622      *
1623      *    3.1 disk was changed by somebody else while were inactive. In this
1624      *        case all in-RAM dirty bitmaps (both persistent and not) are
1625      *        definitely invalid. And we don't have any method to determine
1626      *        this.
1627      *
1628      *        Simple and safe thing is to just drop all the bitmaps of type B on
1629      *        inactivation. But in this case we lose bitmaps in valid 4.2 case.
1630      *
1631      *        On the other hand, resuming source vm, if disk was already changed
1632      *        is a bad thing anyway: not only bitmaps, the whole vm state is
1633      *        out of sync with disk.
1634      *
1635      *        This means, that user or management tool, who for some reason
1636      *        decided to resume source vm, after disk was already changed by
1637      *        target vm, should at least drop all dirty bitmaps by hand.
1638      *
1639      *        So, we can ignore this case for now, but TODO: "generation"
1640      *        extension for qcow2, to determine, that image was changed after
1641      *        last inactivation. And if it is changed, we will drop (or at least
1642      *        mark as 'invalid' all the bitmaps of type B, both persistent
1643      *        and not).
1644      *
1645      *    3.2 disk was _not_ changed while were inactive. Bitmaps may be saved
1646      *        to disk ('dirty-bitmaps' capability disabled), or not saved
1647      *        ('dirty-bitmaps' capability enabled), but we don't need to care
1648      *        of: let's load bitmaps as always: stored bitmaps will be loaded,
1649      *        and not stored has flag IN_USE=1 in the image and will be skipped
1650      *        on loading.
1651      *
1652      * One remaining possible case when we don't want load bitmaps:
1653      *
1654      * 4. Open disk in inactive mode in target vm (bitmaps are migrating or
1655      *    will be loaded on invalidation, no needs try loading them before)
1656      */
1657 
1658     if (!(bdrv_get_flags(bs) & BDRV_O_INACTIVE)) {
1659         /* It's case 1, 2 or 3.2. Or 3.1 which is BUG in management layer. */
1660         bool header_updated = qcow2_load_dirty_bitmaps(bs, &local_err);
1661 
1662         update_header = update_header && !header_updated;
1663     }
1664     if (local_err != NULL) {
1665         error_propagate(errp, local_err);
1666         ret = -EINVAL;
1667         goto fail;
1668     }
1669 
1670     if (update_header) {
1671         ret = qcow2_update_header(bs);
1672         if (ret < 0) {
1673             error_setg_errno(errp, -ret, "Could not update qcow2 header");
1674             goto fail;
1675         }
1676     }
1677 
1678     bs->supported_zero_flags = header.version >= 3 ? BDRV_REQ_MAY_UNMAP : 0;
1679 
1680     /* Repair image if dirty */
1681     if (!(flags & (BDRV_O_CHECK | BDRV_O_INACTIVE)) && !bs->read_only &&
1682         (s->incompatible_features & QCOW2_INCOMPAT_DIRTY)) {
1683         BdrvCheckResult result = {0};
1684 
1685         ret = qcow2_co_check_locked(bs, &result,
1686                                     BDRV_FIX_ERRORS | BDRV_FIX_LEAKS);
1687         if (ret < 0 || result.check_errors) {
1688             if (ret >= 0) {
1689                 ret = -EIO;
1690             }
1691             error_setg_errno(errp, -ret, "Could not repair dirty image");
1692             goto fail;
1693         }
1694     }
1695 
1696 #ifdef DEBUG_ALLOC
1697     {
1698         BdrvCheckResult result = {0};
1699         qcow2_check_refcounts(bs, &result, 0);
1700     }
1701 #endif
1702 
1703     qemu_co_queue_init(&s->thread_task_queue);
1704 
1705     return ret;
1706 
1707  fail:
1708     g_free(s->image_data_file);
1709     if (has_data_file(bs)) {
1710         bdrv_unref_child(bs, s->data_file);
1711     }
1712     g_free(s->unknown_header_fields);
1713     cleanup_unknown_header_ext(bs);
1714     qcow2_free_snapshots(bs);
1715     qcow2_refcount_close(bs);
1716     qemu_vfree(s->l1_table);
1717     /* else pre-write overlap checks in cache_destroy may crash */
1718     s->l1_table = NULL;
1719     cache_clean_timer_del(bs);
1720     if (s->l2_table_cache) {
1721         qcow2_cache_destroy(s->l2_table_cache);
1722     }
1723     if (s->refcount_block_cache) {
1724         qcow2_cache_destroy(s->refcount_block_cache);
1725     }
1726     qcrypto_block_free(s->crypto);
1727     qapi_free_QCryptoBlockOpenOptions(s->crypto_opts);
1728     return ret;
1729 }
1730 
1731 typedef struct QCow2OpenCo {
1732     BlockDriverState *bs;
1733     QDict *options;
1734     int flags;
1735     Error **errp;
1736     int ret;
1737 } QCow2OpenCo;
1738 
1739 static void coroutine_fn qcow2_open_entry(void *opaque)
1740 {
1741     QCow2OpenCo *qoc = opaque;
1742     BDRVQcow2State *s = qoc->bs->opaque;
1743 
1744     qemu_co_mutex_lock(&s->lock);
1745     qoc->ret = qcow2_do_open(qoc->bs, qoc->options, qoc->flags, qoc->errp);
1746     qemu_co_mutex_unlock(&s->lock);
1747 }
1748 
1749 static int qcow2_open(BlockDriverState *bs, QDict *options, int flags,
1750                       Error **errp)
1751 {
1752     BDRVQcow2State *s = bs->opaque;
1753     QCow2OpenCo qoc = {
1754         .bs = bs,
1755         .options = options,
1756         .flags = flags,
1757         .errp = errp,
1758         .ret = -EINPROGRESS
1759     };
1760 
1761     bs->file = bdrv_open_child(NULL, options, "file", bs, &child_file,
1762                                false, errp);
1763     if (!bs->file) {
1764         return -EINVAL;
1765     }
1766 
1767     /* Initialise locks */
1768     qemu_co_mutex_init(&s->lock);
1769 
1770     if (qemu_in_coroutine()) {
1771         /* From bdrv_co_create.  */
1772         qcow2_open_entry(&qoc);
1773     } else {
1774         assert(qemu_get_current_aio_context() == qemu_get_aio_context());
1775         qemu_coroutine_enter(qemu_coroutine_create(qcow2_open_entry, &qoc));
1776         BDRV_POLL_WHILE(bs, qoc.ret == -EINPROGRESS);
1777     }
1778     return qoc.ret;
1779 }
1780 
1781 static void qcow2_refresh_limits(BlockDriverState *bs, Error **errp)
1782 {
1783     BDRVQcow2State *s = bs->opaque;
1784 
1785     if (bs->encrypted) {
1786         /* Encryption works on a sector granularity */
1787         bs->bl.request_alignment = qcrypto_block_get_sector_size(s->crypto);
1788     }
1789     bs->bl.pwrite_zeroes_alignment = s->cluster_size;
1790     bs->bl.pdiscard_alignment = s->cluster_size;
1791 }
1792 
1793 static int qcow2_reopen_prepare(BDRVReopenState *state,
1794                                 BlockReopenQueue *queue, Error **errp)
1795 {
1796     Qcow2ReopenState *r;
1797     int ret;
1798 
1799     r = g_new0(Qcow2ReopenState, 1);
1800     state->opaque = r;
1801 
1802     ret = qcow2_update_options_prepare(state->bs, r, state->options,
1803                                        state->flags, errp);
1804     if (ret < 0) {
1805         goto fail;
1806     }
1807 
1808     /* We need to write out any unwritten data if we reopen read-only. */
1809     if ((state->flags & BDRV_O_RDWR) == 0) {
1810         ret = qcow2_reopen_bitmaps_ro(state->bs, errp);
1811         if (ret < 0) {
1812             goto fail;
1813         }
1814 
1815         ret = bdrv_flush(state->bs);
1816         if (ret < 0) {
1817             goto fail;
1818         }
1819 
1820         ret = qcow2_mark_clean(state->bs);
1821         if (ret < 0) {
1822             goto fail;
1823         }
1824     }
1825 
1826     return 0;
1827 
1828 fail:
1829     qcow2_update_options_abort(state->bs, r);
1830     g_free(r);
1831     return ret;
1832 }
1833 
1834 static void qcow2_reopen_commit(BDRVReopenState *state)
1835 {
1836     qcow2_update_options_commit(state->bs, state->opaque);
1837     g_free(state->opaque);
1838 }
1839 
1840 static void qcow2_reopen_abort(BDRVReopenState *state)
1841 {
1842     qcow2_update_options_abort(state->bs, state->opaque);
1843     g_free(state->opaque);
1844 }
1845 
1846 static void qcow2_join_options(QDict *options, QDict *old_options)
1847 {
1848     bool has_new_overlap_template =
1849         qdict_haskey(options, QCOW2_OPT_OVERLAP) ||
1850         qdict_haskey(options, QCOW2_OPT_OVERLAP_TEMPLATE);
1851     bool has_new_total_cache_size =
1852         qdict_haskey(options, QCOW2_OPT_CACHE_SIZE);
1853     bool has_all_cache_options;
1854 
1855     /* New overlap template overrides all old overlap options */
1856     if (has_new_overlap_template) {
1857         qdict_del(old_options, QCOW2_OPT_OVERLAP);
1858         qdict_del(old_options, QCOW2_OPT_OVERLAP_TEMPLATE);
1859         qdict_del(old_options, QCOW2_OPT_OVERLAP_MAIN_HEADER);
1860         qdict_del(old_options, QCOW2_OPT_OVERLAP_ACTIVE_L1);
1861         qdict_del(old_options, QCOW2_OPT_OVERLAP_ACTIVE_L2);
1862         qdict_del(old_options, QCOW2_OPT_OVERLAP_REFCOUNT_TABLE);
1863         qdict_del(old_options, QCOW2_OPT_OVERLAP_REFCOUNT_BLOCK);
1864         qdict_del(old_options, QCOW2_OPT_OVERLAP_SNAPSHOT_TABLE);
1865         qdict_del(old_options, QCOW2_OPT_OVERLAP_INACTIVE_L1);
1866         qdict_del(old_options, QCOW2_OPT_OVERLAP_INACTIVE_L2);
1867     }
1868 
1869     /* New total cache size overrides all old options */
1870     if (qdict_haskey(options, QCOW2_OPT_CACHE_SIZE)) {
1871         qdict_del(old_options, QCOW2_OPT_L2_CACHE_SIZE);
1872         qdict_del(old_options, QCOW2_OPT_REFCOUNT_CACHE_SIZE);
1873     }
1874 
1875     qdict_join(options, old_options, false);
1876 
1877     /*
1878      * If after merging all cache size options are set, an old total size is
1879      * overwritten. Do keep all options, however, if all three are new. The
1880      * resulting error message is what we want to happen.
1881      */
1882     has_all_cache_options =
1883         qdict_haskey(options, QCOW2_OPT_CACHE_SIZE) ||
1884         qdict_haskey(options, QCOW2_OPT_L2_CACHE_SIZE) ||
1885         qdict_haskey(options, QCOW2_OPT_REFCOUNT_CACHE_SIZE);
1886 
1887     if (has_all_cache_options && !has_new_total_cache_size) {
1888         qdict_del(options, QCOW2_OPT_CACHE_SIZE);
1889     }
1890 }
1891 
1892 static int coroutine_fn qcow2_co_block_status(BlockDriverState *bs,
1893                                               bool want_zero,
1894                                               int64_t offset, int64_t count,
1895                                               int64_t *pnum, int64_t *map,
1896                                               BlockDriverState **file)
1897 {
1898     BDRVQcow2State *s = bs->opaque;
1899     uint64_t cluster_offset;
1900     int index_in_cluster, ret;
1901     unsigned int bytes;
1902     int status = 0;
1903 
1904     if (!s->metadata_preallocation_checked) {
1905         ret = qcow2_detect_metadata_preallocation(bs);
1906         s->metadata_preallocation = (ret == 1);
1907         s->metadata_preallocation_checked = true;
1908     }
1909 
1910     bytes = MIN(INT_MAX, count);
1911     qemu_co_mutex_lock(&s->lock);
1912     ret = qcow2_get_cluster_offset(bs, offset, &bytes, &cluster_offset);
1913     qemu_co_mutex_unlock(&s->lock);
1914     if (ret < 0) {
1915         return ret;
1916     }
1917 
1918     *pnum = bytes;
1919 
1920     if ((ret == QCOW2_CLUSTER_NORMAL || ret == QCOW2_CLUSTER_ZERO_ALLOC) &&
1921         !s->crypto) {
1922         index_in_cluster = offset & (s->cluster_size - 1);
1923         *map = cluster_offset | index_in_cluster;
1924         *file = s->data_file->bs;
1925         status |= BDRV_BLOCK_OFFSET_VALID;
1926     }
1927     if (ret == QCOW2_CLUSTER_ZERO_PLAIN || ret == QCOW2_CLUSTER_ZERO_ALLOC) {
1928         status |= BDRV_BLOCK_ZERO;
1929     } else if (ret != QCOW2_CLUSTER_UNALLOCATED) {
1930         status |= BDRV_BLOCK_DATA;
1931     }
1932     if (s->metadata_preallocation && (status & BDRV_BLOCK_DATA) &&
1933         (status & BDRV_BLOCK_OFFSET_VALID))
1934     {
1935         status |= BDRV_BLOCK_RECURSE;
1936     }
1937     return status;
1938 }
1939 
1940 static coroutine_fn int qcow2_handle_l2meta(BlockDriverState *bs,
1941                                             QCowL2Meta **pl2meta,
1942                                             bool link_l2)
1943 {
1944     int ret = 0;
1945     QCowL2Meta *l2meta = *pl2meta;
1946 
1947     while (l2meta != NULL) {
1948         QCowL2Meta *next;
1949 
1950         if (link_l2) {
1951             ret = qcow2_alloc_cluster_link_l2(bs, l2meta);
1952             if (ret) {
1953                 goto out;
1954             }
1955         } else {
1956             qcow2_alloc_cluster_abort(bs, l2meta);
1957         }
1958 
1959         /* Take the request off the list of running requests */
1960         if (l2meta->nb_clusters != 0) {
1961             QLIST_REMOVE(l2meta, next_in_flight);
1962         }
1963 
1964         qemu_co_queue_restart_all(&l2meta->dependent_requests);
1965 
1966         next = l2meta->next;
1967         g_free(l2meta);
1968         l2meta = next;
1969     }
1970 out:
1971     *pl2meta = l2meta;
1972     return ret;
1973 }
1974 
1975 static coroutine_fn int qcow2_co_preadv_part(BlockDriverState *bs,
1976                                              uint64_t offset, uint64_t bytes,
1977                                              QEMUIOVector *qiov,
1978                                              size_t qiov_offset, int flags)
1979 {
1980     BDRVQcow2State *s = bs->opaque;
1981     int offset_in_cluster;
1982     int ret;
1983     unsigned int cur_bytes; /* number of bytes in current iteration */
1984     uint64_t cluster_offset = 0;
1985     uint8_t *cluster_data = NULL;
1986 
1987     while (bytes != 0) {
1988 
1989         /* prepare next request */
1990         cur_bytes = MIN(bytes, INT_MAX);
1991         if (s->crypto) {
1992             cur_bytes = MIN(cur_bytes,
1993                             QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size);
1994         }
1995 
1996         qemu_co_mutex_lock(&s->lock);
1997         ret = qcow2_get_cluster_offset(bs, offset, &cur_bytes, &cluster_offset);
1998         qemu_co_mutex_unlock(&s->lock);
1999         if (ret < 0) {
2000             goto fail;
2001         }
2002 
2003         offset_in_cluster = offset_into_cluster(s, offset);
2004 
2005         switch (ret) {
2006         case QCOW2_CLUSTER_UNALLOCATED:
2007 
2008             if (bs->backing) {
2009                 BLKDBG_EVENT(bs->file, BLKDBG_READ_BACKING_AIO);
2010                 ret = bdrv_co_preadv_part(bs->backing, offset, cur_bytes,
2011                                           qiov, qiov_offset, 0);
2012                 if (ret < 0) {
2013                     goto fail;
2014                 }
2015             } else {
2016                 /* Note: in this case, no need to wait */
2017                 qemu_iovec_memset(qiov, qiov_offset, 0, cur_bytes);
2018             }
2019             break;
2020 
2021         case QCOW2_CLUSTER_ZERO_PLAIN:
2022         case QCOW2_CLUSTER_ZERO_ALLOC:
2023             qemu_iovec_memset(qiov, qiov_offset, 0, cur_bytes);
2024             break;
2025 
2026         case QCOW2_CLUSTER_COMPRESSED:
2027             ret = qcow2_co_preadv_compressed(bs, cluster_offset,
2028                                              offset, cur_bytes,
2029                                              qiov, qiov_offset);
2030             if (ret < 0) {
2031                 goto fail;
2032             }
2033 
2034             break;
2035 
2036         case QCOW2_CLUSTER_NORMAL:
2037             if ((cluster_offset & 511) != 0) {
2038                 ret = -EIO;
2039                 goto fail;
2040             }
2041 
2042             if (bs->encrypted) {
2043                 assert(s->crypto);
2044 
2045                 /*
2046                  * For encrypted images, read everything into a temporary
2047                  * contiguous buffer on which the AES functions can work.
