xref: /openbmc/qemu/block/qcow2.c (revision b097ba37)
1 /*
2  * Block driver for the QCOW version 2 format
3  *
4  * Copyright (c) 2004-2006 Fabrice Bellard
5  *
6  * Permission is hereby granted, free of charge, to any person obtaining a copy
7  * of this software and associated documentation files (the "Software"), to deal
8  * in the Software without restriction, including without limitation the rights
9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10  * copies of the Software, and to permit persons to whom the Software is
11  * furnished to do so, subject to the following conditions:
12  *
13  * The above copyright notice and this permission notice shall be included in
14  * all copies or substantial portions of the Software.
15  *
16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22  * THE SOFTWARE.
23  */
24 
25 #include "qemu/osdep.h"
26 
27 #define ZLIB_CONST
28 #include <zlib.h>
29 
30 #include "block/block_int.h"
31 #include "block/qdict.h"
32 #include "sysemu/block-backend.h"
33 #include "qemu/module.h"
34 #include "qcow2.h"
35 #include "qemu/error-report.h"
36 #include "qapi/error.h"
37 #include "qapi/qapi-events-block-core.h"
38 #include "qapi/qmp/qdict.h"
39 #include "qapi/qmp/qstring.h"
40 #include "trace.h"
41 #include "qemu/option_int.h"
42 #include "qemu/cutils.h"
43 #include "qemu/bswap.h"
44 #include "qapi/qobject-input-visitor.h"
45 #include "qapi/qapi-visit-block-core.h"
46 #include "crypto.h"
47 #include "block/thread-pool.h"
48 
49 /*
50   Differences with QCOW:
51 
52   - Support for multiple incremental snapshots.
53   - Memory management by reference counts.
54   - Clusters which have a reference count of one have the bit
55     QCOW_OFLAG_COPIED to optimize write performance.
56   - Size of compressed clusters is stored in sectors to reduce bit usage
57     in the cluster offsets.
58   - Support for storing additional data (such as the VM state) in the
59     snapshots.
60   - If a backing store is used, the cluster size is not constrained
61     (could be backported to QCOW).
62   - L2 tables have always a size of one cluster.
63 */
64 
65 
66 typedef struct {
67     uint32_t magic;
68     uint32_t len;
69 } QEMU_PACKED QCowExtension;
70 
71 #define  QCOW2_EXT_MAGIC_END 0
72 #define  QCOW2_EXT_MAGIC_BACKING_FORMAT 0xE2792ACA
73 #define  QCOW2_EXT_MAGIC_FEATURE_TABLE 0x6803f857
74 #define  QCOW2_EXT_MAGIC_CRYPTO_HEADER 0x0537be77
75 #define  QCOW2_EXT_MAGIC_BITMAPS 0x23852875
76 #define  QCOW2_EXT_MAGIC_DATA_FILE 0x44415441
77 
78 static int coroutine_fn
79 qcow2_co_preadv_compressed(BlockDriverState *bs,
80                            uint64_t file_cluster_offset,
81                            uint64_t offset,
82                            uint64_t bytes,
83                            QEMUIOVector *qiov);
84 
85 static int qcow2_probe(const uint8_t *buf, int buf_size, const char *filename)
86 {
87     const QCowHeader *cow_header = (const void *)buf;
88 
89     if (buf_size >= sizeof(QCowHeader) &&
90         be32_to_cpu(cow_header->magic) == QCOW_MAGIC &&
91         be32_to_cpu(cow_header->version) >= 2)
92         return 100;
93     else
94         return 0;
95 }
96 
97 
98 static ssize_t qcow2_crypto_hdr_read_func(QCryptoBlock *block, size_t offset,
99                                           uint8_t *buf, size_t buflen,
100                                           void *opaque, Error **errp)
101 {
102     BlockDriverState *bs = opaque;
103     BDRVQcow2State *s = bs->opaque;
104     ssize_t ret;
105 
106     if ((offset + buflen) > s->crypto_header.length) {
107         error_setg(errp, "Request for data outside of extension header");
108         return -1;
109     }
110 
111     ret = bdrv_pread(bs->file,
112                      s->crypto_header.offset + offset, buf, buflen);
113     if (ret < 0) {
114         error_setg_errno(errp, -ret, "Could not read encryption header");
115         return -1;
116     }
117     return ret;
118 }
119 
120 
121 static ssize_t qcow2_crypto_hdr_init_func(QCryptoBlock *block, size_t headerlen,
122                                           void *opaque, Error **errp)
123 {
124     BlockDriverState *bs = opaque;
125     BDRVQcow2State *s = bs->opaque;
126     int64_t ret;
127     int64_t clusterlen;
128 
129     ret = qcow2_alloc_clusters(bs, headerlen);
130     if (ret < 0) {
131         error_setg_errno(errp, -ret,
132                          "Cannot allocate cluster for LUKS header size %zu",
133                          headerlen);
134         return -1;
135     }
136 
137     s->crypto_header.length = headerlen;
138     s->crypto_header.offset = ret;
139 
140     /* Zero fill remaining space in cluster so it has predictable
141      * content in case of future spec changes */
142     clusterlen = size_to_clusters(s, headerlen) * s->cluster_size;
143     assert(qcow2_pre_write_overlap_check(bs, 0, ret, clusterlen, false) == 0);
144     ret = bdrv_pwrite_zeroes(bs->file,
145                              ret + headerlen,
146                              clusterlen - headerlen, 0);
147     if (ret < 0) {
148         error_setg_errno(errp, -ret, "Could not zero fill encryption header");
149         return -1;
150     }
151 
152     return ret;
153 }
154 
155 
156 static ssize_t qcow2_crypto_hdr_write_func(QCryptoBlock *block, size_t offset,
157                                            const uint8_t *buf, size_t buflen,
158                                            void *opaque, Error **errp)
159 {
160     BlockDriverState *bs = opaque;
161     BDRVQcow2State *s = bs->opaque;
162     ssize_t ret;
163 
164     if ((offset + buflen) > s->crypto_header.length) {
165         error_setg(errp, "Request for data outside of extension header");
166         return -1;
167     }
168 
169     ret = bdrv_pwrite(bs->file,
170                       s->crypto_header.offset + offset, buf, buflen);
171     if (ret < 0) {
172         error_setg_errno(errp, -ret, "Could not read encryption header");
173         return -1;
174     }
175     return ret;
176 }
177 
178 
179 /*
180  * read qcow2 extension and fill bs
181  * start reading from start_offset
182  * finish reading upon magic of value 0 or when end_offset reached
183  * unknown magic is skipped (future extension this version knows nothing about)
184  * return 0 upon success, non-0 otherwise
185  */
186 static int qcow2_read_extensions(BlockDriverState *bs, uint64_t start_offset,
187                                  uint64_t end_offset, void **p_feature_table,
188                                  int flags, bool *need_update_header,
189                                  Error **errp)
190 {
191     BDRVQcow2State *s = bs->opaque;
192     QCowExtension ext;
193     uint64_t offset;
194     int ret;
195     Qcow2BitmapHeaderExt bitmaps_ext;
196 
197     if (need_update_header != NULL) {
198         *need_update_header = false;
199     }
200 
201 #ifdef DEBUG_EXT
202     printf("qcow2_read_extensions: start=%ld end=%ld\n", start_offset, end_offset);
203 #endif
204     offset = start_offset;
205     while (offset < end_offset) {
206 
207 #ifdef DEBUG_EXT
208         /* Sanity check */
209         if (offset > s->cluster_size)
210             printf("qcow2_read_extension: suspicious offset %lu\n", offset);
211 
212         printf("attempting to read extended header in offset %lu\n", offset);
213 #endif
214 
215         ret = bdrv_pread(bs->file, offset, &ext, sizeof(ext));
216         if (ret < 0) {
217             error_setg_errno(errp, -ret, "qcow2_read_extension: ERROR: "
218                              "pread fail from offset %" PRIu64, offset);
219             return 1;
220         }
221         ext.magic = be32_to_cpu(ext.magic);
222         ext.len = be32_to_cpu(ext.len);
223         offset += sizeof(ext);
224 #ifdef DEBUG_EXT
225         printf("ext.magic = 0x%x\n", ext.magic);
226 #endif
227         if (offset > end_offset || ext.len > end_offset - offset) {
228             error_setg(errp, "Header extension too large");
229             return -EINVAL;
230         }
231 
232         switch (ext.magic) {
233         case QCOW2_EXT_MAGIC_END:
234             return 0;
235 
236         case QCOW2_EXT_MAGIC_BACKING_FORMAT:
237             if (ext.len >= sizeof(bs->backing_format)) {
238                 error_setg(errp, "ERROR: ext_backing_format: len=%" PRIu32
239                            " too large (>=%zu)", ext.len,
240                            sizeof(bs->backing_format));
241                 return 2;
242             }
243             ret = bdrv_pread(bs->file, offset, bs->backing_format, ext.len);
244             if (ret < 0) {
245                 error_setg_errno(errp, -ret, "ERROR: ext_backing_format: "
246                                  "Could not read format name");
247                 return 3;
248             }
249             bs->backing_format[ext.len] = '\0';
250             s->image_backing_format = g_strdup(bs->backing_format);
251 #ifdef DEBUG_EXT
252             printf("Qcow2: Got format extension %s\n", bs->backing_format);
253 #endif
254             break;
255 
256         case QCOW2_EXT_MAGIC_FEATURE_TABLE:
257             if (p_feature_table != NULL) {
258                 void* feature_table = g_malloc0(ext.len + 2 * sizeof(Qcow2Feature));
259                 ret = bdrv_pread(bs->file, offset , feature_table, ext.len);
260                 if (ret < 0) {
261                     error_setg_errno(errp, -ret, "ERROR: ext_feature_table: "
262                                      "Could not read table");
263                     return ret;
264                 }
265 
266                 *p_feature_table = feature_table;
267             }
268             break;
269 
270         case QCOW2_EXT_MAGIC_CRYPTO_HEADER: {
271             unsigned int cflags = 0;
272             if (s->crypt_method_header != QCOW_CRYPT_LUKS) {
273                 error_setg(errp, "CRYPTO header extension only "
274                            "expected with LUKS encryption method");
275                 return -EINVAL;
276             }
277             if (ext.len != sizeof(Qcow2CryptoHeaderExtension)) {
278                 error_setg(errp, "CRYPTO header extension size %u, "
279                            "but expected size %zu", ext.len,
280                            sizeof(Qcow2CryptoHeaderExtension));
281                 return -EINVAL;
282             }
283 
284             ret = bdrv_pread(bs->file, offset, &s->crypto_header, ext.len);
285             if (ret < 0) {
286                 error_setg_errno(errp, -ret,
287                                  "Unable to read CRYPTO header extension");
288                 return ret;
289             }
290             s->crypto_header.offset = be64_to_cpu(s->crypto_header.offset);
291             s->crypto_header.length = be64_to_cpu(s->crypto_header.length);
292 
293             if ((s->crypto_header.offset % s->cluster_size) != 0) {
294                 error_setg(errp, "Encryption header offset '%" PRIu64 "' is "
295                            "not a multiple of cluster size '%u'",
296                            s->crypto_header.offset, s->cluster_size);
297                 return -EINVAL;
298             }
299 
300             if (flags & BDRV_O_NO_IO) {
301                 cflags |= QCRYPTO_BLOCK_OPEN_NO_IO;
302             }
303             s->crypto = qcrypto_block_open(s->crypto_opts, "encrypt.",
304                                            qcow2_crypto_hdr_read_func,
305                                            bs, cflags, 1, errp);
306             if (!s->crypto) {
307                 return -EINVAL;
308             }
309         }   break;
310 
311         case QCOW2_EXT_MAGIC_BITMAPS:
312             if (ext.len != sizeof(bitmaps_ext)) {
313                 error_setg_errno(errp, -ret, "bitmaps_ext: "
314                                  "Invalid extension length");
315                 return -EINVAL;
316             }
317 
318             if (!(s->autoclear_features & QCOW2_AUTOCLEAR_BITMAPS)) {
319                 if (s->qcow_version < 3) {
320                     /* Let's be a bit more specific */
321                     warn_report("This qcow2 v2 image contains bitmaps, but "
322                                 "they may have been modified by a program "
323                                 "without persistent bitmap support; so now "
324                                 "they must all be considered inconsistent");
325                 } else {
326                     warn_report("a program lacking bitmap support "
327                                 "modified this file, so all bitmaps are now "
328                                 "considered inconsistent");
329                 }
330                 error_printf("Some clusters may be leaked, "
331                              "run 'qemu-img check -r' on the image "
332                              "file to fix.");
333                 if (need_update_header != NULL) {
334                     /* Updating is needed to drop invalid bitmap extension. */
335                     *need_update_header = true;
336                 }
337                 break;
338             }
339 
340             ret = bdrv_pread(bs->file, offset, &bitmaps_ext, ext.len);
341             if (ret < 0) {
342                 error_setg_errno(errp, -ret, "bitmaps_ext: "
343                                  "Could not read ext header");
344                 return ret;
345             }
346 
347             if (bitmaps_ext.reserved32 != 0) {
348                 error_setg_errno(errp, -ret, "bitmaps_ext: "
349                                  "Reserved field is not zero");
350                 return -EINVAL;
351             }
352 
353             bitmaps_ext.nb_bitmaps = be32_to_cpu(bitmaps_ext.nb_bitmaps);
354             bitmaps_ext.bitmap_directory_size =
355                 be64_to_cpu(bitmaps_ext.bitmap_directory_size);
356             bitmaps_ext.bitmap_directory_offset =
357                 be64_to_cpu(bitmaps_ext.bitmap_directory_offset);
358 
359             if (bitmaps_ext.nb_bitmaps > QCOW2_MAX_BITMAPS) {
360                 error_setg(errp,
361                            "bitmaps_ext: Image has %" PRIu32 " bitmaps, "
362                            "exceeding the QEMU supported maximum of %d",
363                            bitmaps_ext.nb_bitmaps, QCOW2_MAX_BITMAPS);
364                 return -EINVAL;
365             }
366 
367             if (bitmaps_ext.nb_bitmaps == 0) {
368                 error_setg(errp, "found bitmaps extension with zero bitmaps");
369                 return -EINVAL;
370             }
371 
372             if (bitmaps_ext.bitmap_directory_offset & (s->cluster_size - 1)) {
373                 error_setg(errp, "bitmaps_ext: "
374                                  "invalid bitmap directory offset");
375                 return -EINVAL;
376             }
377 
378             if (bitmaps_ext.bitmap_directory_size >
379                 QCOW2_MAX_BITMAP_DIRECTORY_SIZE) {
380                 error_setg(errp, "bitmaps_ext: "
381                                  "bitmap directory size (%" PRIu64 ") exceeds "
382                                  "the maximum supported size (%d)",
383                                  bitmaps_ext.bitmap_directory_size,
384                                  QCOW2_MAX_BITMAP_DIRECTORY_SIZE);
385                 return -EINVAL;
386             }
387 
388             s->nb_bitmaps = bitmaps_ext.nb_bitmaps;
389             s->bitmap_directory_offset =
390                     bitmaps_ext.bitmap_directory_offset;
391             s->bitmap_directory_size =
392                     bitmaps_ext.bitmap_directory_size;
393 
394 #ifdef DEBUG_EXT
395             printf("Qcow2: Got bitmaps extension: "
396                    "offset=%" PRIu64 " nb_bitmaps=%" PRIu32 "\n",
397                    s->bitmap_directory_offset, s->nb_bitmaps);
398 #endif
399             break;
400 
401         case QCOW2_EXT_MAGIC_DATA_FILE:
402         {
403             s->image_data_file = g_malloc0(ext.len + 1);
404             ret = bdrv_pread(bs->file, offset, s->image_data_file, ext.len);
405             if (ret < 0) {
406                 error_setg_errno(errp, -ret,
407                                  "ERROR: Could not read data file name");
408                 return ret;
409             }
410 #ifdef DEBUG_EXT
411             printf("Qcow2: Got external data file %s\n", s->image_data_file);
412 #endif
413             break;
414         }
415 
416         default:
417             /* unknown magic - save it in case we need to rewrite the header */
418             /* If you add a new feature, make sure to also update the fast
419              * path of qcow2_make_empty() to deal with it. */
420             {
421                 Qcow2UnknownHeaderExtension *uext;
422 
423                 uext = g_malloc0(sizeof(*uext)  + ext.len);
424                 uext->magic = ext.magic;
425                 uext->len = ext.len;
426                 QLIST_INSERT_HEAD(&s->unknown_header_ext, uext, next);
427 
428                 ret = bdrv_pread(bs->file, offset , uext->data, uext->len);
429                 if (ret < 0) {
430                     error_setg_errno(errp, -ret, "ERROR: unknown extension: "
431                                      "Could not read data");
432                     return ret;
433                 }
434             }
435             break;
436         }
437 
438         offset += ((ext.len + 7) & ~7);
439     }
440 
441     return 0;
442 }
443 
444 static void cleanup_unknown_header_ext(BlockDriverState *bs)
445 {
446     BDRVQcow2State *s = bs->opaque;
447     Qcow2UnknownHeaderExtension *uext, *next;
448 
449     QLIST_FOREACH_SAFE(uext, &s->unknown_header_ext, next, next) {
450         QLIST_REMOVE(uext, next);
451         g_free(uext);
452     }
453 }
454 
455 static void report_unsupported_feature(Error **errp, Qcow2Feature *table,
456                                        uint64_t mask)
457 {
458     char *features = g_strdup("");
459     char *old;
460 
461     while (table && table->name[0] != '\0') {
462         if (table->type == QCOW2_FEAT_TYPE_INCOMPATIBLE) {
463             if (mask & (1ULL << table->bit)) {
464                 old = features;
465                 features = g_strdup_printf("%s%s%.46s", old, *old ? ", " : "",
466                                            table->name);
467                 g_free(old);
468                 mask &= ~(1ULL << table->bit);
469             }
470         }
471         table++;
472     }
473 
474     if (mask) {
475         old = features;
476         features = g_strdup_printf("%s%sUnknown incompatible feature: %" PRIx64,
477                                    old, *old ? ", " : "", mask);
478         g_free(old);
479     }
480 
481     error_setg(errp, "Unsupported qcow2 feature(s): %s", features);
482     g_free(features);
483 }
484 
485 /*
486  * Sets the dirty bit and flushes afterwards if necessary.
487  *
488  * The incompatible_features bit is only set if the image file header was
489  * updated successfully.  Therefore it is not required to check the return
490  * value of this function.
491  */
492 int qcow2_mark_dirty(BlockDriverState *bs)
493 {
494     BDRVQcow2State *s = bs->opaque;
495     uint64_t val;
496     int ret;
497 
498     assert(s->qcow_version >= 3);
499 
500     if (s->incompatible_features & QCOW2_INCOMPAT_DIRTY) {
501         return 0; /* already dirty */
502     }
503 
504     val = cpu_to_be64(s->incompatible_features | QCOW2_INCOMPAT_DIRTY);
505     ret = bdrv_pwrite(bs->file, offsetof(QCowHeader, incompatible_features),
506                       &val, sizeof(val));
507     if (ret < 0) {
508         return ret;
509     }
510     ret = bdrv_flush(bs->file->bs);
511     if (ret < 0) {
512         return ret;
513     }
514 
515     /* Only treat image as dirty if the header was updated successfully */
516     s->incompatible_features |= QCOW2_INCOMPAT_DIRTY;
517     return 0;
518 }
519 
520 /*
521  * Clears the dirty bit and flushes before if necessary.  Only call this
522  * function when there are no pending requests, it does not guard against
523  * concurrent requests dirtying the image.
524  */
525 static int qcow2_mark_clean(BlockDriverState *bs)
526 {
527     BDRVQcow2State *s = bs->opaque;
528 
529     if (s->incompatible_features & QCOW2_INCOMPAT_DIRTY) {
530         int ret;
531 
532         s->incompatible_features &= ~QCOW2_INCOMPAT_DIRTY;
533 
534         ret = qcow2_flush_caches(bs);
535         if (ret < 0) {
536             return ret;
537         }
538 
539         return qcow2_update_header(bs);
540     }
541     return 0;
542 }
543 
544 /*
545  * Marks the image as corrupt.
546  */
547 int qcow2_mark_corrupt(BlockDriverState *bs)
548 {
549     BDRVQcow2State *s = bs->opaque;
550 
551     s->incompatible_features |= QCOW2_INCOMPAT_CORRUPT;
552     return qcow2_update_header(bs);
553 }
554 
555 /*
556  * Marks the image as consistent, i.e., unsets the corrupt bit, and flushes
557  * before if necessary.
