xref: /openbmc/qemu/block/qcow2.c (revision f28d0dfd)
1 /*
2  * Block driver for the QCOW version 2 format
3  *
4  * Copyright (c) 2004-2006 Fabrice Bellard
5  *
6  * Permission is hereby granted, free of charge, to any person obtaining a copy
7  * of this software and associated documentation files (the "Software"), to deal
8  * in the Software without restriction, including without limitation the rights
9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10  * copies of the Software, and to permit persons to whom the Software is
11  * furnished to do so, subject to the following conditions:
12  *
13  * The above copyright notice and this permission notice shall be included in
14  * all copies or substantial portions of the Software.
15  *
16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22  * THE SOFTWARE.
23  */
24 
25 #include "qemu/osdep.h"
26 #include "block/block_int.h"
27 #include "block/qdict.h"
28 #include "sysemu/block-backend.h"
29 #include "qemu/module.h"
30 #include <zlib.h>
31 #include "qcow2.h"
32 #include "qemu/error-report.h"
33 #include "qapi/error.h"
34 #include "qapi/qapi-events-block-core.h"
35 #include "qapi/qmp/qdict.h"
36 #include "qapi/qmp/qstring.h"
37 #include "trace.h"
38 #include "qemu/option_int.h"
39 #include "qemu/cutils.h"
40 #include "qemu/bswap.h"
41 #include "qapi/qobject-input-visitor.h"
42 #include "qapi/qapi-visit-block-core.h"
43 #include "crypto.h"
44 
45 /*
46   Differences with QCOW:
47 
48   - Support for multiple incremental snapshots.
49   - Memory management by reference counts.
50   - Clusters which have a reference count of one have the bit
51     QCOW_OFLAG_COPIED to optimize write performance.
52   - Size of compressed clusters is stored in sectors to reduce bit usage
53     in the cluster offsets.
54   - Support for storing additional data (such as the VM state) in the
55     snapshots.
56   - If a backing store is used, the cluster size is not constrained
57     (could be backported to QCOW).
58   - L2 tables have always a size of one cluster.
59 */
60 
61 
62 typedef struct {
63     uint32_t magic;
64     uint32_t len;
65 } QEMU_PACKED QCowExtension;
66 
67 #define  QCOW2_EXT_MAGIC_END 0
68 #define  QCOW2_EXT_MAGIC_BACKING_FORMAT 0xE2792ACA
69 #define  QCOW2_EXT_MAGIC_FEATURE_TABLE 0x6803f857
70 #define  QCOW2_EXT_MAGIC_CRYPTO_HEADER 0x0537be77
71 #define  QCOW2_EXT_MAGIC_BITMAPS 0x23852875
72 
73 static int qcow2_probe(const uint8_t *buf, int buf_size, const char *filename)
74 {
75     const QCowHeader *cow_header = (const void *)buf;
76 
77     if (buf_size >= sizeof(QCowHeader) &&
78         be32_to_cpu(cow_header->magic) == QCOW_MAGIC &&
79         be32_to_cpu(cow_header->version) >= 2)
80         return 100;
81     else
82         return 0;
83 }
84 
85 
86 static ssize_t qcow2_crypto_hdr_read_func(QCryptoBlock *block, size_t offset,
87                                           uint8_t *buf, size_t buflen,
88                                           void *opaque, Error **errp)
89 {
90     BlockDriverState *bs = opaque;
91     BDRVQcow2State *s = bs->opaque;
92     ssize_t ret;
93 
94     if ((offset + buflen) > s->crypto_header.length) {
95         error_setg(errp, "Request for data outside of extension header");
96         return -1;
97     }
98 
99     ret = bdrv_pread(bs->file,
100                      s->crypto_header.offset + offset, buf, buflen);
101     if (ret < 0) {
102         error_setg_errno(errp, -ret, "Could not read encryption header");
103         return -1;
104     }
105     return ret;
106 }
107 
108 
109 static ssize_t qcow2_crypto_hdr_init_func(QCryptoBlock *block, size_t headerlen,
110                                           void *opaque, Error **errp)
111 {
112     BlockDriverState *bs = opaque;
113     BDRVQcow2State *s = bs->opaque;
114     int64_t ret;
115     int64_t clusterlen;
116 
117     ret = qcow2_alloc_clusters(bs, headerlen);
118     if (ret < 0) {
119         error_setg_errno(errp, -ret,
120                          "Cannot allocate cluster for LUKS header size %zu",
121                          headerlen);
122         return -1;
123     }
124 
125     s->crypto_header.length = headerlen;
126     s->crypto_header.offset = ret;
127 
128     /* Zero fill remaining space in cluster so it has predictable
129      * content in case of future spec changes */
130     clusterlen = size_to_clusters(s, headerlen) * s->cluster_size;
131     assert(qcow2_pre_write_overlap_check(bs, 0, ret, clusterlen) == 0);
132     ret = bdrv_pwrite_zeroes(bs->file,
133                              ret + headerlen,
134                              clusterlen - headerlen, 0);
135     if (ret < 0) {
136         error_setg_errno(errp, -ret, "Could not zero fill encryption header");
137         return -1;
138     }
139 
140     return ret;
141 }
142 
143 
144 static ssize_t qcow2_crypto_hdr_write_func(QCryptoBlock *block, size_t offset,
145                                            const uint8_t *buf, size_t buflen,
146                                            void *opaque, Error **errp)
147 {
148     BlockDriverState *bs = opaque;
149     BDRVQcow2State *s = bs->opaque;
150     ssize_t ret;
151 
152     if ((offset + buflen) > s->crypto_header.length) {
153         error_setg(errp, "Request for data outside of extension header");
154         return -1;
155     }
156 
157     ret = bdrv_pwrite(bs->file,
158                       s->crypto_header.offset + offset, buf, buflen);
159     if (ret < 0) {
160         error_setg_errno(errp, -ret, "Could not read encryption header");
161         return -1;
162     }
163     return ret;
164 }
165 
166 
167 /*
168  * read qcow2 extension and fill bs
169  * start reading from start_offset
170  * finish reading upon magic of value 0 or when end_offset reached
171  * unknown magic is skipped (future extension this version knows nothing about)
172  * return 0 upon success, non-0 otherwise
173  */
174 static int qcow2_read_extensions(BlockDriverState *bs, uint64_t start_offset,
175                                  uint64_t end_offset, void **p_feature_table,
176                                  int flags, bool *need_update_header,
177                                  Error **errp)
178 {
179     BDRVQcow2State *s = bs->opaque;
180     QCowExtension ext;
181     uint64_t offset;
182     int ret;
183     Qcow2BitmapHeaderExt bitmaps_ext;
184 
185     if (need_update_header != NULL) {
186         *need_update_header = false;
187     }
188 
189 #ifdef DEBUG_EXT
190     printf("qcow2_read_extensions: start=%ld end=%ld\n", start_offset, end_offset);
191 #endif
192     offset = start_offset;
193     while (offset < end_offset) {
194 
195 #ifdef DEBUG_EXT
196         /* Sanity check */
197         if (offset > s->cluster_size)
198             printf("qcow2_read_extension: suspicious offset %lu\n", offset);
199 
200         printf("attempting to read extended header in offset %lu\n", offset);
201 #endif
202 
203         ret = bdrv_pread(bs->file, offset, &ext, sizeof(ext));
204         if (ret < 0) {
205             error_setg_errno(errp, -ret, "qcow2_read_extension: ERROR: "
206                              "pread fail from offset %" PRIu64, offset);
207             return 1;
208         }
209         be32_to_cpus(&ext.magic);
210         be32_to_cpus(&ext.len);
211         offset += sizeof(ext);
212 #ifdef DEBUG_EXT
213         printf("ext.magic = 0x%x\n", ext.magic);
214 #endif
215         if (offset > end_offset || ext.len > end_offset - offset) {
216             error_setg(errp, "Header extension too large");
217             return -EINVAL;
218         }
219 
220         switch (ext.magic) {
221         case QCOW2_EXT_MAGIC_END:
222             return 0;
223 
224         case QCOW2_EXT_MAGIC_BACKING_FORMAT:
225             if (ext.len >= sizeof(bs->backing_format)) {
226                 error_setg(errp, "ERROR: ext_backing_format: len=%" PRIu32
227                            " too large (>=%zu)", ext.len,
228                            sizeof(bs->backing_format));
229                 return 2;
230             }
231             ret = bdrv_pread(bs->file, offset, bs->backing_format, ext.len);
232             if (ret < 0) {
233                 error_setg_errno(errp, -ret, "ERROR: ext_backing_format: "
234                                  "Could not read format name");
235                 return 3;
236             }
237             bs->backing_format[ext.len] = '\0';
238             s->image_backing_format = g_strdup(bs->backing_format);
239 #ifdef DEBUG_EXT
240             printf("Qcow2: Got format extension %s\n", bs->backing_format);
241 #endif
242             break;
243 
244         case QCOW2_EXT_MAGIC_FEATURE_TABLE:
245             if (p_feature_table != NULL) {
246                 void* feature_table = g_malloc0(ext.len + 2 * sizeof(Qcow2Feature));
247                 ret = bdrv_pread(bs->file, offset , feature_table, ext.len);
248                 if (ret < 0) {
249                     error_setg_errno(errp, -ret, "ERROR: ext_feature_table: "
250                                      "Could not read table");
251                     return ret;
252                 }
253 
254                 *p_feature_table = feature_table;
255             }
256             break;
257 
258         case QCOW2_EXT_MAGIC_CRYPTO_HEADER: {
259             unsigned int cflags = 0;
260             if (s->crypt_method_header != QCOW_CRYPT_LUKS) {
261                 error_setg(errp, "CRYPTO header extension only "
262                            "expected with LUKS encryption method");
263                 return -EINVAL;
264             }
265             if (ext.len != sizeof(Qcow2CryptoHeaderExtension)) {
266                 error_setg(errp, "CRYPTO header extension size %u, "
267                            "but expected size %zu", ext.len,
268                            sizeof(Qcow2CryptoHeaderExtension));
269                 return -EINVAL;
270             }
271 
272             ret = bdrv_pread(bs->file, offset, &s->crypto_header, ext.len);
273             if (ret < 0) {
274                 error_setg_errno(errp, -ret,
275                                  "Unable to read CRYPTO header extension");
276                 return ret;
277             }
278             be64_to_cpus(&s->crypto_header.offset);
279             be64_to_cpus(&s->crypto_header.length);
280 
281             if ((s->crypto_header.offset % s->cluster_size) != 0) {
282                 error_setg(errp, "Encryption header offset '%" PRIu64 "' is "
283                            "not a multiple of cluster size '%u'",
284                            s->crypto_header.offset, s->cluster_size);
285                 return -EINVAL;
286             }
287 
288             if (flags & BDRV_O_NO_IO) {
289                 cflags |= QCRYPTO_BLOCK_OPEN_NO_IO;
290             }
291             s->crypto = qcrypto_block_open(s->crypto_opts, "encrypt.",
292                                            qcow2_crypto_hdr_read_func,
293                                            bs, cflags, errp);
294             if (!s->crypto) {
295                 return -EINVAL;
296             }
297         }   break;
298 
299         case QCOW2_EXT_MAGIC_BITMAPS:
300             if (ext.len != sizeof(bitmaps_ext)) {
301                 error_setg_errno(errp, -ret, "bitmaps_ext: "
302                                  "Invalid extension length");
303                 return -EINVAL;
304             }
305 
306             if (!(s->autoclear_features & QCOW2_AUTOCLEAR_BITMAPS)) {
307                 if (s->qcow_version < 3) {
308                     /* Let's be a bit more specific */
309                     warn_report("This qcow2 v2 image contains bitmaps, but "
310                                 "they may have been modified by a program "
311                                 "without persistent bitmap support; so now "
312                                 "they must all be considered inconsistent");
313                 } else {
314                     warn_report("a program lacking bitmap support "
315                                 "modified this file, so all bitmaps are now "
316                                 "considered inconsistent");
317                 }
318                 error_printf("Some clusters may be leaked, "
319                              "run 'qemu-img check -r' on the image "
320                              "file to fix.");
321                 if (need_update_header != NULL) {
322                     /* Updating is needed to drop invalid bitmap extension. */
323                     *need_update_header = true;
324                 }
325                 break;
326             }
327 
328             ret = bdrv_pread(bs->file, offset, &bitmaps_ext, ext.len);
329             if (ret < 0) {
330                 error_setg_errno(errp, -ret, "bitmaps_ext: "
331                                  "Could not read ext header");
332                 return ret;
333             }
334 
335             if (bitmaps_ext.reserved32 != 0) {
336                 error_setg_errno(errp, -ret, "bitmaps_ext: "
337                                  "Reserved field is not zero");
338                 return -EINVAL;
339             }
340 
341             be32_to_cpus(&bitmaps_ext.nb_bitmaps);
342             be64_to_cpus(&bitmaps_ext.bitmap_directory_size);
343             be64_to_cpus(&bitmaps_ext.bitmap_directory_offset);
344 
345             if (bitmaps_ext.nb_bitmaps > QCOW2_MAX_BITMAPS) {
346                 error_setg(errp,
347                            "bitmaps_ext: Image has %" PRIu32 " bitmaps, "
348                            "exceeding the QEMU supported maximum of %d",
349                            bitmaps_ext.nb_bitmaps, QCOW2_MAX_BITMAPS);
350                 return -EINVAL;
351             }
352 
353             if (bitmaps_ext.nb_bitmaps == 0) {
354                 error_setg(errp, "found bitmaps extension with zero bitmaps");
355                 return -EINVAL;
356             }
357 
358             if (bitmaps_ext.bitmap_directory_offset & (s->cluster_size - 1)) {
359                 error_setg(errp, "bitmaps_ext: "
360                                  "invalid bitmap directory offset");
361                 return -EINVAL;
362             }
363 
364             if (bitmaps_ext.bitmap_directory_size >
365                 QCOW2_MAX_BITMAP_DIRECTORY_SIZE) {
366                 error_setg(errp, "bitmaps_ext: "
367                                  "bitmap directory size (%" PRIu64 ") exceeds "
368                                  "the maximum supported size (%d)",
369                                  bitmaps_ext.bitmap_directory_size,
370                                  QCOW2_MAX_BITMAP_DIRECTORY_SIZE);
371                 return -EINVAL;
372             }
373 
374             s->nb_bitmaps = bitmaps_ext.nb_bitmaps;
375             s->bitmap_directory_offset =
376                     bitmaps_ext.bitmap_directory_offset;
377             s->bitmap_directory_size =
378                     bitmaps_ext.bitmap_directory_size;
379 
380 #ifdef DEBUG_EXT
381             printf("Qcow2: Got bitmaps extension: "
382                    "offset=%" PRIu64 " nb_bitmaps=%" PRIu32 "\n",
383                    s->bitmap_directory_offset, s->nb_bitmaps);
384 #endif
385             break;
386 
387         default:
388             /* unknown magic - save it in case we need to rewrite the header */
389             /* If you add a new feature, make sure to also update the fast
390              * path of qcow2_make_empty() to deal with it. */
391             {
392                 Qcow2UnknownHeaderExtension *uext;
393 
394                 uext = g_malloc0(sizeof(*uext)  + ext.len);
395                 uext->magic = ext.magic;
396                 uext->len = ext.len;
397                 QLIST_INSERT_HEAD(&s->unknown_header_ext, uext, next);
398 
399                 ret = bdrv_pread(bs->file, offset , uext->data, uext->len);
400                 if (ret < 0) {
401                     error_setg_errno(errp, -ret, "ERROR: unknown extension: "
402                                      "Could not read data");
403                     return ret;
404                 }
405             }
406             break;
407         }
408 
409         offset += ((ext.len + 7) & ~7);
410     }
411 
412     return 0;
413 }
414 
415 static void cleanup_unknown_header_ext(BlockDriverState *bs)
416 {
417     BDRVQcow2State *s = bs->opaque;
418     Qcow2UnknownHeaderExtension *uext, *next;
419 
420     QLIST_FOREACH_SAFE(uext, &s->unknown_header_ext, next, next) {
421         QLIST_REMOVE(uext, next);
422         g_free(uext);
423     }
424 }
425 
426 static void report_unsupported_feature(Error **errp, Qcow2Feature *table,
427                                        uint64_t mask)
428 {
429     char *features = g_strdup("");
430     char *old;
431 
432     while (table && table->name[0] != '\0') {
433         if (table->type == QCOW2_FEAT_TYPE_INCOMPATIBLE) {
434             if (mask & (1ULL << table->bit)) {
435                 old = features;
436                 features = g_strdup_printf("%s%s%.46s", old, *old ? ", " : "",
437                                            table->name);
438                 g_free(old);
439                 mask &= ~(1ULL << table->bit);
440             }
441         }
442         table++;
443     }
444 
445     if (mask) {
446         old = features;
447         features = g_strdup_printf("%s%sUnknown incompatible feature: %" PRIx64,
448                                    old, *old ? ", " : "", mask);
449         g_free(old);
450     }
451 
452     error_setg(errp, "Unsupported qcow2 feature(s): %s", features);
453     g_free(features);
454 }
455 
456 /*
457  * Sets the dirty bit and flushes afterwards if necessary.
458  *
459  * The incompatible_features bit is only set if the image file header was
460  * updated successfully.  Therefore it is not required to check the return
461  * value of this function.
462  */
463 int qcow2_mark_dirty(BlockDriverState *bs)
464 {
465     BDRVQcow2State *s = bs->opaque;
466     uint64_t val;
467     int ret;
468 
469     assert(s->qcow_version >= 3);
470 
471     if (s->incompatible_features & QCOW2_INCOMPAT_DIRTY) {
472         return 0; /* already dirty */
473     }
474 
475     val = cpu_to_be64(s->incompatible_features | QCOW2_INCOMPAT_DIRTY);
476     ret = bdrv_pwrite(bs->file, offsetof(QCowHeader, incompatible_features),
477                       &val, sizeof(val));
478     if (ret < 0) {
479         return ret;
480     }
481     ret = bdrv_flush(bs->file->bs);
482     if (ret < 0) {
483         return ret;
484     }
485 
486     /* Only treat image as dirty if the header was updated successfully */
487     s->incompatible_features |= QCOW2_INCOMPAT_DIRTY;
488     return 0;
489 }
490 
491 /*
492  * Clears the dirty bit and flushes before if necessary.  Only call this
493  * function when there are no pending requests, it does not guard against
494  * concurrent requests dirtying the image.
495  */
496 static int qcow2_mark_clean(BlockDriverState *bs)
497 {
498     BDRVQcow2State *s = bs->opaque;
499 
500     if (s->incompatible_features & QCOW2_INCOMPAT_DIRTY) {
501         int ret;
502 
503         s->incompatible_features &= ~QCOW2_INCOMPAT_DIRTY;
504 
505         ret = qcow2_flush_caches(bs);
506         if (ret < 0) {
507             return ret;
508         }
509 
510         return qcow2_update_header(bs);
511     }
512     return 0;
513 }
514 
515 /*
516  * Marks the image as corrupt.
517  */
518 int qcow2_mark_corrupt(BlockDriverState *bs)
519 {
520     BDRVQcow2State *s = bs->opaque;
521 
522     s->incompatible_features |= QCOW2_INCOMPAT_CORRUPT;
523     return qcow2_update_header(bs);
524 }
525 
526 /*
527  * Marks the image as consistent, i.e., unsets the corrupt bit, and flushes
528  * before if necessary.
