xref: /openbmc/qemu/block/vvfat.c (revision b45c03f5)
1 /* vim:set shiftwidth=4 ts=4: */
2 /*
3  * QEMU Block driver for virtual VFAT (shadows a local directory)
4  *
5  * Copyright (c) 2004,2005 Johannes E. Schindelin
6  *
7  * Permission is hereby granted, free of charge, to any person obtaining a copy
8  * of this software and associated documentation files (the "Software"), to deal
9  * in the Software without restriction, including without limitation the rights
10  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11  * copies of the Software, and to permit persons to whom the Software is
12  * furnished to do so, subject to the following conditions:
13  *
14  * The above copyright notice and this permission notice shall be included in
15  * all copies or substantial portions of the Software.
16  *
17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23  * THE SOFTWARE.
24  */
25 #include <sys/stat.h>
26 #include <dirent.h>
27 #include "qemu-common.h"
28 #include "block/block_int.h"
29 #include "qemu/module.h"
30 #include "migration/migration.h"
31 #include "qapi/qmp/qint.h"
32 #include "qapi/qmp/qbool.h"
33 #include "qapi/qmp/qstring.h"
34 
35 #ifndef S_IWGRP
36 #define S_IWGRP 0
37 #endif
38 #ifndef S_IWOTH
39 #define S_IWOTH 0
40 #endif
41 
42 /* TODO: add ":bootsector=blabla.img:" */
43 /* LATER TODO: add automatic boot sector generation from
44     BOOTEASY.ASM and Ranish Partition Manager
45     Note that DOS assumes the system files to be the first files in the
46     file system (test if the boot sector still relies on that fact)! */
47 /* MAYBE TODO: write block-visofs.c */
48 /* TODO: call try_commit() only after a timeout */
49 
50 /* #define DEBUG */
51 
52 #ifdef DEBUG
53 
54 #define DLOG(a) a
55 
56 static void checkpoint(void);
57 
58 #ifdef __MINGW32__
59 void nonono(const char* file, int line, const char* msg) {
60     fprintf(stderr, "Nonono! %s:%d %s\n", file, line, msg);
61     exit(-5);
62 }
63 #undef assert
64 #define assert(a) do {if (!(a)) nonono(__FILE__, __LINE__, #a);}while(0)
65 #endif
66 
67 #else
68 
69 #define DLOG(a)
70 
71 #endif
72 
73 /* dynamic array functions */
74 typedef struct array_t {
75     char* pointer;
76     unsigned int size,next,item_size;
77 } array_t;
78 
79 static inline void array_init(array_t* array,unsigned int item_size)
80 {
81     array->pointer = NULL;
82     array->size=0;
83     array->next=0;
84     array->item_size=item_size;
85 }
86 
87 static inline void array_free(array_t* array)
88 {
89     g_free(array->pointer);
90     array->size=array->next=0;
91 }
92 
93 /* does not automatically grow */
94 static inline void* array_get(array_t* array,unsigned int index) {
95     assert(index < array->next);
96     return array->pointer + index * array->item_size;
97 }
98 
99 static inline int array_ensure_allocated(array_t* array, int index)
100 {
101     if((index + 1) * array->item_size > array->size) {
102 	int new_size = (index + 32) * array->item_size;
103 	array->pointer = g_realloc(array->pointer, new_size);
104 	if (!array->pointer)
105 	    return -1;
106 	array->size = new_size;
107 	array->next = index + 1;
108     }
109 
110     return 0;
111 }
112 
113 static inline void* array_get_next(array_t* array) {
114     unsigned int next = array->next;
115     void* result;
116 
117     if (array_ensure_allocated(array, next) < 0)
118 	return NULL;
119 
120     array->next = next + 1;
121     result = array_get(array, next);
122 
123     return result;
124 }
125 
126 static inline void* array_insert(array_t* array,unsigned int index,unsigned int count) {
127     if((array->next+count)*array->item_size>array->size) {
128 	int increment=count*array->item_size;
129 	array->pointer=g_realloc(array->pointer,array->size+increment);
130 	if(!array->pointer)
131             return NULL;
132 	array->size+=increment;
133     }
134     memmove(array->pointer+(index+count)*array->item_size,
135 		array->pointer+index*array->item_size,
136 		(array->next-index)*array->item_size);
137     array->next+=count;
138     return array->pointer+index*array->item_size;
139 }
140 
141 /* this performs a "roll", so that the element which was at index_from becomes
142  * index_to, but the order of all other elements is preserved. */
143 static inline int array_roll(array_t* array,int index_to,int index_from,int count)
144 {
145     char* buf;
146     char* from;
147     char* to;
148     int is;
149 
150     if(!array ||
151 	    index_to<0 || index_to>=array->next ||
152 	    index_from<0 || index_from>=array->next)
153 	return -1;
154 
155     if(index_to==index_from)
156 	return 0;
157 
158     is=array->item_size;
159     from=array->pointer+index_from*is;
160     to=array->pointer+index_to*is;
161     buf=g_malloc(is*count);
162     memcpy(buf,from,is*count);
163 
164     if(index_to<index_from)
165 	memmove(to+is*count,to,from-to);
166     else
167 	memmove(from,from+is*count,to-from);
168 
169     memcpy(to,buf,is*count);
170 
171     g_free(buf);
172 
173     return 0;
174 }
175 
176 static inline int array_remove_slice(array_t* array,int index, int count)
177 {
178     assert(index >=0);
179     assert(count > 0);
180     assert(index + count <= array->next);
181     if(array_roll(array,array->next-1,index,count))
182 	return -1;
183     array->next -= count;
184     return 0;
185 }
186 
187 static int array_remove(array_t* array,int index)
188 {
189     return array_remove_slice(array, index, 1);
190 }
191 
192 /* return the index for a given member */
193 static int array_index(array_t* array, void* pointer)
194 {
195     size_t offset = (char*)pointer - array->pointer;
196     assert((offset % array->item_size) == 0);
197     assert(offset/array->item_size < array->next);
198     return offset/array->item_size;
199 }
200 
201 /* These structures are used to fake a disk and the VFAT filesystem.
202  * For this reason we need to use QEMU_PACKED. */
203 
204 typedef struct bootsector_t {
205     uint8_t jump[3];
206     uint8_t name[8];
207     uint16_t sector_size;
208     uint8_t sectors_per_cluster;
209     uint16_t reserved_sectors;
210     uint8_t number_of_fats;
211     uint16_t root_entries;
212     uint16_t total_sectors16;
213     uint8_t media_type;
214     uint16_t sectors_per_fat;
215     uint16_t sectors_per_track;
216     uint16_t number_of_heads;
217     uint32_t hidden_sectors;
218     uint32_t total_sectors;
219     union {
220         struct {
221 	    uint8_t drive_number;
222 	    uint8_t current_head;
223 	    uint8_t signature;
224 	    uint32_t id;
225 	    uint8_t volume_label[11];
226 	} QEMU_PACKED fat16;
227 	struct {
228 	    uint32_t sectors_per_fat;
229 	    uint16_t flags;
230 	    uint8_t major,minor;
231 	    uint32_t first_cluster_of_root_directory;
232 	    uint16_t info_sector;
233 	    uint16_t backup_boot_sector;
234 	    uint16_t ignored;
235 	} QEMU_PACKED fat32;
236     } u;
237     uint8_t fat_type[8];
238     uint8_t ignored[0x1c0];
239     uint8_t magic[2];
240 } QEMU_PACKED bootsector_t;
241 
242 typedef struct {
243     uint8_t head;
244     uint8_t sector;
245     uint8_t cylinder;
246 } mbr_chs_t;
247 
248 typedef struct partition_t {
249     uint8_t attributes; /* 0x80 = bootable */
250     mbr_chs_t start_CHS;
251     uint8_t   fs_type; /* 0x1 = FAT12, 0x6 = FAT16, 0xe = FAT16_LBA, 0xb = FAT32, 0xc = FAT32_LBA */
252     mbr_chs_t end_CHS;
253     uint32_t start_sector_long;
254     uint32_t length_sector_long;
255 } QEMU_PACKED partition_t;
256 
257 typedef struct mbr_t {
258     uint8_t ignored[0x1b8];
259     uint32_t nt_id;
260     uint8_t ignored2[2];
261     partition_t partition[4];
262     uint8_t magic[2];
263 } QEMU_PACKED mbr_t;
264 
265 typedef struct direntry_t {
266     uint8_t name[8 + 3];
267     uint8_t attributes;
268     uint8_t reserved[2];
269     uint16_t ctime;
270     uint16_t cdate;
271     uint16_t adate;
272     uint16_t begin_hi;
273     uint16_t mtime;
274     uint16_t mdate;
275     uint16_t begin;
276     uint32_t size;
277 } QEMU_PACKED direntry_t;
278 
279 /* this structure are used to transparently access the files */
280 
281 typedef struct mapping_t {
282     /* begin is the first cluster, end is the last+1 */
283     uint32_t begin,end;
284     /* as s->directory is growable, no pointer may be used here */
285     unsigned int dir_index;
286     /* the clusters of a file may be in any order; this points to the first */
287     int first_mapping_index;
288     union {
289 	/* offset is
290 	 * - the offset in the file (in clusters) for a file, or
291 	 * - the next cluster of the directory for a directory, and
292 	 * - the address of the buffer for a faked entry
293 	 */
294 	struct {
295 	    uint32_t offset;
296 	} file;
297 	struct {
298 	    int parent_mapping_index;
299 	    int first_dir_index;
300 	} dir;
301     } info;
302     /* path contains the full path, i.e. it always starts with s->path */
303     char* path;
304 
305     enum { MODE_UNDEFINED = 0, MODE_NORMAL = 1, MODE_MODIFIED = 2,
306 	MODE_DIRECTORY = 4, MODE_FAKED = 8,
307 	MODE_DELETED = 16, MODE_RENAMED = 32 } mode;
308     int read_only;
309 } mapping_t;
310 
311 #ifdef DEBUG
312 static void print_direntry(const struct direntry_t*);
313 static void print_mapping(const struct mapping_t* mapping);
314 #endif
315 
316 /* here begins the real VVFAT driver */
317 
318 typedef struct BDRVVVFATState {
319     CoMutex lock;
320     BlockDriverState* bs; /* pointer to parent */
321     unsigned int first_sectors_number; /* 1 for a single partition, 0x40 for a disk with partition table */
322     unsigned char first_sectors[0x40*0x200];
323 
324     int fat_type; /* 16 or 32 */
325     array_t fat,directory,mapping;
326     char volume_label[11];
327 
328     unsigned int cluster_size;
329     unsigned int sectors_per_cluster;
330     unsigned int sectors_per_fat;
331     unsigned int sectors_of_root_directory;
332     uint32_t last_cluster_of_root_directory;
333     unsigned int faked_sectors; /* how many sectors are faked before file data */
334     uint32_t sector_count; /* total number of sectors of the partition */
335     uint32_t cluster_count; /* total number of clusters of this partition */
336     uint32_t max_fat_value;
337 
338     int current_fd;
339     mapping_t* current_mapping;
340     unsigned char* cluster; /* points to current cluster */
341     unsigned char* cluster_buffer; /* points to a buffer to hold temp data */
342     unsigned int current_cluster;
343 
344     /* write support */
345     BlockDriverState* write_target;
346     char* qcow_filename;
347     BlockDriverState* qcow;
348     void* fat2;
349     char* used_clusters;
350     array_t commits;
351     const char* path;
352     int downcase_short_names;
353 
354     Error *migration_blocker;
355 } BDRVVVFATState;
356 
357 /* take the sector position spos and convert it to Cylinder/Head/Sector position
358  * if the position is outside the specified geometry, fill maximum value for CHS
359  * and return 1 to signal overflow.
