xref: /openbmc/qemu/block/vvfat.c (revision 7cf745dd)
1 /* vim:set shiftwidth=4 ts=4: */
2 /*
3  * QEMU Block driver for virtual VFAT (shadows a local directory)
4  *
5  * Copyright (c) 2004,2005 Johannes E. Schindelin
6  *
7  * Permission is hereby granted, free of charge, to any person obtaining a copy
8  * of this software and associated documentation files (the "Software"), to deal
9  * in the Software without restriction, including without limitation the rights
10  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11  * copies of the Software, and to permit persons to whom the Software is
12  * furnished to do so, subject to the following conditions:
13  *
14  * The above copyright notice and this permission notice shall be included in
15  * all copies or substantial portions of the Software.
16  *
17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23  * THE SOFTWARE.
24  */
25 
26 #include "qemu/osdep.h"
27 #include <dirent.h>
28 #include "qapi/error.h"
29 #include "block/block_int.h"
30 #include "block/qdict.h"
31 #include "qemu/module.h"
32 #include "qemu/option.h"
33 #include "qemu/bswap.h"
34 #include "migration/blocker.h"
35 #include "qapi/qmp/qdict.h"
36 #include "qapi/qmp/qstring.h"
37 #include "qemu/ctype.h"
38 #include "qemu/cutils.h"
39 #include "qemu/error-report.h"
40 
41 #ifndef S_IWGRP
42 #define S_IWGRP 0
43 #endif
44 #ifndef S_IWOTH
45 #define S_IWOTH 0
46 #endif
47 
48 /* TODO: add ":bootsector=blabla.img:" */
49 /* LATER TODO: add automatic boot sector generation from
50     BOOTEASY.ASM and Ranish Partition Manager
51     Note that DOS assumes the system files to be the first files in the
52     file system (test if the boot sector still relies on that fact)! */
53 /* MAYBE TODO: write block-visofs.c */
54 /* TODO: call try_commit() only after a timeout */
55 
56 /* #define DEBUG */
57 
58 #ifdef DEBUG
59 
60 #define DLOG(a) a
61 
62 static void checkpoint(void);
63 
64 #else
65 
66 #define DLOG(a)
67 
68 #endif
69 
70 /* bootsector OEM name. see related compatibility problems at:
71  * https://jdebp.eu/FGA/volume-boot-block-oem-name-field.html
72  * http://seasip.info/Misc/oemid.html
73  */
74 #define BOOTSECTOR_OEM_NAME "MSWIN4.1"
75 
76 #define DIR_DELETED 0xe5
77 #define DIR_KANJI DIR_DELETED
78 #define DIR_KANJI_FAKE 0x05
79 #define DIR_FREE 0x00
80 
81 /* dynamic array functions */
82 typedef struct array_t {
83     char* pointer;
84     unsigned int size,next,item_size;
85 } array_t;
86 
87 static inline void array_init(array_t* array,unsigned int item_size)
88 {
89     array->pointer = NULL;
90     array->size=0;
91     array->next=0;
92     array->item_size=item_size;
93 }
94 
95 static inline void array_free(array_t* array)
96 {
97     g_free(array->pointer);
98     array->size=array->next=0;
99 }
100 
101 /* does not automatically grow */
102 static inline void* array_get(array_t* array,unsigned int index) {
103     assert(index < array->next);
104     assert(array->pointer);
105     return array->pointer + index * array->item_size;
106 }
107 
108 static inline void array_ensure_allocated(array_t *array, int index)
109 {
110     if((index + 1) * array->item_size > array->size) {
111         int new_size = (index + 32) * array->item_size;
112         array->pointer = g_realloc(array->pointer, new_size);
113         assert(array->pointer);
114         memset(array->pointer + array->size, 0, new_size - array->size);
115         array->size = new_size;
116         array->next = index + 1;
117     }
118 }
119 
120 static inline void* array_get_next(array_t* array) {
121     unsigned int next = array->next;
122 
123     array_ensure_allocated(array, next);
124     array->next = next + 1;
125     return array_get(array, next);
126 }
127 
128 static inline void* array_insert(array_t* array,unsigned int index,unsigned int count) {
129     if((array->next+count)*array->item_size>array->size) {
130         int increment=count*array->item_size;
131         array->pointer=g_realloc(array->pointer,array->size+increment);
132         if(!array->pointer)
133             return NULL;
134         array->size+=increment;
135     }
136     memmove(array->pointer+(index+count)*array->item_size,
137                 array->pointer+index*array->item_size,
138                 (array->next-index)*array->item_size);
139     array->next+=count;
140     return array->pointer+index*array->item_size;
141 }
142 
143 static inline int array_remove_slice(array_t* array,int index, int count)
144 {
145     assert(index >=0);
146     assert(count > 0);
147     assert(index + count <= array->next);
148 
149     memmove(array->pointer + index * array->item_size,
150             array->pointer + (index + count) * array->item_size,
151             (array->next - index - count) * array->item_size);
152 
153     array->next -= count;
154     return 0;
155 }
156 
157 static int array_remove(array_t* array,int index)
158 {
159     return array_remove_slice(array, index, 1);
160 }
161 
162 /* return the index for a given member */
163 static int array_index(array_t* array, void* pointer)
164 {
165     size_t offset = (char*)pointer - array->pointer;
166     assert((offset % array->item_size) == 0);
167     assert(offset/array->item_size < array->next);
168     return offset/array->item_size;
169 }
170 
171 /* These structures are used to fake a disk and the VFAT filesystem.
172  * For this reason we need to use QEMU_PACKED. */
173 
174 typedef struct bootsector_t {
175     uint8_t jump[3];
176     uint8_t name[8];
177     uint16_t sector_size;
178     uint8_t sectors_per_cluster;
179     uint16_t reserved_sectors;
180     uint8_t number_of_fats;
181     uint16_t root_entries;
182     uint16_t total_sectors16;
183     uint8_t media_type;
184     uint16_t sectors_per_fat;
185     uint16_t sectors_per_track;
186     uint16_t number_of_heads;
187     uint32_t hidden_sectors;
188     uint32_t total_sectors;
189     union {
190         struct {
191             uint8_t drive_number;
192             uint8_t reserved1;
193             uint8_t signature;
194             uint32_t id;
195             uint8_t volume_label[11];
196             uint8_t fat_type[8];
197             uint8_t ignored[0x1c0];
198         } QEMU_PACKED fat16;
199         struct {
200             uint32_t sectors_per_fat;
201             uint16_t flags;
202             uint8_t major,minor;
203             uint32_t first_cluster_of_root_dir;
204             uint16_t info_sector;
205             uint16_t backup_boot_sector;
206             uint8_t reserved[12];
207             uint8_t drive_number;
208             uint8_t reserved1;
209             uint8_t signature;
210             uint32_t id;
211             uint8_t volume_label[11];
212             uint8_t fat_type[8];
213             uint8_t ignored[0x1a4];
214         } QEMU_PACKED fat32;
215     } u;
216     uint8_t magic[2];
217 } QEMU_PACKED bootsector_t;
218 
219 typedef struct {
220     uint8_t head;
221     uint8_t sector;
222     uint8_t cylinder;
223 } mbr_chs_t;
224 
225 typedef struct partition_t {
226     uint8_t attributes; /* 0x80 = bootable */
227     mbr_chs_t start_CHS;
228     uint8_t   fs_type; /* 0x1 = FAT12, 0x6 = FAT16, 0xe = FAT16_LBA, 0xb = FAT32, 0xc = FAT32_LBA */
229     mbr_chs_t end_CHS;
230     uint32_t start_sector_long;
231     uint32_t length_sector_long;
232 } QEMU_PACKED partition_t;
233 
234 typedef struct mbr_t {
235     uint8_t ignored[0x1b8];
236     uint32_t nt_id;
237     uint8_t ignored2[2];
238     partition_t partition[4];
239     uint8_t magic[2];
240 } QEMU_PACKED mbr_t;
241 
242 typedef struct direntry_t {
243     uint8_t name[8 + 3];
244     uint8_t attributes;
245     uint8_t reserved[2];
246     uint16_t ctime;
247     uint16_t cdate;
248     uint16_t adate;
249     uint16_t begin_hi;
250     uint16_t mtime;
251     uint16_t mdate;
252     uint16_t begin;
253     uint32_t size;
254 } QEMU_PACKED direntry_t;
255 
256 /* this structure are used to transparently access the files */
257 
258 typedef struct mapping_t {
259     /* begin is the first cluster, end is the last+1 */
260     uint32_t begin,end;
261     /* as s->directory is growable, no pointer may be used here */
262     unsigned int dir_index;
263     /* the clusters of a file may be in any order; this points to the first */
264     int first_mapping_index;
265     union {
266         /* offset is
267          * - the offset in the file (in clusters) for a file, or
268          * - the next cluster of the directory for a directory
269          */
270         struct {
271             uint32_t offset;
272         } file;
273         struct {
274             int parent_mapping_index;
275             int first_dir_index;
276         } dir;
277     } info;
278     /* path contains the full path, i.e. it always starts with s->path */
279     char* path;
280 
281     enum {
282         MODE_UNDEFINED = 0,
283         MODE_NORMAL = 1,
284         MODE_MODIFIED = 2,
285         MODE_DIRECTORY = 4,
286         MODE_DELETED = 8,
287     } mode;
288     int read_only;
289 } mapping_t;
290 
291 #ifdef DEBUG
292 static void print_direntry(const struct direntry_t*);
293 static void print_mapping(const struct mapping_t* mapping);
294 #endif
295 
296 /* here begins the real VVFAT driver */
297 
298 typedef struct BDRVVVFATState {
299     CoMutex lock;
300     BlockDriverState* bs; /* pointer to parent */
301     unsigned char first_sectors[0x40*0x200];
302 
303     int fat_type; /* 16 or 32 */
304     array_t fat,directory,mapping;
305     char volume_label[11];
306 
307     uint32_t offset_to_bootsector; /* 0 for floppy, 0x3f for disk */
308 
309     unsigned int cluster_size;
310     unsigned int sectors_per_cluster;
311     unsigned int sectors_per_fat;
312     uint32_t last_cluster_of_root_directory;
313     /* how many entries are available in root directory (0 for FAT32) */
314     uint16_t root_entries;
315     uint32_t sector_count; /* total number of sectors of the partition */
316     uint32_t cluster_count; /* total number of clusters of this partition */
317     uint32_t max_fat_value;
318     uint32_t offset_to_fat;
319     uint32_t offset_to_root_dir;
320 
321     int current_fd;
322     mapping_t* current_mapping;
323     unsigned char* cluster; /* points to current cluster */
324     unsigned char* cluster_buffer; /* points to a buffer to hold temp data */
325     unsigned int current_cluster;
326 
327     /* write support */
328     char* qcow_filename;
329     BdrvChild* qcow;
330     void* fat2;
331     char* used_clusters;
332     array_t commits;
333     const char* path;
334     int downcase_short_names;
335 
336     Error *migration_blocker;
337 } BDRVVVFATState;
338 
339 /* take the sector position spos and convert it to Cylinder/Head/Sector position
340  * if the position is outside the specified geometry, fill maximum value for CHS
341  * and return 1 to signal overflow.
342  */
343 static int sector2CHS(mbr_chs_t *chs, int spos, int cyls, int heads, int secs)
344 {
345     int head,sector;
346     sector   = spos % secs;  spos /= secs;
347     head     = spos % heads; spos /= heads;
348     if (spos >= cyls) {
349         /* Overflow,
350         it happens if 32bit sector positions are used, while CHS is only 24bit.