529  */
530 int qcow2_mark_consistent(BlockDriverState *bs)
531 {
532     BDRVQcow2State *s = bs->opaque;
533 
534     if (s->incompatible_features & QCOW2_INCOMPAT_CORRUPT) {
535         int ret = qcow2_flush_caches(bs);
536         if (ret < 0) {
537             return ret;
538         }
539 
540         s->incompatible_features &= ~QCOW2_INCOMPAT_CORRUPT;
541         return qcow2_update_header(bs);
542     }
543     return 0;
544 }
545 
546 static int coroutine_fn qcow2_co_check_locked(BlockDriverState *bs,
547                                               BdrvCheckResult *result,
548                                               BdrvCheckMode fix)
549 {
550     int ret = qcow2_check_refcounts(bs, result, fix);
551     if (ret < 0) {
552         return ret;
553     }
554 
555     if (fix && result->check_errors == 0 && result->corruptions == 0) {
556         ret = qcow2_mark_clean(bs);
557         if (ret < 0) {
558             return ret;
559         }
560         return qcow2_mark_consistent(bs);
561     }
562     return ret;
563 }
564 
565 static int coroutine_fn qcow2_co_check(BlockDriverState *bs,
566                                        BdrvCheckResult *result,
567                                        BdrvCheckMode fix)
568 {
569     BDRVQcow2State *s = bs->opaque;
570     int ret;
571 
572     qemu_co_mutex_lock(&s->lock);
573     ret = qcow2_co_check_locked(bs, result, fix);
574     qemu_co_mutex_unlock(&s->lock);
575     return ret;
576 }
577 
578 int qcow2_validate_table(BlockDriverState *bs, uint64_t offset,
579                          uint64_t entries, size_t entry_len,
580                          int64_t max_size_bytes, const char *table_name,
581                          Error **errp)
582 {
583     BDRVQcow2State *s = bs->opaque;
584 
585     if (entries > max_size_bytes / entry_len) {
586         error_setg(errp, "%s too large", table_name);
587         return -EFBIG;
588     }
589 
590     /* Use signed INT64_MAX as the maximum even for uint64_t header fields,
591      * because values will be passed to qemu functions taking int64_t. */
592     if ((INT64_MAX - entries * entry_len < offset) ||
593         (offset_into_cluster(s, offset) != 0)) {
594         error_setg(errp, "%s offset invalid", table_name);
595         return -EINVAL;
596     }
597 
598     return 0;
599 }
600 
601 static QemuOptsList qcow2_runtime_opts = {
602     .name = "qcow2",
603     .head = QTAILQ_HEAD_INITIALIZER(qcow2_runtime_opts.head),
604     .desc = {
605         {
606             .name = QCOW2_OPT_LAZY_REFCOUNTS,
607             .type = QEMU_OPT_BOOL,
608             .help = "Postpone refcount updates",
609         },
610         {
611             .name = QCOW2_OPT_DISCARD_REQUEST,
612             .type = QEMU_OPT_BOOL,
613             .help = "Pass guest discard requests to the layer below",
614         },
615         {
616             .name = QCOW2_OPT_DISCARD_SNAPSHOT,
617             .type = QEMU_OPT_BOOL,
618             .help = "Generate discard requests when snapshot related space "
619                     "is freed",
620         },
621         {
622             .name = QCOW2_OPT_DISCARD_OTHER,
623             .type = QEMU_OPT_BOOL,
624             .help = "Generate discard requests when other clusters are freed",
625         },
626         {
627             .name = QCOW2_OPT_OVERLAP,
628             .type = QEMU_OPT_STRING,
629             .help = "Selects which overlap checks to perform from a range of "
630                     "templates (none, constant, cached, all)",
631         },
632         {
633             .name = QCOW2_OPT_OVERLAP_TEMPLATE,
634             .type = QEMU_OPT_STRING,
635             .help = "Selects which overlap checks to perform from a range of "
636                     "templates (none, constant, cached, all)",
637         },
638         {
639             .name = QCOW2_OPT_OVERLAP_MAIN_HEADER,
640             .type = QEMU_OPT_BOOL,
641             .help = "Check for unintended writes into the main qcow2 header",
642         },
643         {
644             .name = QCOW2_OPT_OVERLAP_ACTIVE_L1,
645             .type = QEMU_OPT_BOOL,
646             .help = "Check for unintended writes into the active L1 table",
647         },
648         {
649             .name = QCOW2_OPT_OVERLAP_ACTIVE_L2,
650             .type = QEMU_OPT_BOOL,
651             .help = "Check for unintended writes into an active L2 table",
652         },
653         {
654             .name = QCOW2_OPT_OVERLAP_REFCOUNT_TABLE,
655             .type = QEMU_OPT_BOOL,
656             .help = "Check for unintended writes into the refcount table",
657         },
658         {
659             .name = QCOW2_OPT_OVERLAP_REFCOUNT_BLOCK,
660             .type = QEMU_OPT_BOOL,
661             .help = "Check for unintended writes into a refcount block",
662         },
663         {
664             .name = QCOW2_OPT_OVERLAP_SNAPSHOT_TABLE,
665             .type = QEMU_OPT_BOOL,
666             .help = "Check for unintended writes into the snapshot table",
667         },
668         {
669             .name = QCOW2_OPT_OVERLAP_INACTIVE_L1,
670             .type = QEMU_OPT_BOOL,
671             .help = "Check for unintended writes into an inactive L1 table",
672         },
673         {
674             .name = QCOW2_OPT_OVERLAP_INACTIVE_L2,
675             .type = QEMU_OPT_BOOL,
676             .help = "Check for unintended writes into an inactive L2 table",
677         },
678         {
679             .name = QCOW2_OPT_CACHE_SIZE,
680             .type = QEMU_OPT_SIZE,
681             .help = "Maximum combined metadata (L2 tables and refcount blocks) "
682                     "cache size",
683         },
684         {
685             .name = QCOW2_OPT_L2_CACHE_SIZE,
686             .type = QEMU_OPT_SIZE,
687             .help = "Maximum L2 table cache size",
688         },
689         {
690             .name = QCOW2_OPT_L2_CACHE_ENTRY_SIZE,
691             .type = QEMU_OPT_SIZE,
692             .help = "Size of each entry in the L2 cache",
693         },
694         {
695             .name = QCOW2_OPT_REFCOUNT_CACHE_SIZE,
696             .type = QEMU_OPT_SIZE,
697             .help = "Maximum refcount block cache size",
698         },
699         {
700             .name = QCOW2_OPT_CACHE_CLEAN_INTERVAL,
701             .type = QEMU_OPT_NUMBER,
702             .help = "Clean unused cache entries after this time (in seconds)",
703         },
704         BLOCK_CRYPTO_OPT_DEF_KEY_SECRET("encrypt.",
705             "ID of secret providing qcow2 AES key or LUKS passphrase"),
706         { /* end of list */ }
707     },
708 };
709 
710 static const char *overlap_bool_option_names[QCOW2_OL_MAX_BITNR] = {
711     [QCOW2_OL_MAIN_HEADER_BITNR]    = QCOW2_OPT_OVERLAP_MAIN_HEADER,
712     [QCOW2_OL_ACTIVE_L1_BITNR]      = QCOW2_OPT_OVERLAP_ACTIVE_L1,
713     [QCOW2_OL_ACTIVE_L2_BITNR]      = QCOW2_OPT_OVERLAP_ACTIVE_L2,
714     [QCOW2_OL_REFCOUNT_TABLE_BITNR] = QCOW2_OPT_OVERLAP_REFCOUNT_TABLE,
715     [QCOW2_OL_REFCOUNT_BLOCK_BITNR] = QCOW2_OPT_OVERLAP_REFCOUNT_BLOCK,
716     [QCOW2_OL_SNAPSHOT_TABLE_BITNR] = QCOW2_OPT_OVERLAP_SNAPSHOT_TABLE,
717     [QCOW2_OL_INACTIVE_L1_BITNR]    = QCOW2_OPT_OVERLAP_INACTIVE_L1,
718     [QCOW2_OL_INACTIVE_L2_BITNR]    = QCOW2_OPT_OVERLAP_INACTIVE_L2,
719 };
720 
721 static void cache_clean_timer_cb(void *opaque)
722 {
723     BlockDriverState *bs = opaque;
724     BDRVQcow2State *s = bs->opaque;
725     qcow2_cache_clean_unused(s->l2_table_cache);
726     qcow2_cache_clean_unused(s->refcount_block_cache);
727     timer_mod(s->cache_clean_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) +
728               (int64_t) s->cache_clean_interval * 1000);
729 }
730 
731 static void cache_clean_timer_init(BlockDriverState *bs, AioContext *context)
732 {
733     BDRVQcow2State *s = bs->opaque;
734     if (s->cache_clean_interval > 0) {
735         s->cache_clean_timer = aio_timer_new(context, QEMU_CLOCK_VIRTUAL,
736                                              SCALE_MS, cache_clean_timer_cb,
737                                              bs);
738         timer_mod(s->cache_clean_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) +
739                   (int64_t) s->cache_clean_interval * 1000);
740     }
741 }
742 
743 static void cache_clean_timer_del(BlockDriverState *bs)
744 {
745     BDRVQcow2State *s = bs->opaque;
746     if (s->cache_clean_timer) {
747         timer_del(s->cache_clean_timer);
748         timer_free(s->cache_clean_timer);
749         s->cache_clean_timer = NULL;
750     }
751 }
752 
753 static void qcow2_detach_aio_context(BlockDriverState *bs)
754 {
755     cache_clean_timer_del(bs);
756 }
757 
758 static void qcow2_attach_aio_context(BlockDriverState *bs,
759                                      AioContext *new_context)
760 {
761     cache_clean_timer_init(bs, new_context);
762 }
763 
764 static void read_cache_sizes(BlockDriverState *bs, QemuOpts *opts,
765                              uint64_t *l2_cache_size,
766                              uint64_t *l2_cache_entry_size,
767                              uint64_t *refcount_cache_size, Error **errp)
768 {
769     BDRVQcow2State *s = bs->opaque;
770     uint64_t combined_cache_size;
771     bool l2_cache_size_set, refcount_cache_size_set, combined_cache_size_set;
772     int min_refcount_cache = MIN_REFCOUNT_CACHE_SIZE * s->cluster_size;
773 
774     combined_cache_size_set = qemu_opt_get(opts, QCOW2_OPT_CACHE_SIZE);
775     l2_cache_size_set = qemu_opt_get(opts, QCOW2_OPT_L2_CACHE_SIZE);
776     refcount_cache_size_set = qemu_opt_get(opts, QCOW2_OPT_REFCOUNT_CACHE_SIZE);
777 
778     combined_cache_size = qemu_opt_get_size(opts, QCOW2_OPT_CACHE_SIZE, 0);
779     *l2_cache_size = qemu_opt_get_size(opts, QCOW2_OPT_L2_CACHE_SIZE, 0);
780     *refcount_cache_size = qemu_opt_get_size(opts,
781                                              QCOW2_OPT_REFCOUNT_CACHE_SIZE, 0);
782 
783     *l2_cache_entry_size = qemu_opt_get_size(
784         opts, QCOW2_OPT_L2_CACHE_ENTRY_SIZE, s->cluster_size);
785 
786     if (combined_cache_size_set) {
787         if (l2_cache_size_set && refcount_cache_size_set) {
788             error_setg(errp, QCOW2_OPT_CACHE_SIZE ", " QCOW2_OPT_L2_CACHE_SIZE
789                        " and " QCOW2_OPT_REFCOUNT_CACHE_SIZE " may not be set "
790                        "the same time");
791             return;
792         } else if (*l2_cache_size > combined_cache_size) {
793             error_setg(errp, QCOW2_OPT_L2_CACHE_SIZE " may not exceed "
794                        QCOW2_OPT_CACHE_SIZE);
795             return;
796         } else if (*refcount_cache_size > combined_cache_size) {
797             error_setg(errp, QCOW2_OPT_REFCOUNT_CACHE_SIZE " may not exceed "
798                        QCOW2_OPT_CACHE_SIZE);
799             return;
800         }
801 
802         if (l2_cache_size_set) {
803             *refcount_cache_size = combined_cache_size - *l2_cache_size;
804         } else if (refcount_cache_size_set) {
805             *l2_cache_size = combined_cache_size - *refcount_cache_size;
806         } else {
807             uint64_t virtual_disk_size = bs->total_sectors * BDRV_SECTOR_SIZE;
808             uint64_t max_l2_cache = virtual_disk_size / (s->cluster_size / 8);
809 
810             /* Assign as much memory as possible to the L2 cache, and
811              * use the remainder for the refcount cache */
812             if (combined_cache_size >= max_l2_cache + min_refcount_cache) {
813                 *l2_cache_size = max_l2_cache;
814                 *refcount_cache_size = combined_cache_size - *l2_cache_size;
815             } else {
816                 *refcount_cache_size =
817                     MIN(combined_cache_size, min_refcount_cache);
818                 *l2_cache_size = combined_cache_size - *refcount_cache_size;
819             }
820         }
821     } else {
822         if (!l2_cache_size_set) {
823             *l2_cache_size = MAX(DEFAULT_L2_CACHE_BYTE_SIZE,
824                                  (uint64_t)DEFAULT_L2_CACHE_CLUSTERS
825                                  * s->cluster_size);
826         }
827         if (!refcount_cache_size_set) {
828             *refcount_cache_size = min_refcount_cache;
829         }
830     }
831 
832     if (*l2_cache_entry_size < (1 << MIN_CLUSTER_BITS) ||
833         *l2_cache_entry_size > s->cluster_size ||
834         !is_power_of_2(*l2_cache_entry_size)) {
835         error_setg(errp, "L2 cache entry size must be a power of two "
836                    "between %d and the cluster size (%d)",
837                    1 << MIN_CLUSTER_BITS, s->cluster_size);
838         return;
839     }
840 }
841 
842 typedef struct Qcow2ReopenState {
843     Qcow2Cache *l2_table_cache;
844     Qcow2Cache *refcount_block_cache;
845     int l2_slice_size; /* Number of entries in a slice of the L2 table */
846     bool use_lazy_refcounts;
847     int overlap_check;
848     bool discard_passthrough[QCOW2_DISCARD_MAX];
849     uint64_t cache_clean_interval;
850     QCryptoBlockOpenOptions *crypto_opts; /* Disk encryption runtime options */
851 } Qcow2ReopenState;
852 
853 static int qcow2_update_options_prepare(BlockDriverState *bs,
854                                         Qcow2ReopenState *r,
855                                         QDict *options, int flags,
856                                         Error **errp)
857 {
858     BDRVQcow2State *s = bs->opaque;
859     QemuOpts *opts = NULL;
860     const char *opt_overlap_check, *opt_overlap_check_template;
861     int overlap_check_template = 0;
862     uint64_t l2_cache_size, l2_cache_entry_size, refcount_cache_size;
863     int i;
864     const char *encryptfmt;
865     QDict *encryptopts = NULL;
866     Error *local_err = NULL;
867     int ret;
868 
869     qdict_extract_subqdict(options, &encryptopts, "encrypt.");
870     encryptfmt = qdict_get_try_str(encryptopts, "format");
871 
872     opts = qemu_opts_create(&qcow2_runtime_opts, NULL, 0, &error_abort);
873     qemu_opts_absorb_qdict(opts, options, &local_err);
874     if (local_err) {
875         error_propagate(errp, local_err);
876         ret = -EINVAL;
877         goto fail;
878     }
879 
880     /* get L2 table/refcount block cache size from command line options */
881     read_cache_sizes(bs, opts, &l2_cache_size, &l2_cache_entry_size,
882                      &refcount_cache_size, &local_err);
883     if (local_err) {
884         error_propagate(errp, local_err);
885         ret = -EINVAL;
886         goto fail;
887     }
888 
889     l2_cache_size /= l2_cache_entry_size;
890     if (l2_cache_size < MIN_L2_CACHE_SIZE) {
891         l2_cache_size = MIN_L2_CACHE_SIZE;
892     }
893     if (l2_cache_size > INT_MAX) {
894         error_setg(errp, "L2 cache size too big");
895         ret = -EINVAL;
896         goto fail;
897     }
898 
899     refcount_cache_size /= s->cluster_size;
900     if (refcount_cache_size < MIN_REFCOUNT_CACHE_SIZE) {
901         refcount_cache_size = MIN_REFCOUNT_CACHE_SIZE;
902     }
903     if (refcount_cache_size > INT_MAX) {
904         error_setg(errp, "Refcount cache size too big");
905         ret = -EINVAL;
906         goto fail;
907     }
908 
909     /* alloc new L2 table/refcount block cache, flush old one */
910     if (s->l2_table_cache) {
911         ret = qcow2_cache_flush(bs, s->l2_table_cache);
912         if (ret) {
913             error_setg_errno(errp, -ret, "Failed to flush the L2 table cache");
914             goto fail;
915         }
916     }
917 
918     if (s->refcount_block_cache) {
919         ret = qcow2_cache_flush(bs, s->refcount_block_cache);
920         if (ret) {
921             error_setg_errno(errp, -ret,
922                              "Failed to flush the refcount block cache");
923             goto fail;
924         }
925     }
926 
927     r->l2_slice_size = l2_cache_entry_size / sizeof(uint64_t);
928     r->l2_table_cache = qcow2_cache_create(bs, l2_cache_size,
929                                            l2_cache_entry_size);
930     r->refcount_block_cache = qcow2_cache_create(bs, refcount_cache_size,
931                                                  s->cluster_size);
932     if (r->l2_table_cache == NULL || r->refcount_block_cache == NULL) {
933         error_setg(errp, "Could not allocate metadata caches");
934         ret = -ENOMEM;
935         goto fail;
936     }
937 
938     /* New interval for cache cleanup timer */
939     r->cache_clean_interval =
940         qemu_opt_get_number(opts, QCOW2_OPT_CACHE_CLEAN_INTERVAL,
941                             s->cache_clean_interval);
942 #ifndef CONFIG_LINUX
943     if (r->cache_clean_interval != 0) {
944         error_setg(errp, QCOW2_OPT_CACHE_CLEAN_INTERVAL
945                    " not supported on this host");
946         ret = -EINVAL;
947         goto fail;
948     }
949 #endif
950     if (r->cache_clean_interval > UINT_MAX) {
951         error_setg(errp, "Cache clean interval too big");
952         ret = -EINVAL;
953         goto fail;
954     }
955 
956     /* lazy-refcounts; flush if going from enabled to disabled */
957     r->use_lazy_refcounts = qemu_opt_get_bool(opts, QCOW2_OPT_LAZY_REFCOUNTS,
958         (s->compatible_features & QCOW2_COMPAT_LAZY_REFCOUNTS));
959     if (r->use_lazy_refcounts && s->qcow_version < 3) {
960         error_setg(errp, "Lazy refcounts require a qcow2 image with at least "
961                    "qemu 1.1 compatibility level");
962         ret = -EINVAL;
963         goto fail;
964     }
965 
966     if (s->use_lazy_refcounts && !r->use_lazy_refcounts) {
967         ret = qcow2_mark_clean(bs);
968         if (ret < 0) {
969             error_setg_errno(errp, -ret, "Failed to disable lazy refcounts");
970             goto fail;
971         }
972     }
973 
974     /* Overlap check options */
975     opt_overlap_check = qemu_opt_get(opts, QCOW2_OPT_OVERLAP);
976     opt_overlap_check_template = qemu_opt_get(opts, QCOW2_OPT_OVERLAP_TEMPLATE);
977     if (opt_overlap_check_template && opt_overlap_check &&
978         strcmp(opt_overlap_check_template, opt_overlap_check))
979     {
980         error_setg(errp, "Conflicting values for qcow2 options '"
981                    QCOW2_OPT_OVERLAP "' ('%s') and '" QCOW2_OPT_OVERLAP_TEMPLATE
982                    "' ('%s')", opt_overlap_check, opt_overlap_check_template);
983         ret = -EINVAL;
984         goto fail;
985     }
986     if (!opt_overlap_check) {
987         opt_overlap_check = opt_overlap_check_template ?: "cached";
988     }
989 
990     if (!strcmp(opt_overlap_check, "none")) {
991         overlap_check_template = 0;
992     } else if (!strcmp(opt_overlap_check, "constant")) {
993         overlap_check_template = QCOW2_OL_CONSTANT;
994     } else if (!strcmp(opt_overlap_check, "cached")) {
995         overlap_check_template = QCOW2_OL_CACHED;
996     } else if (!strcmp(opt_overlap_check, "all")) {
997         overlap_check_template = QCOW2_OL_ALL;
998     } else {
999         error_setg(errp, "Unsupported value '%s' for qcow2 option "
1000                    "'overlap-check'. Allowed are any of the following: "
1001                    "none, constant, cached, all", opt_overlap_check);
1002         ret = -EINVAL;
1003         goto fail;
1004     }
1005 
1006     r->overlap_check = 0;
1007     for (i = 0; i < QCOW2_OL_MAX_BITNR; i++) {
1008         /* overlap-check defines a template bitmask, but every flag may be
1009          * overwritten through the associated boolean option */
1010         r->overlap_check |=
1011             qemu_opt_get_bool(opts, overlap_bool_option_names[i],
1012                               overlap_check_template & (1 << i)) << i;
1013     }
1014 
1015     r->discard_passthrough[QCOW2_DISCARD_NEVER] = false;
1016     r->discard_passthrough[QCOW2_DISCARD_ALWAYS] = true;
1017     r->discard_passthrough[QCOW2_DISCARD_REQUEST] =
1018         qemu_opt_get_bool(opts, QCOW2_OPT_DISCARD_REQUEST,
1019                           flags & BDRV_O_UNMAP);
1020     r->discard_passthrough[QCOW2_DISCARD_SNAPSHOT] =
1021         qemu_opt_get_bool(opts, QCOW2_OPT_DISCARD_SNAPSHOT, true);
1022     r->discard_passthrough[QCOW2_DISCARD_OTHER] =
1023         qemu_opt_get_bool(opts, QCOW2_OPT_DISCARD_OTHER, false);
1024 
1025     switch (s->crypt_method_header) {
1026     case QCOW_CRYPT_NONE:
1027         if (encryptfmt) {
1028             error_setg(errp, "No encryption in image header, but options "
1029                        "specified format '%s'", encryptfmt);
1030             ret = -EINVAL;
1031             goto fail;
1032         }
1033         break;
1034 
1035     case QCOW_CRYPT_AES:
1036         if (encryptfmt && !g_str_equal(encryptfmt, "aes")) {
1037             error_setg(errp,
1038                        "Header reported 'aes' encryption format but "
1039                        "options specify '%s'", encryptfmt);
1040             ret = -EINVAL;
1041             goto fail;
1042         }
1043         qdict_del(encryptopts, "format");
1044         r->crypto_opts = block_crypto_open_opts_init(
1045             Q_CRYPTO_BLOCK_FORMAT_QCOW, encryptopts, errp);
1046         break;
1047 
1048     case QCOW_CRYPT_LUKS:
1049         if (encryptfmt && !g_str_equal(encryptfmt, "luks")) {
1050             error_setg(errp,
1051                        "Header reported 'luks' encryption format but "
1052                        "options specify '%s'", encryptfmt);
1053             ret = -EINVAL;
1054             goto fail;
1055         }
1056         qdict_del(encryptopts, "format");
1057         r->crypto_opts = block_crypto_open_opts_init(
1058             Q_CRYPTO_BLOCK_FORMAT_LUKS, encryptopts, errp);
1059         break;
1060 
1061     default:
1062         error_setg(errp, "Unsupported encryption method %d",
1063                    s->crypt_method_header);
1064         break;
1065     }
1066     if (s->crypt_method_header != QCOW_CRYPT_NONE && !r->crypto_opts) {
1067         ret = -EINVAL;
1068         goto fail;
1069     }
1070 
1071     ret = 0;
1072 fail:
1073     qobject_unref(encryptopts);
1074     qemu_opts_del(opts);
1075     opts = NULL;
1076     return ret;
1077 }
1078 
1079 static void qcow2_update_options_commit(BlockDriverState *bs,
1080                                         Qcow2ReopenState *r)
1081 {
1082     BDRVQcow2State *s = bs->opaque;
1083     int i;
1084 
1085     if (s->l2_table_cache) {
1086         qcow2_cache_destroy(s->l2_table_cache);
1087     }
1088     if (s->refcount_block_cache) {
1089         qcow2_cache_destroy(s->refcount_block_cache);
1090     }
1091     s->l2_table_cache = r->l2_table_cache;
1092     s->refcount_block_cache = r->refcount_block_cache;
1093     s->l2_slice_size = r->l2_slice_size;
1094 
1095     s->overlap_check = r->overlap_check;
1096     s->use_lazy_refcounts = r->use_lazy_refcounts;
1097 
1098     for (i = 0; i < QCOW2_DISCARD_MAX; i++) {
1099         s->discard_passthrough[i] = r->discard_passthrough[i];
1100     }
1101 
1102     if (s->cache_clean_interval != r->cache_clean_interval) {
1103         cache_clean_timer_del(bs);
1104         s->cache_clean_interval = r->cache_clean_interval;
1105         cache_clean_timer_init(bs, bdrv_get_aio_context(bs));
1106     }
1107 
1108     qapi_free_QCryptoBlockOpenOptions(s->crypto_opts);
1109     s->crypto_opts = r->crypto_opts;
1110 }
1111 
1112 static void qcow2_update_options_abort(BlockDriverState *bs,
1113                                        Qcow2ReopenState *r)
1114 {
1115     if (r->l2_table_cache) {
1116         qcow2_cache_destroy(r->l2_table_cache);
1117     }
1118     if (r->refcount_block_cache) {
1119         qcow2_cache_destroy(r->refcount_block_cache);
1120     }
1121     qapi_free_QCryptoBlockOpenOptions(r->crypto_opts);
1122 }
1123 
1124 static int qcow2_update_options(BlockDriverState *bs, QDict *options,
1125                                 int flags, Error **errp)
1126 {
1127     Qcow2ReopenState r = {};
1128     int ret;
1129 
1130     ret = qcow2_update_options_prepare(bs, &r, options, flags, errp);
1131     if (ret >= 0) {
1132         qcow2_update_options_commit(bs, &r);
1133     } else {
1134         qcow2_update_options_abort(bs, &r);
1135     }
1136 
1137     return ret;
1138 }
1139 
1140 /* Called with s->lock held.  */
1141 static int coroutine_fn qcow2_do_open(BlockDriverState *bs, QDict *options,
1142                                       int flags, Error **errp)
1143 {
1144     BDRVQcow2State *s = bs->opaque;
1145     unsigned int len, i;
1146     int ret = 0;
1147     QCowHeader header;
1148     Error *local_err = NULL;
1149     uint64_t ext_end;
1150     uint64_t l1_vm_state_index;
1151     bool update_header = false;
1152     bool header_updated = false;
1153 
1154     ret = bdrv_pread(bs->file, 0, &header, sizeof(header));
1155     if (ret < 0) {
1156         error_setg_errno(errp, -ret, "Could not read qcow2 header");
1157         goto fail;
1158     }
1159     be32_to_cpus(&header.magic);
1160     be32_to_cpus(&header.version);
1161     be64_to_cpus(&header.backing_file_offset);
1162     be32_to_cpus(&header.backing_file_size);
1163     be64_to_cpus(&header.size);
1164     be32_to_cpus(&header.cluster_bits);
1165     be32_to_cpus(&header.crypt_method);
1166     be64_to_cpus(&header.l1_table_offset);
1167     be32_to_cpus(&header.l1_size);
1168     be64_to_cpus(&header.refcount_table_offset);
1169     be32_to_cpus(&header.refcount_table_clusters);
1170     be64_to_cpus(&header.snapshots_offset);
1171     be32_to_cpus(&header.nb_snapshots);
1172 
1173     if (header.magic != QCOW_MAGIC) {
1174         error_setg(errp, "Image is not in qcow2 format");
1175         ret = -EINVAL;
1176         goto fail;
1177     }
1178     if (header.version < 2 || header.version > 3) {
1179         error_setg(errp, "Unsupported qcow2 version %" PRIu32, header.version);
1180         ret = -ENOTSUP;
1181         goto fail;
1182     }
1183 
1184     s->qcow_version = header.version;
1185 
1186     /* Initialise cluster size */
1187     if (header.cluster_bits < MIN_CLUSTER_BITS ||
1188         header.cluster_bits > MAX_CLUSTER_BITS) {
1189         error_setg(errp, "Unsupported cluster size: 2^%" PRIu32,
1190                    header.cluster_bits);
1191         ret = -EINVAL;
1192         goto fail;
1193     }
1194 
1195     s->cluster_bits = header.cluster_bits;
1196     s->cluster_size = 1 << s->cluster_bits;
1197     s->cluster_sectors = 1 << (s->cluster_bits - BDRV_SECTOR_BITS);
1198 
1199     /* Initialise version 3 header fields */
1200     if (header.version == 2) {
1201         header.incompatible_features    = 0;
1202         header.compatible_features      = 0;
1203         header.autoclear_features       = 0;
1204         header.refcount_order           = 4;
1205         header.header_length            = 72;
1206     } else {
1207         be64_to_cpus(&header.incompatible_features);
1208         be64_to_cpus(&header.compatible_features);
1209         be64_to_cpus(&header.autoclear_features);
1210         be32_to_cpus(&header.refcount_order);
1211         be32_to_cpus(&header.header_length);
1212 
1213         if (header.header_length < 104) {
1214             error_setg(errp, "qcow2 header too short");
1215             ret = -EINVAL;
1216             goto fail;
1217         }
1218     }
1219 
1220     if (header.header_length > s->cluster_size) {
1221         error_setg(errp, "qcow2 header exceeds cluster size");
1222         ret = -EINVAL;
1223         goto fail;
1224     }
1225 
1226     if (header.header_length > sizeof(header)) {
1227         s->unknown_header_fields_size = header.header_length - sizeof(header);
1228         s->unknown_header_fields = g_malloc(s->unknown_header_fields_size);
1229         ret = bdrv_pread(bs->file, sizeof(header), s->unknown_header_fields,
1230                          s->unknown_header_fields_size);
1231         if (ret < 0) {
1232             error_setg_errno(errp, -ret, "Could not read unknown qcow2 header "
1233                              "fields");
1234             goto fail;
1235         }
1236     }
1237 
1238     if (header.backing_file_offset > s->cluster_size) {
1239         error_setg(errp, "Invalid backing file offset");
1240         ret = -EINVAL;
1241         goto fail;
1242     }
1243 
1244     if (header.backing_file_offset) {
1245         ext_end = header.backing_file_offset;
1246     } else {
1247         ext_end = 1 << header.cluster_bits;
1248     }
1249 
1250     /* Handle feature bits */
1251     s->incompatible_features    = header.incompatible_features;
1252     s->compatible_features      = header.compatible_features;
1253     s->autoclear_features       = header.autoclear_features;
1254 
1255     if (s->incompatible_features & ~QCOW2_INCOMPAT_MASK) {
1256         void *feature_table = NULL;
1257         qcow2_read_extensions(bs, header.header_length, ext_end,
1258                               &feature_table, flags, NULL, NULL);
1259         report_unsupported_feature(errp, feature_table,
1260                                    s->incompatible_features &
1261                                    ~QCOW2_INCOMPAT_MASK);
1262         ret = -ENOTSUP;
1263         g_free(feature_table);
1264         goto fail;
1265     }
1266 
1267     if (s->incompatible_features & QCOW2_INCOMPAT_CORRUPT) {
1268         /* Corrupt images may not be written to unless they are being repaired
1269          */
1270         if ((flags & BDRV_O_RDWR) && !(flags & BDRV_O_CHECK)) {
1271             error_setg(errp, "qcow2: Image is corrupt; cannot be opened "
1272                        "read/write");
1273             ret = -EACCES;
1274             goto fail;
1275         }
1276     }
1277 
1278     /* Check support for various header values */
1279     if (header.refcount_order > 6) {
1280         error_setg(errp, "Reference count entry width too large; may not "
1281                    "exceed 64 bits");
1282         ret = -EINVAL;
1283         goto fail;
1284     }
1285     s->refcount_order = header.refcount_order;
1286     s->refcount_bits = 1 << s->refcount_order;
1287     s->refcount_max = UINT64_C(1) << (s->refcount_bits - 1);
1288     s->refcount_max += s->refcount_max - 1;
1289 
1290     s->crypt_method_header = header.crypt_method;
1291     if (s->crypt_method_header) {
1292         if (bdrv_uses_whitelist() &&
1293             s->crypt_method_header == QCOW_CRYPT_AES) {
1294             error_setg(errp,
1295                        "Use of AES-CBC encrypted qcow2 images is no longer "
1296                        "supported in system emulators");
1297             error_append_hint(errp,
1298                               "You can use 'qemu-img convert' to convert your "
1299                               "image to an alternative supported format, such "
1300                               "as unencrypted qcow2, or raw with the LUKS "
1301                               "format instead.\n");
1302             ret = -ENOSYS;
1303             goto fail;
1304         }
1305 
1306         if (s->crypt_method_header == QCOW_CRYPT_AES) {
1307             s->crypt_physical_offset = false;
1308         } else {
1309             /* Assuming LUKS and any future crypt methods we
1310              * add will all use physical offsets, due to the
1311              * fact that the alternative is insecure...  */
1312             s->crypt_physical_offset = true;
1313         }
1314 
1315         bs->encrypted = true;
1316     }
1317 
1318     s->l2_bits = s->cluster_bits - 3; /* L2 is always one cluster */
1319     s->l2_size = 1 << s->l2_bits;
1320     /* 2^(s->refcount_order - 3) is the refcount width in bytes */
1321     s->refcount_block_bits = s->cluster_bits - (s->refcount_order - 3);
1322     s->refcount_block_size = 1 << s->refcount_block_bits;
1323     bs->total_sectors = header.size / 512;
1324     s->csize_shift = (62 - (s->cluster_bits - 8));
1325     s->csize_mask = (1 << (s->cluster_bits - 8)) - 1;
1326     s->cluster_offset_mask = (1LL << s->csize_shift) - 1;
1327 
1328     s->refcount_table_offset = header.refcount_table_offset;
1329     s->refcount_table_size =
1330         header.refcount_table_clusters << (s->cluster_bits - 3);
1331 
1332     if (header.refcount_table_clusters == 0 && !(flags & BDRV_O_CHECK)) {
1333         error_setg(errp, "Image does not contain a reference count table");
1334         ret = -EINVAL;
1335         goto fail;
1336     }
1337 
1338     ret = qcow2_validate_table(bs, s->refcount_table_offset,
1339                                header.refcount_table_clusters,
1340                                s->cluster_size, QCOW_MAX_REFTABLE_SIZE,
1341                                "Reference count table", errp);
1342     if (ret < 0) {
1343         goto fail;
1344     }
1345 
1346     /* The total size in bytes of the snapshot table is checked in
1347      * qcow2_read_snapshots() because the size of each snapshot is
1348      * variable and we don't know it yet.