558  */
559 int qcow2_mark_consistent(BlockDriverState *bs)
560 {
561     BDRVQcow2State *s = bs->opaque;
562 
563     if (s->incompatible_features & QCOW2_INCOMPAT_CORRUPT) {
564         int ret = qcow2_flush_caches(bs);
565         if (ret < 0) {
566             return ret;
567         }
568 
569         s->incompatible_features &= ~QCOW2_INCOMPAT_CORRUPT;
570         return qcow2_update_header(bs);
571     }
572     return 0;
573 }
574 
575 static int coroutine_fn qcow2_co_check_locked(BlockDriverState *bs,
576                                               BdrvCheckResult *result,
577                                               BdrvCheckMode fix)
578 {
579     int ret = qcow2_check_refcounts(bs, result, fix);
580     if (ret < 0) {
581         return ret;
582     }
583 
584     if (fix && result->check_errors == 0 && result->corruptions == 0) {
585         ret = qcow2_mark_clean(bs);
586         if (ret < 0) {
587             return ret;
588         }
589         return qcow2_mark_consistent(bs);
590     }
591     return ret;
592 }
593 
594 static int coroutine_fn qcow2_co_check(BlockDriverState *bs,
595                                        BdrvCheckResult *result,
596                                        BdrvCheckMode fix)
597 {
598     BDRVQcow2State *s = bs->opaque;
599     int ret;
600 
601     qemu_co_mutex_lock(&s->lock);
602     ret = qcow2_co_check_locked(bs, result, fix);
603     qemu_co_mutex_unlock(&s->lock);
604     return ret;
605 }
606 
607 int qcow2_validate_table(BlockDriverState *bs, uint64_t offset,
608                          uint64_t entries, size_t entry_len,
609                          int64_t max_size_bytes, const char *table_name,
610                          Error **errp)
611 {
612     BDRVQcow2State *s = bs->opaque;
613 
614     if (entries > max_size_bytes / entry_len) {
615         error_setg(errp, "%s too large", table_name);
616         return -EFBIG;
617     }
618 
619     /* Use signed INT64_MAX as the maximum even for uint64_t header fields,
620      * because values will be passed to qemu functions taking int64_t. */
621     if ((INT64_MAX - entries * entry_len < offset) ||
622         (offset_into_cluster(s, offset) != 0)) {
623         error_setg(errp, "%s offset invalid", table_name);
624         return -EINVAL;
625     }
626 
627     return 0;
628 }
629 
630 static const char *const mutable_opts[] = {
631     QCOW2_OPT_LAZY_REFCOUNTS,
632     QCOW2_OPT_DISCARD_REQUEST,
633     QCOW2_OPT_DISCARD_SNAPSHOT,
634     QCOW2_OPT_DISCARD_OTHER,
635     QCOW2_OPT_OVERLAP,
636     QCOW2_OPT_OVERLAP_TEMPLATE,
637     QCOW2_OPT_OVERLAP_MAIN_HEADER,
638     QCOW2_OPT_OVERLAP_ACTIVE_L1,
639     QCOW2_OPT_OVERLAP_ACTIVE_L2,
640     QCOW2_OPT_OVERLAP_REFCOUNT_TABLE,
641     QCOW2_OPT_OVERLAP_REFCOUNT_BLOCK,
642     QCOW2_OPT_OVERLAP_SNAPSHOT_TABLE,
643     QCOW2_OPT_OVERLAP_INACTIVE_L1,
644     QCOW2_OPT_OVERLAP_INACTIVE_L2,
645     QCOW2_OPT_OVERLAP_BITMAP_DIRECTORY,
646     QCOW2_OPT_CACHE_SIZE,
647     QCOW2_OPT_L2_CACHE_SIZE,
648     QCOW2_OPT_L2_CACHE_ENTRY_SIZE,
649     QCOW2_OPT_REFCOUNT_CACHE_SIZE,
650     QCOW2_OPT_CACHE_CLEAN_INTERVAL,
651     NULL
652 };
653 
654 static QemuOptsList qcow2_runtime_opts = {
655     .name = "qcow2",
656     .head = QTAILQ_HEAD_INITIALIZER(qcow2_runtime_opts.head),
657     .desc = {
658         {
659             .name = QCOW2_OPT_LAZY_REFCOUNTS,
660             .type = QEMU_OPT_BOOL,
661             .help = "Postpone refcount updates",
662         },
663         {
664             .name = QCOW2_OPT_DISCARD_REQUEST,
665             .type = QEMU_OPT_BOOL,
666             .help = "Pass guest discard requests to the layer below",
667         },
668         {
669             .name = QCOW2_OPT_DISCARD_SNAPSHOT,
670             .type = QEMU_OPT_BOOL,
671             .help = "Generate discard requests when snapshot related space "
672                     "is freed",
673         },
674         {
675             .name = QCOW2_OPT_DISCARD_OTHER,
676             .type = QEMU_OPT_BOOL,
677             .help = "Generate discard requests when other clusters are freed",
678         },
679         {
680             .name = QCOW2_OPT_OVERLAP,
681             .type = QEMU_OPT_STRING,
682             .help = "Selects which overlap checks to perform from a range of "
683                     "templates (none, constant, cached, all)",
684         },
685         {
686             .name = QCOW2_OPT_OVERLAP_TEMPLATE,
687             .type = QEMU_OPT_STRING,
688             .help = "Selects which overlap checks to perform from a range of "
689                     "templates (none, constant, cached, all)",
690         },
691         {
692             .name = QCOW2_OPT_OVERLAP_MAIN_HEADER,
693             .type = QEMU_OPT_BOOL,
694             .help = "Check for unintended writes into the main qcow2 header",
695         },
696         {
697             .name = QCOW2_OPT_OVERLAP_ACTIVE_L1,
698             .type = QEMU_OPT_BOOL,
699             .help = "Check for unintended writes into the active L1 table",
700         },
701         {
702             .name = QCOW2_OPT_OVERLAP_ACTIVE_L2,
703             .type = QEMU_OPT_BOOL,
704             .help = "Check for unintended writes into an active L2 table",
705         },
706         {
707             .name = QCOW2_OPT_OVERLAP_REFCOUNT_TABLE,
708             .type = QEMU_OPT_BOOL,
709             .help = "Check for unintended writes into the refcount table",
710         },
711         {
712             .name = QCOW2_OPT_OVERLAP_REFCOUNT_BLOCK,
713             .type = QEMU_OPT_BOOL,
714             .help = "Check for unintended writes into a refcount block",
715         },
716         {
717             .name = QCOW2_OPT_OVERLAP_SNAPSHOT_TABLE,
718             .type = QEMU_OPT_BOOL,
719             .help = "Check for unintended writes into the snapshot table",
720         },
721         {
722             .name = QCOW2_OPT_OVERLAP_INACTIVE_L1,
723             .type = QEMU_OPT_BOOL,
724             .help = "Check for unintended writes into an inactive L1 table",
725         },
726         {
727             .name = QCOW2_OPT_OVERLAP_INACTIVE_L2,
728             .type = QEMU_OPT_BOOL,
729             .help = "Check for unintended writes into an inactive L2 table",
730         },
731         {
732             .name = QCOW2_OPT_OVERLAP_BITMAP_DIRECTORY,
733             .type = QEMU_OPT_BOOL,
734             .help = "Check for unintended writes into the bitmap directory",
735         },
736         {
737             .name = QCOW2_OPT_CACHE_SIZE,
738             .type = QEMU_OPT_SIZE,
739             .help = "Maximum combined metadata (L2 tables and refcount blocks) "
740                     "cache size",
741         },
742         {
743             .name = QCOW2_OPT_L2_CACHE_SIZE,
744             .type = QEMU_OPT_SIZE,
745             .help = "Maximum L2 table cache size",
746         },
747         {
748             .name = QCOW2_OPT_L2_CACHE_ENTRY_SIZE,
749             .type = QEMU_OPT_SIZE,
750             .help = "Size of each entry in the L2 cache",
751         },
752         {
753             .name = QCOW2_OPT_REFCOUNT_CACHE_SIZE,
754             .type = QEMU_OPT_SIZE,
755             .help = "Maximum refcount block cache size",
756         },
757         {
758             .name = QCOW2_OPT_CACHE_CLEAN_INTERVAL,
759             .type = QEMU_OPT_NUMBER,
760             .help = "Clean unused cache entries after this time (in seconds)",
761         },
762         BLOCK_CRYPTO_OPT_DEF_KEY_SECRET("encrypt.",
763             "ID of secret providing qcow2 AES key or LUKS passphrase"),
764         { /* end of list */ }
765     },
766 };
767 
768 static const char *overlap_bool_option_names[QCOW2_OL_MAX_BITNR] = {
769     [QCOW2_OL_MAIN_HEADER_BITNR]      = QCOW2_OPT_OVERLAP_MAIN_HEADER,
770     [QCOW2_OL_ACTIVE_L1_BITNR]        = QCOW2_OPT_OVERLAP_ACTIVE_L1,
771     [QCOW2_OL_ACTIVE_L2_BITNR]        = QCOW2_OPT_OVERLAP_ACTIVE_L2,
772     [QCOW2_OL_REFCOUNT_TABLE_BITNR]   = QCOW2_OPT_OVERLAP_REFCOUNT_TABLE,
773     [QCOW2_OL_REFCOUNT_BLOCK_BITNR]   = QCOW2_OPT_OVERLAP_REFCOUNT_BLOCK,
774     [QCOW2_OL_SNAPSHOT_TABLE_BITNR]   = QCOW2_OPT_OVERLAP_SNAPSHOT_TABLE,
775     [QCOW2_OL_INACTIVE_L1_BITNR]      = QCOW2_OPT_OVERLAP_INACTIVE_L1,
776     [QCOW2_OL_INACTIVE_L2_BITNR]      = QCOW2_OPT_OVERLAP_INACTIVE_L2,
777     [QCOW2_OL_BITMAP_DIRECTORY_BITNR] = QCOW2_OPT_OVERLAP_BITMAP_DIRECTORY,
778 };
779 
780 static void cache_clean_timer_cb(void *opaque)
781 {
782     BlockDriverState *bs = opaque;
783     BDRVQcow2State *s = bs->opaque;
784     qcow2_cache_clean_unused(s->l2_table_cache);
785     qcow2_cache_clean_unused(s->refcount_block_cache);
786     timer_mod(s->cache_clean_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) +
787               (int64_t) s->cache_clean_interval * 1000);
788 }
789 
790 static void cache_clean_timer_init(BlockDriverState *bs, AioContext *context)
791 {
792     BDRVQcow2State *s = bs->opaque;
793     if (s->cache_clean_interval > 0) {
794         s->cache_clean_timer = aio_timer_new(context, QEMU_CLOCK_VIRTUAL,
795                                              SCALE_MS, cache_clean_timer_cb,
796                                              bs);
797         timer_mod(s->cache_clean_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) +
798                   (int64_t) s->cache_clean_interval * 1000);
799     }
800 }
801 
802 static void cache_clean_timer_del(BlockDriverState *bs)
803 {
804     BDRVQcow2State *s = bs->opaque;
805     if (s->cache_clean_timer) {
806         timer_del(s->cache_clean_timer);
807         timer_free(s->cache_clean_timer);
808         s->cache_clean_timer = NULL;
809     }
810 }
811 
812 static void qcow2_detach_aio_context(BlockDriverState *bs)
813 {
814     cache_clean_timer_del(bs);
815 }
816 
817 static void qcow2_attach_aio_context(BlockDriverState *bs,
818                                      AioContext *new_context)
819 {
820     cache_clean_timer_init(bs, new_context);
821 }
822 
823 static void read_cache_sizes(BlockDriverState *bs, QemuOpts *opts,
824                              uint64_t *l2_cache_size,
825                              uint64_t *l2_cache_entry_size,
826                              uint64_t *refcount_cache_size, Error **errp)
827 {
828     BDRVQcow2State *s = bs->opaque;
829     uint64_t combined_cache_size, l2_cache_max_setting;
830     bool l2_cache_size_set, refcount_cache_size_set, combined_cache_size_set;
831     bool l2_cache_entry_size_set;
832     int min_refcount_cache = MIN_REFCOUNT_CACHE_SIZE * s->cluster_size;
833     uint64_t virtual_disk_size = bs->total_sectors * BDRV_SECTOR_SIZE;
834     uint64_t max_l2_cache = virtual_disk_size / (s->cluster_size / 8);
835 
836     combined_cache_size_set = qemu_opt_get(opts, QCOW2_OPT_CACHE_SIZE);
837     l2_cache_size_set = qemu_opt_get(opts, QCOW2_OPT_L2_CACHE_SIZE);
838     refcount_cache_size_set = qemu_opt_get(opts, QCOW2_OPT_REFCOUNT_CACHE_SIZE);
839     l2_cache_entry_size_set = qemu_opt_get(opts, QCOW2_OPT_L2_CACHE_ENTRY_SIZE);
840 
841     combined_cache_size = qemu_opt_get_size(opts, QCOW2_OPT_CACHE_SIZE, 0);
842     l2_cache_max_setting = qemu_opt_get_size(opts, QCOW2_OPT_L2_CACHE_SIZE,
843                                              DEFAULT_L2_CACHE_MAX_SIZE);
844     *refcount_cache_size = qemu_opt_get_size(opts,
845                                              QCOW2_OPT_REFCOUNT_CACHE_SIZE, 0);
846 
847     *l2_cache_entry_size = qemu_opt_get_size(
848         opts, QCOW2_OPT_L2_CACHE_ENTRY_SIZE, s->cluster_size);
849 
850     *l2_cache_size = MIN(max_l2_cache, l2_cache_max_setting);
851 
852     if (combined_cache_size_set) {
853         if (l2_cache_size_set && refcount_cache_size_set) {
854             error_setg(errp, QCOW2_OPT_CACHE_SIZE ", " QCOW2_OPT_L2_CACHE_SIZE
855                        " and " QCOW2_OPT_REFCOUNT_CACHE_SIZE " may not be set "
856                        "at the same time");
857             return;
858         } else if (l2_cache_size_set &&
859                    (l2_cache_max_setting > combined_cache_size)) {
860             error_setg(errp, QCOW2_OPT_L2_CACHE_SIZE " may not exceed "
861                        QCOW2_OPT_CACHE_SIZE);
862             return;
863         } else if (*refcount_cache_size > combined_cache_size) {
864             error_setg(errp, QCOW2_OPT_REFCOUNT_CACHE_SIZE " may not exceed "
865                        QCOW2_OPT_CACHE_SIZE);
866             return;
867         }
868 
869         if (l2_cache_size_set) {
870             *refcount_cache_size = combined_cache_size - *l2_cache_size;
871         } else if (refcount_cache_size_set) {
872             *l2_cache_size = combined_cache_size - *refcount_cache_size;
873         } else {
874             /* Assign as much memory as possible to the L2 cache, and
875              * use the remainder for the refcount cache */
876             if (combined_cache_size >= max_l2_cache + min_refcount_cache) {
877                 *l2_cache_size = max_l2_cache;
878                 *refcount_cache_size = combined_cache_size - *l2_cache_size;
879             } else {
880                 *refcount_cache_size =
881                     MIN(combined_cache_size, min_refcount_cache);
882                 *l2_cache_size = combined_cache_size - *refcount_cache_size;
883             }
884         }
885     }
886 
887     /*
888      * If the L2 cache is not enough to cover the whole disk then
889      * default to 4KB entries. Smaller entries reduce the cost of
890      * loads and evictions and increase I/O performance.
891      */
892     if (*l2_cache_size < max_l2_cache && !l2_cache_entry_size_set) {
893         *l2_cache_entry_size = MIN(s->cluster_size, 4096);
894     }
895 
896     /* l2_cache_size and refcount_cache_size are ensured to have at least
897      * their minimum values in qcow2_update_options_prepare() */
898 
899     if (*l2_cache_entry_size < (1 << MIN_CLUSTER_BITS) ||
900         *l2_cache_entry_size > s->cluster_size ||
901         !is_power_of_2(*l2_cache_entry_size)) {
902         error_setg(errp, "L2 cache entry size must be a power of two "
903                    "between %d and the cluster size (%d)",
904                    1 << MIN_CLUSTER_BITS, s->cluster_size);
905         return;
906     }
907 }
908 
909 typedef struct Qcow2ReopenState {
910     Qcow2Cache *l2_table_cache;
911     Qcow2Cache *refcount_block_cache;
912     int l2_slice_size; /* Number of entries in a slice of the L2 table */
913     bool use_lazy_refcounts;
914     int overlap_check;
915     bool discard_passthrough[QCOW2_DISCARD_MAX];
916     uint64_t cache_clean_interval;
917     QCryptoBlockOpenOptions *crypto_opts; /* Disk encryption runtime options */
918 } Qcow2ReopenState;
919 
920 static int qcow2_update_options_prepare(BlockDriverState *bs,
921                                         Qcow2ReopenState *r,
922                                         QDict *options, int flags,
923                                         Error **errp)
924 {
925     BDRVQcow2State *s = bs->opaque;
926     QemuOpts *opts = NULL;
927     const char *opt_overlap_check, *opt_overlap_check_template;
928     int overlap_check_template = 0;
929     uint64_t l2_cache_size, l2_cache_entry_size, refcount_cache_size;
930     int i;
931     const char *encryptfmt;
932     QDict *encryptopts = NULL;
933     Error *local_err = NULL;
934     int ret;
935 
936     qdict_extract_subqdict(options, &encryptopts, "encrypt.");
937     encryptfmt = qdict_get_try_str(encryptopts, "format");
938 
939     opts = qemu_opts_create(&qcow2_runtime_opts, NULL, 0, &error_abort);
940     qemu_opts_absorb_qdict(opts, options, &local_err);
941     if (local_err) {
942         error_propagate(errp, local_err);
943         ret = -EINVAL;
944         goto fail;
945     }
946 
947     /* get L2 table/refcount block cache size from command line options */
948     read_cache_sizes(bs, opts, &l2_cache_size, &l2_cache_entry_size,
949                      &refcount_cache_size, &local_err);
950     if (local_err) {
951         error_propagate(errp, local_err);
952         ret = -EINVAL;
953         goto fail;
954     }
955 
956     l2_cache_size /= l2_cache_entry_size;
957     if (l2_cache_size < MIN_L2_CACHE_SIZE) {
958         l2_cache_size = MIN_L2_CACHE_SIZE;
959     }
960     if (l2_cache_size > INT_MAX) {
961         error_setg(errp, "L2 cache size too big");
962         ret = -EINVAL;
963         goto fail;
964     }
965 
966     refcount_cache_size /= s->cluster_size;
967     if (refcount_cache_size < MIN_REFCOUNT_CACHE_SIZE) {
968         refcount_cache_size = MIN_REFCOUNT_CACHE_SIZE;
969     }
970     if (refcount_cache_size > INT_MAX) {
971         error_setg(errp, "Refcount cache size too big");
972         ret = -EINVAL;
973         goto fail;
974     }
975 
976     /* alloc new L2 table/refcount block cache, flush old one */
977     if (s->l2_table_cache) {
978         ret = qcow2_cache_flush(bs, s->l2_table_cache);
979         if (ret) {
980             error_setg_errno(errp, -ret, "Failed to flush the L2 table cache");
981             goto fail;
982         }
983     }
984 
985     if (s->refcount_block_cache) {
986         ret = qcow2_cache_flush(bs, s->refcount_block_cache);
987         if (ret) {
988             error_setg_errno(errp, -ret,
989                              "Failed to flush the refcount block cache");
990             goto fail;
991         }
992     }
993 
994     r->l2_slice_size = l2_cache_entry_size / sizeof(uint64_t);
995     r->l2_table_cache = qcow2_cache_create(bs, l2_cache_size,
996                                            l2_cache_entry_size);
997     r->refcount_block_cache = qcow2_cache_create(bs, refcount_cache_size,
998                                                  s->cluster_size);
999     if (r->l2_table_cache == NULL || r->refcount_block_cache == NULL) {
1000         error_setg(errp, "Could not allocate metadata caches");
1001         ret = -ENOMEM;
1002         goto fail;
1003     }
1004 
1005     /* New interval for cache cleanup timer */
1006     r->cache_clean_interval =
1007         qemu_opt_get_number(opts, QCOW2_OPT_CACHE_CLEAN_INTERVAL,
1008                             DEFAULT_CACHE_CLEAN_INTERVAL);
1009 #ifndef CONFIG_LINUX
1010     if (r->cache_clean_interval != 0) {
1011         error_setg(errp, QCOW2_OPT_CACHE_CLEAN_INTERVAL
1012                    " not supported on this host");
1013         ret = -EINVAL;
1014         goto fail;
1015     }
1016 #endif
1017     if (r->cache_clean_interval > UINT_MAX) {
1018         error_setg(errp, "Cache clean interval too big");
1019         ret = -EINVAL;
1020         goto fail;
1021     }
1022 
1023     /* lazy-refcounts; flush if going from enabled to disabled */
1024     r->use_lazy_refcounts = qemu_opt_get_bool(opts, QCOW2_OPT_LAZY_REFCOUNTS,
1025         (s->compatible_features & QCOW2_COMPAT_LAZY_REFCOUNTS));
1026     if (r->use_lazy_refcounts && s->qcow_version < 3) {
1027         error_setg(errp, "Lazy refcounts require a qcow2 image with at least "
1028                    "qemu 1.1 compatibility level");
1029         ret = -EINVAL;
1030         goto fail;
1031     }
1032 
1033     if (s->use_lazy_refcounts && !r->use_lazy_refcounts) {
1034         ret = qcow2_mark_clean(bs);
1035         if (ret < 0) {
1036             error_setg_errno(errp, -ret, "Failed to disable lazy refcounts");
1037             goto fail;
1038         }
1039     }
1040 
1041     /* Overlap check options */
1042     opt_overlap_check = qemu_opt_get(opts, QCOW2_OPT_OVERLAP);
1043     opt_overlap_check_template = qemu_opt_get(opts, QCOW2_OPT_OVERLAP_TEMPLATE);
1044     if (opt_overlap_check_template && opt_overlap_check &&
1045         strcmp(opt_overlap_check_template, opt_overlap_check))
1046     {
1047         error_setg(errp, "Conflicting values for qcow2 options '"
1048                    QCOW2_OPT_OVERLAP "' ('%s') and '" QCOW2_OPT_OVERLAP_TEMPLATE
1049                    "' ('%s')", opt_overlap_check, opt_overlap_check_template);
1050         ret = -EINVAL;
1051         goto fail;
1052     }
1053     if (!opt_overlap_check) {
1054         opt_overlap_check = opt_overlap_check_template ?: "cached";
1055     }
1056 
1057     if (!strcmp(opt_overlap_check, "none")) {
1058         overlap_check_template = 0;
1059     } else if (!strcmp(opt_overlap_check, "constant")) {
1060         overlap_check_template = QCOW2_OL_CONSTANT;
1061     } else if (!strcmp(opt_overlap_check, "cached")) {
1062         overlap_check_template = QCOW2_OL_CACHED;
1063     } else if (!strcmp(opt_overlap_check, "all")) {
1064         overlap_check_template = QCOW2_OL_ALL;
1065     } else {
1066         error_setg(errp, "Unsupported value '%s' for qcow2 option "
1067                    "'overlap-check'. Allowed are any of the following: "
1068                    "none, constant, cached, all", opt_overlap_check);
1069         ret = -EINVAL;
1070         goto fail;
1071     }
1072 
1073     r->overlap_check = 0;
1074     for (i = 0; i < QCOW2_OL_MAX_BITNR; i++) {
1075         /* overlap-check defines a template bitmask, but every flag may be
1076          * overwritten through the associated boolean option */
1077         r->overlap_check |=
1078             qemu_opt_get_bool(opts, overlap_bool_option_names[i],
1079                               overlap_check_template & (1 << i)) << i;
1080     }
1081 
1082     r->discard_passthrough[QCOW2_DISCARD_NEVER] = false;
1083     r->discard_passthrough[QCOW2_DISCARD_ALWAYS] = true;
1084     r->discard_passthrough[QCOW2_DISCARD_REQUEST] =
1085         qemu_opt_get_bool(opts, QCOW2_OPT_DISCARD_REQUEST,
1086                           flags & BDRV_O_UNMAP);
1087     r->discard_passthrough[QCOW2_DISCARD_SNAPSHOT] =
1088         qemu_opt_get_bool(opts, QCOW2_OPT_DISCARD_SNAPSHOT, true);
1089     r->discard_passthrough[QCOW2_DISCARD_OTHER] =
1090         qemu_opt_get_bool(opts, QCOW2_OPT_DISCARD_OTHER, false);
1091 
1092     switch (s->crypt_method_header) {
1093     case QCOW_CRYPT_NONE:
1094         if (encryptfmt) {
1095             error_setg(errp, "No encryption in image header, but options "
1096                        "specified format '%s'", encryptfmt);
1097             ret = -EINVAL;
1098             goto fail;
1099         }
1100         break;
1101 
1102     case QCOW_CRYPT_AES:
1103         if (encryptfmt && !g_str_equal(encryptfmt, "aes")) {
1104             error_setg(errp,
1105                        "Header reported 'aes' encryption format but "
1106                        "options specify '%s'", encryptfmt);
1107             ret = -EINVAL;
1108             goto fail;
1109         }
1110         qdict_put_str(encryptopts, "format", "qcow");
1111         r->crypto_opts = block_crypto_open_opts_init(encryptopts, errp);
1112         break;
1113 
1114     case QCOW_CRYPT_LUKS:
1115         if (encryptfmt && !g_str_equal(encryptfmt, "luks")) {
1116             error_setg(errp,
1117                        "Header reported 'luks' encryption format but "
1118                        "options specify '%s'", encryptfmt);
1119             ret = -EINVAL;
1120             goto fail;
1121         }
1122         qdict_put_str(encryptopts, "format", "luks");
1123         r->crypto_opts = block_crypto_open_opts_init(encryptopts, errp);
1124         break;
1125 
1126     default:
1127         error_setg(errp, "Unsupported encryption method %d",
1128                    s->crypt_method_header);
1129         break;
1130     }
1131     if (s->crypt_method_header != QCOW_CRYPT_NONE && !r->crypto_opts) {
1132         ret = -EINVAL;
1133         goto fail;
1134     }
1135 
1136     ret = 0;
1137 fail:
1138     qobject_unref(encryptopts);
1139     qemu_opts_del(opts);
1140     opts = NULL;
1141     return ret;
1142 }
1143 
1144 static void qcow2_update_options_commit(BlockDriverState *bs,
1145                                         Qcow2ReopenState *r)
1146 {
1147     BDRVQcow2State *s = bs->opaque;
1148     int i;
1149 
1150     if (s->l2_table_cache) {
1151         qcow2_cache_destroy(s->l2_table_cache);
1152     }
1153     if (s->refcount_block_cache) {
1154         qcow2_cache_destroy(s->refcount_block_cache);
1155     }
1156     s->l2_table_cache = r->l2_table_cache;
1157     s->refcount_block_cache = r->refcount_block_cache;
1158     s->l2_slice_size = r->l2_slice_size;
1159 
1160     s->overlap_check = r->overlap_check;
1161     s->use_lazy_refcounts = r->use_lazy_refcounts;
1162 
1163     for (i = 0; i < QCOW2_DISCARD_MAX; i++) {
1164         s->discard_passthrough[i] = r->discard_passthrough[i];
1165     }
1166 
1167     if (s->cache_clean_interval != r->cache_clean_interval) {
1168         cache_clean_timer_del(bs);
1169         s->cache_clean_interval = r->cache_clean_interval;
1170         cache_clean_timer_init(bs, bdrv_get_aio_context(bs));
1171     }
1172 
1173     qapi_free_QCryptoBlockOpenOptions(s->crypto_opts);
1174     s->crypto_opts = r->crypto_opts;
1175 }
1176 
1177 static void qcow2_update_options_abort(BlockDriverState *bs,
1178                                        Qcow2ReopenState *r)
1179 {
1180     if (r->l2_table_cache) {
1181         qcow2_cache_destroy(r->l2_table_cache);
1182     }
1183     if (r->refcount_block_cache) {
1184         qcow2_cache_destroy(r->refcount_block_cache);
1185     }
1186     qapi_free_QCryptoBlockOpenOptions(r->crypto_opts);
1187 }
1188 
1189 static int qcow2_update_options(BlockDriverState *bs, QDict *options,
1190                                 int flags, Error **errp)
1191 {
1192     Qcow2ReopenState r = {};
1193     int ret;
1194 
1195     ret = qcow2_update_options_prepare(bs, &r, options, flags, errp);
1196     if (ret >= 0) {
1197         qcow2_update_options_commit(bs, &r);
1198     } else {
1199         qcow2_update_options_abort(bs, &r);
1200     }
1201 
1202     return ret;
1203 }
1204 
1205 /* Called with s->lock held.  */
1206 static int coroutine_fn qcow2_do_open(BlockDriverState *bs, QDict *options,
1207                                       int flags, Error **errp)
1208 {
1209     BDRVQcow2State *s = bs->opaque;
1210     unsigned int len, i;
1211     int ret = 0;
1212     QCowHeader header;
1213     Error *local_err = NULL;
1214     uint64_t ext_end;
1215     uint64_t l1_vm_state_index;
1216     bool update_header = false;
1217 
1218     ret = bdrv_pread(bs->file, 0, &header, sizeof(header));
1219     if (ret < 0) {
1220         error_setg_errno(errp, -ret, "Could not read qcow2 header");
1221         goto fail;
1222     }
1223     header.magic = be32_to_cpu(header.magic);
1224     header.version = be32_to_cpu(header.version);
1225     header.backing_file_offset = be64_to_cpu(header.backing_file_offset);
1226     header.backing_file_size = be32_to_cpu(header.backing_file_size);
1227     header.size = be64_to_cpu(header.size);
1228     header.cluster_bits = be32_to_cpu(header.cluster_bits);
1229     header.crypt_method = be32_to_cpu(header.crypt_method);
1230     header.l1_table_offset = be64_to_cpu(header.l1_table_offset);
1231     header.l1_size = be32_to_cpu(header.l1_size);
1232     header.refcount_table_offset = be64_to_cpu(header.refcount_table_offset);
1233     header.refcount_table_clusters =
1234         be32_to_cpu(header.refcount_table_clusters);
1235     header.snapshots_offset = be64_to_cpu(header.snapshots_offset);
1236     header.nb_snapshots = be32_to_cpu(header.nb_snapshots);
1237 
1238     if (header.magic != QCOW_MAGIC) {
1239         error_setg(errp, "Image is not in qcow2 format");
1240         ret = -EINVAL;
1241         goto fail;
1242     }
1243     if (header.version < 2 || header.version > 3) {
1244         error_setg(errp, "Unsupported qcow2 version %" PRIu32, header.version);
1245         ret = -ENOTSUP;
1246         goto fail;
1247     }
1248 
1249     s->qcow_version = header.version;
1250 
1251     /* Initialise cluster size */
1252     if (header.cluster_bits < MIN_CLUSTER_BITS ||
1253         header.cluster_bits > MAX_CLUSTER_BITS) {
1254         error_setg(errp, "Unsupported cluster size: 2^%" PRIu32,
1255                    header.cluster_bits);
1256         ret = -EINVAL;
1257         goto fail;
1258     }
1259 
1260     s->cluster_bits = header.cluster_bits;
1261     s->cluster_size = 1 << s->cluster_bits;
1262     s->cluster_sectors = 1 << (s->cluster_bits - BDRV_SECTOR_BITS);
1263 
1264     /* Initialise version 3 header fields */
1265     if (header.version == 2) {
1266         header.incompatible_features    = 0;
1267         header.compatible_features      = 0;
1268         header.autoclear_features       = 0;
1269         header.refcount_order           = 4;
1270         header.header_length            = 72;
1271     } else {
1272         header.incompatible_features =
1273             be64_to_cpu(header.incompatible_features);
1274         header.compatible_features = be64_to_cpu(header.compatible_features);
1275         header.autoclear_features = be64_to_cpu(header.autoclear_features);
1276         header.refcount_order = be32_to_cpu(header.refcount_order);
1277         header.header_length = be32_to_cpu(header.header_length);
1278 
1279         if (header.header_length < 104) {
1280             error_setg(errp, "qcow2 header too short");
1281             ret = -EINVAL;
1282             goto fail;
1283         }
1284     }
1285 
1286     if (header.header_length > s->cluster_size) {
1287         error_setg(errp, "qcow2 header exceeds cluster size");
1288         ret = -EINVAL;
1289         goto fail;
1290     }
1291 
1292     if (header.header_length > sizeof(header)) {
1293         s->unknown_header_fields_size = header.header_length - sizeof(header);
1294         s->unknown_header_fields = g_malloc(s->unknown_header_fields_size);
1295         ret = bdrv_pread(bs->file, sizeof(header), s->unknown_header_fields,
1296                          s->unknown_header_fields_size);
1297         if (ret < 0) {
1298             error_setg_errno(errp, -ret, "Could not read unknown qcow2 header "
1299                              "fields");
1300             goto fail;
1301         }
1302     }
1303 
1304     if (header.backing_file_offset > s->cluster_size) {
1305         error_setg(errp, "Invalid backing file offset");
1306         ret = -EINVAL;
1307         goto fail;
1308     }
1309 
1310     if (header.backing_file_offset) {
1311         ext_end = header.backing_file_offset;
1312     } else {
1313         ext_end = 1 << header.cluster_bits;
1314     }
1315 
1316     /* Handle feature bits */
1317     s->incompatible_features    = header.incompatible_features;
1318     s->compatible_features      = header.compatible_features;
1319     s->autoclear_features       = header.autoclear_features;
1320 
1321     if (s->incompatible_features & ~QCOW2_INCOMPAT_MASK) {
1322         void *feature_table = NULL;
1323         qcow2_read_extensions(bs, header.header_length, ext_end,
1324                               &feature_table, flags, NULL, NULL);
1325         report_unsupported_feature(errp, feature_table,
1326                                    s->incompatible_features &
1327                                    ~QCOW2_INCOMPAT_MASK);
1328         ret = -ENOTSUP;
1329         g_free(feature_table);
1330         goto fail;
1331     }
1332 
1333     if (s->incompatible_features & QCOW2_INCOMPAT_CORRUPT) {
1334         /* Corrupt images may not be written to unless they are being repaired
1335          */
1336         if ((flags & BDRV_O_RDWR) && !(flags & BDRV_O_CHECK)) {
1337             error_setg(errp, "qcow2: Image is corrupt; cannot be opened "
1338                        "read/write");
1339             ret = -EACCES;
1340             goto fail;
1341         }
1342     }
1343 
1344     /* Check support for various header values */
1345     if (header.refcount_order > 6) {
1346         error_setg(errp, "Reference count entry width too large; may not "
1347                    "exceed 64 bits");
1348         ret = -EINVAL;
1349         goto fail;
1350     }
1351     s->refcount_order = header.refcount_order;
1352     s->refcount_bits = 1 << s->refcount_order;
1353     s->refcount_max = UINT64_C(1) << (s->refcount_bits - 1);
1354     s->refcount_max += s->refcount_max - 1;
1355 
1356     s->crypt_method_header = header.crypt_method;
1357     if (s->crypt_method_header) {
1358         if (bdrv_uses_whitelist() &&
1359             s->crypt_method_header == QCOW_CRYPT_AES) {
1360             error_setg(errp,
1361                        "Use of AES-CBC encrypted qcow2 images is no longer "
1362                        "supported in system emulators");
1363             error_append_hint(errp,
1364                               "You can use 'qemu-img convert' to convert your "
1365                               "image to an alternative supported format, such "
1366                               "as unencrypted qcow2, or raw with the LUKS "
1367                               "format instead.\n");
1368             ret = -ENOSYS;
1369             goto fail;
1370         }
1371 
1372         if (s->crypt_method_header == QCOW_CRYPT_AES) {
1373             s->crypt_physical_offset = false;
1374         } else {
1375             /* Assuming LUKS and any future crypt methods we
1376              * add will all use physical offsets, due to the
1377              * fact that the alternative is insecure...  */
1378             s->crypt_physical_offset = true;
1379         }
1380 
1381         bs->encrypted = true;
1382     }
1383 
1384     s->l2_bits = s->cluster_bits - 3; /* L2 is always one cluster */
1385     s->l2_size = 1 << s->l2_bits;
1386     /* 2^(s->refcount_order - 3) is the refcount width in bytes */
1387     s->refcount_block_bits = s->cluster_bits - (s->refcount_order - 3);
1388     s->refcount_block_size = 1 << s->refcount_block_bits;
1389     bs->total_sectors = header.size / BDRV_SECTOR_SIZE;
1390     s->csize_shift = (62 - (s->cluster_bits - 8));
1391     s->csize_mask = (1 << (s->cluster_bits - 8)) - 1;
1392     s->cluster_offset_mask = (1LL << s->csize_shift) - 1;
1393 
1394     s->refcount_table_offset = header.refcount_table_offset;
1395     s->refcount_table_size =
1396         header.refcount_table_clusters << (s->cluster_bits - 3);
1397 
1398     if (header.refcount_table_clusters == 0 && !(flags & BDRV_O_CHECK)) {
1399         error_setg(errp, "Image does not contain a reference count table");
1400         ret = -EINVAL;
1401         goto fail;
1402     }
1403 
1404     ret = qcow2_validate_table(bs, s->refcount_table_offset,
1405                                header.refcount_table_clusters,
1406                                s->cluster_size, QCOW_MAX_REFTABLE_SIZE,
1407                                "Reference count table", errp);
1408     if (ret < 0) {
1409         goto fail;
1410     }
1411 
1412     /* The total size in bytes of the snapshot table is checked in
1413      * qcow2_read_snapshots() because the size of each snapshot is
1414      * variable and we don't know it yet.