351         Windows/Dos is said to take 1023/255/63 as nonrepresentable CHS */
352         chs->head     = 0xFF;
353         chs->sector   = 0xFF;
354         chs->cylinder = 0xFF;
355         return 1;
356     }
357     chs->head     = (uint8_t)head;
358     chs->sector   = (uint8_t)( (sector+1) | ((spos>>8)<<6) );
359     chs->cylinder = (uint8_t)spos;
360     return 0;
361 }
362 
363 static void init_mbr(BDRVVVFATState *s, int cyls, int heads, int secs)
364 {
365     /* TODO: if the files mbr.img and bootsect.img exist, use them */
366     mbr_t* real_mbr=(mbr_t*)s->first_sectors;
367     partition_t* partition = &(real_mbr->partition[0]);
368     int lba;
369 
370     memset(s->first_sectors,0,512);
371 
372     /* Win NT Disk Signature */
373     real_mbr->nt_id= cpu_to_le32(0xbe1afdfa);
374 
375     partition->attributes=0x80; /* bootable */
376 
377     /* LBA is used when partition is outside the CHS geometry */
378     lba  = sector2CHS(&partition->start_CHS, s->offset_to_bootsector,
379                      cyls, heads, secs);
380     lba |= sector2CHS(&partition->end_CHS,   s->bs->total_sectors - 1,
381                      cyls, heads, secs);
382 
383     /*LBA partitions are identified only by start/length_sector_long not by CHS*/
384     partition->start_sector_long  = cpu_to_le32(s->offset_to_bootsector);
385     partition->length_sector_long = cpu_to_le32(s->bs->total_sectors
386                                                 - s->offset_to_bootsector);
387 
388     /* FAT12/FAT16/FAT32 */
389     /* DOS uses different types when partition is LBA,
390        probably to prevent older versions from using CHS on them */
391     partition->fs_type = s->fat_type == 12 ? 0x1 :
392                          s->fat_type == 16 ? (lba ? 0xe : 0x06) :
393                        /*s->fat_type == 32*/ (lba ? 0xc : 0x0b);
394 
395     real_mbr->magic[0]=0x55; real_mbr->magic[1]=0xaa;
396 }
397 
398 /* direntry functions */
399 
400 static direntry_t *create_long_filename(BDRVVVFATState *s, const char *filename)
401 {
402     int number_of_entries, i;
403     glong length;
404     direntry_t *entry;
405 
406     gunichar2 *longname = g_utf8_to_utf16(filename, -1, NULL, &length, NULL);
407     if (!longname) {
408         fprintf(stderr, "vvfat: invalid UTF-8 name: %s\n", filename);
409         return NULL;
410     }
411 
412     number_of_entries = DIV_ROUND_UP(length * 2, 26);
413 
414     for(i=0;i<number_of_entries;i++) {
415         entry=array_get_next(&(s->directory));
416         entry->attributes=0xf;
417         entry->reserved[0]=0;
418         entry->begin=0;
419         entry->name[0]=(number_of_entries-i)|(i==0?0x40:0);
420     }
421     for(i=0;i<26*number_of_entries;i++) {
422         int offset=(i%26);
423         if(offset<10) offset=1+offset;
424         else if(offset<22) offset=14+offset-10;
425         else offset=28+offset-22;
426         entry=array_get(&(s->directory),s->directory.next-1-(i/26));
427         if (i >= 2 * length + 2) {
428             entry->name[offset] = 0xff;
429         } else if (i % 2 == 0) {
430             entry->name[offset] = longname[i / 2] & 0xff;
431         } else {
432             entry->name[offset] = longname[i / 2] >> 8;
433         }
434     }
435     g_free(longname);
436     return array_get(&(s->directory),s->directory.next-number_of_entries);
437 }
438 
439 static char is_free(const direntry_t* direntry)
440 {
441     return direntry->name[0] == DIR_DELETED || direntry->name[0] == DIR_FREE;
442 }
443 
444 static char is_volume_label(const direntry_t* direntry)
445 {
446     return direntry->attributes == 0x28;
447 }
448 
449 static char is_long_name(const direntry_t* direntry)
450 {
451     return direntry->attributes == 0xf;
452 }
453 
454 static char is_short_name(const direntry_t* direntry)
455 {
456     return !is_volume_label(direntry) && !is_long_name(direntry)
457         && !is_free(direntry);
458 }
459 
460 static char is_directory(const direntry_t* direntry)
461 {
462     return direntry->attributes & 0x10 && direntry->name[0] != DIR_DELETED;
463 }
464 
465 static inline char is_dot(const direntry_t* direntry)
466 {
467     return is_short_name(direntry) && direntry->name[0] == '.';
468 }
469 
470 static char is_file(const direntry_t* direntry)
471 {
472     return is_short_name(direntry) && !is_directory(direntry);
473 }
474 
475 static inline uint32_t begin_of_direntry(const direntry_t* direntry)
476 {
477     return le16_to_cpu(direntry->begin)|(le16_to_cpu(direntry->begin_hi)<<16);
478 }
479 
480 static inline uint32_t filesize_of_direntry(const direntry_t* direntry)
481 {
482     return le32_to_cpu(direntry->size);
483 }
484 
485 static void set_begin_of_direntry(direntry_t* direntry, uint32_t begin)
486 {
487     direntry->begin = cpu_to_le16(begin & 0xffff);
488     direntry->begin_hi = cpu_to_le16((begin >> 16) & 0xffff);
489 }
490 
491 static bool valid_filename(const unsigned char *name)
492 {
493     unsigned char c;
494     if (!strcmp((const char*)name, ".") || !strcmp((const char*)name, "..")) {
495         return false;
496     }
497     for (; (c = *name); name++) {
498         if (!((c >= '0' && c <= '9') ||
499               (c >= 'A' && c <= 'Z') ||
500               (c >= 'a' && c <= 'z') ||
501               c > 127 ||
502               strchr("$%'-_@~`!(){}^#&.+,;=[]", c) != NULL))
503         {
504             return false;
505         }
506     }
507     return true;
508 }
509 
510 static uint8_t to_valid_short_char(gunichar c)
511 {
512     c = g_unichar_toupper(c);
513     if ((c >= '0' && c <= '9') ||
514         (c >= 'A' && c <= 'Z') ||
515         strchr("$%'-_@~`!(){}^#&", c) != NULL) {
516         return c;
517     } else {
518         return 0;
519     }
520 }
521 
522 static direntry_t *create_short_filename(BDRVVVFATState *s,
523                                          const char *filename,
524                                          unsigned int directory_start)
525 {
526     int i, j = 0;
527     direntry_t *entry = array_get_next(&(s->directory));
528     const gchar *p, *last_dot = NULL;
529     gunichar c;
530     bool lossy_conversion = false;
531     char tail[8];
532 
533     if (!entry) {
534         return NULL;
535     }
536     memset(entry->name, 0x20, sizeof(entry->name));
537 
538     /* copy filename and search last dot */
539     for (p = filename; ; p = g_utf8_next_char(p)) {
540         c = g_utf8_get_char(p);
541         if (c == '\0') {
542             break;
543         } else if (c == '.') {
544             if (j == 0) {
545                 /* '.' at start of filename */
546                 lossy_conversion = true;
547             } else {
548                 if (last_dot) {
549                     lossy_conversion = true;
550                 }
551                 last_dot = p;
552             }
553         } else if (!last_dot) {
554             /* first part of the name; copy it */
555             uint8_t v = to_valid_short_char(c);
556             if (j < 8 && v) {
557                 entry->name[j++] = v;
558             } else {
559                 lossy_conversion = true;
560             }
561         }
562     }
563 
564     /* copy extension (if any) */
565     if (last_dot) {
566         j = 0;
567         for (p = g_utf8_next_char(last_dot); ; p = g_utf8_next_char(p)) {
568             c = g_utf8_get_char(p);
569             if (c == '\0') {
570                 break;
571             } else {
572                 /* extension; copy it */
573                 uint8_t v = to_valid_short_char(c);
574                 if (j < 3 && v) {
575                     entry->name[8 + (j++)] = v;
576                 } else {
577                     lossy_conversion = true;
578                 }
579             }
580         }
581     }
582 
583     if (entry->name[0] == DIR_KANJI) {
584         entry->name[0] = DIR_KANJI_FAKE;
585     }
586 
587     /* numeric-tail generation */
588     for (j = 0; j < 8; j++) {
589         if (entry->name[j] == ' ') {
590             break;
591         }
592     }
593     for (i = lossy_conversion ? 1 : 0; i < 999999; i++) {
594         direntry_t *entry1;
595         if (i > 0) {
596             int len = snprintf(tail, sizeof(tail), "~%u", (unsigned)i);
597             assert(len <= 7);
598             memcpy(entry->name + MIN(j, 8 - len), tail, len);
599         }
600         for (entry1 = array_get(&(s->directory), directory_start);
601              entry1 < entry; entry1++) {
602             if (!is_long_name(entry1) &&
603                 !memcmp(entry1->name, entry->name, 11)) {
604                 break; /* found dupe */
605             }
606         }
607         if (entry1 == entry) {
608             /* no dupe found */
609             return entry;
610         }
611     }
612     return NULL;
613 }
614 
615 /* fat functions */
616 
617 static inline uint8_t fat_chksum(const direntry_t* entry)
618 {
619     uint8_t chksum=0;
620     int i;
621 
622     for (i = 0; i < ARRAY_SIZE(entry->name); i++) {
623         chksum = (((chksum & 0xfe) >> 1) |
624                   ((chksum & 0x01) ? 0x80 : 0)) + entry->name[i];
625     }
626 
627     return chksum;
628 }
629 
630 /* if return_time==0, this returns the fat_date, else the fat_time */
631 static uint16_t fat_datetime(time_t time,int return_time) {
632     struct tm* t;
633     struct tm t1;
634     t = &t1;
635     localtime_r(&time,t);
636     if(return_time)
637         return cpu_to_le16((t->tm_sec/2)|(t->tm_min<<5)|(t->tm_hour<<11));
638     return cpu_to_le16((t->tm_mday)|((t->tm_mon+1)<<5)|((t->tm_year-80)<<9));
639 }
640 
641 static inline void fat_set(BDRVVVFATState* s,unsigned int cluster,uint32_t value)
642 {
643     if(s->fat_type==32) {
644         uint32_t* entry=array_get(&(s->fat),cluster);
645         *entry=cpu_to_le32(value);
646     } else if(s->fat_type==16) {
647         uint16_t* entry=array_get(&(s->fat),cluster);
648         *entry=cpu_to_le16(value&0xffff);
649     } else {
650         int offset = (cluster*3/2);
651         unsigned char* p = array_get(&(s->fat), offset);
652         switch (cluster&1) {
653         case 0:
654                 p[0] = value&0xff;
655                 p[1] = (p[1]&0xf0) | ((value>>8)&0xf);
656                 break;
657         case 1:
658                 p[0] = (p[0]&0xf) | ((value&0xf)<<4);
659                 p[1] = (value>>4);
660                 break;
661         }
662     }
663 }
664 
665 static inline uint32_t fat_get(BDRVVVFATState* s,unsigned int cluster)
666 {
667     if(s->fat_type==32) {
668         uint32_t* entry=array_get(&(s->fat),cluster);
669         return le32_to_cpu(*entry);
670     } else if(s->fat_type==16) {
671         uint16_t* entry=array_get(&(s->fat),cluster);
672         return le16_to_cpu(*entry);
673     } else {
674         const uint8_t* x=(uint8_t*)(s->fat.pointer)+cluster*3/2;
675         return ((x[0]|(x[1]<<8))>>(cluster&1?4:0))&0x0fff;
676     }
677 }
678 
679 static inline int fat_eof(BDRVVVFATState* s,uint32_t fat_entry)
680 {
681     if(fat_entry>s->max_fat_value-8)
682         return -1;
683     return 0;
684 }
685 
686 static inline void init_fat(BDRVVVFATState* s)
687 {
688     if (s->fat_type == 12) {
689         array_init(&(s->fat),1);
690         array_ensure_allocated(&(s->fat),
691                 s->sectors_per_fat * 0x200 * 3 / 2 - 1);
692     } else {
693         array_init(&(s->fat),(s->fat_type==32?4:2));
694         array_ensure_allocated(&(s->fat),
695                 s->sectors_per_fat * 0x200 / s->fat.item_size - 1);
696     }
697     memset(s->fat.pointer,0,s->fat.size);
698 
699     switch(s->fat_type) {
700         case 12: s->max_fat_value=0xfff; break;
701         case 16: s->max_fat_value=0xffff; break;
702         case 32: s->max_fat_value=0x0fffffff; break;
703         default: s->max_fat_value=0; /* error... */
704     }
705 
706 }
707 
708 static inline direntry_t* create_short_and_long_name(BDRVVVFATState* s,
709         unsigned int directory_start, const char* filename, int is_dot)
710 {
711     int long_index = s->directory.next;
712     direntry_t* entry = NULL;
713     direntry_t* entry_long = NULL;
714 
715     if(is_dot) {
716         entry=array_get_next(&(s->directory));
717         memset(entry->name, 0x20, sizeof(entry->name));
718         memcpy(entry->name,filename,strlen(filename));
719         return entry;
720     }
721 
722     entry_long=create_long_filename(s,filename);
723     entry = create_short_filename(s, filename, directory_start);
724 
725     /* calculate checksum; propagate to long name */
726     if(entry_long) {
727         uint8_t chksum=fat_chksum(entry);
728 
729         /* calculate anew, because realloc could have taken place */
730         entry_long=array_get(&(s->directory),long_index);
731         while(entry_long<entry && is_long_name(entry_long)) {
732             entry_long->reserved[1]=chksum;
733             entry_long++;
734         }
735     }
736 
737     return entry;
738 }
739 
740 /*
741  * Read a directory. (the index of the corresponding mapping must be passed).
742  */
743 static int read_directory(BDRVVVFATState* s, int mapping_index)
744 {
745     mapping_t* mapping = array_get(&(s->mapping), mapping_index);
746     direntry_t* direntry;
747     const char* dirname = mapping->path;
748     int first_cluster = mapping->begin;
749     int parent_index = mapping->info.dir.parent_mapping_index;
750     mapping_t* parent_mapping = (mapping_t*)
751         (parent_index >= 0 ? array_get(&(s->mapping), parent_index) : NULL);
752     int first_cluster_of_parent = parent_mapping ? parent_mapping->begin : -1;
753 
754     DIR* dir=opendir(dirname);
755     struct dirent* entry;
756     int i;
757 
758     assert(mapping->mode & MODE_DIRECTORY);
759 
760     if(!dir) {
761         mapping->end = mapping->begin;
762         return -1;
763     }
764 
765     i = mapping->info.dir.first_dir_index =
766             first_cluster == 0 ? 0 : s->directory.next;
767 
768     if (first_cluster != 0) {
769         /* create the top entries of a subdirectory */
770         (void)create_short_and_long_name(s, i, ".", 1);
771         (void)create_short_and_long_name(s, i, "..", 1);
772     }
773 
774     /* actually read the directory, and allocate the mappings */
775     while((entry=readdir(dir))) {
776         unsigned int length=strlen(dirname)+2+strlen(entry->d_name);
777         char* buffer;
778         direntry_t* direntry;
779         struct stat st;
780         int is_dot=!strcmp(entry->d_name,".");
781         int is_dotdot=!strcmp(entry->d_name,"..");
782 
783         if (first_cluster == 0 && s->directory.next >= s->root_entries - 1) {
784             fprintf(stderr, "Too many entries in root directory\n");
785             closedir(dir);
786             return -2;
787         }
788 
789         if(first_cluster == 0 && (is_dotdot || is_dot))
790             continue;
791 
792         buffer = g_malloc(length);
793         snprintf(buffer,length,"%s/%s",dirname,entry->d_name);
794 
795         if(stat(buffer,&st)<0) {
796             g_free(buffer);
797             continue;
798         }
799 
800         /* create directory entry for this file */
801         if (!is_dot && !is_dotdot) {
802             direntry = create_short_and_long_name(s, i, entry->d_name, 0);
803         } else {
804             direntry = array_get(&(s->directory), is_dot ? i : i + 1);
805         }
806         direntry->attributes=(S_ISDIR(st.st_mode)?0x10:0x20);
807         direntry->reserved[0]=direntry->reserved[1]=0;
808         direntry->ctime=fat_datetime(st.st_ctime,1);
809         direntry->cdate=fat_datetime(st.st_ctime,0);
810         direntry->adate=fat_datetime(st.st_atime,0);
811         direntry->begin_hi=0;
812         direntry->mtime=fat_datetime(st.st_mtime,1);
813         direntry->mdate=fat_datetime(st.st_mtime,0);
814         if(is_dotdot)
815             set_begin_of_direntry(direntry, first_cluster_of_parent);
816         else if(is_dot)
817             set_begin_of_direntry(direntry, first_cluster);
818         else
819             direntry->begin=0; /* do that later */
820         if (st.st_size > 0x7fffffff) {
821             fprintf(stderr, "File %s is larger than 2GB\n", buffer);
822             g_free(buffer);
823             closedir(dir);
824             return -2;
825         }
826         direntry->size=cpu_to_le32(S_ISDIR(st.st_mode)?0:st.st_size);
827 
828         /* create mapping for this file */
829         if(!is_dot && !is_dotdot && (S_ISDIR(st.st_mode) || st.st_size)) {
830             s->current_mapping = array_get_next(&(s->mapping));
831             s->current_mapping->begin=0;
832             s->current_mapping->end=st.st_size;
833             /*
834              * we get the direntry of the most recent direntry, which
835              * contains the short name and all the relevant information.