1349      * Here we only check the offset and number of snapshots. */
1350     ret = qcow2_validate_table(bs, header.snapshots_offset,
1351                                header.nb_snapshots,
1352                                sizeof(QCowSnapshotHeader),
1353                                sizeof(QCowSnapshotHeader) * QCOW_MAX_SNAPSHOTS,
1354                                "Snapshot table", errp);
1355     if (ret < 0) {
1356         goto fail;
1357     }
1358 
1359     /* read the level 1 table */
1360     ret = qcow2_validate_table(bs, header.l1_table_offset,
1361                                header.l1_size, sizeof(uint64_t),
1362                                QCOW_MAX_L1_SIZE, "Active L1 table", errp);
1363     if (ret < 0) {
1364         goto fail;
1365     }
1366     s->l1_size = header.l1_size;
1367     s->l1_table_offset = header.l1_table_offset;
1368 
1369     l1_vm_state_index = size_to_l1(s, header.size);
1370     if (l1_vm_state_index > INT_MAX) {
1371         error_setg(errp, "Image is too big");
1372         ret = -EFBIG;
1373         goto fail;
1374     }
1375     s->l1_vm_state_index = l1_vm_state_index;
1376 
1377     /* the L1 table must contain at least enough entries to put
1378        header.size bytes */
1379     if (s->l1_size < s->l1_vm_state_index) {
1380         error_setg(errp, "L1 table is too small");
1381         ret = -EINVAL;
1382         goto fail;
1383     }
1384 
1385     if (s->l1_size > 0) {
1386         s->l1_table = qemu_try_blockalign(bs->file->bs,
1387             ROUND_UP(s->l1_size * sizeof(uint64_t), 512));
1388         if (s->l1_table == NULL) {
1389             error_setg(errp, "Could not allocate L1 table");
1390             ret = -ENOMEM;
1391             goto fail;
1392         }
1393         ret = bdrv_pread(bs->file, s->l1_table_offset, s->l1_table,
1394                          s->l1_size * sizeof(uint64_t));
1395         if (ret < 0) {
1396             error_setg_errno(errp, -ret, "Could not read L1 table");
1397             goto fail;
1398         }
1399         for(i = 0;i < s->l1_size; i++) {
1400             be64_to_cpus(&s->l1_table[i]);
1401         }
1402     }
1403 
1404     /* Parse driver-specific options */
1405     ret = qcow2_update_options(bs, options, flags, errp);
1406     if (ret < 0) {
1407         goto fail;
1408     }
1409 
1410     s->cluster_cache_offset = -1;
1411     s->flags = flags;
1412 
1413     ret = qcow2_refcount_init(bs);
1414     if (ret != 0) {
1415         error_setg_errno(errp, -ret, "Could not initialize refcount handling");
1416         goto fail;
1417     }
1418 
1419     QLIST_INIT(&s->cluster_allocs);
1420     QTAILQ_INIT(&s->discards);
1421 
1422     /* read qcow2 extensions */
1423     if (qcow2_read_extensions(bs, header.header_length, ext_end, NULL,
1424                               flags, &update_header, &local_err)) {
1425         error_propagate(errp, local_err);
1426         ret = -EINVAL;
1427         goto fail;
1428     }
1429 
1430     /* qcow2_read_extension may have set up the crypto context
1431      * if the crypt method needs a header region, some methods
1432      * don't need header extensions, so must check here
1433      */
1434     if (s->crypt_method_header && !s->crypto) {
1435         if (s->crypt_method_header == QCOW_CRYPT_AES) {
1436             unsigned int cflags = 0;
1437             if (flags & BDRV_O_NO_IO) {
1438                 cflags |= QCRYPTO_BLOCK_OPEN_NO_IO;
1439             }
1440             s->crypto = qcrypto_block_open(s->crypto_opts, "encrypt.",
1441                                            NULL, NULL, cflags, errp);
1442             if (!s->crypto) {
1443                 ret = -EINVAL;
1444                 goto fail;
1445             }
1446         } else if (!(flags & BDRV_O_NO_IO)) {
1447             error_setg(errp, "Missing CRYPTO header for crypt method %d",
1448                        s->crypt_method_header);
1449             ret = -EINVAL;
1450             goto fail;
1451         }
1452     }
1453 
1454     /* read the backing file name */
1455     if (header.backing_file_offset != 0) {
1456         len = header.backing_file_size;
1457         if (len > MIN(1023, s->cluster_size - header.backing_file_offset) ||
1458             len >= sizeof(bs->backing_file)) {
1459             error_setg(errp, "Backing file name too long");
1460             ret = -EINVAL;
1461             goto fail;
1462         }
1463         ret = bdrv_pread(bs->file, header.backing_file_offset,
1464                          bs->backing_file, len);
1465         if (ret < 0) {
1466             error_setg_errno(errp, -ret, "Could not read backing file name");
1467             goto fail;
1468         }
1469         bs->backing_file[len] = '\0';
1470         s->image_backing_file = g_strdup(bs->backing_file);
1471     }
1472 
1473     /* Internal snapshots */
1474     s->snapshots_offset = header.snapshots_offset;
1475     s->nb_snapshots = header.nb_snapshots;
1476 
1477     ret = qcow2_read_snapshots(bs);
1478     if (ret < 0) {
1479         error_setg_errno(errp, -ret, "Could not read snapshots");
1480         goto fail;
1481     }
1482 
1483     /* Clear unknown autoclear feature bits */
1484     update_header |= s->autoclear_features & ~QCOW2_AUTOCLEAR_MASK;
1485     update_header =
1486         update_header && !bs->read_only && !(flags & BDRV_O_INACTIVE);
1487     if (update_header) {
1488         s->autoclear_features &= QCOW2_AUTOCLEAR_MASK;
1489     }
1490 
1491     if (s->dirty_bitmaps_loaded) {
1492         /* It's some kind of reopen. There are no known cases where we need to
1493          * reload bitmaps in such a situation, so it's safer to skip them.
1494          *
1495          * Moreover, if we have some readonly bitmaps and we are reopening for
1496          * rw we should reopen bitmaps correspondingly.
1497          */
1498         if (bdrv_has_readonly_bitmaps(bs) &&
1499             !bdrv_is_read_only(bs) && !(bdrv_get_flags(bs) & BDRV_O_INACTIVE))
1500         {
1501             qcow2_reopen_bitmaps_rw_hint(bs, &header_updated, &local_err);
1502         }
1503     } else {
1504         header_updated = qcow2_load_dirty_bitmaps(bs, &local_err);
1505         s->dirty_bitmaps_loaded = true;
1506     }
1507     update_header = update_header && !header_updated;
1508     if (local_err != NULL) {
1509         error_propagate(errp, local_err);
1510         ret = -EINVAL;
1511         goto fail;
1512     }
1513 
1514     if (update_header) {
1515         ret = qcow2_update_header(bs);
1516         if (ret < 0) {
1517             error_setg_errno(errp, -ret, "Could not update qcow2 header");
1518             goto fail;
1519         }
1520     }
1521 
1522     bs->supported_zero_flags = header.version >= 3 ? BDRV_REQ_MAY_UNMAP : 0;
1523 
1524     /* Repair image if dirty */
1525     if (!(flags & (BDRV_O_CHECK | BDRV_O_INACTIVE)) && !bs->read_only &&
1526         (s->incompatible_features & QCOW2_INCOMPAT_DIRTY)) {
1527         BdrvCheckResult result = {0};
1528 
1529         ret = qcow2_co_check_locked(bs, &result,
1530                                     BDRV_FIX_ERRORS | BDRV_FIX_LEAKS);
1531         if (ret < 0 || result.check_errors) {
1532             if (ret >= 0) {
1533                 ret = -EIO;
1534             }
1535             error_setg_errno(errp, -ret, "Could not repair dirty image");
1536             goto fail;
1537         }
1538     }
1539 
1540 #ifdef DEBUG_ALLOC
1541     {
1542         BdrvCheckResult result = {0};
1543         qcow2_check_refcounts(bs, &result, 0);
1544     }
1545 #endif
1546     return ret;
1547 
1548  fail:
1549     g_free(s->unknown_header_fields);
1550     cleanup_unknown_header_ext(bs);
1551     qcow2_free_snapshots(bs);
1552     qcow2_refcount_close(bs);
1553     qemu_vfree(s->l1_table);
1554     /* else pre-write overlap checks in cache_destroy may crash */
1555     s->l1_table = NULL;
1556     cache_clean_timer_del(bs);
1557     if (s->l2_table_cache) {
1558         qcow2_cache_destroy(s->l2_table_cache);
1559     }
1560     if (s->refcount_block_cache) {
1561         qcow2_cache_destroy(s->refcount_block_cache);
1562     }
1563     qcrypto_block_free(s->crypto);
1564     qapi_free_QCryptoBlockOpenOptions(s->crypto_opts);
1565     return ret;
1566 }
1567 
1568 typedef struct QCow2OpenCo {
1569     BlockDriverState *bs;
1570     QDict *options;
1571     int flags;
1572     Error **errp;
1573     int ret;
1574 } QCow2OpenCo;
1575 
1576 static void coroutine_fn qcow2_open_entry(void *opaque)
1577 {
1578     QCow2OpenCo *qoc = opaque;
1579     BDRVQcow2State *s = qoc->bs->opaque;
1580 
1581     qemu_co_mutex_lock(&s->lock);
1582     qoc->ret = qcow2_do_open(qoc->bs, qoc->options, qoc->flags, qoc->errp);
1583     qemu_co_mutex_unlock(&s->lock);
1584 }
1585 
1586 static int qcow2_open(BlockDriverState *bs, QDict *options, int flags,
1587                       Error **errp)
1588 {
1589     BDRVQcow2State *s = bs->opaque;
1590     QCow2OpenCo qoc = {
1591         .bs = bs,
1592         .options = options,
1593         .flags = flags,
1594         .errp = errp,
1595         .ret = -EINPROGRESS
1596     };
1597 
1598     bs->file = bdrv_open_child(NULL, options, "file", bs, &child_file,
1599                                false, errp);
1600     if (!bs->file) {
1601         return -EINVAL;
1602     }
1603 
1604     /* Initialise locks */
1605     qemu_co_mutex_init(&s->lock);
1606 
1607     if (qemu_in_coroutine()) {
1608         /* From bdrv_co_create.  */
1609         qcow2_open_entry(&qoc);
1610     } else {
1611         qemu_coroutine_enter(qemu_coroutine_create(qcow2_open_entry, &qoc));
1612         BDRV_POLL_WHILE(bs, qoc.ret == -EINPROGRESS);
1613     }
1614     return qoc.ret;
1615 }
1616 
1617 static void qcow2_refresh_limits(BlockDriverState *bs, Error **errp)
1618 {
1619     BDRVQcow2State *s = bs->opaque;
1620 
1621     if (bs->encrypted) {
1622         /* Encryption works on a sector granularity */
1623         bs->bl.request_alignment = BDRV_SECTOR_SIZE;
1624     }
1625     bs->bl.pwrite_zeroes_alignment = s->cluster_size;
1626     bs->bl.pdiscard_alignment = s->cluster_size;
1627 }
1628 
1629 static int qcow2_reopen_prepare(BDRVReopenState *state,
1630                                 BlockReopenQueue *queue, Error **errp)
1631 {
1632     Qcow2ReopenState *r;
1633     int ret;
1634 
1635     r = g_new0(Qcow2ReopenState, 1);
1636     state->opaque = r;
1637 
1638     ret = qcow2_update_options_prepare(state->bs, r, state->options,
1639                                        state->flags, errp);
1640     if (ret < 0) {
1641         goto fail;
1642     }
1643 
1644     /* We need to write out any unwritten data if we reopen read-only. */
1645     if ((state->flags & BDRV_O_RDWR) == 0) {
1646         ret = qcow2_reopen_bitmaps_ro(state->bs, errp);
1647         if (ret < 0) {
1648             goto fail;
1649         }
1650 
1651         ret = bdrv_flush(state->bs);
1652         if (ret < 0) {
1653             goto fail;
1654         }
1655 
1656         ret = qcow2_mark_clean(state->bs);
1657         if (ret < 0) {
1658             goto fail;
1659         }
1660     }
1661 
1662     return 0;
1663 
1664 fail:
1665     qcow2_update_options_abort(state->bs, r);
1666     g_free(r);
1667     return ret;
1668 }
1669 
1670 static void qcow2_reopen_commit(BDRVReopenState *state)
1671 {
1672     qcow2_update_options_commit(state->bs, state->opaque);
1673     g_free(state->opaque);
1674 }
1675 
1676 static void qcow2_reopen_abort(BDRVReopenState *state)
1677 {
1678     qcow2_update_options_abort(state->bs, state->opaque);
1679     g_free(state->opaque);
1680 }
1681 
1682 static void qcow2_join_options(QDict *options, QDict *old_options)
1683 {
1684     bool has_new_overlap_template =
1685         qdict_haskey(options, QCOW2_OPT_OVERLAP) ||
1686         qdict_haskey(options, QCOW2_OPT_OVERLAP_TEMPLATE);
1687     bool has_new_total_cache_size =
1688         qdict_haskey(options, QCOW2_OPT_CACHE_SIZE);
1689     bool has_all_cache_options;
1690 
1691     /* New overlap template overrides all old overlap options */
1692     if (has_new_overlap_template) {
1693         qdict_del(old_options, QCOW2_OPT_OVERLAP);
1694         qdict_del(old_options, QCOW2_OPT_OVERLAP_TEMPLATE);
1695         qdict_del(old_options, QCOW2_OPT_OVERLAP_MAIN_HEADER);
1696         qdict_del(old_options, QCOW2_OPT_OVERLAP_ACTIVE_L1);
1697         qdict_del(old_options, QCOW2_OPT_OVERLAP_ACTIVE_L2);
1698         qdict_del(old_options, QCOW2_OPT_OVERLAP_REFCOUNT_TABLE);
1699         qdict_del(old_options, QCOW2_OPT_OVERLAP_REFCOUNT_BLOCK);
1700         qdict_del(old_options, QCOW2_OPT_OVERLAP_SNAPSHOT_TABLE);
1701         qdict_del(old_options, QCOW2_OPT_OVERLAP_INACTIVE_L1);
1702         qdict_del(old_options, QCOW2_OPT_OVERLAP_INACTIVE_L2);
1703     }
1704 
1705     /* New total cache size overrides all old options */
1706     if (qdict_haskey(options, QCOW2_OPT_CACHE_SIZE)) {
1707         qdict_del(old_options, QCOW2_OPT_L2_CACHE_SIZE);
1708         qdict_del(old_options, QCOW2_OPT_REFCOUNT_CACHE_SIZE);
1709     }
1710 
1711     qdict_join(options, old_options, false);
1712 
1713     /*
1714      * If after merging all cache size options are set, an old total size is
1715      * overwritten. Do keep all options, however, if all three are new. The
1716      * resulting error message is what we want to happen.