1415      * Here we only check the offset and number of snapshots. */
1416     ret = qcow2_validate_table(bs, header.snapshots_offset,
1417                                header.nb_snapshots,
1418                                sizeof(QCowSnapshotHeader),
1419                                sizeof(QCowSnapshotHeader) * QCOW_MAX_SNAPSHOTS,
1420                                "Snapshot table", errp);
1421     if (ret < 0) {
1422         goto fail;
1423     }
1424 
1425     /* read the level 1 table */
1426     ret = qcow2_validate_table(bs, header.l1_table_offset,
1427                                header.l1_size, sizeof(uint64_t),
1428                                QCOW_MAX_L1_SIZE, "Active L1 table", errp);
1429     if (ret < 0) {
1430         goto fail;
1431     }
1432     s->l1_size = header.l1_size;
1433     s->l1_table_offset = header.l1_table_offset;
1434 
1435     l1_vm_state_index = size_to_l1(s, header.size);
1436     if (l1_vm_state_index > INT_MAX) {
1437         error_setg(errp, "Image is too big");
1438         ret = -EFBIG;
1439         goto fail;
1440     }
1441     s->l1_vm_state_index = l1_vm_state_index;
1442 
1443     /* the L1 table must contain at least enough entries to put
1444        header.size bytes */
1445     if (s->l1_size < s->l1_vm_state_index) {
1446         error_setg(errp, "L1 table is too small");
1447         ret = -EINVAL;
1448         goto fail;
1449     }
1450 
1451     if (s->l1_size > 0) {
1452         s->l1_table = qemu_try_blockalign(bs->file->bs,
1453             ROUND_UP(s->l1_size * sizeof(uint64_t), 512));
1454         if (s->l1_table == NULL) {
1455             error_setg(errp, "Could not allocate L1 table");
1456             ret = -ENOMEM;
1457             goto fail;
1458         }
1459         ret = bdrv_pread(bs->file, s->l1_table_offset, s->l1_table,
1460                          s->l1_size * sizeof(uint64_t));
1461         if (ret < 0) {
1462             error_setg_errno(errp, -ret, "Could not read L1 table");
1463             goto fail;
1464         }
1465         for(i = 0;i < s->l1_size; i++) {
1466             s->l1_table[i] = be64_to_cpu(s->l1_table[i]);
1467         }
1468     }
1469 
1470     /* Parse driver-specific options */
1471     ret = qcow2_update_options(bs, options, flags, errp);
1472     if (ret < 0) {
1473         goto fail;
1474     }
1475 
1476     s->flags = flags;
1477 
1478     ret = qcow2_refcount_init(bs);
1479     if (ret != 0) {
1480         error_setg_errno(errp, -ret, "Could not initialize refcount handling");
1481         goto fail;
1482     }
1483 
1484     QLIST_INIT(&s->cluster_allocs);
1485     QTAILQ_INIT(&s->discards);
1486 
1487     /* read qcow2 extensions */
1488     if (qcow2_read_extensions(bs, header.header_length, ext_end, NULL,
1489                               flags, &update_header, &local_err)) {
1490         error_propagate(errp, local_err);
1491         ret = -EINVAL;
1492         goto fail;
1493     }
1494 
1495     /* Open external data file */
1496     s->data_file = bdrv_open_child(NULL, options, "data-file", bs, &child_file,
1497                                    true, &local_err);
1498     if (local_err) {
1499         error_propagate(errp, local_err);
1500         ret = -EINVAL;
1501         goto fail;
1502     }
1503 
1504     if (s->incompatible_features & QCOW2_INCOMPAT_DATA_FILE) {
1505         if (!s->data_file && s->image_data_file) {
1506             s->data_file = bdrv_open_child(s->image_data_file, options,
1507                                            "data-file", bs, &child_file,
1508                                            false, errp);
1509             if (!s->data_file) {
1510                 ret = -EINVAL;
1511                 goto fail;
1512             }
1513         }
1514         if (!s->data_file) {
1515             error_setg(errp, "'data-file' is required for this image");
1516             ret = -EINVAL;
1517             goto fail;
1518         }
1519     } else {
1520         if (s->data_file) {
1521             error_setg(errp, "'data-file' can only be set for images with an "
1522                              "external data file");
1523             ret = -EINVAL;
1524             goto fail;
1525         }
1526 
1527         s->data_file = bs->file;
1528 
1529         if (data_file_is_raw(bs)) {
1530             error_setg(errp, "data-file-raw requires a data file");
1531             ret = -EINVAL;
1532             goto fail;
1533         }
1534     }
1535 
1536     /* qcow2_read_extension may have set up the crypto context
1537      * if the crypt method needs a header region, some methods
1538      * don't need header extensions, so must check here
1539      */
1540     if (s->crypt_method_header && !s->crypto) {
1541         if (s->crypt_method_header == QCOW_CRYPT_AES) {
1542             unsigned int cflags = 0;
1543             if (flags & BDRV_O_NO_IO) {
1544                 cflags |= QCRYPTO_BLOCK_OPEN_NO_IO;
1545             }
1546             s->crypto = qcrypto_block_open(s->crypto_opts, "encrypt.",
1547                                            NULL, NULL, cflags, 1, errp);
1548             if (!s->crypto) {
1549                 ret = -EINVAL;
1550                 goto fail;
1551             }
1552         } else if (!(flags & BDRV_O_NO_IO)) {
1553             error_setg(errp, "Missing CRYPTO header for crypt method %d",
1554                        s->crypt_method_header);
1555             ret = -EINVAL;
1556             goto fail;
1557         }
1558     }
1559 
1560     /* read the backing file name */
1561     if (header.backing_file_offset != 0) {
1562         len = header.backing_file_size;
1563         if (len > MIN(1023, s->cluster_size - header.backing_file_offset) ||
1564             len >= sizeof(bs->backing_file)) {
1565             error_setg(errp, "Backing file name too long");
1566             ret = -EINVAL;
1567             goto fail;
1568         }
1569         ret = bdrv_pread(bs->file, header.backing_file_offset,
1570                          bs->auto_backing_file, len);
1571         if (ret < 0) {
1572             error_setg_errno(errp, -ret, "Could not read backing file name");
1573             goto fail;
1574         }
1575         bs->auto_backing_file[len] = '\0';
1576         pstrcpy(bs->backing_file, sizeof(bs->backing_file),
1577                 bs->auto_backing_file);
1578         s->image_backing_file = g_strdup(bs->auto_backing_file);
1579     }
1580 
1581     /* Internal snapshots */
1582     s->snapshots_offset = header.snapshots_offset;
1583     s->nb_snapshots = header.nb_snapshots;
1584 
1585     ret = qcow2_read_snapshots(bs);
1586     if (ret < 0) {
1587         error_setg_errno(errp, -ret, "Could not read snapshots");
1588         goto fail;
1589     }
1590 
1591     /* Clear unknown autoclear feature bits */
1592     update_header |= s->autoclear_features & ~QCOW2_AUTOCLEAR_MASK;
1593     update_header =
1594         update_header && !bs->read_only && !(flags & BDRV_O_INACTIVE);
1595     if (update_header) {
1596         s->autoclear_features &= QCOW2_AUTOCLEAR_MASK;
1597     }
1598 
1599     /* == Handle persistent dirty bitmaps ==
1600      *
1601      * We want load dirty bitmaps in three cases:
1602      *
1603      * 1. Normal open of the disk in active mode, not related to invalidation
1604      *    after migration.
1605      *
1606      * 2. Invalidation of the target vm after pre-copy phase of migration, if
1607      *    bitmaps are _not_ migrating through migration channel, i.e.
1608      *    'dirty-bitmaps' capability is disabled.
1609      *
1610      * 3. Invalidation of source vm after failed or canceled migration.
1611      *    This is a very interesting case. There are two possible types of
1612      *    bitmaps:
1613      *
1614      *    A. Stored on inactivation and removed. They should be loaded from the
1615      *       image.
1616      *
1617      *    B. Not stored: not-persistent bitmaps and bitmaps, migrated through
1618      *       the migration channel (with dirty-bitmaps capability).
1619      *
1620      *    On the other hand, there are two possible sub-cases:
1621      *
1622      *    3.1 disk was changed by somebody else while were inactive. In this
1623      *        case all in-RAM dirty bitmaps (both persistent and not) are
1624      *        definitely invalid. And we don't have any method to determine
1625      *        this.
1626      *
1627      *        Simple and safe thing is to just drop all the bitmaps of type B on
1628      *        inactivation. But in this case we lose bitmaps in valid 4.2 case.
1629      *
1630      *        On the other hand, resuming source vm, if disk was already changed
1631      *        is a bad thing anyway: not only bitmaps, the whole vm state is
1632      *        out of sync with disk.
1633      *
1634      *        This means, that user or management tool, who for some reason
1635      *        decided to resume source vm, after disk was already changed by
1636      *        target vm, should at least drop all dirty bitmaps by hand.
1637      *
1638      *        So, we can ignore this case for now, but TODO: "generation"
1639      *        extension for qcow2, to determine, that image was changed after
1640      *        last inactivation. And if it is changed, we will drop (or at least
1641      *        mark as 'invalid' all the bitmaps of type B, both persistent
1642      *        and not).
1643      *
1644      *    3.2 disk was _not_ changed while were inactive. Bitmaps may be saved
1645      *        to disk ('dirty-bitmaps' capability disabled), or not saved
1646      *        ('dirty-bitmaps' capability enabled), but we don't need to care
1647      *        of: let's load bitmaps as always: stored bitmaps will be loaded,
1648      *        and not stored has flag IN_USE=1 in the image and will be skipped
1649      *        on loading.
1650      *
1651      * One remaining possible case when we don't want load bitmaps:
1652      *
1653      * 4. Open disk in inactive mode in target vm (bitmaps are migrating or
1654      *    will be loaded on invalidation, no needs try loading them before)
1655      */
1656 
1657     if (!(bdrv_get_flags(bs) & BDRV_O_INACTIVE)) {
1658         /* It's case 1, 2 or 3.2. Or 3.1 which is BUG in management layer. */
1659         bool header_updated = qcow2_load_dirty_bitmaps(bs, &local_err);
1660 
1661         update_header = update_header && !header_updated;
1662     }
1663     if (local_err != NULL) {
1664         error_propagate(errp, local_err);
1665         ret = -EINVAL;
1666         goto fail;
1667     }
1668 
1669     if (update_header) {
1670         ret = qcow2_update_header(bs);
1671         if (ret < 0) {
1672             error_setg_errno(errp, -ret, "Could not update qcow2 header");
1673             goto fail;
1674         }
1675     }
1676 
1677     bs->supported_zero_flags = header.version >= 3 ? BDRV_REQ_MAY_UNMAP : 0;
1678 
1679     /* Repair image if dirty */
1680     if (!(flags & (BDRV_O_CHECK | BDRV_O_INACTIVE)) && !bs->read_only &&
1681         (s->incompatible_features & QCOW2_INCOMPAT_DIRTY)) {
1682         BdrvCheckResult result = {0};
1683 
1684         ret = qcow2_co_check_locked(bs, &result,
1685                                     BDRV_FIX_ERRORS | BDRV_FIX_LEAKS);
1686         if (ret < 0 || result.check_errors) {
1687             if (ret >= 0) {
1688                 ret = -EIO;
1689             }
1690             error_setg_errno(errp, -ret, "Could not repair dirty image");
1691             goto fail;
1692         }
1693     }
1694 
1695 #ifdef DEBUG_ALLOC
1696     {
1697         BdrvCheckResult result = {0};
1698         qcow2_check_refcounts(bs, &result, 0);
1699     }
1700 #endif
1701 
1702     qemu_co_queue_init(&s->compress_wait_queue);
1703 
1704     return ret;
1705 
1706  fail:
1707     g_free(s->image_data_file);
1708     if (has_data_file(bs)) {
1709         bdrv_unref_child(bs, s->data_file);
1710     }
1711     g_free(s->unknown_header_fields);
1712     cleanup_unknown_header_ext(bs);
1713     qcow2_free_snapshots(bs);
1714     qcow2_refcount_close(bs);
1715     qemu_vfree(s->l1_table);
1716     /* else pre-write overlap checks in cache_destroy may crash */
1717     s->l1_table = NULL;
1718     cache_clean_timer_del(bs);
1719     if (s->l2_table_cache) {
1720         qcow2_cache_destroy(s->l2_table_cache);
1721     }
1722     if (s->refcount_block_cache) {
1723         qcow2_cache_destroy(s->refcount_block_cache);
1724     }
1725     qcrypto_block_free(s->crypto);
1726     qapi_free_QCryptoBlockOpenOptions(s->crypto_opts);
1727     return ret;
1728 }
1729 
1730 typedef struct QCow2OpenCo {
1731     BlockDriverState *bs;
1732     QDict *options;
1733     int flags;
1734     Error **errp;
1735     int ret;
1736 } QCow2OpenCo;
1737 
1738 static void coroutine_fn qcow2_open_entry(void *opaque)
1739 {
1740     QCow2OpenCo *qoc = opaque;
1741     BDRVQcow2State *s = qoc->bs->opaque;
1742 
1743     qemu_co_mutex_lock(&s->lock);
1744     qoc->ret = qcow2_do_open(qoc->bs, qoc->options, qoc->flags, qoc->errp);
1745     qemu_co_mutex_unlock(&s->lock);
1746 }
1747 
1748 static int qcow2_open(BlockDriverState *bs, QDict *options, int flags,
1749                       Error **errp)
1750 {
1751     BDRVQcow2State *s = bs->opaque;
1752     QCow2OpenCo qoc = {
1753         .bs = bs,
1754         .options = options,
1755         .flags = flags,
1756         .errp = errp,
1757         .ret = -EINPROGRESS
1758     };
1759 
1760     bs->file = bdrv_open_child(NULL, options, "file", bs, &child_file,
1761                                false, errp);
1762     if (!bs->file) {
1763         return -EINVAL;
1764     }
1765 
1766     /* Initialise locks */
1767     qemu_co_mutex_init(&s->lock);
1768 
1769     if (qemu_in_coroutine()) {
1770         /* From bdrv_co_create.  */
1771         qcow2_open_entry(&qoc);
1772     } else {
1773         assert(qemu_get_current_aio_context() == qemu_get_aio_context());
1774         qemu_coroutine_enter(qemu_coroutine_create(qcow2_open_entry, &qoc));
1775         BDRV_POLL_WHILE(bs, qoc.ret == -EINPROGRESS);
1776     }
1777     return qoc.ret;
1778 }
1779 
1780 static void qcow2_refresh_limits(BlockDriverState *bs, Error **errp)
1781 {
1782     BDRVQcow2State *s = bs->opaque;
1783 
1784     if (bs->encrypted) {
1785         /* Encryption works on a sector granularity */
1786         bs->bl.request_alignment = qcrypto_block_get_sector_size(s->crypto);
1787     }
1788     bs->bl.pwrite_zeroes_alignment = s->cluster_size;
1789     bs->bl.pdiscard_alignment = s->cluster_size;
1790 }
1791 
1792 static int qcow2_reopen_prepare(BDRVReopenState *state,
1793                                 BlockReopenQueue *queue, Error **errp)
1794 {
1795     Qcow2ReopenState *r;
1796     int ret;
1797 
1798     r = g_new0(Qcow2ReopenState, 1);
1799     state->opaque = r;
1800 
1801     ret = qcow2_update_options_prepare(state->bs, r, state->options,
1802                                        state->flags, errp);
1803     if (ret < 0) {
1804         goto fail;
1805     }
1806 
1807     /* We need to write out any unwritten data if we reopen read-only. */
1808     if ((state->flags & BDRV_O_RDWR) == 0) {
1809         ret = qcow2_reopen_bitmaps_ro(state->bs, errp);
1810         if (ret < 0) {
1811             goto fail;
1812         }
1813 
1814         ret = bdrv_flush(state->bs);
1815         if (ret < 0) {
1816             goto fail;
1817         }
1818 
1819         ret = qcow2_mark_clean(state->bs);
1820         if (ret < 0) {
1821             goto fail;
1822         }
1823     }
1824 
1825     return 0;
1826 
1827 fail:
1828     qcow2_update_options_abort(state->bs, r);
1829     g_free(r);
1830     return ret;
1831 }
1832 
1833 static void qcow2_reopen_commit(BDRVReopenState *state)
1834 {
1835     qcow2_update_options_commit(state->bs, state->opaque);
1836     g_free(state->opaque);
1837 }
1838 
1839 static void qcow2_reopen_abort(BDRVReopenState *state)
1840 {
1841     qcow2_update_options_abort(state->bs, state->opaque);
1842     g_free(state->opaque);
1843 }
1844 
1845 static void qcow2_join_options(QDict *options, QDict *old_options)
1846 {
1847     bool has_new_overlap_template =
1848         qdict_haskey(options, QCOW2_OPT_OVERLAP) ||
1849         qdict_haskey(options, QCOW2_OPT_OVERLAP_TEMPLATE);
1850     bool has_new_total_cache_size =
1851         qdict_haskey(options, QCOW2_OPT_CACHE_SIZE);
1852     bool has_all_cache_options;
1853 
1854     /* New overlap template overrides all old overlap options */
1855     if (has_new_overlap_template) {
1856         qdict_del(old_options, QCOW2_OPT_OVERLAP);
1857         qdict_del(old_options, QCOW2_OPT_OVERLAP_TEMPLATE);
1858         qdict_del(old_options, QCOW2_OPT_OVERLAP_MAIN_HEADER);
1859         qdict_del(old_options, QCOW2_OPT_OVERLAP_ACTIVE_L1);
1860         qdict_del(old_options, QCOW2_OPT_OVERLAP_ACTIVE_L2);
1861         qdict_del(old_options, QCOW2_OPT_OVERLAP_REFCOUNT_TABLE);
1862         qdict_del(old_options, QCOW2_OPT_OVERLAP_REFCOUNT_BLOCK);
1863         qdict_del(old_options, QCOW2_OPT_OVERLAP_SNAPSHOT_TABLE);
1864         qdict_del(old_options, QCOW2_OPT_OVERLAP_INACTIVE_L1);
1865         qdict_del(old_options, QCOW2_OPT_OVERLAP_INACTIVE_L2);
1866     }
1867 
1868     /* New total cache size overrides all old options */
1869     if (qdict_haskey(options, QCOW2_OPT_CACHE_SIZE)) {
1870         qdict_del(old_options, QCOW2_OPT_L2_CACHE_SIZE);
1871         qdict_del(old_options, QCOW2_OPT_REFCOUNT_CACHE_SIZE);
1872     }
1873 
1874     qdict_join(options, old_options, false);
1875 
1876     /*
1877      * If after merging all cache size options are set, an old total size is
1878      * overwritten. Do keep all options, however, if all three are new. The
1879      * resulting error message is what we want to happen.