2048                  */
2049                 if (!cluster_data) {
2050                     cluster_data =
2051                         qemu_try_blockalign(s->data_file->bs,
2052                                             QCOW_MAX_CRYPT_CLUSTERS
2053                                             * s->cluster_size);
2054                     if (cluster_data == NULL) {
2055                         ret = -ENOMEM;
2056                         goto fail;
2057                     }
2058                 }
2059 
2060                 assert(cur_bytes <= QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size);
2061 
2062                 BLKDBG_EVENT(bs->file, BLKDBG_READ_AIO);
2063                 ret = bdrv_co_pread(s->data_file,
2064                                     cluster_offset + offset_in_cluster,
2065                                     cur_bytes, cluster_data, 0);
2066                 if (ret < 0) {
2067                     goto fail;
2068                 }
2069 
2070                 assert((offset & (BDRV_SECTOR_SIZE - 1)) == 0);
2071                 assert((cur_bytes & (BDRV_SECTOR_SIZE - 1)) == 0);
2072                 if (qcow2_co_decrypt(bs, cluster_offset, offset,
2073                                      cluster_data, cur_bytes) < 0) {
2074                     ret = -EIO;
2075                     goto fail;
2076                 }
2077                 qemu_iovec_from_buf(qiov, qiov_offset, cluster_data, cur_bytes);
2078             } else {
2079                 BLKDBG_EVENT(bs->file, BLKDBG_READ_AIO);
2080                 ret = bdrv_co_preadv_part(s->data_file,
2081                                           cluster_offset + offset_in_cluster,
2082                                           cur_bytes, qiov, qiov_offset, 0);
2083                 if (ret < 0) {
2084                     goto fail;
2085                 }
2086             }
2087             break;
2088 
2089         default:
2090             g_assert_not_reached();
2091             ret = -EIO;
2092             goto fail;
2093         }
2094 
2095         bytes -= cur_bytes;
2096         offset += cur_bytes;
2097         qiov_offset += cur_bytes;
2098     }
2099     ret = 0;
2100 
2101 fail:
2102     qemu_vfree(cluster_data);
2103 
2104     return ret;
2105 }
2106 
2107 /* Check if it's possible to merge a write request with the writing of
2108  * the data from the COW regions */
2109 static bool merge_cow(uint64_t offset, unsigned bytes,
2110                       QEMUIOVector *qiov, size_t qiov_offset,
2111                       QCowL2Meta *l2meta)
2112 {
2113     QCowL2Meta *m;
2114 
2115     for (m = l2meta; m != NULL; m = m->next) {
2116         /* If both COW regions are empty then there's nothing to merge */
2117         if (m->cow_start.nb_bytes == 0 && m->cow_end.nb_bytes == 0) {
2118             continue;
2119         }
2120 
2121         /* If COW regions are handled already, skip this too */
2122         if (m->skip_cow) {
2123             continue;
2124         }
2125 
2126         /* The data (middle) region must be immediately after the
2127          * start region */
2128         if (l2meta_cow_start(m) + m->cow_start.nb_bytes != offset) {
2129             continue;
2130         }
2131 
2132         /* The end region must be immediately after the data (middle)
2133          * region */
2134         if (m->offset + m->cow_end.offset != offset + bytes) {
2135             continue;
2136         }
2137 
2138         /* Make sure that adding both COW regions to the QEMUIOVector
2139          * does not exceed IOV_MAX */
2140         if (qemu_iovec_subvec_niov(qiov, qiov_offset, bytes) > IOV_MAX - 2) {
2141             continue;
2142         }
2143 
2144         m->data_qiov = qiov;
2145         m->data_qiov_offset = qiov_offset;
2146         return true;
2147     }
2148 
2149     return false;
2150 }
2151 
2152 static bool is_unallocated(BlockDriverState *bs, int64_t offset, int64_t bytes)
2153 {
2154     int64_t nr;
2155     return !bytes ||
2156         (!bdrv_is_allocated_above(bs, NULL, false, offset, bytes, &nr) &&
2157          nr == bytes);
2158 }
2159 
2160 static bool is_zero_cow(BlockDriverState *bs, QCowL2Meta *m)
2161 {
2162     /*
2163      * This check is designed for optimization shortcut so it must be
2164      * efficient.
2165      * Instead of is_zero(), use is_unallocated() as it is faster (but not
2166      * as accurate and can result in false negatives).
2167      */
2168     return is_unallocated(bs, m->offset + m->cow_start.offset,
2169                           m->cow_start.nb_bytes) &&
2170            is_unallocated(bs, m->offset + m->cow_end.offset,
2171                           m->cow_end.nb_bytes);
2172 }
2173 
2174 static int handle_alloc_space(BlockDriverState *bs, QCowL2Meta *l2meta)
2175 {
2176     BDRVQcow2State *s = bs->opaque;
2177     QCowL2Meta *m;
2178 
2179     if (!(s->data_file->bs->supported_zero_flags & BDRV_REQ_NO_FALLBACK)) {
2180         return 0;
2181     }
2182 
2183     if (bs->encrypted) {
2184         return 0;
2185     }
2186 
2187     for (m = l2meta; m != NULL; m = m->next) {
2188         int ret;
2189 
2190         if (!m->cow_start.nb_bytes && !m->cow_end.nb_bytes) {
2191             continue;
2192         }
2193 
2194         if (!is_zero_cow(bs, m)) {
2195             continue;
2196         }
2197 
2198         /*
2199          * instead of writing zero COW buffers,
2200          * efficiently zero out the whole clusters
2201          */
2202 
2203         ret = qcow2_pre_write_overlap_check(bs, 0, m->alloc_offset,
2204                                             m->nb_clusters * s->cluster_size,
2205                                             true);
2206         if (ret < 0) {
2207             return ret;
2208         }
2209 
2210         BLKDBG_EVENT(bs->file, BLKDBG_CLUSTER_ALLOC_SPACE);
2211         ret = bdrv_co_pwrite_zeroes(s->data_file, m->alloc_offset,
2212                                     m->nb_clusters * s->cluster_size,
2213                                     BDRV_REQ_NO_FALLBACK);
2214         if (ret < 0) {
2215             if (ret != -ENOTSUP && ret != -EAGAIN) {
2216                 return ret;
2217             }
2218             continue;
2219         }
2220 
2221         trace_qcow2_skip_cow(qemu_coroutine_self(), m->offset, m->nb_clusters);
2222         m->skip_cow = true;
2223     }
2224     return 0;
2225 }
2226 
2227 static coroutine_fn int qcow2_co_pwritev_part(
2228         BlockDriverState *bs, uint64_t offset, uint64_t bytes,
2229         QEMUIOVector *qiov, size_t qiov_offset, int flags)
2230 {
2231     BDRVQcow2State *s = bs->opaque;
2232     int offset_in_cluster;
2233     int ret;
2234     unsigned int cur_bytes; /* number of sectors in current iteration */
2235     uint64_t cluster_offset;
2236     QEMUIOVector encrypted_qiov;
2237     uint64_t bytes_done = 0;
2238     uint8_t *cluster_data = NULL;
2239     QCowL2Meta *l2meta = NULL;
2240 
2241     trace_qcow2_writev_start_req(qemu_coroutine_self(), offset, bytes);
2242 
2243     qemu_co_mutex_lock(&s->lock);
2244 
2245     while (bytes != 0) {
2246 
2247         l2meta = NULL;
2248 
2249         trace_qcow2_writev_start_part(qemu_coroutine_self());
2250         offset_in_cluster = offset_into_cluster(s, offset);
2251         cur_bytes = MIN(bytes, INT_MAX);
2252         if (bs->encrypted) {
2253             cur_bytes = MIN(cur_bytes,
2254                             QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size
2255                             - offset_in_cluster);
2256         }
2257 
2258         ret = qcow2_alloc_cluster_offset(bs, offset, &cur_bytes,
2259                                          &cluster_offset, &l2meta);
2260         if (ret < 0) {
2261             goto out_locked;
2262         }
2263 
2264         assert((cluster_offset & 511) == 0);
2265 
2266         ret = qcow2_pre_write_overlap_check(bs, 0,
2267                                             cluster_offset + offset_in_cluster,
2268                                             cur_bytes, true);
2269         if (ret < 0) {
2270             goto out_locked;
2271         }
2272 
2273         qemu_co_mutex_unlock(&s->lock);
2274 
2275         if (bs->encrypted) {
2276             assert(s->crypto);
2277             if (!cluster_data) {
2278                 cluster_data = qemu_try_blockalign(bs->file->bs,
2279                                                    QCOW_MAX_CRYPT_CLUSTERS
2280                                                    * s->cluster_size);
2281                 if (cluster_data == NULL) {
2282                     ret = -ENOMEM;
2283                     goto out_unlocked;
2284                 }
2285             }
2286 
2287             assert(cur_bytes <= QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size);
2288             qemu_iovec_to_buf(qiov, qiov_offset + bytes_done,
2289                               cluster_data, cur_bytes);
2290 
2291             if (qcow2_co_encrypt(bs, cluster_offset, offset,
2292                                  cluster_data, cur_bytes) < 0) {
2293                 ret = -EIO;
2294                 goto out_unlocked;
2295             }
2296 
2297             qemu_iovec_init_buf(&encrypted_qiov, cluster_data, cur_bytes);
2298         }
2299 
2300         /* Try to efficiently initialize the physical space with zeroes */
2301         ret = handle_alloc_space(bs, l2meta);
2302         if (ret < 0) {
2303             goto out_unlocked;
2304         }
2305 
2306         /* If we need to do COW, check if it's possible to merge the
2307          * writing of the guest data together with that of the COW regions.
2308          * If it's not possible (or not necessary) then write the
2309          * guest data now. */
2310         if (!merge_cow(offset, cur_bytes,
2311                        bs->encrypted ? &encrypted_qiov : qiov,
2312                        bs->encrypted ? 0 : qiov_offset + bytes_done, l2meta))
2313         {
2314             BLKDBG_EVENT(bs->file, BLKDBG_WRITE_AIO);
2315             trace_qcow2_writev_data(qemu_coroutine_self(),
2316                                     cluster_offset + offset_in_cluster);
2317             ret = bdrv_co_pwritev_part(
2318                     s->data_file, cluster_offset + offset_in_cluster, cur_bytes,
2319                     bs->encrypted ? &encrypted_qiov : qiov,
2320                     bs->encrypted ? 0 : qiov_offset + bytes_done, 0);
2321             if (ret < 0) {
2322                 goto out_unlocked;
2323             }
2324         }
2325 
2326         qemu_co_mutex_lock(&s->lock);
2327 
2328         ret = qcow2_handle_l2meta(bs, &l2meta, true);
2329         if (ret) {
2330             goto out_locked;
2331         }
2332 
2333         bytes -= cur_bytes;
2334         offset += cur_bytes;
2335         bytes_done += cur_bytes;
2336         trace_qcow2_writev_done_part(qemu_coroutine_self(), cur_bytes);
2337     }
2338     ret = 0;
2339     goto out_locked;
2340 
2341 out_unlocked:
2342     qemu_co_mutex_lock(&s->lock);
2343 
2344 out_locked:
2345     qcow2_handle_l2meta(bs, &l2meta, false);
2346 
2347     qemu_co_mutex_unlock(&s->lock);
2348 
2349     qemu_vfree(cluster_data);
2350     trace_qcow2_writev_done_req(qemu_coroutine_self(), ret);
2351 
2352     return ret;
2353 }
2354 
2355 static int qcow2_inactivate(BlockDriverState *bs)
2356 {
2357     BDRVQcow2State *s = bs->opaque;
2358     int ret, result = 0;
2359     Error *local_err = NULL;
2360 
2361     qcow2_store_persistent_dirty_bitmaps(bs, &local_err);
2362     if (local_err != NULL) {
2363         result = -EINVAL;
2364         error_reportf_err(local_err, "Lost persistent bitmaps during "
2365                           "inactivation of node '%s': ",
2366                           bdrv_get_device_or_node_name(bs));
2367     }
2368 
2369     ret = qcow2_cache_flush(bs, s->l2_table_cache);
2370     if (ret) {
2371         result = ret;
2372         error_report("Failed to flush the L2 table cache: %s",
2373                      strerror(-ret));
2374     }
2375 
2376     ret = qcow2_cache_flush(bs, s->refcount_block_cache);
2377     if (ret) {
2378         result = ret;
2379         error_report("Failed to flush the refcount block cache: %s",
2380                      strerror(-ret));
2381     }
2382 
2383     if (result == 0) {
2384         qcow2_mark_clean(bs);
2385     }
2386 
2387     return result;
2388 }
2389 
2390 static void qcow2_close(BlockDriverState *bs)
2391 {
2392     BDRVQcow2State *s = bs->opaque;
2393     qemu_vfree(s->l1_table);
2394     /* else pre-write overlap checks in cache_destroy may crash */
2395     s->l1_table = NULL;
2396 
2397     if (!(s->flags & BDRV_O_INACTIVE)) {
2398         qcow2_inactivate(bs);
2399     }
2400 
2401     cache_clean_timer_del(bs);
2402     qcow2_cache_destroy(s->l2_table_cache);
2403     qcow2_cache_destroy(s->refcount_block_cache);
2404 
2405     qcrypto_block_free(s->crypto);
2406     s->crypto = NULL;
2407 
2408     g_free(s->unknown_header_fields);
2409     cleanup_unknown_header_ext(bs);
2410 
2411     g_free(s->image_data_file);
2412     g_free(s->image_backing_file);
2413     g_free(s->image_backing_format);
2414 
2415     if (has_data_file(bs)) {
2416         bdrv_unref_child(bs, s->data_file);
2417     }
2418 
2419     qcow2_refcount_close(bs);
2420     qcow2_free_snapshots(bs);
2421 }
2422 
2423 static void coroutine_fn qcow2_co_invalidate_cache(BlockDriverState *bs,
2424                                                    Error **errp)
2425 {
2426     BDRVQcow2State *s = bs->opaque;
2427     int flags = s->flags;
2428     QCryptoBlock *crypto = NULL;
2429     QDict *options;
2430     Error *local_err = NULL;
2431     int ret;
2432 
2433     /*
2434      * Backing files are read-only which makes all of their metadata immutable,
2435      * that means we don't have to worry about reopening them here.
2436      */
2437 
2438     crypto = s->crypto;
2439     s->crypto = NULL;
2440 
2441     qcow2_close(bs);
2442 
2443     memset(s, 0, sizeof(BDRVQcow2State));
2444     options = qdict_clone_shallow(bs->options);
2445 
2446     flags &= ~BDRV_O_INACTIVE;
2447     qemu_co_mutex_lock(&s->lock);
2448     ret = qcow2_do_open(bs, options, flags, &local_err);
2449     qemu_co_mutex_unlock(&s->lock);
2450     qobject_unref(options);
2451     if (local_err) {
2452         error_propagate_prepend(errp, local_err,
2453                                 "Could not reopen qcow2 layer: ");
2454         bs->drv = NULL;
2455         return;
2456     } else if (ret < 0) {
2457         error_setg_errno(errp, -ret, "Could not reopen qcow2 layer");
2458         bs->drv = NULL;
2459         return;
2460     }
2461 
2462     s->crypto = crypto;
2463 }
2464 
2465 static size_t header_ext_add(char *buf, uint32_t magic, const void *s,
2466     size_t len, size_t buflen)
2467 {
2468     QCowExtension *ext_backing_fmt = (QCowExtension*) buf;
2469     size_t ext_len = sizeof(QCowExtension) + ((len + 7) & ~7);
2470 
2471     if (buflen < ext_len) {
2472         return -ENOSPC;
2473     }
2474 
2475     *ext_backing_fmt = (QCowExtension) {
2476         .magic  = cpu_to_be32(magic),
2477         .len    = cpu_to_be32(len),
2478     };
2479 
2480     if (len) {
2481         memcpy(buf + sizeof(QCowExtension), s, len);
2482     }
2483 
2484     return ext_len;
2485 }
2486 
2487 /*
2488  * Updates the qcow2 header, including the variable length parts of it, i.e.
2489  * the backing file name and all extensions. qcow2 was not designed to allow
2490  * such changes, so if we run out of space (we can only use the first cluster)
2491  * this function may fail.
2492  *
2493  * Returns 0 on success, -errno in error cases.
