xref: /openbmc/qemu/block/qcow2.c (revision c124c152)
1 /*
2  * Block driver for the QCOW version 2 format
3  *
4  * Copyright (c) 2004-2006 Fabrice Bellard
5  *
6  * Permission is hereby granted, free of charge, to any person obtaining a copy
7  * of this software and associated documentation files (the "Software"), to deal
8  * in the Software without restriction, including without limitation the rights
9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10  * copies of the Software, and to permit persons to whom the Software is
11  * furnished to do so, subject to the following conditions:
12  *
13  * The above copyright notice and this permission notice shall be included in
14  * all copies or substantial portions of the Software.
15  *
16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22  * THE SOFTWARE.
23  */
24 
25 #include "qemu/osdep.h"
26 
27 #define ZLIB_CONST
28 #include <zlib.h>
29 
30 #include "block/block_int.h"
31 #include "block/qdict.h"
32 #include "sysemu/block-backend.h"
33 #include "qemu/module.h"
34 #include "qcow2.h"
35 #include "qemu/error-report.h"
36 #include "qapi/error.h"
37 #include "qapi/qapi-events-block-core.h"
38 #include "qapi/qmp/qdict.h"
39 #include "qapi/qmp/qstring.h"
40 #include "trace.h"
41 #include "qemu/option_int.h"
42 #include "qemu/cutils.h"
43 #include "qemu/bswap.h"
44 #include "qapi/qobject-input-visitor.h"
45 #include "qapi/qapi-visit-block-core.h"
46 #include "crypto.h"
47 #include "block/thread-pool.h"
48 
49 /*
50   Differences with QCOW:
51 
52   - Support for multiple incremental snapshots.
53   - Memory management by reference counts.
54   - Clusters which have a reference count of one have the bit
55     QCOW_OFLAG_COPIED to optimize write performance.
56   - Size of compressed clusters is stored in sectors to reduce bit usage
57     in the cluster offsets.
58   - Support for storing additional data (such as the VM state) in the
59     snapshots.
60   - If a backing store is used, the cluster size is not constrained
61     (could be backported to QCOW).
62   - L2 tables have always a size of one cluster.
63 */
64 
65 
66 typedef struct {
67     uint32_t magic;
68     uint32_t len;
69 } QEMU_PACKED QCowExtension;
70 
71 #define  QCOW2_EXT_MAGIC_END 0
72 #define  QCOW2_EXT_MAGIC_BACKING_FORMAT 0xE2792ACA
73 #define  QCOW2_EXT_MAGIC_FEATURE_TABLE 0x6803f857
74 #define  QCOW2_EXT_MAGIC_CRYPTO_HEADER 0x0537be77
75 #define  QCOW2_EXT_MAGIC_BITMAPS 0x23852875
76 #define  QCOW2_EXT_MAGIC_DATA_FILE 0x44415441
77 
78 static int coroutine_fn
79 qcow2_co_preadv_compressed(BlockDriverState *bs,
80                            uint64_t file_cluster_offset,
81                            uint64_t offset,
82                            uint64_t bytes,
83                            QEMUIOVector *qiov);
84 
85 static int qcow2_probe(const uint8_t *buf, int buf_size, const char *filename)
86 {
87     const QCowHeader *cow_header = (const void *)buf;
88 
89     if (buf_size >= sizeof(QCowHeader) &&
90         be32_to_cpu(cow_header->magic) == QCOW_MAGIC &&
91         be32_to_cpu(cow_header->version) >= 2)
92         return 100;
93     else
94         return 0;
95 }
96 
97 
98 static ssize_t qcow2_crypto_hdr_read_func(QCryptoBlock *block, size_t offset,
99                                           uint8_t *buf, size_t buflen,
100                                           void *opaque, Error **errp)
101 {
102     BlockDriverState *bs = opaque;
103     BDRVQcow2State *s = bs->opaque;
104     ssize_t ret;
105 
106     if ((offset + buflen) > s->crypto_header.length) {
107         error_setg(errp, "Request for data outside of extension header");
108         return -1;
109     }
110 
111     ret = bdrv_pread(bs->file,
112                      s->crypto_header.offset + offset, buf, buflen);
113     if (ret < 0) {
114         error_setg_errno(errp, -ret, "Could not read encryption header");
115         return -1;
116     }
117     return ret;
118 }
119 
120 
121 static ssize_t qcow2_crypto_hdr_init_func(QCryptoBlock *block, size_t headerlen,
122                                           void *opaque, Error **errp)
123 {
124     BlockDriverState *bs = opaque;
125     BDRVQcow2State *s = bs->opaque;
126     int64_t ret;
127     int64_t clusterlen;
128 
129     ret = qcow2_alloc_clusters(bs, headerlen);
130     if (ret < 0) {
131         error_setg_errno(errp, -ret,
132                          "Cannot allocate cluster for LUKS header size %zu",
133                          headerlen);
134         return -1;
135     }
136 
137     s->crypto_header.length = headerlen;
138     s->crypto_header.offset = ret;
139 
140     /* Zero fill remaining space in cluster so it has predictable
141      * content in case of future spec changes */
142     clusterlen = size_to_clusters(s, headerlen) * s->cluster_size;
143     assert(qcow2_pre_write_overlap_check(bs, 0, ret, clusterlen, false) == 0);
144     ret = bdrv_pwrite_zeroes(bs->file,
145                              ret + headerlen,
146                              clusterlen - headerlen, 0);
147     if (ret < 0) {
148         error_setg_errno(errp, -ret, "Could not zero fill encryption header");
149         return -1;
150     }
151 
152     return ret;
153 }
154 
155 
156 static ssize_t qcow2_crypto_hdr_write_func(QCryptoBlock *block, size_t offset,
157                                            const uint8_t *buf, size_t buflen,
158                                            void *opaque, Error **errp)
159 {
160     BlockDriverState *bs = opaque;
161     BDRVQcow2State *s = bs->opaque;
162     ssize_t ret;
163 
164     if ((offset + buflen) > s->crypto_header.length) {
165         error_setg(errp, "Request for data outside of extension header");
166         return -1;
167     }
168 
169     ret = bdrv_pwrite(bs->file,
170                       s->crypto_header.offset + offset, buf, buflen);
171     if (ret < 0) {
172         error_setg_errno(errp, -ret, "Could not read encryption header");
173         return -1;
174     }
175     return ret;
176 }
177 
178 
179 /*
180  * read qcow2 extension and fill bs
181  * start reading from start_offset
182  * finish reading upon magic of value 0 or when end_offset reached
183  * unknown magic is skipped (future extension this version knows nothing about)
184  * return 0 upon success, non-0 otherwise
185  */
186 static int qcow2_read_extensions(BlockDriverState *bs, uint64_t start_offset,
187                                  uint64_t end_offset, void **p_feature_table,
188                                  int flags, bool *need_update_header,
189                                  Error **errp)
190 {
191     BDRVQcow2State *s = bs->opaque;
192     QCowExtension ext;
193     uint64_t offset;
194     int ret;
195     Qcow2BitmapHeaderExt bitmaps_ext;
196 
197     if (need_update_header != NULL) {
198         *need_update_header = false;
199     }
200 
201 #ifdef DEBUG_EXT
202     printf("qcow2_read_extensions: start=%ld end=%ld\n", start_offset, end_offset);
203 #endif
204     offset = start_offset;
205     while (offset < end_offset) {
206 
207 #ifdef DEBUG_EXT
208         /* Sanity check */
209         if (offset > s->cluster_size)
210             printf("qcow2_read_extension: suspicious offset %lu\n", offset);
211 
212         printf("attempting to read extended header in offset %lu\n", offset);
213 #endif
214 
215         ret = bdrv_pread(bs->file, offset, &ext, sizeof(ext));
216         if (ret < 0) {
217             error_setg_errno(errp, -ret, "qcow2_read_extension: ERROR: "
218                              "pread fail from offset %" PRIu64, offset);
219             return 1;
220         }
221         ext.magic = be32_to_cpu(ext.magic);
222         ext.len = be32_to_cpu(ext.len);
223         offset += sizeof(ext);
224 #ifdef DEBUG_EXT
225         printf("ext.magic = 0x%x\n", ext.magic);
226 #endif
227         if (offset > end_offset || ext.len > end_offset - offset) {
228             error_setg(errp, "Header extension too large");
229             return -EINVAL;
230         }
231 
232         switch (ext.magic) {
233         case QCOW2_EXT_MAGIC_END:
234             return 0;
235 
236         case QCOW2_EXT_MAGIC_BACKING_FORMAT:
237             if (ext.len >= sizeof(bs->backing_format)) {
238                 error_setg(errp, "ERROR: ext_backing_format: len=%" PRIu32
239                            " too large (>=%zu)", ext.len,
240                            sizeof(bs->backing_format));
241                 return 2;
242             }
243             ret = bdrv_pread(bs->file, offset, bs->backing_format, ext.len);
244             if (ret < 0) {
245                 error_setg_errno(errp, -ret, "ERROR: ext_backing_format: "
246                                  "Could not read format name");
247                 return 3;
248             }
249             bs->backing_format[ext.len] = '\0';
250             s->image_backing_format = g_strdup(bs->backing_format);
251 #ifdef DEBUG_EXT
252             printf("Qcow2: Got format extension %s\n", bs->backing_format);
253 #endif
254             break;
255 
256         case QCOW2_EXT_MAGIC_FEATURE_TABLE:
257             if (p_feature_table != NULL) {
258                 void* feature_table = g_malloc0(ext.len + 2 * sizeof(Qcow2Feature));
259                 ret = bdrv_pread(bs->file, offset , feature_table, ext.len);
260                 if (ret < 0) {
261                     error_setg_errno(errp, -ret, "ERROR: ext_feature_table: "
262                                      "Could not read table");
263                     return ret;
264                 }
265 
266                 *p_feature_table = feature_table;
267             }
268             break;
269 
270         case QCOW2_EXT_MAGIC_CRYPTO_HEADER: {
271             unsigned int cflags = 0;
272             if (s->crypt_method_header != QCOW_CRYPT_LUKS) {
273                 error_setg(errp, "CRYPTO header extension only "
274                            "expected with LUKS encryption method");
275                 return -EINVAL;
276             }
277             if (ext.len != sizeof(Qcow2CryptoHeaderExtension)) {
278                 error_setg(errp, "CRYPTO header extension size %u, "
279                            "but expected size %zu", ext.len,
280                            sizeof(Qcow2CryptoHeaderExtension));
281                 return -EINVAL;
282             }
283 
284             ret = bdrv_pread(bs->file, offset, &s->crypto_header, ext.len);
285             if (ret < 0) {
286                 error_setg_errno(errp, -ret,
287                                  "Unable to read CRYPTO header extension");
288                 return ret;
289             }
290             s->crypto_header.offset = be64_to_cpu(s->crypto_header.offset);
291             s->crypto_header.length = be64_to_cpu(s->crypto_header.length);
292 
293             if ((s->crypto_header.offset % s->cluster_size) != 0) {
294                 error_setg(errp, "Encryption header offset '%" PRIu64 "' is "
295                            "not a multiple of cluster size '%u'",
296                            s->crypto_header.offset, s->cluster_size);
297                 return -EINVAL;
298             }
299 
300             if (flags & BDRV_O_NO_IO) {
301                 cflags |= QCRYPTO_BLOCK_OPEN_NO_IO;
302             }
303             s->crypto = qcrypto_block_open(s->crypto_opts, "encrypt.",
304                                            qcow2_crypto_hdr_read_func,
305                                            bs, cflags, 1, errp);
306             if (!s->crypto) {
307                 return -EINVAL;
308             }
309         }   break;
310 
311         case QCOW2_EXT_MAGIC_BITMAPS:
312             if (ext.len != sizeof(bitmaps_ext)) {
313                 error_setg_errno(errp, -ret, "bitmaps_ext: "
314                                  "Invalid extension length");
315                 return -EINVAL;
316             }
317 
318             if (!(s->autoclear_features & QCOW2_AUTOCLEAR_BITMAPS)) {
319                 if (s->qcow_version < 3) {
320                     /* Let's be a bit more specific */
321                     warn_report("This qcow2 v2 image contains bitmaps, but "
322                                 "they may have been modified by a program "
323                                 "without persistent bitmap support; so now "
324                                 "they must all be considered inconsistent");
325                 } else {
326                     warn_report("a program lacking bitmap support "
327                                 "modified this file, so all bitmaps are now "
328                                 "considered inconsistent");
329                 }
330                 error_printf("Some clusters may be leaked, "
331                              "run 'qemu-img check -r' on the image "
332                              "file to fix.");
333                 if (need_update_header != NULL) {
334                     /* Updating is needed to drop invalid bitmap extension. */
335                     *need_update_header = true;
336                 }
337                 break;
338             }
339 
340             ret = bdrv_pread(bs->file, offset, &bitmaps_ext, ext.len);
341             if (ret < 0) {
342                 error_setg_errno(errp, -ret, "bitmaps_ext: "
343                                  "Could not read ext header");
344                 return ret;
345             }
346 
347             if (bitmaps_ext.reserved32 != 0) {
348                 error_setg_errno(errp, -ret, "bitmaps_ext: "
349                                  "Reserved field is not zero");
350                 return -EINVAL;
351             }
352 
353             bitmaps_ext.nb_bitmaps = be32_to_cpu(bitmaps_ext.nb_bitmaps);
354             bitmaps_ext.bitmap_directory_size =
355                 be64_to_cpu(bitmaps_ext.bitmap_directory_size);
356             bitmaps_ext.bitmap_directory_offset =
357                 be64_to_cpu(bitmaps_ext.bitmap_directory_offset);
358 
359             if (bitmaps_ext.nb_bitmaps > QCOW2_MAX_BITMAPS) {
360                 error_setg(errp,
361                            "bitmaps_ext: Image has %" PRIu32 " bitmaps, "
362                            "exceeding the QEMU supported maximum of %d",
363                            bitmaps_ext.nb_bitmaps, QCOW2_MAX_BITMAPS);
364                 return -EINVAL;
365             }
366 
367             if (bitmaps_ext.nb_bitmaps == 0) {
368                 error_setg(errp, "found bitmaps extension with zero bitmaps");
369                 return -EINVAL;
370             }
371 
372             if (bitmaps_ext.bitmap_directory_offset & (s->cluster_size - 1)) {
373                 error_setg(errp, "bitmaps_ext: "
374                                  "invalid bitmap directory offset");
375                 return -EINVAL;
376             }
377 
378             if (bitmaps_ext.bitmap_directory_size >
379                 QCOW2_MAX_BITMAP_DIRECTORY_SIZE) {
380                 error_setg(errp, "bitmaps_ext: "
381                                  "bitmap directory size (%" PRIu64 ") exceeds "
382                                  "the maximum supported size (%d)",
383                                  bitmaps_ext.bitmap_directory_size,
384                                  QCOW2_MAX_BITMAP_DIRECTORY_SIZE);
385                 return -EINVAL;
386             }
387 
388             s->nb_bitmaps = bitmaps_ext.nb_bitmaps;
389             s->bitmap_directory_offset =
390                     bitmaps_ext.bitmap_directory_offset;
391             s->bitmap_directory_size =
392                     bitmaps_ext.bitmap_directory_size;
393 
394 #ifdef DEBUG_EXT
395             printf("Qcow2: Got bitmaps extension: "
396                    "offset=%" PRIu64 " nb_bitmaps=%" PRIu32 "\n",
397                    s->bitmap_directory_offset, s->nb_bitmaps);
398 #endif
399             break;
400 
401         case QCOW2_EXT_MAGIC_DATA_FILE:
402         {
403             s->image_data_file = g_malloc0(ext.len + 1);
404             ret = bdrv_pread(bs->file, offset, s->image_data_file, ext.len);
405             if (ret < 0) {
406                 error_setg_errno(errp, -ret,
407                                  "ERROR: Could not read data file name");
408                 return ret;
409             }
410 #ifdef DEBUG_EXT
411             printf("Qcow2: Got external data file %s\n", s->image_data_file);
412 #endif
413             break;
414         }
415 
416         default:
417             /* unknown magic - save it in case we need to rewrite the header */
418             /* If you add a new feature, make sure to also update the fast
419              * path of qcow2_make_empty() to deal with it. */
420             {
421                 Qcow2UnknownHeaderExtension *uext;
422 
423                 uext = g_malloc0(sizeof(*uext)  + ext.len);
424                 uext->magic = ext.magic;
425                 uext->len = ext.len;
426                 QLIST_INSERT_HEAD(&s->unknown_header_ext, uext, next);
427 
428                 ret = bdrv_pread(bs->file, offset , uext->data, uext->len);
429                 if (ret < 0) {
430                     error_setg_errno(errp, -ret, "ERROR: unknown extension: "
431                                      "Could not read data");
432                     return ret;
433                 }
434             }
435             break;
436         }
437 
438         offset += ((ext.len + 7) & ~7);
439     }
440 
441     return 0;
442 }
443 
444 static void cleanup_unknown_header_ext(BlockDriverState *bs)
445 {
446     BDRVQcow2State *s = bs->opaque;
447     Qcow2UnknownHeaderExtension *uext, *next;
448 
449     QLIST_FOREACH_SAFE(uext, &s->unknown_header_ext, next, next) {
450         QLIST_REMOVE(uext, next);
451         g_free(uext);
452     }
453 }
454 
455 static void report_unsupported_feature(Error **errp, Qcow2Feature *table,
456                                        uint64_t mask)
457 {
458     char *features = g_strdup("");
459     char *old;
460 
461     while (table && table->name[0] != '\0') {
462         if (table->type == QCOW2_FEAT_TYPE_INCOMPATIBLE) {
463             if (mask & (1ULL << table->bit)) {
464                 old = features;
465                 features = g_strdup_printf("%s%s%.46s", old, *old ? ", " : "",
466                                            table->name);
467                 g_free(old);
468                 mask &= ~(1ULL << table->bit);
469             }
470         }
471         table++;
472     }
473 
474     if (mask) {
475         old = features;
476         features = g_strdup_printf("%s%sUnknown incompatible feature: %" PRIx64,
477                                    old, *old ? ", " : "", mask);
478         g_free(old);
479     }
480 
481     error_setg(errp, "Unsupported qcow2 feature(s): %s", features);
482     g_free(features);
483 }
484 
485 /*
486  * Sets the dirty bit and flushes afterwards if necessary.
487  *
488  * The incompatible_features bit is only set if the image file header was
489  * updated successfully.  Therefore it is not required to check the return
490  * value of this function.
491  */
492 int qcow2_mark_dirty(BlockDriverState *bs)
493 {
494     BDRVQcow2State *s = bs->opaque;
495     uint64_t val;
496     int ret;
497 
498     assert(s->qcow_version >= 3);
499 
500     if (s->incompatible_features & QCOW2_INCOMPAT_DIRTY) {
501         return 0; /* already dirty */
502     }
503 
504     val = cpu_to_be64(s->incompatible_features | QCOW2_INCOMPAT_DIRTY);
505     ret = bdrv_pwrite(bs->file, offsetof(QCowHeader, incompatible_features),
506                       &val, sizeof(val));
507     if (ret < 0) {
508         return ret;
509     }
510     ret = bdrv_flush(bs->file->bs);
511     if (ret < 0) {
512         return ret;
513     }
514 
515     /* Only treat image as dirty if the header was updated successfully */
516     s->incompatible_features |= QCOW2_INCOMPAT_DIRTY;
517     return 0;
518 }
519 
520 /*
521  * Clears the dirty bit and flushes before if necessary.  Only call this
522  * function when there are no pending requests, it does not guard against
523  * concurrent requests dirtying the image.
524  */
525 static int qcow2_mark_clean(BlockDriverState *bs)
526 {
527     BDRVQcow2State *s = bs->opaque;
528 
529     if (s->incompatible_features & QCOW2_INCOMPAT_DIRTY) {
530         int ret;
531 
532         s->incompatible_features &= ~QCOW2_INCOMPAT_DIRTY;
533 
534         ret = qcow2_flush_caches(bs);
535         if (ret < 0) {
536             return ret;
537         }
538 
539         return qcow2_update_header(bs);
540     }
541     return 0;
542 }
543 
544 /*
545  * Marks the image as corrupt.
546  */
547 int qcow2_mark_corrupt(BlockDriverState *bs)
548 {
549     BDRVQcow2State *s = bs->opaque;
550 
551     s->incompatible_features |= QCOW2_INCOMPAT_CORRUPT;
552     return qcow2_update_header(bs);
553 }
554 
555 /*
556  * Marks the image as consistent, i.e., unsets the corrupt bit, and flushes
557  * before if necessary.