1717      */
1718     has_all_cache_options =
1719         qdict_haskey(options, QCOW2_OPT_CACHE_SIZE) ||
1720         qdict_haskey(options, QCOW2_OPT_L2_CACHE_SIZE) ||
1721         qdict_haskey(options, QCOW2_OPT_REFCOUNT_CACHE_SIZE);
1722 
1723     if (has_all_cache_options && !has_new_total_cache_size) {
1724         qdict_del(options, QCOW2_OPT_CACHE_SIZE);
1725     }
1726 }
1727 
1728 static int coroutine_fn qcow2_co_block_status(BlockDriverState *bs,
1729                                               bool want_zero,
1730                                               int64_t offset, int64_t count,
1731                                               int64_t *pnum, int64_t *map,
1732                                               BlockDriverState **file)
1733 {
1734     BDRVQcow2State *s = bs->opaque;
1735     uint64_t cluster_offset;
1736     int index_in_cluster, ret;
1737     unsigned int bytes;
1738     int status = 0;
1739 
1740     bytes = MIN(INT_MAX, count);
1741     qemu_co_mutex_lock(&s->lock);
1742     ret = qcow2_get_cluster_offset(bs, offset, &bytes, &cluster_offset);
1743     qemu_co_mutex_unlock(&s->lock);
1744     if (ret < 0) {
1745         return ret;
1746     }
1747 
1748     *pnum = bytes;
1749 
1750     if (cluster_offset != 0 && ret != QCOW2_CLUSTER_COMPRESSED &&
1751         !s->crypto) {
1752         index_in_cluster = offset & (s->cluster_size - 1);
1753         *map = cluster_offset | index_in_cluster;
1754         *file = bs->file->bs;
1755         status |= BDRV_BLOCK_OFFSET_VALID;
1756     }
1757     if (ret == QCOW2_CLUSTER_ZERO_PLAIN || ret == QCOW2_CLUSTER_ZERO_ALLOC) {
1758         status |= BDRV_BLOCK_ZERO;
1759     } else if (ret != QCOW2_CLUSTER_UNALLOCATED) {
1760         status |= BDRV_BLOCK_DATA;
1761     }
1762     return status;
1763 }
1764 
1765 static coroutine_fn int qcow2_handle_l2meta(BlockDriverState *bs,
1766                                             QCowL2Meta **pl2meta,
1767                                             bool link_l2)
1768 {
1769     int ret = 0;
1770     QCowL2Meta *l2meta = *pl2meta;
1771 
1772     while (l2meta != NULL) {
1773         QCowL2Meta *next;
1774 
1775         if (!ret && link_l2) {
1776             ret = qcow2_alloc_cluster_link_l2(bs, l2meta);
1777             if (ret) {
1778                 goto out;
1779             }
1780         }
1781 
1782         /* Take the request off the list of running requests */
1783         if (l2meta->nb_clusters != 0) {
1784             QLIST_REMOVE(l2meta, next_in_flight);
1785         }
1786 
1787         qemu_co_queue_restart_all(&l2meta->dependent_requests);
1788 
1789         next = l2meta->next;
1790         g_free(l2meta);
1791         l2meta = next;
1792     }
1793 out:
1794     *pl2meta = l2meta;
1795     return ret;
1796 }
1797 
1798 static coroutine_fn int qcow2_co_preadv(BlockDriverState *bs, uint64_t offset,
1799                                         uint64_t bytes, QEMUIOVector *qiov,
1800                                         int flags)
1801 {
1802     BDRVQcow2State *s = bs->opaque;
1803     int offset_in_cluster;
1804     int ret;
1805     unsigned int cur_bytes; /* number of bytes in current iteration */
1806     uint64_t cluster_offset = 0;
1807     uint64_t bytes_done = 0;
1808     QEMUIOVector hd_qiov;
1809     uint8_t *cluster_data = NULL;
1810 
1811     qemu_iovec_init(&hd_qiov, qiov->niov);
1812 
1813     qemu_co_mutex_lock(&s->lock);
1814 
1815     while (bytes != 0) {
1816 
1817         /* prepare next request */
1818         cur_bytes = MIN(bytes, INT_MAX);
1819         if (s->crypto) {
1820             cur_bytes = MIN(cur_bytes,
1821                             QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size);
1822         }
1823 
1824         ret = qcow2_get_cluster_offset(bs, offset, &cur_bytes, &cluster_offset);
1825         if (ret < 0) {
1826             goto fail;
1827         }
1828 
1829         offset_in_cluster = offset_into_cluster(s, offset);
1830 
1831         qemu_iovec_reset(&hd_qiov);
1832         qemu_iovec_concat(&hd_qiov, qiov, bytes_done, cur_bytes);
1833 
1834         switch (ret) {
1835         case QCOW2_CLUSTER_UNALLOCATED:
1836 
1837             if (bs->backing) {
1838                 BLKDBG_EVENT(bs->file, BLKDBG_READ_BACKING_AIO);
1839                 qemu_co_mutex_unlock(&s->lock);
1840                 ret = bdrv_co_preadv(bs->backing, offset, cur_bytes,
1841                                      &hd_qiov, 0);
1842                 qemu_co_mutex_lock(&s->lock);
1843                 if (ret < 0) {
1844                     goto fail;
1845                 }
1846             } else {
1847                 /* Note: in this case, no need to wait */
1848                 qemu_iovec_memset(&hd_qiov, 0, 0, cur_bytes);
1849             }
1850             break;
1851 
1852         case QCOW2_CLUSTER_ZERO_PLAIN:
1853         case QCOW2_CLUSTER_ZERO_ALLOC:
1854             qemu_iovec_memset(&hd_qiov, 0, 0, cur_bytes);
1855             break;
1856 
1857         case QCOW2_CLUSTER_COMPRESSED:
1858             /* add AIO support for compressed blocks ? */
1859             ret = qcow2_decompress_cluster(bs, cluster_offset);
1860             if (ret < 0) {
1861                 goto fail;
1862             }
1863 
1864             qemu_iovec_from_buf(&hd_qiov, 0,
1865                                 s->cluster_cache + offset_in_cluster,
1866                                 cur_bytes);
1867             break;
1868 
1869         case QCOW2_CLUSTER_NORMAL:
1870             if ((cluster_offset & 511) != 0) {
1871                 ret = -EIO;
1872                 goto fail;
1873             }
1874 
1875             if (bs->encrypted) {
1876                 assert(s->crypto);
1877 
1878                 /*
1879                  * For encrypted images, read everything into a temporary
1880                  * contiguous buffer on which the AES functions can work.
1881                  */
1882                 if (!cluster_data) {
1883                     cluster_data =
1884                         qemu_try_blockalign(bs->file->bs,
1885                                             QCOW_MAX_CRYPT_CLUSTERS
1886                                             * s->cluster_size);
1887                     if (cluster_data == NULL) {
1888                         ret = -ENOMEM;
1889                         goto fail;
1890                     }
1891                 }
1892 
1893                 assert(cur_bytes <= QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size);
1894                 qemu_iovec_reset(&hd_qiov);
1895                 qemu_iovec_add(&hd_qiov, cluster_data, cur_bytes);
1896             }
1897 
1898             BLKDBG_EVENT(bs->file, BLKDBG_READ_AIO);
1899             qemu_co_mutex_unlock(&s->lock);
1900             ret = bdrv_co_preadv(bs->file,
1901                                  cluster_offset + offset_in_cluster,
1902                                  cur_bytes, &hd_qiov, 0);
1903             qemu_co_mutex_lock(&s->lock);
1904             if (ret < 0) {
1905                 goto fail;
1906             }
1907             if (bs->encrypted) {
1908                 assert(s->crypto);
1909                 assert((offset & (BDRV_SECTOR_SIZE - 1)) == 0);
1910                 assert((cur_bytes & (BDRV_SECTOR_SIZE - 1)) == 0);
1911                 if (qcrypto_block_decrypt(s->crypto,
1912                                           (s->crypt_physical_offset ?
1913                                            cluster_offset + offset_in_cluster :
1914                                            offset),
1915                                           cluster_data,
1916                                           cur_bytes,
1917                                           NULL) < 0) {
1918                     ret = -EIO;
1919                     goto fail;
1920                 }
1921                 qemu_iovec_from_buf(qiov, bytes_done, cluster_data, cur_bytes);
1922             }
1923             break;
1924 
1925         default:
1926             g_assert_not_reached();
1927             ret = -EIO;
1928             goto fail;
1929         }
1930 
1931         bytes -= cur_bytes;
1932         offset += cur_bytes;
1933         bytes_done += cur_bytes;
1934     }
1935     ret = 0;
1936 
1937 fail:
1938     qemu_co_mutex_unlock(&s->lock);
1939 
1940     qemu_iovec_destroy(&hd_qiov);
1941     qemu_vfree(cluster_data);
1942 
1943     return ret;
1944 }
1945 
1946 /* Check if it's possible to merge a write request with the writing of
1947  * the data from the COW regions */
1948 static bool merge_cow(uint64_t offset, unsigned bytes,
1949                       QEMUIOVector *hd_qiov, QCowL2Meta *l2meta)
1950 {
1951     QCowL2Meta *m;
1952 
1953     for (m = l2meta; m != NULL; m = m->next) {
1954         /* If both COW regions are empty then there's nothing to merge */
1955         if (m->cow_start.nb_bytes == 0 && m->cow_end.nb_bytes == 0) {
1956             continue;
1957         }
1958 
1959         /* The data (middle) region must be immediately after the
1960          * start region */
1961         if (l2meta_cow_start(m) + m->cow_start.nb_bytes != offset) {
1962             continue;
1963         }
1964 
1965         /* The end region must be immediately after the data (middle)
1966          * region */
1967         if (m->offset + m->cow_end.offset != offset + bytes) {
1968             continue;
1969         }
1970 
1971         /* Make sure that adding both COW regions to the QEMUIOVector
1972          * does not exceed IOV_MAX */
1973         if (hd_qiov->niov > IOV_MAX - 2) {
1974             continue;
1975         }
1976 
1977         m->data_qiov = hd_qiov;
1978         return true;
1979     }
1980 
1981     return false;
1982 }
1983 
1984 static coroutine_fn int qcow2_co_pwritev(BlockDriverState *bs, uint64_t offset,
1985                                          uint64_t bytes, QEMUIOVector *qiov,
1986                                          int flags)
1987 {
1988     BDRVQcow2State *s = bs->opaque;
1989     int offset_in_cluster;
1990     int ret;
1991     unsigned int cur_bytes; /* number of sectors in current iteration */
1992     uint64_t cluster_offset;
1993     QEMUIOVector hd_qiov;
1994     uint64_t bytes_done = 0;
1995     uint8_t *cluster_data = NULL;
1996     QCowL2Meta *l2meta = NULL;
1997 
1998     trace_qcow2_writev_start_req(qemu_coroutine_self(), offset, bytes);
1999 
2000     qemu_iovec_init(&hd_qiov, qiov->niov);
2001 
2002     s->cluster_cache_offset = -1; /* disable compressed cache */
2003 
2004     qemu_co_mutex_lock(&s->lock);
2005 
2006     while (bytes != 0) {
2007 
2008         l2meta = NULL;
2009 
2010         trace_qcow2_writev_start_part(qemu_coroutine_self());
2011         offset_in_cluster = offset_into_cluster(s, offset);
2012         cur_bytes = MIN(bytes, INT_MAX);
2013         if (bs->encrypted) {
2014             cur_bytes = MIN(cur_bytes,
2015                             QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size
2016                             - offset_in_cluster);
2017         }
2018 
2019         ret = qcow2_alloc_cluster_offset(bs, offset, &cur_bytes,
2020                                          &cluster_offset, &l2meta);
2021         if (ret < 0) {
2022             goto fail;
2023         }
2024 
2025         assert((cluster_offset & 511) == 0);
2026 
2027         qemu_iovec_reset(&hd_qiov);
2028         qemu_iovec_concat(&hd_qiov, qiov, bytes_done, cur_bytes);
2029 
2030         if (bs->encrypted) {
2031             assert(s->crypto);
2032             if (!cluster_data) {
2033                 cluster_data = qemu_try_blockalign(bs->file->bs,
2034                                                    QCOW_MAX_CRYPT_CLUSTERS
2035                                                    * s->cluster_size);
2036                 if (cluster_data == NULL) {
2037                     ret = -ENOMEM;
2038                     goto fail;
2039                 }
2040             }
2041 
2042             assert(hd_qiov.size <=
2043                    QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size);
2044             qemu_iovec_to_buf(&hd_qiov, 0, cluster_data, hd_qiov.size);
2045 
2046             if (qcrypto_block_encrypt(s->crypto,
2047                                       (s->crypt_physical_offset ?
2048                                        cluster_offset + offset_in_cluster :
2049                                        offset),
2050                                       cluster_data,
2051                                       cur_bytes, NULL) < 0) {
2052                 ret = -EIO;
2053                 goto fail;
2054             }
2055 
2056             qemu_iovec_reset(&hd_qiov);
2057             qemu_iovec_add(&hd_qiov, cluster_data, cur_bytes);
2058         }
2059 
2060         ret = qcow2_pre_write_overlap_check(bs, 0,
2061                 cluster_offset + offset_in_cluster, cur_bytes);
2062         if (ret < 0) {
2063             goto fail;
2064         }
2065 
2066         /* If we need to do COW, check if it's possible to merge the
2067          * writing of the guest data together with that of the COW regions.
2068          * If it's not possible (or not necessary) then write the
2069          * guest data now. */
2070         if (!merge_cow(offset, cur_bytes, &hd_qiov, l2meta)) {
2071             qemu_co_mutex_unlock(&s->lock);
2072             BLKDBG_EVENT(bs->file, BLKDBG_WRITE_AIO);
2073             trace_qcow2_writev_data(qemu_coroutine_self(),
2074                                     cluster_offset + offset_in_cluster);
2075             ret = bdrv_co_pwritev(bs->file,
2076                                   cluster_offset + offset_in_cluster,
2077                                   cur_bytes, &hd_qiov, 0);
2078             qemu_co_mutex_lock(&s->lock);
2079             if (ret < 0) {
2080                 goto fail;
2081             }
2082         }
2083 
2084         ret = qcow2_handle_l2meta(bs, &l2meta, true);
2085         if (ret) {
2086             goto fail;
2087         }
2088 
2089         bytes -= cur_bytes;
2090         offset += cur_bytes;
2091         bytes_done += cur_bytes;
2092         trace_qcow2_writev_done_part(qemu_coroutine_self(), cur_bytes);
2093     }
2094     ret = 0;
2095 
2096 fail:
2097     qcow2_handle_l2meta(bs, &l2meta, false);
2098 
2099     qemu_co_mutex_unlock(&s->lock);
2100 
2101     qemu_iovec_destroy(&hd_qiov);
2102     qemu_vfree(cluster_data);
2103     trace_qcow2_writev_done_req(qemu_coroutine_self(), ret);
2104 
2105     return ret;
2106 }
2107 
2108 static int qcow2_inactivate(BlockDriverState *bs)
2109 {
2110     BDRVQcow2State *s = bs->opaque;
2111     int ret, result = 0;
2112     Error *local_err = NULL;
2113 
2114     qcow2_store_persistent_dirty_bitmaps(bs, &local_err);
2115     if (local_err != NULL) {
2116         result = -EINVAL;
2117         error_report_err(local_err);
2118         error_report("Persistent bitmaps are lost for node '%s'",
2119                      bdrv_get_device_or_node_name(bs));
2120     }
2121 
2122     ret = qcow2_cache_flush(bs, s->l2_table_cache);
2123     if (ret) {
2124         result = ret;
2125         error_report("Failed to flush the L2 table cache: %s",
2126                      strerror(-ret));
2127     }
2128 
2129     ret = qcow2_cache_flush(bs, s->refcount_block_cache);
2130     if (ret) {
2131         result = ret;
2132         error_report("Failed to flush the refcount block cache: %s",
2133                      strerror(-ret));
2134     }
2135 
2136     if (result == 0) {
2137         qcow2_mark_clean(bs);
2138     }
2139 
2140     return result;
2141 }
2142 
2143 static void qcow2_close(BlockDriverState *bs)
2144 {
2145     BDRVQcow2State *s = bs->opaque;
2146     qemu_vfree(s->l1_table);
2147     /* else pre-write overlap checks in cache_destroy may crash */
2148     s->l1_table = NULL;
2149 
2150     if (!(s->flags & BDRV_O_INACTIVE)) {
2151         qcow2_inactivate(bs);
2152     }
2153 
2154     cache_clean_timer_del(bs);
2155     qcow2_cache_destroy(s->l2_table_cache);
2156     qcow2_cache_destroy(s->refcount_block_cache);
2157 
2158     qcrypto_block_free(s->crypto);
2159     s->crypto = NULL;
2160 
2161     g_free(s->unknown_header_fields);
2162     cleanup_unknown_header_ext(bs);
2163 
2164     g_free(s->image_backing_file);
2165     g_free(s->image_backing_format);
2166 
2167     g_free(s->cluster_cache);
2168     qemu_vfree(s->cluster_data);
2169     qcow2_refcount_close(bs);
2170     qcow2_free_snapshots(bs);
2171 }
2172 
2173 static void coroutine_fn qcow2_co_invalidate_cache(BlockDriverState *bs,
2174                                                    Error **errp)
2175 {
2176     BDRVQcow2State *s = bs->opaque;
2177     int flags = s->flags;
2178     QCryptoBlock *crypto = NULL;
2179     QDict *options;
2180     Error *local_err = NULL;
2181     int ret;
2182 
2183     /*
2184      * Backing files are read-only which makes all of their metadata immutable,
2185      * that means we don't have to worry about reopening them here.
2186      */
2187 
2188     crypto = s->crypto;
2189     s->crypto = NULL;
2190 
2191     qcow2_close(bs);
2192 
2193     memset(s, 0, sizeof(BDRVQcow2State));
2194     options = qdict_clone_shallow(bs->options);
2195 
2196     flags &= ~BDRV_O_INACTIVE;
2197     qemu_co_mutex_lock(&s->lock);
2198     ret = qcow2_do_open(bs, options, flags, &local_err);
2199     qemu_co_mutex_unlock(&s->lock);
2200     qobject_unref(options);
2201     if (local_err) {
2202         error_propagate(errp, local_err);
2203         error_prepend(errp, "Could not reopen qcow2 layer: ");
2204         bs->drv = NULL;
2205         return;
2206     } else if (ret < 0) {
2207         error_setg_errno(errp, -ret, "Could not reopen qcow2 layer");
2208         bs->drv = NULL;
2209         return;
2210     }
2211 
2212     s->crypto = crypto;
2213 }
2214 
2215 static size_t header_ext_add(char *buf, uint32_t magic, const void *s,
2216     size_t len, size_t buflen)
2217 {
2218     QCowExtension *ext_backing_fmt = (QCowExtension*) buf;
2219     size_t ext_len = sizeof(QCowExtension) + ((len + 7) & ~7);
2220 
2221     if (buflen < ext_len) {
2222         return -ENOSPC;
2223     }
2224 
2225     *ext_backing_fmt = (QCowExtension) {
2226         .magic  = cpu_to_be32(magic),
2227         .len    = cpu_to_be32(len),
2228     };
2229 
2230     if (len) {
2231         memcpy(buf + sizeof(QCowExtension), s, len);
2232     }
2233 
2234     return ext_len;
2235 }
2236 
2237 /*
2238  * Updates the qcow2 header, including the variable length parts of it, i.e.
2239  * the backing file name and all extensions. qcow2 was not designed to allow
2240  * such changes, so if we run out of space (we can only use the first cluster)
2241  * this function may fail.
2242  *
2243  * Returns 0 on success, -errno in error cases.
2244  */
2245 int qcow2_update_header(BlockDriverState *bs)
2246 {
2247     BDRVQcow2State *s = bs->opaque;
2248     QCowHeader *header;
2249     char *buf;
2250     size_t buflen = s->cluster_size;
2251     int ret;
2252     uint64_t total_size;
2253     uint32_t refcount_table_clusters;
2254     size_t header_length;
2255     Qcow2UnknownHeaderExtension *uext;
2256 
2257     buf = qemu_blockalign(bs, buflen);
2258 
2259     /* Header structure */
2260     header = (QCowHeader*) buf;
2261 
2262     if (buflen < sizeof(*header)) {
2263         ret = -ENOSPC;
2264         goto fail;
2265     }
2266 
2267     header_length = sizeof(*header) + s->unknown_header_fields_size;
2268     total_size = bs->total_sectors * BDRV_SECTOR_SIZE;
2269     refcount_table_clusters = s->refcount_table_size >> (s->cluster_bits - 3);
2270 
2271     *header = (QCowHeader) {
2272         /* Version 2 fields */
2273         .magic                  = cpu_to_be32(QCOW_MAGIC),
2274         .version                = cpu_to_be32(s->qcow_version),
2275         .backing_file_offset    = 0,
2276         .backing_file_size      = 0,
2277         .cluster_bits           = cpu_to_be32(s->cluster_bits),
2278         .size                   = cpu_to_be64(total_size),
2279         .crypt_method           = cpu_to_be32(s->crypt_method_header),
2280         .l1_size                = cpu_to_be32(s->l1_size),
2281         .l1_table_offset        = cpu_to_be64(s->l1_table_offset),
2282         .refcount_table_offset  = cpu_to_be64(s->refcount_table_offset),
2283         .refcount_table_clusters = cpu_to_be32(refcount_table_clusters),
2284         .nb_snapshots           = cpu_to_be32(s->nb_snapshots),
2285         .snapshots_offset       = cpu_to_be64(s->snapshots_offset),
2286 
2287         /* Version 3 fields */
2288         .incompatible_features  = cpu_to_be64(s->incompatible_features),
2289         .compatible_features    = cpu_to_be64(s->compatible_features),
2290         .autoclear_features     = cpu_to_be64(s->autoclear_features),
2291         .refcount_order         = cpu_to_be32(s->refcount_order),
2292         .header_length          = cpu_to_be32(header_length),
2293     };
2294 
2295     /* For older versions, write a shorter header */
2296     switch (s->qcow_version) {
2297     case 2:
2298         ret = offsetof(QCowHeader, incompatible_features);
2299         break;
2300     case 3:
2301         ret = sizeof(*header);
2302         break;
2303     default:
2304         ret = -EINVAL;
2305         goto fail;
2306     }
2307 
2308     buf += ret;
2309     buflen -= ret;
2310     memset(buf, 0, buflen);
2311 
2312     /* Preserve any unknown field in the header */
2313     if (s->unknown_header_fields_size) {
2314         if (buflen < s->unknown_header_fields_size) {
2315             ret = -ENOSPC;
2316             goto fail;
2317         }
2318 
2319         memcpy(buf, s->unknown_header_fields, s->unknown_header_fields_size);
2320         buf += s->unknown_header_fields_size;
2321         buflen -= s->unknown_header_fields_size;
2322     }
2323 
2324     /* Backing file format header extension */
2325     if (s->image_backing_format) {
2326         ret = header_ext_add(buf, QCOW2_EXT_MAGIC_BACKING_FORMAT,
2327                              s->image_backing_format,
2328                              strlen(s->image_backing_format),
2329                              buflen);
2330         if (ret < 0) {
2331             goto fail;
2332         }
2333 
2334         buf += ret;
2335         buflen -= ret;
2336     }
2337 
2338     /* Full disk encryption header pointer extension */
2339     if (s->crypto_header.offset != 0) {
2340         cpu_to_be64s(&s->crypto_header.offset);
2341         cpu_to_be64s(&s->crypto_header.length);
2342         ret = header_ext_add(buf, QCOW2_EXT_MAGIC_CRYPTO_HEADER,
2343                              &s->crypto_header, sizeof(s->crypto_header),
2344                              buflen);
2345         be64_to_cpus(&s->crypto_header.offset);
2346         be64_to_cpus(&s->crypto_header.length);
2347         if (ret < 0) {
2348             goto fail;
2349         }
2350         buf += ret;
2351         buflen -= ret;
2352     }
2353 
2354     /* Feature table */
2355     if (s->qcow_version >= 3) {
2356         Qcow2Feature features[] = {
2357             {
2358                 .type = QCOW2_FEAT_TYPE_INCOMPATIBLE,
2359                 .bit  = QCOW2_INCOMPAT_DIRTY_BITNR,
2360                 .name = "dirty bit",
2361             },
2362             {
2363                 .type = QCOW2_FEAT_TYPE_INCOMPATIBLE,
2364                 .bit  = QCOW2_INCOMPAT_CORRUPT_BITNR,
2365                 .name = "corrupt bit",
2366             },
2367             {
2368                 .type = QCOW2_FEAT_TYPE_COMPATIBLE,
2369                 .bit  = QCOW2_COMPAT_LAZY_REFCOUNTS_BITNR,
2370                 .name = "lazy refcounts",
2371             },
2372         };
2373 
2374         ret = header_ext_add(buf, QCOW2_EXT_MAGIC_FEATURE_TABLE,
2375                              features, sizeof(features), buflen);
2376         if (ret < 0) {
2377             goto fail;
2378         }
2379         buf += ret;
2380         buflen -= ret;
2381     }
2382 
2383     /* Bitmap extension */
2384     if (s->nb_bitmaps > 0) {
2385         Qcow2BitmapHeaderExt bitmaps_header = {
2386             .nb_bitmaps = cpu_to_be32(s->nb_bitmaps),
2387             .bitmap_directory_size =
2388                     cpu_to_be64(s->bitmap_directory_size),
2389             .bitmap_directory_offset =
2390                     cpu_to_be64(s->bitmap_directory_offset)
2391         };
2392         ret = header_ext_add(buf, QCOW2_EXT_MAGIC_BITMAPS,
2393                              &bitmaps_header, sizeof(bitmaps_header),
2394                              buflen);
2395         if (ret < 0) {
2396             goto fail;
2397         }
2398         buf += ret;
2399         buflen -= ret;
2400     }
2401 
2402     /* Keep unknown header extensions */
2403     QLIST_FOREACH(uext, &s->unknown_header_ext, next) {
2404         ret = header_ext_add(buf, uext->magic, uext->data, uext->len, buflen);
2405         if (ret < 0) {
2406             goto fail;
2407         }
2408 
2409         buf += ret;
2410         buflen -= ret;
2411     }
2412 
2413     /* End of header extensions */
2414     ret = header_ext_add(buf, QCOW2_EXT_MAGIC_END, NULL, 0, buflen);
2415     if (ret < 0) {
2416         goto fail;
2417     }
2418 
2419     buf += ret;
2420     buflen -= ret;
2421 
2422     /* Backing file name */
2423     if (s->image_backing_file) {
2424         size_t backing_file_len = strlen(s->image_backing_file);
2425 
2426         if (buflen < backing_file_len) {
2427             ret = -ENOSPC;
2428             goto fail;
2429         }
2430 
2431         /* Using strncpy is ok here, since buf is not NUL-terminated. */
2432         strncpy(buf, s->image_backing_file, buflen);
2433 
2434         header->backing_file_offset = cpu_to_be64(buf - ((char*) header));
2435         header->backing_file_size   = cpu_to_be32(backing_file_len);
2436     }
2437 
2438     /* Write the new header */
2439     ret = bdrv_pwrite(bs->file, 0, header, s->cluster_size);
2440     if (ret < 0) {
2441         goto fail;
2442     }
2443 
2444     ret = 0;
2445 fail:
2446     qemu_vfree(header);
2447     return ret;
2448 }
2449 
2450 static int qcow2_change_backing_file(BlockDriverState *bs,
2451     const char *backing_file, const char *backing_fmt)
2452 {
2453     BDRVQcow2State *s = bs->opaque;
2454 
2455     if (backing_file && strlen(backing_file) > 1023) {
2456         return -EINVAL;
2457     }
2458 
2459     pstrcpy(bs->backing_file, sizeof(bs->backing_file), backing_file ?: "");
2460     pstrcpy(bs->backing_format, sizeof(bs->backing_format), backing_fmt ?: "");
2461 
2462     g_free(s->image_backing_file);
2463     g_free(s->image_backing_format);
2464 
2465     s->image_backing_file = backing_file ? g_strdup(bs->backing_file) : NULL;
2466     s->image_backing_format = backing_fmt ? g_strdup(bs->backing_format) : NULL;
2467 
2468     return qcow2_update_header(bs);
2469 }
2470 
2471 static int qcow2_crypt_method_from_format(const char *encryptfmt)
2472 {
2473     if (g_str_equal(encryptfmt, "luks")) {
2474         return QCOW_CRYPT_LUKS;
2475     } else if (g_str_equal(encryptfmt, "aes")) {
2476         return QCOW_CRYPT_AES;
2477     } else {
2478         return -EINVAL;
2479     }
2480 }
2481 
2482 static int qcow2_set_up_encryption(BlockDriverState *bs,
2483                                    QCryptoBlockCreateOptions *cryptoopts,
2484                                    Error **errp)
2485 {
2486     BDRVQcow2State *s = bs->opaque;
2487     QCryptoBlock *crypto = NULL;
2488     int fmt, ret;
2489 
2490     switch (cryptoopts->format) {
2491     case Q_CRYPTO_BLOCK_FORMAT_LUKS:
2492         fmt = QCOW_CRYPT_LUKS;
2493         break;
2494     case Q_CRYPTO_BLOCK_FORMAT_QCOW:
2495         fmt = QCOW_CRYPT_AES;
2496         break;
2497     default:
2498         error_setg(errp, "Crypto format not supported in qcow2");
2499         return -EINVAL;
2500     }
2501 
2502     s->crypt_method_header = fmt;
2503 
2504     crypto = qcrypto_block_create(cryptoopts, "encrypt.",
2505                                   qcow2_crypto_hdr_init_func,
2506                                   qcow2_crypto_hdr_write_func,
2507                                   bs, errp);
2508     if (!crypto) {
2509         return -EINVAL;
2510     }
2511 
2512     ret = qcow2_update_header(bs);
2513     if (ret < 0) {
2514         error_setg_errno(errp, -ret, "Could not write encryption header");
2515         goto out;
2516     }
2517 
2518     ret = 0;
2519  out:
2520     qcrypto_block_free(crypto);
2521     return ret;
2522 }
2523 
2524 
2525 typedef struct PreallocCo {
2526     BlockDriverState *bs;
2527     uint64_t offset;
2528     uint64_t new_length;
2529 
2530     int ret;
2531 } PreallocCo;
2532 
2533 /**
2534  * Preallocates metadata structures for data clusters between @offset (in the
2535  * guest disk) and @new_length (which is thus generally the new guest disk
2536  * size).