2494  */
2495 int qcow2_update_header(BlockDriverState *bs)
2496 {
2497     BDRVQcow2State *s = bs->opaque;
2498     QCowHeader *header;
2499     char *buf;
2500     size_t buflen = s->cluster_size;
2501     int ret;
2502     uint64_t total_size;
2503     uint32_t refcount_table_clusters;
2504     size_t header_length;
2505     Qcow2UnknownHeaderExtension *uext;
2506 
2507     buf = qemu_blockalign(bs, buflen);
2508 
2509     /* Header structure */
2510     header = (QCowHeader*) buf;
2511 
2512     if (buflen < sizeof(*header)) {
2513         ret = -ENOSPC;
2514         goto fail;
2515     }
2516 
2517     header_length = sizeof(*header) + s->unknown_header_fields_size;
2518     total_size = bs->total_sectors * BDRV_SECTOR_SIZE;
2519     refcount_table_clusters = s->refcount_table_size >> (s->cluster_bits - 3);
2520 
2521     *header = (QCowHeader) {
2522         /* Version 2 fields */
2523         .magic                  = cpu_to_be32(QCOW_MAGIC),
2524         .version                = cpu_to_be32(s->qcow_version),
2525         .backing_file_offset    = 0,
2526         .backing_file_size      = 0,
2527         .cluster_bits           = cpu_to_be32(s->cluster_bits),
2528         .size                   = cpu_to_be64(total_size),
2529         .crypt_method           = cpu_to_be32(s->crypt_method_header),
2530         .l1_size                = cpu_to_be32(s->l1_size),
2531         .l1_table_offset        = cpu_to_be64(s->l1_table_offset),
2532         .refcount_table_offset  = cpu_to_be64(s->refcount_table_offset),
2533         .refcount_table_clusters = cpu_to_be32(refcount_table_clusters),
2534         .nb_snapshots           = cpu_to_be32(s->nb_snapshots),
2535         .snapshots_offset       = cpu_to_be64(s->snapshots_offset),
2536 
2537         /* Version 3 fields */
2538         .incompatible_features  = cpu_to_be64(s->incompatible_features),
2539         .compatible_features    = cpu_to_be64(s->compatible_features),
2540         .autoclear_features     = cpu_to_be64(s->autoclear_features),
2541         .refcount_order         = cpu_to_be32(s->refcount_order),
2542         .header_length          = cpu_to_be32(header_length),
2543     };
2544 
2545     /* For older versions, write a shorter header */
2546     switch (s->qcow_version) {
2547     case 2:
2548         ret = offsetof(QCowHeader, incompatible_features);
2549         break;
2550     case 3:
2551         ret = sizeof(*header);
2552         break;
2553     default:
2554         ret = -EINVAL;
2555         goto fail;
2556     }
2557 
2558     buf += ret;
2559     buflen -= ret;
2560     memset(buf, 0, buflen);
2561 
2562     /* Preserve any unknown field in the header */
2563     if (s->unknown_header_fields_size) {
2564         if (buflen < s->unknown_header_fields_size) {
2565             ret = -ENOSPC;
2566             goto fail;
2567         }
2568 
2569         memcpy(buf, s->unknown_header_fields, s->unknown_header_fields_size);
2570         buf += s->unknown_header_fields_size;
2571         buflen -= s->unknown_header_fields_size;
2572     }
2573 
2574     /* Backing file format header extension */
2575     if (s->image_backing_format) {
2576         ret = header_ext_add(buf, QCOW2_EXT_MAGIC_BACKING_FORMAT,
2577                              s->image_backing_format,
2578                              strlen(s->image_backing_format),
2579                              buflen);
2580         if (ret < 0) {
2581             goto fail;
2582         }
2583 
2584         buf += ret;
2585         buflen -= ret;
2586     }
2587 
2588     /* External data file header extension */
2589     if (has_data_file(bs) && s->image_data_file) {
2590         ret = header_ext_add(buf, QCOW2_EXT_MAGIC_DATA_FILE,
2591                              s->image_data_file, strlen(s->image_data_file),
2592                              buflen);
2593         if (ret < 0) {
2594             goto fail;
2595         }
2596 
2597         buf += ret;
2598         buflen -= ret;
2599     }
2600 
2601     /* Full disk encryption header pointer extension */
2602     if (s->crypto_header.offset != 0) {
2603         s->crypto_header.offset = cpu_to_be64(s->crypto_header.offset);
2604         s->crypto_header.length = cpu_to_be64(s->crypto_header.length);
2605         ret = header_ext_add(buf, QCOW2_EXT_MAGIC_CRYPTO_HEADER,
2606                              &s->crypto_header, sizeof(s->crypto_header),
2607                              buflen);
2608         s->crypto_header.offset = be64_to_cpu(s->crypto_header.offset);
2609         s->crypto_header.length = be64_to_cpu(s->crypto_header.length);
2610         if (ret < 0) {
2611             goto fail;
2612         }
2613         buf += ret;
2614         buflen -= ret;
2615     }
2616 
2617     /* Feature table */
2618     if (s->qcow_version >= 3) {
2619         Qcow2Feature features[] = {
2620             {
2621                 .type = QCOW2_FEAT_TYPE_INCOMPATIBLE,
2622                 .bit  = QCOW2_INCOMPAT_DIRTY_BITNR,
2623                 .name = "dirty bit",
2624             },
2625             {
2626                 .type = QCOW2_FEAT_TYPE_INCOMPATIBLE,
2627                 .bit  = QCOW2_INCOMPAT_CORRUPT_BITNR,
2628                 .name = "corrupt bit",
2629             },
2630             {
2631                 .type = QCOW2_FEAT_TYPE_INCOMPATIBLE,
2632                 .bit  = QCOW2_INCOMPAT_DATA_FILE_BITNR,
2633                 .name = "external data file",
2634             },
2635             {
2636                 .type = QCOW2_FEAT_TYPE_COMPATIBLE,
2637                 .bit  = QCOW2_COMPAT_LAZY_REFCOUNTS_BITNR,
2638                 .name = "lazy refcounts",
2639             },
2640         };
2641 
2642         ret = header_ext_add(buf, QCOW2_EXT_MAGIC_FEATURE_TABLE,
2643                              features, sizeof(features), buflen);
2644         if (ret < 0) {
2645             goto fail;
2646         }
2647         buf += ret;
2648         buflen -= ret;
2649     }
2650 
2651     /* Bitmap extension */
2652     if (s->nb_bitmaps > 0) {
2653         Qcow2BitmapHeaderExt bitmaps_header = {
2654             .nb_bitmaps = cpu_to_be32(s->nb_bitmaps),
2655             .bitmap_directory_size =
2656                     cpu_to_be64(s->bitmap_directory_size),
2657             .bitmap_directory_offset =
2658                     cpu_to_be64(s->bitmap_directory_offset)
2659         };
2660         ret = header_ext_add(buf, QCOW2_EXT_MAGIC_BITMAPS,
2661                              &bitmaps_header, sizeof(bitmaps_header),
2662                              buflen);
2663         if (ret < 0) {
2664             goto fail;
2665         }
2666         buf += ret;
2667         buflen -= ret;
2668     }
2669 
2670     /* Keep unknown header extensions */
2671     QLIST_FOREACH(uext, &s->unknown_header_ext, next) {
2672         ret = header_ext_add(buf, uext->magic, uext->data, uext->len, buflen);
2673         if (ret < 0) {
2674             goto fail;
2675         }
2676 
2677         buf += ret;
2678         buflen -= ret;
2679     }
2680 
2681     /* End of header extensions */
2682     ret = header_ext_add(buf, QCOW2_EXT_MAGIC_END, NULL, 0, buflen);
2683     if (ret < 0) {
2684         goto fail;
2685     }
2686 
2687     buf += ret;
2688     buflen -= ret;
2689 
2690     /* Backing file name */
2691     if (s->image_backing_file) {
2692         size_t backing_file_len = strlen(s->image_backing_file);
2693 
2694         if (buflen < backing_file_len) {
2695             ret = -ENOSPC;
2696             goto fail;
2697         }
2698 
2699         /* Using strncpy is ok here, since buf is not NUL-terminated. */
2700         strncpy(buf, s->image_backing_file, buflen);
2701 
2702         header->backing_file_offset = cpu_to_be64(buf - ((char*) header));
2703         header->backing_file_size   = cpu_to_be32(backing_file_len);
2704     }
2705 
2706     /* Write the new header */
2707     ret = bdrv_pwrite(bs->file, 0, header, s->cluster_size);
2708     if (ret < 0) {
2709         goto fail;
2710     }
2711 
2712     ret = 0;
2713 fail:
2714     qemu_vfree(header);
2715     return ret;
2716 }
2717 
2718 static int qcow2_change_backing_file(BlockDriverState *bs,
2719     const char *backing_file, const char *backing_fmt)
2720 {
2721     BDRVQcow2State *s = bs->opaque;
2722 
2723     /* Adding a backing file means that the external data file alone won't be
2724      * enough to make sense of the content */
2725     if (backing_file && data_file_is_raw(bs)) {
2726         return -EINVAL;
2727     }
2728 
2729     if (backing_file && strlen(backing_file) > 1023) {
2730         return -EINVAL;
2731     }
2732 
2733     pstrcpy(bs->auto_backing_file, sizeof(bs->auto_backing_file),
2734             backing_file ?: "");
2735     pstrcpy(bs->backing_file, sizeof(bs->backing_file), backing_file ?: "");
2736     pstrcpy(bs->backing_format, sizeof(bs->backing_format), backing_fmt ?: "");
2737 
2738     g_free(s->image_backing_file);
2739     g_free(s->image_backing_format);
2740 
2741     s->image_backing_file = backing_file ? g_strdup(bs->backing_file) : NULL;
2742     s->image_backing_format = backing_fmt ? g_strdup(bs->backing_format) : NULL;
2743 
2744     return qcow2_update_header(bs);
2745 }
2746 
2747 static int qcow2_crypt_method_from_format(const char *encryptfmt)
2748 {
2749     if (g_str_equal(encryptfmt, "luks")) {
2750         return QCOW_CRYPT_LUKS;
2751     } else if (g_str_equal(encryptfmt, "aes")) {
2752         return QCOW_CRYPT_AES;
2753     } else {
2754         return -EINVAL;
2755     }
2756 }
2757 
2758 static int qcow2_set_up_encryption(BlockDriverState *bs,
2759                                    QCryptoBlockCreateOptions *cryptoopts,
2760                                    Error **errp)
2761 {
2762     BDRVQcow2State *s = bs->opaque;
2763     QCryptoBlock *crypto = NULL;
2764     int fmt, ret;
2765 
2766     switch (cryptoopts->format) {
2767     case Q_CRYPTO_BLOCK_FORMAT_LUKS:
2768         fmt = QCOW_CRYPT_LUKS;
2769         break;
2770     case Q_CRYPTO_BLOCK_FORMAT_QCOW:
2771         fmt = QCOW_CRYPT_AES;
2772         break;
2773     default:
2774         error_setg(errp, "Crypto format not supported in qcow2");
2775         return -EINVAL;
2776     }
2777 
2778     s->crypt_method_header = fmt;
2779 
2780     crypto = qcrypto_block_create(cryptoopts, "encrypt.",
2781                                   qcow2_crypto_hdr_init_func,
2782                                   qcow2_crypto_hdr_write_func,
2783                                   bs, errp);
2784     if (!crypto) {
2785         return -EINVAL;
2786     }
2787 
2788     ret = qcow2_update_header(bs);
2789     if (ret < 0) {
2790         error_setg_errno(errp, -ret, "Could not write encryption header");
2791         goto out;
2792     }
2793 
2794     ret = 0;
2795  out:
2796     qcrypto_block_free(crypto);
2797     return ret;
2798 }
2799 
2800 /**
2801  * Preallocates metadata structures for data clusters between @offset (in the
2802  * guest disk) and @new_length (which is thus generally the new guest disk
2803  * size).
2804  *
2805  * Returns: 0 on success, -errno on failure.
2806  */
2807 static int coroutine_fn preallocate_co(BlockDriverState *bs, uint64_t offset,
2808                                        uint64_t new_length, PreallocMode mode,
2809                                        Error **errp)
2810 {
2811     BDRVQcow2State *s = bs->opaque;
2812     uint64_t bytes;
2813     uint64_t host_offset = 0;
2814     int64_t file_length;
2815     unsigned int cur_bytes;
2816     int ret;
2817     QCowL2Meta *meta;
2818 
2819     assert(offset <= new_length);
2820     bytes = new_length - offset;
2821 
2822     while (bytes) {
2823         cur_bytes = MIN(bytes, QEMU_ALIGN_DOWN(INT_MAX, s->cluster_size));
2824         ret = qcow2_alloc_cluster_offset(bs, offset, &cur_bytes,
2825                                          &host_offset, &meta);
2826         if (ret < 0) {
2827             error_setg_errno(errp, -ret, "Allocating clusters failed");
2828             return ret;
2829         }
2830 
2831         while (meta) {
2832             QCowL2Meta *next = meta->next;
2833 
2834             ret = qcow2_alloc_cluster_link_l2(bs, meta);
2835             if (ret < 0) {
2836                 error_setg_errno(errp, -ret, "Mapping clusters failed");
2837                 qcow2_free_any_clusters(bs, meta->alloc_offset,
2838                                         meta->nb_clusters, QCOW2_DISCARD_NEVER);
2839                 return ret;
2840             }
2841 
2842             /* There are no dependent requests, but we need to remove our
2843              * request from the list of in-flight requests */
2844             QLIST_REMOVE(meta, next_in_flight);
2845 
2846             g_free(meta);
2847             meta = next;
2848         }
2849 
2850         /* TODO Preallocate data if requested */
2851 
2852         bytes -= cur_bytes;
2853         offset += cur_bytes;
2854     }
2855 
2856     /*
2857      * It is expected that the image file is large enough to actually contain
2858      * all of the allocated clusters (otherwise we get failing reads after
2859      * EOF). Extend the image to the last allocated sector.
2860      */
2861     file_length = bdrv_getlength(s->data_file->bs);
2862     if (file_length < 0) {
2863         error_setg_errno(errp, -file_length, "Could not get file size");
2864         return file_length;
2865     }
2866 
2867     if (host_offset + cur_bytes > file_length) {
2868         if (mode == PREALLOC_MODE_METADATA) {
2869             mode = PREALLOC_MODE_OFF;
2870         }
2871         ret = bdrv_co_truncate(s->data_file, host_offset + cur_bytes, mode,
2872                                errp);
2873         if (ret < 0) {
2874             return ret;
2875         }
2876     }
2877 
2878     return 0;
2879 }
2880 
2881 /* qcow2_refcount_metadata_size:
2882  * @clusters: number of clusters to refcount (including data and L1/L2 tables)
2883  * @cluster_size: size of a cluster, in bytes
2884  * @refcount_order: refcount bits power-of-2 exponent
2885  * @generous_increase: allow for the refcount table to be 1.5x as large as it
2886  *                     needs to be
2887  *
2888  * Returns: Number of bytes required for refcount blocks and table metadata.
2889  */
2890 int64_t qcow2_refcount_metadata_size(int64_t clusters, size_t cluster_size,
2891                                      int refcount_order, bool generous_increase,
2892                                      uint64_t *refblock_count)
2893 {
2894     /*
2895      * Every host cluster is reference-counted, including metadata (even
2896      * refcount metadata is recursively included).
2897      *
2898      * An accurate formula for the size of refcount metadata size is difficult
2899      * to derive.  An easier method of calculation is finding the fixed point
2900      * where no further refcount blocks or table clusters are required to
2901      * reference count every cluster.
2902      */
2903     int64_t blocks_per_table_cluster = cluster_size / sizeof(uint64_t);
2904     int64_t refcounts_per_block = cluster_size * 8 / (1 << refcount_order);
2905     int64_t table = 0;  /* number of refcount table clusters */
2906     int64_t blocks = 0; /* number of refcount block clusters */
2907     int64_t last;
2908     int64_t n = 0;
2909 
2910     do {
2911         last = n;
2912         blocks = DIV_ROUND_UP(clusters + table + blocks, refcounts_per_block);
2913         table = DIV_ROUND_UP(blocks, blocks_per_table_cluster);
2914         n = clusters + blocks + table;
2915 
2916         if (n == last && generous_increase) {
2917             clusters += DIV_ROUND_UP(table, 2);
2918             n = 0; /* force another loop */
2919             generous_increase = false;
2920         }
2921     } while (n != last);
2922 
2923     if (refblock_count) {
2924         *refblock_count = blocks;
2925     }
2926 
2927     return (blocks + table) * cluster_size;
2928 }
2929 
2930 /**
2931  * qcow2_calc_prealloc_size:
2932  * @total_size: virtual disk size in bytes
2933  * @cluster_size: cluster size in bytes
2934  * @refcount_order: refcount bits power-of-2 exponent
2935  *
2936  * Returns: Total number of bytes required for the fully allocated image
2937  * (including metadata).
2938  */
2939 static int64_t qcow2_calc_prealloc_size(int64_t total_size,
2940                                         size_t cluster_size,
2941                                         int refcount_order)
2942 {
2943     int64_t meta_size = 0;
2944     uint64_t nl1e, nl2e;
2945     int64_t aligned_total_size = ROUND_UP(total_size, cluster_size);
2946 
2947     /* header: 1 cluster */
2948     meta_size += cluster_size;
2949 
2950     /* total size of L2 tables */
2951     nl2e = aligned_total_size / cluster_size;
2952     nl2e = ROUND_UP(nl2e, cluster_size / sizeof(uint64_t));
2953     meta_size += nl2e * sizeof(uint64_t);
2954 
2955     /* total size of L1 tables */
2956     nl1e = nl2e * sizeof(uint64_t) / cluster_size;
2957     nl1e = ROUND_UP(nl1e, cluster_size / sizeof(uint64_t));
2958     meta_size += nl1e * sizeof(uint64_t);
2959 
2960     /* total size of refcount table and blocks */
2961     meta_size += qcow2_refcount_metadata_size(
2962             (meta_size + aligned_total_size) / cluster_size,
2963             cluster_size, refcount_order, false, NULL);
2964 
2965     return meta_size + aligned_total_size;
2966 }
2967 
2968 static bool validate_cluster_size(size_t cluster_size, Error **errp)
2969 {
2970     int cluster_bits = ctz32(cluster_size);
2971     if (cluster_bits < MIN_CLUSTER_BITS || cluster_bits > MAX_CLUSTER_BITS ||
2972         (1 << cluster_bits) != cluster_size)
2973     {
2974         error_setg(errp, "Cluster size must be a power of two between %d and "
2975                    "%dk", 1 << MIN_CLUSTER_BITS, 1 << (MAX_CLUSTER_BITS - 10));
2976         return false;
2977     }
2978     return true;
2979 }
2980 
2981 static size_t qcow2_opt_get_cluster_size_del(QemuOpts *opts, Error **errp)
2982 {
2983     size_t cluster_size;
2984 
2985     cluster_size = qemu_opt_get_size_del(opts, BLOCK_OPT_CLUSTER_SIZE,
2986                                          DEFAULT_CLUSTER_SIZE);
2987     if (!validate_cluster_size(cluster_size, errp)) {
2988         return 0;
2989     }
2990     return cluster_size;
2991 }
2992 
2993 static int qcow2_opt_get_version_del(QemuOpts *opts, Error **errp)
2994 {
2995     char *buf;
2996     int ret;
2997 
2998     buf = qemu_opt_get_del(opts, BLOCK_OPT_COMPAT_LEVEL);
2999     if (!buf) {
3000         ret = 3; /* default */
3001     } else if (!strcmp(buf, "0.10")) {
3002         ret = 2;
3003     } else if (!strcmp(buf, "1.1")) {
3004         ret = 3;
3005     } else {
3006         error_setg(errp, "Invalid compatibility level: '%s'", buf);
3007         ret = -EINVAL;
3008     }
3009     g_free(buf);
3010     return ret;
3011 }
3012 
3013 static uint64_t qcow2_opt_get_refcount_bits_del(QemuOpts *opts, int version,
3014                                                 Error **errp)
3015 {
3016     uint64_t refcount_bits;
3017 
3018     refcount_bits = qemu_opt_get_number_del(opts, BLOCK_OPT_REFCOUNT_BITS, 16);
3019     if (refcount_bits > 64 || !is_power_of_2(refcount_bits)) {
3020         error_setg(errp, "Refcount width must be a power of two and may not "
3021                    "exceed 64 bits");
3022         return 0;
3023     }
3024 
3025     if (version < 3 && refcount_bits != 16) {
3026         error_setg(errp, "Different refcount widths than 16 bits require "
3027                    "compatibility level 1.1 or above (use compat=1.1 or "
3028                    "greater)");
3029         return 0;
3030     }
3031 
3032     return refcount_bits;
3033 }
3034 
3035 static int coroutine_fn
3036 qcow2_co_create(BlockdevCreateOptions *create_options, Error **errp)
3037 {
3038     BlockdevCreateOptionsQcow2 *qcow2_opts;
3039     QDict *options;
3040 
3041     /*
3042      * Open the image file and write a minimal qcow2 header.
3043      *
3044      * We keep things simple and start with a zero-sized image. We also
3045      * do without refcount blocks or a L1 table for now. We'll fix the
3046      * inconsistency later.
3047      *
3048      * We do need a refcount table because growing the refcount table means
3049      * allocating two new refcount blocks - the seconds of which would be at
3050      * 2 GB for 64k clusters, and we don't want to have a 2 GB initial file
3051      * size for any qcow2 image.