558  */
559 int qcow2_mark_consistent(BlockDriverState *bs)
560 {
561     BDRVQcow2State *s = bs->opaque;
562 
563     if (s->incompatible_features & QCOW2_INCOMPAT_CORRUPT) {
564         int ret = qcow2_flush_caches(bs);
565         if (ret < 0) {
566             return ret;
567         }
568 
569         s->incompatible_features &= ~QCOW2_INCOMPAT_CORRUPT;
570         return qcow2_update_header(bs);
571     }
572     return 0;
573 }
574 
575 static int coroutine_fn qcow2_co_check_locked(BlockDriverState *bs,
576                                               BdrvCheckResult *result,
577                                               BdrvCheckMode fix)
578 {
579     int ret = qcow2_check_refcounts(bs, result, fix);
580     if (ret < 0) {
581         return ret;
582     }
583 
584     if (fix && result->check_errors == 0 && result->corruptions == 0) {
585         ret = qcow2_mark_clean(bs);
586         if (ret < 0) {
587             return ret;
588         }
589         return qcow2_mark_consistent(bs);
590     }
591     return ret;
592 }
593 
594 static int coroutine_fn qcow2_co_check(BlockDriverState *bs,
595                                        BdrvCheckResult *result,
596                                        BdrvCheckMode fix)
597 {
598     BDRVQcow2State *s = bs->opaque;
599     int ret;
600 
601     qemu_co_mutex_lock(&s->lock);
602     ret = qcow2_co_check_locked(bs, result, fix);
603     qemu_co_mutex_unlock(&s->lock);
604     return ret;
605 }
606 
607 int qcow2_validate_table(BlockDriverState *bs, uint64_t offset,
608                          uint64_t entries, size_t entry_len,
609                          int64_t max_size_bytes, const char *table_name,
610                          Error **errp)
611 {
612     BDRVQcow2State *s = bs->opaque;
613 
614     if (entries > max_size_bytes / entry_len) {
615         error_setg(errp, "%s too large", table_name);
616         return -EFBIG;
617     }
618 
619     /* Use signed INT64_MAX as the maximum even for uint64_t header fields,
620      * because values will be passed to qemu functions taking int64_t. */
621     if ((INT64_MAX - entries * entry_len < offset) ||
622         (offset_into_cluster(s, offset) != 0)) {
623         error_setg(errp, "%s offset invalid", table_name);
624         return -EINVAL;
625     }
626 
627     return 0;
628 }
629 
630 static const char *const mutable_opts[] = {
631     QCOW2_OPT_LAZY_REFCOUNTS,
632     QCOW2_OPT_DISCARD_REQUEST,
633     QCOW2_OPT_DISCARD_SNAPSHOT,
634     QCOW2_OPT_DISCARD_OTHER,
635     QCOW2_OPT_OVERLAP,
636     QCOW2_OPT_OVERLAP_TEMPLATE,
637     QCOW2_OPT_OVERLAP_MAIN_HEADER,
638     QCOW2_OPT_OVERLAP_ACTIVE_L1,
639     QCOW2_OPT_OVERLAP_ACTIVE_L2,
640     QCOW2_OPT_OVERLAP_REFCOUNT_TABLE,
641     QCOW2_OPT_OVERLAP_REFCOUNT_BLOCK,
642     QCOW2_OPT_OVERLAP_SNAPSHOT_TABLE,
643     QCOW2_OPT_OVERLAP_INACTIVE_L1,
644     QCOW2_OPT_OVERLAP_INACTIVE_L2,
645     QCOW2_OPT_OVERLAP_BITMAP_DIRECTORY,
646     QCOW2_OPT_CACHE_SIZE,
647     QCOW2_OPT_L2_CACHE_SIZE,
648     QCOW2_OPT_L2_CACHE_ENTRY_SIZE,
649     QCOW2_OPT_REFCOUNT_CACHE_SIZE,
650     QCOW2_OPT_CACHE_CLEAN_INTERVAL,
651     NULL
652 };
653 
654 static QemuOptsList qcow2_runtime_opts = {
655     .name = "qcow2",
656     .head = QTAILQ_HEAD_INITIALIZER(qcow2_runtime_opts.head),
657     .desc = {
658         {
659             .name = QCOW2_OPT_LAZY_REFCOUNTS,
660             .type = QEMU_OPT_BOOL,
661             .help = "Postpone refcount updates",
662         },
663         {
664             .name = QCOW2_OPT_DISCARD_REQUEST,
665             .type = QEMU_OPT_BOOL,
666             .help = "Pass guest discard requests to the layer below",
667         },
668         {
669             .name = QCOW2_OPT_DISCARD_SNAPSHOT,
670             .type = QEMU_OPT_BOOL,
671             .help = "Generate discard requests when snapshot related space "
672                     "is freed",
673         },
674         {
675             .name = QCOW2_OPT_DISCARD_OTHER,
676             .type = QEMU_OPT_BOOL,
677             .help = "Generate discard requests when other clusters are freed",
678         },
679         {
680             .name = QCOW2_OPT_OVERLAP,
681             .type = QEMU_OPT_STRING,
682             .help = "Selects which overlap checks to perform from a range of "
683                     "templates (none, constant, cached, all)",
684         },
685         {
686             .name = QCOW2_OPT_OVERLAP_TEMPLATE,
687             .type = QEMU_OPT_STRING,
688             .help = "Selects which overlap checks to perform from a range of "
689                     "templates (none, constant, cached, all)",
690         },
691         {
692             .name = QCOW2_OPT_OVERLAP_MAIN_HEADER,
693             .type = QEMU_OPT_BOOL,
694             .help = "Check for unintended writes into the main qcow2 header",
695         },
696         {
697             .name = QCOW2_OPT_OVERLAP_ACTIVE_L1,
698             .type = QEMU_OPT_BOOL,
699             .help = "Check for unintended writes into the active L1 table",
700         },
701         {
702             .name = QCOW2_OPT_OVERLAP_ACTIVE_L2,
703             .type = QEMU_OPT_BOOL,
704             .help = "Check for unintended writes into an active L2 table",
705         },
706         {
707             .name = QCOW2_OPT_OVERLAP_REFCOUNT_TABLE,
708             .type = QEMU_OPT_BOOL,
709             .help = "Check for unintended writes into the refcount table",
710         },
711         {
712             .name = QCOW2_OPT_OVERLAP_REFCOUNT_BLOCK,
713             .type = QEMU_OPT_BOOL,
714             .help = "Check for unintended writes into a refcount block",
715         },
716         {
717             .name = QCOW2_OPT_OVERLAP_SNAPSHOT_TABLE,
718             .type = QEMU_OPT_BOOL,
719             .help = "Check for unintended writes into the snapshot table",
720         },
721         {
722             .name = QCOW2_OPT_OVERLAP_INACTIVE_L1,
723             .type = QEMU_OPT_BOOL,
724             .help = "Check for unintended writes into an inactive L1 table",
725         },
726         {
727             .name = QCOW2_OPT_OVERLAP_INACTIVE_L2,
728             .type = QEMU_OPT_BOOL,
729             .help = "Check for unintended writes into an inactive L2 table",
730         },
731         {
732             .name = QCOW2_OPT_OVERLAP_BITMAP_DIRECTORY,
733             .type = QEMU_OPT_BOOL,
734             .help = "Check for unintended writes into the bitmap directory",
735         },
736         {
737             .name = QCOW2_OPT_CACHE_SIZE,
738             .type = QEMU_OPT_SIZE,
739             .help = "Maximum combined metadata (L2 tables and refcount blocks) "
740                     "cache size",
741         },
742         {
743             .name = QCOW2_OPT_L2_CACHE_SIZE,
744             .type = QEMU_OPT_SIZE,
745             .help = "Maximum L2 table cache size",
746         },
747         {
748             .name = QCOW2_OPT_L2_CACHE_ENTRY_SIZE,
749             .type = QEMU_OPT_SIZE,
750             .help = "Size of each entry in the L2 cache",
751         },
752         {
753             .name = QCOW2_OPT_REFCOUNT_CACHE_SIZE,
754             .type = QEMU_OPT_SIZE,
755             .help = "Maximum refcount block cache size",
756         },
757         {
758             .name = QCOW2_OPT_CACHE_CLEAN_INTERVAL,
759             .type = QEMU_OPT_NUMBER,
760             .help = "Clean unused cache entries after this time (in seconds)",
761         },
762         BLOCK_CRYPTO_OPT_DEF_KEY_SECRET("encrypt.",
763             "ID of secret providing qcow2 AES key or LUKS passphrase"),
764         { /* end of list */ }
765     },
766 };
767 
768 static const char *overlap_bool_option_names[QCOW2_OL_MAX_BITNR] = {
769     [QCOW2_OL_MAIN_HEADER_BITNR]      = QCOW2_OPT_OVERLAP_MAIN_HEADER,
770     [QCOW2_OL_ACTIVE_L1_BITNR]        = QCOW2_OPT_OVERLAP_ACTIVE_L1,
771     [QCOW2_OL_ACTIVE_L2_BITNR]        = QCOW2_OPT_OVERLAP_ACTIVE_L2,
772     [QCOW2_OL_REFCOUNT_TABLE_BITNR]   = QCOW2_OPT_OVERLAP_REFCOUNT_TABLE,
773     [QCOW2_OL_REFCOUNT_BLOCK_BITNR]   = QCOW2_OPT_OVERLAP_REFCOUNT_BLOCK,
774     [QCOW2_OL_SNAPSHOT_TABLE_BITNR]   = QCOW2_OPT_OVERLAP_SNAPSHOT_TABLE,
775     [QCOW2_OL_INACTIVE_L1_BITNR]      = QCOW2_OPT_OVERLAP_INACTIVE_L1,
776     [QCOW2_OL_INACTIVE_L2_BITNR]      = QCOW2_OPT_OVERLAP_INACTIVE_L2,
777     [QCOW2_OL_BITMAP_DIRECTORY_BITNR] = QCOW2_OPT_OVERLAP_BITMAP_DIRECTORY,
778 };
779 
780 static void cache_clean_timer_cb(void *opaque)
781 {
782     BlockDriverState *bs = opaque;
783     BDRVQcow2State *s = bs->opaque;
784     qcow2_cache_clean_unused(s->l2_table_cache);
785     qcow2_cache_clean_unused(s->refcount_block_cache);
786     timer_mod(s->cache_clean_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) +
787               (int64_t) s->cache_clean_interval * 1000);
788 }
789 
790 static void cache_clean_timer_init(BlockDriverState *bs, AioContext *context)
791 {
792     BDRVQcow2State *s = bs->opaque;
793     if (s->cache_clean_interval > 0) {
794         s->cache_clean_timer = aio_timer_new(context, QEMU_CLOCK_VIRTUAL,
795                                              SCALE_MS, cache_clean_timer_cb,
796                                              bs);
797         timer_mod(s->cache_clean_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) +
798                   (int64_t) s->cache_clean_interval * 1000);
799     }
800 }
801 
802 static void cache_clean_timer_del(BlockDriverState *bs)
803 {
804     BDRVQcow2State *s = bs->opaque;
805     if (s->cache_clean_timer) {
806         timer_del(s->cache_clean_timer);
807         timer_free(s->cache_clean_timer);
808         s->cache_clean_timer = NULL;
809     }
810 }
811 
812 static void qcow2_detach_aio_context(BlockDriverState *bs)
813 {
814     cache_clean_timer_del(bs);
815 }
816 
817 static void qcow2_attach_aio_context(BlockDriverState *bs,
818                                      AioContext *new_context)
819 {
820     cache_clean_timer_init(bs, new_context);
821 }
822 
823 static void read_cache_sizes(BlockDriverState *bs, QemuOpts *opts,
824                              uint64_t *l2_cache_size,
825                              uint64_t *l2_cache_entry_size,
826                              uint64_t *refcount_cache_size, Error **errp)
827 {
828     BDRVQcow2State *s = bs->opaque;
829     uint64_t combined_cache_size, l2_cache_max_setting;
830     bool l2_cache_size_set, refcount_cache_size_set, combined_cache_size_set;
831     bool l2_cache_entry_size_set;
832     int min_refcount_cache = MIN_REFCOUNT_CACHE_SIZE * s->cluster_size;
833     uint64_t virtual_disk_size = bs->total_sectors * BDRV_SECTOR_SIZE;
834     uint64_t max_l2_cache = virtual_disk_size / (s->cluster_size / 8);
835 
836     combined_cache_size_set = qemu_opt_get(opts, QCOW2_OPT_CACHE_SIZE);
837     l2_cache_size_set = qemu_opt_get(opts, QCOW2_OPT_L2_CACHE_SIZE);
838     refcount_cache_size_set = qemu_opt_get(opts, QCOW2_OPT_REFCOUNT_CACHE_SIZE);
839     l2_cache_entry_size_set = qemu_opt_get(opts, QCOW2_OPT_L2_CACHE_ENTRY_SIZE);
840 
841     combined_cache_size = qemu_opt_get_size(opts, QCOW2_OPT_CACHE_SIZE, 0);
842     l2_cache_max_setting = qemu_opt_get_size(opts, QCOW2_OPT_L2_CACHE_SIZE,
843                                              DEFAULT_L2_CACHE_MAX_SIZE);
844     *refcount_cache_size = qemu_opt_get_size(opts,
845                                              QCOW2_OPT_REFCOUNT_CACHE_SIZE, 0);
846 
847     *l2_cache_entry_size = qemu_opt_get_size(
848         opts, QCOW2_OPT_L2_CACHE_ENTRY_SIZE, s->cluster_size);
849 
850     *l2_cache_size = MIN(max_l2_cache, l2_cache_max_setting);
851 
852     if (combined_cache_size_set) {
853         if (l2_cache_size_set && refcount_cache_size_set) {
854             error_setg(errp, QCOW2_OPT_CACHE_SIZE ", " QCOW2_OPT_L2_CACHE_SIZE
855                        " and " QCOW2_OPT_REFCOUNT_CACHE_SIZE " may not be set "
856                        "at the same time");
857             return;
858         } else if (l2_cache_size_set &&
859                    (l2_cache_max_setting > combined_cache_size)) {
860             error_setg(errp, QCOW2_OPT_L2_CACHE_SIZE " may not exceed "
861                        QCOW2_OPT_CACHE_SIZE);
862             return;
863         } else if (*refcount_cache_size > combined_cache_size) {
864             error_setg(errp, QCOW2_OPT_REFCOUNT_CACHE_SIZE " may not exceed "
865                        QCOW2_OPT_CACHE_SIZE);
866             return;
867         }
868 
869         if (l2_cache_size_set) {
870             *refcount_cache_size = combined_cache_size - *l2_cache_size;
871         } else if (refcount_cache_size_set) {
872             *l2_cache_size = combined_cache_size - *refcount_cache_size;
873         } else {
874             /* Assign as much memory as possible to the L2 cache, and
875              * use the remainder for the refcount cache */
876             if (combined_cache_size >= max_l2_cache + min_refcount_cache) {
877                 *l2_cache_size = max_l2_cache;
878                 *refcount_cache_size = combined_cache_size - *l2_cache_size;
879             } else {
880                 *refcount_cache_size =
881                     MIN(combined_cache_size, min_refcount_cache);
882                 *l2_cache_size = combined_cache_size - *refcount_cache_size;
883             }
884         }
885     }
886 
887     /*
888      * If the L2 cache is not enough to cover the whole disk then
889      * default to 4KB entries. Smaller entries reduce the cost of
890      * loads and evictions and increase I/O performance.
891      */
892     if (*l2_cache_size < max_l2_cache && !l2_cache_entry_size_set) {
893         *l2_cache_entry_size = MIN(s->cluster_size, 4096);
894     }
895 
896     /* l2_cache_size and refcount_cache_size are ensured to have at least
897      * their minimum values in qcow2_update_options_prepare() */
898 
899     if (*l2_cache_entry_size < (1 << MIN_CLUSTER_BITS) ||
900         *l2_cache_entry_size > s->cluster_size ||
901         !is_power_of_2(*l2_cache_entry_size)) {
902         error_setg(errp, "L2 cache entry size must be a power of two "
903                    "between %d and the cluster size (%d)",
904                    1 << MIN_CLUSTER_BITS, s->cluster_size);
905         return;
906     }
907 }
908 
909 typedef struct Qcow2ReopenState {
910     Qcow2Cache *l2_table_cache;
911     Qcow2Cache *refcount_block_cache;
912     int l2_slice_size; /* Number of entries in a slice of the L2 table */
913     bool use_lazy_refcounts;
914     int overlap_check;
915     bool discard_passthrough[QCOW2_DISCARD_MAX];
916     uint64_t cache_clean_interval;
917     QCryptoBlockOpenOptions *crypto_opts; /* Disk encryption runtime options */
918 } Qcow2ReopenState;
919 
920 static int qcow2_update_options_prepare(BlockDriverState *bs,
921                                         Qcow2ReopenState *r,
922                                         QDict *options, int flags,
923                                         Error **errp)
924 {
925     BDRVQcow2State *s = bs->opaque;
926     QemuOpts *opts = NULL;
927     const char *opt_overlap_check, *opt_overlap_check_template;
928     int overlap_check_template = 0;
929     uint64_t l2_cache_size, l2_cache_entry_size, refcount_cache_size;
930     int i;
931     const char *encryptfmt;
932     QDict *encryptopts = NULL;
933     Error *local_err = NULL;
934     int ret;
935 
936     qdict_extract_subqdict(options, &encryptopts, "encrypt.");
937     encryptfmt = qdict_get_try_str(encryptopts, "format");
938 
939     opts = qemu_opts_create(&qcow2_runtime_opts, NULL, 0, &error_abort);
940     qemu_opts_absorb_qdict(opts, options, &local_err);
941     if (local_err) {
942         error_propagate(errp, local_err);
943         ret = -EINVAL;
944         goto fail;
945     }
946 
947     /* get L2 table/refcount block cache size from command line options */
948     read_cache_sizes(bs, opts, &l2_cache_size, &l2_cache_entry_size,
949                      &refcount_cache_size, &local_err);
950     if (local_err) {
951         error_propagate(errp, local_err);
952         ret = -EINVAL;
953         goto fail;
954     }
955 
956     l2_cache_size /= l2_cache_entry_size;
957     if (l2_cache_size < MIN_L2_CACHE_SIZE) {
958         l2_cache_size = MIN_L2_CACHE_SIZE;
959     }
960     if (l2_cache_size > INT_MAX) {
961         error_setg(errp, "L2 cache size too big");
962         ret = -EINVAL;
963         goto fail;
964     }
965 
966     refcount_cache_size /= s->cluster_size;
967     if (refcount_cache_size < MIN_REFCOUNT_CACHE_SIZE) {
968         refcount_cache_size = MIN_REFCOUNT_CACHE_SIZE;
969     }
970     if (refcount_cache_size > INT_MAX) {
971         error_setg(errp, "Refcount cache size too big");
972         ret = -EINVAL;
973         goto fail;
974     }
975 
976     /* alloc new L2 table/refcount block cache, flush old one */
977     if (s->l2_table_cache) {
978         ret = qcow2_cache_flush(bs, s->l2_table_cache);
979         if (ret) {
980             error_setg_errno(errp, -ret, "Failed to flush the L2 table cache");
981             goto fail;
982         }
983     }
984 
985     if (s->refcount_block_cache) {
986         ret = qcow2_cache_flush(bs, s->refcount_block_cache);
987         if (ret) {
988             error_setg_errno(errp, -ret,
989                              "Failed to flush the refcount block cache");
990             goto fail;
991         }
992     }
993 
994     r->l2_slice_size = l2_cache_entry_size / sizeof(uint64_t);
995     r->l2_table_cache = qcow2_cache_create(bs, l2_cache_size,
996                                            l2_cache_entry_size);
997     r->refcount_block_cache = qcow2_cache_create(bs, refcount_cache_size,
998                                                  s->cluster_size);
999     if (r->l2_table_cache == NULL || r->refcount_block_cache == NULL) {
1000         error_setg(errp, "Could not allocate metadata caches");
1001         ret = -ENOMEM;
1002         goto fail;
1003     }
1004 
1005     /* New interval for cache cleanup timer */
1006     r->cache_clean_interval =
1007         qemu_opt_get_number(opts, QCOW2_OPT_CACHE_CLEAN_INTERVAL,
1008                             DEFAULT_CACHE_CLEAN_INTERVAL);
1009 #ifndef CONFIG_LINUX
1010     if (r->cache_clean_interval != 0) {
1011         error_setg(errp, QCOW2_OPT_CACHE_CLEAN_INTERVAL
1012                    " not supported on this host");
1013         ret = -EINVAL;
1014         goto fail;
1015     }
1016 #endif
1017     if (r->cache_clean_interval > UINT_MAX) {
1018         error_setg(errp, "Cache clean interval too big");
1019         ret = -EINVAL;
1020         goto fail;
1021     }
1022 
1023     /* lazy-refcounts; flush if going from enabled to disabled */
1024     r->use_lazy_refcounts = qemu_opt_get_bool(opts, QCOW2_OPT_LAZY_REFCOUNTS,
1025         (s->compatible_features & QCOW2_COMPAT_LAZY_REFCOUNTS));
1026     if (r->use_lazy_refcounts && s->qcow_version < 3) {
1027         error_setg(errp, "Lazy refcounts require a qcow2 image with at least "
1028                    "qemu 1.1 compatibility level");
1029         ret = -EINVAL;
1030         goto fail;
1031     }
1032 
1033     if (s->use_lazy_refcounts && !r->use_lazy_refcounts) {
1034         ret = qcow2_mark_clean(bs);
1035         if (ret < 0) {
1036             error_setg_errno(errp, -ret, "Failed to disable lazy refcounts");
1037             goto fail;
1038         }
1039     }
1040 
1041     /* Overlap check options */
1042     opt_overlap_check = qemu_opt_get(opts, QCOW2_OPT_OVERLAP);
1043     opt_overlap_check_template = qemu_opt_get(opts, QCOW2_OPT_OVERLAP_TEMPLATE);
1044     if (opt_overlap_check_template && opt_overlap_check &&
1045         strcmp(opt_overlap_check_template, opt_overlap_check))
1046     {
1047         error_setg(errp, "Conflicting values for qcow2 options '"
1048                    QCOW2_OPT_OVERLAP "' ('%s') and '" QCOW2_OPT_OVERLAP_TEMPLATE
1049                    "' ('%s')", opt_overlap_check, opt_overlap_check_template);
1050         ret = -EINVAL;
1051         goto fail;
1052     }
1053     if (!opt_overlap_check) {
1054         opt_overlap_check = opt_overlap_check_template ?: "cached";
1055     }
1056 
1057     if (!strcmp(opt_overlap_check, "none")) {
1058         overlap_check_template = 0;
1059     } else if (!strcmp(opt_overlap_check, "constant")) {
1060         overlap_check_template = QCOW2_OL_CONSTANT;
1061     } else if (!strcmp(opt_overlap_check, "cached")) {
1062         overlap_check_template = QCOW2_OL_CACHED;
1063     } else if (!strcmp(opt_overlap_check, "all")) {
1064         overlap_check_template = QCOW2_OL_ALL;
1065     } else {
1066         error_setg(errp, "Unsupported value '%s' for qcow2 option "
1067                    "'overlap-check'. Allowed are any of the following: "
1068                    "none, constant, cached, all", opt_overlap_check);
1069         ret = -EINVAL;
1070         goto fail;
1071     }
1072 
1073     r->overlap_check = 0;
1074     for (i = 0; i < QCOW2_OL_MAX_BITNR; i++) {
1075         /* overlap-check defines a template bitmask, but every flag may be
1076          * overwritten through the associated boolean option */
1077         r->overlap_check |=
1078             qemu_opt_get_bool(opts, overlap_bool_option_names[i],
1079                               overlap_check_template & (1 << i)) << i;
1080     }
1081 
1082     r->discard_passthrough[QCOW2_DISCARD_NEVER] = false;
1083     r->discard_passthrough[QCOW2_DISCARD_ALWAYS] = true;
1084     r->discard_passthrough[QCOW2_DISCARD_REQUEST] =
1085         qemu_opt_get_bool(opts, QCOW2_OPT_DISCARD_REQUEST,
1086                           flags & BDRV_O_UNMAP);
1087     r->discard_passthrough[QCOW2_DISCARD_SNAPSHOT] =
1088         qemu_opt_get_bool(opts, QCOW2_OPT_DISCARD_SNAPSHOT, true);
1089     r->discard_passthrough[QCOW2_DISCARD_OTHER] =
1090         qemu_opt_get_bool(opts, QCOW2_OPT_DISCARD_OTHER, false);
1091 
1092     switch (s->crypt_method_header) {
1093     case QCOW_CRYPT_NONE:
1094         if (encryptfmt) {
1095             error_setg(errp, "No encryption in image header, but options "
1096                        "specified format '%s'", encryptfmt);
1097             ret = -EINVAL;
1098             goto fail;
1099         }
1100         break;
1101 
1102     case QCOW_CRYPT_AES:
1103         if (encryptfmt && !g_str_equal(encryptfmt, "aes")) {
1104             error_setg(errp,
1105                        "Header reported 'aes' encryption format but "
1106                        "options specify '%s'", encryptfmt);
1107             ret = -EINVAL;
1108             goto fail;
1109         }
1110         qdict_put_str(encryptopts, "format", "qcow");
1111         r->crypto_opts = block_crypto_open_opts_init(encryptopts, errp);
1112         break;
1113 
1114     case QCOW_CRYPT_LUKS:
1115         if (encryptfmt && !g_str_equal(encryptfmt, "luks")) {
1116             error_setg(errp,
1117                        "Header reported 'luks' encryption format but "
1118                        "options specify '%s'", encryptfmt);
1119             ret = -EINVAL;
1120             goto fail;
1121         }
1122         qdict_put_str(encryptopts, "format", "luks");
1123         r->crypto_opts = block_crypto_open_opts_init(encryptopts, errp);
1124         break;
1125 
1126     default:
1127         error_setg(errp, "Unsupported encryption method %d",
1128                    s->crypt_method_header);
1129         break;
1130     }
1131     if (s->crypt_method_header != QCOW_CRYPT_NONE && !r->crypto_opts) {
1132         ret = -EINVAL;
1133         goto fail;
1134     }
1135 
1136     ret = 0;
1137 fail:
1138     qobject_unref(encryptopts);
1139     qemu_opts_del(opts);
1140     opts = NULL;
1141     return ret;
1142 }
1143 
1144 static void qcow2_update_options_commit(BlockDriverState *bs,
1145                                         Qcow2ReopenState *r)
1146 {
1147     BDRVQcow2State *s = bs->opaque;
1148     int i;
1149 
1150     if (s->l2_table_cache) {
1151         qcow2_cache_destroy(s->l2_table_cache);
1152     }
1153     if (s->refcount_block_cache) {
1154         qcow2_cache_destroy(s->refcount_block_cache);
1155     }
1156     s->l2_table_cache = r->l2_table_cache;
1157     s->refcount_block_cache = r->refcount_block_cache;
1158     s->l2_slice_size = r->l2_slice_size;
1159 
1160     s->overlap_check = r->overlap_check;
1161     s->use_lazy_refcounts = r->use_lazy_refcounts;
1162 
1163     for (i = 0; i < QCOW2_DISCARD_MAX; i++) {
1164         s->discard_passthrough[i] = r->discard_passthrough[i];
1165     }
1166 
1167     if (s->cache_clean_interval != r->cache_clean_interval) {
1168         cache_clean_timer_del(bs);
1169         s->cache_clean_interval = r->cache_clean_interval;
1170         cache_clean_timer_init(bs, bdrv_get_aio_context(bs));
1171     }
1172 
1173     qapi_free_QCryptoBlockOpenOptions(s->crypto_opts);
1174     s->crypto_opts = r->crypto_opts;
1175 }
1176 
1177 static void qcow2_update_options_abort(BlockDriverState *bs,
1178                                        Qcow2ReopenState *r)
1179 {
1180     if (r->l2_table_cache) {
1181         qcow2_cache_destroy(r->l2_table_cache);
1182     }
1183     if (r->refcount_block_cache) {
1184         qcow2_cache_destroy(r->refcount_block_cache);
1185     }
1186     qapi_free_QCryptoBlockOpenOptions(r->crypto_opts);
1187 }
1188 
1189 static int qcow2_update_options(BlockDriverState *bs, QDict *options,
1190                                 int flags, Error **errp)
1191 {
1192     Qcow2ReopenState r = {};
1193     int ret;
1194 
1195     ret = qcow2_update_options_prepare(bs, &r, options, flags, errp);
1196     if (ret >= 0) {
1197         qcow2_update_options_commit(bs, &r);
1198     } else {
1199         qcow2_update_options_abort(bs, &r);
1200     }
1201 
1202     return ret;
1203 }
1204 
1205 /* Called with s->lock held.  */
1206 static int coroutine_fn qcow2_do_open(BlockDriverState *bs, QDict *options,
1207                                       int flags, Error **errp)
1208 {
1209     BDRVQcow2State *s = bs->opaque;
1210     unsigned int len, i;
1211     int ret = 0;
1212     QCowHeader header;
1213     Error *local_err = NULL;
1214     uint64_t ext_end;
1215     uint64_t l1_vm_state_index;
1216     bool update_header = false;
1217 
1218     ret = bdrv_pread(bs->file, 0, &header, sizeof(header));
1219     if (ret < 0) {
1220         error_setg_errno(errp, -ret, "Could not read qcow2 header");
1221         goto fail;
1222     }
1223     header.magic = be32_to_cpu(header.magic);
1224     header.version = be32_to_cpu(header.version);
1225     header.backing_file_offset = be64_to_cpu(header.backing_file_offset);
1226     header.backing_file_size = be32_to_cpu(header.backing_file_size);
1227     header.size = be64_to_cpu(header.size);
1228     header.cluster_bits = be32_to_cpu(header.cluster_bits);
1229     header.crypt_method = be32_to_cpu(header.crypt_method);
1230     header.l1_table_offset = be64_to_cpu(header.l1_table_offset);
1231     header.l1_size = be32_to_cpu(header.l1_size);
1232     header.refcount_table_offset = be64_to_cpu(header.refcount_table_offset);
1233     header.refcount_table_clusters =
1234         be32_to_cpu(header.refcount_table_clusters);
1235     header.snapshots_offset = be64_to_cpu(header.snapshots_offset);
1236     header.nb_snapshots = be32_to_cpu(header.nb_snapshots);
1237 
1238     if (header.magic != QCOW_MAGIC) {
1239         error_setg(errp, "Image is not in qcow2 format");
1240         ret = -EINVAL;
1241         goto fail;
1242     }
1243     if (header.version < 2 || header.version > 3) {
1244         error_setg(errp, "Unsupported qcow2 version %" PRIu32, header.version);
1245         ret = -ENOTSUP;
1246         goto fail;
1247     }
1248 
1249     s->qcow_version = header.version;
1250 
1251     /* Initialise cluster size */
1252     if (header.cluster_bits < MIN_CLUSTER_BITS ||
1253         header.cluster_bits > MAX_CLUSTER_BITS) {
1254         error_setg(errp, "Unsupported cluster size: 2^%" PRIu32,
1255                    header.cluster_bits);
1256         ret = -EINVAL;
1257         goto fail;
1258     }
1259 
1260     s->cluster_bits = header.cluster_bits;
1261     s->cluster_size = 1 << s->cluster_bits;
1262     s->cluster_sectors = 1 << (s->cluster_bits - BDRV_SECTOR_BITS);
1263 
1264     /* Initialise version 3 header fields */
1265     if (header.version == 2) {
1266         header.incompatible_features    = 0;
1267         header.compatible_features      = 0;
1268         header.autoclear_features       = 0;
1269         header.refcount_order           = 4;
1270         header.header_length            = 72;
1271     } else {
1272         header.incompatible_features =
1273             be64_to_cpu(header.incompatible_features);
1274         header.compatible_features = be64_to_cpu(header.compatible_features);
1275         header.autoclear_features = be64_to_cpu(header.autoclear_features);
1276         header.refcount_order = be32_to_cpu(header.refcount_order);
1277         header.header_length = be32_to_cpu(header.header_length);
1278 
1279         if (header.header_length < 104) {
1280             error_setg(errp, "qcow2 header too short");
1281             ret = -EINVAL;
1282             goto fail;
1283         }
1284     }
1285 
1286     if (header.header_length > s->cluster_size) {
1287         error_setg(errp, "qcow2 header exceeds cluster size");
1288         ret = -EINVAL;
1289         goto fail;
1290     }
1291 
1292     if (header.header_length > sizeof(header)) {
1293         s->unknown_header_fields_size = header.header_length - sizeof(header);
1294         s->unknown_header_fields = g_malloc(s->unknown_header_fields_size);
1295         ret = bdrv_pread(bs->file, sizeof(header), s->unknown_header_fields,
1296                          s->unknown_header_fields_size);
1297         if (ret < 0) {
1298             error_setg_errno(errp, -ret, "Could not read unknown qcow2 header "
1299                              "fields");
1300             goto fail;
1301         }
1302     }
1303 
1304     if (header.backing_file_offset > s->cluster_size) {
1305         error_setg(errp, "Invalid backing file offset");
1306         ret = -EINVAL;
1307         goto fail;
1308     }
1309 
1310     if (header.backing_file_offset) {
1311         ext_end = header.backing_file_offset;
1312     } else {
1313         ext_end = 1 << header.cluster_bits;
1314     }
1315 
1316     /* Handle feature bits */
1317     s->incompatible_features    = header.incompatible_features;
1318     s->compatible_features      = header.compatible_features;
1319     s->autoclear_features       = header.autoclear_features;
1320 
1321     if (s->incompatible_features & ~QCOW2_INCOMPAT_MASK) {
1322         void *feature_table = NULL;
1323         qcow2_read_extensions(bs, header.header_length, ext_end,
1324                               &feature_table, flags, NULL, NULL);
1325         report_unsupported_feature(errp, feature_table,
1326                                    s->incompatible_features &
1327                                    ~QCOW2_INCOMPAT_MASK);
1328         ret = -ENOTSUP;
1329         g_free(feature_table);
1330         goto fail;
1331     }
1332 
1333     if (s->incompatible_features & QCOW2_INCOMPAT_CORRUPT) {
1334         /* Corrupt images may not be written to unless they are being repaired
1335          */
1336         if ((flags & BDRV_O_RDWR) && !(flags & BDRV_O_CHECK)) {
1337             error_setg(errp, "qcow2: Image is corrupt; cannot be opened "
1338                        "read/write");
1339             ret = -EACCES;
1340             goto fail;
1341         }
1342     }
1343 
1344     /* Check support for various header values */
1345     if (header.refcount_order > 6) {
1346         error_setg(errp, "Reference count entry width too large; may not "
1347                    "exceed 64 bits");
1348         ret = -EINVAL;
1349         goto fail;
1350     }
1351     s->refcount_order = header.refcount_order;
1352     s->refcount_bits = 1 << s->refcount_order;
1353     s->refcount_max = UINT64_C(1) << (s->refcount_bits - 1);
1354     s->refcount_max += s->refcount_max - 1;
1355 
1356     s->crypt_method_header = header.crypt_method;
1357     if (s->crypt_method_header) {
1358         if (bdrv_uses_whitelist() &&
1359             s->crypt_method_header == QCOW_CRYPT_AES) {
1360             error_setg(errp,
1361                        "Use of AES-CBC encrypted qcow2 images is no longer "
1362                        "supported in system emulators");
1363             error_append_hint(errp,
1364                               "You can use 'qemu-img convert' to convert your "
1365                               "image to an alternative supported format, such "
1366                               "as unencrypted qcow2, or raw with the LUKS "
1367                               "format instead.\n");
1368             ret = -ENOSYS;
1369             goto fail;
1370         }
1371 
1372         if (s->crypt_method_header == QCOW_CRYPT_AES) {
1373             s->crypt_physical_offset = false;
1374         } else {
1375             /* Assuming LUKS and any future crypt methods we
1376              * add will all use physical offsets, due to the
1377              * fact that the alternative is insecure...  */
1378             s->crypt_physical_offset = true;
1379         }
1380 
1381         bs->encrypted = true;
1382     }
1383 
1384     s->l2_bits = s->cluster_bits - 3; /* L2 is always one cluster */
1385     s->l2_size = 1 << s->l2_bits;
1386     /* 2^(s->refcount_order - 3) is the refcount width in bytes */
1387     s->refcount_block_bits = s->cluster_bits - (s->refcount_order - 3);
1388     s->refcount_block_size = 1 << s->refcount_block_bits;
1389     bs->total_sectors = header.size / BDRV_SECTOR_SIZE;
1390     s->csize_shift = (62 - (s->cluster_bits - 8));
1391     s->csize_mask = (1 << (s->cluster_bits - 8)) - 1;
1392     s->cluster_offset_mask = (1LL << s->csize_shift) - 1;
1393 
1394     s->refcount_table_offset = header.refcount_table_offset;
1395     s->refcount_table_size =
1396         header.refcount_table_clusters << (s->cluster_bits - 3);
1397 
1398     if (header.refcount_table_clusters == 0 && !(flags & BDRV_O_CHECK)) {
1399         error_setg(errp, "Image does not contain a reference count table");
1400         ret = -EINVAL;
1401         goto fail;
1402     }
1403 
1404     ret = qcow2_validate_table(bs, s->refcount_table_offset,
1405                                header.refcount_table_clusters,
1406                                s->cluster_size, QCOW_MAX_REFTABLE_SIZE,
1407                                "Reference count table", errp);
1408     if (ret < 0) {
1409         goto fail;
1410     }
1411 
1412     /* The total size in bytes of the snapshot table is checked in
1413      * qcow2_read_snapshots() because the size of each snapshot is
1414      * variable and we don't know it yet.