2537  *
2538  * Returns: 0 on success, -errno on failure.
2539  */
2540 static void coroutine_fn preallocate_co(void *opaque)
2541 {
2542     PreallocCo *params = opaque;
2543     BlockDriverState *bs = params->bs;
2544     uint64_t offset = params->offset;
2545     uint64_t new_length = params->new_length;
2546     BDRVQcow2State *s = bs->opaque;
2547     uint64_t bytes;
2548     uint64_t host_offset = 0;
2549     unsigned int cur_bytes;
2550     int ret;
2551     QCowL2Meta *meta;
2552 
2553     qemu_co_mutex_lock(&s->lock);
2554 
2555     assert(offset <= new_length);
2556     bytes = new_length - offset;
2557 
2558     while (bytes) {
2559         cur_bytes = MIN(bytes, INT_MAX);
2560         ret = qcow2_alloc_cluster_offset(bs, offset, &cur_bytes,
2561                                          &host_offset, &meta);
2562         if (ret < 0) {
2563             goto done;
2564         }
2565 
2566         while (meta) {
2567             QCowL2Meta *next = meta->next;
2568 
2569             ret = qcow2_alloc_cluster_link_l2(bs, meta);
2570             if (ret < 0) {
2571                 qcow2_free_any_clusters(bs, meta->alloc_offset,
2572                                         meta->nb_clusters, QCOW2_DISCARD_NEVER);
2573                 goto done;
2574             }
2575 
2576             /* There are no dependent requests, but we need to remove our
2577              * request from the list of in-flight requests */
2578             QLIST_REMOVE(meta, next_in_flight);
2579 
2580             g_free(meta);
2581             meta = next;
2582         }
2583 
2584         /* TODO Preallocate data if requested */
2585 
2586         bytes -= cur_bytes;
2587         offset += cur_bytes;
2588     }
2589 
2590     /*
2591      * It is expected that the image file is large enough to actually contain
2592      * all of the allocated clusters (otherwise we get failing reads after
2593      * EOF). Extend the image to the last allocated sector.
2594      */
2595     if (host_offset != 0) {
2596         uint8_t data = 0;
2597         ret = bdrv_pwrite(bs->file, (host_offset + cur_bytes) - 1,
2598                           &data, 1);
2599         if (ret < 0) {
2600             goto done;
2601         }
2602     }
2603 
2604     ret = 0;
2605 
2606 done:
2607     qemu_co_mutex_unlock(&s->lock);
2608     params->ret = ret;
2609 }
2610 
2611 static int preallocate(BlockDriverState *bs,
2612                        uint64_t offset, uint64_t new_length)
2613 {
2614     PreallocCo params = {
2615         .bs         = bs,
2616         .offset     = offset,
2617         .new_length = new_length,
2618         .ret        = -EINPROGRESS,
2619     };
2620 
2621     if (qemu_in_coroutine()) {
2622         preallocate_co(&params);
2623     } else {
2624         Coroutine *co = qemu_coroutine_create(preallocate_co, &params);
2625         bdrv_coroutine_enter(bs, co);
2626         BDRV_POLL_WHILE(bs, params.ret == -EINPROGRESS);
2627     }
2628     return params.ret;
2629 }
2630 
2631 /* qcow2_refcount_metadata_size:
2632  * @clusters: number of clusters to refcount (including data and L1/L2 tables)
2633  * @cluster_size: size of a cluster, in bytes
2634  * @refcount_order: refcount bits power-of-2 exponent
2635  * @generous_increase: allow for the refcount table to be 1.5x as large as it
2636  *                     needs to be
2637  *
2638  * Returns: Number of bytes required for refcount blocks and table metadata.
2639  */
2640 int64_t qcow2_refcount_metadata_size(int64_t clusters, size_t cluster_size,
2641                                      int refcount_order, bool generous_increase,
2642                                      uint64_t *refblock_count)
2643 {
2644     /*
2645      * Every host cluster is reference-counted, including metadata (even
2646      * refcount metadata is recursively included).
2647      *
2648      * An accurate formula for the size of refcount metadata size is difficult
2649      * to derive.  An easier method of calculation is finding the fixed point
2650      * where no further refcount blocks or table clusters are required to
2651      * reference count every cluster.
2652      */
2653     int64_t blocks_per_table_cluster = cluster_size / sizeof(uint64_t);
2654     int64_t refcounts_per_block = cluster_size * 8 / (1 << refcount_order);
2655     int64_t table = 0;  /* number of refcount table clusters */
2656     int64_t blocks = 0; /* number of refcount block clusters */
2657     int64_t last;
2658     int64_t n = 0;
2659 
2660     do {
2661         last = n;
2662         blocks = DIV_ROUND_UP(clusters + table + blocks, refcounts_per_block);
2663         table = DIV_ROUND_UP(blocks, blocks_per_table_cluster);
2664         n = clusters + blocks + table;
2665 
2666         if (n == last && generous_increase) {
2667             clusters += DIV_ROUND_UP(table, 2);
2668             n = 0; /* force another loop */
2669             generous_increase = false;
2670         }
2671     } while (n != last);
2672 
2673     if (refblock_count) {
2674         *refblock_count = blocks;
2675     }
2676 
2677     return (blocks + table) * cluster_size;
2678 }
2679 
2680 /**
2681  * qcow2_calc_prealloc_size:
2682  * @total_size: virtual disk size in bytes
2683  * @cluster_size: cluster size in bytes
2684  * @refcount_order: refcount bits power-of-2 exponent
2685  *
2686  * Returns: Total number of bytes required for the fully allocated image
2687  * (including metadata).
2688  */
2689 static int64_t qcow2_calc_prealloc_size(int64_t total_size,
2690                                         size_t cluster_size,
2691                                         int refcount_order)
2692 {
2693     int64_t meta_size = 0;
2694     uint64_t nl1e, nl2e;
2695     int64_t aligned_total_size = ROUND_UP(total_size, cluster_size);
2696 
2697     /* header: 1 cluster */
2698     meta_size += cluster_size;
2699 
2700     /* total size of L2 tables */
2701     nl2e = aligned_total_size / cluster_size;
2702     nl2e = ROUND_UP(nl2e, cluster_size / sizeof(uint64_t));
2703     meta_size += nl2e * sizeof(uint64_t);
2704 
2705     /* total size of L1 tables */
2706     nl1e = nl2e * sizeof(uint64_t) / cluster_size;
2707     nl1e = ROUND_UP(nl1e, cluster_size / sizeof(uint64_t));
2708     meta_size += nl1e * sizeof(uint64_t);
2709 
2710     /* total size of refcount table and blocks */
2711     meta_size += qcow2_refcount_metadata_size(
2712             (meta_size + aligned_total_size) / cluster_size,
2713             cluster_size, refcount_order, false, NULL);
2714 
2715     return meta_size + aligned_total_size;
2716 }
2717 
2718 static bool validate_cluster_size(size_t cluster_size, Error **errp)
2719 {
2720     int cluster_bits = ctz32(cluster_size);
2721     if (cluster_bits < MIN_CLUSTER_BITS || cluster_bits > MAX_CLUSTER_BITS ||
2722         (1 << cluster_bits) != cluster_size)
2723     {
2724         error_setg(errp, "Cluster size must be a power of two between %d and "
2725                    "%dk", 1 << MIN_CLUSTER_BITS, 1 << (MAX_CLUSTER_BITS - 10));
2726         return false;
2727     }
2728     return true;
2729 }
2730 
2731 static size_t qcow2_opt_get_cluster_size_del(QemuOpts *opts, Error **errp)
2732 {
2733     size_t cluster_size;
2734 
2735     cluster_size = qemu_opt_get_size_del(opts, BLOCK_OPT_CLUSTER_SIZE,
2736                                          DEFAULT_CLUSTER_SIZE);
2737     if (!validate_cluster_size(cluster_size, errp)) {
2738         return 0;
2739     }
2740     return cluster_size;
2741 }
2742 
2743 static int qcow2_opt_get_version_del(QemuOpts *opts, Error **errp)
2744 {
2745     char *buf;
2746     int ret;
2747 
2748     buf = qemu_opt_get_del(opts, BLOCK_OPT_COMPAT_LEVEL);
2749     if (!buf) {
2750         ret = 3; /* default */
2751     } else if (!strcmp(buf, "0.10")) {
2752         ret = 2;
2753     } else if (!strcmp(buf, "1.1")) {
2754         ret = 3;
2755     } else {
2756         error_setg(errp, "Invalid compatibility level: '%s'", buf);
2757         ret = -EINVAL;
2758     }
2759     g_free(buf);
2760     return ret;
2761 }
2762 
2763 static uint64_t qcow2_opt_get_refcount_bits_del(QemuOpts *opts, int version,
2764                                                 Error **errp)
2765 {
2766     uint64_t refcount_bits;
2767 
2768     refcount_bits = qemu_opt_get_number_del(opts, BLOCK_OPT_REFCOUNT_BITS, 16);
2769     if (refcount_bits > 64 || !is_power_of_2(refcount_bits)) {
2770         error_setg(errp, "Refcount width must be a power of two and may not "
2771                    "exceed 64 bits");
2772         return 0;
2773     }
2774 
2775     if (version < 3 && refcount_bits != 16) {
2776         error_setg(errp, "Different refcount widths than 16 bits require "
2777                    "compatibility level 1.1 or above (use compat=1.1 or "
2778                    "greater)");
2779         return 0;
2780     }
2781 
2782     return refcount_bits;
2783 }
2784 
2785 static int coroutine_fn
2786 qcow2_co_create(BlockdevCreateOptions *create_options, Error **errp)
2787 {
2788     BlockdevCreateOptionsQcow2 *qcow2_opts;
2789     QDict *options;
2790 
2791     /*
2792      * Open the image file and write a minimal qcow2 header.
2793      *
2794      * We keep things simple and start with a zero-sized image. We also
2795      * do without refcount blocks or a L1 table for now. We'll fix the
2796      * inconsistency later.
2797      *
2798      * We do need a refcount table because growing the refcount table means
2799      * allocating two new refcount blocks - the seconds of which would be at
2800      * 2 GB for 64k clusters, and we don't want to have a 2 GB initial file
2801      * size for any qcow2 image.
2802      */
2803     BlockBackend *blk = NULL;
2804     BlockDriverState *bs = NULL;
2805     QCowHeader *header;
2806     size_t cluster_size;
2807     int version;
2808     int refcount_order;
2809     uint64_t* refcount_table;
2810     Error *local_err = NULL;
2811     int ret;
2812 
2813     assert(create_options->driver == BLOCKDEV_DRIVER_QCOW2);
2814     qcow2_opts = &create_options->u.qcow2;
2815 
2816     bs = bdrv_open_blockdev_ref(qcow2_opts->file, errp);
2817     if (bs == NULL) {
2818         return -EIO;
2819     }
2820 
2821     /* Validate options and set default values */
2822     if (!QEMU_IS_ALIGNED(qcow2_opts->size, BDRV_SECTOR_SIZE)) {
2823         error_setg(errp, "Image size must be a multiple of 512 bytes");
2824         ret = -EINVAL;
2825         goto out;
2826     }
2827 
2828     if (qcow2_opts->has_version) {
2829         switch (qcow2_opts->version) {
2830         case BLOCKDEV_QCOW2_VERSION_V2:
2831             version = 2;
2832             break;
2833         case BLOCKDEV_QCOW2_VERSION_V3:
2834             version = 3;
2835             break;
2836         default:
2837             g_assert_not_reached();
2838         }
2839     } else {
2840         version = 3;
2841     }
2842 
2843     if (qcow2_opts->has_cluster_size) {
2844         cluster_size = qcow2_opts->cluster_size;
2845     } else {
2846         cluster_size = DEFAULT_CLUSTER_SIZE;
2847     }
2848 
2849     if (!validate_cluster_size(cluster_size, errp)) {
2850         ret = -EINVAL;
2851         goto out;
2852     }
2853 
2854     if (!qcow2_opts->has_preallocation) {
2855         qcow2_opts->preallocation = PREALLOC_MODE_OFF;
2856     }
2857     if (qcow2_opts->has_backing_file &&
2858         qcow2_opts->preallocation != PREALLOC_MODE_OFF)
2859     {
2860         error_setg(errp, "Backing file and preallocation cannot be used at "
2861                    "the same time");
2862         ret = -EINVAL;
2863         goto out;
2864     }
2865     if (qcow2_opts->has_backing_fmt && !qcow2_opts->has_backing_file) {
2866         error_setg(errp, "Backing format cannot be used without backing file");
2867         ret = -EINVAL;
2868         goto out;
2869     }
2870 
2871     if (!qcow2_opts->has_lazy_refcounts) {
2872         qcow2_opts->lazy_refcounts = false;
2873     }
2874     if (version < 3 && qcow2_opts->lazy_refcounts) {
2875         error_setg(errp, "Lazy refcounts only supported with compatibility "
2876                    "level 1.1 and above (use version=v3 or greater)");
2877         ret = -EINVAL;
2878         goto out;
2879     }
2880 
2881     if (!qcow2_opts->has_refcount_bits) {
2882         qcow2_opts->refcount_bits = 16;
2883     }
2884     if (qcow2_opts->refcount_bits > 64 ||
2885         !is_power_of_2(qcow2_opts->refcount_bits))
2886     {
2887         error_setg(errp, "Refcount width must be a power of two and may not "
2888                    "exceed 64 bits");
2889         ret = -EINVAL;
2890         goto out;
2891     }
2892     if (version < 3 && qcow2_opts->refcount_bits != 16) {
2893         error_setg(errp, "Different refcount widths than 16 bits require "
2894                    "compatibility level 1.1 or above (use version=v3 or "
2895                    "greater)");
2896         ret = -EINVAL;
2897         goto out;
2898     }
2899     refcount_order = ctz32(qcow2_opts->refcount_bits);
2900 
2901 
2902     /* Create BlockBackend to write to the image */
2903     blk = blk_new(BLK_PERM_WRITE | BLK_PERM_RESIZE, BLK_PERM_ALL);
2904     ret = blk_insert_bs(blk, bs, errp);
2905     if (ret < 0) {
2906         goto out;
2907     }
2908     blk_set_allow_write_beyond_eof(blk, true);
2909 
2910     /* Clear the protocol layer and preallocate it if necessary */
2911     ret = blk_truncate(blk, 0, PREALLOC_MODE_OFF, errp);
2912     if (ret < 0) {
2913         goto out;
2914     }
2915 
2916     if (qcow2_opts->preallocation == PREALLOC_MODE_FULL ||
2917         qcow2_opts->preallocation == PREALLOC_MODE_FALLOC)
2918     {
2919         int64_t prealloc_size =
2920             qcow2_calc_prealloc_size(qcow2_opts->size, cluster_size,
2921                                      refcount_order);
2922 
2923         ret = blk_truncate(blk, prealloc_size, qcow2_opts->preallocation, errp);
2924         if (ret < 0) {
2925             goto out;
2926         }
2927     }
2928 
2929     /* Write the header */
2930     QEMU_BUILD_BUG_ON((1 << MIN_CLUSTER_BITS) < sizeof(*header));
2931     header = g_malloc0(cluster_size);
2932     *header = (QCowHeader) {
2933         .magic                      = cpu_to_be32(QCOW_MAGIC),
2934         .version                    = cpu_to_be32(version),
2935         .cluster_bits               = cpu_to_be32(ctz32(cluster_size)),
2936         .size                       = cpu_to_be64(0),
2937         .l1_table_offset            = cpu_to_be64(0),
2938         .l1_size                    = cpu_to_be32(0),
2939         .refcount_table_offset      = cpu_to_be64(cluster_size),
2940         .refcount_table_clusters    = cpu_to_be32(1),
2941         .refcount_order             = cpu_to_be32(refcount_order),
2942         .header_length              = cpu_to_be32(sizeof(*header)),
2943     };
2944 
2945     /* We'll update this to correct value later */
2946     header->crypt_method = cpu_to_be32(QCOW_CRYPT_NONE);
2947 
2948     if (qcow2_opts->lazy_refcounts) {
2949         header->compatible_features |=
2950             cpu_to_be64(QCOW2_COMPAT_LAZY_REFCOUNTS);
2951     }
2952 
2953     ret = blk_pwrite(blk, 0, header, cluster_size, 0);
2954     g_free(header);
2955     if (ret < 0) {
2956         error_setg_errno(errp, -ret, "Could not write qcow2 header");
2957         goto out;
2958     }
2959 
2960     /* Write a refcount table with one refcount block */
2961     refcount_table = g_malloc0(2 * cluster_size);
2962     refcount_table[0] = cpu_to_be64(2 * cluster_size);
2963     ret = blk_pwrite(blk, cluster_size, refcount_table, 2 * cluster_size, 0);
2964     g_free(refcount_table);
2965 
2966     if (ret < 0) {
2967         error_setg_errno(errp, -ret, "Could not write refcount table");
2968         goto out;
2969     }
2970 
2971     blk_unref(blk);
2972     blk = NULL;
2973 
2974     /*
2975      * And now open the image and make it consistent first (i.e. increase the
2976      * refcount of the cluster that is occupied by the header and the refcount
2977      * table)
2978      */
2979     options = qdict_new();
2980     qdict_put_str(options, "driver", "qcow2");
2981     qdict_put_str(options, "file", bs->node_name);
2982     blk = blk_new_open(NULL, NULL, options,
2983                        BDRV_O_RDWR | BDRV_O_RESIZE | BDRV_O_NO_FLUSH,
2984                        &local_err);
2985     if (blk == NULL) {
2986         error_propagate(errp, local_err);
2987         ret = -EIO;
2988         goto out;
2989     }
2990 
2991     ret = qcow2_alloc_clusters(blk_bs(blk), 3 * cluster_size);
2992     if (ret < 0) {
2993         error_setg_errno(errp, -ret, "Could not allocate clusters for qcow2 "
2994                          "header and refcount table");
2995         goto out;
2996 
2997     } else if (ret != 0) {
2998         error_report("Huh, first cluster in empty image is already in use?");
2999         abort();
3000     }
3001 
3002     /* Create a full header (including things like feature table) */
3003     ret = qcow2_update_header(blk_bs(blk));
3004     if (ret < 0) {
3005         error_setg_errno(errp, -ret, "Could not update qcow2 header");
3006         goto out;
3007     }
3008 
3009     /* Okay, now that we have a valid image, let's give it the right size */
3010     ret = blk_truncate(blk, qcow2_opts->size, PREALLOC_MODE_OFF, errp);
3011     if (ret < 0) {
3012         error_prepend(errp, "Could not resize image: ");
3013         goto out;
3014     }
3015 
3016     /* Want a backing file? There you go.*/
3017     if (qcow2_opts->has_backing_file) {
3018         const char *backing_format = NULL;
3019 
3020         if (qcow2_opts->has_backing_fmt) {
3021             backing_format = BlockdevDriver_str(qcow2_opts->backing_fmt);
3022         }
3023 
3024         ret = bdrv_change_backing_file(blk_bs(blk), qcow2_opts->backing_file,
3025                                        backing_format);
3026         if (ret < 0) {
3027             error_setg_errno(errp, -ret, "Could not assign backing file '%s' "
3028                              "with format '%s'", qcow2_opts->backing_file,
3029                              backing_format);
3030             goto out;
3031         }
3032     }
3033 
3034     /* Want encryption? There you go. */
3035     if (qcow2_opts->has_encrypt) {
3036         ret = qcow2_set_up_encryption(blk_bs(blk), qcow2_opts->encrypt, errp);
3037         if (ret < 0) {
3038             goto out;
3039         }
3040     }
3041 
3042     /* And if we're supposed to preallocate metadata, do that now */
3043     if (qcow2_opts->preallocation != PREALLOC_MODE_OFF) {
3044         ret = preallocate(blk_bs(blk), 0, qcow2_opts->size);
3045         if (ret < 0) {
3046             error_setg_errno(errp, -ret, "Could not preallocate metadata");
3047             goto out;
3048         }
3049     }
3050 
3051     blk_unref(blk);
3052     blk = NULL;
3053 
3054     /* Reopen the image without BDRV_O_NO_FLUSH to flush it before returning.