836              */
837             s->current_mapping->dir_index=s->directory.next-1;
838             s->current_mapping->first_mapping_index = -1;
839             if (S_ISDIR(st.st_mode)) {
840                 s->current_mapping->mode = MODE_DIRECTORY;
841                 s->current_mapping->info.dir.parent_mapping_index =
842                     mapping_index;
843             } else {
844                 s->current_mapping->mode = MODE_UNDEFINED;
845                 s->current_mapping->info.file.offset = 0;
846             }
847             s->current_mapping->path=buffer;
848             s->current_mapping->read_only =
849                 (st.st_mode & (S_IWUSR | S_IWGRP | S_IWOTH)) == 0;
850         } else {
851             g_free(buffer);
852         }
853     }
854     closedir(dir);
855 
856     /* fill with zeroes up to the end of the cluster */
857     while(s->directory.next%(0x10*s->sectors_per_cluster)) {
858         direntry_t* direntry=array_get_next(&(s->directory));
859         memset(direntry,0,sizeof(direntry_t));
860     }
861 
862     if (s->fat_type != 32 &&
863         mapping_index == 0 &&
864         s->directory.next < s->root_entries) {
865         /* root directory */
866         int cur = s->directory.next;
867         array_ensure_allocated(&(s->directory), s->root_entries - 1);
868         s->directory.next = s->root_entries;
869         memset(array_get(&(s->directory), cur), 0,
870                 (s->root_entries - cur) * sizeof(direntry_t));
871     }
872 
873     /* re-get the mapping, since s->mapping was possibly realloc()ed */
874     mapping = array_get(&(s->mapping), mapping_index);
875     first_cluster += (s->directory.next - mapping->info.dir.first_dir_index)
876         * 0x20 / s->cluster_size;
877     mapping->end = first_cluster;
878 
879     direntry = array_get(&(s->directory), mapping->dir_index);
880     set_begin_of_direntry(direntry, mapping->begin);
881 
882     return 0;
883 }
884 
885 static inline int32_t sector2cluster(BDRVVVFATState* s,off_t sector_num)
886 {
887     return (sector_num - s->offset_to_root_dir) / s->sectors_per_cluster;
888 }
889 
890 static inline off_t cluster2sector(BDRVVVFATState* s, uint32_t cluster_num)
891 {
892     return s->offset_to_root_dir + s->sectors_per_cluster * cluster_num;
893 }
894 
895 static int init_directories(BDRVVVFATState* s,
896                             const char *dirname, int heads, int secs,
897                             Error **errp)
898 {
899     bootsector_t* bootsector;
900     mapping_t* mapping;
901     unsigned int i;
902     unsigned int cluster;
903 
904     memset(&(s->first_sectors[0]),0,0x40*0x200);
905 
906     s->cluster_size=s->sectors_per_cluster*0x200;
907     s->cluster_buffer=g_malloc(s->cluster_size);
908 
909     /*
910      * The formula: sc = spf+1+spf*spc*(512*8/fat_type),
911      * where sc is sector_count,
912      * spf is sectors_per_fat,
913      * spc is sectors_per_clusters, and
914      * fat_type = 12, 16 or 32.
915      */
916     i = 1+s->sectors_per_cluster*0x200*8/s->fat_type;
917     s->sectors_per_fat=(s->sector_count+i)/i; /* round up */
918 
919     s->offset_to_fat = s->offset_to_bootsector + 1;
920     s->offset_to_root_dir = s->offset_to_fat + s->sectors_per_fat * 2;
921 
922     array_init(&(s->mapping),sizeof(mapping_t));
923     array_init(&(s->directory),sizeof(direntry_t));
924 
925     /* add volume label */
926     {
927         direntry_t* entry=array_get_next(&(s->directory));
928         entry->attributes=0x28; /* archive | volume label */
929         memcpy(entry->name, s->volume_label, sizeof(entry->name));
930     }
931 
932     /* Now build FAT, and write back information into directory */
933     init_fat(s);
934 
935     /* TODO: if there are more entries, bootsector has to be adjusted! */
936     s->root_entries = 0x02 * 0x10 * s->sectors_per_cluster;
937     s->cluster_count=sector2cluster(s, s->sector_count);
938 
939     mapping = array_get_next(&(s->mapping));
940     mapping->begin = 0;
941     mapping->dir_index = 0;
942     mapping->info.dir.parent_mapping_index = -1;
943     mapping->first_mapping_index = -1;
944     mapping->path = g_strdup(dirname);
945     i = strlen(mapping->path);
946     if (i > 0 && mapping->path[i - 1] == '/')
947         mapping->path[i - 1] = '\0';
948     mapping->mode = MODE_DIRECTORY;
949     mapping->read_only = 0;
950     s->path = mapping->path;
951 
952     for (i = 0, cluster = 0; i < s->mapping.next; i++) {
953         /* MS-DOS expects the FAT to be 0 for the root directory
954          * (except for the media byte). */
955         /* LATER TODO: still true for FAT32? */
956         int fix_fat = (i != 0);
957         mapping = array_get(&(s->mapping), i);
958 
959         if (mapping->mode & MODE_DIRECTORY) {
960             char *path = mapping->path;
961             mapping->begin = cluster;
962             if(read_directory(s, i)) {
963                 error_setg(errp, "Could not read directory %s", path);
964                 return -1;
965             }
966             mapping = array_get(&(s->mapping), i);
967         } else {
968             assert(mapping->mode == MODE_UNDEFINED);
969             mapping->mode=MODE_NORMAL;
970             mapping->begin = cluster;
971             if (mapping->end > 0) {
972                 direntry_t* direntry = array_get(&(s->directory),
973                         mapping->dir_index);
974 
975                 mapping->end = cluster + 1 + (mapping->end-1)/s->cluster_size;
976                 set_begin_of_direntry(direntry, mapping->begin);
977             } else {
978                 mapping->end = cluster + 1;
979                 fix_fat = 0;
980             }
981         }
982 
983         assert(mapping->begin < mapping->end);
984 
985         /* next free cluster */
986         cluster = mapping->end;
987 
988         if(cluster > s->cluster_count) {
989             error_setg(errp,
990                        "Directory does not fit in FAT%d (capacity %.2f MB)",
991                        s->fat_type, s->sector_count / 2000.0);
992             return -1;
993         }
994 
995         /* fix fat for entry */
996         if (fix_fat) {
997             int j;
998             for(j = mapping->begin; j < mapping->end - 1; j++)
999                 fat_set(s, j, j+1);
1000             fat_set(s, mapping->end - 1, s->max_fat_value);
1001         }
1002     }
1003 
1004     mapping = array_get(&(s->mapping), 0);
1005     s->last_cluster_of_root_directory = mapping->end;
1006 
1007     /* the FAT signature */
1008     fat_set(s,0,s->max_fat_value);
1009     fat_set(s,1,s->max_fat_value);
1010 
1011     s->current_mapping = NULL;
1012 
1013     bootsector = (bootsector_t *)(s->first_sectors
1014                                   + s->offset_to_bootsector * 0x200);
1015     bootsector->jump[0]=0xeb;
1016     bootsector->jump[1]=0x3e;
1017     bootsector->jump[2]=0x90;
1018     memcpy(bootsector->name, BOOTSECTOR_OEM_NAME, 8);
1019     bootsector->sector_size=cpu_to_le16(0x200);
1020     bootsector->sectors_per_cluster=s->sectors_per_cluster;
1021     bootsector->reserved_sectors=cpu_to_le16(1);
1022     bootsector->number_of_fats=0x2; /* number of FATs */
1023     bootsector->root_entries = cpu_to_le16(s->root_entries);
1024     bootsector->total_sectors16=s->sector_count>0xffff?0:cpu_to_le16(s->sector_count);
1025     /* media descriptor: hard disk=0xf8, floppy=0xf0 */
1026     bootsector->media_type = (s->offset_to_bootsector > 0 ? 0xf8 : 0xf0);
1027     s->fat.pointer[0] = bootsector->media_type;
1028     bootsector->sectors_per_fat=cpu_to_le16(s->sectors_per_fat);
1029     bootsector->sectors_per_track = cpu_to_le16(secs);
1030     bootsector->number_of_heads = cpu_to_le16(heads);
1031     bootsector->hidden_sectors = cpu_to_le32(s->offset_to_bootsector);
1032     bootsector->total_sectors=cpu_to_le32(s->sector_count>0xffff?s->sector_count:0);
1033 
1034     /* LATER TODO: if FAT32, this is wrong */
1035     /* drive_number: fda=0, hda=0x80 */
1036     bootsector->u.fat16.drive_number = s->offset_to_bootsector == 0 ? 0 : 0x80;
1037     bootsector->u.fat16.signature=0x29;
1038     bootsector->u.fat16.id=cpu_to_le32(0xfabe1afd);
1039 
1040     memcpy(bootsector->u.fat16.volume_label, s->volume_label,
1041            sizeof(bootsector->u.fat16.volume_label));
1042     memcpy(bootsector->u.fat16.fat_type,
1043            s->fat_type == 12 ? "FAT12   " : "FAT16   ", 8);
1044     bootsector->magic[0]=0x55; bootsector->magic[1]=0xaa;
1045 
1046     return 0;
1047 }
1048 
1049 #ifdef DEBUG
1050 static BDRVVVFATState *vvv = NULL;
1051 #endif
1052 
1053 static int enable_write_target(BlockDriverState *bs, Error **errp);
1054 static int is_consistent(BDRVVVFATState *s);
1055 
1056 static QemuOptsList runtime_opts = {
1057     .name = "vvfat",
1058     .head = QTAILQ_HEAD_INITIALIZER(runtime_opts.head),
1059     .desc = {
1060         {
1061             .name = "dir",
1062             .type = QEMU_OPT_STRING,
1063             .help = "Host directory to map to the vvfat device",
1064         },
1065         {
1066             .name = "fat-type",
1067             .type = QEMU_OPT_NUMBER,
1068             .help = "FAT type (12, 16 or 32)",
1069         },
1070         {
1071             .name = "floppy",
1072             .type = QEMU_OPT_BOOL,
1073             .help = "Create a floppy rather than a hard disk image",
1074         },
1075         {
1076             .name = "label",
1077             .type = QEMU_OPT_STRING,
1078             .help = "Use a volume label other than QEMU VVFAT",
1079         },
1080         {
1081             .name = "rw",
1082             .type = QEMU_OPT_BOOL,
1083             .help = "Make the image writable",
1084         },
1085         { /* end of list */ }
1086     },
1087 };
1088 
1089 static void vvfat_parse_filename(const char *filename, QDict *options,
1090                                  Error **errp)
1091 {
1092     int fat_type = 0;
1093     bool floppy = false;
1094     bool rw = false;
1095     int i;
1096 
1097     if (!strstart(filename, "fat:", NULL)) {
1098         error_setg(errp, "File name string must start with 'fat:'");
1099         return;
1100     }
1101 
1102     /* Parse options */
1103     if (strstr(filename, ":32:")) {
1104         fat_type = 32;
1105     } else if (strstr(filename, ":16:")) {
1106         fat_type = 16;
1107     } else if (strstr(filename, ":12:")) {
1108         fat_type = 12;
1109     }
1110 
1111     if (strstr(filename, ":floppy:")) {
1112         floppy = true;
1113     }
1114 
1115     if (strstr(filename, ":rw:")) {
1116         rw = true;
1117     }
1118 
1119     /* Get the directory name without options */
1120     i = strrchr(filename, ':') - filename;
1121     assert(i >= 3);
1122     if (filename[i - 2] == ':' && qemu_isalpha(filename[i - 1])) {
1123         /* workaround for DOS drive names */
1124         filename += i - 1;
1125     } else {
1126         filename += i + 1;
1127     }
1128 
1129     /* Fill in the options QDict */
1130     qdict_put_str(options, "dir", filename);
1131     qdict_put_int(options, "fat-type", fat_type);
1132     qdict_put_bool(options, "floppy", floppy);
1133     qdict_put_bool(options, "rw", rw);
1134 }
1135 
1136 static int vvfat_open(BlockDriverState *bs, QDict *options, int flags,
1137                       Error **errp)
1138 {
1139     BDRVVVFATState *s = bs->opaque;
1140     int cyls, heads, secs;
1141     bool floppy;
1142     const char *dirname, *label;
1143     QemuOpts *opts;
1144     int ret;
1145 
1146 #ifdef DEBUG
1147     vvv = s;
1148 #endif
1149 
1150     opts = qemu_opts_create(&runtime_opts, NULL, 0, &error_abort);
1151     if (!qemu_opts_absorb_qdict(opts, options, errp)) {
1152         ret = -EINVAL;
1153         goto fail;
1154     }
1155 
1156     dirname = qemu_opt_get(opts, "dir");
1157     if (!dirname) {
1158         error_setg(errp, "vvfat block driver requires a 'dir' option");
1159         ret = -EINVAL;
1160         goto fail;
1161     }
1162 
1163     s->fat_type = qemu_opt_get_number(opts, "fat-type", 0);
1164     floppy = qemu_opt_get_bool(opts, "floppy", false);
1165 
1166     memset(s->volume_label, ' ', sizeof(s->volume_label));
1167     label = qemu_opt_get(opts, "label");
1168     if (label) {
1169         size_t label_length = strlen(label);
1170         if (label_length > 11) {
1171             error_setg(errp, "vvfat label cannot be longer than 11 bytes");
1172             ret = -EINVAL;
1173             goto fail;
1174         }
1175         memcpy(s->volume_label, label, label_length);
1176     } else {
1177         memcpy(s->volume_label, "QEMU VVFAT", 10);
1178     }
1179 
1180     if (floppy) {
1181         /* 1.44MB or 2.88MB floppy.  2.88MB can be FAT12 (default) or FAT16. */
1182         if (!s->fat_type) {
1183             s->fat_type = 12;
1184             secs = 36;
1185             s->sectors_per_cluster = 2;
1186         } else {
1187             secs = s->fat_type == 12 ? 18 : 36;
1188             s->sectors_per_cluster = 1;
1189         }
1190         cyls = 80;
1191         heads = 2;
1192     } else {
1193         /* 32MB or 504MB disk*/
1194         if (!s->fat_type) {
1195             s->fat_type = 16;
1196         }
1197         s->offset_to_bootsector = 0x3f;
1198         cyls = s->fat_type == 12 ? 64 : 1024;
1199         heads = 16;
1200         secs = 63;
1201     }
1202 
1203     switch (s->fat_type) {
1204     case 32:
1205         warn_report("FAT32 has not been tested. You are welcome to do so!");
1206         break;
1207     case 16:
1208     case 12:
1209         break;
1210     default:
1211         error_setg(errp, "Valid FAT types are only 12, 16 and 32");
1212         ret = -EINVAL;
1213         goto fail;
1214     }
1215 
1216 
1217     s->bs = bs;
1218 
1219     /* LATER TODO: if FAT32, adjust */
1220     s->sectors_per_cluster=0x10;
1221 
1222     s->current_cluster=0xffffffff;
1223 
1224     s->qcow = NULL;
1225     s->qcow_filename = NULL;
1226     s->fat2 = NULL;
1227     s->downcase_short_names = 1;
1228 
1229     DLOG(fprintf(stderr, "vvfat %s chs %d,%d,%d\n",
1230                  dirname, cyls, heads, secs));
1231 
1232     s->sector_count = cyls * heads * secs - s->offset_to_bootsector;
1233     bs->total_sectors = cyls * heads * secs;
1234 
1235     if (qemu_opt_get_bool(opts, "rw", false)) {
1236         if (!bdrv_is_read_only(bs)) {
1237             ret = enable_write_target(bs, errp);
1238             if (ret < 0) {
1239                 goto fail;
1240             }
1241         } else {
1242             ret = -EPERM;
1243             error_setg(errp,
1244                        "Unable to set VVFAT to 'rw' when drive is read-only");
1245             goto fail;
1246         }
1247     } else {
1248         ret = bdrv_apply_auto_read_only(bs, NULL, errp);
1249         if (ret < 0) {
1250             goto fail;
1251         }
1252     }
1253 
1254     if (init_directories(s, dirname, heads, secs, errp)) {
1255         ret = -EIO;
1256         goto fail;
1257     }
1258 