1415      * Here we only check the offset and number of snapshots. */
1416     ret = qcow2_validate_table(bs, header.snapshots_offset,
1417                                header.nb_snapshots,
1418                                sizeof(QCowSnapshotHeader),
1419                                sizeof(QCowSnapshotHeader) * QCOW_MAX_SNAPSHOTS,
1420                                "Snapshot table", errp);
1421     if (ret < 0) {
1422         goto fail;
1423     }
1424 
1425     /* read the level 1 table */
1426     ret = qcow2_validate_table(bs, header.l1_table_offset,
1427                                header.l1_size, sizeof(uint64_t),
1428                                QCOW_MAX_L1_SIZE, "Active L1 table", errp);
1429     if (ret < 0) {
1430         goto fail;
1431     }
1432     s->l1_size = header.l1_size;
1433     s->l1_table_offset = header.l1_table_offset;
1434 
1435     l1_vm_state_index = size_to_l1(s, header.size);
1436     if (l1_vm_state_index > INT_MAX) {
1437         error_setg(errp, "Image is too big");
1438         ret = -EFBIG;
1439         goto fail;
1440     }
1441     s->l1_vm_state_index = l1_vm_state_index;
1442 
1443     /* the L1 table must contain at least enough entries to put
1444        header.size bytes */
1445     if (s->l1_size < s->l1_vm_state_index) {
1446         error_setg(errp, "L1 table is too small");
1447         ret = -EINVAL;
1448         goto fail;
1449     }
1450 
1451     if (s->l1_size > 0) {
1452         s->l1_table = qemu_try_blockalign(bs->file->bs,
1453             ROUND_UP(s->l1_size * sizeof(uint64_t), 512));
1454         if (s->l1_table == NULL) {
1455             error_setg(errp, "Could not allocate L1 table");
1456             ret = -ENOMEM;
1457             goto fail;
1458         }
1459         ret = bdrv_pread(bs->file, s->l1_table_offset, s->l1_table,
1460                          s->l1_size * sizeof(uint64_t));
1461         if (ret < 0) {
1462             error_setg_errno(errp, -ret, "Could not read L1 table");
1463             goto fail;
1464         }
1465         for(i = 0;i < s->l1_size; i++) {
1466             s->l1_table[i] = be64_to_cpu(s->l1_table[i]);
1467         }
1468     }
1469 
1470     /* Parse driver-specific options */
1471     ret = qcow2_update_options(bs, options, flags, errp);
1472     if (ret < 0) {
1473         goto fail;
1474     }
1475 
1476     s->flags = flags;
1477 
1478     ret = qcow2_refcount_init(bs);
1479     if (ret != 0) {
1480         error_setg_errno(errp, -ret, "Could not initialize refcount handling");
1481         goto fail;
1482     }
1483 
1484     QLIST_INIT(&s->cluster_allocs);
1485     QTAILQ_INIT(&s->discards);
1486 
1487     /* read qcow2 extensions */
1488     if (qcow2_read_extensions(bs, header.header_length, ext_end, NULL,
1489                               flags, &update_header, &local_err)) {
1490         error_propagate(errp, local_err);
1491         ret = -EINVAL;
1492         goto fail;
1493     }
1494 
1495     /* Open external data file */
1496     s->data_file = bdrv_open_child(NULL, options, "data-file", bs, &child_file,
1497                                    true, &local_err);
1498     if (local_err) {
1499         error_propagate(errp, local_err);
1500         ret = -EINVAL;
1501         goto fail;
1502     }
1503 
1504     if (s->incompatible_features & QCOW2_INCOMPAT_DATA_FILE) {
1505         if (!s->data_file && s->image_data_file) {
1506             s->data_file = bdrv_open_child(s->image_data_file, options,
1507                                            "data-file", bs, &child_file,
1508                                            false, errp);
1509             if (!s->data_file) {
1510                 ret = -EINVAL;
1511                 goto fail;
1512             }
1513         }
1514         if (!s->data_file) {
1515             error_setg(errp, "'data-file' is required for this image");
1516             ret = -EINVAL;
1517             goto fail;
1518         }
1519     } else {
1520         if (s->data_file) {
1521             error_setg(errp, "'data-file' can only be set for images with an "
1522                              "external data file");
1523             ret = -EINVAL;
1524             goto fail;
1525         }
1526 
1527         s->data_file = bs->file;
1528 
1529         if (data_file_is_raw(bs)) {
1530             error_setg(errp, "data-file-raw requires a data file");
1531             ret = -EINVAL;
1532             goto fail;
1533         }
1534     }
1535 
1536     /* qcow2_read_extension may have set up the crypto context
1537      * if the crypt method needs a header region, some methods
1538      * don't need header extensions, so must check here
1539      */
1540     if (s->crypt_method_header && !s->crypto) {
1541         if (s->crypt_method_header == QCOW_CRYPT_AES) {
1542             unsigned int cflags = 0;
1543             if (flags & BDRV_O_NO_IO) {
1544                 cflags |= QCRYPTO_BLOCK_OPEN_NO_IO;
1545             }
1546             s->crypto = qcrypto_block_open(s->crypto_opts, "encrypt.",
1547                                            NULL, NULL, cflags, 1, errp);
1548             if (!s->crypto) {
1549                 ret = -EINVAL;
1550                 goto fail;
1551             }
1552         } else if (!(flags & BDRV_O_NO_IO)) {
1553             error_setg(errp, "Missing CRYPTO header for crypt method %d",
1554                        s->crypt_method_header);
1555             ret = -EINVAL;
1556             goto fail;
1557         }
1558     }
1559 
1560     /* read the backing file name */
1561     if (header.backing_file_offset != 0) {
1562         len = header.backing_file_size;
1563         if (len > MIN(1023, s->cluster_size - header.backing_file_offset) ||
1564             len >= sizeof(bs->backing_file)) {
1565             error_setg(errp, "Backing file name too long");
1566             ret = -EINVAL;
1567             goto fail;
1568         }
1569         ret = bdrv_pread(bs->file, header.backing_file_offset,
1570                          bs->auto_backing_file, len);
1571         if (ret < 0) {
1572             error_setg_errno(errp, -ret, "Could not read backing file name");
1573             goto fail;
1574         }
1575         bs->auto_backing_file[len] = '\0';
1576         pstrcpy(bs->backing_file, sizeof(bs->backing_file),
1577                 bs->auto_backing_file);
1578         s->image_backing_file = g_strdup(bs->auto_backing_file);
1579     }
1580 
1581     /* Internal snapshots */
1582     s->snapshots_offset = header.snapshots_offset;
1583     s->nb_snapshots = header.nb_snapshots;
1584 
1585     ret = qcow2_read_snapshots(bs);
1586     if (ret < 0) {
1587         error_setg_errno(errp, -ret, "Could not read snapshots");
1588         goto fail;
1589     }
1590 
1591     /* Clear unknown autoclear feature bits */
1592     update_header |= s->autoclear_features & ~QCOW2_AUTOCLEAR_MASK;
1593     update_header =
1594         update_header && !bs->read_only && !(flags & BDRV_O_INACTIVE);
1595     if (update_header) {
1596         s->autoclear_features &= QCOW2_AUTOCLEAR_MASK;
1597     }
1598 
1599     /* == Handle persistent dirty bitmaps ==
1600      *
1601      * We want load dirty bitmaps in three cases:
1602      *
1603      * 1. Normal open of the disk in active mode, not related to invalidation
1604      *    after migration.
1605      *
1606      * 2. Invalidation of the target vm after pre-copy phase of migration, if
1607      *    bitmaps are _not_ migrating through migration channel, i.e.
1608      *    'dirty-bitmaps' capability is disabled.
1609      *
1610      * 3. Invalidation of source vm after failed or canceled migration.
1611      *    This is a very interesting case. There are two possible types of
1612      *    bitmaps:
1613      *
1614      *    A. Stored on inactivation and removed. They should be loaded from the
1615      *       image.
1616      *
1617      *    B. Not stored: not-persistent bitmaps and bitmaps, migrated through
1618      *       the migration channel (with dirty-bitmaps capability).
1619      *
1620      *    On the other hand, there are two possible sub-cases:
1621      *
1622      *    3.1 disk was changed by somebody else while were inactive. In this
1623      *        case all in-RAM dirty bitmaps (both persistent and not) are
1624      *        definitely invalid. And we don't have any method to determine
1625      *        this.
1626      *
1627      *        Simple and safe thing is to just drop all the bitmaps of type B on
1628      *        inactivation. But in this case we lose bitmaps in valid 4.2 case.
1629      *
1630      *        On the other hand, resuming source vm, if disk was already changed
1631      *        is a bad thing anyway: not only bitmaps, the whole vm state is
1632      *        out of sync with disk.
1633      *
1634      *        This means, that user or management tool, who for some reason
1635      *        decided to resume source vm, after disk was already changed by
1636      *        target vm, should at least drop all dirty bitmaps by hand.
1637      *
1638      *        So, we can ignore this case for now, but TODO: "generation"
1639      *        extension for qcow2, to determine, that image was changed after
1640      *        last inactivation. And if it is changed, we will drop (or at least
1641      *        mark as 'invalid' all the bitmaps of type B, both persistent
1642      *        and not).
1643      *
1644      *    3.2 disk was _not_ changed while were inactive. Bitmaps may be saved
1645      *        to disk ('dirty-bitmaps' capability disabled), or not saved
1646      *        ('dirty-bitmaps' capability enabled), but we don't need to care
1647      *        of: let's load bitmaps as always: stored bitmaps will be loaded,
1648      *        and not stored has flag IN_USE=1 in the image and will be skipped
1649      *        on loading.
1650      *
1651      * One remaining possible case when we don't want load bitmaps:
1652      *
1653      * 4. Open disk in inactive mode in target vm (bitmaps are migrating or
1654      *    will be loaded on invalidation, no needs try loading them before)
1655      */
1656 
1657     if (!(bdrv_get_flags(bs) & BDRV_O_INACTIVE)) {
1658         /* It's case 1, 2 or 3.2. Or 3.1 which is BUG in management layer. */
1659         bool header_updated = qcow2_load_dirty_bitmaps(bs, &local_err);
1660 
1661         update_header = update_header && !header_updated;
1662     }
1663     if (local_err != NULL) {
1664         error_propagate(errp, local_err);
1665         ret = -EINVAL;
1666         goto fail;
1667     }
1668 
1669     if (update_header) {
1670         ret = qcow2_update_header(bs);
1671         if (ret < 0) {
1672             error_setg_errno(errp, -ret, "Could not update qcow2 header");
1673             goto fail;
1674         }
1675     }
1676 
1677     bs->supported_zero_flags = header.version >= 3 ? BDRV_REQ_MAY_UNMAP : 0;
1678 
1679     /* Repair image if dirty */
1680     if (!(flags & (BDRV_O_CHECK | BDRV_O_INACTIVE)) && !bs->read_only &&
1681         (s->incompatible_features & QCOW2_INCOMPAT_DIRTY)) {
1682         BdrvCheckResult result = {0};
1683 
1684         ret = qcow2_co_check_locked(bs, &result,
1685                                     BDRV_FIX_ERRORS | BDRV_FIX_LEAKS);
1686         if (ret < 0 || result.check_errors) {
1687             if (ret >= 0) {
1688                 ret = -EIO;
1689             }
1690             error_setg_errno(errp, -ret, "Could not repair dirty image");
1691             goto fail;
1692         }
1693     }
1694 
1695 #ifdef DEBUG_ALLOC
1696     {
1697         BdrvCheckResult result = {0};
1698         qcow2_check_refcounts(bs, &result, 0);
1699     }
1700 #endif
1701 
1702     qemu_co_queue_init(&s->compress_wait_queue);
1703 
1704     return ret;
1705 
1706  fail:
1707     g_free(s->image_data_file);
1708     if (has_data_file(bs)) {
1709         bdrv_unref_child(bs, s->data_file);
1710     }
1711     g_free(s->unknown_header_fields);
1712     cleanup_unknown_header_ext(bs);
1713     qcow2_free_snapshots(bs);
1714     qcow2_refcount_close(bs);
1715     qemu_vfree(s->l1_table);
1716     /* else pre-write overlap checks in cache_destroy may crash */
1717     s->l1_table = NULL;
1718     cache_clean_timer_del(bs);
1719     if (s->l2_table_cache) {
1720         qcow2_cache_destroy(s->l2_table_cache);
1721     }
1722     if (s->refcount_block_cache) {
1723         qcow2_cache_destroy(s->refcount_block_cache);
1724     }
1725     qcrypto_block_free(s->crypto);
1726     qapi_free_QCryptoBlockOpenOptions(s->crypto_opts);
1727     return ret;
1728 }
1729 
1730 typedef struct QCow2OpenCo {
1731     BlockDriverState *bs;
1732     QDict *options;
1733     int flags;
1734     Error **errp;
1735     int ret;
1736 } QCow2OpenCo;
1737 
1738 static void coroutine_fn qcow2_open_entry(void *opaque)
1739 {
1740     QCow2OpenCo *qoc = opaque;
1741     BDRVQcow2State *s = qoc->bs->opaque;
1742 
1743     qemu_co_mutex_lock(&s->lock);
1744     qoc->ret = qcow2_do_open(qoc->bs, qoc->options, qoc->flags, qoc->errp);
1745     qemu_co_mutex_unlock(&s->lock);
1746 }
1747 
1748 static int qcow2_open(BlockDriverState *bs, QDict *options, int flags,
1749                       Error **errp)
1750 {
1751     BDRVQcow2State *s = bs->opaque;
1752     QCow2OpenCo qoc = {
1753         .bs = bs,
1754         .options = options,
1755         .flags = flags,
1756         .errp = errp,
1757         .ret = -EINPROGRESS
1758     };
1759 
1760     bs->file = bdrv_open_child(NULL, options, "file", bs, &child_file,
1761                                false, errp);
1762     if (!bs->file) {
1763         return -EINVAL;
1764     }
1765 
1766     /* Initialise locks */
1767     qemu_co_mutex_init(&s->lock);
1768 
1769     if (qemu_in_coroutine()) {
1770         /* From bdrv_co_create.  */
1771         qcow2_open_entry(&qoc);
1772     } else {
1773         assert(qemu_get_current_aio_context() == qemu_get_aio_context());
1774         qemu_coroutine_enter(qemu_coroutine_create(qcow2_open_entry, &qoc));
1775         BDRV_POLL_WHILE(bs, qoc.ret == -EINPROGRESS);
1776     }
1777     return qoc.ret;
1778 }
1779 
1780 static void qcow2_refresh_limits(BlockDriverState *bs, Error **errp)
1781 {
1782     BDRVQcow2State *s = bs->opaque;
1783 
1784     if (bs->encrypted) {
1785         /* Encryption works on a sector granularity */
1786         bs->bl.request_alignment = qcrypto_block_get_sector_size(s->crypto);
1787     }
1788     bs->bl.pwrite_zeroes_alignment = s->cluster_size;
1789     bs->bl.pdiscard_alignment = s->cluster_size;
1790 }
1791 
1792 static int qcow2_reopen_prepare(BDRVReopenState *state,
1793                                 BlockReopenQueue *queue, Error **errp)
1794 {
1795     Qcow2ReopenState *r;
1796     int ret;
1797 
1798     r = g_new0(Qcow2ReopenState, 1);
1799     state->opaque = r;
1800 
1801     ret = qcow2_update_options_prepare(state->bs, r, state->options,
1802                                        state->flags, errp);
1803     if (ret < 0) {
1804         goto fail;
1805     }
1806 
1807     /* We need to write out any unwritten data if we reopen read-only. */
1808     if ((state->flags & BDRV_O_RDWR) == 0) {
1809         ret = qcow2_reopen_bitmaps_ro(state->bs, errp);
1810         if (ret < 0) {
1811             goto fail;
1812         }
1813 
1814         ret = bdrv_flush(state->bs);
1815         if (ret < 0) {
1816             goto fail;
1817         }
1818 
1819         ret = qcow2_mark_clean(state->bs);
1820         if (ret < 0) {
1821             goto fail;
1822         }
1823     }
1824 
1825     return 0;
1826 
1827 fail:
1828     qcow2_update_options_abort(state->bs, r);
1829     g_free(r);
1830     return ret;
1831 }
1832 
1833 static void qcow2_reopen_commit(BDRVReopenState *state)
1834 {
1835     qcow2_update_options_commit(state->bs, state->opaque);
1836     g_free(state->opaque);
1837 }
1838 
1839 static void qcow2_reopen_abort(BDRVReopenState *state)
1840 {
1841     qcow2_update_options_abort(state->bs, state->opaque);
1842     g_free(state->opaque);
1843 }
1844 
1845 static void qcow2_join_options(QDict *options, QDict *old_options)
1846 {
1847     bool has_new_overlap_template =
1848         qdict_haskey(options, QCOW2_OPT_OVERLAP) ||
1849         qdict_haskey(options, QCOW2_OPT_OVERLAP_TEMPLATE);
1850     bool has_new_total_cache_size =
1851         qdict_haskey(options, QCOW2_OPT_CACHE_SIZE);
1852     bool has_all_cache_options;
1853 
1854     /* New overlap template overrides all old overlap options */
1855     if (has_new_overlap_template) {
1856         qdict_del(old_options, QCOW2_OPT_OVERLAP);
1857         qdict_del(old_options, QCOW2_OPT_OVERLAP_TEMPLATE);
1858         qdict_del(old_options, QCOW2_OPT_OVERLAP_MAIN_HEADER);
1859         qdict_del(old_options, QCOW2_OPT_OVERLAP_ACTIVE_L1);
1860         qdict_del(old_options, QCOW2_OPT_OVERLAP_ACTIVE_L2);
1861         qdict_del(old_options, QCOW2_OPT_OVERLAP_REFCOUNT_TABLE);
1862         qdict_del(old_options, QCOW2_OPT_OVERLAP_REFCOUNT_BLOCK);
1863         qdict_del(old_options, QCOW2_OPT_OVERLAP_SNAPSHOT_TABLE);
1864         qdict_del(old_options, QCOW2_OPT_OVERLAP_INACTIVE_L1);
1865         qdict_del(old_options, QCOW2_OPT_OVERLAP_INACTIVE_L2);
1866     }
1867 
1868     /* New total cache size overrides all old options */
1869     if (qdict_haskey(options, QCOW2_OPT_CACHE_SIZE)) {
1870         qdict_del(old_options, QCOW2_OPT_L2_CACHE_SIZE);
1871         qdict_del(old_options, QCOW2_OPT_REFCOUNT_CACHE_SIZE);
1872     }
1873 
1874     qdict_join(options, old_options, false);
1875 
1876     /*
1877      * If after merging all cache size options are set, an old total size is
1878      * overwritten. Do keep all options, however, if all three are new. The
1879      * resulting error message is what we want to happen.