3052      */
3053     BlockBackend *blk = NULL;
3054     BlockDriverState *bs = NULL;
3055     BlockDriverState *data_bs = NULL;
3056     QCowHeader *header;
3057     size_t cluster_size;
3058     int version;
3059     int refcount_order;
3060     uint64_t* refcount_table;
3061     Error *local_err = NULL;
3062     int ret;
3063 
3064     assert(create_options->driver == BLOCKDEV_DRIVER_QCOW2);
3065     qcow2_opts = &create_options->u.qcow2;
3066 
3067     bs = bdrv_open_blockdev_ref(qcow2_opts->file, errp);
3068     if (bs == NULL) {
3069         return -EIO;
3070     }
3071 
3072     /* Validate options and set default values */
3073     if (!QEMU_IS_ALIGNED(qcow2_opts->size, BDRV_SECTOR_SIZE)) {
3074         error_setg(errp, "Image size must be a multiple of 512 bytes");
3075         ret = -EINVAL;
3076         goto out;
3077     }
3078 
3079     if (qcow2_opts->has_version) {
3080         switch (qcow2_opts->version) {
3081         case BLOCKDEV_QCOW2_VERSION_V2:
3082             version = 2;
3083             break;
3084         case BLOCKDEV_QCOW2_VERSION_V3:
3085             version = 3;
3086             break;
3087         default:
3088             g_assert_not_reached();
3089         }
3090     } else {
3091         version = 3;
3092     }
3093 
3094     if (qcow2_opts->has_cluster_size) {
3095         cluster_size = qcow2_opts->cluster_size;
3096     } else {
3097         cluster_size = DEFAULT_CLUSTER_SIZE;
3098     }
3099 
3100     if (!validate_cluster_size(cluster_size, errp)) {
3101         ret = -EINVAL;
3102         goto out;
3103     }
3104 
3105     if (!qcow2_opts->has_preallocation) {
3106         qcow2_opts->preallocation = PREALLOC_MODE_OFF;
3107     }
3108     if (qcow2_opts->has_backing_file &&
3109         qcow2_opts->preallocation != PREALLOC_MODE_OFF)
3110     {
3111         error_setg(errp, "Backing file and preallocation cannot be used at "
3112                    "the same time");
3113         ret = -EINVAL;
3114         goto out;
3115     }
3116     if (qcow2_opts->has_backing_fmt && !qcow2_opts->has_backing_file) {
3117         error_setg(errp, "Backing format cannot be used without backing file");
3118         ret = -EINVAL;
3119         goto out;
3120     }
3121 
3122     if (!qcow2_opts->has_lazy_refcounts) {
3123         qcow2_opts->lazy_refcounts = false;
3124     }
3125     if (version < 3 && qcow2_opts->lazy_refcounts) {
3126         error_setg(errp, "Lazy refcounts only supported with compatibility "
3127                    "level 1.1 and above (use version=v3 or greater)");
3128         ret = -EINVAL;
3129         goto out;
3130     }
3131 
3132     if (!qcow2_opts->has_refcount_bits) {
3133         qcow2_opts->refcount_bits = 16;
3134     }
3135     if (qcow2_opts->refcount_bits > 64 ||
3136         !is_power_of_2(qcow2_opts->refcount_bits))
3137     {
3138         error_setg(errp, "Refcount width must be a power of two and may not "
3139                    "exceed 64 bits");
3140         ret = -EINVAL;
3141         goto out;
3142     }
3143     if (version < 3 && qcow2_opts->refcount_bits != 16) {
3144         error_setg(errp, "Different refcount widths than 16 bits require "
3145                    "compatibility level 1.1 or above (use version=v3 or "
3146                    "greater)");
3147         ret = -EINVAL;
3148         goto out;
3149     }
3150     refcount_order = ctz32(qcow2_opts->refcount_bits);
3151 
3152     if (qcow2_opts->data_file_raw && !qcow2_opts->data_file) {
3153         error_setg(errp, "data-file-raw requires data-file");
3154         ret = -EINVAL;
3155         goto out;
3156     }
3157     if (qcow2_opts->data_file_raw && qcow2_opts->has_backing_file) {
3158         error_setg(errp, "Backing file and data-file-raw cannot be used at "
3159                    "the same time");
3160         ret = -EINVAL;
3161         goto out;
3162     }
3163 
3164     if (qcow2_opts->data_file) {
3165         if (version < 3) {
3166             error_setg(errp, "External data files are only supported with "
3167                        "compatibility level 1.1 and above (use version=v3 or "
3168                        "greater)");
3169             ret = -EINVAL;
3170             goto out;
3171         }
3172         data_bs = bdrv_open_blockdev_ref(qcow2_opts->data_file, errp);
3173         if (data_bs == NULL) {
3174             ret = -EIO;
3175             goto out;
3176         }
3177     }
3178 
3179     /* Create BlockBackend to write to the image */
3180     blk = blk_new(bdrv_get_aio_context(bs),
3181                   BLK_PERM_WRITE | BLK_PERM_RESIZE, BLK_PERM_ALL);
3182     ret = blk_insert_bs(blk, bs, errp);
3183     if (ret < 0) {
3184         goto out;
3185     }
3186     blk_set_allow_write_beyond_eof(blk, true);
3187 
3188     /* Clear the protocol layer and preallocate it if necessary */
3189     ret = blk_truncate(blk, 0, PREALLOC_MODE_OFF, errp);
3190     if (ret < 0) {
3191         goto out;
3192     }
3193 
3194     /* Write the header */
3195     QEMU_BUILD_BUG_ON((1 << MIN_CLUSTER_BITS) < sizeof(*header));
3196     header = g_malloc0(cluster_size);
3197     *header = (QCowHeader) {
3198         .magic                      = cpu_to_be32(QCOW_MAGIC),
3199         .version                    = cpu_to_be32(version),
3200         .cluster_bits               = cpu_to_be32(ctz32(cluster_size)),
3201         .size                       = cpu_to_be64(0),
3202         .l1_table_offset            = cpu_to_be64(0),
3203         .l1_size                    = cpu_to_be32(0),
3204         .refcount_table_offset      = cpu_to_be64(cluster_size),
3205         .refcount_table_clusters    = cpu_to_be32(1),
3206         .refcount_order             = cpu_to_be32(refcount_order),
3207         .header_length              = cpu_to_be32(sizeof(*header)),
3208     };
3209 
3210     /* We'll update this to correct value later */
3211     header->crypt_method = cpu_to_be32(QCOW_CRYPT_NONE);
3212 
3213     if (qcow2_opts->lazy_refcounts) {
3214         header->compatible_features |=
3215             cpu_to_be64(QCOW2_COMPAT_LAZY_REFCOUNTS);
3216     }
3217     if (data_bs) {
3218         header->incompatible_features |=
3219             cpu_to_be64(QCOW2_INCOMPAT_DATA_FILE);
3220     }
3221     if (qcow2_opts->data_file_raw) {
3222         header->autoclear_features |=
3223             cpu_to_be64(QCOW2_AUTOCLEAR_DATA_FILE_RAW);
3224     }
3225 
3226     ret = blk_pwrite(blk, 0, header, cluster_size, 0);
3227     g_free(header);
3228     if (ret < 0) {
3229         error_setg_errno(errp, -ret, "Could not write qcow2 header");
3230         goto out;
3231     }
3232 
3233     /* Write a refcount table with one refcount block */
3234     refcount_table = g_malloc0(2 * cluster_size);
3235     refcount_table[0] = cpu_to_be64(2 * cluster_size);
3236     ret = blk_pwrite(blk, cluster_size, refcount_table, 2 * cluster_size, 0);
3237     g_free(refcount_table);
3238 
3239     if (ret < 0) {
3240         error_setg_errno(errp, -ret, "Could not write refcount table");
3241         goto out;
3242     }
3243 
3244     blk_unref(blk);
3245     blk = NULL;
3246 
3247     /*
3248      * And now open the image and make it consistent first (i.e. increase the
3249      * refcount of the cluster that is occupied by the header and the refcount
3250      * table)
3251      */
3252     options = qdict_new();
3253     qdict_put_str(options, "driver", "qcow2");
3254     qdict_put_str(options, "file", bs->node_name);
3255     if (data_bs) {
3256         qdict_put_str(options, "data-file", data_bs->node_name);
3257     }
3258     blk = blk_new_open(NULL, NULL, options,
3259                        BDRV_O_RDWR | BDRV_O_RESIZE | BDRV_O_NO_FLUSH,
3260                        &local_err);
3261     if (blk == NULL) {
3262         error_propagate(errp, local_err);
3263         ret = -EIO;
3264         goto out;
3265     }
3266 
3267     ret = qcow2_alloc_clusters(blk_bs(blk), 3 * cluster_size);
3268     if (ret < 0) {
3269         error_setg_errno(errp, -ret, "Could not allocate clusters for qcow2 "
3270                          "header and refcount table");
3271         goto out;
3272 
3273     } else if (ret != 0) {
3274         error_report("Huh, first cluster in empty image is already in use?");
3275         abort();
3276     }
3277 
3278     /* Set the external data file if necessary */
3279     if (data_bs) {
3280         BDRVQcow2State *s = blk_bs(blk)->opaque;
3281         s->image_data_file = g_strdup(data_bs->filename);
3282     }
3283 
3284     /* Create a full header (including things like feature table) */
3285     ret = qcow2_update_header(blk_bs(blk));
3286     if (ret < 0) {
3287         error_setg_errno(errp, -ret, "Could not update qcow2 header");
3288         goto out;
3289     }
3290 
3291     /* Okay, now that we have a valid image, let's give it the right size */
3292     ret = blk_truncate(blk, qcow2_opts->size, qcow2_opts->preallocation, errp);
3293     if (ret < 0) {
3294         error_prepend(errp, "Could not resize image: ");
3295         goto out;
3296     }
3297 
3298     /* Want a backing file? There you go.*/
3299     if (qcow2_opts->has_backing_file) {
3300         const char *backing_format = NULL;
3301 
3302         if (qcow2_opts->has_backing_fmt) {
3303             backing_format = BlockdevDriver_str(qcow2_opts->backing_fmt);
3304         }
3305 
3306         ret = bdrv_change_backing_file(blk_bs(blk), qcow2_opts->backing_file,
3307                                        backing_format);
3308         if (ret < 0) {
3309             error_setg_errno(errp, -ret, "Could not assign backing file '%s' "
3310                              "with format '%s'", qcow2_opts->backing_file,
3311                              backing_format);
3312             goto out;
3313         }
3314     }
3315 
3316     /* Want encryption? There you go. */
3317     if (qcow2_opts->has_encrypt) {
3318         ret = qcow2_set_up_encryption(blk_bs(blk), qcow2_opts->encrypt, errp);
3319         if (ret < 0) {
3320             goto out;
3321         }
3322     }
3323 
3324     blk_unref(blk);
3325     blk = NULL;
3326 
3327     /* Reopen the image without BDRV_O_NO_FLUSH to flush it before returning.
3328      * Using BDRV_O_NO_IO, since encryption is now setup we don't want to
3329      * have to setup decryption context. We're not doing any I/O on the top
3330      * level BlockDriverState, only lower layers, where BDRV_O_NO_IO does
3331      * not have effect.
3332      */
3333     options = qdict_new();
3334     qdict_put_str(options, "driver", "qcow2");
3335     qdict_put_str(options, "file", bs->node_name);
3336     if (data_bs) {
3337         qdict_put_str(options, "data-file", data_bs->node_name);
3338     }
3339     blk = blk_new_open(NULL, NULL, options,
3340                        BDRV_O_RDWR | BDRV_O_NO_BACKING | BDRV_O_NO_IO,
3341                        &local_err);
3342     if (blk == NULL) {
3343         error_propagate(errp, local_err);
3344         ret = -EIO;
3345         goto out;
3346     }
3347 
3348     ret = 0;
3349 out:
3350     blk_unref(blk);
3351     bdrv_unref(bs);
3352     bdrv_unref(data_bs);
3353     return ret;
3354 }
3355 
3356 static int coroutine_fn qcow2_co_create_opts(const char *filename, QemuOpts *opts,
3357                                              Error **errp)
3358 {
3359     BlockdevCreateOptions *create_options = NULL;
3360     QDict *qdict;
3361     Visitor *v;
3362     BlockDriverState *bs = NULL;
3363     BlockDriverState *data_bs = NULL;
3364     Error *local_err = NULL;
3365     const char *val;
3366     int ret;
3367 
3368     /* Only the keyval visitor supports the dotted syntax needed for
3369      * encryption, so go through a QDict before getting a QAPI type. Ignore
3370      * options meant for the protocol layer so that the visitor doesn't
3371      * complain. */
3372     qdict = qemu_opts_to_qdict_filtered(opts, NULL, bdrv_qcow2.create_opts,
3373                                         true);
3374 
3375     /* Handle encryption options */
3376     val = qdict_get_try_str(qdict, BLOCK_OPT_ENCRYPT);
3377     if (val && !strcmp(val, "on")) {
3378         qdict_put_str(qdict, BLOCK_OPT_ENCRYPT, "qcow");
3379     } else if (val && !strcmp(val, "off")) {
3380         qdict_del(qdict, BLOCK_OPT_ENCRYPT);
3381     }
3382 
3383     val = qdict_get_try_str(qdict, BLOCK_OPT_ENCRYPT_FORMAT);
3384     if (val && !strcmp(val, "aes")) {
3385         qdict_put_str(qdict, BLOCK_OPT_ENCRYPT_FORMAT, "qcow");
3386     }
3387 
3388     /* Convert compat=0.10/1.1 into compat=v2/v3, to be renamed into
3389      * version=v2/v3 below. */
3390     val = qdict_get_try_str(qdict, BLOCK_OPT_COMPAT_LEVEL);
3391     if (val && !strcmp(val, "0.10")) {
3392         qdict_put_str(qdict, BLOCK_OPT_COMPAT_LEVEL, "v2");
3393     } else if (val && !strcmp(val, "1.1")) {
3394         qdict_put_str(qdict, BLOCK_OPT_COMPAT_LEVEL, "v3");
3395     }
3396 
3397     /* Change legacy command line options into QMP ones */
3398     static const QDictRenames opt_renames[] = {
3399         { BLOCK_OPT_BACKING_FILE,       "backing-file" },
3400         { BLOCK_OPT_BACKING_FMT,        "backing-fmt" },
3401         { BLOCK_OPT_CLUSTER_SIZE,       "cluster-size" },
3402         { BLOCK_OPT_LAZY_REFCOUNTS,     "lazy-refcounts" },
3403         { BLOCK_OPT_REFCOUNT_BITS,      "refcount-bits" },
3404         { BLOCK_OPT_ENCRYPT,            BLOCK_OPT_ENCRYPT_FORMAT },
3405         { BLOCK_OPT_COMPAT_LEVEL,       "version" },
3406         { BLOCK_OPT_DATA_FILE_RAW,      "data-file-raw" },
3407         { NULL, NULL },
3408     };
3409 
3410     if (!qdict_rename_keys(qdict, opt_renames, errp)) {
3411         ret = -EINVAL;
3412         goto finish;
3413     }
3414 
3415     /* Create and open the file (protocol layer) */
3416     ret = bdrv_create_file(filename, opts, errp);
3417     if (ret < 0) {
3418         goto finish;
3419     }
3420 
3421     bs = bdrv_open(filename, NULL, NULL,
3422                    BDRV_O_RDWR | BDRV_O_RESIZE | BDRV_O_PROTOCOL, errp);
3423     if (bs == NULL) {
3424         ret = -EIO;
3425         goto finish;
3426     }
3427 
3428     /* Create and open an external data file (protocol layer) */
3429     val = qdict_get_try_str(qdict, BLOCK_OPT_DATA_FILE);
3430     if (val) {
3431         ret = bdrv_create_file(val, opts, errp);
3432         if (ret < 0) {
3433             goto finish;
3434         }
3435 
3436         data_bs = bdrv_open(val, NULL, NULL,
3437                             BDRV_O_RDWR | BDRV_O_RESIZE | BDRV_O_PROTOCOL,
3438                             errp);
3439         if (data_bs == NULL) {
3440             ret = -EIO;
3441             goto finish;
3442         }
3443 
3444         qdict_del(qdict, BLOCK_OPT_DATA_FILE);
3445         qdict_put_str(qdict, "data-file", data_bs->node_name);
3446     }
3447 
3448     /* Set 'driver' and 'node' options */
3449     qdict_put_str(qdict, "driver", "qcow2");
3450     qdict_put_str(qdict, "file", bs->node_name);
3451 
3452     /* Now get the QAPI type BlockdevCreateOptions */
3453     v = qobject_input_visitor_new_flat_confused(qdict, errp);
3454     if (!v) {
3455         ret = -EINVAL;
3456         goto finish;
3457     }
3458 
3459     visit_type_BlockdevCreateOptions(v, NULL, &create_options, &local_err);
3460     visit_free(v);
3461 
3462     if (local_err) {
3463         error_propagate(errp, local_err);
3464         ret = -EINVAL;
3465         goto finish;
3466     }
3467 
3468     /* Silently round up size */
3469     create_options->u.qcow2.size = ROUND_UP(create_options->u.qcow2.size,