1880      */
1881     has_all_cache_options =
1882         qdict_haskey(options, QCOW2_OPT_CACHE_SIZE) ||
1883         qdict_haskey(options, QCOW2_OPT_L2_CACHE_SIZE) ||
1884         qdict_haskey(options, QCOW2_OPT_REFCOUNT_CACHE_SIZE);
1885 
1886     if (has_all_cache_options && !has_new_total_cache_size) {
1887         qdict_del(options, QCOW2_OPT_CACHE_SIZE);
1888     }
1889 }
1890 
1891 static int coroutine_fn qcow2_co_block_status(BlockDriverState *bs,
1892                                               bool want_zero,
1893                                               int64_t offset, int64_t count,
1894                                               int64_t *pnum, int64_t *map,
1895                                               BlockDriverState **file)
1896 {
1897     BDRVQcow2State *s = bs->opaque;
1898     uint64_t cluster_offset;
1899     int index_in_cluster, ret;
1900     unsigned int bytes;
1901     int status = 0;
1902 
1903     bytes = MIN(INT_MAX, count);
1904     qemu_co_mutex_lock(&s->lock);
1905     ret = qcow2_get_cluster_offset(bs, offset, &bytes, &cluster_offset);
1906     qemu_co_mutex_unlock(&s->lock);
1907     if (ret < 0) {
1908         return ret;
1909     }
1910 
1911     *pnum = bytes;
1912 
1913     if ((ret == QCOW2_CLUSTER_NORMAL || ret == QCOW2_CLUSTER_ZERO_ALLOC) &&
1914         !s->crypto) {
1915         index_in_cluster = offset & (s->cluster_size - 1);
1916         *map = cluster_offset | index_in_cluster;
1917         *file = s->data_file->bs;
1918         status |= BDRV_BLOCK_OFFSET_VALID;
1919     }
1920     if (ret == QCOW2_CLUSTER_ZERO_PLAIN || ret == QCOW2_CLUSTER_ZERO_ALLOC) {
1921         status |= BDRV_BLOCK_ZERO;
1922     } else if (ret != QCOW2_CLUSTER_UNALLOCATED) {
1923         status |= BDRV_BLOCK_DATA;
1924     }
1925     return status;
1926 }
1927 
1928 static coroutine_fn int qcow2_handle_l2meta(BlockDriverState *bs,
1929                                             QCowL2Meta **pl2meta,
1930                                             bool link_l2)
1931 {
1932     int ret = 0;
1933     QCowL2Meta *l2meta = *pl2meta;
1934 
1935     while (l2meta != NULL) {
1936         QCowL2Meta *next;
1937 
1938         if (link_l2) {
1939             ret = qcow2_alloc_cluster_link_l2(bs, l2meta);
1940             if (ret) {
1941                 goto out;
1942             }
1943         } else {
1944             qcow2_alloc_cluster_abort(bs, l2meta);
1945         }
1946 
1947         /* Take the request off the list of running requests */
1948         if (l2meta->nb_clusters != 0) {
1949             QLIST_REMOVE(l2meta, next_in_flight);
1950         }
1951 
1952         qemu_co_queue_restart_all(&l2meta->dependent_requests);
1953 
1954         next = l2meta->next;
1955         g_free(l2meta);
1956         l2meta = next;
1957     }
1958 out:
1959     *pl2meta = l2meta;
1960     return ret;
1961 }
1962 
1963 static coroutine_fn int qcow2_co_preadv(BlockDriverState *bs, uint64_t offset,
1964                                         uint64_t bytes, QEMUIOVector *qiov,
1965                                         int flags)
1966 {
1967     BDRVQcow2State *s = bs->opaque;
1968     int offset_in_cluster;
1969     int ret;
1970     unsigned int cur_bytes; /* number of bytes in current iteration */
1971     uint64_t cluster_offset = 0;
1972     uint64_t bytes_done = 0;
1973     QEMUIOVector hd_qiov;
1974     uint8_t *cluster_data = NULL;
1975 
1976     qemu_iovec_init(&hd_qiov, qiov->niov);
1977 
1978     qemu_co_mutex_lock(&s->lock);
1979 
1980     while (bytes != 0) {
1981 
1982         /* prepare next request */
1983         cur_bytes = MIN(bytes, INT_MAX);
1984         if (s->crypto) {
1985             cur_bytes = MIN(cur_bytes,
1986                             QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size);
1987         }
1988 
1989         ret = qcow2_get_cluster_offset(bs, offset, &cur_bytes, &cluster_offset);
1990         if (ret < 0) {
1991             goto fail;
1992         }
1993 
1994         offset_in_cluster = offset_into_cluster(s, offset);
1995 
1996         qemu_iovec_reset(&hd_qiov);
1997         qemu_iovec_concat(&hd_qiov, qiov, bytes_done, cur_bytes);
1998 
1999         switch (ret) {
2000         case QCOW2_CLUSTER_UNALLOCATED:
2001 
2002             if (bs->backing) {
2003                 BLKDBG_EVENT(bs->file, BLKDBG_READ_BACKING_AIO);
2004                 qemu_co_mutex_unlock(&s->lock);
2005                 ret = bdrv_co_preadv(bs->backing, offset, cur_bytes,
2006                                      &hd_qiov, 0);
2007                 qemu_co_mutex_lock(&s->lock);
2008                 if (ret < 0) {
2009                     goto fail;
2010                 }
2011             } else {
2012                 /* Note: in this case, no need to wait */
2013                 qemu_iovec_memset(&hd_qiov, 0, 0, cur_bytes);
2014             }
2015             break;
2016 
2017         case QCOW2_CLUSTER_ZERO_PLAIN:
2018         case QCOW2_CLUSTER_ZERO_ALLOC:
2019             qemu_iovec_memset(&hd_qiov, 0, 0, cur_bytes);
2020             break;
2021 
2022         case QCOW2_CLUSTER_COMPRESSED:
2023             qemu_co_mutex_unlock(&s->lock);
2024             ret = qcow2_co_preadv_compressed(bs, cluster_offset,
2025                                              offset, cur_bytes,
2026                                              &hd_qiov);
2027             qemu_co_mutex_lock(&s->lock);
2028             if (ret < 0) {
2029                 goto fail;
2030             }
2031 
2032             break;
2033 
2034         case QCOW2_CLUSTER_NORMAL:
2035             if ((cluster_offset & 511) != 0) {
2036                 ret = -EIO;
2037                 goto fail;
2038             }
2039 
2040             if (bs->encrypted) {
2041                 assert(s->crypto);
2042 
2043                 /*
2044                  * For encrypted images, read everything into a temporary
2045                  * contiguous buffer on which the AES functions can work.
2046                  */
2047                 if (!cluster_data) {
2048                     cluster_data =
2049                         qemu_try_blockalign(s->data_file->bs,
2050                                             QCOW_MAX_CRYPT_CLUSTERS
2051                                             * s->cluster_size);
2052                     if (cluster_data == NULL) {
2053                         ret = -ENOMEM;
2054                         goto fail;
2055                     }
2056                 }
2057 
2058                 assert(cur_bytes <= QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size);
2059                 qemu_iovec_reset(&hd_qiov);
2060                 qemu_iovec_add(&hd_qiov, cluster_data, cur_bytes);
2061             }
2062 
2063             BLKDBG_EVENT(bs->file, BLKDBG_READ_AIO);
2064             qemu_co_mutex_unlock(&s->lock);
2065             ret = bdrv_co_preadv(s->data_file,
2066                                  cluster_offset + offset_in_cluster,
2067                                  cur_bytes, &hd_qiov, 0);
2068             qemu_co_mutex_lock(&s->lock);
2069             if (ret < 0) {
2070                 goto fail;
2071             }
2072             if (bs->encrypted) {
2073                 assert(s->crypto);
2074                 assert((offset & (BDRV_SECTOR_SIZE - 1)) == 0);
2075                 assert((cur_bytes & (BDRV_SECTOR_SIZE - 1)) == 0);
2076                 if (qcrypto_block_decrypt(s->crypto,
2077                                           (s->crypt_physical_offset ?
2078                                            cluster_offset + offset_in_cluster :
2079                                            offset),
2080                                           cluster_data,
2081                                           cur_bytes,
2082                                           NULL) < 0) {
2083                     ret = -EIO;
2084                     goto fail;
2085                 }
2086                 qemu_iovec_from_buf(qiov, bytes_done, cluster_data, cur_bytes);
2087             }
2088             break;
2089 
2090         default:
2091             g_assert_not_reached();
2092             ret = -EIO;
2093             goto fail;
2094         }
2095 
2096         bytes -= cur_bytes;
2097         offset += cur_bytes;
2098         bytes_done += cur_bytes;
2099     }
2100     ret = 0;
2101 
2102 fail:
2103     qemu_co_mutex_unlock(&s->lock);
2104 
2105     qemu_iovec_destroy(&hd_qiov);
2106     qemu_vfree(cluster_data);
2107 
2108     return ret;
2109 }
2110 
2111 /* Check if it's possible to merge a write request with the writing of
2112  * the data from the COW regions */
2113 static bool merge_cow(uint64_t offset, unsigned bytes,
2114                       QEMUIOVector *hd_qiov, QCowL2Meta *l2meta)
2115 {
2116     QCowL2Meta *m;
2117 
2118     for (m = l2meta; m != NULL; m = m->next) {
2119         /* If both COW regions are empty then there's nothing to merge */
2120         if (m->cow_start.nb_bytes == 0 && m->cow_end.nb_bytes == 0) {
2121             continue;
2122         }
2123 
2124         /* The data (middle) region must be immediately after the
2125          * start region */
2126         if (l2meta_cow_start(m) + m->cow_start.nb_bytes != offset) {
2127             continue;
2128         }
2129 
2130         /* The end region must be immediately after the data (middle)
2131          * region */
2132         if (m->offset + m->cow_end.offset != offset + bytes) {
2133             continue;
2134         }
2135 
2136         /* Make sure that adding both COW regions to the QEMUIOVector
2137          * does not exceed IOV_MAX */
2138         if (hd_qiov->niov > IOV_MAX - 2) {
2139             continue;
2140         }
2141 
2142         m->data_qiov = hd_qiov;
2143         return true;
2144     }
2145 
2146     return false;
2147 }
2148 
2149 static coroutine_fn int qcow2_co_pwritev(BlockDriverState *bs, uint64_t offset,
2150                                          uint64_t bytes, QEMUIOVector *qiov,
2151                                          int flags)
2152 {
2153     BDRVQcow2State *s = bs->opaque;
2154     int offset_in_cluster;
2155     int ret;
2156     unsigned int cur_bytes; /* number of sectors in current iteration */
2157     uint64_t cluster_offset;
2158     QEMUIOVector hd_qiov;
2159     uint64_t bytes_done = 0;
2160     uint8_t *cluster_data = NULL;
2161     QCowL2Meta *l2meta = NULL;
2162 
2163     trace_qcow2_writev_start_req(qemu_coroutine_self(), offset, bytes);
2164 
2165     qemu_iovec_init(&hd_qiov, qiov->niov);
2166 
2167     qemu_co_mutex_lock(&s->lock);
2168 
2169     while (bytes != 0) {
2170 
2171         l2meta = NULL;
2172 
2173         trace_qcow2_writev_start_part(qemu_coroutine_self());
2174         offset_in_cluster = offset_into_cluster(s, offset);
2175         cur_bytes = MIN(bytes, INT_MAX);
2176         if (bs->encrypted) {
2177             cur_bytes = MIN(cur_bytes,
2178                             QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size
2179                             - offset_in_cluster);
2180         }
2181 
2182         ret = qcow2_alloc_cluster_offset(bs, offset, &cur_bytes,
2183                                          &cluster_offset, &l2meta);
2184         if (ret < 0) {
2185             goto fail;
2186         }
2187 
2188         assert((cluster_offset & 511) == 0);
2189 
2190         qemu_iovec_reset(&hd_qiov);
2191         qemu_iovec_concat(&hd_qiov, qiov, bytes_done, cur_bytes);
2192 
2193         if (bs->encrypted) {
2194             assert(s->crypto);
2195             if (!cluster_data) {
2196                 cluster_data = qemu_try_blockalign(bs->file->bs,
2197                                                    QCOW_MAX_CRYPT_CLUSTERS
2198                                                    * s->cluster_size);
2199                 if (cluster_data == NULL) {
2200                     ret = -ENOMEM;
2201                     goto fail;
2202                 }
2203             }
2204 
2205             assert(hd_qiov.size <=
2206                    QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size);
2207             qemu_iovec_to_buf(&hd_qiov, 0, cluster_data, hd_qiov.size);
2208 
2209             if (qcrypto_block_encrypt(s->crypto,
2210                                       (s->crypt_physical_offset ?
2211                                        cluster_offset + offset_in_cluster :
2212                                        offset),
2213                                       cluster_data,
2214                                       cur_bytes, NULL) < 0) {
2215                 ret = -EIO;
2216                 goto fail;
2217             }
2218 
2219             qemu_iovec_reset(&hd_qiov);
2220             qemu_iovec_add(&hd_qiov, cluster_data, cur_bytes);
2221         }
2222 
2223         ret = qcow2_pre_write_overlap_check(bs, 0,
2224                 cluster_offset + offset_in_cluster, cur_bytes, true);
2225         if (ret < 0) {
2226             goto fail;
2227         }
2228 
2229         /* If we need to do COW, check if it's possible to merge the
2230          * writing of the guest data together with that of the COW regions.
2231          * If it's not possible (or not necessary) then write the
2232          * guest data now. */
2233         if (!merge_cow(offset, cur_bytes, &hd_qiov, l2meta)) {
2234             qemu_co_mutex_unlock(&s->lock);
2235             BLKDBG_EVENT(bs->file, BLKDBG_WRITE_AIO);
2236             trace_qcow2_writev_data(qemu_coroutine_self(),
2237                                     cluster_offset + offset_in_cluster);
2238             ret = bdrv_co_pwritev(s->data_file,
2239                                   cluster_offset + offset_in_cluster,
2240                                   cur_bytes, &hd_qiov, 0);
2241             qemu_co_mutex_lock(&s->lock);
2242             if (ret < 0) {
2243                 goto fail;
2244             }
2245         }
2246 
2247         ret = qcow2_handle_l2meta(bs, &l2meta, true);
2248         if (ret) {
2249             goto fail;
2250         }
2251 
2252         bytes -= cur_bytes;
2253         offset += cur_bytes;
2254         bytes_done += cur_bytes;
2255         trace_qcow2_writev_done_part(qemu_coroutine_self(), cur_bytes);
2256     }
2257     ret = 0;
2258 
2259 fail:
2260     qcow2_handle_l2meta(bs, &l2meta, false);
2261 
2262     qemu_co_mutex_unlock(&s->lock);
2263 
2264     qemu_iovec_destroy(&hd_qiov);
2265     qemu_vfree(cluster_data);
2266     trace_qcow2_writev_done_req(qemu_coroutine_self(), ret);
2267 
2268     return ret;
2269 }
2270 
2271 static int qcow2_inactivate(BlockDriverState *bs)
2272 {
2273     BDRVQcow2State *s = bs->opaque;
2274     int ret, result = 0;
2275     Error *local_err = NULL;
2276 
2277     qcow2_store_persistent_dirty_bitmaps(bs, &local_err);
2278     if (local_err != NULL) {
2279         result = -EINVAL;
2280         error_reportf_err(local_err, "Lost persistent bitmaps during "
2281                           "inactivation of node '%s': ",
2282                           bdrv_get_device_or_node_name(bs));
2283     }
2284 
2285     ret = qcow2_cache_flush(bs, s->l2_table_cache);
2286     if (ret) {
2287         result = ret;
2288         error_report("Failed to flush the L2 table cache: %s",
2289                      strerror(-ret));
2290     }
2291 
2292     ret = qcow2_cache_flush(bs, s->refcount_block_cache);
2293     if (ret) {
2294         result = ret;
2295         error_report("Failed to flush the refcount block cache: %s",
2296                      strerror(-ret));
2297     }
2298 
2299     if (result == 0) {
2300         qcow2_mark_clean(bs);
2301     }
2302 
2303     return result;
2304 }
2305 
2306 static void qcow2_close(BlockDriverState *bs)
2307 {
2308     BDRVQcow2State *s = bs->opaque;
2309     qemu_vfree(s->l1_table);
2310     /* else pre-write overlap checks in cache_destroy may crash */
2311     s->l1_table = NULL;
2312 
2313     if (!(s->flags & BDRV_O_INACTIVE)) {
2314         qcow2_inactivate(bs);
2315     }
2316 
2317     cache_clean_timer_del(bs);
2318     qcow2_cache_destroy(s->l2_table_cache);
2319     qcow2_cache_destroy(s->refcount_block_cache);
2320 
2321     qcrypto_block_free(s->crypto);
2322     s->crypto = NULL;
2323 
2324     g_free(s->unknown_header_fields);
2325     cleanup_unknown_header_ext(bs);
2326 
2327     g_free(s->image_data_file);
2328     g_free(s->image_backing_file);
2329     g_free(s->image_backing_format);
2330 
2331     if (has_data_file(bs)) {
2332         bdrv_unref_child(bs, s->data_file);
2333     }
2334 
2335     qcow2_refcount_close(bs);
2336     qcow2_free_snapshots(bs);
2337 }
2338 
2339 static void coroutine_fn qcow2_co_invalidate_cache(BlockDriverState *bs,
2340                                                    Error **errp)
2341 {
2342     BDRVQcow2State *s = bs->opaque;
2343     int flags = s->flags;
2344     QCryptoBlock *crypto = NULL;
2345     QDict *options;
2346     Error *local_err = NULL;
2347     int ret;
2348 
2349     /*
2350      * Backing files are read-only which makes all of their metadata immutable,
2351      * that means we don't have to worry about reopening them here.
2352      */
2353 
2354     crypto = s->crypto;
2355     s->crypto = NULL;
2356 
2357     qcow2_close(bs);
2358 
2359     memset(s, 0, sizeof(BDRVQcow2State));
2360     options = qdict_clone_shallow(bs->options);
2361 
2362     flags &= ~BDRV_O_INACTIVE;
2363     qemu_co_mutex_lock(&s->lock);
2364     ret = qcow2_do_open(bs, options, flags, &local_err);
2365     qemu_co_mutex_unlock(&s->lock);
2366     qobject_unref(options);
2367     if (local_err) {
2368         error_propagate_prepend(errp, local_err,
2369                                 "Could not reopen qcow2 layer: ");
2370         bs->drv = NULL;
2371         return;
2372     } else if (ret < 0) {
2373         error_setg_errno(errp, -ret, "Could not reopen qcow2 layer");
2374         bs->drv = NULL;
2375         return;
2376     }
2377 
2378     s->crypto = crypto;
2379 }
2380 
2381 static size_t header_ext_add(char *buf, uint32_t magic, const void *s,
2382     size_t len, size_t buflen)
2383 {
2384     QCowExtension *ext_backing_fmt = (QCowExtension*) buf;
2385     size_t ext_len = sizeof(QCowExtension) + ((len + 7) & ~7);
2386 
2387     if (buflen < ext_len) {
2388         return -ENOSPC;
2389     }
2390 
2391     *ext_backing_fmt = (QCowExtension) {
2392         .magic  = cpu_to_be32(magic),
2393         .len    = cpu_to_be32(len),
2394     };
2395 
2396     if (len) {
2397         memcpy(buf + sizeof(QCowExtension), s, len);
2398     }
2399 
2400     return ext_len;
2401 }
2402 
2403 /*
2404  * Updates the qcow2 header, including the variable length parts of it, i.e.
2405  * the backing file name and all extensions. qcow2 was not designed to allow
2406  * such changes, so if we run out of space (we can only use the first cluster)
2407  * this function may fail.
2408  *
2409  * Returns 0 on success, -errno in error cases.
2410  */
2411 int qcow2_update_header(BlockDriverState *bs)
2412 {
2413     BDRVQcow2State *s = bs->opaque;
2414     QCowHeader *header;
2415     char *buf;
2416     size_t buflen = s->cluster_size;
2417     int ret;
2418     uint64_t total_size;
2419     uint32_t refcount_table_clusters;
2420     size_t header_length;
2421     Qcow2UnknownHeaderExtension *uext;
2422 
2423     buf = qemu_blockalign(bs, buflen);
2424 
2425     /* Header structure */
2426     header = (QCowHeader*) buf;
2427 
2428     if (buflen < sizeof(*header)) {
2429         ret = -ENOSPC;
2430         goto fail;
2431     }
2432 
2433     header_length = sizeof(*header) + s->unknown_header_fields_size;
2434     total_size = bs->total_sectors * BDRV_SECTOR_SIZE;
2435     refcount_table_clusters = s->refcount_table_size >> (s->cluster_bits - 3);
2436 
2437     *header = (QCowHeader) {
2438         /* Version 2 fields */
2439         .magic                  = cpu_to_be32(QCOW_MAGIC),
2440         .version                = cpu_to_be32(s->qcow_version),
2441         .backing_file_offset    = 0,
2442         .backing_file_size      = 0,
2443         .cluster_bits           = cpu_to_be32(s->cluster_bits),
2444         .size                   = cpu_to_be64(total_size),
2445         .crypt_method           = cpu_to_be32(s->crypt_method_header),
2446         .l1_size                = cpu_to_be32(s->l1_size),
2447         .l1_table_offset        = cpu_to_be64(s->l1_table_offset),
2448         .refcount_table_offset  = cpu_to_be64(s->refcount_table_offset),
2449         .refcount_table_clusters = cpu_to_be32(refcount_table_clusters),
2450         .nb_snapshots           = cpu_to_be32(s->nb_snapshots),
2451         .snapshots_offset       = cpu_to_be64(s->snapshots_offset),
2452 
2453         /* Version 3 fields */
2454         .incompatible_features  = cpu_to_be64(s->incompatible_features),
2455         .compatible_features    = cpu_to_be64(s->compatible_features),
2456         .autoclear_features     = cpu_to_be64(s->autoclear_features),
2457         .refcount_order         = cpu_to_be32(s->refcount_order),
2458         .header_length          = cpu_to_be32(header_length),
2459     };
2460 
2461     /* For older versions, write a shorter header */
2462     switch (s->qcow_version) {
2463     case 2:
2464         ret = offsetof(QCowHeader, incompatible_features);
2465         break;
2466     case 3:
2467         ret = sizeof(*header);
2468         break;
2469     default:
2470         ret = -EINVAL;
2471         goto fail;
2472     }
2473 
2474     buf += ret;
2475     buflen -= ret;
2476     memset(buf, 0, buflen);
2477 
2478     /* Preserve any unknown field in the header */
2479     if (s->unknown_header_fields_size) {
2480         if (buflen < s->unknown_header_fields_size) {
2481             ret = -ENOSPC;
2482             goto fail;
2483         }
2484 
2485         memcpy(buf, s->unknown_header_fields, s->unknown_header_fields_size);
2486         buf += s->unknown_header_fields_size;
2487         buflen -= s->unknown_header_fields_size;
2488     }
2489 
2490     /* Backing file format header extension */
2491     if (s->image_backing_format) {
2492         ret = header_ext_add(buf, QCOW2_EXT_MAGIC_BACKING_FORMAT,
2493                              s->image_backing_format,
2494                              strlen(s->image_backing_format),
2495                              buflen);
2496         if (ret < 0) {
2497             goto fail;
2498         }
2499 
2500         buf += ret;
2501         buflen -= ret;
2502     }
2503 
2504     /* External data file header extension */
2505     if (has_data_file(bs) && s->image_data_file) {
2506         ret = header_ext_add(buf, QCOW2_EXT_MAGIC_DATA_FILE,
2507                              s->image_data_file, strlen(s->image_data_file),
2508                              buflen);
2509         if (ret < 0) {
2510             goto fail;
2511         }
2512 
2513         buf += ret;
2514         buflen -= ret;
2515     }
2516 
2517     /* Full disk encryption header pointer extension */
2518     if (s->crypto_header.offset != 0) {
2519         s->crypto_header.offset = cpu_to_be64(s->crypto_header.offset);
2520         s->crypto_header.length = cpu_to_be64(s->crypto_header.length);
2521         ret = header_ext_add(buf, QCOW2_EXT_MAGIC_CRYPTO_HEADER,
2522                              &s->crypto_header, sizeof(s->crypto_header),
2523                              buflen);
2524         s->crypto_header.offset = be64_to_cpu(s->crypto_header.offset);
2525         s->crypto_header.length = be64_to_cpu(s->crypto_header.length);
2526         if (ret < 0) {
2527             goto fail;
2528         }
2529         buf += ret;
2530         buflen -= ret;
2531     }
2532 
2533     /* Feature table */
2534     if (s->qcow_version >= 3) {
2535         Qcow2Feature features[] = {
2536             {
2537                 .type = QCOW2_FEAT_TYPE_INCOMPATIBLE,
2538                 .bit  = QCOW2_INCOMPAT_DIRTY_BITNR,
2539                 .name = "dirty bit",
2540             },
2541             {
2542                 .type = QCOW2_FEAT_TYPE_INCOMPATIBLE,
2543                 .bit  = QCOW2_INCOMPAT_CORRUPT_BITNR,
2544                 .name = "corrupt bit",
2545             },
2546             {
2547                 .type = QCOW2_FEAT_TYPE_INCOMPATIBLE,
2548                 .bit  = QCOW2_INCOMPAT_DATA_FILE_BITNR,
2549                 .name = "external data file",
2550             },
2551             {
2552                 .type = QCOW2_FEAT_TYPE_COMPATIBLE,
2553                 .bit  = QCOW2_COMPAT_LAZY_REFCOUNTS_BITNR,
2554                 .name = "lazy refcounts",
2555             },
2556         };
2557 
2558         ret = header_ext_add(buf, QCOW2_EXT_MAGIC_FEATURE_TABLE,
2559                              features, sizeof(features), buflen);
2560         if (ret < 0) {
2561             goto fail;
2562         }
2563         buf += ret;
2564         buflen -= ret;
2565     }
2566 
2567     /* Bitmap extension */
2568     if (s->nb_bitmaps > 0) {
2569         Qcow2BitmapHeaderExt bitmaps_header = {
2570             .nb_bitmaps = cpu_to_be32(s->nb_bitmaps),
2571             .bitmap_directory_size =
2572                     cpu_to_be64(s->bitmap_directory_size),
2573             .bitmap_directory_offset =
2574                     cpu_to_be64(s->bitmap_directory_offset)
2575         };
2576         ret = header_ext_add(buf, QCOW2_EXT_MAGIC_BITMAPS,
2577                              &bitmaps_header, sizeof(bitmaps_header),
2578                              buflen);
2579         if (ret < 0) {
2580             goto fail;
2581         }
2582         buf += ret;
2583         buflen -= ret;
2584     }
2585 
2586     /* Keep unknown header extensions */
2587     QLIST_FOREACH(uext, &s->unknown_header_ext, next) {
2588         ret = header_ext_add(buf, uext->magic, uext->data, uext->len, buflen);
2589         if (ret < 0) {
2590             goto fail;
2591         }
2592 
2593         buf += ret;
2594         buflen -= ret;
2595     }
2596 
2597     /* End of header extensions */
2598     ret = header_ext_add(buf, QCOW2_EXT_MAGIC_END, NULL, 0, buflen);
2599     if (ret < 0) {
2600         goto fail;
2601     }
2602 
2603     buf += ret;
2604     buflen -= ret;
2605 
2606     /* Backing file name */
2607     if (s->image_backing_file) {
2608         size_t backing_file_len = strlen(s->image_backing_file);
2609 
2610         if (buflen < backing_file_len) {
2611             ret = -ENOSPC;
2612             goto fail;
2613         }
2614 
2615         /* Using strncpy is ok here, since buf is not NUL-terminated. */
2616         strncpy(buf, s->image_backing_file, buflen);
2617 
2618         header->backing_file_offset = cpu_to_be64(buf - ((char*) header));
2619         header->backing_file_size   = cpu_to_be32(backing_file_len);
2620     }
2621 
2622     /* Write the new header */
2623     ret = bdrv_pwrite(bs->file, 0, header, s->cluster_size);
2624     if (ret < 0) {
2625         goto fail;
2626     }
2627 
2628     ret = 0;
2629 fail:
2630     qemu_vfree(header);
2631     return ret;
2632 }
2633 
2634 static int qcow2_change_backing_file(BlockDriverState *bs,
2635     const char *backing_file, const char *backing_fmt)
2636 {
2637     BDRVQcow2State *s = bs->opaque;
2638 
2639     /* Adding a backing file means that the external data file alone won't be
2640      * enough to make sense of the content */
2641     if (backing_file && data_file_is_raw(bs)) {
2642         return -EINVAL;
2643     }
2644 
2645     if (backing_file && strlen(backing_file) > 1023) {
2646         return -EINVAL;
2647     }
2648 
2649     pstrcpy(bs->auto_backing_file, sizeof(bs->auto_backing_file),
2650             backing_file ?: "");
2651     pstrcpy(bs->backing_file, sizeof(bs->backing_file), backing_file ?: "");
2652     pstrcpy(bs->backing_format, sizeof(bs->backing_format), backing_fmt ?: "");
2653 
2654     g_free(s->image_backing_file);
2655     g_free(s->image_backing_format);
2656 
2657     s->image_backing_file = backing_file ? g_strdup(bs->backing_file) : NULL;
2658     s->image_backing_format = backing_fmt ? g_strdup(bs->backing_format) : NULL;
2659 
2660     return qcow2_update_header(bs);
2661 }
2662 
2663 static int qcow2_crypt_method_from_format(const char *encryptfmt)
2664 {
2665     if (g_str_equal(encryptfmt, "luks")) {
2666         return QCOW_CRYPT_LUKS;
2667     } else if (g_str_equal(encryptfmt, "aes")) {
2668         return QCOW_CRYPT_AES;
2669     } else {
2670         return -EINVAL;
2671     }
2672 }
2673 
2674 static int qcow2_set_up_encryption(BlockDriverState *bs,
2675                                    QCryptoBlockCreateOptions *cryptoopts,
2676                                    Error **errp)
2677 {
2678     BDRVQcow2State *s = bs->opaque;
2679     QCryptoBlock *crypto = NULL;
2680     int fmt, ret;
2681 
2682     switch (cryptoopts->format) {
2683     case Q_CRYPTO_BLOCK_FORMAT_LUKS:
2684         fmt = QCOW_CRYPT_LUKS;
2685         break;
2686     case Q_CRYPTO_BLOCK_FORMAT_QCOW:
2687         fmt = QCOW_CRYPT_AES;
2688         break;
2689     default:
2690         error_setg(errp, "Crypto format not supported in qcow2");
2691         return -EINVAL;
2692     }
2693 
2694     s->crypt_method_header = fmt;
2695 
2696     crypto = qcrypto_block_create(cryptoopts, "encrypt.",
2697                                   qcow2_crypto_hdr_init_func,
2698                                   qcow2_crypto_hdr_write_func,
2699                                   bs, errp);
2700     if (!crypto) {
2701         return -EINVAL;
2702     }
2703 
2704     ret = qcow2_update_header(bs);
2705     if (ret < 0) {
2706         error_setg_errno(errp, -ret, "Could not write encryption header");
2707         goto out;
2708     }
2709 
2710     ret = 0;
2711  out:
2712     qcrypto_block_free(crypto);
2713     return ret;
2714 }
2715 
2716 /**
2717  * Preallocates metadata structures for data clusters between @offset (in the
2718  * guest disk) and @new_length (which is thus generally the new guest disk
2719  * size).