1880      */
1881     has_all_cache_options =
1882         qdict_haskey(options, QCOW2_OPT_CACHE_SIZE) ||
1883         qdict_haskey(options, QCOW2_OPT_L2_CACHE_SIZE) ||
1884         qdict_haskey(options, QCOW2_OPT_REFCOUNT_CACHE_SIZE);
1885 
1886     if (has_all_cache_options && !has_new_total_cache_size) {
1887         qdict_del(options, QCOW2_OPT_CACHE_SIZE);
1888     }
1889 }
1890 
1891 static int coroutine_fn qcow2_co_block_status(BlockDriverState *bs,
1892                                               bool want_zero,
1893                                               int64_t offset, int64_t count,
1894                                               int64_t *pnum, int64_t *map,
1895                                               BlockDriverState **file)
1896 {
1897     BDRVQcow2State *s = bs->opaque;
1898     uint64_t cluster_offset;
1899     int index_in_cluster, ret;
1900     unsigned int bytes;
1901     int status = 0;
1902 
1903     bytes = MIN(INT_MAX, count);
1904     qemu_co_mutex_lock(&s->lock);
1905     ret = qcow2_get_cluster_offset(bs, offset, &bytes, &cluster_offset);
1906     qemu_co_mutex_unlock(&s->lock);
1907     if (ret < 0) {
1908         return ret;
1909     }
1910 
1911     *pnum = bytes;
1912 
1913     if ((ret == QCOW2_CLUSTER_NORMAL || ret == QCOW2_CLUSTER_ZERO_ALLOC) &&
1914         !s->crypto) {
1915         index_in_cluster = offset & (s->cluster_size - 1);
1916         *map = cluster_offset | index_in_cluster;
1917         *file = s->data_file->bs;
1918         status |= BDRV_BLOCK_OFFSET_VALID;
1919     }
1920     if (ret == QCOW2_CLUSTER_ZERO_PLAIN || ret == QCOW2_CLUSTER_ZERO_ALLOC) {
1921         status |= BDRV_BLOCK_ZERO;
1922     } else if (ret != QCOW2_CLUSTER_UNALLOCATED) {
1923         status |= BDRV_BLOCK_DATA;
1924     }
1925     return status;
1926 }
1927 
1928 static coroutine_fn int qcow2_handle_l2meta(BlockDriverState *bs,
1929                                             QCowL2Meta **pl2meta,
1930                                             bool link_l2)
1931 {
1932     int ret = 0;
1933     QCowL2Meta *l2meta = *pl2meta;
1934 
1935     while (l2meta != NULL) {
1936         QCowL2Meta *next;
1937 
1938         if (link_l2) {
1939             ret = qcow2_alloc_cluster_link_l2(bs, l2meta);
1940             if (ret) {
1941                 goto out;
1942             }
1943         } else {
1944             qcow2_alloc_cluster_abort(bs, l2meta);
1945         }
1946 
1947         /* Take the request off the list of running requests */
1948         if (l2meta->nb_clusters != 0) {
1949             QLIST_REMOVE(l2meta, next_in_flight);
1950         }
1951 
1952         qemu_co_queue_restart_all(&l2meta->dependent_requests);
1953 
1954         next = l2meta->next;
1955         g_free(l2meta);
1956         l2meta = next;
1957     }
1958 out:
1959     *pl2meta = l2meta;
1960     return ret;
1961 }
1962 
1963 static coroutine_fn int qcow2_co_preadv(BlockDriverState *bs, uint64_t offset,
1964                                         uint64_t bytes, QEMUIOVector *qiov,
1965                                         int flags)
1966 {
1967     BDRVQcow2State *s = bs->opaque;
1968     int offset_in_cluster;
1969     int ret;
1970     unsigned int cur_bytes; /* number of bytes in current iteration */
1971     uint64_t cluster_offset = 0;
1972     uint64_t bytes_done = 0;
1973     QEMUIOVector hd_qiov;
1974     uint8_t *cluster_data = NULL;
1975 
1976     qemu_iovec_init(&hd_qiov, qiov->niov);
1977 
1978     qemu_co_mutex_lock(&s->lock);
1979 
1980     while (bytes != 0) {
1981 
1982         /* prepare next request */
1983         cur_bytes = MIN(bytes, INT_MAX);
1984         if (s->crypto) {
1985             cur_bytes = MIN(cur_bytes,
1986                             QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size);
1987         }
1988 
1989         ret = qcow2_get_cluster_offset(bs, offset, &cur_bytes, &cluster_offset);
1990         if (ret < 0) {
1991             goto fail;
1992         }
1993 
1994         offset_in_cluster = offset_into_cluster(s, offset);
1995 
1996         qemu_iovec_reset(&hd_qiov);
1997         qemu_iovec_concat(&hd_qiov, qiov, bytes_done, cur_bytes);
1998 
1999         switch (ret) {
2000         case QCOW2_CLUSTER_UNALLOCATED:
2001 
2002             if (bs->backing) {
2003                 BLKDBG_EVENT(bs->file, BLKDBG_READ_BACKING_AIO);
2004                 qemu_co_mutex_unlock(&s->lock);
2005                 ret = bdrv_co_preadv(bs->backing, offset, cur_bytes,
2006                                      &hd_qiov, 0);
2007                 qemu_co_mutex_lock(&s->lock);
2008                 if (ret < 0) {
2009                     goto fail;
2010                 }
2011             } else {
2012                 /* Note: in this case, no need to wait */
2013                 qemu_iovec_memset(&hd_qiov, 0, 0, cur_bytes);
2014             }
2015             break;
2016 
2017         case QCOW2_CLUSTER_ZERO_PLAIN:
2018         case QCOW2_CLUSTER_ZERO_ALLOC:
2019             qemu_iovec_memset(&hd_qiov, 0, 0, cur_bytes);
2020             break;
2021 
2022         case QCOW2_CLUSTER_COMPRESSED:
2023             qemu_co_mutex_unlock(&s->lock);
2024             ret = qcow2_co_preadv_compressed(bs, cluster_offset,
2025                                              offset, cur_bytes,
2026                                              &hd_qiov);
2027             qemu_co_mutex_lock(&s->lock);
2028             if (ret < 0) {
2029                 goto fail;
2030             }
2031 
2032             break;
2033 
2034         case QCOW2_CLUSTER_NORMAL:
2035             if ((cluster_offset & 511) != 0) {
2036                 ret = -EIO;
2037                 goto fail;
2038             }
2039 
2040             if (bs->encrypted) {
2041                 assert(s->crypto);
2042 
2043                 /*
2044                  * For encrypted images, read everything into a temporary
2045                  * contiguous buffer on which the AES functions can work.
2046                  */
2047                 if (!cluster_data) {
2048                     cluster_data =
2049                         qemu_try_blockalign(s->data_file->bs,
2050                                             QCOW_MAX_CRYPT_CLUSTERS
2051                                             * s->cluster_size);
2052                     if (cluster_data == NULL) {
2053                         ret = -ENOMEM;
2054                         goto fail;
2055                     }
2056                 }
2057 
2058                 assert(cur_bytes <= QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size);
2059                 qemu_iovec_reset(&hd_qiov);
2060                 qemu_iovec_add(&hd_qiov, cluster_data, cur_bytes);
2061             }
2062 
2063             BLKDBG_EVENT(bs->file, BLKDBG_READ_AIO);
2064             qemu_co_mutex_unlock(&s->lock);
2065             ret = bdrv_co_preadv(s->data_file,
2066                                  cluster_offset + offset_in_cluster,
2067                                  cur_bytes, &hd_qiov, 0);
2068             qemu_co_mutex_lock(&s->lock);
2069             if (ret < 0) {
2070                 goto fail;
2071             }
2072             if (bs->encrypted) {
2073                 assert(s->crypto);
2074                 assert((offset & (BDRV_SECTOR_SIZE - 1)) == 0);
2075                 assert((cur_bytes & (BDRV_SECTOR_SIZE - 1)) == 0);
2076                 if (qcrypto_block_decrypt(s->crypto,
2077                                           (s->crypt_physical_offset ?
2078                                            cluster_offset + offset_in_cluster :
2079                                            offset),
2080                                           cluster_data,
2081                                           cur_bytes,
2082                                           NULL) < 0) {
2083                     ret = -EIO;
2084                     goto fail;
2085                 }
2086                 qemu_iovec_from_buf(qiov, bytes_done, cluster_data, cur_bytes);
2087             }
2088             break;
2089 
2090         default:
2091             g_assert_not_reached();
2092             ret = -EIO;
2093             goto fail;
2094         }
2095 
2096         bytes -= cur_bytes;
2097         offset += cur_bytes;
2098         bytes_done += cur_bytes;
2099     }
2100     ret = 0;
2101 
2102 fail:
2103     qemu_co_mutex_unlock(&s->lock);
2104 
2105     qemu_iovec_destroy(&hd_qiov);
2106     qemu_vfree(cluster_data);
2107 
2108     return ret;
2109 }
2110 
2111 /* Check if it's possible to merge a write request with the writing of
2112  * the data from the COW regions */
2113 static bool merge_cow(uint64_t offset, unsigned bytes,
2114                       QEMUIOVector *hd_qiov, QCowL2Meta *l2meta)
2115 {
2116     QCowL2Meta *m;
2117 
2118     for (m = l2meta; m != NULL; m = m->next) {
2119         /* If both COW regions are empty then there's nothing to merge */
2120         if (m->cow_start.nb_bytes == 0 && m->cow_end.nb_bytes == 0) {
2121             continue;
2122         }
2123 
2124         /* The data (middle) region must be immediately after the
2125          * start region */
2126         if (l2meta_cow_start(m) + m->cow_start.nb_bytes != offset) {
2127             continue;
2128         }
2129 
2130         /* The end region must be immediately after the data (middle)
2131          * region */
2132         if (m->offset + m->cow_end.offset != offset + bytes) {
2133             continue;
2134         }
2135 
2136         /* Make sure that adding both COW regions to the QEMUIOVector
2137          * does not exceed IOV_MAX */
2138         if (hd_qiov->niov > IOV_MAX - 2) {
2139             continue;
2140         }
2141 
2142         m->data_qiov = hd_qiov;
2143         return true;
2144     }
2145 
2146     return false;
2147 }
2148 
2149 static coroutine_fn int qcow2_co_pwritev(BlockDriverState *bs, uint64_t offset,
2150                                          uint64_t bytes, QEMUIOVector *qiov,
2151                                          int flags)
2152 {
2153     BDRVQcow2State *s = bs->opaque;
2154     int offset_in_cluster;
2155     int ret;
2156     unsigned int cur_bytes; /* number of sectors in current iteration */
2157     uint64_t cluster_offset;
2158     QEMUIOVector hd_qiov;
2159     uint64_t bytes_done = 0;
2160     uint8_t *cluster_data = NULL;
2161     QCowL2Meta *l2meta = NULL;
2162 
2163     trace_qcow2_writev_start_req(qemu_coroutine_self(), offset, bytes);
2164 
2165     qemu_iovec_init(&hd_qiov, qiov->niov);
2166 
2167     qemu_co_mutex_lock(&s->lock);
2168 
2169     while (bytes != 0) {
2170 
2171         l2meta = NULL;
2172 
2173         trace_qcow2_writev_start_part(qemu_coroutine_self());
2174         offset_in_cluster = offset_into_cluster(s, offset);
2175         cur_bytes = MIN(bytes, INT_MAX);
2176         if (bs->encrypted) {
2177             cur_bytes = MIN(cur_bytes,
2178                             QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size
2179                             - offset_in_cluster);
2180         }
2181 
2182         ret = qcow2_alloc_cluster_offset(bs, offset, &cur_bytes,
2183                                          &cluster_offset, &l2meta);
2184         if (ret < 0) {
2185             goto fail;
2186         }
2187 
2188         assert((cluster_offset & 511) == 0);
2189 
2190         qemu_iovec_reset(&hd_qiov);
2191         qemu_iovec_concat(&hd_qiov, qiov, bytes_done, cur_bytes);
2192 
2193         if (bs->encrypted) {
2194             assert(s->crypto);
2195             if (!cluster_data) {
2196                 cluster_data = qemu_try_blockalign(bs->file->bs,
2197                                                    QCOW_MAX_CRYPT_CLUSTERS
2198                                                    * s->cluster_size);
2199                 if (cluster_data == NULL) {
2200                     ret = -ENOMEM;
2201                     goto fail;
2202                 }
2203             }
2204 
2205             assert(hd_qiov.size <=
2206                    QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size);
2207             qemu_iovec_to_buf(&hd_qiov, 0, cluster_data, hd_qiov.size);
2208 
2209             if (qcrypto_block_encrypt(s->crypto,
2210                                       (s->crypt_physical_offset ?
2211                                        cluster_offset + offset_in_cluster :
2212                                        offset),
2213                                       cluster_data,
2214                                       cur_bytes, NULL) < 0) {
2215                 ret = -EIO;
2216                 goto fail;
2217             }
2218 
2219             qemu_iovec_reset(&hd_qiov);
2220             qemu_iovec_add(&hd_qiov, cluster_data, cur_bytes);
2221         }
2222 
2223         ret = qcow2_pre_write_overlap_check(bs, 0,
2224                 cluster_offset + offset_in_cluster, cur_bytes, true);
2225         if (ret < 0) {
2226             goto fail;
2227         }
2228 
2229         /* If we need to do COW, check if it's possible to merge the
2230          * writing of the guest data together with that of the COW regions.
2231          * If it's not possible (or not necessary) then write the
2232          * guest data now. */
2233         if (!merge_cow(offset, cur_bytes, &hd_qiov, l2meta)) {
2234             qemu_co_mutex_unlock(&s->lock);
2235             BLKDBG_EVENT(bs->file, BLKDBG_WRITE_AIO);
2236             trace_qcow2_writev_data(qemu_coroutine_self(),
2237                                     cluster_offset + offset_in_cluster);
2238             ret = bdrv_co_pwritev(s->data_file,
2239                                   cluster_offset + offset_in_cluster,
2240                                   cur_bytes, &hd_qiov, 0);
2241             qemu_co_mutex_lock(&s->lock);
2242             if (ret < 0) {
2243                 goto fail;
2244             }
2245         }
2246 
2247         ret = qcow2_handle_l2meta(bs, &l2meta, true);
2248         if (ret) {
2249             goto fail;
2250         }
2251 
2252         bytes -= cur_bytes;
2253         offset += cur_bytes;
2254         bytes_done += cur_bytes;
2255         trace_qcow2_writev_done_part(qemu_coroutine_self(), cur_bytes);
2256     }
2257     ret = 0;
2258 
2259 fail:
2260     qcow2_handle_l2meta(bs, &l2meta, false);
2261 
2262     qemu_co_mutex_unlock(&s->lock);
2263 
2264     qemu_iovec_destroy(&hd_qiov);
2265     qemu_vfree(cluster_data);
2266     trace_qcow2_writev_done_req(qemu_coroutine_self(), ret);
2267 
2268     return ret;
2269 }
2270 
2271 static int qcow2_inactivate(BlockDriverState *bs)
2272 {
2273     BDRVQcow2State *s = bs->opaque;
2274     int ret, result = 0;
2275     Error *local_err = NULL;
2276 
2277     qcow2_store_persistent_dirty_bitmaps(bs, &local_err);
2278     if (local_err != NULL) {
2279         result = -EINVAL;
2280         error_reportf_err(local_err, "Lost persistent bitmaps during "
2281                           "inactivation of node '%s': ",
2282                           bdrv_get_device_or_node_name(bs));
2283     }
2284 
2285     ret = qcow2_cache_flush(bs, s->l2_table_cache);
2286     if (ret) {
2287         result = ret;
2288         error_report("Failed to flush the L2 table cache: %s",
2289                      strerror(-ret));
2290     }
2291 
2292     ret = qcow2_cache_flush(bs, s->refcount_block_cache);
2293     if (ret) {
2294         result = ret;
2295         error_report("Failed to flush the refcount block cache: %s",
2296                      strerror(-ret));
2297     }
2298 
2299     if (result == 0) {
2300         qcow2_mark_clean(bs);
2301     }
2302 
2303     return result;
2304 }
2305 
2306 static void qcow2_close(BlockDriverState *bs)
2307 {
2308     BDRVQcow2State *s = bs->opaque;
2309     qemu_vfree(s->l1_table);
2310     /* else pre-write overlap checks in cache_destroy may crash */
2311     s->l1_table = NULL;
2312 
2313     if (!(s->flags & BDRV_O_INACTIVE)) {
2314         qcow2_inactivate(bs);
2315     }
2316 
2317     cache_clean_timer_del(bs);
2318     qcow2_cache_destroy(s->l2_table_cache);
2319     qcow2_cache_destroy(s->refcount_block_cache);
2320 
2321     qcrypto_block_free(s->crypto);
2322     s->crypto = NULL;
2323 
2324     g_free(s->unknown_header_fields);
2325     cleanup_unknown_header_ext(bs);
2326 
2327     g_free(s->image_data_file);
2328     g_free(s->image_backing_file);
2329     g_free(s->image_backing_format);
2330 
2331     if (has_data_file(bs)) {
2332         bdrv_unref_child(bs, s->data_file);
2333     }
2334 
2335     qcow2_refcount_close(bs);
2336     qcow2_free_snapshots(bs);
2337 }
2338 
2339 static void coroutine_fn qcow2_co_invalidate_cache(BlockDriverState *bs,
2340                                                    Error **errp)
2341 {
2342     BDRVQcow2State *s = bs->opaque;
2343     int flags = s->flags;
2344     QCryptoBlock *crypto = NULL;
2345     QDict *options;
2346     Error *local_err = NULL;
2347     int ret;
2348 
2349     /*
2350      * Backing files are read-only which makes all of their metadata immutable,
2351      * that means we don't have to worry about reopening them here.
2352      */
2353 
2354     crypto = s->crypto;
2355     s->crypto = NULL;
2356 
2357     qcow2_close(bs);
2358 
2359     memset(s, 0, sizeof(BDRVQcow2State));
2360     options = qdict_clone_shallow(bs->options);
2361 
2362     flags &= ~BDRV_O_INACTIVE;
2363     qemu_co_mutex_lock(&s->lock);
2364     ret = qcow2_do_open(bs, options, flags, &local_err);
2365     qemu_co_mutex_unlock(&s->lock);
2366     qobject_unref(options);
2367     if (local_err) {
2368         error_propagate_prepend(errp, local_err,
2369                                 "Could not reopen qcow2 layer: ");
2370         bs->drv = NULL;
2371         return;
2372     } else if (ret < 0) {
2373         error_setg_errno(errp, -ret, "Could not reopen qcow2 layer");
2374         bs->drv = NULL;
2375         return;
2376     }
2377 
2378     s->crypto = crypto;
2379 }
2380 
2381 static size_t header_ext_add(char *buf, uint32_t magic, const void *s,
2382     size_t len, size_t buflen)
2383 {
2384     QCowExtension *ext_backing_fmt = (QCowExtension*) buf;
2385     size_t ext_len = sizeof(QCowExtension) + ((len + 7) & ~7);
2386 
2387     if (buflen < ext_len) {
2388         return -ENOSPC;
2389     }
2390 
2391     *ext_backing_fmt = (QCowExtension) {
2392         .magic  = cpu_to_be32(magic),
2393         .len    = cpu_to_be32(len),
2394     };
2395 
2396     if (len) {
2397         memcpy(buf + sizeof(QCowExtension), s, len);
2398     }
2399 
2400     return ext_len;
2401 }
2402 
2403 /*
2404  * Updates the qcow2 header, including the variable length parts of it, i.e.
2405  * the backing file name and all extensions. qcow2 was not designed to allow
2406  * such changes, so if we run out of space (we can only use the first cluster)
2407  * this function may fail.
2408  *
2409  * Returns 0 on success, -errno in error cases.
2410  */
2411 int qcow2_update_header(BlockDriverState *bs)
2412 {
2413     BDRVQcow2State *s = bs->opaque;
2414     QCowHeader *header;
2415     char *buf;
2416     size_t buflen = s->cluster_size;
2417     int ret;
2418     uint64_t total_size;
2419     uint32_t refcount_table_clusters;
2420     size_t header_length;
2421     Qcow2UnknownHeaderExtension *uext;
2422 
2423     buf = qemu_blockalign(bs, buflen);
2424 
2425     /* Header structure */
2426     header = (QCowHeader*) buf;
2427 
2428     if (buflen < sizeof(*header)) {
2429         ret = -ENOSPC;
2430         goto fail;
2431     }
2432 
2433     header_length = sizeof(*header) + s->unknown_header_fields_size;
2434     total_size = bs->total_sectors * BDRV_SECTOR_SIZE;
2435     refcount_table_clusters = s->refcount_table_size >> (s->cluster_bits - 3);
2436 
2437     *header = (QCowHeader) {
2438         /* Version 2 fields */
2439         .magic                  = cpu_to_be32(QCOW_MAGIC),
2440         .version                = cpu_to_be32(s->qcow_version),
2441         .backing_file_offset    = 0,
2442         .backing_file_size      = 0,
2443         .cluster_bits           = cpu_to_be32(s->cluster_bits),
2444         .size                   = cpu_to_be64(total_size),
2445         .crypt_method           = cpu_to_be32(s->crypt_method_header),
2446         .l1_size                = cpu_to_be32(s->l1_size),
2447         .l1_table_offset        = cpu_to_be64(s->l1_table_offset),
2448         .refcount_table_offset  = cpu_to_be64(s->refcount_table_offset),
2449         .refcount_table_clusters = cpu_to_be32(refcount_table_clusters),
2450         .nb_snapshots           = cpu_to_be32(s->nb_snapshots),
2451         .snapshots_offset       = cpu_to_be64(s->snapshots_offset),
2452 
2453         /* Version 3 fields */
2454         .incompatible_features  = cpu_to_be64(s->incompatible_features),
2455         .compatible_features    = cpu_to_be64(s->compatible_features),
2456         .autoclear_features     = cpu_to_be64(s->autoclear_features),
2457         .refcount_order         = cpu_to_be32(s->refcount_order),
2458         .header_length          = cpu_to_be32(header_length),
2459     };
2460 
2461     /* For older versions, write a shorter header */
2462     switch (s->qcow_version) {
2463     case 2:
2464         ret = offsetof(QCowHeader, incompatible_features);
2465         break;
2466     case 3:
2467         ret = sizeof(*header);
2468         break;
2469     default:
2470         ret = -EINVAL;
2471         goto fail;
2472     }
2473 
2474     buf += ret;
2475     buflen -= ret;
2476     memset(buf, 0, buflen);
2477 
2478     /* Preserve any unknown field in the header */
2479     if (s->unknown_header_fields_size) {
2480         if (buflen < s->unknown_header_fields_size) {
2481             ret = -ENOSPC;
2482             goto fail;
2483         }
2484 
2485         memcpy(buf, s->unknown_header_fields, s->unknown_header_fields_size);
2486         buf += s->unknown_header_fields_size;
2487         buflen -= s->unknown_header_fields_size;
2488     }
2489 
2490     /* Backing file format header extension */
2491     if (s->image_backing_format) {
2492         ret = header_ext_add(buf, QCOW2_EXT_MAGIC_BACKING_FORMAT,
2493                              s->image_backing_format,
2494                              strlen(s->image_backing_format),
2495                              buflen);
2496         if (ret < 0) {
2497             goto fail;
2498         }
2499 
2500         buf += ret;
2501         buflen -= ret;
2502     }
2503 
2504     /* External data file header extension */
2505     if (has_data_file(bs) && s->image_data_file) {
2506         ret = header_ext_add(buf, QCOW2_EXT_MAGIC_DATA_FILE,
2507                              s->image_data_file, strlen(s->image_data_file),
2508                              buflen);
2509         if (ret < 0) {
2510             goto fail;
2511         }
2512 
2513         buf += ret;
2514         buflen -= ret;
2515     }
2516 
2517     /* Full disk encryption header pointer extension */
2518     if (s->crypto_header.offset != 0) {
2519         s->crypto_header.offset = cpu_to_be64(s->crypto_header.offset);
2520         s->crypto_header.length = cpu_to_be64(s->crypto_header.length);
2521         ret = header_ext_add(buf, QCOW2_EXT_MAGIC_CRYPTO_HEADER,
2522                              &s->crypto_header, sizeof(s->crypto_header),
2523                              buflen);
2524         s->crypto_header.offset = be64_to_cpu(s->crypto_header.offset);
2525         s->crypto_header.length = be64_to_cpu(s->crypto_header.length);
2526         if (ret < 0) {
2527             goto fail;
2528         }
2529         buf += ret;
2530         buflen -= ret;
2531     }
2532 
2533     /* Feature table */
2534     if (s->qcow_version >= 3) {
2535         Qcow2Feature features[] = {
2536             {
2537                 .type = QCOW2_FEAT_TYPE_INCOMPATIBLE,
2538                 .bit  = QCOW2_INCOMPAT_DIRTY_BITNR,
2539                 .name = "dirty bit",
2540             },
2541             {
2542                 .type = QCOW2_FEAT_TYPE_INCOMPATIBLE,
2543                 .bit  = QCOW2_INCOMPAT_CORRUPT_BITNR,
2544                 .name = "corrupt bit",
2545             },
2546             {
2547                 .type = QCOW2_FEAT_TYPE_INCOMPATIBLE,
2548                 .bit  = QCOW2_INCOMPAT_DATA_FILE_BITNR,
2549                 .name = "external data file",
2550             },
2551             {
2552                 .type = QCOW2_FEAT_TYPE_COMPATIBLE,
2553                 .bit  = QCOW2_COMPAT_LAZY_REFCOUNTS_BITNR,
2554                 .name = "lazy refcounts",
2555             },
2556         };
2557 
2558         ret = header_ext_add(buf, QCOW2_EXT_MAGIC_FEATURE_TABLE,
2559                              features, sizeof(features), buflen);
2560         if (ret < 0) {
2561             goto fail;
2562         }
2563         buf += ret;
2564         buflen -= ret;
2565     }
2566 
2567     /* Bitmap extension */
2568     if (s->nb_bitmaps > 0) {
2569         Qcow2BitmapHeaderExt bitmaps_header = {
2570             .nb_bitmaps = cpu_to_be32(s->nb_bitmaps),
2571             .bitmap_directory_size =
2572                     cpu_to_be64(s->bitmap_directory_size),
2573             .bitmap_directory_offset =
2574                     cpu_to_be64(s->bitmap_directory_offset)
2575         };
2576         ret = header_ext_add(buf, QCOW2_EXT_MAGIC_BITMAPS,
2577                              &bitmaps_header, sizeof(bitmaps_header),
2578                              buflen);
2579         if (ret < 0) {
2580             goto fail;
2581         }
2582         buf += ret;
2583         buflen -= ret;
2584     }
2585 
2586     /* Keep unknown header extensions */
2587     QLIST_FOREACH(uext, &s->unknown_header_ext, next) {
2588         ret = header_ext_add(buf, uext->magic, uext->data, uext->len, buflen);
2589         if (ret < 0) {
2590             goto fail;
2591         }
2592 
2593         buf += ret;
2594         buflen -= ret;
2595     }
2596 
2597     /* End of header extensions */
2598     ret = header_ext_add(buf, QCOW2_EXT_MAGIC_END, NULL, 0, buflen);
2599     if (ret < 0) {
2600         goto fail;
2601     }
2602 
2603     buf += ret;
2604     buflen -= ret;
2605 
2606     /* Backing file name */
2607     if (s->image_backing_file) {
2608         size_t backing_file_len = strlen(s->image_backing_file);
2609 
2610         if (buflen < backing_file_len) {
2611             ret = -ENOSPC;
2612             goto fail;
2613         }
2614 
2615         /* Using strncpy is ok here, since buf is not NUL-terminated. */
2616         strncpy(buf, s->image_backing_file, buflen);
2617 
2618         header->backing_file_offset = cpu_to_be64(buf - ((char*) header));
2619         header->backing_file_size   = cpu_to_be32(backing_file_len);
2620     }
2621 
2622     /* Write the new header */
2623     ret = bdrv_pwrite(bs->file, 0, header, s->cluster_size);
2624     if (ret < 0) {
2625         goto fail;
2626     }
2627 
2628     ret = 0;
2629 fail:
2630     qemu_vfree(header);
2631     return ret;
2632 }
2633 
2634 static int qcow2_change_backing_file(BlockDriverState *bs,
2635     const char *backing_file, const char *backing_fmt)
2636 {
2637     BDRVQcow2State *s = bs->opaque;
2638 
2639     /* Adding a backing file means that the external data file alone won't be
2640      * enough to make sense of the content */
2641     if (backing_file && data_file_is_raw(bs)) {
2642         return -EINVAL;
2643     }
2644 
2645     if (backing_file && strlen(backing_file) > 1023) {
2646         return -EINVAL;
2647     }
2648 
2649     pstrcpy(bs->auto_backing_file, sizeof(bs->auto_backing_file),
2650             backing_file ?: "");
2651     pstrcpy(bs->backing_file, sizeof(bs->backing_file), backing_file ?: "");
2652     pstrcpy(bs->backing_format, sizeof(bs->backing_format), backing_fmt ?: "");
2653 
2654     g_free(s->image_backing_file);
2655     g_free(s->image_backing_format);
2656 
2657     s->image_backing_file = backing_file ? g_strdup(bs->backing_file) : NULL;
2658     s->image_backing_format = backing_fmt ? g_strdup(bs->backing_format) : NULL;
2659 
2660     return qcow2_update_header(bs);
2661 }
2662 
2663 static int qcow2_crypt_method_from_format(const char *encryptfmt)
2664 {
2665     if (g_str_equal(encryptfmt, "luks")) {
2666         return QCOW_CRYPT_LUKS;
2667     } else if (g_str_equal(encryptfmt, "aes")) {
2668         return QCOW_CRYPT_AES;
2669     } else {
2670         return -EINVAL;
2671     }
2672 }
2673 
2674 static int qcow2_set_up_encryption(BlockDriverState *bs,
2675                                    QCryptoBlockCreateOptions *cryptoopts,
2676                                    Error **errp)
2677 {
2678     BDRVQcow2State *s = bs->opaque;
2679     QCryptoBlock *crypto = NULL;
2680     int fmt, ret;
2681 
2682     switch (cryptoopts->format) {
2683     case Q_CRYPTO_BLOCK_FORMAT_LUKS:
2684         fmt = QCOW_CRYPT_LUKS;
2685         break;
2686     case Q_CRYPTO_BLOCK_FORMAT_QCOW:
2687         fmt = QCOW_CRYPT_AES;
2688         break;
2689     default:
2690         error_setg(errp, "Crypto format not supported in qcow2");
2691         return -EINVAL;
2692     }
2693 
2694     s->crypt_method_header = fmt;
2695 
2696     crypto = qcrypto_block_create(cryptoopts, "encrypt.",
2697                                   qcow2_crypto_hdr_init_func,
2698                                   qcow2_crypto_hdr_write_func,
2699                                   bs, errp);
2700     if (!crypto) {
2701         return -EINVAL;
2702     }
2703 
2704     ret = qcow2_update_header(bs);
2705     if (ret < 0) {
2706         error_setg_errno(errp, -ret, "Could not write encryption header");
2707         goto out;
2708     }
2709 
2710     ret = 0;
2711  out:
2712     qcrypto_block_free(crypto);
2713     return ret;
2714 }
2715 
2716 /**
2717  * Preallocates metadata structures for data clusters between @offset (in the
2718  * guest disk) and @new_length (which is thus generally the new guest disk
2719  * size).