3055      * Using BDRV_O_NO_IO, since encryption is now setup we don't want to
3056      * have to setup decryption context. We're not doing any I/O on the top
3057      * level BlockDriverState, only lower layers, where BDRV_O_NO_IO does
3058      * not have effect.
3059      */
3060     options = qdict_new();
3061     qdict_put_str(options, "driver", "qcow2");
3062     qdict_put_str(options, "file", bs->node_name);
3063     blk = blk_new_open(NULL, NULL, options,
3064                        BDRV_O_RDWR | BDRV_O_NO_BACKING | BDRV_O_NO_IO,
3065                        &local_err);
3066     if (blk == NULL) {
3067         error_propagate(errp, local_err);
3068         ret = -EIO;
3069         goto out;
3070     }
3071 
3072     ret = 0;
3073 out:
3074     blk_unref(blk);
3075     bdrv_unref(bs);
3076     return ret;
3077 }
3078 
3079 static int coroutine_fn qcow2_co_create_opts(const char *filename, QemuOpts *opts,
3080                                              Error **errp)
3081 {
3082     BlockdevCreateOptions *create_options = NULL;
3083     QDict *qdict;
3084     Visitor *v;
3085     BlockDriverState *bs = NULL;
3086     Error *local_err = NULL;
3087     const char *val;
3088     int ret;
3089 
3090     /* Only the keyval visitor supports the dotted syntax needed for
3091      * encryption, so go through a QDict before getting a QAPI type. Ignore
3092      * options meant for the protocol layer so that the visitor doesn't
3093      * complain. */
3094     qdict = qemu_opts_to_qdict_filtered(opts, NULL, bdrv_qcow2.create_opts,
3095                                         true);
3096 
3097     /* Handle encryption options */
3098     val = qdict_get_try_str(qdict, BLOCK_OPT_ENCRYPT);
3099     if (val && !strcmp(val, "on")) {
3100         qdict_put_str(qdict, BLOCK_OPT_ENCRYPT, "qcow");
3101     } else if (val && !strcmp(val, "off")) {
3102         qdict_del(qdict, BLOCK_OPT_ENCRYPT);
3103     }
3104 
3105     val = qdict_get_try_str(qdict, BLOCK_OPT_ENCRYPT_FORMAT);
3106     if (val && !strcmp(val, "aes")) {
3107         qdict_put_str(qdict, BLOCK_OPT_ENCRYPT_FORMAT, "qcow");
3108     }
3109 
3110     /* Convert compat=0.10/1.1 into compat=v2/v3, to be renamed into
3111      * version=v2/v3 below. */
3112     val = qdict_get_try_str(qdict, BLOCK_OPT_COMPAT_LEVEL);
3113     if (val && !strcmp(val, "0.10")) {
3114         qdict_put_str(qdict, BLOCK_OPT_COMPAT_LEVEL, "v2");
3115     } else if (val && !strcmp(val, "1.1")) {
3116         qdict_put_str(qdict, BLOCK_OPT_COMPAT_LEVEL, "v3");
3117     }
3118 
3119     /* Change legacy command line options into QMP ones */
3120     static const QDictRenames opt_renames[] = {
3121         { BLOCK_OPT_BACKING_FILE,       "backing-file" },
3122         { BLOCK_OPT_BACKING_FMT,        "backing-fmt" },
3123         { BLOCK_OPT_CLUSTER_SIZE,       "cluster-size" },
3124         { BLOCK_OPT_LAZY_REFCOUNTS,     "lazy-refcounts" },
3125         { BLOCK_OPT_REFCOUNT_BITS,      "refcount-bits" },
3126         { BLOCK_OPT_ENCRYPT,            BLOCK_OPT_ENCRYPT_FORMAT },
3127         { BLOCK_OPT_COMPAT_LEVEL,       "version" },
3128         { NULL, NULL },
3129     };
3130 
3131     if (!qdict_rename_keys(qdict, opt_renames, errp)) {
3132         ret = -EINVAL;
3133         goto finish;
3134     }
3135 
3136     /* Create and open the file (protocol layer) */
3137     ret = bdrv_create_file(filename, opts, errp);
3138     if (ret < 0) {
3139         goto finish;
3140     }
3141 
3142     bs = bdrv_open(filename, NULL, NULL,
3143                    BDRV_O_RDWR | BDRV_O_RESIZE | BDRV_O_PROTOCOL, errp);
3144     if (bs == NULL) {
3145         ret = -EIO;
3146         goto finish;
3147     }
3148 
3149     /* Set 'driver' and 'node' options */
3150     qdict_put_str(qdict, "driver", "qcow2");
3151     qdict_put_str(qdict, "file", bs->node_name);
3152 
3153     /* Now get the QAPI type BlockdevCreateOptions */
3154     v = qobject_input_visitor_new_flat_confused(qdict, errp);
3155     if (!v) {
3156         ret = -EINVAL;
3157         goto finish;
3158     }
3159 
3160     visit_type_BlockdevCreateOptions(v, NULL, &create_options, &local_err);
3161     visit_free(v);
3162 
3163     if (local_err) {
3164         error_propagate(errp, local_err);
3165         ret = -EINVAL;
3166         goto finish;
3167     }
3168 
3169     /* Silently round up size */
3170     create_options->u.qcow2.size = ROUND_UP(create_options->u.qcow2.size,
3171                                             BDRV_SECTOR_SIZE);
3172 
3173     /* Create the qcow2 image (format layer) */
3174     ret = qcow2_co_create(create_options, errp);
3175     if (ret < 0) {
3176         goto finish;
3177     }
3178 
3179     ret = 0;
3180 finish:
3181     qobject_unref(qdict);
3182     bdrv_unref(bs);
3183     qapi_free_BlockdevCreateOptions(create_options);
3184     return ret;
3185 }
3186 
3187 
3188 static bool is_zero(BlockDriverState *bs, int64_t offset, int64_t bytes)
3189 {
3190     int64_t nr;
3191     int res;
3192 
3193     /* Clamp to image length, before checking status of underlying sectors */
3194     if (offset + bytes > bs->total_sectors * BDRV_SECTOR_SIZE) {
3195         bytes = bs->total_sectors * BDRV_SECTOR_SIZE - offset;
3196     }
3197 
3198     if (!bytes) {
3199         return true;
3200     }
3201     res = bdrv_block_status_above(bs, NULL, offset, bytes, &nr, NULL, NULL);
3202     return res >= 0 && (res & BDRV_BLOCK_ZERO) && nr == bytes;
3203 }
3204 
3205 static coroutine_fn int qcow2_co_pwrite_zeroes(BlockDriverState *bs,
3206     int64_t offset, int bytes, BdrvRequestFlags flags)
3207 {
3208     int ret;
3209     BDRVQcow2State *s = bs->opaque;
3210 
3211     uint32_t head = offset % s->cluster_size;
3212     uint32_t tail = (offset + bytes) % s->cluster_size;
3213 
3214     trace_qcow2_pwrite_zeroes_start_req(qemu_coroutine_self(), offset, bytes);
3215     if (offset + bytes == bs->total_sectors * BDRV_SECTOR_SIZE) {
3216         tail = 0;
3217     }
3218 
3219     if (head || tail) {
3220         uint64_t off;
3221         unsigned int nr;
3222 
3223         assert(head + bytes <= s->cluster_size);
3224 
3225         /* check whether remainder of cluster already reads as zero */
3226         if (!(is_zero(bs, offset - head, head) &&
3227               is_zero(bs, offset + bytes,
3228                       tail ? s->cluster_size - tail : 0))) {
3229             return -ENOTSUP;
3230         }
3231 
3232         qemu_co_mutex_lock(&s->lock);
3233         /* We can have new write after previous check */
3234         offset = QEMU_ALIGN_DOWN(offset, s->cluster_size);
3235         bytes = s->cluster_size;
3236         nr = s->cluster_size;
3237         ret = qcow2_get_cluster_offset(bs, offset, &nr, &off);
3238         if (ret != QCOW2_CLUSTER_UNALLOCATED &&
3239             ret != QCOW2_CLUSTER_ZERO_PLAIN &&
3240             ret != QCOW2_CLUSTER_ZERO_ALLOC) {
3241             qemu_co_mutex_unlock(&s->lock);
3242             return -ENOTSUP;
3243         }
3244     } else {
3245         qemu_co_mutex_lock(&s->lock);
3246     }
3247 
3248     trace_qcow2_pwrite_zeroes(qemu_coroutine_self(), offset, bytes);
3249 
3250     /* Whatever is left can use real zero clusters */
3251     ret = qcow2_cluster_zeroize(bs, offset, bytes, flags);
3252     qemu_co_mutex_unlock(&s->lock);
3253 
3254     return ret;
3255 }
3256 
3257 static coroutine_fn int qcow2_co_pdiscard(BlockDriverState *bs,
3258                                           int64_t offset, int bytes)
3259 {
3260     int ret;
3261     BDRVQcow2State *s = bs->opaque;
3262 
3263     if (!QEMU_IS_ALIGNED(offset | bytes, s->cluster_size)) {
3264         assert(bytes < s->cluster_size);
3265         /* Ignore partial clusters, except for the special case of the
3266          * complete partial cluster at the end of an unaligned file */
3267         if (!QEMU_IS_ALIGNED(offset, s->cluster_size) ||
3268             offset + bytes != bs->total_sectors * BDRV_SECTOR_SIZE) {
3269             return -ENOTSUP;
3270         }
3271     }
3272 
3273     qemu_co_mutex_lock(&s->lock);
3274     ret = qcow2_cluster_discard(bs, offset, bytes, QCOW2_DISCARD_REQUEST,
3275                                 false);
3276     qemu_co_mutex_unlock(&s->lock);
3277     return ret;
3278 }
3279 
3280 static int coroutine_fn
3281 qcow2_co_copy_range_from(BlockDriverState *bs,
3282                          BdrvChild *src, uint64_t src_offset,
3283                          BdrvChild *dst, uint64_t dst_offset,
3284                          uint64_t bytes, BdrvRequestFlags flags)
3285 {
3286     BDRVQcow2State *s = bs->opaque;
3287     int ret;
3288     unsigned int cur_bytes; /* number of bytes in current iteration */
3289     BdrvChild *child = NULL;
3290     BdrvRequestFlags cur_flags;
3291 
3292     assert(!bs->encrypted);
3293     qemu_co_mutex_lock(&s->lock);
3294 
3295     while (bytes != 0) {
3296         uint64_t copy_offset = 0;
3297         /* prepare next request */
3298         cur_bytes = MIN(bytes, INT_MAX);
3299         cur_flags = flags;
3300 
3301         ret = qcow2_get_cluster_offset(bs, src_offset, &cur_bytes, &copy_offset);
3302         if (ret < 0) {
3303             goto out;
3304         }
3305 
3306         switch (ret) {
3307         case QCOW2_CLUSTER_UNALLOCATED:
3308             if (bs->backing && bs->backing->bs) {
3309                 int64_t backing_length = bdrv_getlength(bs->backing->bs);
3310                 if (src_offset >= backing_length) {
3311                     cur_flags |= BDRV_REQ_ZERO_WRITE;
3312                 } else {
3313                     child = bs->backing;
3314                     cur_bytes = MIN(cur_bytes, backing_length - src_offset);
3315                     copy_offset = src_offset;
3316                 }
3317             } else {
3318                 cur_flags |= BDRV_REQ_ZERO_WRITE;
3319             }
3320             break;
3321 
3322         case QCOW2_CLUSTER_ZERO_PLAIN:
3323         case QCOW2_CLUSTER_ZERO_ALLOC:
3324             cur_flags |= BDRV_REQ_ZERO_WRITE;
3325             break;
3326 
3327         case QCOW2_CLUSTER_COMPRESSED:
3328             ret = -ENOTSUP;
3329             goto out;
3330             break;
3331 
3332         case QCOW2_CLUSTER_NORMAL:
3333             child = bs->file;
3334             copy_offset += offset_into_cluster(s, src_offset);
3335             if ((copy_offset & 511) != 0) {
3336                 ret = -EIO;
3337                 goto out;
3338             }
3339             break;
3340 
3341         default:
3342             abort();
3343         }
3344         qemu_co_mutex_unlock(&s->lock);
3345         ret = bdrv_co_copy_range_from(child,
3346                                       copy_offset,
3347                                       dst, dst_offset,
3348                                       cur_bytes, cur_flags);
3349         qemu_co_mutex_lock(&s->lock);
3350         if (ret < 0) {
3351             goto out;
3352         }
3353 
3354         bytes -= cur_bytes;
3355         src_offset += cur_bytes;
3356         dst_offset += cur_bytes;
3357     }
3358     ret = 0;
3359 
3360 out:
3361     qemu_co_mutex_unlock(&s->lock);
3362     return ret;
3363 }
3364 
3365 static int coroutine_fn
3366 qcow2_co_copy_range_to(BlockDriverState *bs,
3367                        BdrvChild *src, uint64_t src_offset,
3368                        BdrvChild *dst, uint64_t dst_offset,
3369                        uint64_t bytes, BdrvRequestFlags flags)
3370 {
3371     BDRVQcow2State *s = bs->opaque;
3372     int offset_in_cluster;
3373     int ret;
3374     unsigned int cur_bytes; /* number of sectors in current iteration */
3375     uint64_t cluster_offset;
3376     uint8_t *cluster_data = NULL;
3377     QCowL2Meta *l2meta = NULL;
3378 
3379     assert(!bs->encrypted);
3380     s->cluster_cache_offset = -1; /* disable compressed cache */
3381 
3382     qemu_co_mutex_lock(&s->lock);
3383 
3384     while (bytes != 0) {
3385 
3386         l2meta = NULL;
3387 
3388         offset_in_cluster = offset_into_cluster(s, dst_offset);
3389         cur_bytes = MIN(bytes, INT_MAX);
3390 
3391         /* TODO:
3392          * If src->bs == dst->bs, we could simply copy by incrementing
3393          * the refcnt, without copying user data.
3394          * Or if src->bs == dst->bs->backing->bs, we could copy by discarding. */
3395         ret = qcow2_alloc_cluster_offset(bs, dst_offset, &cur_bytes,
3396                                          &cluster_offset, &l2meta);
3397         if (ret < 0) {
3398             goto fail;
3399         }
3400 
3401         assert((cluster_offset & 511) == 0);
3402 
3403         ret = qcow2_pre_write_overlap_check(bs, 0,
3404                 cluster_offset + offset_in_cluster, cur_bytes);
3405         if (ret < 0) {
3406             goto fail;
3407         }
3408 
3409         qemu_co_mutex_unlock(&s->lock);
3410         ret = bdrv_co_copy_range_to(src, src_offset,
3411                                     bs->file,
3412                                     cluster_offset + offset_in_cluster,
3413                                     cur_bytes, flags);
3414         qemu_co_mutex_lock(&s->lock);
3415         if (ret < 0) {
3416             goto fail;
3417         }
3418 
3419         ret = qcow2_handle_l2meta(bs, &l2meta, true);
3420         if (ret) {
3421             goto fail;
3422         }
3423 
3424         bytes -= cur_bytes;
3425         dst_offset += cur_bytes;
3426     }
3427     ret = 0;
3428 
3429 fail:
3430     qcow2_handle_l2meta(bs, &l2meta, false);
3431 
3432     qemu_co_mutex_unlock(&s->lock);
3433 
3434     qemu_vfree(cluster_data);
3435     trace_qcow2_writev_done_req(qemu_coroutine_self(), ret);
3436 
3437     return ret;
3438 }
3439 
3440 static int qcow2_truncate(BlockDriverState *bs, int64_t offset,
3441                           PreallocMode prealloc, Error **errp)
3442 {
3443     BDRVQcow2State *s = bs->opaque;
3444     uint64_t old_length;
3445     int64_t new_l1_size;
3446     int ret;
3447 
3448     if (prealloc != PREALLOC_MODE_OFF && prealloc != PREALLOC_MODE_METADATA &&
3449         prealloc != PREALLOC_MODE_FALLOC && prealloc != PREALLOC_MODE_FULL)
3450     {
3451         error_setg(errp, "Unsupported preallocation mode '%s'",
3452                    PreallocMode_str(prealloc));
3453         return -ENOTSUP;
3454     }
3455 
3456     if (offset & 511) {
3457         error_setg(errp, "The new size must be a multiple of 512");
3458         return -EINVAL;
3459     }
3460 
3461     /* cannot proceed if image has snapshots */
3462     if (s->nb_snapshots) {
3463         error_setg(errp, "Can't resize an image which has snapshots");
3464         return -ENOTSUP;
3465     }
3466 
3467     /* cannot proceed if image has bitmaps */
3468     if (s->nb_bitmaps) {
3469         /* TODO: resize bitmaps in the image */
3470         error_setg(errp, "Can't resize an image which has bitmaps");
3471         return -ENOTSUP;
3472     }
3473 
3474     old_length = bs->total_sectors * 512;
3475     new_l1_size = size_to_l1(s, offset);
3476 
3477     if (offset < old_length) {
3478         int64_t last_cluster, old_file_size;
3479         if (prealloc != PREALLOC_MODE_OFF) {
3480             error_setg(errp,
3481                        "Preallocation can't be used for shrinking an image");
3482             return -EINVAL;
3483         }
3484 
3485         ret = qcow2_cluster_discard(bs, ROUND_UP(offset, s->cluster_size),
3486                                     old_length - ROUND_UP(offset,
3487                                                           s->cluster_size),
3488                                     QCOW2_DISCARD_ALWAYS, true);
3489         if (ret < 0) {
3490             error_setg_errno(errp, -ret, "Failed to discard cropped clusters");
3491             return ret;
3492         }
3493 
3494         ret = qcow2_shrink_l1_table(bs, new_l1_size);
3495         if (ret < 0) {
3496             error_setg_errno(errp, -ret,
3497                              "Failed to reduce the number of L2 tables");
3498             return ret;
3499         }
3500 
3501         ret = qcow2_shrink_reftable(bs);
3502         if (ret < 0) {
3503             error_setg_errno(errp, -ret,
3504                              "Failed to discard unused refblocks");
3505             return ret;
3506         }
3507 
3508         old_file_size = bdrv_getlength(bs->file->bs);
3509         if (old_file_size < 0) {
3510             error_setg_errno(errp, -old_file_size,
3511                              "Failed to inquire current file length");
3512             return old_file_size;
3513         }
3514         last_cluster = qcow2_get_last_cluster(bs, old_file_size);
3515         if (last_cluster < 0) {
3516             error_setg_errno(errp, -last_cluster,
3517                              "Failed to find the last cluster");
3518             return last_cluster;
3519         }
3520         if ((last_cluster + 1) * s->cluster_size < old_file_size) {
3521             Error *local_err = NULL;
3522 
3523             bdrv_truncate(bs->file, (last_cluster + 1) * s->cluster_size,
3524                           PREALLOC_MODE_OFF, &local_err);
3525             if (local_err) {
3526                 warn_reportf_err(local_err,
3527                                  "Failed to truncate the tail of the image: ");
3528             }
3529         }
3530     } else {
3531         ret = qcow2_grow_l1_table(bs, new_l1_size, true);
3532         if (ret < 0) {
3533             error_setg_errno(errp, -ret, "Failed to grow the L1 table");
3534             return ret;
3535         }
3536     }
3537 
3538     switch (prealloc) {
3539     case PREALLOC_MODE_OFF:
3540         break;
3541 
3542     case PREALLOC_MODE_METADATA:
3543         ret = preallocate(bs, old_length, offset);
3544         if (ret < 0) {
3545             error_setg_errno(errp, -ret, "Preallocation failed");
3546             return ret;
3547         }
3548         break;
3549 
3550     case PREALLOC_MODE_FALLOC:
3551     case PREALLOC_MODE_FULL:
3552     {
3553         int64_t allocation_start, host_offset, guest_offset;
3554         int64_t clusters_allocated;
3555         int64_t old_file_size, new_file_size;
3556         uint64_t nb_new_data_clusters, nb_new_l2_tables;
3557 
3558         old_file_size = bdrv_getlength(bs->file->bs);
3559         if (old_file_size < 0) {
3560             error_setg_errno(errp, -old_file_size,
3561                              "Failed to inquire current file length");
3562             return old_file_size;
3563         }
3564         old_file_size = ROUND_UP(old_file_size, s->cluster_size);
3565 
3566         nb_new_data_clusters = DIV_ROUND_UP(offset - old_length,
3567                                             s->cluster_size);
3568 
3569         /* This is an overestimation; we will not actually allocate space for
3570          * these in the file but just make sure the new refcount structures are
3571          * able to cover them so we will not have to allocate new refblocks
3572          * while entering the data blocks in the potentially new L2 tables.