2720  *
2721  * Returns: 0 on success, -errno on failure.
2722  */
2723 static int coroutine_fn preallocate_co(BlockDriverState *bs, uint64_t offset,
2724                                        uint64_t new_length, PreallocMode mode,
2725                                        Error **errp)
2726 {
2727     BDRVQcow2State *s = bs->opaque;
2728     uint64_t bytes;
2729     uint64_t host_offset = 0;
2730     int64_t file_length;
2731     unsigned int cur_bytes;
2732     int ret;
2733     QCowL2Meta *meta;
2734 
2735     assert(offset <= new_length);
2736     bytes = new_length - offset;
2737 
2738     while (bytes) {
2739         cur_bytes = MIN(bytes, QEMU_ALIGN_DOWN(INT_MAX, s->cluster_size));
2740         ret = qcow2_alloc_cluster_offset(bs, offset, &cur_bytes,
2741                                          &host_offset, &meta);
2742         if (ret < 0) {
2743             error_setg_errno(errp, -ret, "Allocating clusters failed");
2744             return ret;
2745         }
2746 
2747         while (meta) {
2748             QCowL2Meta *next = meta->next;
2749 
2750             ret = qcow2_alloc_cluster_link_l2(bs, meta);
2751             if (ret < 0) {
2752                 error_setg_errno(errp, -ret, "Mapping clusters failed");
2753                 qcow2_free_any_clusters(bs, meta->alloc_offset,
2754                                         meta->nb_clusters, QCOW2_DISCARD_NEVER);
2755                 return ret;
2756             }
2757 
2758             /* There are no dependent requests, but we need to remove our
2759              * request from the list of in-flight requests */
2760             QLIST_REMOVE(meta, next_in_flight);
2761 
2762             g_free(meta);
2763             meta = next;
2764         }
2765 
2766         /* TODO Preallocate data if requested */
2767 
2768         bytes -= cur_bytes;
2769         offset += cur_bytes;
2770     }
2771 
2772     /*
2773      * It is expected that the image file is large enough to actually contain
2774      * all of the allocated clusters (otherwise we get failing reads after
2775      * EOF). Extend the image to the last allocated sector.
2776      */
2777     file_length = bdrv_getlength(s->data_file->bs);
2778     if (file_length < 0) {
2779         error_setg_errno(errp, -file_length, "Could not get file size");
2780         return file_length;
2781     }
2782 
2783     if (host_offset + cur_bytes > file_length) {
2784         if (mode == PREALLOC_MODE_METADATA) {
2785             mode = PREALLOC_MODE_OFF;
2786         }
2787         ret = bdrv_co_truncate(s->data_file, host_offset + cur_bytes, mode,
2788                                errp);
2789         if (ret < 0) {
2790             return ret;
2791         }
2792     }
2793 
2794     return 0;
2795 }
2796 
2797 /* qcow2_refcount_metadata_size:
2798  * @clusters: number of clusters to refcount (including data and L1/L2 tables)
2799  * @cluster_size: size of a cluster, in bytes
2800  * @refcount_order: refcount bits power-of-2 exponent
2801  * @generous_increase: allow for the refcount table to be 1.5x as large as it
2802  *                     needs to be
2803  *
2804  * Returns: Number of bytes required for refcount blocks and table metadata.
2805  */
2806 int64_t qcow2_refcount_metadata_size(int64_t clusters, size_t cluster_size,
2807                                      int refcount_order, bool generous_increase,
2808                                      uint64_t *refblock_count)
2809 {
2810     /*
2811      * Every host cluster is reference-counted, including metadata (even
2812      * refcount metadata is recursively included).
2813      *
2814      * An accurate formula for the size of refcount metadata size is difficult
2815      * to derive.  An easier method of calculation is finding the fixed point
2816      * where no further refcount blocks or table clusters are required to
2817      * reference count every cluster.
2818      */
2819     int64_t blocks_per_table_cluster = cluster_size / sizeof(uint64_t);
2820     int64_t refcounts_per_block = cluster_size * 8 / (1 << refcount_order);
2821     int64_t table = 0;  /* number of refcount table clusters */
2822     int64_t blocks = 0; /* number of refcount block clusters */
2823     int64_t last;
2824     int64_t n = 0;
2825 
2826     do {
2827         last = n;
2828         blocks = DIV_ROUND_UP(clusters + table + blocks, refcounts_per_block);
2829         table = DIV_ROUND_UP(blocks, blocks_per_table_cluster);
2830         n = clusters + blocks + table;
2831 
2832         if (n == last && generous_increase) {
2833             clusters += DIV_ROUND_UP(table, 2);
2834             n = 0; /* force another loop */
2835             generous_increase = false;
2836         }
2837     } while (n != last);
2838 
2839     if (refblock_count) {
2840         *refblock_count = blocks;
2841     }
2842 
2843     return (blocks + table) * cluster_size;
2844 }
2845 
2846 /**
2847  * qcow2_calc_prealloc_size:
2848  * @total_size: virtual disk size in bytes
2849  * @cluster_size: cluster size in bytes
2850  * @refcount_order: refcount bits power-of-2 exponent
2851  *
2852  * Returns: Total number of bytes required for the fully allocated image
2853  * (including metadata).
2854  */
2855 static int64_t qcow2_calc_prealloc_size(int64_t total_size,
2856                                         size_t cluster_size,
2857                                         int refcount_order)
2858 {
2859     int64_t meta_size = 0;
2860     uint64_t nl1e, nl2e;
2861     int64_t aligned_total_size = ROUND_UP(total_size, cluster_size);
2862 
2863     /* header: 1 cluster */
2864     meta_size += cluster_size;
2865 
2866     /* total size of L2 tables */
2867     nl2e = aligned_total_size / cluster_size;
2868     nl2e = ROUND_UP(nl2e, cluster_size / sizeof(uint64_t));
2869     meta_size += nl2e * sizeof(uint64_t);
2870 
2871     /* total size of L1 tables */
2872     nl1e = nl2e * sizeof(uint64_t) / cluster_size;
2873     nl1e = ROUND_UP(nl1e, cluster_size / sizeof(uint64_t));
2874     meta_size += nl1e * sizeof(uint64_t);
2875 
2876     /* total size of refcount table and blocks */
2877     meta_size += qcow2_refcount_metadata_size(
2878             (meta_size + aligned_total_size) / cluster_size,
2879             cluster_size, refcount_order, false, NULL);
2880 
2881     return meta_size + aligned_total_size;
2882 }
2883 
2884 static bool validate_cluster_size(size_t cluster_size, Error **errp)
2885 {
2886     int cluster_bits = ctz32(cluster_size);
2887     if (cluster_bits < MIN_CLUSTER_BITS || cluster_bits > MAX_CLUSTER_BITS ||
2888         (1 << cluster_bits) != cluster_size)
2889     {
2890         error_setg(errp, "Cluster size must be a power of two between %d and "
2891                    "%dk", 1 << MIN_CLUSTER_BITS, 1 << (MAX_CLUSTER_BITS - 10));
2892         return false;
2893     }
2894     return true;
2895 }
2896 
2897 static size_t qcow2_opt_get_cluster_size_del(QemuOpts *opts, Error **errp)
2898 {
2899     size_t cluster_size;
2900 
2901     cluster_size = qemu_opt_get_size_del(opts, BLOCK_OPT_CLUSTER_SIZE,
2902                                          DEFAULT_CLUSTER_SIZE);
2903     if (!validate_cluster_size(cluster_size, errp)) {
2904         return 0;
2905     }
2906     return cluster_size;
2907 }
2908 
2909 static int qcow2_opt_get_version_del(QemuOpts *opts, Error **errp)
2910 {
2911     char *buf;
2912     int ret;
2913 
2914     buf = qemu_opt_get_del(opts, BLOCK_OPT_COMPAT_LEVEL);
2915     if (!buf) {
2916         ret = 3; /* default */
2917     } else if (!strcmp(buf, "0.10")) {
2918         ret = 2;
2919     } else if (!strcmp(buf, "1.1")) {
2920         ret = 3;
2921     } else {
2922         error_setg(errp, "Invalid compatibility level: '%s'", buf);
2923         ret = -EINVAL;
2924     }
2925     g_free(buf);
2926     return ret;
2927 }
2928 
2929 static uint64_t qcow2_opt_get_refcount_bits_del(QemuOpts *opts, int version,
2930                                                 Error **errp)
2931 {
2932     uint64_t refcount_bits;
2933 
2934     refcount_bits = qemu_opt_get_number_del(opts, BLOCK_OPT_REFCOUNT_BITS, 16);
2935     if (refcount_bits > 64 || !is_power_of_2(refcount_bits)) {
2936         error_setg(errp, "Refcount width must be a power of two and may not "
2937                    "exceed 64 bits");
2938         return 0;
2939     }
2940 
2941     if (version < 3 && refcount_bits != 16) {
2942         error_setg(errp, "Different refcount widths than 16 bits require "
2943                    "compatibility level 1.1 or above (use compat=1.1 or "
2944                    "greater)");
2945         return 0;
2946     }
2947 
2948     return refcount_bits;
2949 }
2950 
2951 static int coroutine_fn
2952 qcow2_co_create(BlockdevCreateOptions *create_options, Error **errp)
2953 {
2954     BlockdevCreateOptionsQcow2 *qcow2_opts;
2955     QDict *options;
2956 
2957     /*
2958      * Open the image file and write a minimal qcow2 header.
2959      *
2960      * We keep things simple and start with a zero-sized image. We also
2961      * do without refcount blocks or a L1 table for now. We'll fix the
2962      * inconsistency later.
2963      *
2964      * We do need a refcount table because growing the refcount table means
2965      * allocating two new refcount blocks - the seconds of which would be at
2966      * 2 GB for 64k clusters, and we don't want to have a 2 GB initial file
2967      * size for any qcow2 image.
2968      */
2969     BlockBackend *blk = NULL;
2970     BlockDriverState *bs = NULL;
2971     BlockDriverState *data_bs = NULL;
2972     QCowHeader *header;
2973     size_t cluster_size;
2974     int version;
2975     int refcount_order;
2976     uint64_t* refcount_table;
2977     Error *local_err = NULL;
2978     int ret;
2979 
2980     assert(create_options->driver == BLOCKDEV_DRIVER_QCOW2);
2981     qcow2_opts = &create_options->u.qcow2;
2982 
2983     bs = bdrv_open_blockdev_ref(qcow2_opts->file, errp);
2984     if (bs == NULL) {
2985         return -EIO;
2986     }
2987 
2988     /* Validate options and set default values */
2989     if (!QEMU_IS_ALIGNED(qcow2_opts->size, BDRV_SECTOR_SIZE)) {
2990         error_setg(errp, "Image size must be a multiple of 512 bytes");
2991         ret = -EINVAL;
2992         goto out;
2993     }
2994 
2995     if (qcow2_opts->has_version) {
2996         switch (qcow2_opts->version) {
2997         case BLOCKDEV_QCOW2_VERSION_V2:
2998             version = 2;
2999             break;
3000         case BLOCKDEV_QCOW2_VERSION_V3:
3001             version = 3;
3002             break;
3003         default:
3004             g_assert_not_reached();
3005         }
3006     } else {
3007         version = 3;
3008     }
3009 
3010     if (qcow2_opts->has_cluster_size) {
3011         cluster_size = qcow2_opts->cluster_size;
3012     } else {
3013         cluster_size = DEFAULT_CLUSTER_SIZE;
3014     }
3015 
3016     if (!validate_cluster_size(cluster_size, errp)) {
3017         ret = -EINVAL;
3018         goto out;
3019     }
3020 
3021     if (!qcow2_opts->has_preallocation) {
3022         qcow2_opts->preallocation = PREALLOC_MODE_OFF;
3023     }
3024     if (qcow2_opts->has_backing_file &&
3025         qcow2_opts->preallocation != PREALLOC_MODE_OFF)
3026     {
3027         error_setg(errp, "Backing file and preallocation cannot be used at "
3028                    "the same time");
3029         ret = -EINVAL;
3030         goto out;
3031     }
3032     if (qcow2_opts->has_backing_fmt && !qcow2_opts->has_backing_file) {
3033         error_setg(errp, "Backing format cannot be used without backing file");
3034         ret = -EINVAL;
3035         goto out;
3036     }
3037 
3038     if (!qcow2_opts->has_lazy_refcounts) {
3039         qcow2_opts->lazy_refcounts = false;
3040     }
3041     if (version < 3 && qcow2_opts->lazy_refcounts) {
3042         error_setg(errp, "Lazy refcounts only supported with compatibility "
3043                    "level 1.1 and above (use version=v3 or greater)");
3044         ret = -EINVAL;
3045         goto out;
3046     }
3047 
3048     if (!qcow2_opts->has_refcount_bits) {
3049         qcow2_opts->refcount_bits = 16;
3050     }
3051     if (qcow2_opts->refcount_bits > 64 ||
3052         !is_power_of_2(qcow2_opts->refcount_bits))
3053     {
3054         error_setg(errp, "Refcount width must be a power of two and may not "
3055                    "exceed 64 bits");
3056         ret = -EINVAL;
3057         goto out;
3058     }
3059     if (version < 3 && qcow2_opts->refcount_bits != 16) {
3060         error_setg(errp, "Different refcount widths than 16 bits require "
3061                    "compatibility level 1.1 or above (use version=v3 or "
3062                    "greater)");
3063         ret = -EINVAL;
3064         goto out;
3065     }
3066     refcount_order = ctz32(qcow2_opts->refcount_bits);
3067 
3068     if (qcow2_opts->data_file_raw && !qcow2_opts->data_file) {
3069         error_setg(errp, "data-file-raw requires data-file");
3070         ret = -EINVAL;
3071         goto out;
3072     }
3073     if (qcow2_opts->data_file_raw && qcow2_opts->has_backing_file) {
3074         error_setg(errp, "Backing file and data-file-raw cannot be used at "
3075                    "the same time");
3076         ret = -EINVAL;
3077         goto out;
3078     }
3079 
3080     if (qcow2_opts->data_file) {
3081         if (version < 3) {
3082             error_setg(errp, "External data files are only supported with "
3083                        "compatibility level 1.1 and above (use version=v3 or "
3084                        "greater)");
3085             ret = -EINVAL;
3086             goto out;
3087         }
3088         data_bs = bdrv_open_blockdev_ref(qcow2_opts->data_file, errp);
3089         if (data_bs == NULL) {
3090             ret = -EIO;
3091             goto out;
3092         }
3093     }
3094 
3095     /* Create BlockBackend to write to the image */
3096     blk = blk_new(BLK_PERM_WRITE | BLK_PERM_RESIZE, BLK_PERM_ALL);
3097     ret = blk_insert_bs(blk, bs, errp);
3098     if (ret < 0) {
3099         goto out;
3100     }
3101     blk_set_allow_write_beyond_eof(blk, true);
3102 
3103     /* Clear the protocol layer and preallocate it if necessary */
3104     ret = blk_truncate(blk, 0, PREALLOC_MODE_OFF, errp);
3105     if (ret < 0) {
3106         goto out;
3107     }
3108 
3109     /* Write the header */
3110     QEMU_BUILD_BUG_ON((1 << MIN_CLUSTER_BITS) < sizeof(*header));
3111     header = g_malloc0(cluster_size);
3112     *header = (QCowHeader) {
3113         .magic                      = cpu_to_be32(QCOW_MAGIC),
3114         .version                    = cpu_to_be32(version),
3115         .cluster_bits               = cpu_to_be32(ctz32(cluster_size)),
3116         .size                       = cpu_to_be64(0),
3117         .l1_table_offset            = cpu_to_be64(0),
3118         .l1_size                    = cpu_to_be32(0),
3119         .refcount_table_offset      = cpu_to_be64(cluster_size),
3120         .refcount_table_clusters    = cpu_to_be32(1),
3121         .refcount_order             = cpu_to_be32(refcount_order),
3122         .header_length              = cpu_to_be32(sizeof(*header)),
3123     };
3124 
3125     /* We'll update this to correct value later */
3126     header->crypt_method = cpu_to_be32(QCOW_CRYPT_NONE);
3127 
3128     if (qcow2_opts->lazy_refcounts) {
3129         header->compatible_features |=
3130             cpu_to_be64(QCOW2_COMPAT_LAZY_REFCOUNTS);
3131     }
3132     if (data_bs) {
3133         header->incompatible_features |=
3134             cpu_to_be64(QCOW2_INCOMPAT_DATA_FILE);
3135     }
3136     if (qcow2_opts->data_file_raw) {
3137         header->autoclear_features |=
3138             cpu_to_be64(QCOW2_AUTOCLEAR_DATA_FILE_RAW);
3139     }
3140 
3141     ret = blk_pwrite(blk, 0, header, cluster_size, 0);
3142     g_free(header);
3143     if (ret < 0) {
3144         error_setg_errno(errp, -ret, "Could not write qcow2 header");
3145         goto out;
3146     }
3147 
3148     /* Write a refcount table with one refcount block */
3149     refcount_table = g_malloc0(2 * cluster_size);
3150     refcount_table[0] = cpu_to_be64(2 * cluster_size);
3151     ret = blk_pwrite(blk, cluster_size, refcount_table, 2 * cluster_size, 0);
3152     g_free(refcount_table);
3153 
3154     if (ret < 0) {
3155         error_setg_errno(errp, -ret, "Could not write refcount table");
3156         goto out;
3157     }
3158 
3159     blk_unref(blk);
3160     blk = NULL;
3161 
3162     /*
3163      * And now open the image and make it consistent first (i.e. increase the
3164      * refcount of the cluster that is occupied by the header and the refcount
3165      * table)
3166      */
3167     options = qdict_new();
3168     qdict_put_str(options, "driver", "qcow2");
3169     qdict_put_str(options, "file", bs->node_name);
3170     if (data_bs) {
3171         qdict_put_str(options, "data-file", data_bs->node_name);
3172     }
3173     blk = blk_new_open(NULL, NULL, options,
3174                        BDRV_O_RDWR | BDRV_O_RESIZE | BDRV_O_NO_FLUSH,
3175                        &local_err);
3176     if (blk == NULL) {
3177         error_propagate(errp, local_err);
3178         ret = -EIO;
3179         goto out;
3180     }
3181 
3182     ret = qcow2_alloc_clusters(blk_bs(blk), 3 * cluster_size);
3183     if (ret < 0) {
3184         error_setg_errno(errp, -ret, "Could not allocate clusters for qcow2 "
3185                          "header and refcount table");
3186         goto out;
3187 
3188     } else if (ret != 0) {
3189         error_report("Huh, first cluster in empty image is already in use?");
3190         abort();
3191     }
3192 
3193     /* Set the external data file if necessary */
3194     if (data_bs) {
3195         BDRVQcow2State *s = blk_bs(blk)->opaque;
3196         s->image_data_file = g_strdup(data_bs->filename);
3197     }
3198 
3199     /* Create a full header (including things like feature table) */
3200     ret = qcow2_update_header(blk_bs(blk));
3201     if (ret < 0) {
3202         error_setg_errno(errp, -ret, "Could not update qcow2 header");
3203         goto out;
3204     }
3205 
3206     /* Okay, now that we have a valid image, let's give it the right size */
3207     ret = blk_truncate(blk, qcow2_opts->size, qcow2_opts->preallocation, errp);
3208     if (ret < 0) {
3209         error_prepend(errp, "Could not resize image: ");
3210         goto out;
3211     }
3212 
3213     /* Want a backing file? There you go.*/
3214     if (qcow2_opts->has_backing_file) {
3215         const char *backing_format = NULL;
3216 
3217         if (qcow2_opts->has_backing_fmt) {
3218             backing_format = BlockdevDriver_str(qcow2_opts->backing_fmt);
3219         }
3220 
3221         ret = bdrv_change_backing_file(blk_bs(blk), qcow2_opts->backing_file,
3222                                        backing_format);
3223         if (ret < 0) {
3224             error_setg_errno(errp, -ret, "Could not assign backing file '%s' "
3225                              "with format '%s'", qcow2_opts->backing_file,
3226                              backing_format);
3227             goto out;
3228         }
3229     }
3230 
3231     /* Want encryption? There you go. */
3232     if (qcow2_opts->has_encrypt) {
3233         ret = qcow2_set_up_encryption(blk_bs(blk), qcow2_opts->encrypt, errp);
3234         if (ret < 0) {
3235             goto out;
3236         }
3237     }
3238 
3239     blk_unref(blk);
3240     blk = NULL;
3241 
3242     /* Reopen the image without BDRV_O_NO_FLUSH to flush it before returning.
3243      * Using BDRV_O_NO_IO, since encryption is now setup we don't want to
3244      * have to setup decryption context. We're not doing any I/O on the top
3245      * level BlockDriverState, only lower layers, where BDRV_O_NO_IO does
3246      * not have effect.