2720  *
2721  * Returns: 0 on success, -errno on failure.
2722  */
2723 static int coroutine_fn preallocate_co(BlockDriverState *bs, uint64_t offset,
2724                                        uint64_t new_length)
2725 {
2726     uint64_t bytes;
2727     uint64_t host_offset = 0;
2728     unsigned int cur_bytes;
2729     int ret;
2730     QCowL2Meta *meta;
2731 
2732     assert(offset <= new_length);
2733     bytes = new_length - offset;
2734 
2735     while (bytes) {
2736         cur_bytes = MIN(bytes, INT_MAX);
2737         ret = qcow2_alloc_cluster_offset(bs, offset, &cur_bytes,
2738                                          &host_offset, &meta);
2739         if (ret < 0) {
2740             return ret;
2741         }
2742 
2743         while (meta) {
2744             QCowL2Meta *next = meta->next;
2745 
2746             ret = qcow2_alloc_cluster_link_l2(bs, meta);
2747             if (ret < 0) {
2748                 qcow2_free_any_clusters(bs, meta->alloc_offset,
2749                                         meta->nb_clusters, QCOW2_DISCARD_NEVER);
2750                 return ret;
2751             }
2752 
2753             /* There are no dependent requests, but we need to remove our
2754              * request from the list of in-flight requests */
2755             QLIST_REMOVE(meta, next_in_flight);
2756 
2757             g_free(meta);
2758             meta = next;
2759         }
2760 
2761         /* TODO Preallocate data if requested */
2762 
2763         bytes -= cur_bytes;
2764         offset += cur_bytes;
2765     }
2766 
2767     /*
2768      * It is expected that the image file is large enough to actually contain
2769      * all of the allocated clusters (otherwise we get failing reads after
2770      * EOF). Extend the image to the last allocated sector.
2771      */
2772     if (host_offset != 0) {
2773         uint8_t data = 0;
2774         ret = bdrv_pwrite(bs->file, (host_offset + cur_bytes) - 1,
2775                           &data, 1);
2776         if (ret < 0) {
2777             return ret;
2778         }
2779     }
2780 
2781     return 0;
2782 }
2783 
2784 /* qcow2_refcount_metadata_size:
2785  * @clusters: number of clusters to refcount (including data and L1/L2 tables)
2786  * @cluster_size: size of a cluster, in bytes
2787  * @refcount_order: refcount bits power-of-2 exponent
2788  * @generous_increase: allow for the refcount table to be 1.5x as large as it
2789  *                     needs to be
2790  *
2791  * Returns: Number of bytes required for refcount blocks and table metadata.
2792  */
2793 int64_t qcow2_refcount_metadata_size(int64_t clusters, size_t cluster_size,
2794                                      int refcount_order, bool generous_increase,
2795                                      uint64_t *refblock_count)
2796 {
2797     /*
2798      * Every host cluster is reference-counted, including metadata (even
2799      * refcount metadata is recursively included).
2800      *
2801      * An accurate formula for the size of refcount metadata size is difficult
2802      * to derive.  An easier method of calculation is finding the fixed point
2803      * where no further refcount blocks or table clusters are required to
2804      * reference count every cluster.
2805      */
2806     int64_t blocks_per_table_cluster = cluster_size / sizeof(uint64_t);
2807     int64_t refcounts_per_block = cluster_size * 8 / (1 << refcount_order);
2808     int64_t table = 0;  /* number of refcount table clusters */
2809     int64_t blocks = 0; /* number of refcount block clusters */
2810     int64_t last;
2811     int64_t n = 0;
2812 
2813     do {
2814         last = n;
2815         blocks = DIV_ROUND_UP(clusters + table + blocks, refcounts_per_block);
2816         table = DIV_ROUND_UP(blocks, blocks_per_table_cluster);
2817         n = clusters + blocks + table;
2818 
2819         if (n == last && generous_increase) {
2820             clusters += DIV_ROUND_UP(table, 2);
2821             n = 0; /* force another loop */
2822             generous_increase = false;
2823         }
2824     } while (n != last);
2825 
2826     if (refblock_count) {
2827         *refblock_count = blocks;
2828     }
2829 
2830     return (blocks + table) * cluster_size;
2831 }
2832 
2833 /**
2834  * qcow2_calc_prealloc_size:
2835  * @total_size: virtual disk size in bytes
2836  * @cluster_size: cluster size in bytes
2837  * @refcount_order: refcount bits power-of-2 exponent
2838  *
2839  * Returns: Total number of bytes required for the fully allocated image
2840  * (including metadata).
2841  */
2842 static int64_t qcow2_calc_prealloc_size(int64_t total_size,
2843                                         size_t cluster_size,
2844                                         int refcount_order)
2845 {
2846     int64_t meta_size = 0;
2847     uint64_t nl1e, nl2e;
2848     int64_t aligned_total_size = ROUND_UP(total_size, cluster_size);
2849 
2850     /* header: 1 cluster */
2851     meta_size += cluster_size;
2852 
2853     /* total size of L2 tables */
2854     nl2e = aligned_total_size / cluster_size;
2855     nl2e = ROUND_UP(nl2e, cluster_size / sizeof(uint64_t));
2856     meta_size += nl2e * sizeof(uint64_t);
2857 
2858     /* total size of L1 tables */
2859     nl1e = nl2e * sizeof(uint64_t) / cluster_size;
2860     nl1e = ROUND_UP(nl1e, cluster_size / sizeof(uint64_t));
2861     meta_size += nl1e * sizeof(uint64_t);
2862 
2863     /* total size of refcount table and blocks */
2864     meta_size += qcow2_refcount_metadata_size(
2865             (meta_size + aligned_total_size) / cluster_size,
2866             cluster_size, refcount_order, false, NULL);
2867 
2868     return meta_size + aligned_total_size;
2869 }
2870 
2871 static bool validate_cluster_size(size_t cluster_size, Error **errp)
2872 {
2873     int cluster_bits = ctz32(cluster_size);
2874     if (cluster_bits < MIN_CLUSTER_BITS || cluster_bits > MAX_CLUSTER_BITS ||
2875         (1 << cluster_bits) != cluster_size)
2876     {
2877         error_setg(errp, "Cluster size must be a power of two between %d and "
2878                    "%dk", 1 << MIN_CLUSTER_BITS, 1 << (MAX_CLUSTER_BITS - 10));
2879         return false;
2880     }
2881     return true;
2882 }
2883 
2884 static size_t qcow2_opt_get_cluster_size_del(QemuOpts *opts, Error **errp)
2885 {
2886     size_t cluster_size;
2887 
2888     cluster_size = qemu_opt_get_size_del(opts, BLOCK_OPT_CLUSTER_SIZE,
2889                                          DEFAULT_CLUSTER_SIZE);
2890     if (!validate_cluster_size(cluster_size, errp)) {
2891         return 0;
2892     }
2893     return cluster_size;
2894 }
2895 
2896 static int qcow2_opt_get_version_del(QemuOpts *opts, Error **errp)
2897 {
2898     char *buf;
2899     int ret;
2900 
2901     buf = qemu_opt_get_del(opts, BLOCK_OPT_COMPAT_LEVEL);
2902     if (!buf) {
2903         ret = 3; /* default */
2904     } else if (!strcmp(buf, "0.10")) {
2905         ret = 2;
2906     } else if (!strcmp(buf, "1.1")) {
2907         ret = 3;
2908     } else {
2909         error_setg(errp, "Invalid compatibility level: '%s'", buf);
2910         ret = -EINVAL;
2911     }
2912     g_free(buf);
2913     return ret;
2914 }
2915 
2916 static uint64_t qcow2_opt_get_refcount_bits_del(QemuOpts *opts, int version,
2917                                                 Error **errp)
2918 {
2919     uint64_t refcount_bits;
2920 
2921     refcount_bits = qemu_opt_get_number_del(opts, BLOCK_OPT_REFCOUNT_BITS, 16);
2922     if (refcount_bits > 64 || !is_power_of_2(refcount_bits)) {
2923         error_setg(errp, "Refcount width must be a power of two and may not "
2924                    "exceed 64 bits");
2925         return 0;
2926     }
2927 
2928     if (version < 3 && refcount_bits != 16) {
2929         error_setg(errp, "Different refcount widths than 16 bits require "
2930                    "compatibility level 1.1 or above (use compat=1.1 or "
2931                    "greater)");
2932         return 0;
2933     }
2934 
2935     return refcount_bits;
2936 }
2937 
2938 static int coroutine_fn
2939 qcow2_co_create(BlockdevCreateOptions *create_options, Error **errp)
2940 {
2941     BlockdevCreateOptionsQcow2 *qcow2_opts;
2942     QDict *options;
2943 
2944     /*
2945      * Open the image file and write a minimal qcow2 header.
2946      *
2947      * We keep things simple and start with a zero-sized image. We also
2948      * do without refcount blocks or a L1 table for now. We'll fix the
2949      * inconsistency later.
2950      *
2951      * We do need a refcount table because growing the refcount table means
2952      * allocating two new refcount blocks - the seconds of which would be at
2953      * 2 GB for 64k clusters, and we don't want to have a 2 GB initial file
2954      * size for any qcow2 image.
2955      */
2956     BlockBackend *blk = NULL;
2957     BlockDriverState *bs = NULL;
2958     BlockDriverState *data_bs = NULL;
2959     QCowHeader *header;
2960     size_t cluster_size;
2961     int version;
2962     int refcount_order;
2963     uint64_t* refcount_table;
2964     Error *local_err = NULL;
2965     int ret;
2966 
2967     assert(create_options->driver == BLOCKDEV_DRIVER_QCOW2);
2968     qcow2_opts = &create_options->u.qcow2;
2969 
2970     bs = bdrv_open_blockdev_ref(qcow2_opts->file, errp);
2971     if (bs == NULL) {
2972         return -EIO;
2973     }
2974 
2975     /* Validate options and set default values */
2976     if (!QEMU_IS_ALIGNED(qcow2_opts->size, BDRV_SECTOR_SIZE)) {
2977         error_setg(errp, "Image size must be a multiple of 512 bytes");
2978         ret = -EINVAL;
2979         goto out;
2980     }
2981 
2982     if (qcow2_opts->has_version) {
2983         switch (qcow2_opts->version) {
2984         case BLOCKDEV_QCOW2_VERSION_V2:
2985             version = 2;
2986             break;
2987         case BLOCKDEV_QCOW2_VERSION_V3:
2988             version = 3;
2989             break;
2990         default:
2991             g_assert_not_reached();
2992         }
2993     } else {
2994         version = 3;
2995     }
2996 
2997     if (qcow2_opts->has_cluster_size) {
2998         cluster_size = qcow2_opts->cluster_size;
2999     } else {
3000         cluster_size = DEFAULT_CLUSTER_SIZE;
3001     }
3002 
3003     if (!validate_cluster_size(cluster_size, errp)) {
3004         ret = -EINVAL;
3005         goto out;
3006     }
3007 
3008     if (!qcow2_opts->has_preallocation) {
3009         qcow2_opts->preallocation = PREALLOC_MODE_OFF;
3010     }
3011     if (qcow2_opts->has_backing_file &&
3012         qcow2_opts->preallocation != PREALLOC_MODE_OFF)
3013     {
3014         error_setg(errp, "Backing file and preallocation cannot be used at "
3015                    "the same time");
3016         ret = -EINVAL;
3017         goto out;
3018     }
3019     if (qcow2_opts->has_backing_fmt && !qcow2_opts->has_backing_file) {
3020         error_setg(errp, "Backing format cannot be used without backing file");
3021         ret = -EINVAL;
3022         goto out;
3023     }
3024 
3025     if (!qcow2_opts->has_lazy_refcounts) {
3026         qcow2_opts->lazy_refcounts = false;
3027     }
3028     if (version < 3 && qcow2_opts->lazy_refcounts) {
3029         error_setg(errp, "Lazy refcounts only supported with compatibility "
3030                    "level 1.1 and above (use version=v3 or greater)");
3031         ret = -EINVAL;
3032         goto out;
3033     }
3034 
3035     if (!qcow2_opts->has_refcount_bits) {
3036         qcow2_opts->refcount_bits = 16;
3037     }
3038     if (qcow2_opts->refcount_bits > 64 ||
3039         !is_power_of_2(qcow2_opts->refcount_bits))
3040     {
3041         error_setg(errp, "Refcount width must be a power of two and may not "
3042                    "exceed 64 bits");
3043         ret = -EINVAL;
3044         goto out;
3045     }
3046     if (version < 3 && qcow2_opts->refcount_bits != 16) {
3047         error_setg(errp, "Different refcount widths than 16 bits require "
3048                    "compatibility level 1.1 or above (use version=v3 or "
3049                    "greater)");
3050         ret = -EINVAL;
3051         goto out;
3052     }
3053     refcount_order = ctz32(qcow2_opts->refcount_bits);
3054 
3055     if (qcow2_opts->data_file_raw && !qcow2_opts->data_file) {
3056         error_setg(errp, "data-file-raw requires data-file");
3057         ret = -EINVAL;
3058         goto out;
3059     }
3060     if (qcow2_opts->data_file_raw && qcow2_opts->has_backing_file) {
3061         error_setg(errp, "Backing file and data-file-raw cannot be used at "
3062                    "the same time");
3063         ret = -EINVAL;
3064         goto out;
3065     }
3066 
3067     if (qcow2_opts->data_file) {
3068         if (version < 3) {
3069             error_setg(errp, "External data files are only supported with "
3070                        "compatibility level 1.1 and above (use version=v3 or "
3071                        "greater)");
3072             ret = -EINVAL;
3073             goto out;
3074         }
3075         data_bs = bdrv_open_blockdev_ref(qcow2_opts->data_file, errp);
3076         if (bs == NULL) {
3077             ret = -EIO;
3078             goto out;
3079         }
3080     }
3081 
3082     /* Create BlockBackend to write to the image */
3083     blk = blk_new(BLK_PERM_WRITE | BLK_PERM_RESIZE, BLK_PERM_ALL);
3084     ret = blk_insert_bs(blk, bs, errp);
3085     if (ret < 0) {
3086         goto out;
3087     }
3088     blk_set_allow_write_beyond_eof(blk, true);
3089 
3090     /* Clear the protocol layer and preallocate it if necessary */
3091     ret = blk_truncate(blk, 0, PREALLOC_MODE_OFF, errp);
3092     if (ret < 0) {
3093         goto out;
3094     }
3095 
3096     /* Write the header */
3097     QEMU_BUILD_BUG_ON((1 << MIN_CLUSTER_BITS) < sizeof(*header));
3098     header = g_malloc0(cluster_size);
3099     *header = (QCowHeader) {
3100         .magic                      = cpu_to_be32(QCOW_MAGIC),
3101         .version                    = cpu_to_be32(version),
3102         .cluster_bits               = cpu_to_be32(ctz32(cluster_size)),
3103         .size                       = cpu_to_be64(0),
3104         .l1_table_offset            = cpu_to_be64(0),
3105         .l1_size                    = cpu_to_be32(0),
3106         .refcount_table_offset      = cpu_to_be64(cluster_size),
3107         .refcount_table_clusters    = cpu_to_be32(1),
3108         .refcount_order             = cpu_to_be32(refcount_order),
3109         .header_length              = cpu_to_be32(sizeof(*header)),
3110     };
3111 
3112     /* We'll update this to correct value later */
3113     header->crypt_method = cpu_to_be32(QCOW_CRYPT_NONE);
3114 
3115     if (qcow2_opts->lazy_refcounts) {
3116         header->compatible_features |=
3117             cpu_to_be64(QCOW2_COMPAT_LAZY_REFCOUNTS);
3118     }
3119     if (data_bs) {
3120         header->incompatible_features |=
3121             cpu_to_be64(QCOW2_INCOMPAT_DATA_FILE);
3122     }
3123     if (qcow2_opts->data_file_raw) {
3124         header->autoclear_features |=
3125             cpu_to_be64(QCOW2_AUTOCLEAR_DATA_FILE_RAW);
3126     }
3127 
3128     ret = blk_pwrite(blk, 0, header, cluster_size, 0);
3129     g_free(header);
3130     if (ret < 0) {
3131         error_setg_errno(errp, -ret, "Could not write qcow2 header");
3132         goto out;
3133     }
3134 
3135     /* Write a refcount table with one refcount block */
3136     refcount_table = g_malloc0(2 * cluster_size);
3137     refcount_table[0] = cpu_to_be64(2 * cluster_size);
3138     ret = blk_pwrite(blk, cluster_size, refcount_table, 2 * cluster_size, 0);
3139     g_free(refcount_table);
3140 
3141     if (ret < 0) {
3142         error_setg_errno(errp, -ret, "Could not write refcount table");
3143         goto out;
3144     }
3145 
3146     blk_unref(blk);
3147     blk = NULL;
3148 
3149     /*
3150      * And now open the image and make it consistent first (i.e. increase the
3151      * refcount of the cluster that is occupied by the header and the refcount
3152      * table)
3153      */
3154     options = qdict_new();
3155     qdict_put_str(options, "driver", "qcow2");
3156     qdict_put_str(options, "file", bs->node_name);
3157     if (data_bs) {
3158         qdict_put_str(options, "data-file", data_bs->node_name);
3159     }
3160     blk = blk_new_open(NULL, NULL, options,
3161                        BDRV_O_RDWR | BDRV_O_RESIZE | BDRV_O_NO_FLUSH,
3162                        &local_err);
3163     if (blk == NULL) {
3164         error_propagate(errp, local_err);
3165         ret = -EIO;
3166         goto out;
3167     }
3168 
3169     ret = qcow2_alloc_clusters(blk_bs(blk), 3 * cluster_size);
3170     if (ret < 0) {
3171         error_setg_errno(errp, -ret, "Could not allocate clusters for qcow2 "
3172                          "header and refcount table");
3173         goto out;
3174 
3175     } else if (ret != 0) {
3176         error_report("Huh, first cluster in empty image is already in use?");
3177         abort();
3178     }
3179 
3180     /* Set the external data file if necessary */
3181     if (data_bs) {
3182         BDRVQcow2State *s = blk_bs(blk)->opaque;
3183         s->image_data_file = g_strdup(data_bs->filename);
3184     }
3185 
3186     /* Create a full header (including things like feature table) */
3187     ret = qcow2_update_header(blk_bs(blk));
3188     if (ret < 0) {
3189         error_setg_errno(errp, -ret, "Could not update qcow2 header");
3190         goto out;
3191     }
3192 
3193     /* Okay, now that we have a valid image, let's give it the right size */
3194     ret = blk_truncate(blk, qcow2_opts->size, qcow2_opts->preallocation, errp);
3195     if (ret < 0) {
3196         error_prepend(errp, "Could not resize image: ");
3197         goto out;
3198     }
3199 
3200     /* Want a backing file? There you go.*/
3201     if (qcow2_opts->has_backing_file) {
3202         const char *backing_format = NULL;
3203 
3204         if (qcow2_opts->has_backing_fmt) {
3205             backing_format = BlockdevDriver_str(qcow2_opts->backing_fmt);
3206         }
3207 
3208         ret = bdrv_change_backing_file(blk_bs(blk), qcow2_opts->backing_file,
3209                                        backing_format);
3210         if (ret < 0) {
3211             error_setg_errno(errp, -ret, "Could not assign backing file '%s' "
3212                              "with format '%s'", qcow2_opts->backing_file,
3213                              backing_format);
3214             goto out;
3215         }
3216     }
3217 
3218     /* Want encryption? There you go. */
3219     if (qcow2_opts->has_encrypt) {
3220         ret = qcow2_set_up_encryption(blk_bs(blk), qcow2_opts->encrypt, errp);
3221         if (ret < 0) {
3222             goto out;
3223         }
3224     }
3225 
3226     blk_unref(blk);
3227     blk = NULL;
3228 
3229     /* Reopen the image without BDRV_O_NO_FLUSH to flush it before returning.
3230      * Using BDRV_O_NO_IO, since encryption is now setup we don't want to
3231      * have to setup decryption context. We're not doing any I/O on the top
3232      * level BlockDriverState, only lower layers, where BDRV_O_NO_IO does
3233      * not have effect.