360  */
361 static int sector2CHS(mbr_chs_t *chs, int spos, int cyls, int heads, int secs)
362 {
363     int head,sector;
364     sector   = spos % secs;  spos /= secs;
365     head     = spos % heads; spos /= heads;
366     if (spos >= cyls) {
367         /* Overflow,
368         it happens if 32bit sector positions are used, while CHS is only 24bit.
369         Windows/Dos is said to take 1023/255/63 as nonrepresentable CHS */
370         chs->head     = 0xFF;
371         chs->sector   = 0xFF;
372         chs->cylinder = 0xFF;
373         return 1;
374     }
375     chs->head     = (uint8_t)head;
376     chs->sector   = (uint8_t)( (sector+1) | ((spos>>8)<<6) );
377     chs->cylinder = (uint8_t)spos;
378     return 0;
379 }
380 
381 static void init_mbr(BDRVVVFATState *s, int cyls, int heads, int secs)
382 {
383     /* TODO: if the files mbr.img and bootsect.img exist, use them */
384     mbr_t* real_mbr=(mbr_t*)s->first_sectors;
385     partition_t* partition = &(real_mbr->partition[0]);
386     int lba;
387 
388     memset(s->first_sectors,0,512);
389 
390     /* Win NT Disk Signature */
391     real_mbr->nt_id= cpu_to_le32(0xbe1afdfa);
392 
393     partition->attributes=0x80; /* bootable */
394 
395     /* LBA is used when partition is outside the CHS geometry */
396     lba  = sector2CHS(&partition->start_CHS, s->first_sectors_number - 1,
397                      cyls, heads, secs);
398     lba |= sector2CHS(&partition->end_CHS,   s->bs->total_sectors - 1,
399                      cyls, heads, secs);
400 
401     /*LBA partitions are identified only by start/length_sector_long not by CHS*/
402     partition->start_sector_long  = cpu_to_le32(s->first_sectors_number - 1);
403     partition->length_sector_long = cpu_to_le32(s->bs->total_sectors
404                                                 - s->first_sectors_number + 1);
405 
406     /* FAT12/FAT16/FAT32 */
407     /* DOS uses different types when partition is LBA,
408        probably to prevent older versions from using CHS on them */
409     partition->fs_type= s->fat_type==12 ? 0x1:
410                         s->fat_type==16 ? (lba?0xe:0x06):
411                          /*fat_tyoe==32*/ (lba?0xc:0x0b);
412 
413     real_mbr->magic[0]=0x55; real_mbr->magic[1]=0xaa;
414 }
415 
416 /* direntry functions */
417 
418 /* dest is assumed to hold 258 bytes, and pads with 0xffff up to next multiple of 26 */
419 static inline int short2long_name(char* dest,const char* src)
420 {
421     int i;
422     int len;
423     for(i=0;i<129 && src[i];i++) {
424         dest[2*i]=src[i];
425 	dest[2*i+1]=0;
426     }
427     len=2*i;
428     dest[2*i]=dest[2*i+1]=0;
429     for(i=2*i+2;(i%26);i++)
430 	dest[i]=0xff;
431     return len;
432 }
433 
434 static inline direntry_t* create_long_filename(BDRVVVFATState* s,const char* filename)
435 {
436     char buffer[258];
437     int length=short2long_name(buffer,filename),
438         number_of_entries=(length+25)/26,i;
439     direntry_t* entry;
440 
441     for(i=0;i<number_of_entries;i++) {
442 	entry=array_get_next(&(s->directory));
443 	entry->attributes=0xf;
444 	entry->reserved[0]=0;
445 	entry->begin=0;
446 	entry->name[0]=(number_of_entries-i)|(i==0?0x40:0);
447     }
448     for(i=0;i<26*number_of_entries;i++) {
449 	int offset=(i%26);
450 	if(offset<10) offset=1+offset;
451 	else if(offset<22) offset=14+offset-10;
452 	else offset=28+offset-22;
453 	entry=array_get(&(s->directory),s->directory.next-1-(i/26));
454 	entry->name[offset]=buffer[i];
455     }
456     return array_get(&(s->directory),s->directory.next-number_of_entries);
457 }
458 
459 static char is_free(const direntry_t* direntry)
460 {
461     return direntry->name[0]==0xe5 || direntry->name[0]==0x00;
462 }
463 
464 static char is_volume_label(const direntry_t* direntry)
465 {
466     return direntry->attributes == 0x28;
467 }
468 
469 static char is_long_name(const direntry_t* direntry)
470 {
471     return direntry->attributes == 0xf;
472 }
473 
474 static char is_short_name(const direntry_t* direntry)
475 {
476     return !is_volume_label(direntry) && !is_long_name(direntry)
477 	&& !is_free(direntry);
478 }
479 
480 static char is_directory(const direntry_t* direntry)
481 {
482     return direntry->attributes & 0x10 && direntry->name[0] != 0xe5;
483 }
484 
485 static inline char is_dot(const direntry_t* direntry)
486 {
487     return is_short_name(direntry) && direntry->name[0] == '.';
488 }
489 
490 static char is_file(const direntry_t* direntry)
491 {
492     return is_short_name(direntry) && !is_directory(direntry);
493 }
494 
495 static inline uint32_t begin_of_direntry(const direntry_t* direntry)
496 {
497     return le16_to_cpu(direntry->begin)|(le16_to_cpu(direntry->begin_hi)<<16);
498 }
499 
500 static inline uint32_t filesize_of_direntry(const direntry_t* direntry)
501 {
502     return le32_to_cpu(direntry->size);
503 }
504 
505 static void set_begin_of_direntry(direntry_t* direntry, uint32_t begin)
506 {
507     direntry->begin = cpu_to_le16(begin & 0xffff);
508     direntry->begin_hi = cpu_to_le16((begin >> 16) & 0xffff);
509 }
510 
511 /* fat functions */
512 
513 static inline uint8_t fat_chksum(const direntry_t* entry)
514 {
515     uint8_t chksum=0;
516     int i;
517 
518     for (i = 0; i < ARRAY_SIZE(entry->name); i++) {
519         chksum = (((chksum & 0xfe) >> 1) |
520                   ((chksum & 0x01) ? 0x80 : 0)) + entry->name[i];
521     }
522 
523     return chksum;
524 }
525 
526 /* if return_time==0, this returns the fat_date, else the fat_time */
527 static uint16_t fat_datetime(time_t time,int return_time) {
528     struct tm* t;
529     struct tm t1;
530     t = &t1;
531     localtime_r(&time,t);
532     if(return_time)
533 	return cpu_to_le16((t->tm_sec/2)|(t->tm_min<<5)|(t->tm_hour<<11));
534     return cpu_to_le16((t->tm_mday)|((t->tm_mon+1)<<5)|((t->tm_year-80)<<9));
535 }
536 
537 static inline void fat_set(BDRVVVFATState* s,unsigned int cluster,uint32_t value)
538 {
539     if(s->fat_type==32) {
540 	uint32_t* entry=array_get(&(s->fat),cluster);
541 	*entry=cpu_to_le32(value);
542     } else if(s->fat_type==16) {
543 	uint16_t* entry=array_get(&(s->fat),cluster);
544 	*entry=cpu_to_le16(value&0xffff);
545     } else {
546 	int offset = (cluster*3/2);
547 	unsigned char* p = array_get(&(s->fat), offset);
548         switch (cluster&1) {
549 	case 0:
550 		p[0] = value&0xff;
551 		p[1] = (p[1]&0xf0) | ((value>>8)&0xf);
552 		break;
553 	case 1:
554 		p[0] = (p[0]&0xf) | ((value&0xf)<<4);
555 		p[1] = (value>>4);
556 		break;
557 	}
558     }
559 }
560 
561 static inline uint32_t fat_get(BDRVVVFATState* s,unsigned int cluster)
562 {
563     if(s->fat_type==32) {
564 	uint32_t* entry=array_get(&(s->fat),cluster);
565 	return le32_to_cpu(*entry);
566     } else if(s->fat_type==16) {
567 	uint16_t* entry=array_get(&(s->fat),cluster);