3470                                             BDRV_SECTOR_SIZE);
3471 
3472     /* Create the qcow2 image (format layer) */
3473     ret = qcow2_co_create(create_options, errp);
3474     if (ret < 0) {
3475         goto finish;
3476     }
3477 
3478     ret = 0;
3479 finish:
3480     qobject_unref(qdict);
3481     bdrv_unref(bs);
3482     bdrv_unref(data_bs);
3483     qapi_free_BlockdevCreateOptions(create_options);
3484     return ret;
3485 }
3486 
3487 
3488 static bool is_zero(BlockDriverState *bs, int64_t offset, int64_t bytes)
3489 {
3490     int64_t nr;
3491     int res;
3492 
3493     /* Clamp to image length, before checking status of underlying sectors */
3494     if (offset + bytes > bs->total_sectors * BDRV_SECTOR_SIZE) {
3495         bytes = bs->total_sectors * BDRV_SECTOR_SIZE - offset;
3496     }
3497 
3498     if (!bytes) {
3499         return true;
3500     }
3501     res = bdrv_block_status_above(bs, NULL, offset, bytes, &nr, NULL, NULL);
3502     return res >= 0 && (res & BDRV_BLOCK_ZERO) && nr == bytes;
3503 }
3504 
3505 static coroutine_fn int qcow2_co_pwrite_zeroes(BlockDriverState *bs,
3506     int64_t offset, int bytes, BdrvRequestFlags flags)
3507 {
3508     int ret;
3509     BDRVQcow2State *s = bs->opaque;
3510 
3511     uint32_t head = offset % s->cluster_size;
3512     uint32_t tail = (offset + bytes) % s->cluster_size;
3513 
3514     trace_qcow2_pwrite_zeroes_start_req(qemu_coroutine_self(), offset, bytes);
3515     if (offset + bytes == bs->total_sectors * BDRV_SECTOR_SIZE) {
3516         tail = 0;
3517     }
3518 
3519     if (head || tail) {
3520         uint64_t off;
3521         unsigned int nr;
3522 
3523         assert(head + bytes <= s->cluster_size);
3524 
3525         /* check whether remainder of cluster already reads as zero */
3526         if (!(is_zero(bs, offset - head, head) &&
3527               is_zero(bs, offset + bytes,
3528                       tail ? s->cluster_size - tail : 0))) {
3529             return -ENOTSUP;
3530         }
3531 
3532         qemu_co_mutex_lock(&s->lock);
3533         /* We can have new write after previous check */
3534         offset = QEMU_ALIGN_DOWN(offset, s->cluster_size);
3535         bytes = s->cluster_size;
3536         nr = s->cluster_size;
3537         ret = qcow2_get_cluster_offset(bs, offset, &nr, &off);
3538         if (ret != QCOW2_CLUSTER_UNALLOCATED &&
3539             ret != QCOW2_CLUSTER_ZERO_PLAIN &&
3540             ret != QCOW2_CLUSTER_ZERO_ALLOC) {
3541             qemu_co_mutex_unlock(&s->lock);
3542             return -ENOTSUP;
3543         }
3544     } else {
3545         qemu_co_mutex_lock(&s->lock);
3546     }
3547 
3548     trace_qcow2_pwrite_zeroes(qemu_coroutine_self(), offset, bytes);
3549 
3550     /* Whatever is left can use real zero clusters */
3551     ret = qcow2_cluster_zeroize(bs, offset, bytes, flags);
3552     qemu_co_mutex_unlock(&s->lock);
3553 
3554     return ret;
3555 }
3556 
3557 static coroutine_fn int qcow2_co_pdiscard(BlockDriverState *bs,
3558                                           int64_t offset, int bytes)
3559 {
3560     int ret;
3561     BDRVQcow2State *s = bs->opaque;
3562 
3563     if (!QEMU_IS_ALIGNED(offset | bytes, s->cluster_size)) {
3564         assert(bytes < s->cluster_size);
3565         /* Ignore partial clusters, except for the special case of the
3566          * complete partial cluster at the end of an unaligned file */
3567         if (!QEMU_IS_ALIGNED(offset, s->cluster_size) ||
3568             offset + bytes != bs->total_sectors * BDRV_SECTOR_SIZE) {
3569             return -ENOTSUP;
3570         }
3571     }
3572 
3573     qemu_co_mutex_lock(&s->lock);
3574     ret = qcow2_cluster_discard(bs, offset, bytes, QCOW2_DISCARD_REQUEST,
3575                                 false);
3576     qemu_co_mutex_unlock(&s->lock);
3577     return ret;
3578 }
3579 
3580 static int coroutine_fn
3581 qcow2_co_copy_range_from(BlockDriverState *bs,
3582                          BdrvChild *src, uint64_t src_offset,
3583                          BdrvChild *dst, uint64_t dst_offset,
3584                          uint64_t bytes, BdrvRequestFlags read_flags,
3585                          BdrvRequestFlags write_flags)
3586 {
3587     BDRVQcow2State *s = bs->opaque;
3588     int ret;
3589     unsigned int cur_bytes; /* number of bytes in current iteration */
3590     BdrvChild *child = NULL;
3591     BdrvRequestFlags cur_write_flags;
3592 
3593     assert(!bs->encrypted);
3594     qemu_co_mutex_lock(&s->lock);
3595 
3596     while (bytes != 0) {
3597         uint64_t copy_offset = 0;
3598         /* prepare next request */
3599         cur_bytes = MIN(bytes, INT_MAX);
3600         cur_write_flags = write_flags;
3601 
3602         ret = qcow2_get_cluster_offset(bs, src_offset, &cur_bytes, &copy_offset);
3603         if (ret < 0) {
3604             goto out;
3605         }
3606 
3607         switch (ret) {
3608         case QCOW2_CLUSTER_UNALLOCATED:
3609             if (bs->backing && bs->backing->bs) {
3610                 int64_t backing_length = bdrv_getlength(bs->backing->bs);
3611                 if (src_offset >= backing_length) {
3612                     cur_write_flags |= BDRV_REQ_ZERO_WRITE;
3613                 } else {
3614                     child = bs->backing;
3615                     cur_bytes = MIN(cur_bytes, backing_length - src_offset);
3616                     copy_offset = src_offset;
3617                 }
3618             } else {
3619                 cur_write_flags |= BDRV_REQ_ZERO_WRITE;
3620             }
3621             break;
3622 
3623         case QCOW2_CLUSTER_ZERO_PLAIN:
3624         case QCOW2_CLUSTER_ZERO_ALLOC:
3625             cur_write_flags |= BDRV_REQ_ZERO_WRITE;
3626             break;
3627 
3628         case QCOW2_CLUSTER_COMPRESSED:
3629             ret = -ENOTSUP;
3630             goto out;
3631 
3632         case QCOW2_CLUSTER_NORMAL:
3633             child = s->data_file;
3634             copy_offset += offset_into_cluster(s, src_offset);
3635             if ((copy_offset & 511) != 0) {
3636                 ret = -EIO;
3637                 goto out;
3638             }
3639             break;
3640 
3641         default:
3642             abort();
3643         }
3644         qemu_co_mutex_unlock(&s->lock);
3645         ret = bdrv_co_copy_range_from(child,
3646                                       copy_offset,
3647                                       dst, dst_offset,
3648                                       cur_bytes, read_flags, cur_write_flags);
3649         qemu_co_mutex_lock(&s->lock);
3650         if (ret < 0) {
3651             goto out;
3652         }
3653 
3654         bytes -= cur_bytes;
3655         src_offset += cur_bytes;
3656         dst_offset += cur_bytes;
3657     }
3658     ret = 0;
3659 
3660 out:
3661     qemu_co_mutex_unlock(&s->lock);
3662     return ret;
3663 }
3664 
3665 static int coroutine_fn
3666 qcow2_co_copy_range_to(BlockDriverState *bs,
3667                        BdrvChild *src, uint64_t src_offset,
3668                        BdrvChild *dst, uint64_t dst_offset,
3669                        uint64_t bytes, BdrvRequestFlags read_flags,
3670                        BdrvRequestFlags write_flags)
3671 {
3672     BDRVQcow2State *s = bs->opaque;
3673     int offset_in_cluster;
3674     int ret;
3675     unsigned int cur_bytes; /* number of sectors in current iteration */
3676     uint64_t cluster_offset;
3677     QCowL2Meta *l2meta = NULL;
3678 
3679     assert(!bs->encrypted);
3680 
3681     qemu_co_mutex_lock(&s->lock);
3682 
3683     while (bytes != 0) {
3684 
3685         l2meta = NULL;
3686 
3687         offset_in_cluster = offset_into_cluster(s, dst_offset);
3688         cur_bytes = MIN(bytes, INT_MAX);
3689 
3690         /* TODO:
3691          * If src->bs == dst->bs, we could simply copy by incrementing
3692          * the refcnt, without copying user data.
3693          * Or if src->bs == dst->bs->backing->bs, we could copy by discarding. */
3694         ret = qcow2_alloc_cluster_offset(bs, dst_offset, &cur_bytes,
3695                                          &cluster_offset, &l2meta);
3696         if (ret < 0) {
3697             goto fail;
3698         }
3699 
3700         assert((cluster_offset & 511) == 0);
3701 
3702         ret = qcow2_pre_write_overlap_check(bs, 0,
3703                 cluster_offset + offset_in_cluster, cur_bytes, true);
3704         if (ret < 0) {
3705             goto fail;
3706         }
3707 
3708         qemu_co_mutex_unlock(&s->lock);
3709         ret = bdrv_co_copy_range_to(src, src_offset,
3710                                     s->data_file,
3711                                     cluster_offset + offset_in_cluster,
3712                                     cur_bytes, read_flags, write_flags);
3713         qemu_co_mutex_lock(&s->lock);
3714         if (ret < 0) {
3715             goto fail;
3716         }
3717 
3718         ret = qcow2_handle_l2meta(bs, &l2meta, true);
3719         if (ret) {
3720             goto fail;
3721         }
3722 
3723         bytes -= cur_bytes;
3724         src_offset += cur_bytes;
3725         dst_offset += cur_bytes;
3726     }
3727     ret = 0;
3728 
3729 fail:
3730     qcow2_handle_l2meta(bs, &l2meta, false);
3731 
3732     qemu_co_mutex_unlock(&s->lock);
3733 
3734     trace_qcow2_writev_done_req(qemu_coroutine_self(), ret);
3735 
3736     return ret;
3737 }
3738 
3739 static int coroutine_fn qcow2_co_truncate(BlockDriverState *bs, int64_t offset,
3740                                           PreallocMode prealloc, Error **errp)
3741 {
3742     BDRVQcow2State *s = bs->opaque;
3743     uint64_t old_length;
3744     int64_t new_l1_size;
3745     int ret;
3746     QDict *options;
3747 
3748     if (prealloc != PREALLOC_MODE_OFF && prealloc != PREALLOC_MODE_METADATA &&
3749         prealloc != PREALLOC_MODE_FALLOC && prealloc != PREALLOC_MODE_FULL)
3750     {
3751         error_setg(errp, "Unsupported preallocation mode '%s'",
3752                    PreallocMode_str(prealloc));
3753         return -ENOTSUP;
3754     }
3755 
3756     if (offset & 511) {
3757         error_setg(errp, "The new size must be a multiple of 512");
3758         return -EINVAL;
3759     }
3760 
3761     qemu_co_mutex_lock(&s->lock);
3762 
3763     /* cannot proceed if image has snapshots */
3764     if (s->nb_snapshots) {
3765         error_setg(errp, "Can't resize an image which has snapshots");
3766         ret = -ENOTSUP;
3767         goto fail;
3768     }
3769 
3770     /* cannot proceed if image has bitmaps */
3771     if (qcow2_truncate_bitmaps_check(bs, errp)) {
3772         ret = -ENOTSUP;
3773         goto fail;
3774     }
3775 
3776     old_length = bs->total_sectors * BDRV_SECTOR_SIZE;
3777     new_l1_size = size_to_l1(s, offset);
3778 
3779     if (offset < old_length) {
3780         int64_t last_cluster, old_file_size;
3781         if (prealloc != PREALLOC_MODE_OFF) {
3782             error_setg(errp,
3783                        "Preallocation can't be used for shrinking an image");
3784             ret = -EINVAL;
3785             goto fail;
3786         }
3787 
3788         ret = qcow2_cluster_discard(bs, ROUND_UP(offset, s->cluster_size),
3789                                     old_length - ROUND_UP(offset,
3790                                                           s->cluster_size),
3791                                     QCOW2_DISCARD_ALWAYS, true);
3792         if (ret < 0) {
3793             error_setg_errno(errp, -ret, "Failed to discard cropped clusters");
3794             goto fail;
3795         }
3796 
3797         ret = qcow2_shrink_l1_table(bs, new_l1_size);
3798         if (ret < 0) {
3799             error_setg_errno(errp, -ret,
3800                              "Failed to reduce the number of L2 tables");
3801             goto fail;
3802         }
3803 
3804         ret = qcow2_shrink_reftable(bs);
3805         if (ret < 0) {
3806             error_setg_errno(errp, -ret,
3807                              "Failed to discard unused refblocks");
3808             goto fail;
3809         }
3810 
3811         old_file_size = bdrv_getlength(bs->file->bs);
3812         if (old_file_size < 0) {
3813             error_setg_errno(errp, -old_file_size,
3814                              "Failed to inquire current file length");
3815             ret = old_file_size;
3816             goto fail;
3817         }
3818         last_cluster = qcow2_get_last_cluster(bs, old_file_size);
3819         if (last_cluster < 0) {
3820             error_setg_errno(errp, -last_cluster,
3821                              "Failed to find the last cluster");
3822             ret = last_cluster;
3823             goto fail;
3824         }
3825         if ((last_cluster + 1) * s->cluster_size < old_file_size) {
3826             Error *local_err = NULL;
3827 
3828             bdrv_co_truncate(bs->file, (last_cluster + 1) * s->cluster_size,
3829                              PREALLOC_MODE_OFF, &local_err);
3830             if (local_err) {
3831                 warn_reportf_err(local_err,
3832                                  "Failed to truncate the tail of the image: ");
3833             }
3834         }
3835     } else {
3836         ret = qcow2_grow_l1_table(bs, new_l1_size, true);
3837         if (ret < 0) {
3838             error_setg_errno(errp, -ret, "Failed to grow the L1 table");
3839             goto fail;
3840         }
3841     }
3842 
3843     switch (prealloc) {
3844     case PREALLOC_MODE_OFF:
3845         if (has_data_file(bs)) {
3846             ret = bdrv_co_truncate(s->data_file, offset, prealloc, errp);
3847             if (ret < 0) {
3848                 goto fail;
3849             }
3850         }
3851         break;
3852 
3853     case PREALLOC_MODE_METADATA:
3854         ret = preallocate_co(bs, old_length, offset, prealloc, errp);
3855         if (ret < 0) {
3856             goto fail;
3857         }
3858         break;
3859 
3860     case PREALLOC_MODE_FALLOC:
3861     case PREALLOC_MODE_FULL:
3862     {
3863         int64_t allocation_start, host_offset, guest_offset;
3864         int64_t clusters_allocated;
3865         int64_t old_file_size, new_file_size;
3866         uint64_t nb_new_data_clusters, nb_new_l2_tables;
3867 
3868         /* With a data file, preallocation means just allocating the metadata
3869          * and forwarding the truncate request to the data file */
3870         if (has_data_file(bs)) {
3871             ret = preallocate_co(bs, old_length, offset, prealloc, errp);
3872             if (ret < 0) {
3873                 goto fail;
3874             }
3875             break;
3876         }
3877 
3878         old_file_size = bdrv_getlength(bs->file->bs);
3879         if (old_file_size < 0) {
3880             error_setg_errno(errp, -old_file_size,
3881                              "Failed to inquire current file length");
3882             ret = old_file_size;
3883             goto fail;
3884         }
3885         old_file_size = ROUND_UP(old_file_size, s->cluster_size);
3886 
3887         nb_new_data_clusters = DIV_ROUND_UP(offset - old_length,
3888                                             s->cluster_size);
3889 
3890         /* This is an overestimation; we will not actually allocate space for
3891          * these in the file but just make sure the new refcount structures are
3892          * able to cover them so we will not have to allocate new refblocks
3893          * while entering the data blocks in the potentially new L2 tables.