3234      */
3235     options = qdict_new();
3236     qdict_put_str(options, "driver", "qcow2");
3237     qdict_put_str(options, "file", bs->node_name);
3238     if (data_bs) {
3239         qdict_put_str(options, "data-file", data_bs->node_name);
3240     }
3241     blk = blk_new_open(NULL, NULL, options,
3242                        BDRV_O_RDWR | BDRV_O_NO_BACKING | BDRV_O_NO_IO,
3243                        &local_err);
3244     if (blk == NULL) {
3245         error_propagate(errp, local_err);
3246         ret = -EIO;
3247         goto out;
3248     }
3249 
3250     ret = 0;
3251 out:
3252     blk_unref(blk);
3253     bdrv_unref(bs);
3254     bdrv_unref(data_bs);
3255     return ret;
3256 }
3257 
3258 static int coroutine_fn qcow2_co_create_opts(const char *filename, QemuOpts *opts,
3259                                              Error **errp)
3260 {
3261     BlockdevCreateOptions *create_options = NULL;
3262     QDict *qdict;
3263     Visitor *v;
3264     BlockDriverState *bs = NULL;
3265     BlockDriverState *data_bs = NULL;
3266     Error *local_err = NULL;
3267     const char *val;
3268     int ret;
3269 
3270     /* Only the keyval visitor supports the dotted syntax needed for
3271      * encryption, so go through a QDict before getting a QAPI type. Ignore
3272      * options meant for the protocol layer so that the visitor doesn't
3273      * complain. */
3274     qdict = qemu_opts_to_qdict_filtered(opts, NULL, bdrv_qcow2.create_opts,
3275                                         true);
3276 
3277     /* Handle encryption options */
3278     val = qdict_get_try_str(qdict, BLOCK_OPT_ENCRYPT);
3279     if (val && !strcmp(val, "on")) {
3280         qdict_put_str(qdict, BLOCK_OPT_ENCRYPT, "qcow");
3281     } else if (val && !strcmp(val, "off")) {
3282         qdict_del(qdict, BLOCK_OPT_ENCRYPT);
3283     }
3284 
3285     val = qdict_get_try_str(qdict, BLOCK_OPT_ENCRYPT_FORMAT);
3286     if (val && !strcmp(val, "aes")) {
3287         qdict_put_str(qdict, BLOCK_OPT_ENCRYPT_FORMAT, "qcow");
3288     }
3289 
3290     /* Convert compat=0.10/1.1 into compat=v2/v3, to be renamed into
3291      * version=v2/v3 below. */
3292     val = qdict_get_try_str(qdict, BLOCK_OPT_COMPAT_LEVEL);
3293     if (val && !strcmp(val, "0.10")) {
3294         qdict_put_str(qdict, BLOCK_OPT_COMPAT_LEVEL, "v2");
3295     } else if (val && !strcmp(val, "1.1")) {
3296         qdict_put_str(qdict, BLOCK_OPT_COMPAT_LEVEL, "v3");
3297     }
3298 
3299     /* Change legacy command line options into QMP ones */
3300     static const QDictRenames opt_renames[] = {
3301         { BLOCK_OPT_BACKING_FILE,       "backing-file" },
3302         { BLOCK_OPT_BACKING_FMT,        "backing-fmt" },
3303         { BLOCK_OPT_CLUSTER_SIZE,       "cluster-size" },
3304         { BLOCK_OPT_LAZY_REFCOUNTS,     "lazy-refcounts" },
3305         { BLOCK_OPT_REFCOUNT_BITS,      "refcount-bits" },
3306         { BLOCK_OPT_ENCRYPT,            BLOCK_OPT_ENCRYPT_FORMAT },
3307         { BLOCK_OPT_COMPAT_LEVEL,       "version" },
3308         { BLOCK_OPT_DATA_FILE_RAW,      "data-file-raw" },
3309         { NULL, NULL },
3310     };
3311 
3312     if (!qdict_rename_keys(qdict, opt_renames, errp)) {
3313         ret = -EINVAL;
3314         goto finish;
3315     }
3316 
3317     /* Create and open the file (protocol layer) */
3318     ret = bdrv_create_file(filename, opts, errp);
3319     if (ret < 0) {
3320         goto finish;
3321     }
3322 
3323     bs = bdrv_open(filename, NULL, NULL,
3324                    BDRV_O_RDWR | BDRV_O_RESIZE | BDRV_O_PROTOCOL, errp);
3325     if (bs == NULL) {
3326         ret = -EIO;
3327         goto finish;
3328     }
3329 
3330     /* Create and open an external data file (protocol layer) */
3331     val = qdict_get_try_str(qdict, BLOCK_OPT_DATA_FILE);
3332     if (val) {
3333         ret = bdrv_create_file(val, opts, errp);
3334         if (ret < 0) {
3335             goto finish;
3336         }
3337 
3338         data_bs = bdrv_open(val, NULL, NULL,
3339                             BDRV_O_RDWR | BDRV_O_RESIZE | BDRV_O_PROTOCOL,
3340                             errp);
3341         if (data_bs == NULL) {
3342             ret = -EIO;
3343             goto finish;
3344         }
3345 
3346         qdict_del(qdict, BLOCK_OPT_DATA_FILE);
3347         qdict_put_str(qdict, "data-file", data_bs->node_name);
3348     }
3349 
3350     /* Set 'driver' and 'node' options */
3351     qdict_put_str(qdict, "driver", "qcow2");
3352     qdict_put_str(qdict, "file", bs->node_name);
3353 
3354     /* Now get the QAPI type BlockdevCreateOptions */
3355     v = qobject_input_visitor_new_flat_confused(qdict, errp);
3356     if (!v) {
3357         ret = -EINVAL;
3358         goto finish;
3359     }
3360 
3361     visit_type_BlockdevCreateOptions(v, NULL, &create_options, &local_err);
3362     visit_free(v);
3363 
3364     if (local_err) {
3365         error_propagate(errp, local_err);
3366         ret = -EINVAL;
3367         goto finish;
3368     }
3369 
3370     /* Silently round up size */
3371     create_options->u.qcow2.size = ROUND_UP(create_options->u.qcow2.size,
3372                                             BDRV_SECTOR_SIZE);
3373 
3374     /* Create the qcow2 image (format layer) */
3375     ret = qcow2_co_create(create_options, errp);
3376     if (ret < 0) {
3377         goto finish;
3378     }
3379 
3380     ret = 0;
3381 finish:
3382     qobject_unref(qdict);
3383     bdrv_unref(bs);
3384     bdrv_unref(data_bs);
3385     qapi_free_BlockdevCreateOptions(create_options);
3386     return ret;
3387 }
3388 
3389 
3390 static bool is_zero(BlockDriverState *bs, int64_t offset, int64_t bytes)
3391 {
3392     int64_t nr;
3393     int res;
3394 
3395     /* Clamp to image length, before checking status of underlying sectors */
3396     if (offset + bytes > bs->total_sectors * BDRV_SECTOR_SIZE) {
3397         bytes = bs->total_sectors * BDRV_SECTOR_SIZE - offset;
3398     }
3399 
3400     if (!bytes) {
3401         return true;
3402     }
3403     res = bdrv_block_status_above(bs, NULL, offset, bytes, &nr, NULL, NULL);
3404     return res >= 0 && (res & BDRV_BLOCK_ZERO) && nr == bytes;
3405 }
3406 
3407 static coroutine_fn int qcow2_co_pwrite_zeroes(BlockDriverState *bs,
3408     int64_t offset, int bytes, BdrvRequestFlags flags)
3409 {
3410     int ret;
3411     BDRVQcow2State *s = bs->opaque;
3412 
3413     uint32_t head = offset % s->cluster_size;
3414     uint32_t tail = (offset + bytes) % s->cluster_size;
3415 
3416     trace_qcow2_pwrite_zeroes_start_req(qemu_coroutine_self(), offset, bytes);
3417     if (offset + bytes == bs->total_sectors * BDRV_SECTOR_SIZE) {
3418         tail = 0;
3419     }
3420 
3421     if (head || tail) {
3422         uint64_t off;
3423         unsigned int nr;
3424 
3425         assert(head + bytes <= s->cluster_size);
3426 
3427         /* check whether remainder of cluster already reads as zero */
3428         if (!(is_zero(bs, offset - head, head) &&
3429               is_zero(bs, offset + bytes,
3430                       tail ? s->cluster_size - tail : 0))) {
3431             return -ENOTSUP;
3432         }
3433 
3434         qemu_co_mutex_lock(&s->lock);
3435         /* We can have new write after previous check */
3436         offset = QEMU_ALIGN_DOWN(offset, s->cluster_size);
3437         bytes = s->cluster_size;
3438         nr = s->cluster_size;
3439         ret = qcow2_get_cluster_offset(bs, offset, &nr, &off);
3440         if (ret != QCOW2_CLUSTER_UNALLOCATED &&
3441             ret != QCOW2_CLUSTER_ZERO_PLAIN &&
3442             ret != QCOW2_CLUSTER_ZERO_ALLOC) {
3443             qemu_co_mutex_unlock(&s->lock);
3444             return -ENOTSUP;
3445         }
3446     } else {
3447         qemu_co_mutex_lock(&s->lock);
3448     }
3449 
3450     trace_qcow2_pwrite_zeroes(qemu_coroutine_self(), offset, bytes);
3451 
3452     /* Whatever is left can use real zero clusters */
3453     ret = qcow2_cluster_zeroize(bs, offset, bytes, flags);
3454     qemu_co_mutex_unlock(&s->lock);
3455 
3456     return ret;
3457 }
3458 
3459 static coroutine_fn int qcow2_co_pdiscard(BlockDriverState *bs,
3460                                           int64_t offset, int bytes)
3461 {
3462     int ret;
3463     BDRVQcow2State *s = bs->opaque;
3464 
3465     if (!QEMU_IS_ALIGNED(offset | bytes, s->cluster_size)) {
3466         assert(bytes < s->cluster_size);
3467         /* Ignore partial clusters, except for the special case of the
3468          * complete partial cluster at the end of an unaligned file */
3469         if (!QEMU_IS_ALIGNED(offset, s->cluster_size) ||
3470             offset + bytes != bs->total_sectors * BDRV_SECTOR_SIZE) {
3471             return -ENOTSUP;
3472         }
3473     }
3474 
3475     qemu_co_mutex_lock(&s->lock);
3476     ret = qcow2_cluster_discard(bs, offset, bytes, QCOW2_DISCARD_REQUEST,
3477                                 false);
3478     qemu_co_mutex_unlock(&s->lock);
3479     return ret;
3480 }
3481 
3482 static int coroutine_fn
3483 qcow2_co_copy_range_from(BlockDriverState *bs,
3484                          BdrvChild *src, uint64_t src_offset,
3485                          BdrvChild *dst, uint64_t dst_offset,
3486                          uint64_t bytes, BdrvRequestFlags read_flags,
3487                          BdrvRequestFlags write_flags)
3488 {
3489     BDRVQcow2State *s = bs->opaque;
3490     int ret;
3491     unsigned int cur_bytes; /* number of bytes in current iteration */
3492     BdrvChild *child = NULL;
3493     BdrvRequestFlags cur_write_flags;
3494 
3495     assert(!bs->encrypted);
3496     qemu_co_mutex_lock(&s->lock);
3497 
3498     while (bytes != 0) {
3499         uint64_t copy_offset = 0;
3500         /* prepare next request */
3501         cur_bytes = MIN(bytes, INT_MAX);
3502         cur_write_flags = write_flags;
3503 
3504         ret = qcow2_get_cluster_offset(bs, src_offset, &cur_bytes, &copy_offset);
3505         if (ret < 0) {
3506             goto out;
3507         }
3508 
3509         switch (ret) {
3510         case QCOW2_CLUSTER_UNALLOCATED:
3511             if (bs->backing && bs->backing->bs) {
3512                 int64_t backing_length = bdrv_getlength(bs->backing->bs);
3513                 if (src_offset >= backing_length) {
3514                     cur_write_flags |= BDRV_REQ_ZERO_WRITE;
3515                 } else {
3516                     child = bs->backing;
3517                     cur_bytes = MIN(cur_bytes, backing_length - src_offset);
3518                     copy_offset = src_offset;
3519                 }
3520             } else {
3521                 cur_write_flags |= BDRV_REQ_ZERO_WRITE;
3522             }
3523             break;
3524 
3525         case QCOW2_CLUSTER_ZERO_PLAIN:
3526         case QCOW2_CLUSTER_ZERO_ALLOC:
3527             cur_write_flags |= BDRV_REQ_ZERO_WRITE;
3528             break;
3529 
3530         case QCOW2_CLUSTER_COMPRESSED:
3531             ret = -ENOTSUP;
3532             goto out;
3533 
3534         case QCOW2_CLUSTER_NORMAL:
3535             child = s->data_file;
3536             copy_offset += offset_into_cluster(s, src_offset);
3537             if ((copy_offset & 511) != 0) {
3538                 ret = -EIO;
3539                 goto out;
3540             }
3541             break;
3542 
3543         default:
3544             abort();
3545         }
3546         qemu_co_mutex_unlock(&s->lock);
3547         ret = bdrv_co_copy_range_from(child,
3548                                       copy_offset,
3549                                       dst, dst_offset,
3550                                       cur_bytes, read_flags, cur_write_flags);
3551         qemu_co_mutex_lock(&s->lock);
3552         if (ret < 0) {
3553             goto out;
3554         }
3555 
3556         bytes -= cur_bytes;
3557         src_offset += cur_bytes;
3558         dst_offset += cur_bytes;
3559     }
3560     ret = 0;
3561 
3562 out:
3563     qemu_co_mutex_unlock(&s->lock);
3564     return ret;
3565 }
3566 
3567 static int coroutine_fn
3568 qcow2_co_copy_range_to(BlockDriverState *bs,
3569                        BdrvChild *src, uint64_t src_offset,
3570                        BdrvChild *dst, uint64_t dst_offset,
3571                        uint64_t bytes, BdrvRequestFlags read_flags,
3572                        BdrvRequestFlags write_flags)
3573 {
3574     BDRVQcow2State *s = bs->opaque;
3575     int offset_in_cluster;
3576     int ret;
3577     unsigned int cur_bytes; /* number of sectors in current iteration */
3578     uint64_t cluster_offset;
3579     QCowL2Meta *l2meta = NULL;
3580 
3581     assert(!bs->encrypted);
3582 
3583     qemu_co_mutex_lock(&s->lock);
3584 
3585     while (bytes != 0) {
3586 
3587         l2meta = NULL;
3588 
3589         offset_in_cluster = offset_into_cluster(s, dst_offset);
3590         cur_bytes = MIN(bytes, INT_MAX);
3591 
3592         /* TODO:
3593          * If src->bs == dst->bs, we could simply copy by incrementing
3594          * the refcnt, without copying user data.
3595          * Or if src->bs == dst->bs->backing->bs, we could copy by discarding. */
3596         ret = qcow2_alloc_cluster_offset(bs, dst_offset, &cur_bytes,
3597                                          &cluster_offset, &l2meta);
3598         if (ret < 0) {
3599             goto fail;
3600         }
3601 
3602         assert((cluster_offset & 511) == 0);
3603 
3604         ret = qcow2_pre_write_overlap_check(bs, 0,
3605                 cluster_offset + offset_in_cluster, cur_bytes, true);
3606         if (ret < 0) {
3607             goto fail;
3608         }
3609 
3610         qemu_co_mutex_unlock(&s->lock);
3611         ret = bdrv_co_copy_range_to(src, src_offset,
3612                                     s->data_file,
3613                                     cluster_offset + offset_in_cluster,
3614                                     cur_bytes, read_flags, write_flags);
3615         qemu_co_mutex_lock(&s->lock);
3616         if (ret < 0) {
3617             goto fail;
3618         }
3619 
3620         ret = qcow2_handle_l2meta(bs, &l2meta, true);
3621         if (ret) {
3622             goto fail;
3623         }
3624 
3625         bytes -= cur_bytes;
3626         src_offset += cur_bytes;
3627         dst_offset += cur_bytes;
3628     }
3629     ret = 0;
3630 
3631 fail:
3632     qcow2_handle_l2meta(bs, &l2meta, false);
3633 
3634     qemu_co_mutex_unlock(&s->lock);
3635 
3636     trace_qcow2_writev_done_req(qemu_coroutine_self(), ret);
3637 
3638     return ret;
3639 }
3640 
3641 static int coroutine_fn qcow2_co_truncate(BlockDriverState *bs, int64_t offset,
3642                                           PreallocMode prealloc, Error **errp)
3643 {
3644     BDRVQcow2State *s = bs->opaque;
3645     uint64_t old_length;
3646     int64_t new_l1_size;
3647     int ret;
3648     QDict *options;
3649 
3650     if (prealloc != PREALLOC_MODE_OFF && prealloc != PREALLOC_MODE_METADATA &&
3651         prealloc != PREALLOC_MODE_FALLOC && prealloc != PREALLOC_MODE_FULL)
3652     {
3653         error_setg(errp, "Unsupported preallocation mode '%s'",
3654                    PreallocMode_str(prealloc));
3655         return -ENOTSUP;
3656     }
3657 
3658     if (offset & 511) {
3659         error_setg(errp, "The new size must be a multiple of 512");
3660         return -EINVAL;
3661     }
3662 
3663     qemu_co_mutex_lock(&s->lock);
3664 
3665     /* cannot proceed if image has snapshots */
3666     if (s->nb_snapshots) {
3667         error_setg(errp, "Can't resize an image which has snapshots");
3668         ret = -ENOTSUP;
3669         goto fail;
3670     }
3671 
3672     /* cannot proceed if image has bitmaps */
3673     if (qcow2_truncate_bitmaps_check(bs, errp)) {
3674         ret = -ENOTSUP;
3675         goto fail;
3676     }
3677 
3678     old_length = bs->total_sectors * BDRV_SECTOR_SIZE;
3679     new_l1_size = size_to_l1(s, offset);
3680 
3681     if (offset < old_length) {
3682         int64_t last_cluster, old_file_size;
3683         if (prealloc != PREALLOC_MODE_OFF) {
3684             error_setg(errp,
3685                        "Preallocation can't be used for shrinking an image");
3686             ret = -EINVAL;
3687             goto fail;
3688         }
3689 
3690         ret = qcow2_cluster_discard(bs, ROUND_UP(offset, s->cluster_size),
3691                                     old_length - ROUND_UP(offset,
3692                                                           s->cluster_size),
3693                                     QCOW2_DISCARD_ALWAYS, true);
3694         if (ret < 0) {
3695             error_setg_errno(errp, -ret, "Failed to discard cropped clusters");
3696             goto fail;
3697         }
3698 
3699         ret = qcow2_shrink_l1_table(bs, new_l1_size);
3700         if (ret < 0) {
3701             error_setg_errno(errp, -ret,
3702                              "Failed to reduce the number of L2 tables");
3703             goto fail;
3704         }
3705 
3706         ret = qcow2_shrink_reftable(bs);
3707         if (ret < 0) {
3708             error_setg_errno(errp, -ret,
3709                              "Failed to discard unused refblocks");
3710             goto fail;
3711         }
3712 
3713         old_file_size = bdrv_getlength(bs->file->bs);
3714         if (old_file_size < 0) {
3715             error_setg_errno(errp, -old_file_size,
3716                              "Failed to inquire current file length");
3717             ret = old_file_size;
3718             goto fail;
3719         }
3720         last_cluster = qcow2_get_last_cluster(bs, old_file_size);
3721         if (last_cluster < 0) {
3722             error_setg_errno(errp, -last_cluster,
3723                              "Failed to find the last cluster");
3724             ret = last_cluster;
3725             goto fail;
3726         }
3727         if ((last_cluster + 1) * s->cluster_size < old_file_size) {
3728             Error *local_err = NULL;
3729 
3730             bdrv_co_truncate(bs->file, (last_cluster + 1) * s->cluster_size,
3731                              PREALLOC_MODE_OFF, &local_err);
3732             if (local_err) {
3733                 warn_reportf_err(local_err,
3734                                  "Failed to truncate the tail of the image: ");
3735             }
3736         }
3737     } else {
3738         ret = qcow2_grow_l1_table(bs, new_l1_size, true);
3739         if (ret < 0) {
3740             error_setg_errno(errp, -ret, "Failed to grow the L1 table");
3741             goto fail;
3742         }
3743     }
3744 
3745     switch (prealloc) {
3746     case PREALLOC_MODE_OFF:
3747         break;
3748 
3749     case PREALLOC_MODE_METADATA:
3750         ret = preallocate_co(bs, old_length, offset);
3751         if (ret < 0) {
3752             error_setg_errno(errp, -ret, "Preallocation failed");
3753             goto fail;
3754         }
3755         break;
3756 
3757     case PREALLOC_MODE_FALLOC:
3758     case PREALLOC_MODE_FULL:
3759     {
3760         int64_t allocation_start, host_offset, guest_offset;
3761         int64_t clusters_allocated;
3762         int64_t old_file_size, new_file_size;
3763         uint64_t nb_new_data_clusters, nb_new_l2_tables;
3764 
3765         /* With a data file, preallocation means just allocating the metadata
3766          * and forwarding the truncate request to the data file */
3767         if (has_data_file(bs)) {
3768             ret = preallocate_co(bs, old_length, offset);
3769             if (ret < 0) {
3770                 error_setg_errno(errp, -ret, "Preallocation failed");
3771                 goto fail;
3772             }
3773             break;
3774         }
3775 
3776         old_file_size = bdrv_getlength(bs->file->bs);
3777         if (old_file_size < 0) {
3778             error_setg_errno(errp, -old_file_size,
3779                              "Failed to inquire current file length");
3780             ret = old_file_size;
3781             goto fail;
3782         }
3783         old_file_size = ROUND_UP(old_file_size, s->cluster_size);
3784 
3785         nb_new_data_clusters = DIV_ROUND_UP(offset - old_length,
3786                                             s->cluster_size);
3787 
3788         /* This is an overestimation; we will not actually allocate space for
3789          * these in the file but just make sure the new refcount structures are
3790          * able to cover them so we will not have to allocate new refblocks
3791          * while entering the data blocks in the potentially new L2 tables.
3792          * (We do not actually care where the L2 tables are placed. Maybe they
3793          *  are already allocated or they can be placed somewhere before
3794          *  @old_file_size. It does not matter because they will be fully
3795          *  allocated automatically, so they do not need to be covered by the
3796          *  preallocation. All that matters is that we will not have to allocate
3797          *  new refcount structures for them.) */
3798         nb_new_l2_tables = DIV_ROUND_UP(nb_new_data_clusters,
3799                                         s->cluster_size / sizeof(uint64_t));
3800         /* The cluster range may not be aligned to L2 boundaries, so add one L2
3801          * table for a potential head/tail */
3802         nb_new_l2_tables++;
3803 
3804         allocation_start = qcow2_refcount_area(bs, old_file_size,
3805                                                nb_new_data_clusters +
3806                                                nb_new_l2_tables,
3807                                                true, 0, 0);
3808         if (allocation_start < 0) {
3809             error_setg_errno(errp, -allocation_start,
3810                              "Failed to resize refcount structures");
3811             ret = allocation_start;
3812             goto fail;
3813         }
3814 
3815         clusters_allocated = qcow2_alloc_clusters_at(bs, allocation_start,
3816                                                      nb_new_data_clusters);
3817         if (clusters_allocated < 0) {
3818             error_setg_errno(errp, -clusters_allocated,
3819                              "Failed to allocate data clusters");
3820             ret = clusters_allocated;
3821             goto fail;
3822         }
3823 
3824         assert(clusters_allocated == nb_new_data_clusters);
3825 
3826         /* Allocate the data area */
3827         new_file_size = allocation_start +
3828                         nb_new_data_clusters * s->cluster_size;
3829         ret = bdrv_co_truncate(bs->file, new_file_size, prealloc, errp);
3830         if (ret < 0) {
3831             error_prepend(errp, "Failed to resize underlying file: ");
3832             qcow2_free_clusters(bs, allocation_start,
3833                                 nb_new_data_clusters * s->cluster_size,
3834                                 QCOW2_DISCARD_OTHER);
3835             goto fail;
3836         }
3837 
3838         /* Create the necessary L2 entries */
3839         host_offset = allocation_start;
3840         guest_offset = old_length;
3841         while (nb_new_data_clusters) {
3842             int64_t nb_clusters = MIN(
3843                 nb_new_data_clusters,
3844                 s->l2_slice_size - offset_to_l2_slice_index(s, guest_offset));
3845             QCowL2Meta allocation = {
3846                 .offset       = guest_offset,
3847                 .alloc_offset = host_offset,
3848                 .nb_clusters  = nb_clusters,
3849             };
3850             qemu_co_queue_init(&allocation.dependent_requests);
3851 
3852             ret = qcow2_alloc_cluster_link_l2(bs, &allocation);
3853             if (ret < 0) {
3854                 error_setg_errno(errp, -ret, "Failed to update L2 tables");
3855                 qcow2_free_clusters(bs, host_offset,
3856                                     nb_new_data_clusters * s->cluster_size,
3857                                     QCOW2_DISCARD_OTHER);
3858                 goto fail;
3859             }
3860 
3861             guest_offset += nb_clusters * s->cluster_size;
3862             host_offset += nb_clusters * s->cluster_size;
3863             nb_new_data_clusters -= nb_clusters;
3864         }
3865         break;
3866     }
3867 
3868     default:
3869         g_assert_not_reached();
3870     }
3871 
3872     if (prealloc != PREALLOC_MODE_OFF) {
3873         /* Flush metadata before actually changing the image size */
3874         ret = qcow2_write_caches(bs);
3875         if (ret < 0) {
3876             error_setg_errno(errp, -ret,
3877                              "Failed to flush the preallocated area to disk");
3878             goto fail;
3879         }
3880     }
3881 
3882     bs->total_sectors = offset / BDRV_SECTOR_SIZE;
3883 
3884     if (has_data_file(bs)) {
3885         if (prealloc == PREALLOC_MODE_METADATA) {
3886             prealloc = PREALLOC_MODE_OFF;
3887         }
3888         ret = bdrv_co_truncate(s->data_file, offset, prealloc, errp);
3889         if (ret < 0) {
3890             goto fail;
3891         }
3892     }
3893 
3894     /* write updated header.size */
3895     offset = cpu_to_be64(offset);
3896     ret = bdrv_pwrite_sync(bs->file, offsetof(QCowHeader, size),
3897                            &offset, sizeof(uint64_t));
3898     if (ret < 0) {
3899         error_setg_errno(errp, -ret, "Failed to update the image size");
3900         goto fail;
3901     }
3902 
3903     s->l1_vm_state_index = new_l1_size;
3904 
3905     /* Update cache sizes */
3906     options = qdict_clone_shallow(bs->options);
3907     ret = qcow2_update_options(bs, options, s->flags, errp);
3908     qobject_unref(options);
3909     if (ret < 0) {
3910         goto fail;
3911     }
3912     ret = 0;
3913 fail:
3914     qemu_co_mutex_unlock(&s->lock);
3915     return ret;
3916 }
3917 
3918 /*
3919  * qcow2_compress()
3920  *
3921  * @dest - destination buffer, @dest_size bytes
3922  * @src - source buffer, @src_size bytes
3923  *
3924  * Returns: compressed size on success
3925  *          -1 destination buffer is not enough to store compressed data
3926  *          -2 on any other error
3927  */
3928 static ssize_t qcow2_compress(void *dest, size_t dest_size,
3929                               const void *src, size_t src_size)
3930 {
3931     ssize_t ret;
3932     z_stream strm;
3933 
3934     /* best compression, small window, no zlib header */
3935     memset(&strm, 0, sizeof(strm));
3936     ret = deflateInit2(&strm, Z_DEFAULT_COMPRESSION, Z_DEFLATED,
3937                        -12, 9, Z_DEFAULT_STRATEGY);
3938     if (ret != Z_OK) {
3939         return -2;
3940     }
3941 
3942     /* strm.next_in is not const in old zlib versions, such as those used on
3943      * OpenBSD/NetBSD, so cast the const away */
3944     strm.avail_in = src_size;
3945     strm.next_in = (void *) src;
3946     strm.avail_out = dest_size;
3947     strm.next_out = dest;
3948 
3949     ret = deflate(&strm, Z_FINISH);
3950     if (ret == Z_STREAM_END) {
3951         ret = dest_size - strm.avail_out;
3952     } else {
3953         ret = (ret == Z_OK ? -1 : -2);
3954     }
3955 
3956     deflateEnd(&strm);
3957 
3958     return ret;
3959 }
3960 
3961 /*
3962  * qcow2_decompress()
3963  *
3964  * Decompress some data (not more than @src_size bytes) to produce exactly
3965  * @dest_size bytes.