568 	return le16_to_cpu(*entry);
569     } else {
570 	const uint8_t* x=(uint8_t*)(s->fat.pointer)+cluster*3/2;
571 	return ((x[0]|(x[1]<<8))>>(cluster&1?4:0))&0x0fff;
572     }
573 }
574 
575 static inline int fat_eof(BDRVVVFATState* s,uint32_t fat_entry)
576 {
577     if(fat_entry>s->max_fat_value-8)
578 	return -1;
579     return 0;
580 }
581 
582 static inline void init_fat(BDRVVVFATState* s)
583 {
584     if (s->fat_type == 12) {
585 	array_init(&(s->fat),1);
586 	array_ensure_allocated(&(s->fat),
587 		s->sectors_per_fat * 0x200 * 3 / 2 - 1);
588     } else {
589 	array_init(&(s->fat),(s->fat_type==32?4:2));
590 	array_ensure_allocated(&(s->fat),
591 		s->sectors_per_fat * 0x200 / s->fat.item_size - 1);
592     }
593     memset(s->fat.pointer,0,s->fat.size);
594 
595     switch(s->fat_type) {
596 	case 12: s->max_fat_value=0xfff; break;
597 	case 16: s->max_fat_value=0xffff; break;
598 	case 32: s->max_fat_value=0x0fffffff; break;
599 	default: s->max_fat_value=0; /* error... */
600     }
601 
602 }
603 
604 /* TODO: in create_short_filename, 0xe5->0x05 is not yet handled! */
605 /* TODO: in parse_short_filename, 0x05->0xe5 is not yet handled! */
606 static inline direntry_t* create_short_and_long_name(BDRVVVFATState* s,
607 	unsigned int directory_start, const char* filename, int is_dot)
608 {
609     int i,j,long_index=s->directory.next;
610     direntry_t* entry = NULL;
611     direntry_t* entry_long = NULL;
612 
613     if(is_dot) {
614 	entry=array_get_next(&(s->directory));
615         memset(entry->name, 0x20, sizeof(entry->name));
616 	memcpy(entry->name,filename,strlen(filename));
617 	return entry;
618     }
619 
620     entry_long=create_long_filename(s,filename);
621 
622     i = strlen(filename);
623     for(j = i - 1; j>0  && filename[j]!='.';j--);
624     if (j > 0)
625 	i = (j > 8 ? 8 : j);
626     else if (i > 8)
627 	i = 8;
628 
629     entry=array_get_next(&(s->directory));
630     memset(entry->name, 0x20, sizeof(entry->name));
631     memcpy(entry->name, filename, i);
632 
633     if (j > 0) {
634         for (i = 0; i < 3 && filename[j + 1 + i]; i++) {
635             entry->name[8 + i] = filename[j + 1 + i];
636         }
637     }
638 
639     /* upcase & remove unwanted characters */
640     for(i=10;i>=0;i--) {
641 	if(i==10 || i==7) for(;i>0 && entry->name[i]==' ';i--);
642 	if(entry->name[i]<=' ' || entry->name[i]>0x7f
643 		|| strchr(".*?<>|\":/\\[];,+='",entry->name[i]))
644 	    entry->name[i]='_';
645         else if(entry->name[i]>='a' && entry->name[i]<='z')
646             entry->name[i]+='A'-'a';
647     }
648 
649     /* mangle duplicates */
650     while(1) {
651 	direntry_t* entry1=array_get(&(s->directory),directory_start);
652 	int j;
653 
654 	for(;entry1<entry;entry1++)
655 	    if(!is_long_name(entry1) && !memcmp(entry1->name,entry->name,11))
656 		break; /* found dupe */
657 	if(entry1==entry) /* no dupe found */
658 	    break;
659 
660 	/* use all 8 characters of name */
661 	if(entry->name[7]==' ') {
662 	    int j;
663 	    for(j=6;j>0 && entry->name[j]==' ';j--)
664 		entry->name[j]='~';
665 	}
666 
667 	/* increment number */
668 	for(j=7;j>0 && entry->name[j]=='9';j--)
669 	    entry->name[j]='0';
670 	if(j>0) {
671 	    if(entry->name[j]<'0' || entry->name[j]>'9')
672 	        entry->name[j]='0';
673 	    else
674 	        entry->name[j]++;
675 	}
676     }
677 
678     /* calculate checksum; propagate to long name */
679     if(entry_long) {
680         uint8_t chksum=fat_chksum(entry);
681 
682 	/* calculate anew, because realloc could have taken place */
683 	entry_long=array_get(&(s->directory),long_index);
684 	while(entry_long<entry && is_long_name(entry_long)) {
685 	    entry_long->reserved[1]=chksum;
686 	    entry_long++;
687 	}
688     }
689 
690     return entry;
691 }
692 
693 /*
694  * Read a directory. (the index of the corresponding mapping must be passed).
695  */
696 static int read_directory(BDRVVVFATState* s, int mapping_index)
697 {
698     mapping_t* mapping = array_get(&(s->mapping), mapping_index);
699     direntry_t* direntry;
700     const char* dirname = mapping->path;
701     int first_cluster = mapping->begin;
702     int parent_index = mapping->info.dir.parent_mapping_index;
703     mapping_t* parent_mapping = (mapping_t*)
704         (parent_index >= 0 ? array_get(&(s->mapping), parent_index) : NULL);
705     int first_cluster_of_parent = parent_mapping ? parent_mapping->begin : -1;
706 
707     DIR* dir=opendir(dirname);
708     struct dirent* entry;
709     int i;
710 
711     assert(mapping->mode & MODE_DIRECTORY);
712 
713     if(!dir) {
714 	mapping->end = mapping->begin;
715 	return -1;
716     }
717 
718     i = mapping->info.dir.first_dir_index =
719 	    first_cluster == 0 ? 0 : s->directory.next;
720 
721     /* actually read the directory, and allocate the mappings */
722     while((entry=readdir(dir))) {
723 	unsigned int length=strlen(dirname)+2+strlen(entry->d_name);
724         char* buffer;
725 	direntry_t* direntry;
726         struct stat st;
727 	int is_dot=!strcmp(entry->d_name,".");
728 	int is_dotdot=!strcmp(entry->d_name,"..");
729 
730 	if(first_cluster == 0 && (is_dotdot || is_dot))
731 	    continue;
732 
733 	buffer = g_malloc(length);
734 	snprintf(buffer,length,"%s/%s",dirname,entry->d_name);
735 
736 	if(stat(buffer,&st)<0) {
737             g_free(buffer);
738             continue;
739 	}
740 
741 	/* create directory entry for this file */
742 	direntry=create_short_and_long_name(s, i, entry->d_name,
743 		is_dot || is_dotdot);
744 	direntry->attributes=(S_ISDIR(st.st_mode)?0x10:0x20);
745 	direntry->reserved[0]=direntry->reserved[1]=0;
746 	direntry->ctime=fat_datetime(st.st_ctime,1);
747 	direntry->cdate=fat_datetime(st.st_ctime,0);
748 	direntry->adate=fat_datetime(st.st_atime,0);
749 	direntry->begin_hi=0;
750 	direntry->mtime=fat_datetime(st.st_mtime,1);
751 	direntry->mdate=fat_datetime(st.st_mtime,0);
752 	if(is_dotdot)
753 	    set_begin_of_direntry(direntry, first_cluster_of_parent);
754 	else if(is_dot)
755 	    set_begin_of_direntry(direntry, first_cluster);
756 	else
757 	    direntry->begin=0; /* do that later */
758         if (st.st_size > 0x7fffffff) {
759 	    fprintf(stderr, "File %s is larger than 2GB\n", buffer);
760             g_free(buffer);
761             closedir(dir);
762 	    return -2;
763         }
764 	direntry->size=cpu_to_le32(S_ISDIR(st.st_mode)?0:st.st_size);
765 
766 	/* create mapping for this file */
767 	if(!is_dot && !is_dotdot && (S_ISDIR(st.st_mode) || st.st_size)) {
768 	    s->current_mapping = array_get_next(&(s->mapping));
769 	    s->current_mapping->begin=0;
770 	    s->current_mapping->end=st.st_size;
771 	    /*
772 	     * we get the direntry of the most recent direntry, which
773 	     * contains the short name and all the relevant information.