3573          * (We do not actually care where the L2 tables are placed. Maybe they
3574          *  are already allocated or they can be placed somewhere before
3575          *  @old_file_size. It does not matter because they will be fully
3576          *  allocated automatically, so they do not need to be covered by the
3577          *  preallocation. All that matters is that we will not have to allocate
3578          *  new refcount structures for them.) */
3579         nb_new_l2_tables = DIV_ROUND_UP(nb_new_data_clusters,
3580                                         s->cluster_size / sizeof(uint64_t));
3581         /* The cluster range may not be aligned to L2 boundaries, so add one L2
3582          * table for a potential head/tail */
3583         nb_new_l2_tables++;
3584 
3585         allocation_start = qcow2_refcount_area(bs, old_file_size,
3586                                                nb_new_data_clusters +
3587                                                nb_new_l2_tables,
3588                                                true, 0, 0);
3589         if (allocation_start < 0) {
3590             error_setg_errno(errp, -allocation_start,
3591                              "Failed to resize refcount structures");
3592             return allocation_start;
3593         }
3594 
3595         clusters_allocated = qcow2_alloc_clusters_at(bs, allocation_start,
3596                                                      nb_new_data_clusters);
3597         if (clusters_allocated < 0) {
3598             error_setg_errno(errp, -clusters_allocated,
3599                              "Failed to allocate data clusters");
3600             return -clusters_allocated;
3601         }
3602 
3603         assert(clusters_allocated == nb_new_data_clusters);
3604 
3605         /* Allocate the data area */
3606         new_file_size = allocation_start +
3607                         nb_new_data_clusters * s->cluster_size;
3608         ret = bdrv_truncate(bs->file, new_file_size, prealloc, errp);
3609         if (ret < 0) {
3610             error_prepend(errp, "Failed to resize underlying file: ");
3611             qcow2_free_clusters(bs, allocation_start,
3612                                 nb_new_data_clusters * s->cluster_size,
3613                                 QCOW2_DISCARD_OTHER);
3614             return ret;
3615         }
3616 
3617         /* Create the necessary L2 entries */
3618         host_offset = allocation_start;
3619         guest_offset = old_length;
3620         while (nb_new_data_clusters) {
3621             int64_t nb_clusters = MIN(
3622                 nb_new_data_clusters,
3623                 s->l2_slice_size - offset_to_l2_slice_index(s, guest_offset));
3624             QCowL2Meta allocation = {
3625                 .offset       = guest_offset,
3626                 .alloc_offset = host_offset,
3627                 .nb_clusters  = nb_clusters,
3628             };
3629             qemu_co_queue_init(&allocation.dependent_requests);
3630 
3631             ret = qcow2_alloc_cluster_link_l2(bs, &allocation);
3632             if (ret < 0) {
3633                 error_setg_errno(errp, -ret, "Failed to update L2 tables");
3634                 qcow2_free_clusters(bs, host_offset,
3635                                     nb_new_data_clusters * s->cluster_size,
3636                                     QCOW2_DISCARD_OTHER);
3637                 return ret;
3638             }
3639 
3640             guest_offset += nb_clusters * s->cluster_size;
3641             host_offset += nb_clusters * s->cluster_size;
3642             nb_new_data_clusters -= nb_clusters;
3643         }
3644         break;
3645     }
3646 
3647     default:
3648         g_assert_not_reached();
3649     }
3650 
3651     if (prealloc != PREALLOC_MODE_OFF) {
3652         /* Flush metadata before actually changing the image size */
3653         ret = bdrv_flush(bs);
3654         if (ret < 0) {
3655             error_setg_errno(errp, -ret,
3656                              "Failed to flush the preallocated area to disk");
3657             return ret;
3658         }
3659     }
3660 
3661     /* write updated header.size */
3662     offset = cpu_to_be64(offset);
3663     ret = bdrv_pwrite_sync(bs->file, offsetof(QCowHeader, size),
3664                            &offset, sizeof(uint64_t));
3665     if (ret < 0) {
3666         error_setg_errno(errp, -ret, "Failed to update the image size");
3667         return ret;
3668     }
3669 
3670     s->l1_vm_state_index = new_l1_size;
3671     return 0;
3672 }
3673 
3674 /* XXX: put compressed sectors first, then all the cluster aligned
3675    tables to avoid losing bytes in alignment */
3676 static coroutine_fn int
3677 qcow2_co_pwritev_compressed(BlockDriverState *bs, uint64_t offset,
3678                             uint64_t bytes, QEMUIOVector *qiov)
3679 {
3680     BDRVQcow2State *s = bs->opaque;
3681     QEMUIOVector hd_qiov;
3682     struct iovec iov;
3683     z_stream strm;
3684     int ret, out_len;
3685     uint8_t *buf, *out_buf;
3686     int64_t cluster_offset;
3687 
3688     if (bytes == 0) {
3689         /* align end of file to a sector boundary to ease reading with
3690            sector based I/Os */
3691         cluster_offset = bdrv_getlength(bs->file->bs);
3692         if (cluster_offset < 0) {
3693             return cluster_offset;
3694         }
3695         return bdrv_truncate(bs->file, cluster_offset, PREALLOC_MODE_OFF, NULL);
3696     }
3697 
3698     if (offset_into_cluster(s, offset)) {
3699         return -EINVAL;
3700     }
3701 
3702     buf = qemu_blockalign(bs, s->cluster_size);
3703     if (bytes != s->cluster_size) {
3704         if (bytes > s->cluster_size ||
3705             offset + bytes != bs->total_sectors << BDRV_SECTOR_BITS)
3706         {
3707             qemu_vfree(buf);
3708             return -EINVAL;
3709         }
3710         /* Zero-pad last write if image size is not cluster aligned */
3711         memset(buf + bytes, 0, s->cluster_size - bytes);
3712     }
3713     qemu_iovec_to_buf(qiov, 0, buf, bytes);
3714 
3715     out_buf = g_malloc(s->cluster_size);
3716 
3717     /* best compression, small window, no zlib header */
3718     memset(&strm, 0, sizeof(strm));
3719     ret = deflateInit2(&strm, Z_DEFAULT_COMPRESSION,
3720                        Z_DEFLATED, -12,
3721                        9, Z_DEFAULT_STRATEGY);
3722     if (ret != 0) {
3723         ret = -EINVAL;
3724         goto fail;
3725     }
3726 
3727     strm.avail_in = s->cluster_size;
3728     strm.next_in = (uint8_t *)buf;
3729     strm.avail_out = s->cluster_size;
3730     strm.next_out = out_buf;
3731 
3732     ret = deflate(&strm, Z_FINISH);
3733     if (ret != Z_STREAM_END && ret != Z_OK) {
3734         deflateEnd(&strm);
3735         ret = -EINVAL;
3736         goto fail;
3737     }
3738     out_len = strm.next_out - out_buf;
3739 
3740     deflateEnd(&strm);
3741 
3742     if (ret != Z_STREAM_END || out_len >= s->cluster_size) {
3743         /* could not compress: write normal cluster */
3744         ret = qcow2_co_pwritev(bs, offset, bytes, qiov, 0);
3745         if (ret < 0) {
3746             goto fail;
3747         }
3748         goto success;
3749     }
3750 
3751     qemu_co_mutex_lock(&s->lock);
3752     cluster_offset =
3753         qcow2_alloc_compressed_cluster_offset(bs, offset, out_len);
3754     if (!cluster_offset) {
3755         qemu_co_mutex_unlock(&s->lock);
3756         ret = -EIO;
3757         goto fail;
3758     }
3759     cluster_offset &= s->cluster_offset_mask;
3760 
3761     ret = qcow2_pre_write_overlap_check(bs, 0, cluster_offset, out_len);
3762     qemu_co_mutex_unlock(&s->lock);
3763     if (ret < 0) {
3764         goto fail;
3765     }
3766 
3767     iov = (struct iovec) {
3768         .iov_base   = out_buf,
3769         .iov_len    = out_len,
3770     };
3771     qemu_iovec_init_external(&hd_qiov, &iov, 1);
3772 
3773     BLKDBG_EVENT(bs->file, BLKDBG_WRITE_COMPRESSED);
3774     ret = bdrv_co_pwritev(bs->file, cluster_offset, out_len, &hd_qiov, 0);
3775     if (ret < 0) {
3776         goto fail;
3777     }
3778 success:
3779     ret = 0;
3780 fail:
3781     qemu_vfree(buf);
3782     g_free(out_buf);
3783     return ret;
3784 }
3785 
3786 static int make_completely_empty(BlockDriverState *bs)
3787 {
3788     BDRVQcow2State *s = bs->opaque;
3789     Error *local_err = NULL;
3790     int ret, l1_clusters;
3791     int64_t offset;
3792     uint64_t *new_reftable = NULL;
3793     uint64_t rt_entry, l1_size2;
3794     struct {
3795         uint64_t l1_offset;
3796         uint64_t reftable_offset;
3797         uint32_t reftable_clusters;
3798     } QEMU_PACKED l1_ofs_rt_ofs_cls;
3799 
3800     ret = qcow2_cache_empty(bs, s->l2_table_cache);
3801     if (ret < 0) {
3802         goto fail;
3803     }
3804 
3805     ret = qcow2_cache_empty(bs, s->refcount_block_cache);
3806     if (ret < 0) {
3807         goto fail;
3808     }
3809 
3810     /* Refcounts will be broken utterly */
3811     ret = qcow2_mark_dirty(bs);
3812     if (ret < 0) {
3813         goto fail;
3814     }
3815 
3816     BLKDBG_EVENT(bs->file, BLKDBG_L1_UPDATE);
3817 
3818     l1_clusters = DIV_ROUND_UP(s->l1_size, s->cluster_size / sizeof(uint64_t));
3819     l1_size2 = (uint64_t)s->l1_size * sizeof(uint64_t);
3820 
3821     /* After this call, neither the in-memory nor the on-disk refcount
3822      * information accurately describe the actual references */
3823 
3824     ret = bdrv_pwrite_zeroes(bs->file, s->l1_table_offset,
3825                              l1_clusters * s->cluster_size, 0);
3826     if (ret < 0) {
3827         goto fail_broken_refcounts;
3828     }
3829     memset(s->l1_table, 0, l1_size2);
3830 
3831     BLKDBG_EVENT(bs->file, BLKDBG_EMPTY_IMAGE_PREPARE);
3832 
3833     /* Overwrite enough clusters at the beginning of the sectors to place
3834      * the refcount table, a refcount block and the L1 table in; this may
3835      * overwrite parts of the existing refcount and L1 table, which is not
3836      * an issue because the dirty flag is set, complete data loss is in fact
3837      * desired and partial data loss is consequently fine as well */
3838     ret = bdrv_pwrite_zeroes(bs->file, s->cluster_size,
3839                              (2 + l1_clusters) * s->cluster_size, 0);
3840     /* This call (even if it failed overall) may have overwritten on-disk
3841      * refcount structures; in that case, the in-memory refcount information
3842      * will probably differ from the on-disk information which makes the BDS
3843      * unusable */
3844     if (ret < 0) {
3845         goto fail_broken_refcounts;
3846     }
3847 
3848     BLKDBG_EVENT(bs->file, BLKDBG_L1_UPDATE);
3849     BLKDBG_EVENT(bs->file, BLKDBG_REFTABLE_UPDATE);
3850 
3851     /* "Create" an empty reftable (one cluster) directly after the image
3852      * header and an empty L1 table three clusters after the image header;
3853      * the cluster between those two will be used as the first refblock */
3854     l1_ofs_rt_ofs_cls.l1_offset = cpu_to_be64(3 * s->cluster_size);
3855     l1_ofs_rt_ofs_cls.reftable_offset = cpu_to_be64(s->cluster_size);
3856     l1_ofs_rt_ofs_cls.reftable_clusters = cpu_to_be32(1);
3857     ret = bdrv_pwrite_sync(bs->file, offsetof(QCowHeader, l1_table_offset),
3858                            &l1_ofs_rt_ofs_cls, sizeof(l1_ofs_rt_ofs_cls));
3859     if (ret < 0) {
3860         goto fail_broken_refcounts;
3861     }
3862 
3863     s->l1_table_offset = 3 * s->cluster_size;
3864 
3865     new_reftable = g_try_new0(uint64_t, s->cluster_size / sizeof(uint64_t));
3866     if (!new_reftable) {
3867         ret = -ENOMEM;
3868         goto fail_broken_refcounts;
3869     }
3870 
3871     s->refcount_table_offset = s->cluster_size;
3872     s->refcount_table_size   = s->cluster_size / sizeof(uint64_t);
3873     s->max_refcount_table_index = 0;
3874 
3875     g_free(s->refcount_table);
3876     s->refcount_table = new_reftable;
3877     new_reftable = NULL;
3878 
3879     /* Now the in-memory refcount information again corresponds to the on-disk
3880      * information (reftable is empty and no refblocks (the refblock cache is
3881      * empty)); however, this means some clusters (e.g. the image header) are
3882      * referenced, but not refcounted, but the normal qcow2 code assumes that
3883      * the in-memory information is always correct */
3884 
3885     BLKDBG_EVENT(bs->file, BLKDBG_REFBLOCK_ALLOC);
3886 
3887     /* Enter the first refblock into the reftable */
3888     rt_entry = cpu_to_be64(2 * s->cluster_size);
3889     ret = bdrv_pwrite_sync(bs->file, s->cluster_size,
3890                            &rt_entry, sizeof(rt_entry));
3891     if (ret < 0) {
3892         goto fail_broken_refcounts;
3893     }
3894     s->refcount_table[0] = 2 * s->cluster_size;
3895 
3896     s->free_cluster_index = 0;
3897     assert(3 + l1_clusters <= s->refcount_block_size);
3898     offset = qcow2_alloc_clusters(bs, 3 * s->cluster_size + l1_size2);
3899     if (offset < 0) {
3900         ret = offset;
3901         goto fail_broken_refcounts;
3902     } else if (offset > 0) {
3903         error_report("First cluster in emptied image is in use");
3904         abort();
3905     }
3906 
3907     /* Now finally the in-memory information corresponds to the on-disk
3908      * structures and is correct */
3909     ret = qcow2_mark_clean(bs);
3910     if (ret < 0) {
3911         goto fail;
3912     }
3913 
3914     ret = bdrv_truncate(bs->file, (3 + l1_clusters) * s->cluster_size,
3915                         PREALLOC_MODE_OFF, &local_err);
3916     if (ret < 0) {
3917         error_report_err(local_err);
3918         goto fail;
3919     }
3920 
3921     return 0;
3922 
3923 fail_broken_refcounts:
3924     /* The BDS is unusable at this point. If we wanted to make it usable, we
3925      * would have to call qcow2_refcount_close(), qcow2_refcount_init(),
3926      * qcow2_check_refcounts(), qcow2_refcount_close() and qcow2_refcount_init()
3927      * again. However, because the functions which could have caused this error
3928      * path to be taken are used by those functions as well, it's very likely
3929      * that that sequence will fail as well. Therefore, just eject the BDS. */
3930     bs->drv = NULL;
3931 
3932 fail:
3933     g_free(new_reftable);
3934     return ret;
3935 }
3936 
3937 static int qcow2_make_empty(BlockDriverState *bs)
3938 {
3939     BDRVQcow2State *s = bs->opaque;
3940     uint64_t offset, end_offset;
3941     int step = QEMU_ALIGN_DOWN(INT_MAX, s->cluster_size);
3942     int l1_clusters, ret = 0;
3943 
3944     l1_clusters = DIV_ROUND_UP(s->l1_size, s->cluster_size / sizeof(uint64_t));
3945 
3946     if (s->qcow_version >= 3 && !s->snapshots && !s->nb_bitmaps &&
3947         3 + l1_clusters <= s->refcount_block_size &&
3948         s->crypt_method_header != QCOW_CRYPT_LUKS) {
3949         /* The following function only works for qcow2 v3 images (it
3950          * requires the dirty flag) and only as long as there are no
3951          * features that reserve extra clusters (such as snapshots,
3952          * LUKS header, or persistent bitmaps), because it completely
3953          * empties the image.  Furthermore, the L1 table and three
3954          * additional clusters (image header, refcount table, one
3955          * refcount block) have to fit inside one refcount block. */
3956         return make_completely_empty(bs);
3957     }
3958 
3959     /* This fallback code simply discards every active cluster; this is slow,
3960      * but works in all cases */
3961     end_offset = bs->total_sectors * BDRV_SECTOR_SIZE;
3962     for (offset = 0; offset < end_offset; offset += step) {
3963         /* As this function is generally used after committing an external
3964          * snapshot, QCOW2_DISCARD_SNAPSHOT seems appropriate. Also, the
3965          * default action for this kind of discard is to pass the discard,
3966          * which will ideally result in an actually smaller image file, as
3967          * is probably desired. */
3968         ret = qcow2_cluster_discard(bs, offset, MIN(step, end_offset - offset),
3969                                     QCOW2_DISCARD_SNAPSHOT, true);
3970         if (ret < 0) {
3971             break;
3972         }
3973     }
3974 
3975     return ret;
3976 }
3977 
3978 static coroutine_fn int qcow2_co_flush_to_os(BlockDriverState *bs)
3979 {
3980     BDRVQcow2State *s = bs->opaque;
3981     int ret;
3982 
3983     qemu_co_mutex_lock(&s->lock);
3984     ret = qcow2_write_caches(bs);
3985     qemu_co_mutex_unlock(&s->lock);
3986 
3987     return ret;
3988 }
3989 
3990 static BlockMeasureInfo *qcow2_measure(QemuOpts *opts, BlockDriverState *in_bs,
3991                                        Error **errp)
3992 {
3993     Error *local_err = NULL;
3994     BlockMeasureInfo *info;
3995     uint64_t required = 0; /* bytes that contribute to required size */
3996     uint64_t virtual_size; /* disk size as seen by guest */
3997     uint64_t refcount_bits;
3998     uint64_t l2_tables;
3999     size_t cluster_size;
4000     int version;
4001     char *optstr;
4002     PreallocMode prealloc;
4003     bool has_backing_file;
4004 
4005     /* Parse image creation options */
4006     cluster_size = qcow2_opt_get_cluster_size_del(opts, &local_err);
4007     if (local_err) {
4008         goto err;
4009     }
4010 
4011     version = qcow2_opt_get_version_del(opts, &local_err);
4012     if (local_err) {
4013         goto err;
4014     }
4015 
4016     refcount_bits = qcow2_opt_get_refcount_bits_del(opts, version, &local_err);
4017     if (local_err) {
4018         goto err;
4019     }
4020 
4021     optstr = qemu_opt_get_del(opts, BLOCK_OPT_PREALLOC);
4022     prealloc = qapi_enum_parse(&PreallocMode_lookup, optstr,
4023                                PREALLOC_MODE_OFF, &local_err);
4024     g_free(optstr);
4025     if (local_err) {
4026         goto err;
4027     }
4028 
4029     optstr = qemu_opt_get_del(opts, BLOCK_OPT_BACKING_FILE);
4030     has_backing_file = !!optstr;
4031     g_free(optstr);
4032 
4033     virtual_size = qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0);
4034     virtual_size = ROUND_UP(virtual_size, cluster_size);
4035 
4036     /* Check that virtual disk size is valid */
4037     l2_tables = DIV_ROUND_UP(virtual_size / cluster_size,
4038                              cluster_size / sizeof(uint64_t));
4039     if (l2_tables * sizeof(uint64_t) > QCOW_MAX_L1_SIZE) {
4040         error_setg(&local_err, "The image size is too large "
4041                                "(try using a larger cluster size)");
4042         goto err;
4043     }
4044 
4045     /* Account for input image */
4046     if (in_bs) {
4047         int64_t ssize = bdrv_getlength(in_bs);
4048         if (ssize < 0) {
4049             error_setg_errno(&local_err, -ssize,
4050                              "Unable to get image virtual_size");
4051             goto err;
4052         }
4053 
4054         virtual_size = ROUND_UP(ssize, cluster_size);
4055 
4056         if (has_backing_file) {
4057             /* We don't how much of the backing chain is shared by the input
4058              * image and the new image file.  In the worst case the new image's
4059              * backing file has nothing in common with the input image.  Be
4060              * conservative and assume all clusters need to be written.
4061              */
4062             required = virtual_size;
4063         } else {
4064             int64_t offset;
4065             int64_t pnum = 0;
4066 
4067             for (offset = 0; offset < ssize; offset += pnum) {
4068                 int ret;
4069 
4070                 ret = bdrv_block_status_above(in_bs, NULL, offset,
4071                                               ssize - offset, &pnum, NULL,
4072                                               NULL);
4073                 if (ret < 0) {
4074                     error_setg_errno(&local_err, -ret,
4075                                      "Unable to get block status");
4076                     goto err;
4077                 }
4078 
4079                 if (ret & BDRV_BLOCK_ZERO) {
4080                     /* Skip zero regions (safe with no backing file) */
4081                 } else if ((ret & (BDRV_BLOCK_DATA | BDRV_BLOCK_ALLOCATED)) ==
4082                            (BDRV_BLOCK_DATA | BDRV_BLOCK_ALLOCATED)) {
4083                     /* Extend pnum to end of cluster for next iteration */
4084                     pnum = ROUND_UP(offset + pnum, cluster_size) - offset;
4085 
4086                     /* Count clusters we've seen */
4087                     required += offset % cluster_size + pnum;
4088                 }
4089             }
4090         }
4091     }
4092 
4093     /* Take into account preallocation.  Nothing special is needed for
4094      * PREALLOC_MODE_METADATA since metadata is always counted.
4095      */
4096     if (prealloc == PREALLOC_MODE_FULL || prealloc == PREALLOC_MODE_FALLOC) {
4097         required = virtual_size;
4098     }
4099 
4100     info = g_new(BlockMeasureInfo, 1);
4101     info->fully_allocated =
4102         qcow2_calc_prealloc_size(virtual_size, cluster_size,
4103                                  ctz32(refcount_bits));
4104 
4105     /* Remove data clusters that are not required.  This overestimates the
4106      * required size because metadata needed for the fully allocated file is
4107      * still counted.
4108      */
4109     info->required = info->fully_allocated - virtual_size + required;
4110     return info;
4111 
4112 err:
4113     error_propagate(errp, local_err);
4114     return NULL;
4115 }
4116 
4117 static int qcow2_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
4118 {
4119     BDRVQcow2State *s = bs->opaque;
4120     bdi->unallocated_blocks_are_zero = true;
4121     bdi->cluster_size = s->cluster_size;
4122     bdi->vm_state_offset = qcow2_vm_state_offset(s);
4123     return 0;
4124 }
4125 
4126 static ImageInfoSpecific *qcow2_get_specific_info(BlockDriverState *bs)
4127 {
4128     BDRVQcow2State *s = bs->opaque;
4129     ImageInfoSpecific *spec_info;
4130     QCryptoBlockInfo *encrypt_info = NULL;
4131 
4132     if (s->crypto != NULL) {
4133         encrypt_info = qcrypto_block_get_info(s->crypto, &error_abort);
4134     }
4135 
4136     spec_info = g_new(ImageInfoSpecific, 1);
4137     *spec_info = (ImageInfoSpecific){
4138         .type  = IMAGE_INFO_SPECIFIC_KIND_QCOW2,
4139         .u.qcow2.data = g_new(ImageInfoSpecificQCow2, 1),
4140     };
4141     if (s->qcow_version == 2) {
4142         *spec_info->u.qcow2.data = (ImageInfoSpecificQCow2){
4143             .compat             = g_strdup("0.10"),
4144             .refcount_bits      = s->refcount_bits,
4145         };
4146     } else if (s->qcow_version == 3) {
4147         *spec_info->u.qcow2.data = (ImageInfoSpecificQCow2){
4148             .compat             = g_strdup("1.1"),
4149             .lazy_refcounts     = s->compatible_features &
4150                                   QCOW2_COMPAT_LAZY_REFCOUNTS,
4151             .has_lazy_refcounts = true,
4152             .corrupt            = s->incompatible_features &
4153                                   QCOW2_INCOMPAT_CORRUPT,
4154             .has_corrupt        = true,
4155             .refcount_bits      = s->refcount_bits,
4156         };
4157     } else {
4158         /* if this assertion fails, this probably means a new version was
4159          * added without having it covered here */
4160         assert(false);
4161     }
4162 
4163     if (encrypt_info) {
4164         ImageInfoSpecificQCow2Encryption *qencrypt =
4165             g_new(ImageInfoSpecificQCow2Encryption, 1);
4166         switch (encrypt_info->format) {
4167         case Q_CRYPTO_BLOCK_FORMAT_QCOW:
4168             qencrypt->format = BLOCKDEV_QCOW2_ENCRYPTION_FORMAT_AES;
4169             break;
4170         case Q_CRYPTO_BLOCK_FORMAT_LUKS:
4171             qencrypt->format = BLOCKDEV_QCOW2_ENCRYPTION_FORMAT_LUKS;
4172             qencrypt->u.luks = encrypt_info->u.luks;
4173             break;
4174         default:
4175             abort();
4176         }
4177         /* Since we did shallow copy above, erase any pointers
4178          * in the original info */
4179         memset(&encrypt_info->u, 0, sizeof(encrypt_info->u));
4180         qapi_free_QCryptoBlockInfo(encrypt_info);
4181 
4182         spec_info->u.qcow2.data->has_encrypt = true;
4183         spec_info->u.qcow2.data->encrypt = qencrypt;
4184     }
4185 
4186     return spec_info;
4187 }
4188 
4189 static int qcow2_save_vmstate(BlockDriverState *bs, QEMUIOVector *qiov,
4190                               int64_t pos)
4191 {
4192     BDRVQcow2State *s = bs->opaque;
4193 
4194     BLKDBG_EVENT(bs->file, BLKDBG_VMSTATE_SAVE);
4195     return bs->drv->bdrv_co_pwritev(bs, qcow2_vm_state_offset(s) + pos,
4196                                     qiov->size, qiov, 0);
4197 }
4198 
4199 static int qcow2_load_vmstate(BlockDriverState *bs, QEMUIOVector *qiov,
4200                               int64_t pos)
4201 {
4202     BDRVQcow2State *s = bs->opaque;
4203 
4204     BLKDBG_EVENT(bs->file, BLKDBG_VMSTATE_LOAD);
4205     return bs->drv->bdrv_co_preadv(bs, qcow2_vm_state_offset(s) + pos,
4206                                    qiov->size, qiov, 0);
4207 }
4208 
4209 /*
4210  * Downgrades an image's version. To achieve this, any incompatible features
4211  * have to be removed.