3966  *
3967  * @dest - destination buffer, @dest_size bytes
3968  * @src - source buffer, @src_size bytes
3969  *
3970  * Returns: 0 on success
3971  *          -1 on fail
3972  */
3973 static ssize_t qcow2_decompress(void *dest, size_t dest_size,
3974                                 const void *src, size_t src_size)
3975 {
3976     int ret = 0;
3977     z_stream strm;
3978 
3979     memset(&strm, 0, sizeof(strm));
3980     strm.avail_in = src_size;
3981     strm.next_in = (void *) src;
3982     strm.avail_out = dest_size;
3983     strm.next_out = dest;
3984 
3985     ret = inflateInit2(&strm, -12);
3986     if (ret != Z_OK) {
3987         return -1;
3988     }
3989 
3990     ret = inflate(&strm, Z_FINISH);
3991     if ((ret != Z_STREAM_END && ret != Z_BUF_ERROR) || strm.avail_out != 0) {
3992         /* We approve Z_BUF_ERROR because we need @dest buffer to be filled, but
3993          * @src buffer may be processed partly (because in qcow2 we know size of
3994          * compressed data with precision of one sector) */
3995         ret = -1;
3996     }
3997 
3998     inflateEnd(&strm);
3999 
4000     return ret;
4001 }
4002 
4003 #define MAX_COMPRESS_THREADS 4
4004 
4005 typedef ssize_t (*Qcow2CompressFunc)(void *dest, size_t dest_size,
4006                                      const void *src, size_t src_size);
4007 typedef struct Qcow2CompressData {
4008     void *dest;
4009     size_t dest_size;
4010     const void *src;
4011     size_t src_size;
4012     ssize_t ret;
4013 
4014     Qcow2CompressFunc func;
4015 } Qcow2CompressData;
4016 
4017 static int qcow2_compress_pool_func(void *opaque)
4018 {
4019     Qcow2CompressData *data = opaque;
4020 
4021     data->ret = data->func(data->dest, data->dest_size,
4022                            data->src, data->src_size);
4023 
4024     return 0;
4025 }
4026 
4027 static void qcow2_compress_complete(void *opaque, int ret)
4028 {
4029     qemu_coroutine_enter(opaque);
4030 }
4031 
4032 static ssize_t coroutine_fn
4033 qcow2_co_do_compress(BlockDriverState *bs, void *dest, size_t dest_size,
4034                      const void *src, size_t src_size, Qcow2CompressFunc func)
4035 {
4036     BDRVQcow2State *s = bs->opaque;
4037     BlockAIOCB *acb;
4038     ThreadPool *pool = aio_get_thread_pool(bdrv_get_aio_context(bs));
4039     Qcow2CompressData arg = {
4040         .dest = dest,
4041         .dest_size = dest_size,
4042         .src = src,
4043         .src_size = src_size,
4044         .func = func,
4045     };
4046 
4047     while (s->nb_compress_threads >= MAX_COMPRESS_THREADS) {
4048         qemu_co_queue_wait(&s->compress_wait_queue, NULL);
4049     }
4050 
4051     s->nb_compress_threads++;
4052     acb = thread_pool_submit_aio(pool, qcow2_compress_pool_func, &arg,
4053                                  qcow2_compress_complete,
4054                                  qemu_coroutine_self());
4055 
4056     if (!acb) {
4057         s->nb_compress_threads--;
4058         return -EINVAL;
4059     }
4060     qemu_coroutine_yield();
4061     s->nb_compress_threads--;
4062     qemu_co_queue_next(&s->compress_wait_queue);
4063 
4064     return arg.ret;
4065 }
4066 
4067 static ssize_t coroutine_fn
4068 qcow2_co_compress(BlockDriverState *bs, void *dest, size_t dest_size,
4069                   const void *src, size_t src_size)
4070 {
4071     return qcow2_co_do_compress(bs, dest, dest_size, src, src_size,
4072                                 qcow2_compress);
4073 }
4074 
4075 static ssize_t coroutine_fn
4076 qcow2_co_decompress(BlockDriverState *bs, void *dest, size_t dest_size,
4077                     const void *src, size_t src_size)
4078 {
4079     return qcow2_co_do_compress(bs, dest, dest_size, src, src_size,
4080                                 qcow2_decompress);
4081 }
4082 
4083 /* XXX: put compressed sectors first, then all the cluster aligned
4084    tables to avoid losing bytes in alignment */
4085 static coroutine_fn int
4086 qcow2_co_pwritev_compressed(BlockDriverState *bs, uint64_t offset,
4087                             uint64_t bytes, QEMUIOVector *qiov)
4088 {
4089     BDRVQcow2State *s = bs->opaque;
4090     QEMUIOVector hd_qiov;
4091     int ret;
4092     size_t out_len;
4093     uint8_t *buf, *out_buf;
4094     uint64_t cluster_offset;
4095 
4096     if (has_data_file(bs)) {
4097         return -ENOTSUP;
4098     }
4099 
4100     if (bytes == 0) {
4101         /* align end of file to a sector boundary to ease reading with
4102            sector based I/Os */
4103         int64_t len = bdrv_getlength(bs->file->bs);
4104         if (len < 0) {
4105             return len;
4106         }
4107         return bdrv_co_truncate(bs->file, len, PREALLOC_MODE_OFF, NULL);
4108     }
4109 
4110     if (offset_into_cluster(s, offset)) {
4111         return -EINVAL;
4112     }
4113 
4114     buf = qemu_blockalign(bs, s->cluster_size);
4115     if (bytes != s->cluster_size) {
4116         if (bytes > s->cluster_size ||
4117             offset + bytes != bs->total_sectors << BDRV_SECTOR_BITS)
4118         {
4119             qemu_vfree(buf);
4120             return -EINVAL;
4121         }
4122         /* Zero-pad last write if image size is not cluster aligned */
4123         memset(buf + bytes, 0, s->cluster_size - bytes);
4124     }
4125     qemu_iovec_to_buf(qiov, 0, buf, bytes);
4126 
4127     out_buf = g_malloc(s->cluster_size);
4128 
4129     out_len = qcow2_co_compress(bs, out_buf, s->cluster_size - 1,
4130                                 buf, s->cluster_size);
4131     if (out_len == -2) {
4132         ret = -EINVAL;
4133         goto fail;
4134     } else if (out_len == -1) {
4135         /* could not compress: write normal cluster */
4136         ret = qcow2_co_pwritev(bs, offset, bytes, qiov, 0);
4137         if (ret < 0) {
4138             goto fail;
4139         }
4140         goto success;
4141     }
4142 
4143     qemu_co_mutex_lock(&s->lock);
4144     ret = qcow2_alloc_compressed_cluster_offset(bs, offset, out_len,
4145                                                 &cluster_offset);
4146     if (ret < 0) {
4147         qemu_co_mutex_unlock(&s->lock);
4148         goto fail;
4149     }
4150 
4151     ret = qcow2_pre_write_overlap_check(bs, 0, cluster_offset, out_len, true);
4152     qemu_co_mutex_unlock(&s->lock);
4153     if (ret < 0) {
4154         goto fail;
4155     }
4156 
4157     qemu_iovec_init_buf(&hd_qiov, out_buf, out_len);
4158 
4159     BLKDBG_EVENT(s->data_file, BLKDBG_WRITE_COMPRESSED);
4160     ret = bdrv_co_pwritev(s->data_file, cluster_offset, out_len, &hd_qiov, 0);
4161     if (ret < 0) {
4162         goto fail;
4163     }
4164 success:
4165     ret = 0;
4166 fail:
4167     qemu_vfree(buf);
4168     g_free(out_buf);
4169     return ret;
4170 }
4171 
4172 static int coroutine_fn
4173 qcow2_co_preadv_compressed(BlockDriverState *bs,
4174                            uint64_t file_cluster_offset,
4175                            uint64_t offset,
4176                            uint64_t bytes,
4177                            QEMUIOVector *qiov)
4178 {
4179     BDRVQcow2State *s = bs->opaque;
4180     int ret = 0, csize, nb_csectors;
4181     uint64_t coffset;
4182     uint8_t *buf, *out_buf;
4183     QEMUIOVector local_qiov;
4184     int offset_in_cluster = offset_into_cluster(s, offset);
4185 
4186     coffset = file_cluster_offset & s->cluster_offset_mask;
4187     nb_csectors = ((file_cluster_offset >> s->csize_shift) & s->csize_mask) + 1;
4188     csize = nb_csectors * 512 - (coffset & 511);
4189 
4190     buf = g_try_malloc(csize);
4191     if (!buf) {
4192         return -ENOMEM;
4193     }
4194     qemu_iovec_init_buf(&local_qiov, buf, csize);
4195 
4196     out_buf = qemu_blockalign(bs, s->cluster_size);
4197 
4198     BLKDBG_EVENT(bs->file, BLKDBG_READ_COMPRESSED);
4199     ret = bdrv_co_preadv(bs->file, coffset, csize, &local_qiov, 0);
4200     if (ret < 0) {
4201         goto fail;
4202     }
4203 
4204     if (qcow2_co_decompress(bs, out_buf, s->cluster_size, buf, csize) < 0) {
4205         ret = -EIO;
4206         goto fail;
4207     }
4208 
4209     qemu_iovec_from_buf(qiov, 0, out_buf + offset_in_cluster, bytes);
4210 
4211 fail:
4212     qemu_vfree(out_buf);
4213     g_free(buf);
4214 
4215     return ret;
4216 }
4217 
4218 static int make_completely_empty(BlockDriverState *bs)
4219 {
4220     BDRVQcow2State *s = bs->opaque;
4221     Error *local_err = NULL;
4222     int ret, l1_clusters;
4223     int64_t offset;
4224     uint64_t *new_reftable = NULL;
4225     uint64_t rt_entry, l1_size2;
4226     struct {
4227         uint64_t l1_offset;
4228         uint64_t reftable_offset;
4229         uint32_t reftable_clusters;
4230     } QEMU_PACKED l1_ofs_rt_ofs_cls;
4231 
4232     ret = qcow2_cache_empty(bs, s->l2_table_cache);
4233     if (ret < 0) {
4234         goto fail;
4235     }
4236 
4237     ret = qcow2_cache_empty(bs, s->refcount_block_cache);
4238     if (ret < 0) {
4239         goto fail;
4240     }
4241 
4242     /* Refcounts will be broken utterly */
4243     ret = qcow2_mark_dirty(bs);
4244     if (ret < 0) {
4245         goto fail;
4246     }
4247 
4248     BLKDBG_EVENT(bs->file, BLKDBG_L1_UPDATE);
4249 
4250     l1_clusters = DIV_ROUND_UP(s->l1_size, s->cluster_size / sizeof(uint64_t));
4251     l1_size2 = (uint64_t)s->l1_size * sizeof(uint64_t);
4252 
4253     /* After this call, neither the in-memory nor the on-disk refcount
4254      * information accurately describe the actual references */
4255 
4256     ret = bdrv_pwrite_zeroes(bs->file, s->l1_table_offset,
4257                              l1_clusters * s->cluster_size, 0);
4258     if (ret < 0) {
4259         goto fail_broken_refcounts;
4260     }
4261     memset(s->l1_table, 0, l1_size2);
4262 
4263     BLKDBG_EVENT(bs->file, BLKDBG_EMPTY_IMAGE_PREPARE);
4264 
4265     /* Overwrite enough clusters at the beginning of the sectors to place
4266      * the refcount table, a refcount block and the L1 table in; this may
4267      * overwrite parts of the existing refcount and L1 table, which is not
4268      * an issue because the dirty flag is set, complete data loss is in fact
4269      * desired and partial data loss is consequently fine as well */
4270     ret = bdrv_pwrite_zeroes(bs->file, s->cluster_size,
4271                              (2 + l1_clusters) * s->cluster_size, 0);
4272     /* This call (even if it failed overall) may have overwritten on-disk
4273      * refcount structures; in that case, the in-memory refcount information
4274      * will probably differ from the on-disk information which makes the BDS
4275      * unusable */
4276     if (ret < 0) {
4277         goto fail_broken_refcounts;
4278     }
4279 
4280     BLKDBG_EVENT(bs->file, BLKDBG_L1_UPDATE);
4281     BLKDBG_EVENT(bs->file, BLKDBG_REFTABLE_UPDATE);
4282 
4283     /* "Create" an empty reftable (one cluster) directly after the image
4284      * header and an empty L1 table three clusters after the image header;
4285      * the cluster between those two will be used as the first refblock */
4286     l1_ofs_rt_ofs_cls.l1_offset = cpu_to_be64(3 * s->cluster_size);
4287     l1_ofs_rt_ofs_cls.reftable_offset = cpu_to_be64(s->cluster_size);
4288     l1_ofs_rt_ofs_cls.reftable_clusters = cpu_to_be32(1);
4289     ret = bdrv_pwrite_sync(bs->file, offsetof(QCowHeader, l1_table_offset),
4290                            &l1_ofs_rt_ofs_cls, sizeof(l1_ofs_rt_ofs_cls));
4291     if (ret < 0) {
4292         goto fail_broken_refcounts;
4293     }
4294 
4295     s->l1_table_offset = 3 * s->cluster_size;
4296 
4297     new_reftable = g_try_new0(uint64_t, s->cluster_size / sizeof(uint64_t));
4298     if (!new_reftable) {
4299         ret = -ENOMEM;
4300         goto fail_broken_refcounts;
4301     }
4302 
4303     s->refcount_table_offset = s->cluster_size;
4304     s->refcount_table_size   = s->cluster_size / sizeof(uint64_t);
4305     s->max_refcount_table_index = 0;
4306 
4307     g_free(s->refcount_table);
4308     s->refcount_table = new_reftable;
4309     new_reftable = NULL;
4310 
4311     /* Now the in-memory refcount information again corresponds to the on-disk
4312      * information (reftable is empty and no refblocks (the refblock cache is
4313      * empty)); however, this means some clusters (e.g. the image header) are
4314      * referenced, but not refcounted, but the normal qcow2 code assumes that
4315      * the in-memory information is always correct */
4316 
4317     BLKDBG_EVENT(bs->file, BLKDBG_REFBLOCK_ALLOC);
4318 
4319     /* Enter the first refblock into the reftable */
4320     rt_entry = cpu_to_be64(2 * s->cluster_size);
4321     ret = bdrv_pwrite_sync(bs->file, s->cluster_size,
4322                            &rt_entry, sizeof(rt_entry));
4323     if (ret < 0) {
4324         goto fail_broken_refcounts;
4325     }
4326     s->refcount_table[0] = 2 * s->cluster_size;
4327 
4328     s->free_cluster_index = 0;
4329     assert(3 + l1_clusters <= s->refcount_block_size);
4330     offset = qcow2_alloc_clusters(bs, 3 * s->cluster_size + l1_size2);
4331     if (offset < 0) {
4332         ret = offset;
4333         goto fail_broken_refcounts;
4334     } else if (offset > 0) {
4335         error_report("First cluster in emptied image is in use");
4336         abort();
4337     }
4338 
4339     /* Now finally the in-memory information corresponds to the on-disk
4340      * structures and is correct */
4341     ret = qcow2_mark_clean(bs);
4342     if (ret < 0) {
4343         goto fail;
4344     }
4345 
4346     ret = bdrv_truncate(bs->file, (3 + l1_clusters) * s->cluster_size,
4347                         PREALLOC_MODE_OFF, &local_err);
4348     if (ret < 0) {
4349         error_report_err(local_err);
4350         goto fail;
4351     }
4352 
4353     return 0;
4354 
4355 fail_broken_refcounts:
4356     /* The BDS is unusable at this point. If we wanted to make it usable, we
4357      * would have to call qcow2_refcount_close(), qcow2_refcount_init(),
4358      * qcow2_check_refcounts(), qcow2_refcount_close() and qcow2_refcount_init()
4359      * again. However, because the functions which could have caused this error
4360      * path to be taken are used by those functions as well, it's very likely
4361      * that that sequence will fail as well. Therefore, just eject the BDS. */
4362     bs->drv = NULL;
4363 
4364 fail:
4365     g_free(new_reftable);
4366     return ret;
4367 }
4368 
4369 static int qcow2_make_empty(BlockDriverState *bs)
4370 {
4371     BDRVQcow2State *s = bs->opaque;
4372     uint64_t offset, end_offset;
4373     int step = QEMU_ALIGN_DOWN(INT_MAX, s->cluster_size);
4374     int l1_clusters, ret = 0;
4375 
4376     l1_clusters = DIV_ROUND_UP(s->l1_size, s->cluster_size / sizeof(uint64_t));
4377 
4378     if (s->qcow_version >= 3 && !s->snapshots && !s->nb_bitmaps &&
4379         3 + l1_clusters <= s->refcount_block_size &&
4380         s->crypt_method_header != QCOW_CRYPT_LUKS) {
4381         /* The following function only works for qcow2 v3 images (it
4382          * requires the dirty flag) and only as long as there are no
4383          * features that reserve extra clusters (such as snapshots,
4384          * LUKS header, or persistent bitmaps), because it completely
4385          * empties the image.  Furthermore, the L1 table and three
4386          * additional clusters (image header, refcount table, one
4387          * refcount block) have to fit inside one refcount block. */
4388         return make_completely_empty(bs);
4389     }
4390 
4391     /* This fallback code simply discards every active cluster; this is slow,
4392      * but works in all cases */
4393     end_offset = bs->total_sectors * BDRV_SECTOR_SIZE;
4394     for (offset = 0; offset < end_offset; offset += step) {
4395         /* As this function is generally used after committing an external
4396          * snapshot, QCOW2_DISCARD_SNAPSHOT seems appropriate. Also, the
4397          * default action for this kind of discard is to pass the discard,
4398          * which will ideally result in an actually smaller image file, as
4399          * is probably desired. */
4400         ret = qcow2_cluster_discard(bs, offset, MIN(step, end_offset - offset),
4401                                     QCOW2_DISCARD_SNAPSHOT, true);
4402         if (ret < 0) {
4403             break;
4404         }
4405     }
4406 
4407     return ret;
4408 }
4409 
4410 static coroutine_fn int qcow2_co_flush_to_os(BlockDriverState *bs)
4411 {
4412     BDRVQcow2State *s = bs->opaque;
4413     int ret;
4414 
4415     qemu_co_mutex_lock(&s->lock);
4416     ret = qcow2_write_caches(bs);
4417     qemu_co_mutex_unlock(&s->lock);
4418 
4419     return ret;
4420 }
4421 
4422 static ssize_t qcow2_measure_crypto_hdr_init_func(QCryptoBlock *block,
4423         size_t headerlen, void *opaque, Error **errp)
4424 {
4425     size_t *headerlenp = opaque;
4426 
4427     /* Stash away the payload size */
4428     *headerlenp = headerlen;
4429     return 0;
4430 }
4431 
4432 static ssize_t qcow2_measure_crypto_hdr_write_func(QCryptoBlock *block,
4433         size_t offset, const uint8_t *buf, size_t buflen,
4434         void *opaque, Error **errp)
4435 {
4436     /* Discard the bytes, we're not actually writing to an image */
4437     return buflen;
4438 }
4439 
4440 /* Determine the number of bytes for the LUKS payload */
4441 static bool qcow2_measure_luks_headerlen(QemuOpts *opts, size_t *len,
4442                                          Error **errp)
4443 {
4444     QDict *opts_qdict;
4445     QDict *cryptoopts_qdict;
4446     QCryptoBlockCreateOptions *cryptoopts;
4447     QCryptoBlock *crypto;
4448 
4449     /* Extract "encrypt." options into a qdict */
4450     opts_qdict = qemu_opts_to_qdict(opts, NULL);
4451     qdict_extract_subqdict(opts_qdict, &cryptoopts_qdict, "encrypt.");
4452     qobject_unref(opts_qdict);
4453 
4454     /* Build QCryptoBlockCreateOptions object from qdict */
4455     qdict_put_str(cryptoopts_qdict, "format", "luks");
4456     cryptoopts = block_crypto_create_opts_init(cryptoopts_qdict, errp);
4457     qobject_unref(cryptoopts_qdict);
4458     if (!cryptoopts) {
4459         return false;
4460     }
4461 
4462     /* Fake LUKS creation in order to determine the payload size */
4463     crypto = qcrypto_block_create(cryptoopts, "encrypt.",
4464                                   qcow2_measure_crypto_hdr_init_func,
4465                                   qcow2_measure_crypto_hdr_write_func,
4466                                   len, errp);
4467     qapi_free_QCryptoBlockCreateOptions(cryptoopts);
4468     if (!crypto) {
4469         return false;
4470     }
4471 
4472     qcrypto_block_free(crypto);
4473     return true;
4474 }
4475 
4476 static BlockMeasureInfo *qcow2_measure(QemuOpts *opts, BlockDriverState *in_bs,
4477                                        Error **errp)
4478 {
4479     Error *local_err = NULL;
4480     BlockMeasureInfo *info;
4481     uint64_t required = 0; /* bytes that contribute to required size */
4482     uint64_t virtual_size; /* disk size as seen by guest */
4483     uint64_t refcount_bits;
4484     uint64_t l2_tables;
4485     uint64_t luks_payload_size = 0;
4486     size_t cluster_size;
4487     int version;
4488     char *optstr;
4489     PreallocMode prealloc;
4490     bool has_backing_file;
4491     bool has_luks;
4492 
4493     /* Parse image creation options */
4494     cluster_size = qcow2_opt_get_cluster_size_del(opts, &local_err);
4495     if (local_err) {
4496         goto err;
4497     }
4498 
4499     version = qcow2_opt_get_version_del(opts, &local_err);
4500     if (local_err) {
4501         goto err;
4502     }
4503 
4504     refcount_bits = qcow2_opt_get_refcount_bits_del(opts, version, &local_err);
4505     if (local_err) {
4506         goto err;
4507     }
4508 
4509     optstr = qemu_opt_get_del(opts, BLOCK_OPT_PREALLOC);
4510     prealloc = qapi_enum_parse(&PreallocMode_lookup, optstr,
4511                                PREALLOC_MODE_OFF, &local_err);
4512     g_free(optstr);
4513     if (local_err) {
4514         goto err;
4515     }
4516 
4517     optstr = qemu_opt_get_del(opts, BLOCK_OPT_BACKING_FILE);
4518     has_backing_file = !!optstr;
4519     g_free(optstr);
4520 
4521     optstr = qemu_opt_get_del(opts, BLOCK_OPT_ENCRYPT_FORMAT);
4522     has_luks = optstr && strcmp(optstr, "luks") == 0;
4523     g_free(optstr);
4524 
4525     if (has_luks) {
4526         size_t headerlen;
4527 
4528         if (!qcow2_measure_luks_headerlen(opts, &headerlen, &local_err)) {
4529             goto err;
4530         }
4531 
4532         luks_payload_size = ROUND_UP(headerlen, cluster_size);
4533     }
4534 
4535     virtual_size = qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0);
4536     virtual_size = ROUND_UP(virtual_size, cluster_size);
4537 
4538     /* Check that virtual disk size is valid */
4539     l2_tables = DIV_ROUND_UP(virtual_size / cluster_size,
4540                              cluster_size / sizeof(uint64_t));
4541     if (l2_tables * sizeof(uint64_t) > QCOW_MAX_L1_SIZE) {
4542         error_setg(&local_err, "The image size is too large "
4543                                "(try using a larger cluster size)");
4544         goto err;
4545     }
4546 
4547     /* Account for input image */
4548     if (in_bs) {
4549         int64_t ssize = bdrv_getlength(in_bs);
4550         if (ssize < 0) {
4551             error_setg_errno(&local_err, -ssize,
4552                              "Unable to get image virtual_size");
4553             goto err;
4554         }
4555 
4556         virtual_size = ROUND_UP(ssize, cluster_size);
4557 
4558         if (has_backing_file) {
4559             /* We don't how much of the backing chain is shared by the input
4560              * image and the new image file.  In the worst case the new image's
4561              * backing file has nothing in common with the input image.  Be
4562              * conservative and assume all clusters need to be written.
4563              */
4564             required = virtual_size;
4565         } else {
4566             int64_t offset;
4567             int64_t pnum = 0;
4568 
4569             for (offset = 0; offset < ssize; offset += pnum) {
4570                 int ret;
4571 
4572                 ret = bdrv_block_status_above(in_bs, NULL, offset,
4573                                               ssize - offset, &pnum, NULL,
4574                                               NULL);
4575                 if (ret < 0) {
4576                     error_setg_errno(&local_err, -ret,
4577                                      "Unable to get block status");
4578                     goto err;
4579                 }
4580 
4581                 if (ret & BDRV_BLOCK_ZERO) {
4582                     /* Skip zero regions (safe with no backing file) */
4583                 } else if ((ret & (BDRV_BLOCK_DATA | BDRV_BLOCK_ALLOCATED)) ==
4584                            (BDRV_BLOCK_DATA | BDRV_BLOCK_ALLOCATED)) {
4585                     /* Extend pnum to end of cluster for next iteration */
4586                     pnum = ROUND_UP(offset + pnum, cluster_size) - offset;
4587 
4588                     /* Count clusters we've seen */
4589                     required += offset % cluster_size + pnum;
4590                 }
4591             }
4592         }
4593     }
4594 
4595     /* Take into account preallocation.  Nothing special is needed for
4596      * PREALLOC_MODE_METADATA since metadata is always counted.
4597      */
4598     if (prealloc == PREALLOC_MODE_FULL || prealloc == PREALLOC_MODE_FALLOC) {
4599         required = virtual_size;
4600     }
4601 
4602     info = g_new(BlockMeasureInfo, 1);
4603     info->fully_allocated =
4604         qcow2_calc_prealloc_size(virtual_size, cluster_size,
4605                                  ctz32(refcount_bits)) + luks_payload_size;
4606 
4607     /* Remove data clusters that are not required.  This overestimates the
4608      * required size because metadata needed for the fully allocated file is
4609      * still counted.
4610      */
4611     info->required = info->fully_allocated - virtual_size + required;
4612     return info;
4613 
4614 err:
4615     error_propagate(errp, local_err);
4616     return NULL;
4617 }
4618 
4619 static int qcow2_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
4620 {
4621     BDRVQcow2State *s = bs->opaque;
4622     bdi->unallocated_blocks_are_zero = true;
4623     bdi->cluster_size = s->cluster_size;
4624     bdi->vm_state_offset = qcow2_vm_state_offset(s);
4625     return 0;
4626 }
4627 
4628 static ImageInfoSpecific *qcow2_get_specific_info(BlockDriverState *bs,
4629                                                   Error **errp)
4630 {
4631     BDRVQcow2State *s = bs->opaque;
4632     ImageInfoSpecific *spec_info;
4633     QCryptoBlockInfo *encrypt_info = NULL;
4634     Error *local_err = NULL;
4635 
4636     if (s->crypto != NULL) {
4637         encrypt_info = qcrypto_block_get_info(s->crypto, &local_err);
4638         if (local_err) {
4639             error_propagate(errp, local_err);
4640             return NULL;
4641         }
4642     }
4643 
4644     spec_info = g_new(ImageInfoSpecific, 1);
4645     *spec_info = (ImageInfoSpecific){
4646         .type  = IMAGE_INFO_SPECIFIC_KIND_QCOW2,
4647         .u.qcow2.data = g_new0(ImageInfoSpecificQCow2, 1),
4648     };
4649     if (s->qcow_version == 2) {
4650         *spec_info->u.qcow2.data = (ImageInfoSpecificQCow2){
4651             .compat             = g_strdup("0.10"),
4652             .refcount_bits      = s->refcount_bits,
4653         };
4654     } else if (s->qcow_version == 3) {
4655         Qcow2BitmapInfoList *bitmaps;
4656         bitmaps = qcow2_get_bitmap_info_list(bs, &local_err);
4657         if (local_err) {
4658             error_propagate(errp, local_err);
4659             qapi_free_ImageInfoSpecific(spec_info);
4660             return NULL;
4661         }
4662         *spec_info->u.qcow2.data = (ImageInfoSpecificQCow2){
4663             .compat             = g_strdup("1.1"),
4664             .lazy_refcounts     = s->compatible_features &
4665                                   QCOW2_COMPAT_LAZY_REFCOUNTS,
4666             .has_lazy_refcounts = true,
4667             .corrupt            = s->incompatible_features &
4668                                   QCOW2_INCOMPAT_CORRUPT,
4669             .has_corrupt        = true,
4670             .refcount_bits      = s->refcount_bits,
4671             .has_bitmaps        = !!bitmaps,
4672             .bitmaps            = bitmaps,
4673             .has_data_file      = !!s->image_data_file,
4674             .data_file          = g_strdup(s->image_data_file),
4675             .has_data_file_raw  = has_data_file(bs),
4676             .data_file_raw      = data_file_is_raw(bs),
4677         };
4678     } else {
4679         /* if this assertion fails, this probably means a new version was
4680          * added without having it covered here */
4681         assert(false);
4682     }
4683 
4684     if (encrypt_info) {
4685         ImageInfoSpecificQCow2Encryption *qencrypt =
4686             g_new(ImageInfoSpecificQCow2Encryption, 1);
4687         switch (encrypt_info->format) {
4688         case Q_CRYPTO_BLOCK_FORMAT_QCOW:
4689             qencrypt->format = BLOCKDEV_QCOW2_ENCRYPTION_FORMAT_AES;
4690             break;
4691         case Q_CRYPTO_BLOCK_FORMAT_LUKS:
4692             qencrypt->format = BLOCKDEV_QCOW2_ENCRYPTION_FORMAT_LUKS;
4693             qencrypt->u.luks = encrypt_info->u.luks;
4694             break;
4695         default:
4696             abort();
4697         }
4698         /* Since we did shallow copy above, erase any pointers
4699          * in the original info */
4700         memset(&encrypt_info->u, 0, sizeof(encrypt_info->u));
4701         qapi_free_QCryptoBlockInfo(encrypt_info);
4702 
4703         spec_info->u.qcow2.data->has_encrypt = true;
4704         spec_info->u.qcow2.data->encrypt = qencrypt;
4705     }
4706 
4707     return spec_info;
4708 }
4709 
4710 static int qcow2_save_vmstate(BlockDriverState *bs, QEMUIOVector *qiov,
4711                               int64_t pos)
4712 {
4713     BDRVQcow2State *s = bs->opaque;
4714 
4715     BLKDBG_EVENT(bs->file, BLKDBG_VMSTATE_SAVE);
4716     return bs->drv->bdrv_co_pwritev(bs, qcow2_vm_state_offset(s) + pos,
4717                                     qiov->size, qiov, 0);
4718 }
4719 
4720 static int qcow2_load_vmstate(BlockDriverState *bs, QEMUIOVector *qiov,
4721                               int64_t pos)
4722 {
4723     BDRVQcow2State *s = bs->opaque;
4724 
4725     BLKDBG_EVENT(bs->file, BLKDBG_VMSTATE_LOAD);
4726     return bs->drv->bdrv_co_preadv(bs, qcow2_vm_state_offset(s) + pos,
4727                                    qiov->size, qiov, 0);
4728 }
4729 
4730 /*
4731  * Downgrades an image's version. To achieve this, any incompatible features
4732  * have to be removed.