1259     s->sector_count = s->offset_to_root_dir
1260                     + s->sectors_per_cluster * s->cluster_count;
1261 
1262     /* Disable migration when vvfat is used rw */
1263     if (s->qcow) {
1264         error_setg(&s->migration_blocker,
1265                    "The vvfat (rw) format used by node '%s' "
1266                    "does not support live migration",
1267                    bdrv_get_device_or_node_name(bs));
1268         ret = migrate_add_blocker(s->migration_blocker, errp);
1269         if (ret < 0) {
1270             error_free(s->migration_blocker);
1271             goto fail;
1272         }
1273     }
1274 
1275     if (s->offset_to_bootsector > 0) {
1276         init_mbr(s, cyls, heads, secs);
1277     }
1278 
1279     qemu_co_mutex_init(&s->lock);
1280 
1281     qemu_opts_del(opts);
1282 
1283     return 0;
1284 
1285 fail:
1286     g_free(s->qcow_filename);
1287     s->qcow_filename = NULL;
1288     g_free(s->cluster_buffer);
1289     s->cluster_buffer = NULL;
1290     g_free(s->used_clusters);
1291     s->used_clusters = NULL;
1292 
1293     qemu_opts_del(opts);
1294     return ret;
1295 }
1296 
1297 static void vvfat_refresh_limits(BlockDriverState *bs, Error **errp)
1298 {
1299     bs->bl.request_alignment = BDRV_SECTOR_SIZE; /* No sub-sector I/O */
1300 }
1301 
1302 static inline void vvfat_close_current_file(BDRVVVFATState *s)
1303 {
1304     if(s->current_mapping) {
1305         s->current_mapping = NULL;
1306         if (s->current_fd) {
1307                 qemu_close(s->current_fd);
1308                 s->current_fd = 0;
1309         }
1310     }
1311     s->current_cluster = -1;
1312 }
1313 
1314 /* mappings between index1 and index2-1 are supposed to be ordered
1315  * return value is the index of the last mapping for which end>cluster_num
1316  */
1317 static inline int find_mapping_for_cluster_aux(BDRVVVFATState* s,int cluster_num,int index1,int index2)
1318 {
1319     while(1) {
1320         int index3;
1321         mapping_t* mapping;
1322         index3=(index1+index2)/2;
1323         mapping=array_get(&(s->mapping),index3);
1324         assert(mapping->begin < mapping->end);
1325         if(mapping->begin>=cluster_num) {
1326             assert(index2!=index3 || index2==0);
1327             if(index2==index3)
1328                 return index1;
1329             index2=index3;
1330         } else {
1331             if(index1==index3)
1332                 return mapping->end<=cluster_num ? index2 : index1;
1333             index1=index3;
1334         }
1335         assert(index1<=index2);
1336         DLOG(mapping=array_get(&(s->mapping),index1);
1337         assert(mapping->begin<=cluster_num);
1338         assert(index2 >= s->mapping.next ||
1339                 ((mapping = array_get(&(s->mapping),index2)) &&
1340                 mapping->end>cluster_num)));
1341     }
1342 }
1343 
1344 static inline mapping_t* find_mapping_for_cluster(BDRVVVFATState* s,int cluster_num)
1345 {
1346     int index=find_mapping_for_cluster_aux(s,cluster_num,0,s->mapping.next);
1347     mapping_t* mapping;
1348     if(index>=s->mapping.next)
1349         return NULL;
1350     mapping=array_get(&(s->mapping),index);
1351     if(mapping->begin>cluster_num)
1352         return NULL;
1353     assert(mapping->begin<=cluster_num && mapping->end>cluster_num);
1354     return mapping;
1355 }
1356 
1357 static int open_file(BDRVVVFATState* s,mapping_t* mapping)
1358 {
1359     if(!mapping)
1360         return -1;
1361     if(!s->current_mapping ||
1362             strcmp(s->current_mapping->path,mapping->path)) {
1363         /* open file */
1364         int fd = qemu_open_old(mapping->path,
1365                                O_RDONLY | O_BINARY | O_LARGEFILE);
1366         if(fd<0)
1367             return -1;
1368         vvfat_close_current_file(s);
1369         s->current_fd = fd;
1370         s->current_mapping = mapping;
1371     }
1372     return 0;
1373 }
1374 
1375 static inline int read_cluster(BDRVVVFATState *s,int cluster_num)
1376 {
1377     if(s->current_cluster != cluster_num) {
1378         int result=0;
1379         off_t offset;
1380         assert(!s->current_mapping || s->current_fd || (s->current_mapping->mode & MODE_DIRECTORY));
1381         if(!s->current_mapping
1382                 || s->current_mapping->begin>cluster_num
1383                 || s->current_mapping->end<=cluster_num) {
1384             /* binary search of mappings for file */
1385             mapping_t* mapping=find_mapping_for_cluster(s,cluster_num);
1386 
1387             assert(!mapping || (cluster_num>=mapping->begin && cluster_num<mapping->end));
1388 
1389             if (mapping && mapping->mode & MODE_DIRECTORY) {
1390                 vvfat_close_current_file(s);
1391                 s->current_mapping = mapping;
1392 read_cluster_directory:
1393                 offset = s->cluster_size*(cluster_num-s->current_mapping->begin);
1394                 s->cluster = (unsigned char*)s->directory.pointer+offset
1395                         + 0x20*s->current_mapping->info.dir.first_dir_index;
1396                 assert(((s->cluster-(unsigned char*)s->directory.pointer)%s->cluster_size)==0);
1397                 assert((char*)s->cluster+s->cluster_size <= s->directory.pointer+s->directory.next*s->directory.item_size);
1398                 s->current_cluster = cluster_num;
1399                 return 0;
1400             }
1401 
1402             if(open_file(s,mapping))
1403                 return -2;
1404         } else if (s->current_mapping->mode & MODE_DIRECTORY)
1405             goto read_cluster_directory;
1406 
1407         assert(s->current_fd);
1408 
1409         offset=s->cluster_size*(cluster_num-s->current_mapping->begin)+s->current_mapping->info.file.offset;
1410         if(lseek(s->current_fd, offset, SEEK_SET)!=offset)
1411             return -3;
1412         s->cluster=s->cluster_buffer;
1413         result=read(s->current_fd,s->cluster,s->cluster_size);
1414         if(result<0) {
1415             s->current_cluster = -1;
1416             return -1;
1417         }
1418         s->current_cluster = cluster_num;
1419     }
1420     return 0;
1421 }
1422 
1423 #ifdef DEBUG
1424 static void print_direntry(const direntry_t* direntry)
1425 {
1426     int j = 0;
1427     char buffer[1024];
1428 
1429     fprintf(stderr, "direntry %p: ", direntry);
1430     if(!direntry)
1431         return;
1432     if(is_long_name(direntry)) {
1433         unsigned char* c=(unsigned char*)direntry;
1434         int i;
1435         for(i=1;i<11 && c[i] && c[i]!=0xff;i+=2)
1436 #define ADD_CHAR(c) {buffer[j] = (c); if (buffer[j] < ' ') buffer[j] = 0xb0; j++;}
1437             ADD_CHAR(c[i]);
1438         for(i=14;i<26 && c[i] && c[i]!=0xff;i+=2)
1439             ADD_CHAR(c[i]);
1440         for(i=28;i<32 && c[i] && c[i]!=0xff;i+=2)
1441             ADD_CHAR(c[i]);
1442         buffer[j] = 0;
1443         fprintf(stderr, "%s\n", buffer);
1444     } else {
1445         int i;
1446         for(i=0;i<11;i++)
1447             ADD_CHAR(direntry->name[i]);
1448         buffer[j] = 0;
1449         fprintf(stderr, "%s attributes=0x%02x begin=%u size=%u\n",
1450                 buffer,
1451                 direntry->attributes,
1452                 begin_of_direntry(direntry),le32_to_cpu(direntry->size));
1453     }
1454 }
1455 
1456 static void print_mapping(const mapping_t* mapping)
1457 {
1458     fprintf(stderr, "mapping (%p): begin, end = %u, %u, dir_index = %u, "
1459         "first_mapping_index = %d, name = %s, mode = 0x%x, " ,
1460         mapping, mapping->begin, mapping->end, mapping->dir_index,
1461         mapping->first_mapping_index, mapping->path, mapping->mode);
1462 
1463     if (mapping->mode & MODE_DIRECTORY)
1464         fprintf(stderr, "parent_mapping_index = %d, first_dir_index = %d\n", mapping->info.dir.parent_mapping_index, mapping->info.dir.first_dir_index);
1465     else
1466         fprintf(stderr, "offset = %u\n", mapping->info.file.offset);
1467 }
1468 #endif
1469 
1470 static int vvfat_read(BlockDriverState *bs, int64_t sector_num,
1471                     uint8_t *buf, int nb_sectors)
1472 {
1473     BDRVVVFATState *s = bs->opaque;
1474     int i;
1475 
1476     for(i=0;i<nb_sectors;i++,sector_num++) {
1477         if (sector_num >= bs->total_sectors)
1478            return -1;
1479         if (s->qcow) {
1480             int64_t n;
1481             int ret;
1482             ret = bdrv_is_allocated(s->qcow->bs, sector_num * BDRV_SECTOR_SIZE,
1483                                     (nb_sectors - i) * BDRV_SECTOR_SIZE, &n);
1484             if (ret < 0) {
1485                 return ret;
1486             }
1487             if (ret) {
1488                 DLOG(fprintf(stderr, "sectors %" PRId64 "+%" PRId64
1489                              " allocated\n", sector_num,
1490                              n >> BDRV_SECTOR_BITS));
1491                 if (bdrv_pread(s->qcow, sector_num * BDRV_SECTOR_SIZE, n,
1492                                buf + i * 0x200, 0) < 0) {
1493                     return -1;
1494                 }
1495                 i += (n >> BDRV_SECTOR_BITS) - 1;
1496                 sector_num += (n >> BDRV_SECTOR_BITS) - 1;
1497                 continue;
1498             }
1499             DLOG(fprintf(stderr, "sector %" PRId64 " not allocated\n",
1500                          sector_num));
1501         }
1502         if (sector_num < s->offset_to_root_dir) {
1503             if (sector_num < s->offset_to_fat) {
1504                 memcpy(buf + i * 0x200,
1505                        &(s->first_sectors[sector_num * 0x200]),
1506                        0x200);
1507             } else if (sector_num < s->offset_to_fat + s->sectors_per_fat) {
1508                 memcpy(buf + i * 0x200,
1509                        &(s->fat.pointer[(sector_num
1510                                        - s->offset_to_fat) * 0x200]),
1511                        0x200);
1512             } else if (sector_num < s->offset_to_root_dir) {
1513                 memcpy(buf + i * 0x200,
1514                        &(s->fat.pointer[(sector_num - s->offset_to_fat
1515                                        - s->sectors_per_fat) * 0x200]),
1516                        0x200);
1517             }
1518         } else {
1519             uint32_t sector = sector_num - s->offset_to_root_dir,
1520             sector_offset_in_cluster=(sector%s->sectors_per_cluster),
1521             cluster_num=sector/s->sectors_per_cluster;
1522             if(cluster_num > s->cluster_count || read_cluster(s, cluster_num) != 0) {
1523                 /* LATER TODO: strict: return -1; */
1524                 memset(buf+i*0x200,0,0x200);
1525                 continue;
1526             }
1527             memcpy(buf+i*0x200,s->cluster+sector_offset_in_cluster*0x200,0x200);
1528         }
1529     }
1530     return 0;
1531 }
1532 
1533 static int coroutine_fn
1534 vvfat_co_preadv(BlockDriverState *bs, int64_t offset, int64_t bytes,
1535                 QEMUIOVector *qiov, BdrvRequestFlags flags)
1536 {
1537     int ret;
1538     BDRVVVFATState *s = bs->opaque;
1539     uint64_t sector_num = offset >> BDRV_SECTOR_BITS;
1540     int nb_sectors = bytes >> BDRV_SECTOR_BITS;
1541     void *buf;
1542 
1543     assert(QEMU_IS_ALIGNED(offset, BDRV_SECTOR_SIZE));
1544     assert(QEMU_IS_ALIGNED(bytes, BDRV_SECTOR_SIZE));
1545 
1546     buf = g_try_malloc(bytes);
1547     if (bytes && buf == NULL) {
1548         return -ENOMEM;
1549     }
1550 
1551     qemu_co_mutex_lock(&s->lock);
1552     ret = vvfat_read(bs, sector_num, buf, nb_sectors);
1553     qemu_co_mutex_unlock(&s->lock);
1554 
1555     qemu_iovec_from_buf(qiov, 0, buf, bytes);
1556     g_free(buf);
1557 
1558     return ret;
1559 }
1560 
1561 /* LATER TODO: statify all functions */
1562 
1563 /*
1564  * Idea of the write support (use snapshot):
1565  *
1566  * 1. check if all data is consistent, recording renames, modifications,
1567  *    new files and directories (in s->commits).
1568  *
1569  * 2. if the data is not consistent, stop committing
1570  *
1571  * 3. handle renames, and create new files and directories (do not yet
1572  *    write their contents)
1573  *
1574  * 4. walk the directories, fixing the mapping and direntries, and marking
1575  *    the handled mappings as not deleted
1576  *
1577  * 5. commit the contents of the files
1578  *
1579  * 6. handle deleted files and directories
1580  *
1581  */
1582 
1583 typedef struct commit_t {
1584     char* path;
1585     union {
1586         struct { uint32_t cluster; } rename;
1587         struct { int dir_index; uint32_t modified_offset; } writeout;
1588         struct { uint32_t first_cluster; } new_file;
1589         struct { uint32_t cluster; } mkdir;
1590     } param;
1591     /* DELETEs and RMDIRs are handled differently: see handle_deletes() */
1592     enum {
1593         ACTION_RENAME, ACTION_WRITEOUT, ACTION_NEW_FILE, ACTION_MKDIR
1594     } action;
1595 } commit_t;
1596 
1597 static void clear_commits(BDRVVVFATState* s)
1598 {
1599     int i;
1600 DLOG(fprintf(stderr, "clear_commits (%u commits)\n", s->commits.next));
1601     for (i = 0; i < s->commits.next; i++) {
1602         commit_t* commit = array_get(&(s->commits), i);
1603         assert(commit->path || commit->action == ACTION_WRITEOUT);
1604         if (commit->action != ACTION_WRITEOUT) {
1605             assert(commit->path);
1606             g_free(commit->path);
1607         } else
1608             assert(commit->path == NULL);
1609     }
1610     s->commits.next = 0;
1611 }
1612 
1613 static void schedule_rename(BDRVVVFATState* s,
1614         uint32_t cluster, char* new_path)
1615 {
1616     commit_t* commit = array_get_next(&(s->commits));
1617     commit->path = new_path;
1618     commit->param.rename.cluster = cluster;
1619     commit->action = ACTION_RENAME;
1620 }
1621 
1622 static void schedule_writeout(BDRVVVFATState* s,
1623         int dir_index, uint32_t modified_offset)
1624 {
1625     commit_t* commit = array_get_next(&(s->commits));
1626     commit->path = NULL;
1627     commit->param.writeout.dir_index = dir_index;
1628     commit->param.writeout.modified_offset = modified_offset;
1629     commit->action = ACTION_WRITEOUT;
1630 }
1631 
1632 static void schedule_new_file(BDRVVVFATState* s,
1633         char* path, uint32_t first_cluster)
1634 {
1635     commit_t* commit = array_get_next(&(s->commits));
1636     commit->path = path;
1637     commit->param.new_file.first_cluster = first_cluster;
1638     commit->action = ACTION_NEW_FILE;
1639 }
1640 
1641 static void schedule_mkdir(BDRVVVFATState* s, uint32_t cluster, char* path)
1642 {
1643     commit_t* commit = array_get_next(&(s->commits));
1644     commit->path = path;
1645     commit->param.mkdir.cluster = cluster;
1646     commit->action = ACTION_MKDIR;
1647 }
1648 
1649 typedef struct {
1650     /*
1651      * Since the sequence number is at most 0x3f, and the filename
1652      * length is at most 13 times the sequence number, the maximal
1653      * filename length is 0x3f * 13 bytes.