3894          * (We do not actually care where the L2 tables are placed. Maybe they
3895          *  are already allocated or they can be placed somewhere before
3896          *  @old_file_size. It does not matter because they will be fully
3897          *  allocated automatically, so they do not need to be covered by the
3898          *  preallocation. All that matters is that we will not have to allocate
3899          *  new refcount structures for them.) */
3900         nb_new_l2_tables = DIV_ROUND_UP(nb_new_data_clusters,
3901                                         s->cluster_size / sizeof(uint64_t));
3902         /* The cluster range may not be aligned to L2 boundaries, so add one L2
3903          * table for a potential head/tail */
3904         nb_new_l2_tables++;
3905 
3906         allocation_start = qcow2_refcount_area(bs, old_file_size,
3907                                                nb_new_data_clusters +
3908                                                nb_new_l2_tables,
3909                                                true, 0, 0);
3910         if (allocation_start < 0) {
3911             error_setg_errno(errp, -allocation_start,
3912                              "Failed to resize refcount structures");
3913             ret = allocation_start;
3914             goto fail;
3915         }
3916 
3917         clusters_allocated = qcow2_alloc_clusters_at(bs, allocation_start,
3918                                                      nb_new_data_clusters);
3919         if (clusters_allocated < 0) {
3920             error_setg_errno(errp, -clusters_allocated,
3921                              "Failed to allocate data clusters");
3922             ret = clusters_allocated;
3923             goto fail;
3924         }
3925 
3926         assert(clusters_allocated == nb_new_data_clusters);
3927 
3928         /* Allocate the data area */
3929         new_file_size = allocation_start +
3930                         nb_new_data_clusters * s->cluster_size;
3931         ret = bdrv_co_truncate(bs->file, new_file_size, prealloc, errp);
3932         if (ret < 0) {
3933             error_prepend(errp, "Failed to resize underlying file: ");
3934             qcow2_free_clusters(bs, allocation_start,
3935                                 nb_new_data_clusters * s->cluster_size,
3936                                 QCOW2_DISCARD_OTHER);
3937             goto fail;
3938         }
3939 
3940         /* Create the necessary L2 entries */
3941         host_offset = allocation_start;
3942         guest_offset = old_length;
3943         while (nb_new_data_clusters) {
3944             int64_t nb_clusters = MIN(
3945                 nb_new_data_clusters,
3946                 s->l2_slice_size - offset_to_l2_slice_index(s, guest_offset));
3947             QCowL2Meta allocation = {
3948                 .offset       = guest_offset,
3949                 .alloc_offset = host_offset,
3950                 .nb_clusters  = nb_clusters,
3951             };
3952             qemu_co_queue_init(&allocation.dependent_requests);
3953 
3954             ret = qcow2_alloc_cluster_link_l2(bs, &allocation);
3955             if (ret < 0) {
3956                 error_setg_errno(errp, -ret, "Failed to update L2 tables");
3957                 qcow2_free_clusters(bs, host_offset,
3958                                     nb_new_data_clusters * s->cluster_size,
3959                                     QCOW2_DISCARD_OTHER);
3960                 goto fail;
3961             }
3962 
3963             guest_offset += nb_clusters * s->cluster_size;
3964             host_offset += nb_clusters * s->cluster_size;
3965             nb_new_data_clusters -= nb_clusters;
3966         }
3967         break;
3968     }
3969 
3970     default:
3971         g_assert_not_reached();
3972     }
3973 
3974     if (prealloc != PREALLOC_MODE_OFF) {
3975         /* Flush metadata before actually changing the image size */
3976         ret = qcow2_write_caches(bs);
3977         if (ret < 0) {
3978             error_setg_errno(errp, -ret,
3979                              "Failed to flush the preallocated area to disk");
3980             goto fail;
3981         }
3982     }
3983 
3984     bs->total_sectors = offset / BDRV_SECTOR_SIZE;
3985 
3986     /* write updated header.size */
3987     offset = cpu_to_be64(offset);
3988     ret = bdrv_pwrite_sync(bs->file, offsetof(QCowHeader, size),
3989                            &offset, sizeof(uint64_t));
3990     if (ret < 0) {
3991         error_setg_errno(errp, -ret, "Failed to update the image size");
3992         goto fail;
3993     }
3994 
3995     s->l1_vm_state_index = new_l1_size;
3996 
3997     /* Update cache sizes */
3998     options = qdict_clone_shallow(bs->options);
3999     ret = qcow2_update_options(bs, options, s->flags, errp);
4000     qobject_unref(options);
4001     if (ret < 0) {
4002         goto fail;
4003     }
4004     ret = 0;
4005 fail:
4006     qemu_co_mutex_unlock(&s->lock);
4007     return ret;
4008 }
4009 
4010 /* XXX: put compressed sectors first, then all the cluster aligned
4011    tables to avoid losing bytes in alignment */
4012 static coroutine_fn int
4013 qcow2_co_pwritev_compressed_part(BlockDriverState *bs,
4014                                  uint64_t offset, uint64_t bytes,
4015                                  QEMUIOVector *qiov, size_t qiov_offset)
4016 {
4017     BDRVQcow2State *s = bs->opaque;
4018     int ret;
4019     ssize_t out_len;
4020     uint8_t *buf, *out_buf;
4021     uint64_t cluster_offset;
4022 
4023     if (has_data_file(bs)) {
4024         return -ENOTSUP;
4025     }
4026 
4027     if (bytes == 0) {
4028         /* align end of file to a sector boundary to ease reading with
4029            sector based I/Os */
4030         int64_t len = bdrv_getlength(bs->file->bs);
4031         if (len < 0) {
4032             return len;
4033         }
4034         return bdrv_co_truncate(bs->file, len, PREALLOC_MODE_OFF, NULL);
4035     }
4036 
4037     if (offset_into_cluster(s, offset)) {
4038         return -EINVAL;
4039     }
4040 
4041     buf = qemu_blockalign(bs, s->cluster_size);
4042     if (bytes != s->cluster_size) {
4043         if (bytes > s->cluster_size ||
4044             offset + bytes != bs->total_sectors << BDRV_SECTOR_BITS)
4045         {
4046             qemu_vfree(buf);
4047             return -EINVAL;
4048         }
4049         /* Zero-pad last write if image size is not cluster aligned */
4050         memset(buf + bytes, 0, s->cluster_size - bytes);
4051     }
4052     qemu_iovec_to_buf(qiov, qiov_offset, buf, bytes);
4053 
4054     out_buf = g_malloc(s->cluster_size);
4055 
4056     out_len = qcow2_co_compress(bs, out_buf, s->cluster_size - 1,
4057                                 buf, s->cluster_size);
4058     if (out_len == -ENOMEM) {
4059         /* could not compress: write normal cluster */
4060         ret = qcow2_co_pwritev_part(bs, offset, bytes, qiov, qiov_offset, 0);
4061         if (ret < 0) {
4062             goto fail;
4063         }
4064         goto success;
4065     } else if (out_len < 0) {
4066         ret = -EINVAL;
4067         goto fail;
4068     }
4069 
4070     qemu_co_mutex_lock(&s->lock);
4071     ret = qcow2_alloc_compressed_cluster_offset(bs, offset, out_len,
4072                                                 &cluster_offset);
4073     if (ret < 0) {
4074         qemu_co_mutex_unlock(&s->lock);
4075         goto fail;
4076     }
4077 
4078     ret = qcow2_pre_write_overlap_check(bs, 0, cluster_offset, out_len, true);
4079     qemu_co_mutex_unlock(&s->lock);
4080     if (ret < 0) {
4081         goto fail;
4082     }
4083 
4084     BLKDBG_EVENT(s->data_file, BLKDBG_WRITE_COMPRESSED);
4085     ret = bdrv_co_pwrite(s->data_file, cluster_offset, out_len, out_buf, 0);
4086     if (ret < 0) {
4087         goto fail;
4088     }
4089 success:
4090     ret = 0;
4091 fail:
4092     qemu_vfree(buf);
4093     g_free(out_buf);
4094     return ret;
4095 }
4096 
4097 static int coroutine_fn
4098 qcow2_co_preadv_compressed(BlockDriverState *bs,
4099                            uint64_t file_cluster_offset,
4100                            uint64_t offset,
4101                            uint64_t bytes,
4102                            QEMUIOVector *qiov,
4103                            size_t qiov_offset)
4104 {
4105     BDRVQcow2State *s = bs->opaque;
4106     int ret = 0, csize, nb_csectors;
4107     uint64_t coffset;
4108     uint8_t *buf, *out_buf;
4109     int offset_in_cluster = offset_into_cluster(s, offset);
4110 
4111     coffset = file_cluster_offset & s->cluster_offset_mask;
4112     nb_csectors = ((file_cluster_offset >> s->csize_shift) & s->csize_mask) + 1;
4113     csize = nb_csectors * QCOW2_COMPRESSED_SECTOR_SIZE -
4114         (coffset & ~QCOW2_COMPRESSED_SECTOR_MASK);
4115 
4116     buf = g_try_malloc(csize);
4117     if (!buf) {
4118         return -ENOMEM;
4119     }
4120 
4121     out_buf = qemu_blockalign(bs, s->cluster_size);
4122 
4123     BLKDBG_EVENT(bs->file, BLKDBG_READ_COMPRESSED);
4124     ret = bdrv_co_pread(bs->file, coffset, csize, buf, 0);
4125     if (ret < 0) {
4126         goto fail;
4127     }
4128 
4129     if (qcow2_co_decompress(bs, out_buf, s->cluster_size, buf, csize) < 0) {
4130         ret = -EIO;
4131         goto fail;
4132     }
4133 
4134     qemu_iovec_from_buf(qiov, qiov_offset, out_buf + offset_in_cluster, bytes);
4135 
4136 fail:
4137     qemu_vfree(out_buf);
4138     g_free(buf);
4139 
4140     return ret;
4141 }
4142 
4143 static int make_completely_empty(BlockDriverState *bs)
4144 {
4145     BDRVQcow2State *s = bs->opaque;
4146     Error *local_err = NULL;
4147     int ret, l1_clusters;
4148     int64_t offset;
4149     uint64_t *new_reftable = NULL;
4150     uint64_t rt_entry, l1_size2;
4151     struct {
4152         uint64_t l1_offset;
4153         uint64_t reftable_offset;
4154         uint32_t reftable_clusters;
4155     } QEMU_PACKED l1_ofs_rt_ofs_cls;
4156 
4157     ret = qcow2_cache_empty(bs, s->l2_table_cache);
4158     if (ret < 0) {
4159         goto fail;
4160     }
4161 
4162     ret = qcow2_cache_empty(bs, s->refcount_block_cache);
4163     if (ret < 0) {
4164         goto fail;
4165     }
4166 
4167     /* Refcounts will be broken utterly */
4168     ret = qcow2_mark_dirty(bs);
4169     if (ret < 0) {
4170         goto fail;
4171     }
4172 
4173     BLKDBG_EVENT(bs->file, BLKDBG_L1_UPDATE);
4174 
4175     l1_clusters = DIV_ROUND_UP(s->l1_size, s->cluster_size / sizeof(uint64_t));
4176     l1_size2 = (uint64_t)s->l1_size * sizeof(uint64_t);
4177 
4178     /* After this call, neither the in-memory nor the on-disk refcount
4179      * information accurately describe the actual references */
4180 
4181     ret = bdrv_pwrite_zeroes(bs->file, s->l1_table_offset,
4182                              l1_clusters * s->cluster_size, 0);
4183     if (ret < 0) {
4184         goto fail_broken_refcounts;
4185     }
4186     memset(s->l1_table, 0, l1_size2);
4187 
4188     BLKDBG_EVENT(bs->file, BLKDBG_EMPTY_IMAGE_PREPARE);
4189 
4190     /* Overwrite enough clusters at the beginning of the sectors to place
4191      * the refcount table, a refcount block and the L1 table in; this may
4192      * overwrite parts of the existing refcount and L1 table, which is not
4193      * an issue because the dirty flag is set, complete data loss is in fact
4194      * desired and partial data loss is consequently fine as well */
4195     ret = bdrv_pwrite_zeroes(bs->file, s->cluster_size,
4196                              (2 + l1_clusters) * s->cluster_size, 0);
4197     /* This call (even if it failed overall) may have overwritten on-disk
4198      * refcount structures; in that case, the in-memory refcount information
4199      * will probably differ from the on-disk information which makes the BDS
4200      * unusable */
4201     if (ret < 0) {
4202         goto fail_broken_refcounts;
4203     }
4204 
4205     BLKDBG_EVENT(bs->file, BLKDBG_L1_UPDATE);
4206     BLKDBG_EVENT(bs->file, BLKDBG_REFTABLE_UPDATE);
4207 
4208     /* "Create" an empty reftable (one cluster) directly after the image
4209      * header and an empty L1 table three clusters after the image header;
4210      * the cluster between those two will be used as the first refblock */
4211     l1_ofs_rt_ofs_cls.l1_offset = cpu_to_be64(3 * s->cluster_size);
4212     l1_ofs_rt_ofs_cls.reftable_offset = cpu_to_be64(s->cluster_size);
4213     l1_ofs_rt_ofs_cls.reftable_clusters = cpu_to_be32(1);
4214     ret = bdrv_pwrite_sync(bs->file, offsetof(QCowHeader, l1_table_offset),
4215                            &l1_ofs_rt_ofs_cls, sizeof(l1_ofs_rt_ofs_cls));
4216     if (ret < 0) {
4217         goto fail_broken_refcounts;
4218     }
4219 
4220     s->l1_table_offset = 3 * s->cluster_size;
4221 
4222     new_reftable = g_try_new0(uint64_t, s->cluster_size / sizeof(uint64_t));
4223     if (!new_reftable) {
4224         ret = -ENOMEM;
4225         goto fail_broken_refcounts;
4226     }
4227 
4228     s->refcount_table_offset = s->cluster_size;
4229     s->refcount_table_size   = s->cluster_size / sizeof(uint64_t);
4230     s->max_refcount_table_index = 0;
4231 
4232     g_free(s->refcount_table);
4233     s->refcount_table = new_reftable;
4234     new_reftable = NULL;
4235 
4236     /* Now the in-memory refcount information again corresponds to the on-disk
4237      * information (reftable is empty and no refblocks (the refblock cache is
4238      * empty)); however, this means some clusters (e.g. the image header) are
4239      * referenced, but not refcounted, but the normal qcow2 code assumes that
4240      * the in-memory information is always correct */
4241 
4242     BLKDBG_EVENT(bs->file, BLKDBG_REFBLOCK_ALLOC);
4243 
4244     /* Enter the first refblock into the reftable */
4245     rt_entry = cpu_to_be64(2 * s->cluster_size);
4246     ret = bdrv_pwrite_sync(bs->file, s->cluster_size,
4247                            &rt_entry, sizeof(rt_entry));
4248     if (ret < 0) {
4249         goto fail_broken_refcounts;
4250     }
4251     s->refcount_table[0] = 2 * s->cluster_size;
4252 
4253     s->free_cluster_index = 0;
4254     assert(3 + l1_clusters <= s->refcount_block_size);
4255     offset = qcow2_alloc_clusters(bs, 3 * s->cluster_size + l1_size2);
4256     if (offset < 0) {
4257         ret = offset;
4258         goto fail_broken_refcounts;
4259     } else if (offset > 0) {
4260         error_report("First cluster in emptied image is in use");
4261         abort();
4262     }
4263 
4264     /* Now finally the in-memory information corresponds to the on-disk
4265      * structures and is correct */
4266     ret = qcow2_mark_clean(bs);
4267     if (ret < 0) {
4268         goto fail;
4269     }
4270 
4271     ret = bdrv_truncate(bs->file, (3 + l1_clusters) * s->cluster_size,
4272                         PREALLOC_MODE_OFF, &local_err);
4273     if (ret < 0) {
4274         error_report_err(local_err);
4275         goto fail;
4276     }
4277 
4278     return 0;
4279 
4280 fail_broken_refcounts:
4281     /* The BDS is unusable at this point. If we wanted to make it usable, we
4282      * would have to call qcow2_refcount_close(), qcow2_refcount_init(),
4283      * qcow2_check_refcounts(), qcow2_refcount_close() and qcow2_refcount_init()
4284      * again. However, because the functions which could have caused this error
4285      * path to be taken are used by those functions as well, it's very likely
4286      * that that sequence will fail as well. Therefore, just eject the BDS. */
4287     bs->drv = NULL;
4288 
4289 fail:
4290     g_free(new_reftable);
4291     return ret;
4292 }
4293 
4294 static int qcow2_make_empty(BlockDriverState *bs)
4295 {
4296     BDRVQcow2State *s = bs->opaque;
4297     uint64_t offset, end_offset;
4298     int step = QEMU_ALIGN_DOWN(INT_MAX, s->cluster_size);
4299     int l1_clusters, ret = 0;
4300 
4301     l1_clusters = DIV_ROUND_UP(s->l1_size, s->cluster_size / sizeof(uint64_t));
4302 
4303     if (s->qcow_version >= 3 && !s->snapshots && !s->nb_bitmaps &&
4304         3 + l1_clusters <= s->refcount_block_size &&
4305         s->crypt_method_header != QCOW_CRYPT_LUKS &&
4306         !has_data_file(bs)) {
4307         /* The following function only works for qcow2 v3 images (it
4308          * requires the dirty flag) and only as long as there are no
4309          * features that reserve extra clusters (such as snapshots,
4310          * LUKS header, or persistent bitmaps), because it completely
4311          * empties the image.  Furthermore, the L1 table and three
4312          * additional clusters (image header, refcount table, one
4313          * refcount block) have to fit inside one refcount block. It
4314          * only resets the image file, i.e. does not work with an
4315          * external data file. */
4316         return make_completely_empty(bs);
4317     }
4318 
4319     /* This fallback code simply discards every active cluster; this is slow,
4320      * but works in all cases */
4321     end_offset = bs->total_sectors * BDRV_SECTOR_SIZE;
4322     for (offset = 0; offset < end_offset; offset += step) {
4323         /* As this function is generally used after committing an external
4324          * snapshot, QCOW2_DISCARD_SNAPSHOT seems appropriate. Also, the
4325          * default action for this kind of discard is to pass the discard,
4326          * which will ideally result in an actually smaller image file, as
4327          * is probably desired. */
4328         ret = qcow2_cluster_discard(bs, offset, MIN(step, end_offset - offset),
4329                                     QCOW2_DISCARD_SNAPSHOT, true);
4330         if (ret < 0) {
4331             break;
4332         }
4333     }
4334 
4335     return ret;
4336 }
4337 
4338 static coroutine_fn int qcow2_co_flush_to_os(BlockDriverState *bs)
4339 {
4340     BDRVQcow2State *s = bs->opaque;
4341     int ret;
4342 
4343     qemu_co_mutex_lock(&s->lock);
4344     ret = qcow2_write_caches(bs);
4345     qemu_co_mutex_unlock(&s->lock);
4346 
4347     return ret;
4348 }
4349 
4350 static ssize_t qcow2_measure_crypto_hdr_init_func(QCryptoBlock *block,
4351         size_t headerlen, void *opaque, Error **errp)
4352 {
4353     size_t *headerlenp = opaque;
4354 
4355     /* Stash away the payload size */
4356     *headerlenp = headerlen;
4357     return 0;
4358 }
4359 
4360 static ssize_t qcow2_measure_crypto_hdr_write_func(QCryptoBlock *block,
4361         size_t offset, const uint8_t *buf, size_t buflen,
4362         void *opaque, Error **errp)
4363 {
4364     /* Discard the bytes, we're not actually writing to an image */
4365     return buflen;
4366 }
4367 
4368 /* Determine the number of bytes for the LUKS payload */
4369 static bool qcow2_measure_luks_headerlen(QemuOpts *opts, size_t *len,
4370                                          Error **errp)
4371 {
4372     QDict *opts_qdict;
4373     QDict *cryptoopts_qdict;
4374     QCryptoBlockCreateOptions *cryptoopts;
4375     QCryptoBlock *crypto;
4376 
4377     /* Extract "encrypt." options into a qdict */
4378     opts_qdict = qemu_opts_to_qdict(opts, NULL);
4379     qdict_extract_subqdict(opts_qdict, &cryptoopts_qdict, "encrypt.");
4380     qobject_unref(opts_qdict);
4381 
4382     /* Build QCryptoBlockCreateOptions object from qdict */
4383     qdict_put_str(cryptoopts_qdict, "format", "luks");
4384     cryptoopts = block_crypto_create_opts_init(cryptoopts_qdict, errp);
4385     qobject_unref(cryptoopts_qdict);
4386     if (!cryptoopts) {
4387         return false;
4388     }
4389 
4390     /* Fake LUKS creation in order to determine the payload size */
4391     crypto = qcrypto_block_create(cryptoopts, "encrypt.",
4392                                   qcow2_measure_crypto_hdr_init_func,
4393                                   qcow2_measure_crypto_hdr_write_func,
4394                                   len, errp);
4395     qapi_free_QCryptoBlockCreateOptions(cryptoopts);
4396     if (!crypto) {
4397         return false;
4398     }
4399 
4400     qcrypto_block_free(crypto);
4401     return true;
4402 }
4403 
4404 static BlockMeasureInfo *qcow2_measure(QemuOpts *opts, BlockDriverState *in_bs,
4405                                        Error **errp)
4406 {
4407     Error *local_err = NULL;
4408     BlockMeasureInfo *info;
4409     uint64_t required = 0; /* bytes that contribute to required size */
4410     uint64_t virtual_size; /* disk size as seen by guest */
4411     uint64_t refcount_bits;
4412     uint64_t l2_tables;
4413     uint64_t luks_payload_size = 0;
4414     size_t cluster_size;
4415     int version;
4416     char *optstr;
4417     PreallocMode prealloc;
4418     bool has_backing_file;
4419     bool has_luks;
4420 
4421     /* Parse image creation options */
4422     cluster_size = qcow2_opt_get_cluster_size_del(opts, &local_err);
4423     if (local_err) {
4424         goto err;
4425     }
4426 
4427     version = qcow2_opt_get_version_del(opts, &local_err);
4428     if (local_err) {
4429         goto err;
4430     }
4431 
4432     refcount_bits = qcow2_opt_get_refcount_bits_del(opts, version, &local_err);
4433     if (local_err) {
4434         goto err;
4435     }
4436 
4437     optstr = qemu_opt_get_del(opts, BLOCK_OPT_PREALLOC);
4438     prealloc = qapi_enum_parse(&PreallocMode_lookup, optstr,
4439                                PREALLOC_MODE_OFF, &local_err);
4440     g_free(optstr);
4441     if (local_err) {
4442         goto err;
4443     }
4444 
4445     optstr = qemu_opt_get_del(opts, BLOCK_OPT_BACKING_FILE);
4446     has_backing_file = !!optstr;
4447     g_free(optstr);
4448 
4449     optstr = qemu_opt_get_del(opts, BLOCK_OPT_ENCRYPT_FORMAT);
4450     has_luks = optstr && strcmp(optstr, "luks") == 0;
4451     g_free(optstr);
4452 
4453     if (has_luks) {
4454         size_t headerlen;
4455 
4456         if (!qcow2_measure_luks_headerlen(opts, &headerlen, &local_err)) {
4457             goto err;
4458         }
4459 
4460         luks_payload_size = ROUND_UP(headerlen, cluster_size);
4461     }
4462 
4463     virtual_size = qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0);
4464     virtual_size = ROUND_UP(virtual_size, cluster_size);
4465 
4466     /* Check that virtual disk size is valid */
4467     l2_tables = DIV_ROUND_UP(virtual_size / cluster_size,
4468                              cluster_size / sizeof(uint64_t));
4469     if (l2_tables * sizeof(uint64_t) > QCOW_MAX_L1_SIZE) {
4470         error_setg(&local_err, "The image size is too large "
4471                                "(try using a larger cluster size)");
4472         goto err;
4473     }
4474 
4475     /* Account for input image */
4476     if (in_bs) {
4477         int64_t ssize = bdrv_getlength(in_bs);
4478         if (ssize < 0) {
4479             error_setg_errno(&local_err, -ssize,
4480                              "Unable to get image virtual_size");
4481             goto err;
4482         }
4483 
4484         virtual_size = ROUND_UP(ssize, cluster_size);
4485 
4486         if (has_backing_file) {
4487             /* We don't how much of the backing chain is shared by the input
4488              * image and the new image file.  In the worst case the new image's
4489              * backing file has nothing in common with the input image.  Be
4490              * conservative and assume all clusters need to be written.