3247      */
3248     options = qdict_new();
3249     qdict_put_str(options, "driver", "qcow2");
3250     qdict_put_str(options, "file", bs->node_name);
3251     if (data_bs) {
3252         qdict_put_str(options, "data-file", data_bs->node_name);
3253     }
3254     blk = blk_new_open(NULL, NULL, options,
3255                        BDRV_O_RDWR | BDRV_O_NO_BACKING | BDRV_O_NO_IO,
3256                        &local_err);
3257     if (blk == NULL) {
3258         error_propagate(errp, local_err);
3259         ret = -EIO;
3260         goto out;
3261     }
3262 
3263     ret = 0;
3264 out:
3265     blk_unref(blk);
3266     bdrv_unref(bs);
3267     bdrv_unref(data_bs);
3268     return ret;
3269 }
3270 
3271 static int coroutine_fn qcow2_co_create_opts(const char *filename, QemuOpts *opts,
3272                                              Error **errp)
3273 {
3274     BlockdevCreateOptions *create_options = NULL;
3275     QDict *qdict;
3276     Visitor *v;
3277     BlockDriverState *bs = NULL;
3278     BlockDriverState *data_bs = NULL;
3279     Error *local_err = NULL;
3280     const char *val;
3281     int ret;
3282 
3283     /* Only the keyval visitor supports the dotted syntax needed for
3284      * encryption, so go through a QDict before getting a QAPI type. Ignore
3285      * options meant for the protocol layer so that the visitor doesn't
3286      * complain. */
3287     qdict = qemu_opts_to_qdict_filtered(opts, NULL, bdrv_qcow2.create_opts,
3288                                         true);
3289 
3290     /* Handle encryption options */
3291     val = qdict_get_try_str(qdict, BLOCK_OPT_ENCRYPT);
3292     if (val && !strcmp(val, "on")) {
3293         qdict_put_str(qdict, BLOCK_OPT_ENCRYPT, "qcow");
3294     } else if (val && !strcmp(val, "off")) {
3295         qdict_del(qdict, BLOCK_OPT_ENCRYPT);
3296     }
3297 
3298     val = qdict_get_try_str(qdict, BLOCK_OPT_ENCRYPT_FORMAT);
3299     if (val && !strcmp(val, "aes")) {
3300         qdict_put_str(qdict, BLOCK_OPT_ENCRYPT_FORMAT, "qcow");
3301     }
3302 
3303     /* Convert compat=0.10/1.1 into compat=v2/v3, to be renamed into
3304      * version=v2/v3 below. */
3305     val = qdict_get_try_str(qdict, BLOCK_OPT_COMPAT_LEVEL);
3306     if (val && !strcmp(val, "0.10")) {
3307         qdict_put_str(qdict, BLOCK_OPT_COMPAT_LEVEL, "v2");
3308     } else if (val && !strcmp(val, "1.1")) {
3309         qdict_put_str(qdict, BLOCK_OPT_COMPAT_LEVEL, "v3");
3310     }
3311 
3312     /* Change legacy command line options into QMP ones */
3313     static const QDictRenames opt_renames[] = {
3314         { BLOCK_OPT_BACKING_FILE,       "backing-file" },
3315         { BLOCK_OPT_BACKING_FMT,        "backing-fmt" },
3316         { BLOCK_OPT_CLUSTER_SIZE,       "cluster-size" },
3317         { BLOCK_OPT_LAZY_REFCOUNTS,     "lazy-refcounts" },
3318         { BLOCK_OPT_REFCOUNT_BITS,      "refcount-bits" },
3319         { BLOCK_OPT_ENCRYPT,            BLOCK_OPT_ENCRYPT_FORMAT },
3320         { BLOCK_OPT_COMPAT_LEVEL,       "version" },
3321         { BLOCK_OPT_DATA_FILE_RAW,      "data-file-raw" },
3322         { NULL, NULL },
3323     };
3324 
3325     if (!qdict_rename_keys(qdict, opt_renames, errp)) {
3326         ret = -EINVAL;
3327         goto finish;
3328     }
3329 
3330     /* Create and open the file (protocol layer) */
3331     ret = bdrv_create_file(filename, opts, errp);
3332     if (ret < 0) {
3333         goto finish;
3334     }
3335 
3336     bs = bdrv_open(filename, NULL, NULL,
3337                    BDRV_O_RDWR | BDRV_O_RESIZE | BDRV_O_PROTOCOL, errp);
3338     if (bs == NULL) {
3339         ret = -EIO;
3340         goto finish;
3341     }
3342 
3343     /* Create and open an external data file (protocol layer) */
3344     val = qdict_get_try_str(qdict, BLOCK_OPT_DATA_FILE);
3345     if (val) {
3346         ret = bdrv_create_file(val, opts, errp);
3347         if (ret < 0) {
3348             goto finish;
3349         }
3350 
3351         data_bs = bdrv_open(val, NULL, NULL,
3352                             BDRV_O_RDWR | BDRV_O_RESIZE | BDRV_O_PROTOCOL,
3353                             errp);
3354         if (data_bs == NULL) {
3355             ret = -EIO;
3356             goto finish;
3357         }
3358 
3359         qdict_del(qdict, BLOCK_OPT_DATA_FILE);
3360         qdict_put_str(qdict, "data-file", data_bs->node_name);
3361     }
3362 
3363     /* Set 'driver' and 'node' options */
3364     qdict_put_str(qdict, "driver", "qcow2");
3365     qdict_put_str(qdict, "file", bs->node_name);
3366 
3367     /* Now get the QAPI type BlockdevCreateOptions */
3368     v = qobject_input_visitor_new_flat_confused(qdict, errp);
3369     if (!v) {
3370         ret = -EINVAL;
3371         goto finish;
3372     }
3373 
3374     visit_type_BlockdevCreateOptions(v, NULL, &create_options, &local_err);
3375     visit_free(v);
3376 
3377     if (local_err) {
3378         error_propagate(errp, local_err);
3379         ret = -EINVAL;
3380         goto finish;
3381     }
3382 
3383     /* Silently round up size */
3384     create_options->u.qcow2.size = ROUND_UP(create_options->u.qcow2.size,
3385                                             BDRV_SECTOR_SIZE);
3386 
3387     /* Create the qcow2 image (format layer) */
3388     ret = qcow2_co_create(create_options, errp);
3389     if (ret < 0) {
3390         goto finish;
3391     }
3392 
3393     ret = 0;
3394 finish:
3395     qobject_unref(qdict);
3396     bdrv_unref(bs);
3397     bdrv_unref(data_bs);
3398     qapi_free_BlockdevCreateOptions(create_options);
3399     return ret;
3400 }
3401 
3402 
3403 static bool is_zero(BlockDriverState *bs, int64_t offset, int64_t bytes)
3404 {
3405     int64_t nr;
3406     int res;
3407 
3408     /* Clamp to image length, before checking status of underlying sectors */
3409     if (offset + bytes > bs->total_sectors * BDRV_SECTOR_SIZE) {
3410         bytes = bs->total_sectors * BDRV_SECTOR_SIZE - offset;
3411     }
3412 
3413     if (!bytes) {
3414         return true;
3415     }
3416     res = bdrv_block_status_above(bs, NULL, offset, bytes, &nr, NULL, NULL);
3417     return res >= 0 && (res & BDRV_BLOCK_ZERO) && nr == bytes;
3418 }
3419 
3420 static coroutine_fn int qcow2_co_pwrite_zeroes(BlockDriverState *bs,
3421     int64_t offset, int bytes, BdrvRequestFlags flags)
3422 {
3423     int ret;
3424     BDRVQcow2State *s = bs->opaque;
3425 
3426     uint32_t head = offset % s->cluster_size;
3427     uint32_t tail = (offset + bytes) % s->cluster_size;
3428 
3429     trace_qcow2_pwrite_zeroes_start_req(qemu_coroutine_self(), offset, bytes);
3430     if (offset + bytes == bs->total_sectors * BDRV_SECTOR_SIZE) {
3431         tail = 0;
3432     }
3433 
3434     if (head || tail) {
3435         uint64_t off;
3436         unsigned int nr;
3437 
3438         assert(head + bytes <= s->cluster_size);
3439 
3440         /* check whether remainder of cluster already reads as zero */
3441         if (!(is_zero(bs, offset - head, head) &&
3442               is_zero(bs, offset + bytes,
3443                       tail ? s->cluster_size - tail : 0))) {
3444             return -ENOTSUP;
3445         }
3446 
3447         qemu_co_mutex_lock(&s->lock);
3448         /* We can have new write after previous check */
3449         offset = QEMU_ALIGN_DOWN(offset, s->cluster_size);
3450         bytes = s->cluster_size;
3451         nr = s->cluster_size;
3452         ret = qcow2_get_cluster_offset(bs, offset, &nr, &off);
3453         if (ret != QCOW2_CLUSTER_UNALLOCATED &&
3454             ret != QCOW2_CLUSTER_ZERO_PLAIN &&
3455             ret != QCOW2_CLUSTER_ZERO_ALLOC) {
3456             qemu_co_mutex_unlock(&s->lock);
3457             return -ENOTSUP;
3458         }
3459     } else {
3460         qemu_co_mutex_lock(&s->lock);
3461     }
3462 
3463     trace_qcow2_pwrite_zeroes(qemu_coroutine_self(), offset, bytes);
3464 
3465     /* Whatever is left can use real zero clusters */
3466     ret = qcow2_cluster_zeroize(bs, offset, bytes, flags);
3467     qemu_co_mutex_unlock(&s->lock);
3468 
3469     return ret;
3470 }
3471 
3472 static coroutine_fn int qcow2_co_pdiscard(BlockDriverState *bs,
3473                                           int64_t offset, int bytes)
3474 {
3475     int ret;
3476     BDRVQcow2State *s = bs->opaque;
3477 
3478     if (!QEMU_IS_ALIGNED(offset | bytes, s->cluster_size)) {
3479         assert(bytes < s->cluster_size);
3480         /* Ignore partial clusters, except for the special case of the
3481          * complete partial cluster at the end of an unaligned file */
3482         if (!QEMU_IS_ALIGNED(offset, s->cluster_size) ||
3483             offset + bytes != bs->total_sectors * BDRV_SECTOR_SIZE) {
3484             return -ENOTSUP;
3485         }
3486     }
3487 
3488     qemu_co_mutex_lock(&s->lock);
3489     ret = qcow2_cluster_discard(bs, offset, bytes, QCOW2_DISCARD_REQUEST,
3490                                 false);
3491     qemu_co_mutex_unlock(&s->lock);
3492     return ret;
3493 }
3494 
3495 static int coroutine_fn
3496 qcow2_co_copy_range_from(BlockDriverState *bs,
3497                          BdrvChild *src, uint64_t src_offset,
3498                          BdrvChild *dst, uint64_t dst_offset,
3499                          uint64_t bytes, BdrvRequestFlags read_flags,
3500                          BdrvRequestFlags write_flags)
3501 {
3502     BDRVQcow2State *s = bs->opaque;
3503     int ret;
3504     unsigned int cur_bytes; /* number of bytes in current iteration */
3505     BdrvChild *child = NULL;
3506     BdrvRequestFlags cur_write_flags;
3507 
3508     assert(!bs->encrypted);
3509     qemu_co_mutex_lock(&s->lock);
3510 
3511     while (bytes != 0) {
3512         uint64_t copy_offset = 0;
3513         /* prepare next request */
3514         cur_bytes = MIN(bytes, INT_MAX);
3515         cur_write_flags = write_flags;
3516 
3517         ret = qcow2_get_cluster_offset(bs, src_offset, &cur_bytes, &copy_offset);
3518         if (ret < 0) {
3519             goto out;
3520         }
3521 
3522         switch (ret) {
3523         case QCOW2_CLUSTER_UNALLOCATED:
3524             if (bs->backing && bs->backing->bs) {
3525                 int64_t backing_length = bdrv_getlength(bs->backing->bs);
3526                 if (src_offset >= backing_length) {
3527                     cur_write_flags |= BDRV_REQ_ZERO_WRITE;
3528                 } else {
3529                     child = bs->backing;
3530                     cur_bytes = MIN(cur_bytes, backing_length - src_offset);
3531                     copy_offset = src_offset;
3532                 }
3533             } else {
3534                 cur_write_flags |= BDRV_REQ_ZERO_WRITE;
3535             }
3536             break;
3537 
3538         case QCOW2_CLUSTER_ZERO_PLAIN:
3539         case QCOW2_CLUSTER_ZERO_ALLOC:
3540             cur_write_flags |= BDRV_REQ_ZERO_WRITE;
3541             break;
3542 
3543         case QCOW2_CLUSTER_COMPRESSED:
3544             ret = -ENOTSUP;
3545             goto out;
3546 
3547         case QCOW2_CLUSTER_NORMAL:
3548             child = s->data_file;
3549             copy_offset += offset_into_cluster(s, src_offset);
3550             if ((copy_offset & 511) != 0) {
3551                 ret = -EIO;
3552                 goto out;
3553             }
3554             break;
3555 
3556         default:
3557             abort();
3558         }
3559         qemu_co_mutex_unlock(&s->lock);
3560         ret = bdrv_co_copy_range_from(child,
3561                                       copy_offset,
3562                                       dst, dst_offset,
3563                                       cur_bytes, read_flags, cur_write_flags);
3564         qemu_co_mutex_lock(&s->lock);
3565         if (ret < 0) {
3566             goto out;
3567         }
3568 
3569         bytes -= cur_bytes;
3570         src_offset += cur_bytes;
3571         dst_offset += cur_bytes;
3572     }
3573     ret = 0;
3574 
3575 out:
3576     qemu_co_mutex_unlock(&s->lock);
3577     return ret;
3578 }
3579 
3580 static int coroutine_fn
3581 qcow2_co_copy_range_to(BlockDriverState *bs,
3582                        BdrvChild *src, uint64_t src_offset,
3583                        BdrvChild *dst, uint64_t dst_offset,
3584                        uint64_t bytes, BdrvRequestFlags read_flags,
3585                        BdrvRequestFlags write_flags)
3586 {
3587     BDRVQcow2State *s = bs->opaque;
3588     int offset_in_cluster;
3589     int ret;
3590     unsigned int cur_bytes; /* number of sectors in current iteration */
3591     uint64_t cluster_offset;
3592     QCowL2Meta *l2meta = NULL;
3593 
3594     assert(!bs->encrypted);
3595 
3596     qemu_co_mutex_lock(&s->lock);
3597 
3598     while (bytes != 0) {
3599 
3600         l2meta = NULL;
3601 
3602         offset_in_cluster = offset_into_cluster(s, dst_offset);
3603         cur_bytes = MIN(bytes, INT_MAX);
3604 
3605         /* TODO:
3606          * If src->bs == dst->bs, we could simply copy by incrementing
3607          * the refcnt, without copying user data.
3608          * Or if src->bs == dst->bs->backing->bs, we could copy by discarding. */
3609         ret = qcow2_alloc_cluster_offset(bs, dst_offset, &cur_bytes,
3610                                          &cluster_offset, &l2meta);
3611         if (ret < 0) {
3612             goto fail;
3613         }
3614 
3615         assert((cluster_offset & 511) == 0);
3616 
3617         ret = qcow2_pre_write_overlap_check(bs, 0,
3618                 cluster_offset + offset_in_cluster, cur_bytes, true);
3619         if (ret < 0) {
3620             goto fail;
3621         }
3622 
3623         qemu_co_mutex_unlock(&s->lock);
3624         ret = bdrv_co_copy_range_to(src, src_offset,
3625                                     s->data_file,
3626                                     cluster_offset + offset_in_cluster,
3627                                     cur_bytes, read_flags, write_flags);
3628         qemu_co_mutex_lock(&s->lock);
3629         if (ret < 0) {
3630             goto fail;
3631         }
3632 
3633         ret = qcow2_handle_l2meta(bs, &l2meta, true);
3634         if (ret) {
3635             goto fail;
3636         }
3637 
3638         bytes -= cur_bytes;
3639         src_offset += cur_bytes;
3640         dst_offset += cur_bytes;
3641     }
3642     ret = 0;
3643 
3644 fail:
3645     qcow2_handle_l2meta(bs, &l2meta, false);
3646 
3647     qemu_co_mutex_unlock(&s->lock);
3648 
3649     trace_qcow2_writev_done_req(qemu_coroutine_self(), ret);
3650 
3651     return ret;
3652 }
3653 
3654 static int coroutine_fn qcow2_co_truncate(BlockDriverState *bs, int64_t offset,
3655                                           PreallocMode prealloc, Error **errp)
3656 {
3657     BDRVQcow2State *s = bs->opaque;
3658     uint64_t old_length;
3659     int64_t new_l1_size;
3660     int ret;
3661     QDict *options;
3662 
3663     if (prealloc != PREALLOC_MODE_OFF && prealloc != PREALLOC_MODE_METADATA &&
3664         prealloc != PREALLOC_MODE_FALLOC && prealloc != PREALLOC_MODE_FULL)
3665     {
3666         error_setg(errp, "Unsupported preallocation mode '%s'",
3667                    PreallocMode_str(prealloc));
3668         return -ENOTSUP;
3669     }
3670 
3671     if (offset & 511) {
3672         error_setg(errp, "The new size must be a multiple of 512");
3673         return -EINVAL;
3674     }
3675 
3676     qemu_co_mutex_lock(&s->lock);
3677 
3678     /* cannot proceed if image has snapshots */
3679     if (s->nb_snapshots) {
3680         error_setg(errp, "Can't resize an image which has snapshots");
3681         ret = -ENOTSUP;
3682         goto fail;
3683     }
3684 
3685     /* cannot proceed if image has bitmaps */
3686     if (qcow2_truncate_bitmaps_check(bs, errp)) {
3687         ret = -ENOTSUP;
3688         goto fail;
3689     }
3690 
3691     old_length = bs->total_sectors * BDRV_SECTOR_SIZE;
3692     new_l1_size = size_to_l1(s, offset);
3693 
3694     if (offset < old_length) {
3695         int64_t last_cluster, old_file_size;
3696         if (prealloc != PREALLOC_MODE_OFF) {
3697             error_setg(errp,
3698                        "Preallocation can't be used for shrinking an image");
3699             ret = -EINVAL;
3700             goto fail;
3701         }
3702 
3703         ret = qcow2_cluster_discard(bs, ROUND_UP(offset, s->cluster_size),
3704                                     old_length - ROUND_UP(offset,
3705                                                           s->cluster_size),
3706                                     QCOW2_DISCARD_ALWAYS, true);
3707         if (ret < 0) {
3708             error_setg_errno(errp, -ret, "Failed to discard cropped clusters");
3709             goto fail;
3710         }
3711 
3712         ret = qcow2_shrink_l1_table(bs, new_l1_size);
3713         if (ret < 0) {
3714             error_setg_errno(errp, -ret,
3715                              "Failed to reduce the number of L2 tables");
3716             goto fail;
3717         }
3718 
3719         ret = qcow2_shrink_reftable(bs);
3720         if (ret < 0) {
3721             error_setg_errno(errp, -ret,
3722                              "Failed to discard unused refblocks");
3723             goto fail;
3724         }
3725 
3726         old_file_size = bdrv_getlength(bs->file->bs);
3727         if (old_file_size < 0) {
3728             error_setg_errno(errp, -old_file_size,
3729                              "Failed to inquire current file length");
3730             ret = old_file_size;
3731             goto fail;
3732         }
3733         last_cluster = qcow2_get_last_cluster(bs, old_file_size);
3734         if (last_cluster < 0) {
3735             error_setg_errno(errp, -last_cluster,
3736                              "Failed to find the last cluster");
3737             ret = last_cluster;
3738             goto fail;
3739         }
3740         if ((last_cluster + 1) * s->cluster_size < old_file_size) {
3741             Error *local_err = NULL;
3742 
3743             bdrv_co_truncate(bs->file, (last_cluster + 1) * s->cluster_size,
3744                              PREALLOC_MODE_OFF, &local_err);
3745             if (local_err) {
3746                 warn_reportf_err(local_err,
3747                                  "Failed to truncate the tail of the image: ");
3748             }
3749         }
3750     } else {
3751         ret = qcow2_grow_l1_table(bs, new_l1_size, true);
3752         if (ret < 0) {
3753             error_setg_errno(errp, -ret, "Failed to grow the L1 table");
3754             goto fail;
3755         }
3756     }
3757 
3758     switch (prealloc) {
3759     case PREALLOC_MODE_OFF:
3760         if (has_data_file(bs)) {
3761             ret = bdrv_co_truncate(s->data_file, offset, prealloc, errp);
3762             if (ret < 0) {
3763                 goto fail;
3764             }
3765         }
3766         break;
3767 
3768     case PREALLOC_MODE_METADATA:
3769         ret = preallocate_co(bs, old_length, offset, prealloc, errp);
3770         if (ret < 0) {
3771             goto fail;
3772         }
3773         break;
3774 
3775     case PREALLOC_MODE_FALLOC:
3776     case PREALLOC_MODE_FULL:
3777     {
3778         int64_t allocation_start, host_offset, guest_offset;
3779         int64_t clusters_allocated;
3780         int64_t old_file_size, new_file_size;
3781         uint64_t nb_new_data_clusters, nb_new_l2_tables;
3782 
3783         /* With a data file, preallocation means just allocating the metadata
3784          * and forwarding the truncate request to the data file */
3785         if (has_data_file(bs)) {
3786             ret = preallocate_co(bs, old_length, offset, prealloc, errp);
3787             if (ret < 0) {
3788                 goto fail;
3789             }
3790             break;
3791         }
3792 
3793         old_file_size = bdrv_getlength(bs->file->bs);
3794         if (old_file_size < 0) {
3795             error_setg_errno(errp, -old_file_size,
3796                              "Failed to inquire current file length");
3797             ret = old_file_size;
3798             goto fail;
3799         }
3800         old_file_size = ROUND_UP(old_file_size, s->cluster_size);
3801 
3802         nb_new_data_clusters = DIV_ROUND_UP(offset - old_length,
3803                                             s->cluster_size);
3804 
3805         /* This is an overestimation; we will not actually allocate space for
3806          * these in the file but just make sure the new refcount structures are
3807          * able to cover them so we will not have to allocate new refblocks
3808          * while entering the data blocks in the potentially new L2 tables.
3809          * (We do not actually care where the L2 tables are placed. Maybe they
3810          *  are already allocated or they can be placed somewhere before
3811          *  @old_file_size. It does not matter because they will be fully
3812          *  allocated automatically, so they do not need to be covered by the
3813          *  preallocation. All that matters is that we will not have to allocate
3814          *  new refcount structures for them.) */
3815         nb_new_l2_tables = DIV_ROUND_UP(nb_new_data_clusters,
3816                                         s->cluster_size / sizeof(uint64_t));
3817         /* The cluster range may not be aligned to L2 boundaries, so add one L2
3818          * table for a potential head/tail */
3819         nb_new_l2_tables++;
3820 
3821         allocation_start = qcow2_refcount_area(bs, old_file_size,
3822                                                nb_new_data_clusters +
3823                                                nb_new_l2_tables,
3824                                                true, 0, 0);
3825         if (allocation_start < 0) {
3826             error_setg_errno(errp, -allocation_start,
3827                              "Failed to resize refcount structures");
3828             ret = allocation_start;
3829             goto fail;
3830         }
3831 
3832         clusters_allocated = qcow2_alloc_clusters_at(bs, allocation_start,
3833                                                      nb_new_data_clusters);
3834         if (clusters_allocated < 0) {
3835             error_setg_errno(errp, -clusters_allocated,
3836                              "Failed to allocate data clusters");
3837             ret = clusters_allocated;
3838             goto fail;
3839         }
3840 
3841         assert(clusters_allocated == nb_new_data_clusters);
3842 
3843         /* Allocate the data area */
3844         new_file_size = allocation_start +
3845                         nb_new_data_clusters * s->cluster_size;
3846         ret = bdrv_co_truncate(bs->file, new_file_size, prealloc, errp);
3847         if (ret < 0) {
3848             error_prepend(errp, "Failed to resize underlying file: ");
3849             qcow2_free_clusters(bs, allocation_start,
3850                                 nb_new_data_clusters * s->cluster_size,
3851                                 QCOW2_DISCARD_OTHER);
3852             goto fail;
3853         }
3854 
3855         /* Create the necessary L2 entries */
3856         host_offset = allocation_start;
3857         guest_offset = old_length;
3858         while (nb_new_data_clusters) {
3859             int64_t nb_clusters = MIN(
3860                 nb_new_data_clusters,
3861                 s->l2_slice_size - offset_to_l2_slice_index(s, guest_offset));
3862             QCowL2Meta allocation = {
3863                 .offset       = guest_offset,
3864                 .alloc_offset = host_offset,
3865                 .nb_clusters  = nb_clusters,
3866             };
3867             qemu_co_queue_init(&allocation.dependent_requests);
3868 
3869             ret = qcow2_alloc_cluster_link_l2(bs, &allocation);
3870             if (ret < 0) {
3871                 error_setg_errno(errp, -ret, "Failed to update L2 tables");
3872                 qcow2_free_clusters(bs, host_offset,
3873                                     nb_new_data_clusters * s->cluster_size,
3874                                     QCOW2_DISCARD_OTHER);
3875                 goto fail;
3876             }
3877 
3878             guest_offset += nb_clusters * s->cluster_size;
3879             host_offset += nb_clusters * s->cluster_size;
3880             nb_new_data_clusters -= nb_clusters;
3881         }
3882         break;
3883     }
3884 
3885     default:
3886         g_assert_not_reached();
3887     }
3888 
3889     if (prealloc != PREALLOC_MODE_OFF) {
3890         /* Flush metadata before actually changing the image size */
3891         ret = qcow2_write_caches(bs);
3892         if (ret < 0) {
3893             error_setg_errno(errp, -ret,
3894                              "Failed to flush the preallocated area to disk");
3895             goto fail;
3896         }
3897     }
3898 
3899     bs->total_sectors = offset / BDRV_SECTOR_SIZE;
3900 
3901     /* write updated header.size */
3902     offset = cpu_to_be64(offset);
3903     ret = bdrv_pwrite_sync(bs->file, offsetof(QCowHeader, size),
3904                            &offset, sizeof(uint64_t));
3905     if (ret < 0) {
3906         error_setg_errno(errp, -ret, "Failed to update the image size");
3907         goto fail;
3908     }
3909 
3910     s->l1_vm_state_index = new_l1_size;
3911 
3912     /* Update cache sizes */
3913     options = qdict_clone_shallow(bs->options);
3914     ret = qcow2_update_options(bs, options, s->flags, errp);
3915     qobject_unref(options);
3916     if (ret < 0) {
3917         goto fail;
3918     }
3919     ret = 0;
3920 fail:
3921     qemu_co_mutex_unlock(&s->lock);
3922     return ret;
3923 }
3924 
3925 /*
3926  * qcow2_compress()
3927  *
3928  * @dest - destination buffer, @dest_size bytes
3929  * @src - source buffer, @src_size bytes
3930  *
3931  * Returns: compressed size on success
3932  *          -ENOMEM destination buffer is not enough to store compressed data
3933  *          -EIO    on any other error
3934  */
3935 static ssize_t qcow2_compress(void *dest, size_t dest_size,
3936                               const void *src, size_t src_size)
3937 {
3938     ssize_t ret;
3939     z_stream strm;
3940 
3941     /* best compression, small window, no zlib header */
3942     memset(&strm, 0, sizeof(strm));
3943     ret = deflateInit2(&strm, Z_DEFAULT_COMPRESSION, Z_DEFLATED,
3944                        -12, 9, Z_DEFAULT_STRATEGY);
3945     if (ret != Z_OK) {
3946         return -EIO;
3947     }
3948 
3949     /* strm.next_in is not const in old zlib versions, such as those used on
3950      * OpenBSD/NetBSD, so cast the const away */
3951     strm.avail_in = src_size;
3952     strm.next_in = (void *) src;
3953     strm.avail_out = dest_size;
3954     strm.next_out = dest;
3955 
3956     ret = deflate(&strm, Z_FINISH);
3957     if (ret == Z_STREAM_END) {
3958         ret = dest_size - strm.avail_out;
3959     } else {
3960         ret = (ret == Z_OK ? -ENOMEM : -EIO);
3961     }
3962 
3963     deflateEnd(&strm);
3964 
3965     return ret;
3966 }
3967 
3968 /*
3969  * qcow2_decompress()
3970  *
3971  * Decompress some data (not more than @src_size bytes) to produce exactly
3972  * @dest_size bytes.