1654      */
1655     unsigned char name[0x3f * 13 + 1];
1656     gunichar2 name2[0x3f * 13 + 1];
1657     int checksum, len;
1658     int sequence_number;
1659 } long_file_name;
1660 
1661 static void lfn_init(long_file_name* lfn)
1662 {
1663    lfn->sequence_number = lfn->len = 0;
1664    lfn->checksum = 0x100;
1665 }
1666 
1667 /* return 0 if parsed successfully, > 0 if no long name, < 0 if error */
1668 static int parse_long_name(long_file_name* lfn,
1669         const direntry_t* direntry)
1670 {
1671     int i, j, offset;
1672     const unsigned char* pointer = (const unsigned char*)direntry;
1673 
1674     if (!is_long_name(direntry))
1675         return 1;
1676 
1677     if (pointer[0] & 0x40) {
1678         /* first entry; do some initialization */
1679         lfn->sequence_number = pointer[0] & 0x3f;
1680         lfn->checksum = pointer[13];
1681         lfn->name[0] = 0;
1682         lfn->name[lfn->sequence_number * 13] = 0;
1683     } else if ((pointer[0] & 0x3f) != --lfn->sequence_number) {
1684         /* not the expected sequence number */
1685         return -1;
1686     } else if (pointer[13] != lfn->checksum) {
1687         /* not the expected checksum */
1688         return -2;
1689     } else if (pointer[12] || pointer[26] || pointer[27]) {
1690         /* invalid zero fields */
1691         return -3;
1692     }
1693 
1694     offset = 13 * (lfn->sequence_number - 1);
1695     for (i = 0, j = 1; i < 13; i++, j+=2) {
1696         if (j == 11)
1697             j = 14;
1698         else if (j == 26)
1699             j = 28;
1700 
1701         if (pointer[j] == 0 && pointer[j + 1] == 0) {
1702             /* end of long file name */
1703             break;
1704         }
1705         gunichar2 c = (pointer[j + 1] << 8) + pointer[j];
1706         lfn->name2[offset + i] = c;
1707     }
1708 
1709     if (pointer[0] & 0x40) {
1710         /* first entry; set len */
1711         lfn->len = offset + i;
1712     }
1713     if ((pointer[0] & 0x3f) == 0x01) {
1714         /* last entry; finalize entry */
1715         glong olen;
1716         gchar *utf8 = g_utf16_to_utf8(lfn->name2, lfn->len, NULL, &olen, NULL);
1717         if (!utf8) {
1718             return -4;
1719         }
1720         lfn->len = olen;
1721         memcpy(lfn->name, utf8, olen + 1);
1722         g_free(utf8);
1723     }
1724 
1725     return 0;
1726 }
1727 
1728 /* returns 0 if successful, >0 if no short_name, and <0 on error */
1729 static int parse_short_name(BDRVVVFATState* s,
1730         long_file_name* lfn, direntry_t* direntry)
1731 {
1732     int i, j;
1733 
1734     if (!is_short_name(direntry))
1735         return 1;
1736 
1737     for (j = 7; j >= 0 && direntry->name[j] == ' '; j--);
1738     for (i = 0; i <= j; i++) {
1739         uint8_t c = direntry->name[i];
1740         if (c != to_valid_short_char(c)) {
1741             return -1;
1742         } else if (s->downcase_short_names) {
1743             lfn->name[i] = qemu_tolower(direntry->name[i]);
1744         } else {
1745             lfn->name[i] = direntry->name[i];
1746         }
1747     }
1748 
1749     for (j = 2; j >= 0 && direntry->name[8 + j] == ' '; j--) {
1750     }
1751     if (j >= 0) {
1752         lfn->name[i++] = '.';
1753         lfn->name[i + j + 1] = '\0';
1754         for (;j >= 0; j--) {
1755             uint8_t c = direntry->name[8 + j];
1756             if (c != to_valid_short_char(c)) {
1757                 return -2;
1758             } else if (s->downcase_short_names) {
1759                 lfn->name[i + j] = qemu_tolower(c);
1760             } else {
1761                 lfn->name[i + j] = c;
1762             }
1763         }
1764     } else
1765         lfn->name[i + j + 1] = '\0';
1766 
1767     if (lfn->name[0] == DIR_KANJI_FAKE) {
1768         lfn->name[0] = DIR_KANJI;
1769     }
1770     lfn->len = strlen((char*)lfn->name);
1771 
1772     return 0;
1773 }
1774 
1775 static inline uint32_t modified_fat_get(BDRVVVFATState* s,
1776         unsigned int cluster)
1777 {
1778     if (cluster < s->last_cluster_of_root_directory) {
1779         if (cluster + 1 == s->last_cluster_of_root_directory)
1780             return s->max_fat_value;
1781         else
1782             return cluster + 1;
1783     }
1784 
1785     if (s->fat_type==32) {
1786         uint32_t* entry=((uint32_t*)s->fat2)+cluster;
1787         return le32_to_cpu(*entry);
1788     } else if (s->fat_type==16) {
1789         uint16_t* entry=((uint16_t*)s->fat2)+cluster;
1790         return le16_to_cpu(*entry);
1791     } else {
1792         const uint8_t* x=s->fat2+cluster*3/2;
1793         return ((x[0]|(x[1]<<8))>>(cluster&1?4:0))&0x0fff;
1794     }
1795 }
1796 
1797 static inline bool cluster_was_modified(BDRVVVFATState *s,
1798                                         uint32_t cluster_num)
1799 {
1800     int was_modified = 0;
1801     int i;
1802 
1803     if (s->qcow == NULL) {
1804         return 0;
1805     }
1806 
1807     for (i = 0; !was_modified && i < s->sectors_per_cluster; i++) {
1808         was_modified = bdrv_is_allocated(s->qcow->bs,
1809                                          (cluster2sector(s, cluster_num) +
1810                                           i) * BDRV_SECTOR_SIZE,
1811                                          BDRV_SECTOR_SIZE, NULL);
1812     }
1813 
1814     /*
1815      * Note that this treats failures to learn allocation status the
1816      * same as if an allocation has occurred.  It's as safe as
1817      * anything else, given that a failure to learn allocation status
1818      * will probably result in more failures.
1819      */
1820     return !!was_modified;
1821 }
1822 
1823 static const char* get_basename(const char* path)
1824 {
1825     char* basename = strrchr(path, '/');
1826     if (basename == NULL)
1827         return path;
1828     else
1829         return basename + 1; /* strip '/' */
1830 }
1831 
1832 /*
1833  * The array s->used_clusters holds the states of the clusters. If it is
1834  * part of a file, it has bit 2 set, in case of a directory, bit 1. If it
1835  * was modified, bit 3 is set.
1836  * If any cluster is allocated, but not part of a file or directory, this
1837  * driver refuses to commit.
1838  */
1839 typedef enum {
1840      USED_DIRECTORY = 1, USED_FILE = 2, USED_ANY = 3, USED_ALLOCATED = 4
1841 } used_t;
1842 
1843 /*
1844  * get_cluster_count_for_direntry() not only determines how many clusters
1845  * are occupied by direntry, but also if it was renamed or modified.
1846  *
1847  * A file is thought to be renamed *only* if there already was a file with
1848  * exactly the same first cluster, but a different name.
1849  *
1850  * Further, the files/directories handled by this function are
1851  * assumed to be *not* deleted (and *only* those).
1852  */
1853 static uint32_t get_cluster_count_for_direntry(BDRVVVFATState* s,
1854         direntry_t* direntry, const char* path)
1855 {
1856     /*
1857      * This is a little bit tricky:
1858      * IF the guest OS just inserts a cluster into the file chain,
1859      * and leaves the rest alone, (i.e. the original file had clusters
1860      * 15 -> 16, but now has 15 -> 32 -> 16), then the following happens:
1861      *
1862      * - do_commit will write the cluster into the file at the given
1863      *   offset, but
1864      *
1865      * - the cluster which is overwritten should be moved to a later
1866      *   position in the file.
1867      *
1868      * I am not aware that any OS does something as braindead, but this
1869      * situation could happen anyway when not committing for a long time.
1870      * Just to be sure that this does not bite us, detect it, and copy the
1871      * contents of the clusters to-be-overwritten into the qcow.
1872      */
1873     int copy_it = 0;
1874     int was_modified = 0;
1875     int32_t ret = 0;
1876 
1877     uint32_t cluster_num = begin_of_direntry(direntry);
1878     uint32_t offset = 0;
1879     int first_mapping_index = -1;
1880     mapping_t* mapping = NULL;
1881     const char* basename2 = NULL;
1882 
1883     vvfat_close_current_file(s);
1884 
1885     /* the root directory */
1886     if (cluster_num == 0)
1887         return 0;
1888 
1889     /* write support */
1890     if (s->qcow) {
1891         basename2 = get_basename(path);
1892 
1893         mapping = find_mapping_for_cluster(s, cluster_num);
1894 
1895         if (mapping) {
1896             const char* basename;
1897 
1898             assert(mapping->mode & MODE_DELETED);
1899             mapping->mode &= ~MODE_DELETED;
1900 
1901             basename = get_basename(mapping->path);
1902 
1903             assert(mapping->mode & MODE_NORMAL);
1904 
1905             /* rename */
1906             if (strcmp(basename, basename2))
1907                 schedule_rename(s, cluster_num, g_strdup(path));
1908         } else if (is_file(direntry))
1909             /* new file */
1910             schedule_new_file(s, g_strdup(path), cluster_num);
1911         else {
1912             abort();
1913             return 0;
1914         }
1915     }
1916 
1917     while(1) {
1918         if (s->qcow) {
1919             if (!copy_it && cluster_was_modified(s, cluster_num)) {
1920                 if (mapping == NULL ||
1921                         mapping->begin > cluster_num ||
1922                         mapping->end <= cluster_num)
1923                 mapping = find_mapping_for_cluster(s, cluster_num);
1924 
1925 
1926                 if (mapping &&
1927                         (mapping->mode & MODE_DIRECTORY) == 0) {
1928 
1929                     /* was modified in qcow */
1930                     if (offset != mapping->info.file.offset + s->cluster_size
1931                             * (cluster_num - mapping->begin)) {
1932                         /* offset of this cluster in file chain has changed */
1933                         abort();
1934                         copy_it = 1;
1935                     } else if (offset == 0) {
1936                         const char* basename = get_basename(mapping->path);
1937 
1938                         if (strcmp(basename, basename2))
1939                             copy_it = 1;
1940                         first_mapping_index = array_index(&(s->mapping), mapping);
1941                     }
1942 
1943                     if (mapping->first_mapping_index != first_mapping_index
1944                             && mapping->info.file.offset > 0) {
1945                         abort();
1946                         copy_it = 1;
1947                     }
1948 
1949                     /* need to write out? */
1950                     if (!was_modified && is_file(direntry)) {
1951                         was_modified = 1;
1952                         schedule_writeout(s, mapping->dir_index, offset);
1953                     }
1954                 }
1955             }
1956 
1957             if (copy_it) {
1958                 int i;
1959                 /*
1960                  * This is horribly inefficient, but that is okay, since
1961                  * it is rarely executed, if at all.
1962                  */
1963                 int64_t offset = cluster2sector(s, cluster_num);
1964 
1965                 vvfat_close_current_file(s);
1966                 for (i = 0; i < s->sectors_per_cluster; i++) {
1967                     int res;
1968 
1969                     res = bdrv_is_allocated(s->qcow->bs,
1970                                             (offset + i) * BDRV_SECTOR_SIZE,
1971                                             BDRV_SECTOR_SIZE, NULL);
1972                     if (res < 0) {
1973                         return -1;
1974                     }
1975                     if (!res) {
1976                         res = vvfat_read(s->bs, offset, s->cluster_buffer, 1);
1977                         if (res) {
1978                             return -1;
1979                         }
1980                         res = bdrv_pwrite(s->qcow, offset * BDRV_SECTOR_SIZE,
1981                                           BDRV_SECTOR_SIZE, s->cluster_buffer,
1982                                           0);
1983                         if (res < 0) {
1984                             return -2;
1985                         }
1986                     }
1987                 }
1988             }
1989         }
1990 
1991         ret++;
1992         if (s->used_clusters[cluster_num] & USED_ANY)
1993             return 0;
1994         s->used_clusters[cluster_num] = USED_FILE;
1995 
1996         cluster_num = modified_fat_get(s, cluster_num);
1997 
1998         if (fat_eof(s, cluster_num))
1999             return ret;
2000         else if (cluster_num < 2 || cluster_num > s->max_fat_value - 16)
2001             return -1;
2002 
2003         offset += s->cluster_size;
2004     }
2005 }
2006 
2007 /*
2008  * This function looks at the modified data (qcow).
2009  * It returns 0 upon inconsistency or error, and the number of clusters
2010  * used by the directory, its subdirectories and their files.
2011  */
2012 static int check_directory_consistency(BDRVVVFATState *s,
2013         int cluster_num, const char* path)
2014 {
2015     int ret = 0;
2016     unsigned char* cluster = g_malloc(s->cluster_size);
2017     direntry_t* direntries = (direntry_t*)cluster;
2018     mapping_t* mapping = find_mapping_for_cluster(s, cluster_num);
2019 
2020     long_file_name lfn;
2021     int path_len = strlen(path);
2022     char path2[PATH_MAX + 1];
2023 
2024     assert(path_len < PATH_MAX); /* len was tested before! */
2025     pstrcpy(path2, sizeof(path2), path);
2026     path2[path_len] = '/';
2027     path2[path_len + 1] = '\0';
2028 
2029     if (mapping) {
2030         const char* basename = get_basename(mapping->path);
2031         const char* basename2 = get_basename(path);
2032 
2033         assert(mapping->mode & MODE_DIRECTORY);
2034 
2035         assert(mapping->mode & MODE_DELETED);
2036         mapping->mode &= ~MODE_DELETED;
2037 
2038         if (strcmp(basename, basename2))
2039             schedule_rename(s, cluster_num, g_strdup(path));
2040     } else
2041         /* new directory */
2042         schedule_mkdir(s, cluster_num, g_strdup(path));
2043 
2044     lfn_init(&lfn);
2045     do {
2046         int i;
2047         int subret = 0;
2048 
2049         ret++;
2050 
2051         if (s->used_clusters[cluster_num] & USED_ANY) {
2052             fprintf(stderr, "cluster %d used more than once\n", (int)cluster_num);
2053             goto fail;
2054         }
2055         s->used_clusters[cluster_num] = USED_DIRECTORY;
2056 
2057 DLOG(fprintf(stderr, "read cluster %d (sector %d)\n", (int)cluster_num, (int)cluster2sector(s, cluster_num)));
2058         subret = vvfat_read(s->bs, cluster2sector(s, cluster_num), cluster,
2059                 s->sectors_per_cluster);
2060         if (subret) {
2061             fprintf(stderr, "Error fetching direntries\n");
2062         fail:
2063             g_free(cluster);
2064             return 0;
2065         }
2066 
2067         for (i = 0; i < 0x10 * s->sectors_per_cluster; i++) {
2068             int cluster_count = 0;
2069 
2070 DLOG(fprintf(stderr, "check direntry %d:\n", i); print_direntry(direntries + i));
2071             if (is_volume_label(direntries + i) || is_dot(direntries + i) ||
2072                     is_free(direntries + i))
2073                 continue;
2074 
2075             subret = parse_long_name(&lfn, direntries + i);
2076             if (subret < 0) {
2077                 fprintf(stderr, "Error in long name\n");
2078                 goto fail;
2079             }
2080             if (subret == 0 || is_free(direntries + i))
2081                 continue;
2082 
2083             if (fat_chksum(direntries+i) != lfn.checksum) {
2084                 subret = parse_short_name(s, &lfn, direntries + i);
2085                 if (subret < 0) {
2086                     fprintf(stderr, "Error in short name (%d)\n", subret);
2087                     goto fail;
2088                 }
2089                 if (subret > 0 || !strcmp((char*)lfn.name, ".")