4733  */
4734 static int qcow2_downgrade(BlockDriverState *bs, int target_version,
4735                            BlockDriverAmendStatusCB *status_cb, void *cb_opaque,
4736                            Error **errp)
4737 {
4738     BDRVQcow2State *s = bs->opaque;
4739     int current_version = s->qcow_version;
4740     int ret;
4741 
4742     /* This is qcow2_downgrade(), not qcow2_upgrade() */
4743     assert(target_version < current_version);
4744 
4745     /* There are no other versions (now) that you can downgrade to */
4746     assert(target_version == 2);
4747 
4748     if (s->refcount_order != 4) {
4749         error_setg(errp, "compat=0.10 requires refcount_bits=16");
4750         return -ENOTSUP;
4751     }
4752 
4753     if (has_data_file(bs)) {
4754         error_setg(errp, "Cannot downgrade an image with a data file");
4755         return -ENOTSUP;
4756     }
4757 
4758     /* clear incompatible features */
4759     if (s->incompatible_features & QCOW2_INCOMPAT_DIRTY) {
4760         ret = qcow2_mark_clean(bs);
4761         if (ret < 0) {
4762             error_setg_errno(errp, -ret, "Failed to make the image clean");
4763             return ret;
4764         }
4765     }
4766 
4767     /* with QCOW2_INCOMPAT_CORRUPT, it is pretty much impossible to get here in
4768      * the first place; if that happens nonetheless, returning -ENOTSUP is the
4769      * best thing to do anyway */
4770 
4771     if (s->incompatible_features) {
4772         error_setg(errp, "Cannot downgrade an image with incompatible features "
4773                    "%#" PRIx64 " set", s->incompatible_features);
4774         return -ENOTSUP;
4775     }
4776 
4777     /* since we can ignore compatible features, we can set them to 0 as well */
4778     s->compatible_features = 0;
4779     /* if lazy refcounts have been used, they have already been fixed through
4780      * clearing the dirty flag */
4781 
4782     /* clearing autoclear features is trivial */
4783     s->autoclear_features = 0;
4784 
4785     ret = qcow2_expand_zero_clusters(bs, status_cb, cb_opaque);
4786     if (ret < 0) {
4787         error_setg_errno(errp, -ret, "Failed to turn zero into data clusters");
4788         return ret;
4789     }
4790 
4791     s->qcow_version = target_version;
4792     ret = qcow2_update_header(bs);
4793     if (ret < 0) {
4794         s->qcow_version = current_version;
4795         error_setg_errno(errp, -ret, "Failed to update the image header");
4796         return ret;
4797     }
4798     return 0;
4799 }
4800 
4801 typedef enum Qcow2AmendOperation {
4802     /* This is the value Qcow2AmendHelperCBInfo::last_operation will be
4803      * statically initialized to so that the helper CB can discern the first
4804      * invocation from an operation change */
4805     QCOW2_NO_OPERATION = 0,
4806 
4807     QCOW2_CHANGING_REFCOUNT_ORDER,
4808     QCOW2_DOWNGRADING,
4809 } Qcow2AmendOperation;
4810 
4811 typedef struct Qcow2AmendHelperCBInfo {
4812     /* The code coordinating the amend operations should only modify
4813      * these four fields; the rest will be managed by the CB */
4814     BlockDriverAmendStatusCB *original_status_cb;
4815     void *original_cb_opaque;
4816 
4817     Qcow2AmendOperation current_operation;
4818 
4819     /* Total number of operations to perform (only set once) */
4820     int total_operations;
4821 
4822     /* The following fields are managed by the CB */
4823 
4824     /* Number of operations completed */
4825     int operations_completed;
4826 
4827     /* Cumulative offset of all completed operations */
4828     int64_t offset_completed;
4829 
4830     Qcow2AmendOperation last_operation;
4831     int64_t last_work_size;
4832 } Qcow2AmendHelperCBInfo;
4833 
4834 static void qcow2_amend_helper_cb(BlockDriverState *bs,
4835                                   int64_t operation_offset,
4836                                   int64_t operation_work_size, void *opaque)
4837 {
4838     Qcow2AmendHelperCBInfo *info = opaque;
4839     int64_t current_work_size;
4840     int64_t projected_work_size;
4841 
4842     if (info->current_operation != info->last_operation) {
4843         if (info->last_operation != QCOW2_NO_OPERATION) {
4844             info->offset_completed += info->last_work_size;
4845             info->operations_completed++;
4846         }
4847 
4848         info->last_operation = info->current_operation;
4849     }
4850 
4851     assert(info->total_operations > 0);
4852     assert(info->operations_completed < info->total_operations);
4853 
4854     info->last_work_size = operation_work_size;
4855 
4856     current_work_size = info->offset_completed + operation_work_size;
4857 
4858     /* current_work_size is the total work size for (operations_completed + 1)
4859      * operations (which includes this one), so multiply it by the number of
4860      * operations not covered and divide it by the number of operations
4861      * covered to get a projection for the operations not covered */
4862     projected_work_size = current_work_size * (info->total_operations -
4863                                                info->operations_completed - 1)
4864                                             / (info->operations_completed + 1);
4865 
4866     info->original_status_cb(bs, info->offset_completed + operation_offset,
4867                              current_work_size + projected_work_size,
4868                              info->original_cb_opaque);
4869 }
4870 
4871 static int qcow2_amend_options(BlockDriverState *bs, QemuOpts *opts,
4872                                BlockDriverAmendStatusCB *status_cb,
4873                                void *cb_opaque,
4874                                Error **errp)
4875 {
4876     BDRVQcow2State *s = bs->opaque;
4877     int old_version = s->qcow_version, new_version = old_version;
4878     uint64_t new_size = 0;
4879     const char *backing_file = NULL, *backing_format = NULL, *data_file = NULL;
4880     bool lazy_refcounts = s->use_lazy_refcounts;
4881     bool data_file_raw = data_file_is_raw(bs);
4882     const char *compat = NULL;
4883     uint64_t cluster_size = s->cluster_size;
4884     bool encrypt;
4885     int encformat;
4886     int refcount_bits = s->refcount_bits;
4887     int ret;
4888     QemuOptDesc *desc = opts->list->desc;
4889     Qcow2AmendHelperCBInfo helper_cb_info;
4890 
4891     while (desc && desc->name) {
4892         if (!qemu_opt_find(opts, desc->name)) {
4893             /* only change explicitly defined options */
4894             desc++;
4895             continue;
4896         }
4897 
4898         if (!strcmp(desc->name, BLOCK_OPT_COMPAT_LEVEL)) {
4899             compat = qemu_opt_get(opts, BLOCK_OPT_COMPAT_LEVEL);
4900             if (!compat) {
4901                 /* preserve default */
4902             } else if (!strcmp(compat, "0.10")) {
4903                 new_version = 2;
4904             } else if (!strcmp(compat, "1.1")) {
4905                 new_version = 3;
4906             } else {
4907                 error_setg(errp, "Unknown compatibility level %s", compat);
4908                 return -EINVAL;
4909             }
4910         } else if (!strcmp(desc->name, BLOCK_OPT_PREALLOC)) {
4911             error_setg(errp, "Cannot change preallocation mode");
4912             return -ENOTSUP;
4913         } else if (!strcmp(desc->name, BLOCK_OPT_SIZE)) {
4914             new_size = qemu_opt_get_size(opts, BLOCK_OPT_SIZE, 0);
4915         } else if (!strcmp(desc->name, BLOCK_OPT_BACKING_FILE)) {
4916             backing_file = qemu_opt_get(opts, BLOCK_OPT_BACKING_FILE);
4917         } else if (!strcmp(desc->name, BLOCK_OPT_BACKING_FMT)) {
4918             backing_format = qemu_opt_get(opts, BLOCK_OPT_BACKING_FMT);
4919         } else if (!strcmp(desc->name, BLOCK_OPT_ENCRYPT)) {
4920             encrypt = qemu_opt_get_bool(opts, BLOCK_OPT_ENCRYPT,
4921                                         !!s->crypto);
4922 
4923             if (encrypt != !!s->crypto) {
4924                 error_setg(errp,
4925                            "Changing the encryption flag is not supported");
4926                 return -ENOTSUP;
4927             }
4928         } else if (!strcmp(desc->name, BLOCK_OPT_ENCRYPT_FORMAT)) {
4929             encformat = qcow2_crypt_method_from_format(
4930                 qemu_opt_get(opts, BLOCK_OPT_ENCRYPT_FORMAT));
4931 
4932             if (encformat != s->crypt_method_header) {
4933                 error_setg(errp,
4934                            "Changing the encryption format is not supported");
4935                 return -ENOTSUP;
4936             }
4937         } else if (g_str_has_prefix(desc->name, "encrypt.")) {
4938             error_setg(errp,
4939                        "Changing the encryption parameters is not supported");
4940             return -ENOTSUP;
4941         } else if (!strcmp(desc->name, BLOCK_OPT_CLUSTER_SIZE)) {
4942             cluster_size = qemu_opt_get_size(opts, BLOCK_OPT_CLUSTER_SIZE,
4943                                              cluster_size);
4944             if (cluster_size != s->cluster_size) {
4945                 error_setg(errp, "Changing the cluster size is not supported");
4946                 return -ENOTSUP;
4947             }
4948         } else if (!strcmp(desc->name, BLOCK_OPT_LAZY_REFCOUNTS)) {
4949             lazy_refcounts = qemu_opt_get_bool(opts, BLOCK_OPT_LAZY_REFCOUNTS,
4950                                                lazy_refcounts);
4951         } else if (!strcmp(desc->name, BLOCK_OPT_REFCOUNT_BITS)) {
4952             refcount_bits = qemu_opt_get_number(opts, BLOCK_OPT_REFCOUNT_BITS,
4953                                                 refcount_bits);
4954 
4955             if (refcount_bits <= 0 || refcount_bits > 64 ||
4956                 !is_power_of_2(refcount_bits))
4957             {
4958                 error_setg(errp, "Refcount width must be a power of two and "
4959                            "may not exceed 64 bits");
4960                 return -EINVAL;
4961             }
4962         } else if (!strcmp(desc->name, BLOCK_OPT_DATA_FILE)) {
4963             data_file = qemu_opt_get(opts, BLOCK_OPT_DATA_FILE);
4964             if (data_file && !has_data_file(bs)) {
4965                 error_setg(errp, "data-file can only be set for images that "
4966                                  "use an external data file");
4967                 return -EINVAL;
4968             }
4969         } else if (!strcmp(desc->name, BLOCK_OPT_DATA_FILE_RAW)) {
4970             data_file_raw = qemu_opt_get_bool(opts, BLOCK_OPT_DATA_FILE_RAW,
4971                                               data_file_raw);
4972             if (data_file_raw && !data_file_is_raw(bs)) {
4973                 error_setg(errp, "data-file-raw cannot be set on existing "
4974                                  "images");
4975                 return -EINVAL;
4976             }
4977         } else {
4978             /* if this point is reached, this probably means a new option was
4979              * added without having it covered here */
4980             abort();
4981         }
4982 
4983         desc++;
4984     }
4985 
4986     helper_cb_info = (Qcow2AmendHelperCBInfo){
4987         .original_status_cb = status_cb,
4988         .original_cb_opaque = cb_opaque,
4989         .total_operations = (new_version < old_version)
4990                           + (s->refcount_bits != refcount_bits)
4991     };
4992 
4993     /* Upgrade first (some features may require compat=1.1) */
4994     if (new_version > old_version) {
4995         s->qcow_version = new_version;
4996         ret = qcow2_update_header(bs);
4997         if (ret < 0) {
4998             s->qcow_version = old_version;
4999             error_setg_errno(errp, -ret, "Failed to update the image header");
5000             return ret;
5001         }
5002     }
5003 
5004     if (s->refcount_bits != refcount_bits) {
5005         int refcount_order = ctz32(refcount_bits);
5006 
5007         if (new_version < 3 && refcount_bits != 16) {
5008             error_setg(errp, "Refcount widths other than 16 bits require "
5009                        "compatibility level 1.1 or above (use compat=1.1 or "
5010                        "greater)");
5011             return -EINVAL;
5012         }
5013 
5014         helper_cb_info.current_operation = QCOW2_CHANGING_REFCOUNT_ORDER;
5015         ret = qcow2_change_refcount_order(bs, refcount_order,
5016                                           &qcow2_amend_helper_cb,
5017                                           &helper_cb_info, errp);
5018         if (ret < 0) {
5019             return ret;
5020         }
5021     }
5022 
5023     /* data-file-raw blocks backing files, so clear it first if requested */
5024     if (data_file_raw) {
5025         s->autoclear_features |= QCOW2_AUTOCLEAR_DATA_FILE_RAW;
5026     } else {
5027         s->autoclear_features &= ~QCOW2_AUTOCLEAR_DATA_FILE_RAW;
5028     }
5029 
5030     if (data_file) {
5031         g_free(s->image_data_file);
5032         s->image_data_file = *data_file ? g_strdup(data_file) : NULL;
5033     }
5034 
5035     ret = qcow2_update_header(bs);
5036     if (ret < 0) {
5037         error_setg_errno(errp, -ret, "Failed to update the image header");
5038         return ret;
5039     }
5040 
5041     if (backing_file || backing_format) {
5042         ret = qcow2_change_backing_file(bs,
5043                     backing_file ?: s->image_backing_file,
5044                     backing_format ?: s->image_backing_format);
5045         if (ret < 0) {
5046             error_setg_errno(errp, -ret, "Failed to change the backing file");
5047             return ret;
5048         }
5049     }
5050 
5051     if (s->use_lazy_refcounts != lazy_refcounts) {
5052         if (lazy_refcounts) {
5053             if (new_version < 3) {
5054                 error_setg(errp, "Lazy refcounts only supported with "
5055                            "compatibility level 1.1 and above (use compat=1.1 "
5056                            "or greater)");
5057                 return -EINVAL;
5058             }
5059             s->compatible_features |= QCOW2_COMPAT_LAZY_REFCOUNTS;
5060             ret = qcow2_update_header(bs);
5061             if (ret < 0) {
5062                 s->compatible_features &= ~QCOW2_COMPAT_LAZY_REFCOUNTS;
5063                 error_setg_errno(errp, -ret, "Failed to update the image header");
5064                 return ret;
5065             }
5066             s->use_lazy_refcounts = true;
5067         } else {
5068             /* make image clean first */
5069             ret = qcow2_mark_clean(bs);
5070             if (ret < 0) {
5071                 error_setg_errno(errp, -ret, "Failed to make the image clean");
5072                 return ret;
5073             }
5074             /* now disallow lazy refcounts */
5075             s->compatible_features &= ~QCOW2_COMPAT_LAZY_REFCOUNTS;
5076             ret = qcow2_update_header(bs);
5077             if (ret < 0) {
5078                 s->compatible_features |= QCOW2_COMPAT_LAZY_REFCOUNTS;
5079                 error_setg_errno(errp, -ret, "Failed to update the image header");
5080                 return ret;
5081             }
5082             s->use_lazy_refcounts = false;
5083         }
5084     }
5085 
5086     if (new_size) {
5087         BlockBackend *blk = blk_new(BLK_PERM_RESIZE, BLK_PERM_ALL);
5088         ret = blk_insert_bs(blk, bs, errp);
5089         if (ret < 0) {
5090             blk_unref(blk);
5091             return ret;
5092         }
5093 
5094         ret = blk_truncate(blk, new_size, PREALLOC_MODE_OFF, errp);
5095         blk_unref(blk);
5096         if (ret < 0) {
5097             return ret;
5098         }
5099     }
5100 
5101     /* Downgrade last (so unsupported features can be removed before) */
5102     if (new_version < old_version) {
5103         helper_cb_info.current_operation = QCOW2_DOWNGRADING;
5104         ret = qcow2_downgrade(bs, new_version, &qcow2_amend_helper_cb,
5105                               &helper_cb_info, errp);
5106         if (ret < 0) {
5107             return ret;
5108         }
5109     }
5110 
5111     return 0;
5112 }
5113 
5114 /*
5115  * If offset or size are negative, respectively, they will not be included in
5116  * the BLOCK_IMAGE_CORRUPTED event emitted.
5117  * fatal will be ignored for read-only BDS; corruptions found there will always
5118  * be considered non-fatal.
5119  */
5120 void qcow2_signal_corruption(BlockDriverState *bs, bool fatal, int64_t offset,
5121                              int64_t size, const char *message_format, ...)
5122 {
5123     BDRVQcow2State *s = bs->opaque;
5124     const char *node_name;
5125     char *message;
5126     va_list ap;
5127 
5128     fatal = fatal && bdrv_is_writable(bs);
5129 
5130     if (s->signaled_corruption &&
5131         (!fatal || (s->incompatible_features & QCOW2_INCOMPAT_CORRUPT)))
5132     {
5133         return;
5134     }
5135 
5136     va_start(ap, message_format);
5137     message = g_strdup_vprintf(message_format, ap);
5138     va_end(ap);
5139 
5140     if (fatal) {
5141         fprintf(stderr, "qcow2: Marking image as corrupt: %s; further "
5142                 "corruption events will be suppressed\n", message);
5143     } else {
5144         fprintf(stderr, "qcow2: Image is corrupt: %s; further non-fatal "
5145                 "corruption events will be suppressed\n", message);
5146     }
5147 
5148     node_name = bdrv_get_node_name(bs);
5149     qapi_event_send_block_image_corrupted(bdrv_get_device_name(bs),
5150                                           *node_name != '\0', node_name,
5151                                           message, offset >= 0, offset,
5152                                           size >= 0, size,
5153                                           fatal);
5154     g_free(message);
5155 
5156     if (fatal) {
5157         qcow2_mark_corrupt(bs);
5158         bs->drv = NULL; /* make BDS unusable */
5159     }
5160 
5161     s->signaled_corruption = true;
5162 }
5163 
5164 static QemuOptsList qcow2_create_opts = {
5165     .name = "qcow2-create-opts",
5166     .head = QTAILQ_HEAD_INITIALIZER(qcow2_create_opts.head),
5167     .desc = {
5168         {
5169             .name = BLOCK_OPT_SIZE,
5170             .type = QEMU_OPT_SIZE,
5171             .help = "Virtual disk size"
5172         },
5173         {
5174             .name = BLOCK_OPT_COMPAT_LEVEL,
5175             .type = QEMU_OPT_STRING,
5176             .help = "Compatibility level (0.10 or 1.1)"
5177         },
5178         {
5179             .name = BLOCK_OPT_BACKING_FILE,
5180             .type = QEMU_OPT_STRING,
5181             .help = "File name of a base image"
5182         },
5183         {
5184             .name = BLOCK_OPT_BACKING_FMT,
5185             .type = QEMU_OPT_STRING,
5186             .help = "Image format of the base image"
5187         },
5188         {
5189             .name = BLOCK_OPT_DATA_FILE,
5190             .type = QEMU_OPT_STRING,
5191             .help = "File name of an external data file"
5192         },
5193         {
5194             .name = BLOCK_OPT_DATA_FILE_RAW,
5195             .type = QEMU_OPT_BOOL,
5196             .help = "The external data file must stay valid as a raw image"
5197         },
5198         {
5199             .name = BLOCK_OPT_ENCRYPT,
5200             .type = QEMU_OPT_BOOL,
5201             .help = "Encrypt the image with format 'aes'. (Deprecated "
5202                     "in favor of " BLOCK_OPT_ENCRYPT_FORMAT "=aes)",
5203         },
5204         {
5205             .name = BLOCK_OPT_ENCRYPT_FORMAT,
5206             .type = QEMU_OPT_STRING,
5207             .help = "Encrypt the image, format choices: 'aes', 'luks'",
5208         },
5209         BLOCK_CRYPTO_OPT_DEF_KEY_SECRET("encrypt.",
5210             "ID of secret providing qcow AES key or LUKS passphrase"),
5211         BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_ALG("encrypt."),
5212         BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_MODE("encrypt."),
5213         BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_ALG("encrypt."),
5214         BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_HASH_ALG("encrypt."),
5215         BLOCK_CRYPTO_OPT_DEF_LUKS_HASH_ALG("encrypt."),
5216         BLOCK_CRYPTO_OPT_DEF_LUKS_ITER_TIME("encrypt."),
5217         {
5218             .name = BLOCK_OPT_CLUSTER_SIZE,
5219             .type = QEMU_OPT_SIZE,
5220             .help = "qcow2 cluster size",
5221             .def_value_str = stringify(DEFAULT_CLUSTER_SIZE)
5222         },
5223         {
5224             .name = BLOCK_OPT_PREALLOC,
5225             .type = QEMU_OPT_STRING,
5226             .help = "Preallocation mode (allowed values: off, metadata, "
5227                     "falloc, full)"
5228         },
5229         {
5230             .name = BLOCK_OPT_LAZY_REFCOUNTS,
5231             .type = QEMU_OPT_BOOL,
5232             .help = "Postpone refcount updates",
5233             .def_value_str = "off"
5234         },
5235         {
5236             .name = BLOCK_OPT_REFCOUNT_BITS,
5237             .type = QEMU_OPT_NUMBER,
5238             .help = "Width of a reference count entry in bits",
5239             .def_value_str = "16"
5240         },
5241         { /* end of list */ }
5242     }
5243 };
5244 
5245 static const char *const qcow2_strong_runtime_opts[] = {
5246     "encrypt." BLOCK_CRYPTO_OPT_QCOW_KEY_SECRET,
5247 
5248     NULL
5249 };
5250 
5251 BlockDriver bdrv_qcow2 = {
5252     .format_name        = "qcow2",
5253     .instance_size      = sizeof(BDRVQcow2State),
5254     .bdrv_probe         = qcow2_probe,
5255     .bdrv_open          = qcow2_open,
5256     .bdrv_close         = qcow2_close,
5257     .bdrv_reopen_prepare  = qcow2_reopen_prepare,
5258     .bdrv_reopen_commit   = qcow2_reopen_commit,
5259     .bdrv_reopen_abort    = qcow2_reopen_abort,
5260     .bdrv_join_options    = qcow2_join_options,
5261     .bdrv_child_perm      = bdrv_format_default_perms,
5262     .bdrv_co_create_opts  = qcow2_co_create_opts,
5263     .bdrv_co_create       = qcow2_co_create,
5264     .bdrv_has_zero_init = bdrv_has_zero_init_1,
5265     .bdrv_co_block_status = qcow2_co_block_status,
5266 
5267     .bdrv_co_preadv         = qcow2_co_preadv,
5268     .bdrv_co_pwritev        = qcow2_co_pwritev,
5269     .bdrv_co_flush_to_os    = qcow2_co_flush_to_os,
5270 
5271     .bdrv_co_pwrite_zeroes  = qcow2_co_pwrite_zeroes,
5272     .bdrv_co_pdiscard       = qcow2_co_pdiscard,
5273     .bdrv_co_copy_range_from = qcow2_co_copy_range_from,
5274     .bdrv_co_copy_range_to  = qcow2_co_copy_range_to,
5275     .bdrv_co_truncate       = qcow2_co_truncate,
5276     .bdrv_co_pwritev_compressed = qcow2_co_pwritev_compressed,
5277     .bdrv_make_empty        = qcow2_make_empty,
5278 
5279     .bdrv_snapshot_create   = qcow2_snapshot_create,
5280     .bdrv_snapshot_goto     = qcow2_snapshot_goto,
5281     .bdrv_snapshot_delete   = qcow2_snapshot_delete,
5282     .bdrv_snapshot_list     = qcow2_snapshot_list,
5283     .bdrv_snapshot_load_tmp = qcow2_snapshot_load_tmp,
5284     .bdrv_measure           = qcow2_measure,
5285     .bdrv_get_info          = qcow2_get_info,
5286     .bdrv_get_specific_info = qcow2_get_specific_info,
5287 
5288     .bdrv_save_vmstate    = qcow2_save_vmstate,
5289     .bdrv_load_vmstate    = qcow2_load_vmstate,
5290 
5291     .supports_backing           = true,
5292     .bdrv_change_backing_file   = qcow2_change_backing_file,
5293 
5294     .bdrv_refresh_limits        = qcow2_refresh_limits,
5295     .bdrv_co_invalidate_cache   = qcow2_co_invalidate_cache,
5296     .bdrv_inactivate            = qcow2_inactivate,
5297 
5298     .create_opts         = &qcow2_create_opts,
5299     .strong_runtime_opts = qcow2_strong_runtime_opts,
5300     .mutable_opts        = mutable_opts,
5301     .bdrv_co_check       = qcow2_co_check,
5302     .bdrv_amend_options  = qcow2_amend_options,
5303 
5304     .bdrv_detach_aio_context  = qcow2_detach_aio_context,
5305     .bdrv_attach_aio_context  = qcow2_attach_aio_context,
5306 
5307     .bdrv_reopen_bitmaps_rw = qcow2_reopen_bitmaps_rw,
5308     .bdrv_can_store_new_dirty_bitmap = qcow2_can_store_new_dirty_bitmap,
5309     .bdrv_remove_persistent_dirty_bitmap = qcow2_remove_persistent_dirty_bitmap,
5310 };
5311 
5312 static void bdrv_qcow2_init(void)
5313 {
5314     bdrv_register(&bdrv_qcow2);
5315 }
5316 
5317 block_init(bdrv_qcow2_init);
5318