4491              */
4492             required = virtual_size;
4493         } else {
4494             int64_t offset;
4495             int64_t pnum = 0;
4496 
4497             for (offset = 0; offset < ssize; offset += pnum) {
4498                 int ret;
4499 
4500                 ret = bdrv_block_status_above(in_bs, NULL, offset,
4501                                               ssize - offset, &pnum, NULL,
4502                                               NULL);
4503                 if (ret < 0) {
4504                     error_setg_errno(&local_err, -ret,
4505                                      "Unable to get block status");
4506                     goto err;
4507                 }
4508 
4509                 if (ret & BDRV_BLOCK_ZERO) {
4510                     /* Skip zero regions (safe with no backing file) */
4511                 } else if ((ret & (BDRV_BLOCK_DATA | BDRV_BLOCK_ALLOCATED)) ==
4512                            (BDRV_BLOCK_DATA | BDRV_BLOCK_ALLOCATED)) {
4513                     /* Extend pnum to end of cluster for next iteration */
4514                     pnum = ROUND_UP(offset + pnum, cluster_size) - offset;
4515 
4516                     /* Count clusters we've seen */
4517                     required += offset % cluster_size + pnum;
4518                 }
4519             }
4520         }
4521     }
4522 
4523     /* Take into account preallocation.  Nothing special is needed for
4524      * PREALLOC_MODE_METADATA since metadata is always counted.
4525      */
4526     if (prealloc == PREALLOC_MODE_FULL || prealloc == PREALLOC_MODE_FALLOC) {
4527         required = virtual_size;
4528     }
4529 
4530     info = g_new(BlockMeasureInfo, 1);
4531     info->fully_allocated =
4532         qcow2_calc_prealloc_size(virtual_size, cluster_size,
4533                                  ctz32(refcount_bits)) + luks_payload_size;
4534 
4535     /* Remove data clusters that are not required.  This overestimates the
4536      * required size because metadata needed for the fully allocated file is
4537      * still counted.
4538      */
4539     info->required = info->fully_allocated - virtual_size + required;
4540     return info;
4541 
4542 err:
4543     error_propagate(errp, local_err);
4544     return NULL;
4545 }
4546 
4547 static int qcow2_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
4548 {
4549     BDRVQcow2State *s = bs->opaque;
4550     bdi->unallocated_blocks_are_zero = true;
4551     bdi->cluster_size = s->cluster_size;
4552     bdi->vm_state_offset = qcow2_vm_state_offset(s);
4553     return 0;
4554 }
4555 
4556 static ImageInfoSpecific *qcow2_get_specific_info(BlockDriverState *bs,
4557                                                   Error **errp)
4558 {
4559     BDRVQcow2State *s = bs->opaque;
4560     ImageInfoSpecific *spec_info;
4561     QCryptoBlockInfo *encrypt_info = NULL;
4562     Error *local_err = NULL;
4563 
4564     if (s->crypto != NULL) {
4565         encrypt_info = qcrypto_block_get_info(s->crypto, &local_err);
4566         if (local_err) {
4567             error_propagate(errp, local_err);
4568             return NULL;
4569         }
4570     }
4571 
4572     spec_info = g_new(ImageInfoSpecific, 1);
4573     *spec_info = (ImageInfoSpecific){
4574         .type  = IMAGE_INFO_SPECIFIC_KIND_QCOW2,
4575         .u.qcow2.data = g_new0(ImageInfoSpecificQCow2, 1),
4576     };
4577     if (s->qcow_version == 2) {
4578         *spec_info->u.qcow2.data = (ImageInfoSpecificQCow2){
4579             .compat             = g_strdup("0.10"),
4580             .refcount_bits      = s->refcount_bits,
4581         };
4582     } else if (s->qcow_version == 3) {
4583         Qcow2BitmapInfoList *bitmaps;
4584         bitmaps = qcow2_get_bitmap_info_list(bs, &local_err);
4585         if (local_err) {
4586             error_propagate(errp, local_err);
4587             qapi_free_ImageInfoSpecific(spec_info);
4588             return NULL;
4589         }
4590         *spec_info->u.qcow2.data = (ImageInfoSpecificQCow2){
4591             .compat             = g_strdup("1.1"),
4592             .lazy_refcounts     = s->compatible_features &
4593                                   QCOW2_COMPAT_LAZY_REFCOUNTS,
4594             .has_lazy_refcounts = true,
4595             .corrupt            = s->incompatible_features &
4596                                   QCOW2_INCOMPAT_CORRUPT,
4597             .has_corrupt        = true,
4598             .refcount_bits      = s->refcount_bits,
4599             .has_bitmaps        = !!bitmaps,
4600             .bitmaps            = bitmaps,
4601             .has_data_file      = !!s->image_data_file,
4602             .data_file          = g_strdup(s->image_data_file),
4603             .has_data_file_raw  = has_data_file(bs),
4604             .data_file_raw      = data_file_is_raw(bs),
4605         };
4606     } else {
4607         /* if this assertion fails, this probably means a new version was
4608          * added without having it covered here */
4609         assert(false);
4610     }
4611 
4612     if (encrypt_info) {
4613         ImageInfoSpecificQCow2Encryption *qencrypt =
4614             g_new(ImageInfoSpecificQCow2Encryption, 1);
4615         switch (encrypt_info->format) {
4616         case Q_CRYPTO_BLOCK_FORMAT_QCOW:
4617             qencrypt->format = BLOCKDEV_QCOW2_ENCRYPTION_FORMAT_AES;
4618             break;
4619         case Q_CRYPTO_BLOCK_FORMAT_LUKS:
4620             qencrypt->format = BLOCKDEV_QCOW2_ENCRYPTION_FORMAT_LUKS;
4621             qencrypt->u.luks = encrypt_info->u.luks;
4622             break;
4623         default:
4624             abort();
4625         }
4626         /* Since we did shallow copy above, erase any pointers
4627          * in the original info */
4628         memset(&encrypt_info->u, 0, sizeof(encrypt_info->u));
4629         qapi_free_QCryptoBlockInfo(encrypt_info);
4630 
4631         spec_info->u.qcow2.data->has_encrypt = true;
4632         spec_info->u.qcow2.data->encrypt = qencrypt;
4633     }
4634 
4635     return spec_info;
4636 }
4637 
4638 static int qcow2_has_zero_init(BlockDriverState *bs)
4639 {
4640     BDRVQcow2State *s = bs->opaque;
4641     bool preallocated;
4642 
4643     if (qemu_in_coroutine()) {
4644         qemu_co_mutex_lock(&s->lock);
4645     }
4646     /*
4647      * Check preallocation status: Preallocated images have all L2
4648      * tables allocated, nonpreallocated images have none.  It is
4649      * therefore enough to check the first one.
4650      */
4651     preallocated = s->l1_size > 0 && s->l1_table[0] != 0;
4652     if (qemu_in_coroutine()) {
4653         qemu_co_mutex_unlock(&s->lock);
4654     }
4655 
4656     if (!preallocated) {
4657         return 1;
4658     } else if (bs->encrypted) {
4659         return 0;
4660     } else {
4661         return bdrv_has_zero_init(s->data_file->bs);
4662     }
4663 }
4664 
4665 static int qcow2_save_vmstate(BlockDriverState *bs, QEMUIOVector *qiov,
4666                               int64_t pos)
4667 {
4668     BDRVQcow2State *s = bs->opaque;
4669 
4670     BLKDBG_EVENT(bs->file, BLKDBG_VMSTATE_SAVE);
4671     return bs->drv->bdrv_co_pwritev_part(bs, qcow2_vm_state_offset(s) + pos,
4672                                          qiov->size, qiov, 0, 0);
4673 }
4674 
4675 static int qcow2_load_vmstate(BlockDriverState *bs, QEMUIOVector *qiov,
4676                               int64_t pos)
4677 {
4678     BDRVQcow2State *s = bs->opaque;
4679 
4680     BLKDBG_EVENT(bs->file, BLKDBG_VMSTATE_LOAD);
4681     return bs->drv->bdrv_co_preadv_part(bs, qcow2_vm_state_offset(s) + pos,
4682                                         qiov->size, qiov, 0, 0);
4683 }
4684 
4685 /*
4686  * Downgrades an image's version. To achieve this, any incompatible features
4687  * have to be removed.
4688  */
4689 static int qcow2_downgrade(BlockDriverState *bs, int target_version,
4690                            BlockDriverAmendStatusCB *status_cb, void *cb_opaque,
4691                            Error **errp)
4692 {
4693     BDRVQcow2State *s = bs->opaque;
4694     int current_version = s->qcow_version;
4695     int ret;
4696 
4697     /* This is qcow2_downgrade(), not qcow2_upgrade() */
4698     assert(target_version < current_version);
4699 
4700     /* There are no other versions (now) that you can downgrade to */
4701     assert(target_version == 2);
4702 
4703     if (s->refcount_order != 4) {
4704         error_setg(errp, "compat=0.10 requires refcount_bits=16");
4705         return -ENOTSUP;
4706     }
4707 
4708     if (has_data_file(bs)) {
4709         error_setg(errp, "Cannot downgrade an image with a data file");
4710         return -ENOTSUP;
4711     }
4712 
4713     /* clear incompatible features */
4714     if (s->incompatible_features & QCOW2_INCOMPAT_DIRTY) {
4715         ret = qcow2_mark_clean(bs);
4716         if (ret < 0) {
4717             error_setg_errno(errp, -ret, "Failed to make the image clean");
4718             return ret;
4719         }
4720     }
4721 
4722     /* with QCOW2_INCOMPAT_CORRUPT, it is pretty much impossible to get here in
4723      * the first place; if that happens nonetheless, returning -ENOTSUP is the
4724      * best thing to do anyway */
4725 
4726     if (s->incompatible_features) {
4727         error_setg(errp, "Cannot downgrade an image with incompatible features "
4728                    "%#" PRIx64 " set", s->incompatible_features);
4729         return -ENOTSUP;
4730     }
4731 
4732     /* since we can ignore compatible features, we can set them to 0 as well */
4733     s->compatible_features = 0;
4734     /* if lazy refcounts have been used, they have already been fixed through
4735      * clearing the dirty flag */
4736 
4737     /* clearing autoclear features is trivial */
4738     s->autoclear_features = 0;
4739 
4740     ret = qcow2_expand_zero_clusters(bs, status_cb, cb_opaque);
4741     if (ret < 0) {
4742         error_setg_errno(errp, -ret, "Failed to turn zero into data clusters");
4743         return ret;
4744     }
4745 
4746     s->qcow_version = target_version;
4747     ret = qcow2_update_header(bs);
4748     if (ret < 0) {
4749         s->qcow_version = current_version;
4750         error_setg_errno(errp, -ret, "Failed to update the image header");
4751         return ret;
4752     }
4753     return 0;
4754 }
4755 
4756 typedef enum Qcow2AmendOperation {
4757     /* This is the value Qcow2AmendHelperCBInfo::last_operation will be
4758      * statically initialized to so that the helper CB can discern the first
4759      * invocation from an operation change */
4760     QCOW2_NO_OPERATION = 0,
4761 
4762     QCOW2_CHANGING_REFCOUNT_ORDER,
4763     QCOW2_DOWNGRADING,
4764 } Qcow2AmendOperation;
4765 
4766 typedef struct Qcow2AmendHelperCBInfo {
4767     /* The code coordinating the amend operations should only modify
4768      * these four fields; the rest will be managed by the CB */
4769     BlockDriverAmendStatusCB *original_status_cb;
4770     void *original_cb_opaque;
4771 
4772     Qcow2AmendOperation current_operation;
4773 
4774     /* Total number of operations to perform (only set once) */
4775     int total_operations;
4776 
4777     /* The following fields are managed by the CB */
4778 
4779     /* Number of operations completed */
4780     int operations_completed;
4781 
4782     /* Cumulative offset of all completed operations */
4783     int64_t offset_completed;
4784 
4785     Qcow2AmendOperation last_operation;
4786     int64_t last_work_size;
4787 } Qcow2AmendHelperCBInfo;
4788 
4789 static void qcow2_amend_helper_cb(BlockDriverState *bs,
4790                                   int64_t operation_offset,
4791                                   int64_t operation_work_size, void *opaque)
4792 {
4793     Qcow2AmendHelperCBInfo *info = opaque;
4794     int64_t current_work_size;
4795     int64_t projected_work_size;
4796 
4797     if (info->current_operation != info->last_operation) {
4798         if (info->last_operation != QCOW2_NO_OPERATION) {
4799             info->offset_completed += info->last_work_size;
4800             info->operations_completed++;
4801         }
4802 
4803         info->last_operation = info->current_operation;
4804     }
4805 
4806     assert(info->total_operations > 0);
4807     assert(info->operations_completed < info->total_operations);
4808 
4809     info->last_work_size = operation_work_size;
4810 
4811     current_work_size = info->offset_completed + operation_work_size;
4812 
4813     /* current_work_size is the total work size for (operations_completed + 1)
4814      * operations (which includes this one), so multiply it by the number of
4815      * operations not covered and divide it by the number of operations
4816      * covered to get a projection for the operations not covered */
4817     projected_work_size = current_work_size * (info->total_operations -
4818                                                info->operations_completed - 1)
4819                                             / (info->operations_completed + 1);
4820 
4821     info->original_status_cb(bs, info->offset_completed + operation_offset,
4822                              current_work_size + projected_work_size,
4823                              info->original_cb_opaque);
4824 }
4825 
4826 static int qcow2_amend_options(BlockDriverState *bs, QemuOpts *opts,
4827                                BlockDriverAmendStatusCB *status_cb,
4828                                void *cb_opaque,
4829                                Error **errp)
4830 {
4831     BDRVQcow2State *s = bs->opaque;
4832     int old_version = s->qcow_version, new_version = old_version;
4833     uint64_t new_size = 0;
4834     const char *backing_file = NULL, *backing_format = NULL, *data_file = NULL;
4835     bool lazy_refcounts = s->use_lazy_refcounts;
4836     bool data_file_raw = data_file_is_raw(bs);
4837     const char *compat = NULL;
4838     uint64_t cluster_size = s->cluster_size;
4839     bool encrypt;
4840     int encformat;
4841     int refcount_bits = s->refcount_bits;
4842     int ret;
4843     QemuOptDesc *desc = opts->list->desc;
4844     Qcow2AmendHelperCBInfo helper_cb_info;
4845 
4846     while (desc && desc->name) {
4847         if (!qemu_opt_find(opts, desc->name)) {
4848             /* only change explicitly defined options */
4849             desc++;
4850             continue;
4851         }
4852 
4853         if (!strcmp(desc->name, BLOCK_OPT_COMPAT_LEVEL)) {
4854             compat = qemu_opt_get(opts, BLOCK_OPT_COMPAT_LEVEL);
4855             if (!compat) {
4856                 /* preserve default */
4857             } else if (!strcmp(compat, "0.10") || !strcmp(compat, "v2")) {
4858                 new_version = 2;
4859             } else if (!strcmp(compat, "1.1") || !strcmp(compat, "v3")) {
4860                 new_version = 3;
4861             } else {
4862                 error_setg(errp, "Unknown compatibility level %s", compat);
4863                 return -EINVAL;
4864             }
4865         } else if (!strcmp(desc->name, BLOCK_OPT_PREALLOC)) {
4866             error_setg(errp, "Cannot change preallocation mode");
4867             return -ENOTSUP;
4868         } else if (!strcmp(desc->name, BLOCK_OPT_SIZE)) {
4869             new_size = qemu_opt_get_size(opts, BLOCK_OPT_SIZE, 0);
4870         } else if (!strcmp(desc->name, BLOCK_OPT_BACKING_FILE)) {
4871             backing_file = qemu_opt_get(opts, BLOCK_OPT_BACKING_FILE);
4872         } else if (!strcmp(desc->name, BLOCK_OPT_BACKING_FMT)) {
4873             backing_format = qemu_opt_get(opts, BLOCK_OPT_BACKING_FMT);
4874         } else if (!strcmp(desc->name, BLOCK_OPT_ENCRYPT)) {
4875             encrypt = qemu_opt_get_bool(opts, BLOCK_OPT_ENCRYPT,
4876                                         !!s->crypto);
4877 
4878             if (encrypt != !!s->crypto) {
4879                 error_setg(errp,
4880                            "Changing the encryption flag is not supported");
4881                 return -ENOTSUP;
4882             }
4883         } else if (!strcmp(desc->name, BLOCK_OPT_ENCRYPT_FORMAT)) {
4884             encformat = qcow2_crypt_method_from_format(
4885                 qemu_opt_get(opts, BLOCK_OPT_ENCRYPT_FORMAT));
4886 