2090                         || !strcmp((char*)lfn.name, ".."))
2091                     continue;
2092             }
2093             lfn.checksum = 0x100; /* cannot use long name twice */
2094 
2095             if (!valid_filename(lfn.name)) {
2096                 fprintf(stderr, "Invalid file name\n");
2097                 goto fail;
2098             }
2099             if (path_len + 1 + lfn.len >= PATH_MAX) {
2100                 fprintf(stderr, "Name too long: %s/%s\n", path, lfn.name);
2101                 goto fail;
2102             }
2103             pstrcpy(path2 + path_len + 1, sizeof(path2) - path_len - 1,
2104                     (char*)lfn.name);
2105 
2106             if (is_directory(direntries + i)) {
2107                 if (begin_of_direntry(direntries + i) == 0) {
2108                     DLOG(fprintf(stderr, "invalid begin for directory: %s\n", path2); print_direntry(direntries + i));
2109                     goto fail;
2110                 }
2111                 cluster_count = check_directory_consistency(s,
2112                         begin_of_direntry(direntries + i), path2);
2113                 if (cluster_count == 0) {
2114                     DLOG(fprintf(stderr, "problem in directory %s:\n", path2); print_direntry(direntries + i));
2115                     goto fail;
2116                 }
2117             } else if (is_file(direntries + i)) {
2118                 /* check file size with FAT */
2119                 cluster_count = get_cluster_count_for_direntry(s, direntries + i, path2);
2120                 if (cluster_count !=
2121             DIV_ROUND_UP(le32_to_cpu(direntries[i].size), s->cluster_size)) {
2122                     DLOG(fprintf(stderr, "Cluster count mismatch\n"));
2123                     goto fail;
2124                 }
2125             } else
2126                 abort(); /* cluster_count = 0; */
2127 
2128             ret += cluster_count;
2129         }
2130 
2131         cluster_num = modified_fat_get(s, cluster_num);
2132     } while(!fat_eof(s, cluster_num));
2133 
2134     g_free(cluster);
2135     return ret;
2136 }
2137 
2138 /* returns 1 on success */
2139 static int is_consistent(BDRVVVFATState* s)
2140 {
2141     int i, check;
2142     int used_clusters_count = 0;
2143 
2144 DLOG(checkpoint());
2145     /*
2146      * - get modified FAT
2147      * - compare the two FATs (TODO)
2148      * - get buffer for marking used clusters
2149      * - recurse direntries from root (using bs->bdrv_pread to make
2150      *    sure to get the new data)
2151      *   - check that the FAT agrees with the size
2152      *   - count the number of clusters occupied by this directory and
2153      *     its files
2154      * - check that the cumulative used cluster count agrees with the
2155      *   FAT
2156      * - if all is fine, return number of used clusters
2157      */
2158     if (s->fat2 == NULL) {
2159         int size = 0x200 * s->sectors_per_fat;
2160         s->fat2 = g_malloc(size);
2161         memcpy(s->fat2, s->fat.pointer, size);
2162     }
2163     check = vvfat_read(s->bs,
2164             s->offset_to_fat, s->fat2, s->sectors_per_fat);
2165     if (check) {
2166         fprintf(stderr, "Could not copy fat\n");
2167         return 0;
2168     }
2169     assert (s->used_clusters);
2170     for (i = 0; i < sector2cluster(s, s->sector_count); i++)
2171         s->used_clusters[i] &= ~USED_ANY;
2172 
2173     clear_commits(s);
2174 
2175     /* mark every mapped file/directory as deleted.
2176      * (check_directory_consistency() will unmark those still present). */
2177     if (s->qcow)
2178         for (i = 0; i < s->mapping.next; i++) {
2179             mapping_t* mapping = array_get(&(s->mapping), i);
2180             if (mapping->first_mapping_index < 0)
2181                 mapping->mode |= MODE_DELETED;
2182         }
2183 
2184     used_clusters_count = check_directory_consistency(s, 0, s->path);
2185     if (used_clusters_count <= 0) {
2186         DLOG(fprintf(stderr, "problem in directory\n"));
2187         return 0;
2188     }
2189 
2190     check = s->last_cluster_of_root_directory;
2191     for (i = check; i < sector2cluster(s, s->sector_count); i++) {
2192         if (modified_fat_get(s, i)) {
2193             if(!s->used_clusters[i]) {
2194                 DLOG(fprintf(stderr, "FAT was modified (%d), but cluster is not used?\n", i));
2195                 return 0;
2196             }
2197             check++;
2198         }
2199 
2200         if (s->used_clusters[i] == USED_ALLOCATED) {
2201             /* allocated, but not used... */
2202             DLOG(fprintf(stderr, "unused, modified cluster: %d\n", i));
2203             return 0;
2204         }
2205     }
2206 
2207     if (check != used_clusters_count)
2208         return 0;
2209 
2210     return used_clusters_count;
2211 }
2212 
2213 static inline void adjust_mapping_indices(BDRVVVFATState* s,
2214         int offset, int adjust)
2215 {
2216     int i;
2217 
2218     for (i = 0; i < s->mapping.next; i++) {
2219         mapping_t* mapping = array_get(&(s->mapping), i);
2220 
2221 #define ADJUST_MAPPING_INDEX(name) \
2222         if (mapping->name >= offset) \
2223             mapping->name += adjust
2224 
2225         ADJUST_MAPPING_INDEX(first_mapping_index);
2226         if (mapping->mode & MODE_DIRECTORY)
2227             ADJUST_MAPPING_INDEX(info.dir.parent_mapping_index);
2228     }
2229 }
2230 
2231 /* insert or update mapping */
2232 static mapping_t* insert_mapping(BDRVVVFATState* s,
2233         uint32_t begin, uint32_t end)
2234 {
2235     /*
2236      * - find mapping where mapping->begin >= begin,
2237      * - if mapping->begin > begin: insert
2238      *   - adjust all references to mappings!
2239      * - else: adjust
2240      * - replace name
2241      */
2242     int index = find_mapping_for_cluster_aux(s, begin, 0, s->mapping.next);
2243     mapping_t* mapping = NULL;
2244     mapping_t* first_mapping = array_get(&(s->mapping), 0);
2245 
2246     if (index < s->mapping.next && (mapping = array_get(&(s->mapping), index))
2247             && mapping->begin < begin) {
2248         mapping->end = begin;
2249         index++;
2250         mapping = array_get(&(s->mapping), index);
2251     }
2252     if (index >= s->mapping.next || mapping->begin > begin) {
2253         mapping = array_insert(&(s->mapping), index, 1);
2254         mapping->path = NULL;
2255         adjust_mapping_indices(s, index, +1);
2256     }
2257 
2258     mapping->begin = begin;
2259     mapping->end = end;
2260 
2261 DLOG(mapping_t* next_mapping;
2262 assert(index + 1 >= s->mapping.next ||
2263 ((next_mapping = array_get(&(s->mapping), index + 1)) &&
2264  next_mapping->begin >= end)));
2265 
2266     if (s->current_mapping && first_mapping != (mapping_t*)s->mapping.pointer)
2267         s->current_mapping = array_get(&(s->mapping),
2268                 s->current_mapping - first_mapping);
2269 
2270     return mapping;
2271 }
2272 
2273 static int remove_mapping(BDRVVVFATState* s, int mapping_index)
2274 {
2275     mapping_t* mapping = array_get(&(s->mapping), mapping_index);
2276     mapping_t* first_mapping = array_get(&(s->mapping), 0);
2277 
2278     /* free mapping */
2279     if (mapping->first_mapping_index < 0) {
2280         g_free(mapping->path);
2281     }
2282 
2283     /* remove from s->mapping */
2284     array_remove(&(s->mapping), mapping_index);
2285 
2286     /* adjust all references to mappings */
2287     adjust_mapping_indices(s, mapping_index, -1);
2288 
2289     if (s->current_mapping && first_mapping != (mapping_t*)s->mapping.pointer)
2290         s->current_mapping = array_get(&(s->mapping),
2291                 s->current_mapping - first_mapping);
2292 
2293     return 0;
2294 }
2295 
2296 static void adjust_dirindices(BDRVVVFATState* s, int offset, int adjust)
2297 {
2298     int i;
2299     for (i = 0; i < s->mapping.next; i++) {
2300         mapping_t* mapping = array_get(&(s->mapping), i);
2301         if (mapping->dir_index >= offset)
2302             mapping->dir_index += adjust;
2303         if ((mapping->mode & MODE_DIRECTORY) &&
2304                 mapping->info.dir.first_dir_index >= offset)
2305             mapping->info.dir.first_dir_index += adjust;
2306     }
2307 }
2308 
2309 static direntry_t* insert_direntries(BDRVVVFATState* s,
2310         int dir_index, int count)
2311 {
2312     /*
2313      * make room in s->directory,
2314      * adjust_dirindices
2315      */
2316     direntry_t* result = array_insert(&(s->directory), dir_index, count);
2317     if (result == NULL)
2318         return NULL;
2319     adjust_dirindices(s, dir_index, count);
2320     return result;
2321 }
2322 
2323 static int remove_direntries(BDRVVVFATState* s, int dir_index, int count)
2324 {
2325     int ret = array_remove_slice(&(s->directory), dir_index, count);
2326     if (ret)
2327         return ret;
2328     adjust_dirindices(s, dir_index, -count);
2329     return 0;
2330 }
2331 
2332 /*
2333  * Adapt the mappings of the cluster chain starting at first cluster
2334  * (i.e. if a file starts at first_cluster, the chain is followed according
2335  * to the modified fat, and the corresponding entries in s->mapping are
2336  * adjusted)
2337  */
2338 static int commit_mappings(BDRVVVFATState* s,
2339         uint32_t first_cluster, int dir_index)
2340 {
2341     mapping_t* mapping = find_mapping_for_cluster(s, first_cluster);
2342     direntry_t* direntry = array_get(&(s->directory), dir_index);
2343     uint32_t cluster = first_cluster;
2344 
2345     vvfat_close_current_file(s);
2346 
2347     assert(mapping);
2348     assert(mapping->begin == first_cluster);
2349     mapping->first_mapping_index = -1;
2350     mapping->dir_index = dir_index;
2351     mapping->mode = (dir_index <= 0 || is_directory(direntry)) ?
2352         MODE_DIRECTORY : MODE_NORMAL;
2353 
2354     while (!fat_eof(s, cluster)) {
2355         uint32_t c, c1;
2356 
2357         for (c = cluster, c1 = modified_fat_get(s, c); c + 1 == c1;
2358                 c = c1, c1 = modified_fat_get(s, c1));
2359 
2360         c++;
2361         if (c > mapping->end) {
2362             int index = array_index(&(s->mapping), mapping);
2363             int i, max_i = s->mapping.next - index;
2364             for (i = 1; i < max_i && mapping[i].begin < c; i++);
2365             while (--i > 0)
2366                 remove_mapping(s, index + 1);
2367         }
2368         assert(mapping == array_get(&(s->mapping), s->mapping.next - 1)
2369                 || mapping[1].begin >= c);
2370         mapping->end = c;
2371 
2372         if (!fat_eof(s, c1)) {
2373             int i = find_mapping_for_cluster_aux(s, c1, 0, s->mapping.next);
2374             mapping_t* next_mapping = i >= s->mapping.next ? NULL :
2375                 array_get(&(s->mapping), i);
2376 
2377             if (next_mapping == NULL || next_mapping->begin > c1) {
2378                 int i1 = array_index(&(s->mapping), mapping);
2379 
2380                 next_mapping = insert_mapping(s, c1, c1+1);
2381 
2382                 if (c1 < c)
2383                     i1++;
2384                 mapping = array_get(&(s->mapping), i1);
2385             }
2386 
2387             next_mapping->dir_index = mapping->dir_index;
2388             next_mapping->first_mapping_index =
2389                 mapping->first_mapping_index < 0 ?