4212  */
4213 static int qcow2_downgrade(BlockDriverState *bs, int target_version,
4214                            BlockDriverAmendStatusCB *status_cb, void *cb_opaque,
4215                            Error **errp)
4216 {
4217     BDRVQcow2State *s = bs->opaque;
4218     int current_version = s->qcow_version;
4219     int ret;
4220 
4221     /* This is qcow2_downgrade(), not qcow2_upgrade() */
4222     assert(target_version < current_version);
4223 
4224     /* There are no other versions (now) that you can downgrade to */
4225     assert(target_version == 2);
4226 
4227     if (s->refcount_order != 4) {
4228         error_setg(errp, "compat=0.10 requires refcount_bits=16");
4229         return -ENOTSUP;
4230     }
4231 
4232     /* clear incompatible features */
4233     if (s->incompatible_features & QCOW2_INCOMPAT_DIRTY) {
4234         ret = qcow2_mark_clean(bs);
4235         if (ret < 0) {
4236             error_setg_errno(errp, -ret, "Failed to make the image clean");
4237             return ret;
4238         }
4239     }
4240 
4241     /* with QCOW2_INCOMPAT_CORRUPT, it is pretty much impossible to get here in
4242      * the first place; if that happens nonetheless, returning -ENOTSUP is the
4243      * best thing to do anyway */
4244 
4245     if (s->incompatible_features) {
4246         error_setg(errp, "Cannot downgrade an image with incompatible features "
4247                    "%#" PRIx64 " set", s->incompatible_features);
4248         return -ENOTSUP;
4249     }
4250 
4251     /* since we can ignore compatible features, we can set them to 0 as well */
4252     s->compatible_features = 0;
4253     /* if lazy refcounts have been used, they have already been fixed through
4254      * clearing the dirty flag */
4255 
4256     /* clearing autoclear features is trivial */
4257     s->autoclear_features = 0;
4258 
4259     ret = qcow2_expand_zero_clusters(bs, status_cb, cb_opaque);
4260     if (ret < 0) {
4261         error_setg_errno(errp, -ret, "Failed to turn zero into data clusters");
4262         return ret;
4263     }
4264 
4265     s->qcow_version = target_version;
4266     ret = qcow2_update_header(bs);
4267     if (ret < 0) {
4268         s->qcow_version = current_version;
4269         error_setg_errno(errp, -ret, "Failed to update the image header");
4270         return ret;
4271     }
4272     return 0;
4273 }
4274 
4275 typedef enum Qcow2AmendOperation {
4276     /* This is the value Qcow2AmendHelperCBInfo::last_operation will be
4277      * statically initialized to so that the helper CB can discern the first
4278      * invocation from an operation change */
4279     QCOW2_NO_OPERATION = 0,
4280 
4281     QCOW2_CHANGING_REFCOUNT_ORDER,
4282     QCOW2_DOWNGRADING,
4283 } Qcow2AmendOperation;
4284 
4285 typedef struct Qcow2AmendHelperCBInfo {
4286     /* The code coordinating the amend operations should only modify
4287      * these four fields; the rest will be managed by the CB */
4288     BlockDriverAmendStatusCB *original_status_cb;
4289     void *original_cb_opaque;
4290 
4291     Qcow2AmendOperation current_operation;
4292 
4293     /* Total number of operations to perform (only set once) */
4294     int total_operations;
4295 
4296     /* The following fields are managed by the CB */
4297 
4298     /* Number of operations completed */
4299     int operations_completed;
4300 
4301     /* Cumulative offset of all completed operations */
4302     int64_t offset_completed;
4303 
4304     Qcow2AmendOperation last_operation;
4305     int64_t last_work_size;
4306 } Qcow2AmendHelperCBInfo;
4307 
4308 static void qcow2_amend_helper_cb(BlockDriverState *bs,
4309                                   int64_t operation_offset,
4310                                   int64_t operation_work_size, void *opaque)
4311 {
4312     Qcow2AmendHelperCBInfo *info = opaque;
4313     int64_t current_work_size;
4314     int64_t projected_work_size;
4315 
4316     if (info->current_operation != info->last_operation) {
4317         if (info->last_operation != QCOW2_NO_OPERATION) {
4318             info->offset_completed += info->last_work_size;
4319             info->operations_completed++;
4320         }
4321 
4322         info->last_operation = info->current_operation;
4323     }
4324 
4325     assert(info->total_operations > 0);
4326     assert(info->operations_completed < info->total_operations);
4327 
4328     info->last_work_size = operation_work_size;
4329 
4330     current_work_size = info->offset_completed + operation_work_size;
4331 
4332     /* current_work_size is the total work size for (operations_completed + 1)
4333      * operations (which includes this one), so multiply it by the number of
4334      * operations not covered and divide it by the number of operations
4335      * covered to get a projection for the operations not covered */
4336     projected_work_size = current_work_size * (info->total_operations -
4337                                                info->operations_completed - 1)
4338                                             / (info->operations_completed + 1);
4339 
4340     info->original_status_cb(bs, info->offset_completed + operation_offset,
4341                              current_work_size + projected_work_size,
4342                              info->original_cb_opaque);
4343 }
4344 
4345 static int qcow2_amend_options(BlockDriverState *bs, QemuOpts *opts,
4346                                BlockDriverAmendStatusCB *status_cb,
4347                                void *cb_opaque,
4348                                Error **errp)
4349 {
4350     BDRVQcow2State *s = bs->opaque;
4351     int old_version = s->qcow_version, new_version = old_version;
4352     uint64_t new_size = 0;
4353     const char *backing_file = NULL, *backing_format = NULL;
4354     bool lazy_refcounts = s->use_lazy_refcounts;
4355     const char *compat = NULL;
4356     uint64_t cluster_size = s->cluster_size;
4357     bool encrypt;
4358     int encformat;
4359     int refcount_bits = s->refcount_bits;
4360     int ret;
4361     QemuOptDesc *desc = opts->list->desc;
4362     Qcow2AmendHelperCBInfo helper_cb_info;
4363 
4364     while (desc && desc->name) {
4365         if (!qemu_opt_find(opts, desc->name)) {
4366             /* only change explicitly defined options */
4367             desc++;
4368             continue;
4369         }
4370 
4371         if (!strcmp(desc->name, BLOCK_OPT_COMPAT_LEVEL)) {
4372             compat = qemu_opt_get(opts, BLOCK_OPT_COMPAT_LEVEL);
4373             if (!compat) {
4374                 /* preserve default */
4375             } else if (!strcmp(compat, "0.10")) {
4376                 new_version = 2;
4377             } else if (!strcmp(compat, "1.1")) {
4378                 new_version = 3;
4379             } else {
4380                 error_setg(errp, "Unknown compatibility level %s", compat);
4381                 return -EINVAL;
4382             }
4383         } else if (!strcmp(desc->name, BLOCK_OPT_PREALLOC)) {
4384             error_setg(errp, "Cannot change preallocation mode");
4385             return -ENOTSUP;
4386         } else if (!strcmp(desc->name, BLOCK_OPT_SIZE)) {
4387             new_size = qemu_opt_get_size(opts, BLOCK_OPT_SIZE, 0);
4388         } else if (!strcmp(desc->name, BLOCK_OPT_BACKING_FILE)) {
4389             backing_file = qemu_opt_get(opts, BLOCK_OPT_BACKING_FILE);
4390         } else if (!strcmp(desc->name, BLOCK_OPT_BACKING_FMT)) {
4391             backing_format = qemu_opt_get(opts, BLOCK_OPT_BACKING_FMT);
4392         } else if (!strcmp(desc->name, BLOCK_OPT_ENCRYPT)) {
4393             encrypt = qemu_opt_get_bool(opts, BLOCK_OPT_ENCRYPT,
4394                                         !!s->crypto);
4395 
4396             if (encrypt != !!s->crypto) {
4397                 error_setg(errp,
4398                            "Changing the encryption flag is not supported");
4399                 return -ENOTSUP;
4400             }
4401         } else if (!strcmp(desc->name, BLOCK_OPT_ENCRYPT_FORMAT)) {
4402             encformat = qcow2_crypt_method_from_format(
4403                 qemu_opt_get(opts, BLOCK_OPT_ENCRYPT_FORMAT));
4404 
4405             if (encformat != s->crypt_method_header) {
4406                 error_setg(errp,
4407                            "Changing the encryption format is not supported");
4408                 return -ENOTSUP;
4409             }
4410         } else if (g_str_has_prefix(desc->name, "encrypt.")) {
4411             error_setg(errp,
4412                        "Changing the encryption parameters is not supported");
4413             return -ENOTSUP;
4414         } else if (!strcmp(desc->name, BLOCK_OPT_CLUSTER_SIZE)) {
4415             cluster_size = qemu_opt_get_size(opts, BLOCK_OPT_CLUSTER_SIZE,
4416                                              cluster_size);
4417             if (cluster_size != s->cluster_size) {
4418                 error_setg(errp, "Changing the cluster size is not supported");
4419                 return -ENOTSUP;
4420             }
4421         } else if (!strcmp(desc->name, BLOCK_OPT_LAZY_REFCOUNTS)) {
4422             lazy_refcounts = qemu_opt_get_bool(opts, BLOCK_OPT_LAZY_REFCOUNTS,
4423                                                lazy_refcounts);
4424         } else if (!strcmp(desc->name, BLOCK_OPT_REFCOUNT_BITS)) {
4425             refcount_bits = qemu_opt_get_number(opts, BLOCK_OPT_REFCOUNT_BITS,
4426                                                 refcount_bits);
4427 
4428             if (refcount_bits <= 0 || refcount_bits > 64 ||
4429                 !is_power_of_2(refcount_bits))
4430             {
4431                 error_setg(errp, "Refcount width must be a power of two and "
4432                            "may not exceed 64 bits");
4433                 return -EINVAL;
4434             }
4435         } else {
4436             /* if this point is reached, this probably means a new option was
4437              * added without having it covered here */
4438             abort();
4439         }
4440 
4441         desc++;
4442     }
4443 
4444     helper_cb_info = (Qcow2AmendHelperCBInfo){
4445         .original_status_cb = status_cb,
4446         .original_cb_opaque = cb_opaque,
4447         .total_operations = (new_version < old_version)
4448                           + (s->refcount_bits != refcount_bits)
4449     };
4450 
4451     /* Upgrade first (some features may require compat=1.1) */
4452     if (new_version > old_version) {
4453         s->qcow_version = new_version;
4454         ret = qcow2_update_header(bs);
4455         if (ret < 0) {
4456             s->qcow_version = old_version;
4457             error_setg_errno(errp, -ret, "Failed to update the image header");
4458             return ret;
4459         }
4460     }
4461 
4462     if (s->refcount_bits != refcount_bits) {
4463         int refcount_order = ctz32(refcount_bits);
4464 
4465         if (new_version < 3 && refcount_bits != 16) {
4466             error_setg(errp, "Refcount widths other than 16 bits require "
4467                        "compatibility level 1.1 or above (use compat=1.1 or "
4468                        "greater)");
4469             return -EINVAL;
4470         }
4471 
4472         helper_cb_info.current_operation = QCOW2_CHANGING_REFCOUNT_ORDER;
4473         ret = qcow2_change_refcount_order(bs, refcount_order,
4474                                           &qcow2_amend_helper_cb,
4475                                           &helper_cb_info, errp);
4476         if (ret < 0) {
4477             return ret;
4478         }
4479     }
4480 
4481     if (backing_file || backing_format) {
4482         ret = qcow2_change_backing_file(bs,
4483                     backing_file ?: s->image_backing_file,
4484                     backing_format ?: s->image_backing_format);
4485         if (ret < 0) {
4486             error_setg_errno(errp, -ret, "Failed to change the backing file");
4487             return ret;
4488         }
4489     }
4490 
4491     if (s->use_lazy_refcounts != lazy_refcounts) {
4492         if (lazy_refcounts) {
4493             if (new_version < 3) {
4494                 error_setg(errp, "Lazy refcounts only supported with "
4495                            "compatibility level 1.1 and above (use compat=1.1 "
4496                            "or greater)");
4497                 return -EINVAL;
4498             }
4499             s->compatible_features |= QCOW2_COMPAT_LAZY_REFCOUNTS;
4500             ret = qcow2_update_header(bs);
4501             if (ret < 0) {
4502                 s->compatible_features &= ~QCOW2_COMPAT_LAZY_REFCOUNTS;
4503                 error_setg_errno(errp, -ret, "Failed to update the image header");
4504                 return ret;
4505             }
4506             s->use_lazy_refcounts = true;
4507         } else {
4508             /* make image clean first */
4509             ret = qcow2_mark_clean(bs);
4510             if (ret < 0) {
4511                 error_setg_errno(errp, -ret, "Failed to make the image clean");
4512                 return ret;
4513             }
4514             /* now disallow lazy refcounts */
4515             s->compatible_features &= ~QCOW2_COMPAT_LAZY_REFCOUNTS;
4516             ret = qcow2_update_header(bs);
4517             if (ret < 0) {
4518                 s->compatible_features |= QCOW2_COMPAT_LAZY_REFCOUNTS;
4519                 error_setg_errno(errp, -ret, "Failed to update the image header");
4520                 return ret;
4521             }
4522             s->use_lazy_refcounts = false;
4523         }
4524     }
4525 
4526     if (new_size) {
4527         BlockBackend *blk = blk_new(BLK_PERM_RESIZE, BLK_PERM_ALL);
4528         ret = blk_insert_bs(blk, bs, errp);
4529         if (ret < 0) {
4530             blk_unref(blk);
4531             return ret;
4532         }
4533 
4534         ret = blk_truncate(blk, new_size, PREALLOC_MODE_OFF, errp);
4535         blk_unref(blk);
4536         if (ret < 0) {
4537             return ret;
4538         }
4539     }
4540 
4541     /* Downgrade last (so unsupported features can be removed before) */
4542     if (new_version < old_version) {
4543         helper_cb_info.current_operation = QCOW2_DOWNGRADING;
4544         ret = qcow2_downgrade(bs, new_version, &qcow2_amend_helper_cb,
4545                               &helper_cb_info, errp);
4546         if (ret < 0) {
4547             return ret;
4548         }
4549     }
4550 
4551     return 0;
4552 }
4553 
4554 /*
4555  * If offset or size are negative, respectively, they will not be included in
4556  * the BLOCK_IMAGE_CORRUPTED event emitted.
4557  * fatal will be ignored for read-only BDS; corruptions found there will always
4558  * be considered non-fatal.
4559  */
4560 void qcow2_signal_corruption(BlockDriverState *bs, bool fatal, int64_t offset,
4561                              int64_t size, const char *message_format, ...)
4562 {
4563     BDRVQcow2State *s = bs->opaque;
4564     const char *node_name;
4565     char *message;
4566     va_list ap;
4567 
4568     fatal = fatal && bdrv_is_writable(bs);
4569 
4570     if (s->signaled_corruption &&
4571         (!fatal || (s->incompatible_features & QCOW2_INCOMPAT_CORRUPT)))
4572     {
4573         return;
4574     }
4575 
4576     va_start(ap, message_format);
4577     message = g_strdup_vprintf(message_format, ap);
4578     va_end(ap);
4579 
4580     if (fatal) {
4581         fprintf(stderr, "qcow2: Marking image as corrupt: %s; further "
4582                 "corruption events will be suppressed\n", message);
4583     } else {
4584         fprintf(stderr, "qcow2: Image is corrupt: %s; further non-fatal "
4585                 "corruption events will be suppressed\n", message);
4586     }
4587 
4588     node_name = bdrv_get_node_name(bs);
4589     qapi_event_send_block_image_corrupted(bdrv_get_device_name(bs),
4590                                           *node_name != '\0', node_name,
4591                                           message, offset >= 0, offset,
4592                                           size >= 0, size,
4593                                           fatal, &error_abort);
4594     g_free(message);
4595 
4596     if (fatal) {
4597         qcow2_mark_corrupt(bs);
4598         bs->drv = NULL; /* make BDS unusable */
4599     }
4600 
4601     s->signaled_corruption = true;
4602 }
4603 
4604 static QemuOptsList qcow2_create_opts = {
4605     .name = "qcow2-create-opts",
4606     .head = QTAILQ_HEAD_INITIALIZER(qcow2_create_opts.head),
4607     .desc = {
4608         {
4609             .name = BLOCK_OPT_SIZE,
4610             .type = QEMU_OPT_SIZE,
4611             .help = "Virtual disk size"
4612         },
4613         {
4614             .name = BLOCK_OPT_COMPAT_LEVEL,
4615             .type = QEMU_OPT_STRING,
4616             .help = "Compatibility level (0.10 or 1.1)"
4617         },
4618         {
4619             .name = BLOCK_OPT_BACKING_FILE,
4620             .type = QEMU_OPT_STRING,
4621             .help = "File name of a base image"
4622         },
4623         {
4624             .name = BLOCK_OPT_BACKING_FMT,
4625             .type = QEMU_OPT_STRING,
4626             .help = "Image format of the base image"
4627         },
4628         {
4629             .name = BLOCK_OPT_ENCRYPT,
4630             .type = QEMU_OPT_BOOL,
4631             .help = "Encrypt the image with format 'aes'. (Deprecated "
4632                     "in favor of " BLOCK_OPT_ENCRYPT_FORMAT "=aes)",
4633         },
4634         {
4635             .name = BLOCK_OPT_ENCRYPT_FORMAT,
4636             .type = QEMU_OPT_STRING,
4637             .help = "Encrypt the image, format choices: 'aes', 'luks'",
4638         },
4639         BLOCK_CRYPTO_OPT_DEF_KEY_SECRET("encrypt.",
4640             "ID of secret providing qcow AES key or LUKS passphrase"),
4641         BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_ALG("encrypt."),
4642         BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_MODE("encrypt."),
4643         BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_ALG("encrypt."),
4644         BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_HASH_ALG("encrypt."),
4645         BLOCK_CRYPTO_OPT_DEF_LUKS_HASH_ALG("encrypt."),
4646         BLOCK_CRYPTO_OPT_DEF_LUKS_ITER_TIME("encrypt."),
4647         {
4648             .name = BLOCK_OPT_CLUSTER_SIZE,
4649             .type = QEMU_OPT_SIZE,
4650             .help = "qcow2 cluster size",
4651             .def_value_str = stringify(DEFAULT_CLUSTER_SIZE)
4652         },
4653         {
4654             .name = BLOCK_OPT_PREALLOC,
4655             .type = QEMU_OPT_STRING,
4656             .help = "Preallocation mode (allowed values: off, metadata, "
4657                     "falloc, full)"
4658         },
4659         {
4660             .name = BLOCK_OPT_LAZY_REFCOUNTS,
4661             .type = QEMU_OPT_BOOL,
4662             .help = "Postpone refcount updates",
4663             .def_value_str = "off"
4664         },
4665         {
4666             .name = BLOCK_OPT_REFCOUNT_BITS,
4667             .type = QEMU_OPT_NUMBER,
4668             .help = "Width of a reference count entry in bits",
4669             .def_value_str = "16"
4670         },
4671         { /* end of list */ }
4672     }
4673 };
4674 
4675 BlockDriver bdrv_qcow2 = {
4676     .format_name        = "qcow2",
4677     .instance_size      = sizeof(BDRVQcow2State),
4678     .bdrv_probe         = qcow2_probe,
4679     .bdrv_open          = qcow2_open,
4680     .bdrv_close         = qcow2_close,
4681     .bdrv_reopen_prepare  = qcow2_reopen_prepare,
4682     .bdrv_reopen_commit   = qcow2_reopen_commit,
4683     .bdrv_reopen_abort    = qcow2_reopen_abort,
4684     .bdrv_join_options    = qcow2_join_options,
4685     .bdrv_child_perm      = bdrv_format_default_perms,
4686     .bdrv_co_create_opts  = qcow2_co_create_opts,
4687     .bdrv_co_create       = qcow2_co_create,
4688     .bdrv_has_zero_init = bdrv_has_zero_init_1,
4689     .bdrv_co_block_status = qcow2_co_block_status,
4690 
4691     .bdrv_co_preadv         = qcow2_co_preadv,
4692     .bdrv_co_pwritev        = qcow2_co_pwritev,
4693     .bdrv_co_flush_to_os    = qcow2_co_flush_to_os,
4694 
4695     .bdrv_co_pwrite_zeroes  = qcow2_co_pwrite_zeroes,
4696     .bdrv_co_pdiscard       = qcow2_co_pdiscard,
4697     .bdrv_co_copy_range_from = qcow2_co_copy_range_from,
4698     .bdrv_co_copy_range_to  = qcow2_co_copy_range_to,
4699     .bdrv_truncate          = qcow2_truncate,
4700     .bdrv_co_pwritev_compressed = qcow2_co_pwritev_compressed,
4701     .bdrv_make_empty        = qcow2_make_empty,
4702 
4703     .bdrv_snapshot_create   = qcow2_snapshot_create,
4704     .bdrv_snapshot_goto     = qcow2_snapshot_goto,
4705     .bdrv_snapshot_delete   = qcow2_snapshot_delete,
4706     .bdrv_snapshot_list     = qcow2_snapshot_list,
4707     .bdrv_snapshot_load_tmp = qcow2_snapshot_load_tmp,
4708     .bdrv_measure           = qcow2_measure,
4709     .bdrv_get_info          = qcow2_get_info,
4710     .bdrv_get_specific_info = qcow2_get_specific_info,
4711 
4712     .bdrv_save_vmstate    = qcow2_save_vmstate,
4713     .bdrv_load_vmstate    = qcow2_load_vmstate,
4714 
4715     .supports_backing           = true,
4716     .bdrv_change_backing_file   = qcow2_change_backing_file,
4717 
4718     .bdrv_refresh_limits        = qcow2_refresh_limits,
4719     .bdrv_co_invalidate_cache   = qcow2_co_invalidate_cache,
4720     .bdrv_inactivate            = qcow2_inactivate,
4721 
4722     .create_opts         = &qcow2_create_opts,
4723     .bdrv_co_check       = qcow2_co_check,
4724     .bdrv_amend_options  = qcow2_amend_options,
4725 
4726     .bdrv_detach_aio_context  = qcow2_detach_aio_context,
4727     .bdrv_attach_aio_context  = qcow2_attach_aio_context,
4728 
4729     .bdrv_reopen_bitmaps_rw = qcow2_reopen_bitmaps_rw,
4730     .bdrv_can_store_new_dirty_bitmap = qcow2_can_store_new_dirty_bitmap,
4731     .bdrv_remove_persistent_dirty_bitmap = qcow2_remove_persistent_dirty_bitmap,
4732 };
4733 
4734 static void bdrv_qcow2_init(void)
4735 {
4736     bdrv_register(&bdrv_qcow2);
4737 }
4738 
4739 block_init(bdrv_qcow2_init);
4740