3973  *
3974  * @dest - destination buffer, @dest_size bytes
3975  * @src - source buffer, @src_size bytes
3976  *
3977  * Returns: 0 on success
3978  *          -1 on fail
3979  */
3980 static ssize_t qcow2_decompress(void *dest, size_t dest_size,
3981                                 const void *src, size_t src_size)
3982 {
3983     int ret = 0;
3984     z_stream strm;
3985 
3986     memset(&strm, 0, sizeof(strm));
3987     strm.avail_in = src_size;
3988     strm.next_in = (void *) src;
3989     strm.avail_out = dest_size;
3990     strm.next_out = dest;
3991 
3992     ret = inflateInit2(&strm, -12);
3993     if (ret != Z_OK) {
3994         return -1;
3995     }
3996 
3997     ret = inflate(&strm, Z_FINISH);
3998     if ((ret != Z_STREAM_END && ret != Z_BUF_ERROR) || strm.avail_out != 0) {
3999         /* We approve Z_BUF_ERROR because we need @dest buffer to be filled, but
4000          * @src buffer may be processed partly (because in qcow2 we know size of
4001          * compressed data with precision of one sector) */
4002         ret = -1;
4003     }
4004 
4005     inflateEnd(&strm);
4006 
4007     return ret;
4008 }
4009 
4010 #define MAX_COMPRESS_THREADS 4
4011 
4012 typedef ssize_t (*Qcow2CompressFunc)(void *dest, size_t dest_size,
4013                                      const void *src, size_t src_size);
4014 typedef struct Qcow2CompressData {
4015     void *dest;
4016     size_t dest_size;
4017     const void *src;
4018     size_t src_size;
4019     ssize_t ret;
4020 
4021     Qcow2CompressFunc func;
4022 } Qcow2CompressData;
4023 
4024 static int qcow2_compress_pool_func(void *opaque)
4025 {
4026     Qcow2CompressData *data = opaque;
4027 
4028     data->ret = data->func(data->dest, data->dest_size,
4029                            data->src, data->src_size);
4030 
4031     return 0;
4032 }
4033 
4034 static void qcow2_compress_complete(void *opaque, int ret)
4035 {
4036     qemu_coroutine_enter(opaque);
4037 }
4038 
4039 static ssize_t coroutine_fn
4040 qcow2_co_do_compress(BlockDriverState *bs, void *dest, size_t dest_size,
4041                      const void *src, size_t src_size, Qcow2CompressFunc func)
4042 {
4043     BDRVQcow2State *s = bs->opaque;
4044     BlockAIOCB *acb;
4045     ThreadPool *pool = aio_get_thread_pool(bdrv_get_aio_context(bs));
4046     Qcow2CompressData arg = {
4047         .dest = dest,
4048         .dest_size = dest_size,
4049         .src = src,
4050         .src_size = src_size,
4051         .func = func,
4052     };
4053 
4054     while (s->nb_compress_threads >= MAX_COMPRESS_THREADS) {
4055         qemu_co_queue_wait(&s->compress_wait_queue, NULL);
4056     }
4057 
4058     s->nb_compress_threads++;
4059     acb = thread_pool_submit_aio(pool, qcow2_compress_pool_func, &arg,
4060                                  qcow2_compress_complete,
4061                                  qemu_coroutine_self());
4062 
4063     if (!acb) {
4064         s->nb_compress_threads--;
4065         return -EINVAL;
4066     }
4067     qemu_coroutine_yield();
4068     s->nb_compress_threads--;
4069     qemu_co_queue_next(&s->compress_wait_queue);
4070 
4071     return arg.ret;
4072 }
4073 
4074 static ssize_t coroutine_fn
4075 qcow2_co_compress(BlockDriverState *bs, void *dest, size_t dest_size,
4076                   const void *src, size_t src_size)
4077 {
4078     return qcow2_co_do_compress(bs, dest, dest_size, src, src_size,
4079                                 qcow2_compress);
4080 }
4081 
4082 static ssize_t coroutine_fn
4083 qcow2_co_decompress(BlockDriverState *bs, void *dest, size_t dest_size,
4084                     const void *src, size_t src_size)
4085 {
4086     return qcow2_co_do_compress(bs, dest, dest_size, src, src_size,
4087                                 qcow2_decompress);
4088 }
4089 
4090 /* XXX: put compressed sectors first, then all the cluster aligned
4091    tables to avoid losing bytes in alignment */
4092 static coroutine_fn int
4093 qcow2_co_pwritev_compressed(BlockDriverState *bs, uint64_t offset,
4094                             uint64_t bytes, QEMUIOVector *qiov)
4095 {
4096     BDRVQcow2State *s = bs->opaque;
4097     int ret;
4098     ssize_t out_len;
4099     uint8_t *buf, *out_buf;
4100     uint64_t cluster_offset;
4101 
4102     if (has_data_file(bs)) {
4103         return -ENOTSUP;
4104     }
4105 
4106     if (bytes == 0) {
4107         /* align end of file to a sector boundary to ease reading with
4108            sector based I/Os */
4109         int64_t len = bdrv_getlength(bs->file->bs);
4110         if (len < 0) {
4111             return len;
4112         }
4113         return bdrv_co_truncate(bs->file, len, PREALLOC_MODE_OFF, NULL);
4114     }
4115 
4116     if (offset_into_cluster(s, offset)) {
4117         return -EINVAL;
4118     }
4119 
4120     buf = qemu_blockalign(bs, s->cluster_size);
4121     if (bytes != s->cluster_size) {
4122         if (bytes > s->cluster_size ||
4123             offset + bytes != bs->total_sectors << BDRV_SECTOR_BITS)
4124         {
4125             qemu_vfree(buf);
4126             return -EINVAL;
4127         }
4128         /* Zero-pad last write if image size is not cluster aligned */
4129         memset(buf + bytes, 0, s->cluster_size - bytes);
4130     }
4131     qemu_iovec_to_buf(qiov, 0, buf, bytes);
4132 
4133     out_buf = g_malloc(s->cluster_size);
4134 
4135     out_len = qcow2_co_compress(bs, out_buf, s->cluster_size - 1,
4136                                 buf, s->cluster_size);
4137     if (out_len == -ENOMEM) {
4138         /* could not compress: write normal cluster */
4139         ret = qcow2_co_pwritev(bs, offset, bytes, qiov, 0);
4140         if (ret < 0) {
4141             goto fail;
4142         }
4143         goto success;
4144     } else if (out_len < 0) {
4145         ret = -EINVAL;
4146         goto fail;
4147     }
4148 
4149     qemu_co_mutex_lock(&s->lock);
4150     ret = qcow2_alloc_compressed_cluster_offset(bs, offset, out_len,
4151                                                 &cluster_offset);
4152     if (ret < 0) {
4153         qemu_co_mutex_unlock(&s->lock);
4154         goto fail;
4155     }
4156 
4157     ret = qcow2_pre_write_overlap_check(bs, 0, cluster_offset, out_len, true);
4158     qemu_co_mutex_unlock(&s->lock);
4159     if (ret < 0) {
4160         goto fail;
4161     }
4162 
4163     BLKDBG_EVENT(s->data_file, BLKDBG_WRITE_COMPRESSED);
4164     ret = bdrv_co_pwrite(s->data_file, cluster_offset, out_len, out_buf, 0);
4165     if (ret < 0) {
4166         goto fail;
4167     }
4168 success:
4169     ret = 0;
4170 fail:
4171     qemu_vfree(buf);
4172     g_free(out_buf);
4173     return ret;
4174 }
4175 
4176 static int coroutine_fn
4177 qcow2_co_preadv_compressed(BlockDriverState *bs,
4178                            uint64_t file_cluster_offset,
4179                            uint64_t offset,
4180                            uint64_t bytes,
4181                            QEMUIOVector *qiov)
4182 {
4183     BDRVQcow2State *s = bs->opaque;
4184     int ret = 0, csize, nb_csectors;
4185     uint64_t coffset;
4186     uint8_t *buf, *out_buf;
4187     int offset_in_cluster = offset_into_cluster(s, offset);
4188 
4189     coffset = file_cluster_offset & s->cluster_offset_mask;
4190     nb_csectors = ((file_cluster_offset >> s->csize_shift) & s->csize_mask) + 1;
4191     csize = nb_csectors * 512 - (coffset & 511);
4192 
4193     buf = g_try_malloc(csize);
4194     if (!buf) {
4195         return -ENOMEM;
4196     }
4197 
4198     out_buf = qemu_blockalign(bs, s->cluster_size);
4199 
4200     BLKDBG_EVENT(bs->file, BLKDBG_READ_COMPRESSED);
4201     ret = bdrv_co_pread(bs->file, coffset, csize, buf, 0);
4202     if (ret < 0) {
4203         goto fail;
4204     }
4205 
4206     if (qcow2_co_decompress(bs, out_buf, s->cluster_size, buf, csize) < 0) {
4207         ret = -EIO;
4208         goto fail;
4209     }
4210 
4211     qemu_iovec_from_buf(qiov, 0, out_buf + offset_in_cluster, bytes);
4212 
4213 fail:
4214     qemu_vfree(out_buf);
4215     g_free(buf);
4216 
4217     return ret;
4218 }
4219 
4220 static int make_completely_empty(BlockDriverState *bs)
4221 {
4222     BDRVQcow2State *s = bs->opaque;
4223     Error *local_err = NULL;
4224     int ret, l1_clusters;
4225     int64_t offset;
4226     uint64_t *new_reftable = NULL;
4227     uint64_t rt_entry, l1_size2;
4228     struct {
4229         uint64_t l1_offset;
4230         uint64_t reftable_offset;
4231         uint32_t reftable_clusters;
4232     } QEMU_PACKED l1_ofs_rt_ofs_cls;
4233 
4234     ret = qcow2_cache_empty(bs, s->l2_table_cache);
4235     if (ret < 0) {
4236         goto fail;
4237     }
4238 
4239     ret = qcow2_cache_empty(bs, s->refcount_block_cache);
4240     if (ret < 0) {
4241         goto fail;
4242     }
4243 
4244     /* Refcounts will be broken utterly */
4245     ret = qcow2_mark_dirty(bs);
4246     if (ret < 0) {
4247         goto fail;
4248     }
4249 
4250     BLKDBG_EVENT(bs->file, BLKDBG_L1_UPDATE);
4251 
4252     l1_clusters = DIV_ROUND_UP(s->l1_size, s->cluster_size / sizeof(uint64_t));
4253     l1_size2 = (uint64_t)s->l1_size * sizeof(uint64_t);
4254 
4255     /* After this call, neither the in-memory nor the on-disk refcount
4256      * information accurately describe the actual references */
4257 
4258     ret = bdrv_pwrite_zeroes(bs->file, s->l1_table_offset,
4259                              l1_clusters * s->cluster_size, 0);
4260     if (ret < 0) {
4261         goto fail_broken_refcounts;
4262     }
4263     memset(s->l1_table, 0, l1_size2);
4264 
4265     BLKDBG_EVENT(bs->file, BLKDBG_EMPTY_IMAGE_PREPARE);
4266 
4267     /* Overwrite enough clusters at the beginning of the sectors to place
4268      * the refcount table, a refcount block and the L1 table in; this may
4269      * overwrite parts of the existing refcount and L1 table, which is not
4270      * an issue because the dirty flag is set, complete data loss is in fact
4271      * desired and partial data loss is consequently fine as well */
4272     ret = bdrv_pwrite_zeroes(bs->file, s->cluster_size,
4273                              (2 + l1_clusters) * s->cluster_size, 0);
4274     /* This call (even if it failed overall) may have overwritten on-disk
4275      * refcount structures; in that case, the in-memory refcount information
4276      * will probably differ from the on-disk information which makes the BDS
4277      * unusable */
4278     if (ret < 0) {
4279         goto fail_broken_refcounts;
4280     }
4281 
4282     BLKDBG_EVENT(bs->file, BLKDBG_L1_UPDATE);
4283     BLKDBG_EVENT(bs->file, BLKDBG_REFTABLE_UPDATE);
4284 
4285     /* "Create" an empty reftable (one cluster) directly after the image
4286      * header and an empty L1 table three clusters after the image header;
4287      * the cluster between those two will be used as the first refblock */
4288     l1_ofs_rt_ofs_cls.l1_offset = cpu_to_be64(3 * s->cluster_size);
4289     l1_ofs_rt_ofs_cls.reftable_offset = cpu_to_be64(s->cluster_size);
4290     l1_ofs_rt_ofs_cls.reftable_clusters = cpu_to_be32(1);
4291     ret = bdrv_pwrite_sync(bs->file, offsetof(QCowHeader, l1_table_offset),
4292                            &l1_ofs_rt_ofs_cls, sizeof(l1_ofs_rt_ofs_cls));
4293     if (ret < 0) {
4294         goto fail_broken_refcounts;
4295     }
4296 
4297     s->l1_table_offset = 3 * s->cluster_size;
4298 
4299     new_reftable = g_try_new0(uint64_t, s->cluster_size / sizeof(uint64_t));
4300     if (!new_reftable) {
4301         ret = -ENOMEM;
4302         goto fail_broken_refcounts;
4303     }
4304 
4305     s->refcount_table_offset = s->cluster_size;
4306     s->refcount_table_size   = s->cluster_size / sizeof(uint64_t);
4307     s->max_refcount_table_index = 0;
4308 
4309     g_free(s->refcount_table);
4310     s->refcount_table = new_reftable;
4311     new_reftable = NULL;
4312 
4313     /* Now the in-memory refcount information again corresponds to the on-disk
4314      * information (reftable is empty and no refblocks (the refblock cache is
4315      * empty)); however, this means some clusters (e.g. the image header) are
4316      * referenced, but not refcounted, but the normal qcow2 code assumes that
4317      * the in-memory information is always correct */
4318 
4319     BLKDBG_EVENT(bs->file, BLKDBG_REFBLOCK_ALLOC);
4320 
4321     /* Enter the first refblock into the reftable */
4322     rt_entry = cpu_to_be64(2 * s->cluster_size);
4323     ret = bdrv_pwrite_sync(bs->file, s->cluster_size,
4324                            &rt_entry, sizeof(rt_entry));
4325     if (ret < 0) {
4326         goto fail_broken_refcounts;
4327     }
4328     s->refcount_table[0] = 2 * s->cluster_size;
4329 
4330     s->free_cluster_index = 0;
4331     assert(3 + l1_clusters <= s->refcount_block_size);
4332     offset = qcow2_alloc_clusters(bs, 3 * s->cluster_size + l1_size2);
4333     if (offset < 0) {
4334         ret = offset;
4335         goto fail_broken_refcounts;
4336     } else if (offset > 0) {
4337         error_report("First cluster in emptied image is in use");
4338         abort();
4339     }
4340 
4341     /* Now finally the in-memory information corresponds to the on-disk
4342      * structures and is correct */
4343     ret = qcow2_mark_clean(bs);
4344     if (ret < 0) {
4345         goto fail;
4346     }
4347 
4348     ret = bdrv_truncate(bs->file, (3 + l1_clusters) * s->cluster_size,
4349                         PREALLOC_MODE_OFF, &local_err);
4350     if (ret < 0) {
4351         error_report_err(local_err);
4352         goto fail;
4353     }
4354 
4355     return 0;
4356 
4357 fail_broken_refcounts:
4358     /* The BDS is unusable at this point. If we wanted to make it usable, we
4359      * would have to call qcow2_refcount_close(), qcow2_refcount_init(),
4360      * qcow2_check_refcounts(), qcow2_refcount_close() and qcow2_refcount_init()
4361      * again. However, because the functions which could have caused this error
4362      * path to be taken are used by those functions as well, it's very likely
4363      * that that sequence will fail as well. Therefore, just eject the BDS. */
4364     bs->drv = NULL;
4365 
4366 fail:
4367     g_free(new_reftable);
4368     return ret;
4369 }
4370 
4371 static int qcow2_make_empty(BlockDriverState *bs)
4372 {
4373     BDRVQcow2State *s = bs->opaque;
4374     uint64_t offset, end_offset;
4375     int step = QEMU_ALIGN_DOWN(INT_MAX, s->cluster_size);
4376     int l1_clusters, ret = 0;
4377 
4378     l1_clusters = DIV_ROUND_UP(s->l1_size, s->cluster_size / sizeof(uint64_t));
4379 
4380     if (s->qcow_version >= 3 && !s->snapshots && !s->nb_bitmaps &&
4381         3 + l1_clusters <= s->refcount_block_size &&
4382         s->crypt_method_header != QCOW_CRYPT_LUKS &&
4383         !has_data_file(bs)) {
4384         /* The following function only works for qcow2 v3 images (it
4385          * requires the dirty flag) and only as long as there are no
4386          * features that reserve extra clusters (such as snapshots,
4387          * LUKS header, or persistent bitmaps), because it completely
4388          * empties the image.  Furthermore, the L1 table and three
4389          * additional clusters (image header, refcount table, one
4390          * refcount block) have to fit inside one refcount block. It
4391          * only resets the image file, i.e. does not work with an
4392          * external data file. */
4393         return make_completely_empty(bs);
4394     }
4395 
4396     /* This fallback code simply discards every active cluster; this is slow,
4397      * but works in all cases */
4398     end_offset = bs->total_sectors * BDRV_SECTOR_SIZE;
4399     for (offset = 0; offset < end_offset; offset += step) {
4400         /* As this function is generally used after committing an external
4401          * snapshot, QCOW2_DISCARD_SNAPSHOT seems appropriate. Also, the
4402          * default action for this kind of discard is to pass the discard,
4403          * which will ideally result in an actually smaller image file, as
4404          * is probably desired. */
4405         ret = qcow2_cluster_discard(bs, offset, MIN(step, end_offset - offset),
4406                                     QCOW2_DISCARD_SNAPSHOT, true);
4407         if (ret < 0) {
4408             break;
4409         }
4410     }
4411 
4412     return ret;
4413 }
4414 
4415 static coroutine_fn int qcow2_co_flush_to_os(BlockDriverState *bs)
4416 {
4417     BDRVQcow2State *s = bs->opaque;
4418     int ret;
4419 
4420     qemu_co_mutex_lock(&s->lock);
4421     ret = qcow2_write_caches(bs);
4422     qemu_co_mutex_unlock(&s->lock);
4423 
4424     return ret;
4425 }
4426 
4427 static ssize_t qcow2_measure_crypto_hdr_init_func(QCryptoBlock *block,
4428         size_t headerlen, void *opaque, Error **errp)
4429 {
4430     size_t *headerlenp = opaque;
4431 
4432     /* Stash away the payload size */
4433     *headerlenp = headerlen;
4434     return 0;
4435 }
4436 
4437 static ssize_t qcow2_measure_crypto_hdr_write_func(QCryptoBlock *block,
4438         size_t offset, const uint8_t *buf, size_t buflen,
4439         void *opaque, Error **errp)
4440 {
4441     /* Discard the bytes, we're not actually writing to an image */
4442     return buflen;
4443 }
4444 
4445 /* Determine the number of bytes for the LUKS payload */
4446 static bool qcow2_measure_luks_headerlen(QemuOpts *opts, size_t *len,
4447                                          Error **errp)
4448 {
4449     QDict *opts_qdict;
4450     QDict *cryptoopts_qdict;
4451     QCryptoBlockCreateOptions *cryptoopts;
4452     QCryptoBlock *crypto;
4453 
4454     /* Extract "encrypt." options into a qdict */
4455     opts_qdict = qemu_opts_to_qdict(opts, NULL);
4456     qdict_extract_subqdict(opts_qdict, &cryptoopts_qdict, "encrypt.");
4457     qobject_unref(opts_qdict);
4458 
4459     /* Build QCryptoBlockCreateOptions object from qdict */
4460     qdict_put_str(cryptoopts_qdict, "format", "luks");
4461     cryptoopts = block_crypto_create_opts_init(cryptoopts_qdict, errp);
4462     qobject_unref(cryptoopts_qdict);
4463     if (!cryptoopts) {
4464         return false;
4465     }
4466 
4467     /* Fake LUKS creation in order to determine the payload size */
4468     crypto = qcrypto_block_create(cryptoopts, "encrypt.",
4469                                   qcow2_measure_crypto_hdr_init_func,
4470                                   qcow2_measure_crypto_hdr_write_func,
4471                                   len, errp);
4472     qapi_free_QCryptoBlockCreateOptions(cryptoopts);
4473     if (!crypto) {
4474         return false;
4475     }
4476 
4477     qcrypto_block_free(crypto);
4478     return true;
4479 }
4480 
4481 static BlockMeasureInfo *qcow2_measure(QemuOpts *opts, BlockDriverState *in_bs,
4482                                        Error **errp)
4483 {
4484     Error *local_err = NULL;
4485     BlockMeasureInfo *info;
4486     uint64_t required = 0; /* bytes that contribute to required size */
4487     uint64_t virtual_size; /* disk size as seen by guest */
4488     uint64_t refcount_bits;
4489     uint64_t l2_tables;
4490     uint64_t luks_payload_size = 0;
4491     size_t cluster_size;
4492     int version;
4493     char *optstr;
4494     PreallocMode prealloc;
4495     bool has_backing_file;
4496     bool has_luks;
4497 
4498     /* Parse image creation options */
4499     cluster_size = qcow2_opt_get_cluster_size_del(opts, &local_err);
4500     if (local_err) {
4501         goto err;
4502     }
4503 
4504     version = qcow2_opt_get_version_del(opts, &local_err);
4505     if (local_err) {
4506         goto err;
4507     }
4508 
4509     refcount_bits = qcow2_opt_get_refcount_bits_del(opts, version, &local_err);
4510     if (local_err) {
4511         goto err;
4512     }
4513 
4514     optstr = qemu_opt_get_del(opts, BLOCK_OPT_PREALLOC);
4515     prealloc = qapi_enum_parse(&PreallocMode_lookup, optstr,
4516                                PREALLOC_MODE_OFF, &local_err);
4517     g_free(optstr);
4518     if (local_err) {
4519         goto err;
4520     }
4521 
4522     optstr = qemu_opt_get_del(opts, BLOCK_OPT_BACKING_FILE);
4523     has_backing_file = !!optstr;
4524     g_free(optstr);
4525 
4526     optstr = qemu_opt_get_del(opts, BLOCK_OPT_ENCRYPT_FORMAT);
4527     has_luks = optstr && strcmp(optstr, "luks") == 0;
4528     g_free(optstr);
4529 
4530     if (has_luks) {
4531         size_t headerlen;
4532 
4533         if (!qcow2_measure_luks_headerlen(opts, &headerlen, &local_err)) {
4534             goto err;
4535         }
4536 
4537         luks_payload_size = ROUND_UP(headerlen, cluster_size);
4538     }
4539 
4540     virtual_size = qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0);
4541     virtual_size = ROUND_UP(virtual_size, cluster_size);
4542 
4543     /* Check that virtual disk size is valid */
4544     l2_tables = DIV_ROUND_UP(virtual_size / cluster_size,
4545                              cluster_size / sizeof(uint64_t));
4546     if (l2_tables * sizeof(uint64_t) > QCOW_MAX_L1_SIZE) {
4547         error_setg(&local_err, "The image size is too large "
4548                                "(try using a larger cluster size)");
4549         goto err;
4550     }
4551 
4552     /* Account for input image */
4553     if (in_bs) {
4554         int64_t ssize = bdrv_getlength(in_bs);
4555         if (ssize < 0) {
4556             error_setg_errno(&local_err, -ssize,
4557                              "Unable to get image virtual_size");
4558             goto err;
4559         }
4560 
4561         virtual_size = ROUND_UP(ssize, cluster_size);
4562 
4563         if (has_backing_file) {
4564             /* We don't how much of the backing chain is shared by the input
4565              * image and the new image file.  In the worst case the new image's
4566              * backing file has nothing in common with the input image.  Be
4567              * conservative and assume all clusters need to be written.
4568              */
4569             required = virtual_size;
4570         } else {
4571             int64_t offset;
4572             int64_t pnum = 0;
4573 
4574             for (offset = 0; offset < ssize; offset += pnum) {
4575                 int ret;
4576 
4577                 ret = bdrv_block_status_above(in_bs, NULL, offset,
4578                                               ssize - offset, &pnum, NULL,
4579                                               NULL);
4580                 if (ret < 0) {
4581                     error_setg_errno(&local_err, -ret,
4582                                      "Unable to get block status");
4583                     goto err;
4584                 }
4585 
4586                 if (ret & BDRV_BLOCK_ZERO) {
4587                     /* Skip zero regions (safe with no backing file) */
4588                 } else if ((ret & (BDRV_BLOCK_DATA | BDRV_BLOCK_ALLOCATED)) ==
4589                            (BDRV_BLOCK_DATA | BDRV_BLOCK_ALLOCATED)) {
4590                     /* Extend pnum to end of cluster for next iteration */
4591                     pnum = ROUND_UP(offset + pnum, cluster_size) - offset;
4592 
4593                     /* Count clusters we've seen */
4594                     required += offset % cluster_size + pnum;
4595                 }
4596             }
4597         }
4598     }
4599 
4600     /* Take into account preallocation.  Nothing special is needed for
4601      * PREALLOC_MODE_METADATA since metadata is always counted.
4602      */
4603     if (prealloc == PREALLOC_MODE_FULL || prealloc == PREALLOC_MODE_FALLOC) {
4604         required = virtual_size;
4605     }
4606 
4607     info = g_new(BlockMeasureInfo, 1);
4608     info->fully_allocated =
4609         qcow2_calc_prealloc_size(virtual_size, cluster_size,
4610                                  ctz32(refcount_bits)) + luks_payload_size;
4611 
4612     /* Remove data clusters that are not required.  This overestimates the
4613      * required size because metadata needed for the fully allocated file is
4614      * still counted.
4615      */
4616     info->required = info->fully_allocated - virtual_size + required;
4617     return info;
4618 
4619 err:
4620     error_propagate(errp, local_err);
4621     return NULL;
4622 }
4623 
4624 static int qcow2_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
4625 {
4626     BDRVQcow2State *s = bs->opaque;
4627     bdi->unallocated_blocks_are_zero = true;
4628     bdi->cluster_size = s->cluster_size;
4629     bdi->vm_state_offset = qcow2_vm_state_offset(s);
4630     return 0;
4631 }
4632 
4633 static ImageInfoSpecific *qcow2_get_specific_info(BlockDriverState *bs,
4634                                                   Error **errp)
4635 {
4636     BDRVQcow2State *s = bs->opaque;
4637     ImageInfoSpecific *spec_info;
4638     QCryptoBlockInfo *encrypt_info = NULL;
4639     Error *local_err = NULL;
4640 
4641     if (s->crypto != NULL) {
4642         encrypt_info = qcrypto_block_get_info(s->crypto, &local_err);
4643         if (local_err) {
4644             error_propagate(errp, local_err);
4645             return NULL;
4646         }
4647     }
4648 
4649     spec_info = g_new(ImageInfoSpecific, 1);
4650     *spec_info = (ImageInfoSpecific){
4651         .type  = IMAGE_INFO_SPECIFIC_KIND_QCOW2,
4652         .u.qcow2.data = g_new0(ImageInfoSpecificQCow2, 1),
4653     };
4654     if (s->qcow_version == 2) {
4655         *spec_info->u.qcow2.data = (ImageInfoSpecificQCow2){
4656             .compat             = g_strdup("0.10"),
4657             .refcount_bits      = s->refcount_bits,
4658         };
4659     } else if (s->qcow_version == 3) {
4660         Qcow2BitmapInfoList *bitmaps;
4661         bitmaps = qcow2_get_bitmap_info_list(bs, &local_err);
4662         if (local_err) {
4663             error_propagate(errp, local_err);
4664             qapi_free_ImageInfoSpecific(spec_info);
4665             return NULL;
4666         }
4667         *spec_info->u.qcow2.data = (ImageInfoSpecificQCow2){
4668             .compat             = g_strdup("1.1"),
4669             .lazy_refcounts     = s->compatible_features &
4670                                   QCOW2_COMPAT_LAZY_REFCOUNTS,
4671             .has_lazy_refcounts = true,
4672             .corrupt            = s->incompatible_features &
4673                                   QCOW2_INCOMPAT_CORRUPT,
4674             .has_corrupt        = true,
4675             .refcount_bits      = s->refcount_bits,
4676             .has_bitmaps        = !!bitmaps,
4677             .bitmaps            = bitmaps,
4678             .has_data_file      = !!s->image_data_file,
4679             .data_file          = g_strdup(s->image_data_file),
4680             .has_data_file_raw  = has_data_file(bs),
4681             .data_file_raw      = data_file_is_raw(bs),
4682         };
4683     } else {
4684         /* if this assertion fails, this probably means a new version was
4685          * added without having it covered here */
4686         assert(false);
4687     }
4688 
4689     if (encrypt_info) {
4690         ImageInfoSpecificQCow2Encryption *qencrypt =
4691             g_new(ImageInfoSpecificQCow2Encryption, 1);
4692         switch (encrypt_info->format) {
4693         case Q_CRYPTO_BLOCK_FORMAT_QCOW:
4694             qencrypt->format = BLOCKDEV_QCOW2_ENCRYPTION_FORMAT_AES;
4695             break;
4696         case Q_CRYPTO_BLOCK_FORMAT_LUKS:
4697             qencrypt->format = BLOCKDEV_QCOW2_ENCRYPTION_FORMAT_LUKS;
4698             qencrypt->u.luks = encrypt_info->u.luks;
4699             break;
4700         default:
4701             abort();
4702         }
4703         /* Since we did shallow copy above, erase any pointers
4704          * in the original info */
4705         memset(&encrypt_info->u, 0, sizeof(encrypt_info->u));
4706         qapi_free_QCryptoBlockInfo(encrypt_info);
4707 
4708         spec_info->u.qcow2.data->has_encrypt = true;
4709         spec_info->u.qcow2.data->encrypt = qencrypt;
4710     }
4711 
4712     return spec_info;
4713 }
4714 
4715 static int qcow2_save_vmstate(BlockDriverState *bs, QEMUIOVector *qiov,
4716                               int64_t pos)
4717 {
4718     BDRVQcow2State *s = bs->opaque;
4719 
4720     BLKDBG_EVENT(bs->file, BLKDBG_VMSTATE_SAVE);
4721     return bs->drv->bdrv_co_pwritev(bs, qcow2_vm_state_offset(s) + pos,
4722                                     qiov->size, qiov, 0);
4723 }
4724 
4725 static int qcow2_load_vmstate(BlockDriverState *bs, QEMUIOVector *qiov,
4726                               int64_t pos)
4727 {
4728     BDRVQcow2State *s = bs->opaque;
4729 
4730     BLKDBG_EVENT(bs->file, BLKDBG_VMSTATE_LOAD);
4731     return bs->drv->bdrv_co_preadv(bs, qcow2_vm_state_offset(s) + pos,
4732                                    qiov->size, qiov, 0);
4733 }
4734 
4735 /*
4736  * Downgrades an image's version. To achieve this, any incompatible features
4737  * have to be removed.