2390                 array_index(&(s->mapping), mapping) :
2391                 mapping->first_mapping_index;
2392             next_mapping->path = mapping->path;
2393             next_mapping->mode = mapping->mode;
2394             next_mapping->read_only = mapping->read_only;
2395             if (mapping->mode & MODE_DIRECTORY) {
2396                 next_mapping->info.dir.parent_mapping_index =
2397                         mapping->info.dir.parent_mapping_index;
2398                 next_mapping->info.dir.first_dir_index =
2399                         mapping->info.dir.first_dir_index +
2400                         0x10 * s->sectors_per_cluster *
2401                         (mapping->end - mapping->begin);
2402             } else
2403                 next_mapping->info.file.offset = mapping->info.file.offset +
2404                         mapping->end - mapping->begin;
2405 
2406             mapping = next_mapping;
2407         }
2408 
2409         cluster = c1;
2410     }
2411 
2412     return 0;
2413 }
2414 
2415 static int commit_direntries(BDRVVVFATState* s,
2416         int dir_index, int parent_mapping_index)
2417 {
2418     direntry_t* direntry = array_get(&(s->directory), dir_index);
2419     uint32_t first_cluster = dir_index == 0 ? 0 : begin_of_direntry(direntry);
2420     mapping_t* mapping = find_mapping_for_cluster(s, first_cluster);
2421     int factor = 0x10 * s->sectors_per_cluster;
2422     int old_cluster_count, new_cluster_count;
2423     int current_dir_index;
2424     int first_dir_index;
2425     int ret, i;
2426     uint32_t c;
2427 
2428     assert(direntry);
2429     assert(mapping);
2430     assert(mapping->begin == first_cluster);
2431     assert(mapping->info.dir.first_dir_index < s->directory.next);
2432     assert(mapping->mode & MODE_DIRECTORY);
2433     assert(dir_index == 0 || is_directory(direntry));
2434 
2435     DLOG(fprintf(stderr, "commit_direntries for %s, parent_mapping_index %d\n",
2436                  mapping->path, parent_mapping_index));
2437 
2438     current_dir_index = mapping->info.dir.first_dir_index;
2439     first_dir_index = current_dir_index;
2440     mapping->info.dir.parent_mapping_index = parent_mapping_index;
2441 
2442     if (first_cluster == 0) {
2443         old_cluster_count = new_cluster_count =
2444             s->last_cluster_of_root_directory;
2445     } else {
2446         for (old_cluster_count = 0, c = first_cluster; !fat_eof(s, c);
2447                 c = fat_get(s, c))
2448             old_cluster_count++;
2449 
2450         for (new_cluster_count = 0, c = first_cluster; !fat_eof(s, c);
2451                 c = modified_fat_get(s, c))
2452             new_cluster_count++;
2453     }
2454 
2455     if (new_cluster_count > old_cluster_count) {
2456         if (insert_direntries(s,
2457                 current_dir_index + factor * old_cluster_count,
2458                 factor * (new_cluster_count - old_cluster_count)) == NULL)
2459             return -1;
2460     } else if (new_cluster_count < old_cluster_count)
2461         remove_direntries(s,
2462                 current_dir_index + factor * new_cluster_count,
2463                 factor * (old_cluster_count - new_cluster_count));
2464 
2465     for (c = first_cluster; !fat_eof(s, c); c = modified_fat_get(s, c)) {
2466         direntry_t *first_direntry;
2467         void* direntry = array_get(&(s->directory), current_dir_index);
2468         int ret = vvfat_read(s->bs, cluster2sector(s, c), direntry,
2469                 s->sectors_per_cluster);
2470         if (ret)
2471             return ret;
2472 
2473         /* The first directory entry on the filesystem is the volume name */
2474         first_direntry = (direntry_t*) s->directory.pointer;
2475         assert(!memcmp(first_direntry->name, s->volume_label, 11));
2476 
2477         current_dir_index += factor;
2478     }
2479 
2480     ret = commit_mappings(s, first_cluster, dir_index);
2481     if (ret)
2482         return ret;
2483 
2484     /* recurse */
2485     for (i = 0; i < factor * new_cluster_count; i++) {
2486         direntry = array_get(&(s->directory), first_dir_index + i);
2487         if (is_directory(direntry) && !is_dot(direntry)) {
2488             mapping = find_mapping_for_cluster(s, first_cluster);
2489             if (mapping == NULL) {
2490                 return -1;
2491             }
2492             assert(mapping->mode & MODE_DIRECTORY);
2493             ret = commit_direntries(s, first_dir_index + i,
2494                 array_index(&(s->mapping), mapping));
2495             if (ret)
2496                 return ret;
2497         }
2498     }
2499 
2500     return 0;
2501 }
2502 
2503 /* commit one file (adjust contents, adjust mapping),
2504    return first_mapping_index */
2505 static int commit_one_file(BDRVVVFATState* s,
2506         int dir_index, uint32_t offset)
2507 {
2508     direntry_t* direntry = array_get(&(s->directory), dir_index);
2509     uint32_t c = begin_of_direntry(direntry);
2510     uint32_t first_cluster = c;
2511     mapping_t* mapping = find_mapping_for_cluster(s, c);
2512     uint32_t size = filesize_of_direntry(direntry);
2513     char *cluster;
2514     uint32_t i;
2515     int fd = 0;
2516 
2517     assert(offset < size);
2518     assert((offset % s->cluster_size) == 0);
2519 
2520     if (mapping == NULL) {
2521         return -1;
2522     }
2523 
2524     for (i = s->cluster_size; i < offset; i += s->cluster_size)
2525         c = modified_fat_get(s, c);
2526 
2527     fd = qemu_open_old(mapping->path, O_RDWR | O_CREAT | O_BINARY, 0666);
2528     if (fd < 0) {
2529         fprintf(stderr, "Could not open %s... (%s, %d)\n", mapping->path,
2530                 strerror(errno), errno);
2531         return fd;
2532     }
2533     if (offset > 0) {
2534         if (lseek(fd, offset, SEEK_SET) != offset) {
2535             qemu_close(fd);
2536             return -3;
2537         }
2538     }
2539 
2540     cluster = g_malloc(s->cluster_size);
2541 
2542     while (offset < size) {
2543         uint32_t c1;
2544         int rest_size = (size - offset > s->cluster_size ?
2545                 s->cluster_size : size - offset);
2546         int ret;
2547 
2548         c1 = modified_fat_get(s, c);
2549 
2550         assert((size - offset == 0 && fat_eof(s, c)) ||
2551                 (size > offset && c >=2 && !fat_eof(s, c)));
2552 
2553         ret = vvfat_read(s->bs, cluster2sector(s, c),
2554             (uint8_t*)cluster, DIV_ROUND_UP(rest_size, 0x200));
2555 
2556         if (ret < 0) {
2557             qemu_close(fd);
2558             g_free(cluster);
2559             return ret;
2560         }
2561 
2562         if (write(fd, cluster, rest_size) < 0) {
2563             qemu_close(fd);
2564             g_free(cluster);
2565             return -2;
2566         }
2567 
2568         offset += rest_size;
2569         c = c1;
2570     }
2571 
2572     if (ftruncate(fd, size)) {
2573         perror("ftruncate()");
2574         qemu_close(fd);
2575         g_free(cluster);
2576         return -4;
2577     }
2578     qemu_close(fd);
2579     g_free(cluster);
2580 
2581     return commit_mappings(s, first_cluster, dir_index);
2582 }
2583 
2584 #ifdef DEBUG
2585 /* test, if all mappings point to valid direntries */
2586 static void check1(BDRVVVFATState* s)
2587 {
2588     int i;
2589     for (i = 0; i < s->mapping.next; i++) {
2590         mapping_t* mapping = array_get(&(s->mapping), i);
2591         if (mapping->mode & MODE_DELETED) {
2592             fprintf(stderr, "deleted\n");
2593             continue;
2594         }
2595         assert(mapping->dir_index < s->directory.next);
2596         direntry_t* direntry = array_get(&(s->directory), mapping->dir_index);
2597         assert(mapping->begin == begin_of_direntry(direntry) || mapping->first_mapping_index >= 0);
2598         if (mapping->mode & MODE_DIRECTORY) {
2599             assert(mapping->info.dir.first_dir_index + 0x10 * s->sectors_per_cluster * (mapping->end - mapping->begin) <= s->directory.next);
2600             assert((mapping->info.dir.first_dir_index % (0x10 * s->sectors_per_cluster)) == 0);
2601         }
2602     }
2603 }
2604 
2605 /* test, if all direntries have mappings */
2606 static void check2(BDRVVVFATState* s)
2607 {
2608     int i;
2609     int first_mapping = -1;
2610 
2611     for (i = 0; i < s->directory.next; i++) {
2612         direntry_t* direntry = array_get(&(s->directory), i);
2613 
2614         if (is_short_name(direntry) && begin_of_direntry(direntry)) {
2615             mapping_t* mapping = find_mapping_for_cluster(s, begin_of_direntry(direntry));
2616             assert(mapping);
2617             assert(mapping->dir_index == i || is_dot(direntry));
2618             assert(mapping->begin == begin_of_direntry(direntry) || is_dot(direntry));
2619         }
2620 
2621         if ((i % (0x10 * s->sectors_per_cluster)) == 0) {
2622             /* cluster start */
2623             int j, count = 0;
2624 
2625             for (j = 0; j < s->mapping.next; j++) {
2626                 mapping_t* mapping = array_get(&(s->mapping), j);
2627                 if (mapping->mode & MODE_DELETED)
2628                     continue;
2629                 if (mapping->mode & MODE_DIRECTORY) {
2630                     if (mapping->info.dir.first_dir_index <= i && mapping->info.dir.first_dir_index + 0x10 * s->sectors_per_cluster > i) {
2631                         assert(++count == 1);
2632                         if (mapping->first_mapping_index == -1)
2633                             first_mapping = array_index(&(s->mapping), mapping);
2634                         else
2635                             assert(first_mapping == mapping->first_mapping_index);
2636                         if (mapping->info.dir.parent_mapping_index < 0)
2637                             assert(j == 0);
2638                         else {
2639                             mapping_t* parent = array_get(&(s->mapping), mapping->info.dir.parent_mapping_index);
2640                             assert(parent->mode & MODE_DIRECTORY);
2641                             assert(parent->info.dir.first_dir_index < mapping->info.dir.first_dir_index);
2642                         }
2643                     }
2644                 }
2645             }
2646             if (count == 0)
2647                 first_mapping = -1;
2648         }
2649     }
2650 }
2651 #endif
2652 
2653 static int handle_renames_and_mkdirs(BDRVVVFATState* s)
2654 {
2655     int i;
2656 
2657 #ifdef DEBUG
2658     fprintf(stderr, "handle_renames\n");
2659     for (i = 0; i < s->commits.next; i++) {
2660         commit_t* commit = array_get(&(s->commits), i);
2661         fprintf(stderr, "%d, %s (%u, %d)\n", i,
2662                 commit->path ? commit->path : "(null)",
2663                 commit->param.rename.cluster, commit->action);
2664     }
2665 #endif
2666 
2667     for (i = 0; i < s->commits.next;) {
2668         commit_t* commit = array_get(&(s->commits), i);
2669         if (commit->action == ACTION_RENAME) {
2670             mapping_t* mapping = find_mapping_for_cluster(s,
2671                     commit->param.rename.cluster);
2672             char *old_path;
2673 
2674             if (mapping == NULL) {
2675                 return -1;
2676             }
2677             old_path = mapping->path;
2678             assert(commit->path);
2679             mapping->path = commit->path;
2680             if (rename(old_path, mapping->path))
2681                 return -2;
2682 
2683             if (mapping->mode & MODE_DIRECTORY) {
2684                 int l1 = strlen(mapping->path);
2685                 int l2 = strlen(old_path);
2686                 int diff = l1 - l2;
2687                 direntry_t* direntry = array_get(&(s->directory),
2688                         mapping->info.dir.first_dir_index);
2689                 uint32_t c = mapping->begin;
2690                 int i = 0;
2691 
2692                 /* recurse */
2693                 while (!fat_eof(s, c)) {
2694                     do {
2695                         direntry_t* d = direntry + i;
2696 
2697                         if (is_file(d) || (is_directory(d) && !is_dot(d))) {
2698                             int l;
2699                             char *new_path;
2700                             mapping_t* m = find_mapping_for_cluster(s,
2701                                     begin_of_direntry(d));
2702                             if (m == NULL) {
2703                                 return -1;
2704                             }
2705                             l = strlen(m->path);
2706                             new_path = g_malloc(l + diff + 1);
2707 
2708                             assert(!strncmp(m->path, mapping->path, l2));
2709 
2710                             pstrcpy(new_path, l + diff + 1, mapping->path);
2711                             pstrcpy(new_path + l1, l + diff + 1 - l1,
2712                                     m->path + l2);
2713 
2714                             schedule_rename(s, m->begin, new_path);
2715                         }
2716                         i++;
2717                     } while((i % (0x10 * s->sectors_per_cluster)) != 0);
2718                     c = fat_get(s, c);
2719                 }
2720             }
2721 
2722             g_free(old_path);
2723             array_remove(&(s->commits), i);
2724             continue;
2725         } else if (commit->action == ACTION_MKDIR) {
2726             mapping_t* mapping;
2727             int j, parent_path_len;
2728 
2729 #ifdef __MINGW32__
2730             if (mkdir(commit->path))
2731                 return -5;
2732 #else
2733             if (mkdir(commit->path, 0755))
2734                 return -5;
2735 #endif
2736 
2737             mapping = insert_mapping(s, commit->param.mkdir.cluster,
2738                     commit->param.mkdir.cluster + 1);
2739             if (mapping == NULL)
2740                 return -6;
2741 
2742             mapping->mode = MODE_DIRECTORY;
2743             mapping->read_only = 0;
2744             mapping->path = commit->path;
2745             j = s->directory.next;
2746             assert(j);
2747             insert_direntries(s, s->directory.next,
2748                     0x10 * s->sectors_per_cluster);
2749             mapping->info.dir.first_dir_index = j;
2750 
2751             parent_path_len = strlen(commit->path)
2752                 - strlen(get_basename(commit->path)) - 1;
2753             for (j = 0; j < s->mapping.next; j++) {
2754                 mapping_t* m = array_get(&(s->mapping), j);
2755                 if (m->first_mapping_index < 0 && m != mapping &&
2756                         !strncmp(m->path, mapping->path, parent_path_len) &&
2757                         strlen(m->path) == parent_path_len)
2758                     break;
2759             }
2760             assert(j < s->mapping.next);
2761             mapping->info.dir.parent_mapping_index = j;
2762 
2763             array_remove(&(s->commits), i);
2764             continue;
2765         }
2766 
2767         i++;
2768     }
2769     return 0;
2770 }
2771 
2772 /*
2773  * TODO: make sure that the short name is not matching *another* file
2774  */
2775 static int handle_commits(BDRVVVFATState* s)
2776 {
2777     int i, fail = 0;
2778 
2779     vvfat_close_current_file(s);
2780 
2781     for (i = 0; !fail && i < s->commits.next; i++) {
2782         commit_t* commit = array_get(&(s->commits), i);
2783         switch(commit->action) {
2784         case ACTION_RENAME: case ACTION_MKDIR:
2785             abort();
2786             fail = -2;
2787             break;
2788         case ACTION_WRITEOUT: {
2789 #ifndef NDEBUG
2790             /* these variables are only used by assert() below */
2791             direntry_t* entry = array_get(&(s->directory),
2792                     commit->param.writeout.dir_index);
2793             uint32_t begin = begin_of_direntry(entry);
2794             mapping_t* mapping = find_mapping_for_cluster(s, begin);
2795 #endif
2796 
2797             assert(mapping);
2798             assert(mapping->begin == begin);
2799             assert(commit->path == NULL);
2800 
2801             if (commit_one_file(s, commit->param.writeout.dir_index,