774 	     */
775 	    s->current_mapping->dir_index=s->directory.next-1;
776 	    s->current_mapping->first_mapping_index = -1;
777 	    if (S_ISDIR(st.st_mode)) {
778 		s->current_mapping->mode = MODE_DIRECTORY;
779 		s->current_mapping->info.dir.parent_mapping_index =
780 		    mapping_index;
781 	    } else {
782 		s->current_mapping->mode = MODE_UNDEFINED;
783 		s->current_mapping->info.file.offset = 0;
784 	    }
785 	    s->current_mapping->path=buffer;
786 	    s->current_mapping->read_only =
787 		(st.st_mode & (S_IWUSR | S_IWGRP | S_IWOTH)) == 0;
788         } else {
789             g_free(buffer);
790         }
791     }
792     closedir(dir);
793 
794     /* fill with zeroes up to the end of the cluster */
795     while(s->directory.next%(0x10*s->sectors_per_cluster)) {
796 	direntry_t* direntry=array_get_next(&(s->directory));
797 	memset(direntry,0,sizeof(direntry_t));
798     }
799 
800 /* TODO: if there are more entries, bootsector has to be adjusted! */
801 #define ROOT_ENTRIES (0x02 * 0x10 * s->sectors_per_cluster)
802     if (mapping_index == 0 && s->directory.next < ROOT_ENTRIES) {
803 	/* root directory */
804 	int cur = s->directory.next;
805 	array_ensure_allocated(&(s->directory), ROOT_ENTRIES - 1);
806 	s->directory.next = ROOT_ENTRIES;
807 	memset(array_get(&(s->directory), cur), 0,
808 		(ROOT_ENTRIES - cur) * sizeof(direntry_t));
809     }
810 
811      /* reget the mapping, since s->mapping was possibly realloc()ed */
812     mapping = array_get(&(s->mapping), mapping_index);
813     first_cluster += (s->directory.next - mapping->info.dir.first_dir_index)
814 	* 0x20 / s->cluster_size;
815     mapping->end = first_cluster;
816 
817     direntry = array_get(&(s->directory), mapping->dir_index);
818     set_begin_of_direntry(direntry, mapping->begin);
819 
820     return 0;
821 }
822 
823 static inline uint32_t sector2cluster(BDRVVVFATState* s,off_t sector_num)
824 {
825     return (sector_num-s->faked_sectors)/s->sectors_per_cluster;
826 }
827 
828 static inline off_t cluster2sector(BDRVVVFATState* s, uint32_t cluster_num)
829 {
830     return s->faked_sectors + s->sectors_per_cluster * cluster_num;
831 }
832 
833 static int init_directories(BDRVVVFATState* s,
834                             const char *dirname, int heads, int secs,
835                             Error **errp)
836 {
837     bootsector_t* bootsector;
838     mapping_t* mapping;
839     unsigned int i;
840     unsigned int cluster;
841 
842     memset(&(s->first_sectors[0]),0,0x40*0x200);
843 
844     s->cluster_size=s->sectors_per_cluster*0x200;
845     s->cluster_buffer=g_malloc(s->cluster_size);
846 
847     /*
848      * The formula: sc = spf+1+spf*spc*(512*8/fat_type),
849      * where sc is sector_count,
850      * spf is sectors_per_fat,
851      * spc is sectors_per_clusters, and
852      * fat_type = 12, 16 or 32.
853      */
854     i = 1+s->sectors_per_cluster*0x200*8/s->fat_type;
855     s->sectors_per_fat=(s->sector_count+i)/i; /* round up */
856 
857     array_init(&(s->mapping),sizeof(mapping_t));
858     array_init(&(s->directory),sizeof(direntry_t));
859 
860     /* add volume label */
861     {
862 	direntry_t* entry=array_get_next(&(s->directory));
863 	entry->attributes=0x28; /* archive | volume label */
864         memcpy(entry->name, s->volume_label, sizeof(entry->name));
865     }
866 
867     /* Now build FAT, and write back information into directory */
868     init_fat(s);
869 
870     s->faked_sectors=s->first_sectors_number+s->sectors_per_fat*2;
871     s->cluster_count=sector2cluster(s, s->sector_count);
872 
873     mapping = array_get_next(&(s->mapping));
874     mapping->begin = 0;
875     mapping->dir_index = 0;
876     mapping->info.dir.parent_mapping_index = -1;
877     mapping->first_mapping_index = -1;
878     mapping->path = g_strdup(dirname);
879     i = strlen(mapping->path);
880     if (i > 0 && mapping->path[i - 1] == '/')
881 	mapping->path[i - 1] = '\0';
882     mapping->mode = MODE_DIRECTORY;
883     mapping->read_only = 0;
884     s->path = mapping->path;
885 
886     for (i = 0, cluster = 0; i < s->mapping.next; i++) {
887 	/* MS-DOS expects the FAT to be 0 for the root directory
888 	 * (except for the media byte). */
889 	/* LATER TODO: still true for FAT32? */
890 	int fix_fat = (i != 0);
891 	mapping = array_get(&(s->mapping), i);
892 
893         if (mapping->mode & MODE_DIRECTORY) {
894 	    mapping->begin = cluster;
895 	    if(read_directory(s, i)) {
896                 error_setg(errp, "Could not read directory %s",
897                            mapping->path);
898 		return -1;
899 	    }
900 	    mapping = array_get(&(s->mapping), i);
901 	} else {
902 	    assert(mapping->mode == MODE_UNDEFINED);
903 	    mapping->mode=MODE_NORMAL;
904 	    mapping->begin = cluster;
905 	    if (mapping->end > 0) {
906 		direntry_t* direntry = array_get(&(s->directory),
907 			mapping->dir_index);
908 
909 		mapping->end = cluster + 1 + (mapping->end-1)/s->cluster_size;
910 		set_begin_of_direntry(direntry, mapping->begin);
911 	    } else {
912 		mapping->end = cluster + 1;
913 		fix_fat = 0;
914 	    }
915 	}
916 
917 	assert(mapping->begin < mapping->end);
918 
919 	/* next free cluster */
920 	cluster = mapping->end;
921 
922 	if(cluster > s->cluster_count) {
923             error_setg(errp,
924                        "Directory does not fit in FAT%d (capacity %.2f MB)",
925                        s->fat_type, s->sector_count / 2000.0);
926             return -1;
927 	}
928 
929 	/* fix fat for entry */
930 	if (fix_fat) {
931 	    int j;
932 	    for(j = mapping->begin; j < mapping->end - 1; j++)
933 		fat_set(s, j, j+1);
934 	    fat_set(s, mapping->end - 1, s->max_fat_value);
935 	}
936     }
937 
938     mapping = array_get(&(s->mapping), 0);
939     s->sectors_of_root_directory = mapping->end * s->sectors_per_cluster;
940     s->last_cluster_of_root_directory = mapping->end;
941 
942     /* the FAT signature */
943     fat_set(s,0,s->max_fat_value);
944     fat_set(s,1,s->max_fat_value);
945 
946     s->current_mapping = NULL;
947 
948     bootsector=(bootsector_t*)(s->first_sectors+(s->first_sectors_number-1)*0x200);
949     bootsector->jump[0]=0xeb;
950     bootsector->jump[1]=0x3e;
951     bootsector->jump[2]=0x90;
952     memcpy(bootsector->name,"QEMU    ",8);
953     bootsector->sector_size=cpu_to_le16(0x200);
954     bootsector->sectors_per_cluster=s->sectors_per_cluster;
955     bootsector->reserved_sectors=cpu_to_le16(1);
956     bootsector->number_of_fats=0x2; /* number of FATs */
957     bootsector->root_entries=cpu_to_le16(s->sectors_of_root_directory*0x10);
958     bootsector->total_sectors16=s->sector_count>0xffff?0:cpu_to_le16(s->sector_count);
959     bootsector->media_type=(s->first_sectors_number>1?0xf8:0xf0); /* media descriptor (f8=hd, f0=3.5 fd)*/
960     s->fat.pointer[0] = bootsector->media_type;
961     bootsector->sectors_per_fat=cpu_to_le16(s->sectors_per_fat);
962     bootsector->sectors_per_track = cpu_to_le16(secs);
963     bootsector->number_of_heads = cpu_to_le16(heads);
964     bootsector->hidden_sectors=cpu_to_le32(s->first_sectors_number==1?0:0x3f);
965     bootsector->total_sectors=cpu_to_le32(s->sector_count>0xffff?s->sector_count:0);
966 
967     /* LATER TODO: if FAT32, this is wrong */
968     bootsector->u.fat16.drive_number=s->first_sectors_number==1?0:0x80; /* fda=0, hda=0x80 */
969     bootsector->u.fat16.current_head=0;
970     bootsector->u.fat16.signature=0x29;
971     bootsector->u.fat16.id=cpu_to_le32(0xfabe1afd);
972 
973     memcpy(bootsector->u.fat16.volume_label, s->volume_label,
974            sizeof(bootsector->u.fat16.volume_label));
975     memcpy(bootsector->fat_type,(s->fat_type==12?"FAT12   ":s->fat_type==16?"FAT16   ":"FAT32   "),8);
976     bootsector->magic[0]=0x55; bootsector->magic[1]=0xaa;
977 
978     return 0;