4887             if (encformat != s->crypt_method_header) {
4888                 error_setg(errp,
4889                            "Changing the encryption format is not supported");
4890                 return -ENOTSUP;
4891             }
4892         } else if (g_str_has_prefix(desc->name, "encrypt.")) {
4893             error_setg(errp,
4894                        "Changing the encryption parameters is not supported");
4895             return -ENOTSUP;
4896         } else if (!strcmp(desc->name, BLOCK_OPT_CLUSTER_SIZE)) {
4897             cluster_size = qemu_opt_get_size(opts, BLOCK_OPT_CLUSTER_SIZE,
4898                                              cluster_size);
4899             if (cluster_size != s->cluster_size) {
4900                 error_setg(errp, "Changing the cluster size is not supported");
4901                 return -ENOTSUP;
4902             }
4903         } else if (!strcmp(desc->name, BLOCK_OPT_LAZY_REFCOUNTS)) {
4904             lazy_refcounts = qemu_opt_get_bool(opts, BLOCK_OPT_LAZY_REFCOUNTS,
4905                                                lazy_refcounts);
4906         } else if (!strcmp(desc->name, BLOCK_OPT_REFCOUNT_BITS)) {
4907             refcount_bits = qemu_opt_get_number(opts, BLOCK_OPT_REFCOUNT_BITS,
4908                                                 refcount_bits);
4909 
4910             if (refcount_bits <= 0 || refcount_bits > 64 ||
4911                 !is_power_of_2(refcount_bits))
4912             {
4913                 error_setg(errp, "Refcount width must be a power of two and "
4914                            "may not exceed 64 bits");
4915                 return -EINVAL;
4916             }
4917         } else if (!strcmp(desc->name, BLOCK_OPT_DATA_FILE)) {
4918             data_file = qemu_opt_get(opts, BLOCK_OPT_DATA_FILE);
4919             if (data_file && !has_data_file(bs)) {
4920                 error_setg(errp, "data-file can only be set for images that "
4921                                  "use an external data file");
4922                 return -EINVAL;
4923             }
4924         } else if (!strcmp(desc->name, BLOCK_OPT_DATA_FILE_RAW)) {
4925             data_file_raw = qemu_opt_get_bool(opts, BLOCK_OPT_DATA_FILE_RAW,
4926                                               data_file_raw);
4927             if (data_file_raw && !data_file_is_raw(bs)) {
4928                 error_setg(errp, "data-file-raw cannot be set on existing "
4929                                  "images");
4930                 return -EINVAL;
4931             }
4932         } else {
4933             /* if this point is reached, this probably means a new option was
4934              * added without having it covered here */
4935             abort();
4936         }
4937 
4938         desc++;
4939     }
4940 
4941     helper_cb_info = (Qcow2AmendHelperCBInfo){
4942         .original_status_cb = status_cb,
4943         .original_cb_opaque = cb_opaque,
4944         .total_operations = (new_version < old_version)
4945                           + (s->refcount_bits != refcount_bits)
4946     };
4947 
4948     /* Upgrade first (some features may require compat=1.1) */
4949     if (new_version > old_version) {
4950         s->qcow_version = new_version;
4951         ret = qcow2_update_header(bs);
4952         if (ret < 0) {
4953             s->qcow_version = old_version;
4954             error_setg_errno(errp, -ret, "Failed to update the image header");
4955             return ret;
4956         }
4957     }
4958 
4959     if (s->refcount_bits != refcount_bits) {
4960         int refcount_order = ctz32(refcount_bits);
4961 
4962         if (new_version < 3 && refcount_bits != 16) {
4963             error_setg(errp, "Refcount widths other than 16 bits require "
4964                        "compatibility level 1.1 or above (use compat=1.1 or "
4965                        "greater)");
4966             return -EINVAL;
4967         }
4968 
4969         helper_cb_info.current_operation = QCOW2_CHANGING_REFCOUNT_ORDER;
4970         ret = qcow2_change_refcount_order(bs, refcount_order,
4971                                           &qcow2_amend_helper_cb,
4972                                           &helper_cb_info, errp);
4973         if (ret < 0) {
4974             return ret;
4975         }
4976     }
4977 
4978     /* data-file-raw blocks backing files, so clear it first if requested */
4979     if (data_file_raw) {
4980         s->autoclear_features |= QCOW2_AUTOCLEAR_DATA_FILE_RAW;
4981     } else {
4982         s->autoclear_features &= ~QCOW2_AUTOCLEAR_DATA_FILE_RAW;
4983     }
4984 
4985     if (data_file) {
4986         g_free(s->image_data_file);
4987         s->image_data_file = *data_file ? g_strdup(data_file) : NULL;
4988     }
4989 
4990     ret = qcow2_update_header(bs);
4991     if (ret < 0) {
4992         error_setg_errno(errp, -ret, "Failed to update the image header");
4993         return ret;
4994     }
4995 
4996     if (backing_file || backing_format) {
4997         ret = qcow2_change_backing_file(bs,
4998                     backing_file ?: s->image_backing_file,
4999                     backing_format ?: s->image_backing_format);
5000         if (ret < 0) {
5001             error_setg_errno(errp, -ret, "Failed to change the backing file");
5002             return ret;
5003         }
5004     }
5005 
5006     if (s->use_lazy_refcounts != lazy_refcounts) {
5007         if (lazy_refcounts) {
5008             if (new_version < 3) {
5009                 error_setg(errp, "Lazy refcounts only supported with "
5010                            "compatibility level 1.1 and above (use compat=1.1 "
5011                            "or greater)");
5012                 return -EINVAL;
5013             }
5014             s->compatible_features |= QCOW2_COMPAT_LAZY_REFCOUNTS;
5015             ret = qcow2_update_header(bs);
5016             if (ret < 0) {
5017                 s->compatible_features &= ~QCOW2_COMPAT_LAZY_REFCOUNTS;
5018                 error_setg_errno(errp, -ret, "Failed to update the image header");
5019                 return ret;
5020             }
5021             s->use_lazy_refcounts = true;
5022         } else {
5023             /* make image clean first */
5024             ret = qcow2_mark_clean(bs);
5025             if (ret < 0) {
5026                 error_setg_errno(errp, -ret, "Failed to make the image clean");
5027                 return ret;
5028             }
5029             /* now disallow lazy refcounts */
5030             s->compatible_features &= ~QCOW2_COMPAT_LAZY_REFCOUNTS;
5031             ret = qcow2_update_header(bs);
5032             if (ret < 0) {
5033                 s->compatible_features |= QCOW2_COMPAT_LAZY_REFCOUNTS;
5034                 error_setg_errno(errp, -ret, "Failed to update the image header");
5035                 return ret;
5036             }
5037             s->use_lazy_refcounts = false;
5038         }
5039     }
5040 
5041     if (new_size) {
5042         BlockBackend *blk = blk_new(bdrv_get_aio_context(bs),
5043                                     BLK_PERM_RESIZE, BLK_PERM_ALL);
5044         ret = blk_insert_bs(blk, bs, errp);
5045         if (ret < 0) {
5046             blk_unref(blk);
5047             return ret;
5048         }
5049 
5050         ret = blk_truncate(blk, new_size, PREALLOC_MODE_OFF, errp);
5051         blk_unref(blk);
5052         if (ret < 0) {
5053             return ret;
5054         }
5055     }
5056 
5057     /* Downgrade last (so unsupported features can be removed before) */
5058     if (new_version < old_version) {
5059         helper_cb_info.current_operation = QCOW2_DOWNGRADING;
5060         ret = qcow2_downgrade(bs, new_version, &qcow2_amend_helper_cb,
5061                               &helper_cb_info, errp);
5062         if (ret < 0) {
5063             return ret;
5064         }
5065     }
5066 
5067     return 0;
5068 }
5069 
5070 /*
5071  * If offset or size are negative, respectively, they will not be included in
5072  * the BLOCK_IMAGE_CORRUPTED event emitted.
5073  * fatal will be ignored for read-only BDS; corruptions found there will always
5074  * be considered non-fatal.
5075  */
5076 void qcow2_signal_corruption(BlockDriverState *bs, bool fatal, int64_t offset,
5077                              int64_t size, const char *message_format, ...)
5078 {
5079     BDRVQcow2State *s = bs->opaque;
5080     const char *node_name;
5081     char *message;
5082     va_list ap;
5083 
5084     fatal = fatal && bdrv_is_writable(bs);
5085 
5086     if (s->signaled_corruption &&
5087         (!fatal || (s->incompatible_features & QCOW2_INCOMPAT_CORRUPT)))
5088     {
5089         return;
5090     }
5091 
5092     va_start(ap, message_format);
5093     message = g_strdup_vprintf(message_format, ap);
5094     va_end(ap);
5095 
5096     if (fatal) {
5097         fprintf(stderr, "qcow2: Marking image as corrupt: %s; further "
5098                 "corruption events will be suppressed\n", message);
5099     } else {
5100         fprintf(stderr, "qcow2: Image is corrupt: %s; further non-fatal "
5101                 "corruption events will be suppressed\n", message);
5102     }
5103 
5104     node_name = bdrv_get_node_name(bs);
5105     qapi_event_send_block_image_corrupted(bdrv_get_device_name(bs),
5106                                           *node_name != '\0', node_name,
5107                                           message, offset >= 0, offset,
5108                                           size >= 0, size,
5109                                           fatal);
5110     g_free(message);
5111 
5112     if (fatal) {
5113         qcow2_mark_corrupt(bs);
5114         bs->drv = NULL; /* make BDS unusable */
5115     }
5116 
5117     s->signaled_corruption = true;
5118 }
5119 
5120 static QemuOptsList qcow2_create_opts = {
5121     .name = "qcow2-create-opts",
5122     .head = QTAILQ_HEAD_INITIALIZER(qcow2_create_opts.head),
5123     .desc = {
5124         {
5125             .name = BLOCK_OPT_SIZE,
5126             .type = QEMU_OPT_SIZE,
5127             .help = "Virtual disk size"
5128         },
5129         {
5130             .name = BLOCK_OPT_COMPAT_LEVEL,
5131             .type = QEMU_OPT_STRING,
5132             .help = "Compatibility level (v2 [0.10] or v3 [1.1])"
5133         },
5134         {
5135             .name = BLOCK_OPT_BACKING_FILE,
5136             .type = QEMU_OPT_STRING,
5137             .help = "File name of a base image"
5138         },
5139         {
5140             .name = BLOCK_OPT_BACKING_FMT,
5141             .type = QEMU_OPT_STRING,
5142             .help = "Image format of the base image"
5143         },
5144         {
5145             .name = BLOCK_OPT_DATA_FILE,
5146             .type = QEMU_OPT_STRING,
5147             .help = "File name of an external data file"
5148         },
5149         {
5150             .name = BLOCK_OPT_DATA_FILE_RAW,
5151             .type = QEMU_OPT_BOOL,
5152             .help = "The external data file must stay valid as a raw image"
5153         },
5154         {
5155             .name = BLOCK_OPT_ENCRYPT,
5156             .type = QEMU_OPT_BOOL,
5157             .help = "Encrypt the image with format 'aes'. (Deprecated "
5158                     "in favor of " BLOCK_OPT_ENCRYPT_FORMAT "=aes)",
5159         },
5160         {
5161             .name = BLOCK_OPT_ENCRYPT_FORMAT,
5162             .type = QEMU_OPT_STRING,
5163             .help = "Encrypt the image, format choices: 'aes', 'luks'",
5164         },
5165         BLOCK_CRYPTO_OPT_DEF_KEY_SECRET("encrypt.",
5166             "ID of secret providing qcow AES key or LUKS passphrase"),
5167         BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_ALG("encrypt."),
5168         BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_MODE("encrypt."),
5169         BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_ALG("encrypt."),
5170         BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_HASH_ALG("encrypt."),
5171         BLOCK_CRYPTO_OPT_DEF_LUKS_HASH_ALG("encrypt."),
5172         BLOCK_CRYPTO_OPT_DEF_LUKS_ITER_TIME("encrypt."),
5173         {
5174             .name = BLOCK_OPT_CLUSTER_SIZE,
5175             .type = QEMU_OPT_SIZE,
5176             .help = "qcow2 cluster size",
5177             .def_value_str = stringify(DEFAULT_CLUSTER_SIZE)
5178         },
5179         {
5180             .name = BLOCK_OPT_PREALLOC,
5181             .type = QEMU_OPT_STRING,
5182             .help = "Preallocation mode (allowed values: off, metadata, "
5183                     "falloc, full)"
5184         },
5185         {
5186             .name = BLOCK_OPT_LAZY_REFCOUNTS,
5187             .type = QEMU_OPT_BOOL,
5188             .help = "Postpone refcount updates",
5189             .def_value_str = "off"
5190         },
5191         {
5192             .name = BLOCK_OPT_REFCOUNT_BITS,
5193             .type = QEMU_OPT_NUMBER,
5194             .help = "Width of a reference count entry in bits",
5195             .def_value_str = "16"
5196         },
5197         { /* end of list */ }
5198     }
5199 };
5200 
5201 static const char *const qcow2_strong_runtime_opts[] = {
5202     "encrypt." BLOCK_CRYPTO_OPT_QCOW_KEY_SECRET,
5203 
5204     NULL
5205 };
5206 
5207 BlockDriver bdrv_qcow2 = {
5208     .format_name        = "qcow2",
5209     .instance_size      = sizeof(BDRVQcow2State),
5210     .bdrv_probe         = qcow2_probe,
5211     .bdrv_open          = qcow2_open,
5212     .bdrv_close         = qcow2_close,
5213     .bdrv_reopen_prepare  = qcow2_reopen_prepare,
5214     .bdrv_reopen_commit   = qcow2_reopen_commit,
5215     .bdrv_reopen_abort    = qcow2_reopen_abort,
5216     .bdrv_join_options    = qcow2_join_options,
5217     .bdrv_child_perm      = bdrv_format_default_perms,
5218     .bdrv_co_create_opts  = qcow2_co_create_opts,
5219     .bdrv_co_create       = qcow2_co_create,
5220     .bdrv_has_zero_init   = qcow2_has_zero_init,
5221     .bdrv_has_zero_init_truncate = bdrv_has_zero_init_1,
5222     .bdrv_co_block_status = qcow2_co_block_status,
5223 
5224     .bdrv_co_preadv_part    = qcow2_co_preadv_part,
5225     .bdrv_co_pwritev_part   = qcow2_co_pwritev_part,
5226     .bdrv_co_flush_to_os    = qcow2_co_flush_to_os,
5227 
5228     .bdrv_co_pwrite_zeroes  = qcow2_co_pwrite_zeroes,
5229     .bdrv_co_pdiscard       = qcow2_co_pdiscard,
5230     .bdrv_co_copy_range_from = qcow2_co_copy_range_from,
5231     .bdrv_co_copy_range_to  = qcow2_co_copy_range_to,
5232     .bdrv_co_truncate       = qcow2_co_truncate,
5233     .bdrv_co_pwritev_compressed_part = qcow2_co_pwritev_compressed_part,
5234     .bdrv_make_empty        = qcow2_make_empty,
5235 
5236     .bdrv_snapshot_create   = qcow2_snapshot_create,
5237     .bdrv_snapshot_goto     = qcow2_snapshot_goto,
5238     .bdrv_snapshot_delete   = qcow2_snapshot_delete,
5239     .bdrv_snapshot_list     = qcow2_snapshot_list,
5240     .bdrv_snapshot_load_tmp = qcow2_snapshot_load_tmp,
5241     .bdrv_measure           = qcow2_measure,
5242     .bdrv_get_info          = qcow2_get_info,
5243     .bdrv_get_specific_info = qcow2_get_specific_info,
5244 
5245     .bdrv_save_vmstate    = qcow2_save_vmstate,
5246     .bdrv_load_vmstate    = qcow2_load_vmstate,
5247 
5248     .supports_backing           = true,
5249     .bdrv_change_backing_file   = qcow2_change_backing_file,
5250 
5251     .bdrv_refresh_limits        = qcow2_refresh_limits,
5252     .bdrv_co_invalidate_cache   = qcow2_co_invalidate_cache,
5253     .bdrv_inactivate            = qcow2_inactivate,
5254 
5255     .create_opts         = &qcow2_create_opts,
5256     .strong_runtime_opts = qcow2_strong_runtime_opts,
5257     .mutable_opts        = mutable_opts,
5258     .bdrv_co_check       = qcow2_co_check,
5259     .bdrv_amend_options  = qcow2_amend_options,
5260 
5261     .bdrv_detach_aio_context  = qcow2_detach_aio_context,
5262     .bdrv_attach_aio_context  = qcow2_attach_aio_context,
5263 
5264     .bdrv_reopen_bitmaps_rw = qcow2_reopen_bitmaps_rw,
5265     .bdrv_can_store_new_dirty_bitmap = qcow2_can_store_new_dirty_bitmap,
5266     .bdrv_remove_persistent_dirty_bitmap = qcow2_remove_persistent_dirty_bitmap,
5267 };
5268 
5269 static void bdrv_qcow2_init(void)
5270 {
5271     bdrv_register(&bdrv_qcow2);
5272 }
5273 
5274 block_init(bdrv_qcow2_init);
5275