2802                         commit->param.writeout.modified_offset))
2803                 fail = -3;
2804 
2805             break;
2806         }
2807         case ACTION_NEW_FILE: {
2808             int begin = commit->param.new_file.first_cluster;
2809             mapping_t* mapping = find_mapping_for_cluster(s, begin);
2810             direntry_t* entry;
2811             int i;
2812 
2813             /* find direntry */
2814             for (i = 0; i < s->directory.next; i++) {
2815                 entry = array_get(&(s->directory), i);
2816                 if (is_file(entry) && begin_of_direntry(entry) == begin)
2817                     break;
2818             }
2819 
2820             if (i >= s->directory.next) {
2821                 fail = -6;
2822                 continue;
2823             }
2824 
2825             /* make sure there exists an initial mapping */
2826             if (mapping && mapping->begin != begin) {
2827                 mapping->end = begin;
2828                 mapping = NULL;
2829             }
2830             if (mapping == NULL) {
2831                 mapping = insert_mapping(s, begin, begin+1);
2832             }
2833             /* most members will be fixed in commit_mappings() */
2834             assert(commit->path);
2835             mapping->path = commit->path;
2836             mapping->read_only = 0;
2837             mapping->mode = MODE_NORMAL;
2838             mapping->info.file.offset = 0;
2839 
2840             if (commit_one_file(s, i, 0))
2841                 fail = -7;
2842 
2843             break;
2844         }
2845         default:
2846             abort();
2847         }
2848     }
2849     if (i > 0 && array_remove_slice(&(s->commits), 0, i))
2850         return -1;
2851     return fail;
2852 }
2853 
2854 static int handle_deletes(BDRVVVFATState* s)
2855 {
2856     int i, deferred = 1, deleted = 1;
2857 
2858     /* delete files corresponding to mappings marked as deleted */
2859     /* handle DELETEs and unused mappings (modified_fat_get(s, mapping->begin) == 0) */
2860     while (deferred && deleted) {
2861         deferred = 0;
2862         deleted = 0;
2863 
2864         for (i = 1; i < s->mapping.next; i++) {
2865             mapping_t* mapping = array_get(&(s->mapping), i);
2866             if (mapping->mode & MODE_DELETED) {
2867                 direntry_t* entry = array_get(&(s->directory),
2868                         mapping->dir_index);
2869 
2870                 if (is_free(entry)) {
2871                     /* remove file/directory */
2872                     if (mapping->mode & MODE_DIRECTORY) {
2873                         int j, next_dir_index = s->directory.next,
2874                         first_dir_index = mapping->info.dir.first_dir_index;
2875 
2876                         if (rmdir(mapping->path) < 0) {
2877                             if (errno == ENOTEMPTY) {
2878                                 deferred++;
2879                                 continue;
2880                             } else
2881                                 return -5;
2882                         }
2883 
2884                         for (j = 1; j < s->mapping.next; j++) {
2885                             mapping_t* m = array_get(&(s->mapping), j);
2886                             if (m->mode & MODE_DIRECTORY &&
2887                                     m->info.dir.first_dir_index >
2888                                     first_dir_index &&
2889                                     m->info.dir.first_dir_index <
2890                                     next_dir_index)
2891                                 next_dir_index =
2892                                     m->info.dir.first_dir_index;
2893                         }
2894                         remove_direntries(s, first_dir_index,
2895                                 next_dir_index - first_dir_index);
2896 
2897                         deleted++;
2898                     }
2899                 } else {
2900                     if (unlink(mapping->path))
2901                         return -4;
2902                     deleted++;
2903                 }
2904                 DLOG(fprintf(stderr, "DELETE (%d)\n", i); print_mapping(mapping); print_direntry(entry));
2905                 remove_mapping(s, i);
2906             }
2907         }
2908     }
2909 
2910     return 0;
2911 }
2912 
2913 /*
2914  * synchronize mapping with new state:
2915  *
2916  * - copy FAT (with bdrv_pread)
2917  * - mark all filenames corresponding to mappings as deleted
2918  * - recurse direntries from root (using bs->bdrv_pread)
2919  * - delete files corresponding to mappings marked as deleted
2920  */
2921 static int do_commit(BDRVVVFATState* s)
2922 {
2923     int ret = 0;
2924 
2925     /* the real meat are the commits. Nothing to do? Move along! */
2926     if (s->commits.next == 0)
2927         return 0;
2928 
2929     vvfat_close_current_file(s);
2930 
2931     ret = handle_renames_and_mkdirs(s);
2932     if (ret) {
2933         fprintf(stderr, "Error handling renames (%d)\n", ret);
2934         abort();
2935         return ret;
2936     }
2937 
2938     /* copy FAT (with bdrv_pread) */
2939     memcpy(s->fat.pointer, s->fat2, 0x200 * s->sectors_per_fat);
2940 
2941     /* recurse direntries from root (using bs->bdrv_pread) */
2942     ret = commit_direntries(s, 0, -1);
2943     if (ret) {
2944         fprintf(stderr, "Fatal: error while committing (%d)\n", ret);
2945         abort();
2946         return ret;
2947     }
2948 
2949     ret = handle_commits(s);
2950     if (ret) {
2951         fprintf(stderr, "Error handling commits (%d)\n", ret);
2952         abort();
2953         return ret;
2954     }
2955 
2956     ret = handle_deletes(s);
2957     if (ret) {
2958         fprintf(stderr, "Error deleting\n");
2959         abort();
2960         return ret;
2961     }
2962 
2963     bdrv_make_empty(s->qcow, NULL);
2964 
2965     memset(s->used_clusters, 0, sector2cluster(s, s->sector_count));
2966 
2967 DLOG(checkpoint());
2968     return 0;
2969 }
2970 
2971 static int try_commit(BDRVVVFATState* s)
2972 {
2973     vvfat_close_current_file(s);
2974 DLOG(checkpoint());
2975     if(!is_consistent(s))
2976         return -1;
2977     return do_commit(s);
2978 }
2979 
2980 static int vvfat_write(BlockDriverState *bs, int64_t sector_num,
2981                     const uint8_t *buf, int nb_sectors)
2982 {
2983     BDRVVVFATState *s = bs->opaque;
2984     int i, ret;
2985     int first_cluster, last_cluster;
2986 
2987 DLOG(checkpoint());
2988 
2989     /* Check if we're operating in read-only mode */
2990     if (s->qcow == NULL) {
2991         return -EACCES;
2992     }
2993 
2994     vvfat_close_current_file(s);
2995 
2996     /*
2997      * Some sanity checks:
2998      * - do not allow writing to the boot sector
2999      */
3000 
3001     if (sector_num < s->offset_to_fat)
3002         return -1;
3003 
3004     /*
3005      * Values will be negative for writes to the FAT, which is located before
3006      * the root directory.
3007      */
3008     first_cluster = sector2cluster(s, sector_num);
3009     last_cluster = sector2cluster(s, sector_num + nb_sectors - 1);
3010 
3011     for (i = first_cluster; i <= last_cluster;) {
3012         mapping_t *mapping = NULL;
3013 
3014         if (i >= 0) {
3015             mapping = find_mapping_for_cluster(s, i);
3016         }
3017 
3018         if (mapping) {
3019             if (mapping->read_only) {
3020                 fprintf(stderr, "Tried to write to write-protected file %s\n",
3021                         mapping->path);
3022                 return -1;
3023             }
3024 
3025             if (mapping->mode & MODE_DIRECTORY) {
3026                 int begin = cluster2sector(s, i);
3027                 int end = begin + s->sectors_per_cluster, k;
3028                 int dir_index;
3029                 const direntry_t* direntries;
3030                 long_file_name lfn;
3031 
3032                 lfn_init(&lfn);
3033 
3034                 if (begin < sector_num)
3035                     begin = sector_num;
3036                 if (end > sector_num + nb_sectors)
3037                     end = sector_num + nb_sectors;
3038                 dir_index  = mapping->dir_index +
3039                     0x10 * (begin - mapping->begin * s->sectors_per_cluster);
3040                 direntries = (direntry_t*)(buf + 0x200 * (begin - sector_num));
3041 
3042                 for (k = 0; k < (end - begin) * 0x10; k++) {
3043                     /* no access to the direntry of a read-only file */
3044                     if (is_short_name(direntries + k) &&
3045                             (direntries[k].attributes & 1)) {
3046                         if (memcmp(direntries + k,
3047                                     array_get(&(s->directory), dir_index + k),
3048                                     sizeof(direntry_t))) {
3049                             warn_report("tried to write to write-protected "
3050                                         "file");
3051                             return -1;
3052                         }
3053                     }
3054                 }
3055             }
3056             i = mapping->end;
3057         } else {
3058             i++;
3059         }
3060     }
3061 
3062     /*
3063      * Use qcow backend. Commit later.
3064      */
3065 DLOG(fprintf(stderr, "Write to qcow backend: %d + %d\n", (int)sector_num, nb_sectors));
3066     ret = bdrv_pwrite(s->qcow, sector_num * BDRV_SECTOR_SIZE,
3067                       nb_sectors * BDRV_SECTOR_SIZE, buf, 0);
3068     if (ret < 0) {
3069         fprintf(stderr, "Error writing to qcow backend\n");
3070         return ret;
3071     }
3072 
3073     for (i = first_cluster; i <= last_cluster; i++) {
3074         if (i >= 0) {
3075             s->used_clusters[i] |= USED_ALLOCATED;
3076         }
3077     }
3078 
3079 DLOG(checkpoint());
3080     /* TODO: add timeout */
3081     try_commit(s);
3082 
3083 DLOG(checkpoint());
3084     return 0;
3085 }
3086 
3087 static int coroutine_fn
3088 vvfat_co_pwritev(BlockDriverState *bs, int64_t offset, int64_t bytes,
3089                  QEMUIOVector *qiov, BdrvRequestFlags flags)
3090 {
3091     int ret;
3092     BDRVVVFATState *s = bs->opaque;
3093     uint64_t sector_num = offset >> BDRV_SECTOR_BITS;
3094     int nb_sectors = bytes >> BDRV_SECTOR_BITS;
3095     void *buf;
3096 
3097     assert(QEMU_IS_ALIGNED(offset, BDRV_SECTOR_SIZE));
3098     assert(QEMU_IS_ALIGNED(bytes, BDRV_SECTOR_SIZE));
3099 
3100     buf = g_try_malloc(bytes);
3101     if (bytes && buf == NULL) {
3102         return -ENOMEM;
3103     }
3104     qemu_iovec_to_buf(qiov, 0, buf, bytes);
3105 
3106     qemu_co_mutex_lock(&s->lock);
3107     ret = vvfat_write(bs, sector_num, buf, nb_sectors);
3108     qemu_co_mutex_unlock(&s->lock);
3109 
3110     g_free(buf);
3111 
3112     return ret;
3113 }
3114 
3115 static int coroutine_fn vvfat_co_block_status(BlockDriverState *bs,
3116                                               bool want_zero, int64_t offset,
3117                                               int64_t bytes, int64_t *n,
3118                                               int64_t *map,
3119                                               BlockDriverState **file)
3120 {
3121     *n = bytes;
3122     return BDRV_BLOCK_DATA;
3123 }
3124 
3125 static void vvfat_qcow_options(BdrvChildRole role, bool parent_is_format,
3126                                int *child_flags, QDict *child_options,
3127                                int parent_flags, QDict *parent_options)
3128 {
3129     qdict_set_default_str(child_options, BDRV_OPT_READ_ONLY, "off");
3130     qdict_set_default_str(child_options, BDRV_OPT_AUTO_READ_ONLY, "off");
3131     qdict_set_default_str(child_options, BDRV_OPT_CACHE_NO_FLUSH, "on");
3132 }
3133 
3134 static BdrvChildClass child_vvfat_qcow;
3135 
3136 static int enable_write_target(BlockDriverState *bs, Error **errp)
3137 {
3138     BDRVVVFATState *s = bs->opaque;
3139     BlockDriver *bdrv_qcow = NULL;
3140     QemuOpts *opts = NULL;
3141     int ret;
3142     int size = sector2cluster(s, s->sector_count);
3143     QDict *options;
3144 
3145     s->used_clusters = g_malloc0(size);
3146 
3147     array_init(&(s->commits), sizeof(commit_t));
3148 
3149     s->qcow_filename = g_malloc(PATH_MAX);
3150     ret = get_tmp_filename(s->qcow_filename, PATH_MAX);
3151     if (ret < 0) {
3152         error_setg_errno(errp, -ret, "can't create temporary file");
3153         goto err;
3154     }
3155 
3156     bdrv_qcow = bdrv_find_format("qcow");
3157     if (!bdrv_qcow) {
3158         error_setg(errp, "Failed to locate qcow driver");
3159         ret = -ENOENT;
3160         goto err;
3161     }
3162 
3163     opts = qemu_opts_create(bdrv_qcow->create_opts, NULL, 0, &error_abort);
3164     qemu_opt_set_number(opts, BLOCK_OPT_SIZE,
3165                         bs->total_sectors * BDRV_SECTOR_SIZE, &error_abort);
3166     qemu_opt_set(opts, BLOCK_OPT_BACKING_FILE, "fat:", &error_abort);
3167 
3168     ret = bdrv_create(bdrv_qcow, s->qcow_filename, opts, errp);
3169     qemu_opts_del(opts);
3170     if (ret < 0) {
3171         goto err;
3172     }
3173 
3174     options = qdict_new();
3175     qdict_put_str(options, "write-target.driver", "qcow");
3176     s->qcow = bdrv_open_child(s->qcow_filename, options, "write-target", bs,
3177                               &child_vvfat_qcow,
3178                               BDRV_CHILD_DATA | BDRV_CHILD_METADATA,
3179                               false, errp);
3180     qobject_unref(options);
3181     if (!s->qcow) {
3182         ret = -EINVAL;
3183         goto err;
3184     }
3185 
3186 #ifndef _WIN32
3187     unlink(s->qcow_filename);
3188 #endif
3189 
3190     return 0;
3191 
3192 err:
3193     return ret;
3194 }
3195 
3196 static void vvfat_child_perm(BlockDriverState *bs, BdrvChild *c,
3197                              BdrvChildRole role,
3198                              BlockReopenQueue *reopen_queue,
3199                              uint64_t perm, uint64_t shared,
3200                              uint64_t *nperm, uint64_t *nshared)
3201 {
3202     assert(role & BDRV_CHILD_DATA);
3203     /* This is a private node, nobody should try to attach to it */
3204     *nperm = BLK_PERM_CONSISTENT_READ | BLK_PERM_WRITE;
3205     *nshared = BLK_PERM_WRITE_UNCHANGED;
3206 }
3207 
3208 static void vvfat_close(BlockDriverState *bs)
3209 {
3210     BDRVVVFATState *s = bs->opaque;
3211 
3212     vvfat_close_current_file(s);
3213     array_free(&(s->fat));
3214     array_free(&(s->directory));
3215     array_free(&(s->mapping));
3216     g_free(s->cluster_buffer);
3217 
3218     if (s->qcow) {
3219         migrate_del_blocker(s->migration_blocker);
3220         error_free(s->migration_blocker);
3221     }
3222 }
3223 
3224 static const char *const vvfat_strong_runtime_opts[] = {
3225     "dir",
3226     "fat-type",
3227     "floppy",
3228     "label",
3229     "rw",
3230 
3231     NULL
3232 };
3233 
3234 static BlockDriver bdrv_vvfat = {
3235     .format_name            = "vvfat",
3236     .protocol_name          = "fat",
3237     .instance_size          = sizeof(BDRVVVFATState),
3238 
3239     .bdrv_parse_filename    = vvfat_parse_filename,
3240     .bdrv_file_open         = vvfat_open,
3241     .bdrv_refresh_limits    = vvfat_refresh_limits,
3242     .bdrv_close             = vvfat_close,
3243     .bdrv_child_perm        = vvfat_child_perm,
3244 
3245     .bdrv_co_preadv         = vvfat_co_preadv,
3246     .bdrv_co_pwritev        = vvfat_co_pwritev,
3247     .bdrv_co_block_status   = vvfat_co_block_status,
3248 
3249     .strong_runtime_opts    = vvfat_strong_runtime_opts,
3250 };
3251 
3252 static void bdrv_vvfat_init(void)
3253 {
3254     child_vvfat_qcow = child_of_bds;
3255     child_vvfat_qcow.inherit_options = vvfat_qcow_options;
3256     bdrv_register(&bdrv_vvfat);
3257 }
3258 
3259 block_init(bdrv_vvfat_init);
3260 
3261 #ifdef DEBUG
3262 static void checkpoint(void)
3263 {
3264     assert(((mapping_t*)array_get(&(vvv->mapping), 0))->end == 2);
3265     check1(vvv);
3266     check2(vvv);
3267     assert(!vvv->current_mapping || vvv->current_fd || (vvv->current_mapping->mode & MODE_DIRECTORY));
3268 }
3269 #endif
3270