979 }
980 
981 #ifdef DEBUG
982 static BDRVVVFATState *vvv = NULL;
983 #endif
984 
985 static int enable_write_target(BDRVVVFATState *s, Error **errp);
986 static int is_consistent(BDRVVVFATState *s);
987 
988 static void vvfat_rebind(BlockDriverState *bs)
989 {
990     BDRVVVFATState *s = bs->opaque;
991     s->bs = bs;
992 }
993 
994 static QemuOptsList runtime_opts = {
995     .name = "vvfat",
996     .head = QTAILQ_HEAD_INITIALIZER(runtime_opts.head),
997     .desc = {
998         {
999             .name = "dir",
1000             .type = QEMU_OPT_STRING,
1001             .help = "Host directory to map to the vvfat device",
1002         },
1003         {
1004             .name = "fat-type",
1005             .type = QEMU_OPT_NUMBER,
1006             .help = "FAT type (12, 16 or 32)",
1007         },
1008         {
1009             .name = "floppy",
1010             .type = QEMU_OPT_BOOL,
1011             .help = "Create a floppy rather than a hard disk image",
1012         },
1013         {
1014             .name = "label",
1015             .type = QEMU_OPT_STRING,
1016             .help = "Use a volume label other than QEMU VVFAT",
1017         },
1018         {
1019             .name = "rw",
1020             .type = QEMU_OPT_BOOL,
1021             .help = "Make the image writable",
1022         },
1023         { /* end of list */ }
1024     },
1025 };
1026 
1027 static void vvfat_parse_filename(const char *filename, QDict *options,
1028                                  Error **errp)
1029 {
1030     int fat_type = 0;
1031     bool floppy = false;
1032     bool rw = false;
1033     int i;
1034 
1035     if (!strstart(filename, "fat:", NULL)) {
1036         error_setg(errp, "File name string must start with 'fat:'");
1037         return;
1038     }
1039 
1040     /* Parse options */
1041     if (strstr(filename, ":32:")) {
1042         fat_type = 32;
1043     } else if (strstr(filename, ":16:")) {
1044         fat_type = 16;
1045     } else if (strstr(filename, ":12:")) {
1046         fat_type = 12;
1047     }
1048 
1049     if (strstr(filename, ":floppy:")) {
1050         floppy = true;
1051     }
1052 
1053     if (strstr(filename, ":rw:")) {
1054         rw = true;
1055     }
1056 
1057     /* Get the directory name without options */
1058     i = strrchr(filename, ':') - filename;
1059     assert(i >= 3);
1060     if (filename[i - 2] == ':' && qemu_isalpha(filename[i - 1])) {
1061         /* workaround for DOS drive names */
1062         filename += i - 1;
1063     } else {
1064         filename += i + 1;
1065     }
1066 
1067     /* Fill in the options QDict */
1068     qdict_put(options, "dir", qstring_from_str(filename));
1069     qdict_put(options, "fat-type", qint_from_int(fat_type));
1070     qdict_put(options, "floppy", qbool_from_bool(floppy));
1071     qdict_put(options, "rw", qbool_from_bool(rw));
1072 }
1073 
1074 static int vvfat_open(BlockDriverState *bs, QDict *options, int flags,
1075                       Error **errp)
1076 {
1077     BDRVVVFATState *s = bs->opaque;
1078     int cyls, heads, secs;
1079     bool floppy;
1080     const char *dirname, *label;
1081     QemuOpts *opts;
1082     Error *local_err = NULL;
1083     int ret;
1084 
1085 #ifdef DEBUG
1086     vvv = s;
1087 #endif
1088 
1089     opts = qemu_opts_create(&runtime_opts, NULL, 0, &error_abort);
1090     qemu_opts_absorb_qdict(opts, options, &local_err);
1091     if (local_err) {
1092         error_propagate(errp, local_err);
1093         ret = -EINVAL;
1094         goto fail;
1095     }
1096 
1097     dirname = qemu_opt_get(opts, "dir");
1098     if (!dirname) {
1099         error_setg(errp, "vvfat block driver requires a 'dir' option");
1100         ret = -EINVAL;
1101         goto fail;
1102     }
1103 
1104     s->fat_type = qemu_opt_get_number(opts, "fat-type", 0);
1105     floppy = qemu_opt_get_bool(opts, "floppy", false);
1106 
1107     memset(s->volume_label, ' ', sizeof(s->volume_label));
1108     label = qemu_opt_get(opts, "label");
1109     if (label) {
1110         size_t label_length = strlen(label);
1111         if (label_length > 11) {
1112             error_setg(errp, "vvfat label cannot be longer than 11 bytes");
1113             ret = -EINVAL;
1114             goto fail;
1115         }
1116         memcpy(s->volume_label, label, label_length);
1117     }
1118 
1119     if (floppy) {
1120         /* 1.44MB or 2.88MB floppy.  2.88MB can be FAT12 (default) or FAT16. */
1121         if (!s->fat_type) {
1122             s->fat_type = 12;
1123             secs = 36;
1124             s->sectors_per_cluster = 2;
1125         } else {
1126             secs = s->fat_type == 12 ? 18 : 36;
1127             s->sectors_per_cluster = 1;
1128         }
1129         s->first_sectors_number = 1;
1130         cyls = 80;
1131         heads = 2;
1132     } else {
1133         /* 32MB or 504MB disk*/
1134         if (!s->fat_type) {
1135             s->fat_type = 16;
1136         }
1137         s->first_sectors_number = 0x40;
1138         cyls = s->fat_type == 12 ? 64 : 1024;
1139         heads = 16;
1140         secs = 63;
1141     }
1142 
1143     switch (s->fat_type) {
1144     case 32:
1145 	    fprintf(stderr, "Big fat greek warning: FAT32 has not been tested. "
1146                 "You are welcome to do so!\n");
1147         break;
1148     case 16:
1149     case 12:
1150         break;
1151     default:
1152         error_setg(errp, "Valid FAT types are only 12, 16 and 32");
1153         ret = -EINVAL;
1154         goto fail;
1155     }
1156 
1157 
1158     s->bs = bs;
1159 
1160     /* LATER TODO: if FAT32, adjust */
1161     s->sectors_per_cluster=0x10;
1162 
1163     s->current_cluster=0xffffffff;
1164 
1165     /* read only is the default for safety */
1166     bs->read_only = 1;
1167     s->qcow = s->write_target = NULL;
1168     s->qcow_filename = NULL;
1169     s->fat2 = NULL;
1170     s->downcase_short_names = 1;
1171 
1172     fprintf(stderr, "vvfat %s chs %d,%d,%d\n",
1173             dirname, cyls, heads, secs);
1174 
1175     s->sector_count = cyls * heads * secs - (s->first_sectors_number - 1);
1176 
1177     if (qemu_opt_get_bool(opts, "rw", false)) {
1178         ret = enable_write_target(s, errp);
1179         if (ret < 0) {
1180             goto fail;
1181         }
1182         bs->read_only = 0;
1183     }
1184 
1185     bs->total_sectors = cyls * heads * secs;
1186 
1187     if (init_directories(s, dirname, heads, secs, errp)) {
1188         ret = -EIO;
1189         goto fail;
1190     }
1191 
1192     s->sector_count = s->faked_sectors + s->sectors_per_cluster*s->cluster_count;
1193 
1194     if (s->first_sectors_number == 0x40) {
1195         init_mbr(s, cyls, heads, secs);
1196     }
1197 
1198     //    assert(is_consistent(s));
1199     qemu_co_mutex_init(&s->lock);
1200 
1201     /* Disable migration when vvfat is used rw */
1202     if (s->qcow) {
1203         error_setg(&s->migration_blocker,
1204                    "The vvfat (rw) format used by node '%s' "
1205                    "does not support live migration",
1206                    bdrv_get_device_or_node_name(bs));
1207         migrate_add_blocker(s->migration_blocker);
1208     }
1209 
1210     ret = 0;
1211 fail:
1212     qemu_opts_del(opts);
1213     return ret;
1214 }
1215 
1216 static inline void vvfat_close_current_file(BDRVVVFATState *s)
1217 {
1218     if(s->current_mapping) {
1219 	s->current_mapping = NULL;
1220 	if (s->current_fd) {
1221 		qemu_close(s->current_fd);
1222 		s->current_fd = 0;
1223 	}
1224     }
1225     s->current_cluster = -1;
1226 }
1227 
1228 /* mappings between index1 and index2-1 are supposed to be ordered
1229  * return value is the index of the last mapping for which end>cluster_num
1230  */
1231 static inline int find_mapping_for_cluster_aux(BDRVVVFATState* s,int cluster_num,int index1,int index2)
1232 {