4738  */
4739 static int qcow2_downgrade(BlockDriverState *bs, int target_version,
4740                            BlockDriverAmendStatusCB *status_cb, void *cb_opaque,
4741                            Error **errp)
4742 {
4743     BDRVQcow2State *s = bs->opaque;
4744     int current_version = s->qcow_version;
4745     int ret;
4746 
4747     /* This is qcow2_downgrade(), not qcow2_upgrade() */
4748     assert(target_version < current_version);
4749 
4750     /* There are no other versions (now) that you can downgrade to */
4751     assert(target_version == 2);
4752 
4753     if (s->refcount_order != 4) {
4754         error_setg(errp, "compat=0.10 requires refcount_bits=16");
4755         return -ENOTSUP;
4756     }
4757 
4758     if (has_data_file(bs)) {
4759         error_setg(errp, "Cannot downgrade an image with a data file");
4760         return -ENOTSUP;
4761     }
4762 
4763     /* clear incompatible features */
4764     if (s->incompatible_features & QCOW2_INCOMPAT_DIRTY) {
4765         ret = qcow2_mark_clean(bs);
4766         if (ret < 0) {
4767             error_setg_errno(errp, -ret, "Failed to make the image clean");
4768             return ret;
4769         }
4770     }
4771 
4772     /* with QCOW2_INCOMPAT_CORRUPT, it is pretty much impossible to get here in
4773      * the first place; if that happens nonetheless, returning -ENOTSUP is the
4774      * best thing to do anyway */
4775 
4776     if (s->incompatible_features) {
4777         error_setg(errp, "Cannot downgrade an image with incompatible features "
4778                    "%#" PRIx64 " set", s->incompatible_features);
4779         return -ENOTSUP;
4780     }
4781 
4782     /* since we can ignore compatible features, we can set them to 0 as well */
4783     s->compatible_features = 0;
4784     /* if lazy refcounts have been used, they have already been fixed through
4785      * clearing the dirty flag */
4786 
4787     /* clearing autoclear features is trivial */
4788     s->autoclear_features = 0;
4789 
4790     ret = qcow2_expand_zero_clusters(bs, status_cb, cb_opaque);
4791     if (ret < 0) {
4792         error_setg_errno(errp, -ret, "Failed to turn zero into data clusters");
4793         return ret;
4794     }
4795 
4796     s->qcow_version = target_version;
4797     ret = qcow2_update_header(bs);
4798     if (ret < 0) {
4799         s->qcow_version = current_version;
4800         error_setg_errno(errp, -ret, "Failed to update the image header");
4801         return ret;
4802     }
4803     return 0;
4804 }
4805 
4806 typedef enum Qcow2AmendOperation {
4807     /* This is the value Qcow2AmendHelperCBInfo::last_operation will be
4808      * statically initialized to so that the helper CB can discern the first
4809      * invocation from an operation change */
4810     QCOW2_NO_OPERATION = 0,
4811 
4812     QCOW2_CHANGING_REFCOUNT_ORDER,
4813     QCOW2_DOWNGRADING,
4814 } Qcow2AmendOperation;
4815 
4816 typedef struct Qcow2AmendHelperCBInfo {
4817     /* The code coordinating the amend operations should only modify
4818      * these four fields; the rest will be managed by the CB */
4819     BlockDriverAmendStatusCB *original_status_cb;
4820     void *original_cb_opaque;
4821 
4822     Qcow2AmendOperation current_operation;
4823 
4824     /* Total number of operations to perform (only set once) */
4825     int total_operations;
4826 
4827     /* The following fields are managed by the CB */
4828 
4829     /* Number of operations completed */
4830     int operations_completed;
4831 
4832     /* Cumulative offset of all completed operations */
4833     int64_t offset_completed;
4834 
4835     Qcow2AmendOperation last_operation;
4836     int64_t last_work_size;
4837 } Qcow2AmendHelperCBInfo;
4838 
4839 static void qcow2_amend_helper_cb(BlockDriverState *bs,
4840                                   int64_t operation_offset,
4841                                   int64_t operation_work_size, void *opaque)
4842 {
4843     Qcow2AmendHelperCBInfo *info = opaque;
4844     int64_t current_work_size;
4845     int64_t projected_work_size;
4846 
4847     if (info->current_operation != info->last_operation) {
4848         if (info->last_operation != QCOW2_NO_OPERATION) {
4849             info->offset_completed += info->last_work_size;
4850             info->operations_completed++;
4851         }
4852 
4853         info->last_operation = info->current_operation;
4854     }
4855 
4856     assert(info->total_operations > 0);
4857     assert(info->operations_completed < info->total_operations);
4858 
4859     info->last_work_size = operation_work_size;
4860 
4861     current_work_size = info->offset_completed + operation_work_size;
4862 
4863     /* current_work_size is the total work size for (operations_completed + 1)
4864      * operations (which includes this one), so multiply it by the number of
4865      * operations not covered and divide it by the number of operations
4866      * covered to get a projection for the operations not covered */
4867     projected_work_size = current_work_size * (info->total_operations -
4868                                                info->operations_completed - 1)
4869                                             / (info->operations_completed + 1);
4870 
4871     info->original_status_cb(bs, info->offset_completed + operation_offset,
4872                              current_work_size + projected_work_size,
4873                              info->original_cb_opaque);
4874 }
4875 
4876 static int qcow2_amend_options(BlockDriverState *bs, QemuOpts *opts,
4877                                BlockDriverAmendStatusCB *status_cb,
4878                                void *cb_opaque,
4879                                Error **errp)
4880 {
4881     BDRVQcow2State *s = bs->opaque;
4882     int old_version = s->qcow_version, new_version = old_version;
4883     uint64_t new_size = 0;
4884     const char *backing_file = NULL, *backing_format = NULL, *data_file = NULL;
4885     bool lazy_refcounts = s->use_lazy_refcounts;
4886     bool data_file_raw = data_file_is_raw(bs);
4887     const char *compat = NULL;
4888     uint64_t cluster_size = s->cluster_size;
4889     bool encrypt;
4890     int encformat;
4891     int refcount_bits = s->refcount_bits;
4892     int ret;
4893     QemuOptDesc *desc = opts->list->desc;
4894     Qcow2AmendHelperCBInfo helper_cb_info;
4895 
4896     while (desc && desc->name) {
4897         if (!qemu_opt_find(opts, desc->name)) {
4898             /* only change explicitly defined options */
4899             desc++;
4900             continue;
4901         }
4902 
4903         if (!strcmp(desc->name, BLOCK_OPT_COMPAT_LEVEL)) {
4904             compat = qemu_opt_get(opts, BLOCK_OPT_COMPAT_LEVEL);
4905             if (!compat) {
4906                 /* preserve default */
4907             } else if (!strcmp(compat, "0.10")) {
4908                 new_version = 2;
4909             } else if (!strcmp(compat, "1.1")) {
4910                 new_version = 3;
4911             } else {
4912                 error_setg(errp, "Unknown compatibility level %s", compat);
4913                 return -EINVAL;
4914             }
4915         } else if (!strcmp(desc->name, BLOCK_OPT_PREALLOC)) {
4916             error_setg(errp, "Cannot change preallocation mode");
4917             return -ENOTSUP;
4918         } else if (!strcmp(desc->name, BLOCK_OPT_SIZE)) {
4919             new_size = qemu_opt_get_size(opts, BLOCK_OPT_SIZE, 0);
4920         } else if (!strcmp(desc->name, BLOCK_OPT_BACKING_FILE)) {
4921             backing_file = qemu_opt_get(opts, BLOCK_OPT_BACKING_FILE);
4922         } else if (!strcmp(desc->name, BLOCK_OPT_BACKING_FMT)) {
4923             backing_format = qemu_opt_get(opts, BLOCK_OPT_BACKING_FMT);
4924         } else if (!strcmp(desc->name, BLOCK_OPT_ENCRYPT)) {
4925             encrypt = qemu_opt_get_bool(opts, BLOCK_OPT_ENCRYPT,
4926                                         !!s->crypto);
4927 
4928             if (encrypt != !!s->crypto) {
4929                 error_setg(errp,
4930                            "Changing the encryption flag is not supported");
4931                 return -ENOTSUP;
4932             }
4933         } else if (!strcmp(desc->name, BLOCK_OPT_ENCRYPT_FORMAT)) {
4934             encformat = qcow2_crypt_method_from_format(
4935                 qemu_opt_get(opts, BLOCK_OPT_ENCRYPT_FORMAT));
4936 
4937             if (encformat != s->crypt_method_header) {
4938                 error_setg(errp,
4939                            "Changing the encryption format is not supported");
4940                 return -ENOTSUP;
4941             }
4942         } else if (g_str_has_prefix(desc->name, "encrypt.")) {
4943             error_setg(errp,
4944                        "Changing the encryption parameters is not supported");
4945             return -ENOTSUP;
4946         } else if (!strcmp(desc->name, BLOCK_OPT_CLUSTER_SIZE)) {
4947             cluster_size = qemu_opt_get_size(opts, BLOCK_OPT_CLUSTER_SIZE,
4948                                              cluster_size);
4949             if (cluster_size != s->cluster_size) {
4950                 error_setg(errp, "Changing the cluster size is not supported");
4951                 return -ENOTSUP;
4952             }
4953         } else if (!strcmp(desc->name, BLOCK_OPT_LAZY_REFCOUNTS)) {
4954             lazy_refcounts = qemu_opt_get_bool(opts, BLOCK_OPT_LAZY_REFCOUNTS,
4955                                                lazy_refcounts);
4956         } else if (!strcmp(desc->name, BLOCK_OPT_REFCOUNT_BITS)) {
4957             refcount_bits = qemu_opt_get_number(opts, BLOCK_OPT_REFCOUNT_BITS,
4958                                                 refcount_bits);
4959 
4960             if (refcount_bits <= 0 || refcount_bits > 64 ||
4961                 !is_power_of_2(refcount_bits))
4962             {
4963                 error_setg(errp, "Refcount width must be a power of two and "
4964                            "may not exceed 64 bits");
4965                 return -EINVAL;
4966             }
4967         } else if (!strcmp(desc->name, BLOCK_OPT_DATA_FILE)) {
4968             data_file = qemu_opt_get(opts, BLOCK_OPT_DATA_FILE);
4969             if (data_file && !has_data_file(bs)) {
4970                 error_setg(errp, "data-file can only be set for images that "
4971                                  "use an external data file");
4972                 return -EINVAL;
4973             }
4974         } else if (!strcmp(desc->name, BLOCK_OPT_DATA_FILE_RAW)) {
4975             data_file_raw = qemu_opt_get_bool(opts, BLOCK_OPT_DATA_FILE_RAW,
4976                                               data_file_raw);
4977             if (data_file_raw && !data_file_is_raw(bs)) {
4978                 error_setg(errp, "data-file-raw cannot be set on existing "
4979                                  "images");
4980                 return -EINVAL;
4981             }
4982         } else {
4983             /* if this point is reached, this probably means a new option was
4984              * added without having it covered here */
4985             abort();
4986         }
4987 
4988         desc++;
4989     }
4990 
4991     helper_cb_info = (Qcow2AmendHelperCBInfo){
4992         .original_status_cb = status_cb,
4993         .original_cb_opaque = cb_opaque,
4994         .total_operations = (new_version < old_version)
4995                           + (s->refcount_bits != refcount_bits)
4996     };
4997 
4998     /* Upgrade first (some features may require compat=1.1) */
4999     if (new_version > old_version) {
5000         s->qcow_version = new_version;
5001         ret = qcow2_update_header(bs);
5002         if (ret < 0) {
5003             s->qcow_version = old_version;
5004             error_setg_errno(errp, -ret, "Failed to update the image header");
5005             return ret;
5006         }
5007     }
5008 
5009     if (s->refcount_bits != refcount_bits) {
5010         int refcount_order = ctz32(refcount_bits);
5011 
5012         if (new_version < 3 && refcount_bits != 16) {
5013             error_setg(errp, "Refcount widths other than 16 bits require "
5014                        "compatibility level 1.1 or above (use compat=1.1 or "
5015                        "greater)");
5016             return -EINVAL;
5017         }
5018 
5019         helper_cb_info.current_operation = QCOW2_CHANGING_REFCOUNT_ORDER;
5020         ret = qcow2_change_refcount_order(bs, refcount_order,
5021                                           &qcow2_amend_helper_cb,
5022                                           &helper_cb_info, errp);
5023         if (ret < 0) {
5024             return ret;
5025         }
5026     }
5027 
5028     /* data-file-raw blocks backing files, so clear it first if requested */
5029     if (data_file_raw) {
5030         s->autoclear_features |= QCOW2_AUTOCLEAR_DATA_FILE_RAW;
5031     } else {
5032         s->autoclear_features &= ~QCOW2_AUTOCLEAR_DATA_FILE_RAW;
5033     }
5034 
5035     if (data_file) {
5036         g_free(s->image_data_file);
5037         s->image_data_file = *data_file ? g_strdup(data_file) : NULL;
5038     }
5039 
5040     ret = qcow2_update_header(bs);
5041     if (ret < 0) {
5042         error_setg_errno(errp, -ret, "Failed to update the image header");
5043         return ret;
5044     }
5045 
5046     if (backing_file || backing_format) {
5047         ret = qcow2_change_backing_file(bs,
5048                     backing_file ?: s->image_backing_file,
5049                     backing_format ?: s->image_backing_format);
5050         if (ret < 0) {
5051             error_setg_errno(errp, -ret, "Failed to change the backing file");
5052             return ret;
5053         }
5054     }
5055 
5056     if (s->use_lazy_refcounts != lazy_refcounts) {
5057         if (lazy_refcounts) {
5058             if (new_version < 3) {
5059                 error_setg(errp, "Lazy refcounts only supported with "
5060                            "compatibility level 1.1 and above (use compat=1.1 "
5061                            "or greater)");
5062                 return -EINVAL;
5063             }
5064             s->compatible_features |= QCOW2_COMPAT_LAZY_REFCOUNTS;
5065             ret = qcow2_update_header(bs);
5066             if (ret < 0) {
5067                 s->compatible_features &= ~QCOW2_COMPAT_LAZY_REFCOUNTS;
5068                 error_setg_errno(errp, -ret, "Failed to update the image header");
5069                 return ret;
5070             }
5071             s->use_lazy_refcounts = true;
5072         } else {
5073             /* make image clean first */
5074             ret = qcow2_mark_clean(bs);
5075             if (ret < 0) {
5076                 error_setg_errno(errp, -ret, "Failed to make the image clean");
5077                 return ret;
5078             }
5079             /* now disallow lazy refcounts */
5080             s->compatible_features &= ~QCOW2_COMPAT_LAZY_REFCOUNTS;
5081             ret = qcow2_update_header(bs);
5082             if (ret < 0) {
5083                 s->compatible_features |= QCOW2_COMPAT_LAZY_REFCOUNTS;
5084                 error_setg_errno(errp, -ret, "Failed to update the image header");
5085                 return ret;
5086             }
5087             s->use_lazy_refcounts = false;
5088         }
5089     }
5090 
5091     if (new_size) {
5092         BlockBackend *blk = blk_new(BLK_PERM_RESIZE, BLK_PERM_ALL);
5093         ret = blk_insert_bs(blk, bs, errp);
5094         if (ret < 0) {
5095             blk_unref(blk);
5096             return ret;
5097         }
5098 
5099         ret = blk_truncate(blk, new_size, PREALLOC_MODE_OFF, errp);
5100         blk_unref(blk);
5101         if (ret < 0) {
5102             return ret;
5103         }
5104     }
5105 
5106     /* Downgrade last (so unsupported features can be removed before) */
5107     if (new_version < old_version) {
5108         helper_cb_info.current_operation = QCOW2_DOWNGRADING;
5109         ret = qcow2_downgrade(bs, new_version, &qcow2_amend_helper_cb,
5110                               &helper_cb_info, errp);
5111         if (ret < 0) {
5112             return ret;
5113         }
5114     }
5115 
5116     return 0;
5117 }
5118 
5119 /*
5120  * If offset or size are negative, respectively, they will not be included in
5121  * the BLOCK_IMAGE_CORRUPTED event emitted.
5122  * fatal will be ignored for read-only BDS; corruptions found there will always
5123  * be considered non-fatal.
5124  */
5125 void qcow2_signal_corruption(BlockDriverState *bs, bool fatal, int64_t offset,
5126                              int64_t size, const char *message_format, ...)
5127 {
5128     BDRVQcow2State *s = bs->opaque;
5129     const char *node_name;
5130     char *message;
5131     va_list ap;
5132 
5133     fatal = fatal && bdrv_is_writable(bs);
5134 
5135     if (s->signaled_corruption &&
5136         (!fatal || (s->incompatible_features & QCOW2_INCOMPAT_CORRUPT)))
5137     {
5138         return;
5139     }
5140 
5141     va_start(ap, message_format);
5142     message = g_strdup_vprintf(message_format, ap);
5143     va_end(ap);
5144 
5145     if (fatal) {
5146         fprintf(stderr, "qcow2: Marking image as corrupt: %s; further "
5147                 "corruption events will be suppressed\n", message);
5148     } else {
5149         fprintf(stderr, "qcow2: Image is corrupt: %s; further non-fatal "
5150                 "corruption events will be suppressed\n", message);
5151     }
5152 
5153     node_name = bdrv_get_node_name(bs);
5154     qapi_event_send_block_image_corrupted(bdrv_get_device_name(bs),
5155                                           *node_name != '\0', node_name,
5156                                           message, offset >= 0, offset,
5157                                           size >= 0, size,
5158                                           fatal);
5159     g_free(message);
5160 
5161     if (fatal) {
5162         qcow2_mark_corrupt(bs);
5163         bs->drv = NULL; /* make BDS unusable */
5164     }
5165 
5166     s->signaled_corruption = true;
5167 }
5168 
5169 static QemuOptsList qcow2_create_opts = {
5170     .name = "qcow2-create-opts",
5171     .head = QTAILQ_HEAD_INITIALIZER(qcow2_create_opts.head),
5172     .desc = {
5173         {
5174             .name = BLOCK_OPT_SIZE,
5175             .type = QEMU_OPT_SIZE,
5176             .help = "Virtual disk size"
5177         },
5178         {
5179             .name = BLOCK_OPT_COMPAT_LEVEL,
5180             .type = QEMU_OPT_STRING,
5181             .help = "Compatibility level (0.10 or 1.1)"
5182         },
5183         {
5184             .name = BLOCK_OPT_BACKING_FILE,
5185             .type = QEMU_OPT_STRING,
5186             .help = "File name of a base image"
5187         },
5188         {
5189             .name = BLOCK_OPT_BACKING_FMT,
5190             .type = QEMU_OPT_STRING,
5191             .help = "Image format of the base image"
5192         },
5193         {
5194             .name = BLOCK_OPT_DATA_FILE,
5195             .type = QEMU_OPT_STRING,
5196             .help = "File name of an external data file"
5197         },
5198         {
5199             .name = BLOCK_OPT_DATA_FILE_RAW,
5200             .type = QEMU_OPT_BOOL,
5201             .help = "The external data file must stay valid as a raw image"
5202         },
5203         {
5204             .name = BLOCK_OPT_ENCRYPT,
5205             .type = QEMU_OPT_BOOL,
5206             .help = "Encrypt the image with format 'aes'. (Deprecated "
5207                     "in favor of " BLOCK_OPT_ENCRYPT_FORMAT "=aes)",
5208         },
5209         {
5210             .name = BLOCK_OPT_ENCRYPT_FORMAT,
5211             .type = QEMU_OPT_STRING,
5212             .help = "Encrypt the image, format choices: 'aes', 'luks'",
5213         },
5214         BLOCK_CRYPTO_OPT_DEF_KEY_SECRET("encrypt.",
5215             "ID of secret providing qcow AES key or LUKS passphrase"),
5216         BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_ALG("encrypt."),
5217         BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_MODE("encrypt."),
5218         BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_ALG("encrypt."),
5219         BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_HASH_ALG("encrypt."),
5220         BLOCK_CRYPTO_OPT_DEF_LUKS_HASH_ALG("encrypt."),
5221         BLOCK_CRYPTO_OPT_DEF_LUKS_ITER_TIME("encrypt."),
5222         {
5223             .name = BLOCK_OPT_CLUSTER_SIZE,
5224             .type = QEMU_OPT_SIZE,
5225             .help = "qcow2 cluster size",
5226             .def_value_str = stringify(DEFAULT_CLUSTER_SIZE)
5227         },
5228         {
5229             .name = BLOCK_OPT_PREALLOC,
5230             .type = QEMU_OPT_STRING,
5231             .help = "Preallocation mode (allowed values: off, metadata, "
5232                     "falloc, full)"
5233         },
5234         {
5235             .name = BLOCK_OPT_LAZY_REFCOUNTS,
5236             .type = QEMU_OPT_BOOL,
5237             .help = "Postpone refcount updates",
5238             .def_value_str = "off"
5239         },
5240         {
5241             .name = BLOCK_OPT_REFCOUNT_BITS,
5242             .type = QEMU_OPT_NUMBER,
5243             .help = "Width of a reference count entry in bits",
5244             .def_value_str = "16"
5245         },
5246         { /* end of list */ }
5247     }
5248 };
5249 
5250 static const char *const qcow2_strong_runtime_opts[] = {
5251     "encrypt." BLOCK_CRYPTO_OPT_QCOW_KEY_SECRET,
5252 
5253     NULL
5254 };
5255 
5256 BlockDriver bdrv_qcow2 = {
5257     .format_name        = "qcow2",
5258     .instance_size      = sizeof(BDRVQcow2State),
5259     .bdrv_probe         = qcow2_probe,
5260     .bdrv_open          = qcow2_open,
5261     .bdrv_close         = qcow2_close,
5262     .bdrv_reopen_prepare  = qcow2_reopen_prepare,
5263     .bdrv_reopen_commit   = qcow2_reopen_commit,
5264     .bdrv_reopen_abort    = qcow2_reopen_abort,
5265     .bdrv_join_options    = qcow2_join_options,
5266     .bdrv_child_perm      = bdrv_format_default_perms,
5267     .bdrv_co_create_opts  = qcow2_co_create_opts,
5268     .bdrv_co_create       = qcow2_co_create,
5269     .bdrv_has_zero_init = bdrv_has_zero_init_1,
5270     .bdrv_co_block_status = qcow2_co_block_status,
5271 
5272     .bdrv_co_preadv         = qcow2_co_preadv,
5273     .bdrv_co_pwritev        = qcow2_co_pwritev,
5274     .bdrv_co_flush_to_os    = qcow2_co_flush_to_os,
5275 
5276     .bdrv_co_pwrite_zeroes  = qcow2_co_pwrite_zeroes,
5277     .bdrv_co_pdiscard       = qcow2_co_pdiscard,
5278     .bdrv_co_copy_range_from = qcow2_co_copy_range_from,
5279     .bdrv_co_copy_range_to  = qcow2_co_copy_range_to,
5280     .bdrv_co_truncate       = qcow2_co_truncate,
5281     .bdrv_co_pwritev_compressed = qcow2_co_pwritev_compressed,
5282     .bdrv_make_empty        = qcow2_make_empty,
5283 
5284     .bdrv_snapshot_create   = qcow2_snapshot_create,
5285     .bdrv_snapshot_goto     = qcow2_snapshot_goto,
5286     .bdrv_snapshot_delete   = qcow2_snapshot_delete,
5287     .bdrv_snapshot_list     = qcow2_snapshot_list,
5288     .bdrv_snapshot_load_tmp = qcow2_snapshot_load_tmp,
5289     .bdrv_measure           = qcow2_measure,
5290     .bdrv_get_info          = qcow2_get_info,
5291     .bdrv_get_specific_info = qcow2_get_specific_info,
5292 
5293     .bdrv_save_vmstate    = qcow2_save_vmstate,
5294     .bdrv_load_vmstate    = qcow2_load_vmstate,
5295 
5296     .supports_backing           = true,
5297     .bdrv_change_backing_file   = qcow2_change_backing_file,
5298 
5299     .bdrv_refresh_limits        = qcow2_refresh_limits,
5300     .bdrv_co_invalidate_cache   = qcow2_co_invalidate_cache,
5301     .bdrv_inactivate            = qcow2_inactivate,
5302 
5303     .create_opts         = &qcow2_create_opts,
5304     .strong_runtime_opts = qcow2_strong_runtime_opts,
5305     .mutable_opts        = mutable_opts,
5306     .bdrv_co_check       = qcow2_co_check,
5307     .bdrv_amend_options  = qcow2_amend_options,
5308 
5309     .bdrv_detach_aio_context  = qcow2_detach_aio_context,
5310     .bdrv_attach_aio_context  = qcow2_attach_aio_context,
5311 
5312     .bdrv_reopen_bitmaps_rw = qcow2_reopen_bitmaps_rw,
5313     .bdrv_can_store_new_dirty_bitmap = qcow2_can_store_new_dirty_bitmap,
5314     .bdrv_remove_persistent_dirty_bitmap = qcow2_remove_persistent_dirty_bitmap,
5315 };
5316 
5317 static void bdrv_qcow2_init(void)
5318 {
5319     bdrv_register(&bdrv_qcow2);
5320 }
5321 
5322 block_init(bdrv_qcow2_init);
5323