1233     while(1) {
1234         int index3;
1235 	mapping_t* mapping;
1236 	index3=(index1+index2)/2;
1237 	mapping=array_get(&(s->mapping),index3);
1238 	assert(mapping->begin < mapping->end);
1239 	if(mapping->begin>=cluster_num) {
1240 	    assert(index2!=index3 || index2==0);
1241 	    if(index2==index3)
1242 		return index1;
1243 	    index2=index3;
1244 	} else {
1245 	    if(index1==index3)
1246 		return mapping->end<=cluster_num ? index2 : index1;
1247 	    index1=index3;
1248 	}
1249 	assert(index1<=index2);
1250 	DLOG(mapping=array_get(&(s->mapping),index1);
1251 	assert(mapping->begin<=cluster_num);
1252 	assert(index2 >= s->mapping.next ||
1253 		((mapping = array_get(&(s->mapping),index2)) &&
1254 		mapping->end>cluster_num)));
1255     }
1256 }
1257 
1258 static inline mapping_t* find_mapping_for_cluster(BDRVVVFATState* s,int cluster_num)
1259 {
1260     int index=find_mapping_for_cluster_aux(s,cluster_num,0,s->mapping.next);
1261     mapping_t* mapping;
1262     if(index>=s->mapping.next)
1263         return NULL;
1264     mapping=array_get(&(s->mapping),index);
1265     if(mapping->begin>cluster_num)
1266         return NULL;
1267     assert(mapping->begin<=cluster_num && mapping->end>cluster_num);
1268     return mapping;
1269 }
1270 
1271 static int open_file(BDRVVVFATState* s,mapping_t* mapping)
1272 {
1273     if(!mapping)
1274 	return -1;
1275     if(!s->current_mapping ||
1276 	    strcmp(s->current_mapping->path,mapping->path)) {
1277 	/* open file */
1278 	int fd = qemu_open(mapping->path, O_RDONLY | O_BINARY | O_LARGEFILE);
1279 	if(fd<0)
1280 	    return -1;
1281 	vvfat_close_current_file(s);
1282 	s->current_fd = fd;
1283 	s->current_mapping = mapping;
1284     }
1285     return 0;
1286 }
1287 
1288 static inline int read_cluster(BDRVVVFATState *s,int cluster_num)
1289 {
1290     if(s->current_cluster != cluster_num) {
1291 	int result=0;
1292 	off_t offset;
1293 	assert(!s->current_mapping || s->current_fd || (s->current_mapping->mode & MODE_DIRECTORY));
1294 	if(!s->current_mapping
1295 		|| s->current_mapping->begin>cluster_num
1296 		|| s->current_mapping->end<=cluster_num) {
1297 	    /* binary search of mappings for file */
1298 	    mapping_t* mapping=find_mapping_for_cluster(s,cluster_num);
1299 
1300 	    assert(!mapping || (cluster_num>=mapping->begin && cluster_num<mapping->end));
1301 
1302 	    if (mapping && mapping->mode & MODE_DIRECTORY) {
1303 		vvfat_close_current_file(s);
1304 		s->current_mapping = mapping;
1305 read_cluster_directory:
1306 		offset = s->cluster_size*(cluster_num-s->current_mapping->begin);
1307 		s->cluster = (unsigned char*)s->directory.pointer+offset
1308 			+ 0x20*s->current_mapping->info.dir.first_dir_index;
1309 		assert(((s->cluster-(unsigned char*)s->directory.pointer)%s->cluster_size)==0);
1310 		assert((char*)s->cluster+s->cluster_size <= s->directory.pointer+s->directory.next*s->directory.item_size);
1311 		s->current_cluster = cluster_num;
1312 		return 0;
1313 	    }
1314 
1315 	    if(open_file(s,mapping))
1316 		return -2;
1317 	} else if (s->current_mapping->mode & MODE_DIRECTORY)
1318 	    goto read_cluster_directory;
1319 
1320 	assert(s->current_fd);
1321 
1322 	offset=s->cluster_size*(cluster_num-s->current_mapping->begin)+s->current_mapping->info.file.offset;
1323 	if(lseek(s->current_fd, offset, SEEK_SET)!=offset)
1324 	    return -3;
1325 	s->cluster=s->cluster_buffer;
1326 	result=read(s->current_fd,s->cluster,s->cluster_size);
1327 	if(result<0) {
1328 	    s->current_cluster = -1;
1329 	    return -1;
1330 	}
1331 	s->current_cluster = cluster_num;
1332     }
1333     return 0;
1334 }
1335 
1336 #ifdef DEBUG
1337 static void print_direntry(const direntry_t* direntry)
1338 {
1339     int j = 0;
1340     char buffer[1024];
1341 
1342     fprintf(stderr, "direntry %p: ", direntry);
1343     if(!direntry)
1344 	return;
1345     if(is_long_name(direntry)) {
1346 	unsigned char* c=(unsigned char*)direntry;
1347 	int i;
1348 	for(i=1;i<11 && c[i] && c[i]!=0xff;i+=2)
1349 #define ADD_CHAR(c) {buffer[j] = (c); if (buffer[j] < ' ') buffer[j] = 0xb0; j++;}
1350 	    ADD_CHAR(c[i]);
1351 	for(i=14;i<26 && c[i] && c[i]!=0xff;i+=2)
1352 	    ADD_CHAR(c[i]);
1353 	for(i=28;i<32 && c[i] && c[i]!=0xff;i+=2)
1354 	    ADD_CHAR(c[i]);
1355 	buffer[j] = 0;
1356 	fprintf(stderr, "%s\n", buffer);
1357     } else {
1358 	int i;
1359 	for(i=0;i<11;i++)
1360 	    ADD_CHAR(direntry->name[i]);
1361 	buffer[j] = 0;
1362 	fprintf(stderr,"%s attributes=0x%02x begin=%d size=%d\n",
1363 		buffer,
1364 		direntry->attributes,
1365 		begin_of_direntry(direntry),le32_to_cpu(direntry->size));
1366     }
1367 }
1368 
1369 static void print_mapping(const mapping_t* mapping)
1370 {
1371     fprintf(stderr, "mapping (%p): begin, end = %d, %d, dir_index = %d, "
1372         "first_mapping_index = %d, name = %s, mode = 0x%x, " ,
1373         mapping, mapping->begin, mapping->end, mapping->dir_index,
1374         mapping->first_mapping_index, mapping->path, mapping->mode);
1375 
1376     if (mapping->mode & MODE_DIRECTORY)
1377 	fprintf(stderr, "parent_mapping_index = %d, first_dir_index = %d\n", mapping->info.dir.parent_mapping_index, mapping->info.dir.first_dir_index);
1378     else
1379 	fprintf(stderr, "offset = %d\n", mapping->info.file.offset);
1380 }
1381 #endif
1382 
1383 static int vvfat_read(BlockDriverState *bs, int64_t sector_num,
1384                     uint8_t *buf, int nb_sectors)
1385 {
1386     BDRVVVFATState *s = bs->opaque;
1387     int i;
1388 
1389     for(i=0;i<nb_sectors;i++,sector_num++) {
1390 	if (sector_num >= bs->total_sectors)
1391 	   return -1;
1392 	if (s->qcow) {
1393 	    int n;
1394             if (bdrv_is_allocated(s->qcow, sector_num, nb_sectors-i, &n)) {
1395 DLOG(fprintf(stderr, "sectors %d+%d allocated\n", (int)sector_num, n));
1396                 if (bdrv_read(s->qcow, sector_num, buf + i*0x200, n)) {
1397                     return -1;
1398                 }
1399                 i += n - 1;
1400                 sector_num += n - 1;
1401                 continue;
1402             }
1403 DLOG(fprintf(stderr, "sector %d not allocated\n", (int)sector_num));
1404 	}
1405 	if(sector_num<s->faked_sectors) {
1406 	    if(sector_num<s->first_sectors_number)
1407 		memcpy(buf+i*0x200,&(s->first_sectors[sector_num*0x200]),0x200);
1408 	    else if(sector_num-s->first_sectors_number<s->sectors_per_fat)
1409 		memcpy(buf+i*0x200,&(s->fat.pointer[(sector_num-s->first_sectors_number)*0x200]),0x200);
1410 	    else if(sector_num-s->first_sectors_number-s->sectors_per_fat<s->sectors_per_fat)
1411 		memcpy(buf+i*0x200,&(s->fat.pointer[(sector_num-s->first_sectors_number-s->sectors_per_fat)*0x200]),0x200);
1412 	} else {
1413 	    uint32_t sector=sector_num-s->faked_sectors,
1414 	    sector_offset_in_cluster=(sector%s->sectors_per_cluster),
1415 	    cluster_num=sector/s->sectors_per_cluster;
1416 	    if(cluster_num > s->cluster_count || read_cluster(s, cluster_num) != 0) {
1417 		/* LATER TODO: strict: return -1; */
1418 		memset(buf+i*0x200,0,0x200);
1419 		continue;
1420 	    }
1421 	    memcpy(buf+i*0x200,s->cluster+sector_offset_in_cluster*0x200,0x200);
1422 	}
1423     }
1424     return 0;
1425 }
1426 
1427 static coroutine_fn int vvfat_co_read(BlockDriverState *bs, int64_t sector_num,
1428                                       uint8_t *buf, int nb_sectors)
1429 {
1430     int ret;
1431     BDRVVVFATState *s = bs->opaque;
1432     qemu_co_mutex_lock(&s->lock);
1433     ret = vvfat_read(bs, sector_num, buf, nb_sectors);
1434     qemu_co_mutex_unlock(&s->lock);
1435     return ret;
1436 }
1437 
1438 /* LATER TODO: statify all functions */
1439 
1440 /*
1441  * Idea of the write support (use snapshot):
1442  *
1443  * 1. check if all data is consistent, recording renames, modifications,
1444  *    new files and directories (in s->commits).
1445  *
1446  * 2. if the data is not consistent, stop committing
1447  *
1448  * 3. handle renames, and create new files and directories (do not yet
1449  *    write their contents)
1450  *
1451  * 4. walk the directories, fixing the mapping and direntries, and marking
1452  *    the handled mappings as not deleted
1453  *
1454  * 5. commit the contents of the files
1455  *
1456  * 6. handle deleted files and directories
1457  *
1458  */
1459 
1460 typedef struct commit_t {
1461     char* path;
1462     union {
1463 	struct { uint32_t cluster; } rename;
1464 	struct { int dir_index; uint32_t modified_offset; } writeout;
1465 	struct { uint32_t first_cluster; } new_file;
1466 	struct { uint32_t cluster; } mkdir;
1467     } param;
1468     /* DELETEs and RMDIRs are handled differently: see handle_deletes() */
1469     enum {
1470 	ACTION_RENAME, ACTION_WRITEOUT, ACTION_NEW_FILE, ACTION_MKDIR
1471     } action;
1472 } commit_t;
1473 
1474 static void clear_commits(BDRVVVFATState* s)
1475 {
1476     int i;
1477 DLOG(fprintf(stderr, "clear_commits (%d commits)\n", s->commits.next));
1478     for (i = 0; i < s->commits.next; i++) {
1479 	commit_t* commit = array_get(&(s->commits), i);
1480 	assert(commit->path || commit->action == ACTION_WRITEOUT);
1481 	if (commit->action != ACTION_WRITEOUT) {
1482 	    assert(commit->path);
1483             g_free(commit->path);
1484 	} else
1485 	    assert(commit->path == NULL);
1486     }
1487     s->commits.next = 0;
1488 }
1489 
1490 static void schedule_rename(BDRVVVFATState* s,
1491 	uint32_t cluster, char* new_path)
1492 {
1493     commit_t* commit = array_get_next(&(s->commits));
1494     commit->path = new_path;
1495     commit->param.rename.cluster = cluster;
1496     commit->action = ACTION_RENAME;
1497 }
1498 
1499 static void schedule_writeout(BDRVVVFATState* s,
1500 	int dir_index, uint32_t modified_offset)
1501 {
1502     commit_t* commit = array_get_next(&(s->commits));
1503     commit->path = NULL;
1504     commit->param.writeout.dir_index = dir_index;
1505     commit->param.writeout.modified_offset = modified_offset;
1506     commit->action = ACTION_WRITEOUT;
1507 }
1508 
1509 static void schedule_new_file(BDRVVVFATState* s,
1510 	char* path, uint32_t first_cluster)
1511 {
1512     commit_t* commit = array_get_next(&(s->commits));
1513     commit->path = path;
1514     commit->param.new_file.first_cluster = first_cluster;
1515     commit->action = ACTION_NEW_FILE;
1516 }
1517 
1518 static void schedule_mkdir(BDRVVVFATState* s, uint32_t cluster, char* path)
1519 {
1520     commit_t* commit = array_get_next(&(s->commits));
1521     commit->path = path;
1522     commit->param.mkdir.cluster = cluster;
1523     commit->action = ACTION_MKDIR;
1524 }
1525 
1526 typedef struct {
1527     /*
1528      * Since the sequence number is at most 0x3f, and the filename
1529      * length is at most 13 times the sequence number, the maximal
1530      * filename length is 0x3f * 13 bytes.
1531      */
1532     unsigned char name[0x3f * 13 + 1];
1533     int checksum, len;
1534     int sequence_number;
1535 } long_file_name;
1536 
1537 static void lfn_init(long_file_name* lfn)
1538 {
1539    lfn->sequence_number = lfn->len = 0;
1540    lfn->checksum = 0x100;
1541 }
1542 
1543 /* return 0 if parsed successfully, > 0 if no long name, < 0 if error */
1544 static int parse_long_name(long_file_name* lfn,
1545 	const direntry_t* direntry)
1546 {
1547     int i, j, offset;
1548     const unsigned char* pointer = (const unsigned char*)direntry;
1549 
1550     if (!is_long_name(direntry))
1551 	return 1;
1552 
1553     if (pointer[0] & 0x40) {
1554 	lfn->sequence_number = pointer[0] & 0x3f;
1555 	lfn->checksum = pointer[13];
1556 	lfn->name[0] = 0;
1557 	lfn->name[lfn->sequence_number * 13] = 0;
1558     } else if ((pointer[0] & 0x3f) != --lfn->sequence_number)
1559 	return -1;
1560     else if (pointer[13] != lfn->checksum)
1561 	return -2;
1562     else if (pointer[12] || pointer[26] || pointer[27])
1563 	return -3;
1564 
1565     offset = 13 * (lfn->sequence_number - 1);
1566     for (i = 0, j = 1; i < 13; i++, j+=2) {
1567 	if (j == 11)
1568 	    j = 14;
1569 	else if (j == 26)
1570 	    j = 28;
1571 
1572 	if (pointer[j+1] == 0)
1573 	    lfn->name[offset + i] = pointer[j];
1574 	else if (pointer[j+1] != 0xff || (pointer[0] & 0x40) == 0)
1575 	    return -4;
1576 	else
1577 	    lfn->name[offset + i] = 0;
1578     }
1579 
1580     if (pointer[0] & 0x40)
1581 	lfn->len = offset + strlen((char*)lfn->name + offset);
1582 
1583     return 0;
1584 }
1585 
1586 /* returns 0 if successful, >0 if no short_name, and <0 on error */
1587 static int parse_short_name(BDRVVVFATState* s,
1588 	long_file_name* lfn, direntry_t* direntry)
1589 {
1590     int i, j;
1591 
1592     if (!is_short_name(direntry))
1593 	return 1;
1594 
1595     for (j = 7; j >= 0 && direntry->name[j] == ' '; j--);
1596     for (i = 0; i <= j; i++) {
1597 	if (direntry->name[i] <= ' ' || direntry->name[i] > 0x7f)
1598 	    return -1;
1599 	else if (s->downcase_short_names)
1600 	    lfn->name[i] = qemu_tolower(direntry->name[i]);
1601 	else
1602 	    lfn->name[i] = direntry->name[i];
1603     }
1604 
1605     for (j = 2; j >= 0 && direntry->name[8 + j] == ' '; j--) {
1606     }
1607     if (j >= 0) {
1608 	lfn->name[i++] = '.';
1609 	lfn->name[i + j + 1] = '\0';
1610 	for (;j >= 0; j--) {
1611             uint8_t c = direntry->name[8 + j];
1612             if (c <= ' ' || c > 0x7f) {
1613                 return -2;
1614             } else if (s->downcase_short_names) {
1615                 lfn->name[i + j] = qemu_tolower(c);
1616             } else {
1617                 lfn->name[i + j] = c;
1618             }
1619 	}
1620     } else
1621 	lfn->name[i + j + 1] = '\0';
1622 
1623     lfn->len = strlen((char*)lfn->name);
1624 
1625     return 0;
1626 }
1627 
1628 static inline uint32_t modified_fat_get(BDRVVVFATState* s,
1629 	unsigned int cluster)
1630 {
1631     if (cluster < s->last_cluster_of_root_directory) {
1632 	if (cluster + 1 == s->last_cluster_of_root_directory)
1633 	    return s->max_fat_value;
1634 	else
1635 	    return cluster + 1;
1636     }
1637 
1638     if (s->fat_type==32) {
1639         uint32_t* entry=((uint32_t*)s->fat2)+cluster;
1640         return le32_to_cpu(*entry);
1641     } else if (s->fat_type==16) {
1642         uint16_t* entry=((uint16_t*)s->fat2)+cluster;
1643         return le16_to_cpu(*entry);
1644     } else {
1645         const uint8_t* x=s->fat2+cluster*3/2;
1646         return ((x[0]|(x[1]<<8))>>(cluster&1?4:0))&0x0fff;
1647     }
1648 }
1649 
1650 static inline int cluster_was_modified(BDRVVVFATState* s, uint32_t cluster_num)
1651 {
1652     int was_modified = 0;
1653     int i, dummy;
1654 
1655     if (s->qcow == NULL)
1656 	return 0;
1657 
1658     for (i = 0; !was_modified && i < s->sectors_per_cluster; i++)
1659 	was_modified = bdrv_is_allocated(s->qcow,
1660 		cluster2sector(s, cluster_num) + i, 1, &dummy);
1661 
1662     return was_modified;
1663 }
1664 
1665 static const char* get_basename(const char* path)
1666 {
1667     char* basename = strrchr(path, '/');
1668     if (basename == NULL)
1669 	return path;
1670     else
1671 	return basename + 1; /* strip '/' */
1672 }
1673 
1674 /*
1675  * The array s->used_clusters holds the states of the clusters. If it is
1676  * part of a file, it has bit 2 set, in case of a directory, bit 1. If it
1677  * was modified, bit 3 is set.
1678  * If any cluster is allocated, but not part of a file or directory, this
1679  * driver refuses to commit.
1680  */
1681 typedef enum {
1682      USED_DIRECTORY = 1, USED_FILE = 2, USED_ANY = 3, USED_ALLOCATED = 4
1683 } used_t;
1684 
1685 /*
1686  * get_cluster_count_for_direntry() not only determines how many clusters
1687  * are occupied by direntry, but also if it was renamed or modified.
1688  *
1689  * A file is thought to be renamed *only* if there already was a file with
1690  * exactly the same first cluster, but a different name.
1691  *
1692  * Further, the files/directories handled by this function are
1693  * assumed to be *not* deleted (and *only* those).
1694  */
1695 static uint32_t get_cluster_count_for_direntry(BDRVVVFATState* s,
1696 	direntry_t* direntry, const char* path)
1697 {
1698     /*
1699      * This is a little bit tricky:
1700      * IF the guest OS just inserts a cluster into the file chain,
1701      * and leaves the rest alone, (i.e. the original file had clusters
1702      * 15 -> 16, but now has 15 -> 32 -> 16), then the following happens:
1703      *
1704      * - do_commit will write the cluster into the file at the given
1705      *   offset, but
1706      *
1707      * - the cluster which is overwritten should be moved to a later
1708      *   position in the file.
1709      *
1710      * I am not aware that any OS does something as braindead, but this
1711      * situation could happen anyway when not committing for a long time.
1712      * Just to be sure that this does not bite us, detect it, and copy the
1713      * contents of the clusters to-be-overwritten into the qcow.
1714      */
1715     int copy_it = 0;
1716     int was_modified = 0;
1717     int32_t ret = 0;
1718 
1719     uint32_t cluster_num = begin_of_direntry(direntry);
1720     uint32_t offset = 0;
1721     int first_mapping_index = -1;
1722     mapping_t* mapping = NULL;
1723     const char* basename2 = NULL;
1724 
1725     vvfat_close_current_file(s);
1726 
1727     /* the root directory */
1728     if (cluster_num == 0)
1729 	return 0;
1730 
1731     /* write support */
1732     if (s->qcow) {
1733 	basename2 = get_basename(path);
1734 
1735 	mapping = find_mapping_for_cluster(s, cluster_num);
1736 
1737 	if (mapping) {
1738 	    const char* basename;
1739 
1740 	    assert(mapping->mode & MODE_DELETED);
1741 	    mapping->mode &= ~MODE_DELETED;
1742 
1743 	    basename = get_basename(mapping->path);
1744 
1745 	    assert(mapping->mode & MODE_NORMAL);
1746 
1747 	    /* rename */
1748 	    if (strcmp(basename, basename2))
1749 		schedule_rename(s, cluster_num, g_strdup(path));
1750 	} else if (is_file(direntry))
1751 	    /* new file */
1752 	    schedule_new_file(s, g_strdup(path), cluster_num);
1753 	else {
1754             abort();
1755 	    return 0;
1756 	}
1757     }
1758 
1759     while(1) {
1760 	if (s->qcow) {
1761 	    if (!copy_it && cluster_was_modified(s, cluster_num)) {
1762 		if (mapping == NULL ||
1763 			mapping->begin > cluster_num ||
1764 			mapping->end <= cluster_num)
1765 		mapping = find_mapping_for_cluster(s, cluster_num);
1766 
1767 
1768 		if (mapping &&
1769 			(mapping->mode & MODE_DIRECTORY) == 0) {
1770 
1771 		    /* was modified in qcow */
1772 		    if (offset != mapping->info.file.offset + s->cluster_size
1773 			    * (cluster_num - mapping->begin)) {
1774 			/* offset of this cluster in file chain has changed */
1775                         abort();
1776 			copy_it = 1;
1777 		    } else if (offset == 0) {
1778 			const char* basename = get_basename(mapping->path);
1779 
1780 			if (strcmp(basename, basename2))
1781 			    copy_it = 1;
1782 			first_mapping_index = array_index(&(s->mapping), mapping);
1783 		    }
1784 
1785 		    if (mapping->first_mapping_index != first_mapping_index
1786 			    && mapping->info.file.offset > 0) {
1787                         abort();
1788 			copy_it = 1;
1789 		    }
1790 
1791 		    /* need to write out? */
1792 		    if (!was_modified && is_file(direntry)) {
1793 			was_modified = 1;
1794 			schedule_writeout(s, mapping->dir_index, offset);
1795 		    }
1796 		}
1797 	    }
1798 
1799 	    if (copy_it) {
1800 		int i, dummy;
1801 		/*
1802 		 * This is horribly inefficient, but that is okay, since
1803 		 * it is rarely executed, if at all.
1804 		 */
1805 		int64_t offset = cluster2sector(s, cluster_num);
1806 
1807 		vvfat_close_current_file(s);
1808                 for (i = 0; i < s->sectors_per_cluster; i++) {
1809                     if (!bdrv_is_allocated(s->qcow, offset + i, 1, &dummy)) {
1810                         if (vvfat_read(s->bs, offset, s->cluster_buffer, 1)) {
1811                             return -1;
1812                         }
1813                         if (bdrv_write(s->qcow, offset, s->cluster_buffer, 1)) {
1814                             return -2;
1815                         }
1816                     }
1817                 }
1818 	    }
1819 	}
1820 
1821 	ret++;
1822 	if (s->used_clusters[cluster_num] & USED_ANY)
1823 	    return 0;
1824 	s->used_clusters[cluster_num] = USED_FILE;
1825 
1826 	cluster_num = modified_fat_get(s, cluster_num);
1827 
1828 	if (fat_eof(s, cluster_num))
1829 	    return ret;
1830 	else if (cluster_num < 2 || cluster_num > s->max_fat_value - 16)
1831 	    return -1;
1832 
1833 	offset += s->cluster_size;
1834     }
1835 }
1836 
1837 /*
1838  * This function looks at the modified data (qcow).
1839  * It returns 0 upon inconsistency or error, and the number of clusters
1840  * used by the directory, its subdirectories and their files.
1841  */
1842 static int check_directory_consistency(BDRVVVFATState *s,
1843 	int cluster_num, const char* path)
1844 {
1845     int ret = 0;
1846     unsigned char* cluster = g_malloc(s->cluster_size);
1847     direntry_t* direntries = (direntry_t*)cluster;
1848     mapping_t* mapping = find_mapping_for_cluster(s, cluster_num);
1849 
1850     long_file_name lfn;
1851     int path_len = strlen(path);
1852     char path2[PATH_MAX + 1];
1853 
1854     assert(path_len < PATH_MAX); /* len was tested before! */
1855     pstrcpy(path2, sizeof(path2), path);
1856     path2[path_len] = '/';
1857     path2[path_len + 1] = '\0';
1858 
1859     if (mapping) {
1860 	const char* basename = get_basename(mapping->path);
1861 	const char* basename2 = get_basename(path);
1862 
1863 	assert(mapping->mode & MODE_DIRECTORY);
1864 
1865 	assert(mapping->mode & MODE_DELETED);
1866 	mapping->mode &= ~MODE_DELETED;
1867 
1868 	if (strcmp(basename, basename2))
1869 	    schedule_rename(s, cluster_num, g_strdup(path));
1870     } else
1871 	/* new directory */
1872 	schedule_mkdir(s, cluster_num, g_strdup(path));
1873 
1874     lfn_init(&lfn);
1875     do {
1876 	int i;
1877 	int subret = 0;
1878 
1879 	ret++;
1880 
1881 	if (s->used_clusters[cluster_num] & USED_ANY) {
1882 	    fprintf(stderr, "cluster %d used more than once\n", (int)cluster_num);
1883             goto fail;
1884 	}
1885 	s->used_clusters[cluster_num] = USED_DIRECTORY;
1886 
1887 DLOG(fprintf(stderr, "read cluster %d (sector %d)\n", (int)cluster_num, (int)cluster2sector(s, cluster_num)));
1888 	subret = vvfat_read(s->bs, cluster2sector(s, cluster_num), cluster,
1889 		s->sectors_per_cluster);
1890 	if (subret) {
1891 	    fprintf(stderr, "Error fetching direntries\n");
1892 	fail:
1893             g_free(cluster);
1894 	    return 0;
1895 	}
1896 
1897 	for (i = 0; i < 0x10 * s->sectors_per_cluster; i++) {
1898 	    int cluster_count = 0;
1899 
1900 DLOG(fprintf(stderr, "check direntry %d:\n", i); print_direntry(direntries + i));
1901 	    if (is_volume_label(direntries + i) || is_dot(direntries + i) ||
1902 		    is_free(direntries + i))
1903 		continue;
1904 
1905 	    subret = parse_long_name(&lfn, direntries + i);
1906 	    if (subret < 0) {
1907 		fprintf(stderr, "Error in long name\n");
1908 		goto fail;
1909 	    }
1910 	    if (subret == 0 || is_free(direntries + i))
1911 		continue;
1912 
1913 	    if (fat_chksum(direntries+i) != lfn.checksum) {
1914 		subret = parse_short_name(s, &lfn, direntries + i);
1915 		if (subret < 0) {
1916 		    fprintf(stderr, "Error in short name (%d)\n", subret);
1917 		    goto fail;
1918 		}
1919 		if (subret > 0 || !strcmp((char*)lfn.name, ".")
1920 			|| !strcmp((char*)lfn.name, ".."))
1921 		    continue;
1922 	    }
1923 	    lfn.checksum = 0x100; /* cannot use long name twice */
1924 
1925 	    if (path_len + 1 + lfn.len >= PATH_MAX) {
1926 		fprintf(stderr, "Name too long: %s/%s\n", path, lfn.name);
1927 		goto fail;
1928 	    }
1929             pstrcpy(path2 + path_len + 1, sizeof(path2) - path_len - 1,
1930                     (char*)lfn.name);
1931 
1932 	    if (is_directory(direntries + i)) {
1933 		if (begin_of_direntry(direntries + i) == 0) {
1934 		    DLOG(fprintf(stderr, "invalid begin for directory: %s\n", path2); print_direntry(direntries + i));
1935 		    goto fail;
1936 		}
1937 		cluster_count = check_directory_consistency(s,
1938 			begin_of_direntry(direntries + i), path2);
1939 		if (cluster_count == 0) {
1940 		    DLOG(fprintf(stderr, "problem in directory %s:\n", path2); print_direntry(direntries + i));
1941 		    goto fail;
1942 		}
1943 	    } else if (is_file(direntries + i)) {
1944 		/* check file size with FAT */
1945 		cluster_count = get_cluster_count_for_direntry(s, direntries + i, path2);
1946 		if (cluster_count !=
1947 			(le32_to_cpu(direntries[i].size) + s->cluster_size
1948 			 - 1) / s->cluster_size) {
1949 		    DLOG(fprintf(stderr, "Cluster count mismatch\n"));
1950 		    goto fail;
1951 		}
1952 	    } else
1953                 abort(); /* cluster_count = 0; */
1954 
1955 	    ret += cluster_count;
1956 	}
1957 
1958 	cluster_num = modified_fat_get(s, cluster_num);
1959     } while(!fat_eof(s, cluster_num));
1960 
1961     g_free(cluster);
1962     return ret;
1963 }
1964 
1965 /* returns 1 on success */
1966 static int is_consistent(BDRVVVFATState* s)
1967 {
1968     int i, check;
1969     int used_clusters_count = 0;
1970 
1971 DLOG(checkpoint());
1972     /*
1973      * - get modified FAT
1974      * - compare the two FATs (TODO)
1975      * - get buffer for marking used clusters
1976      * - recurse direntries from root (using bs->bdrv_read to make
1977      *    sure to get the new data)
1978      *   - check that the FAT agrees with the size
1979      *   - count the number of clusters occupied by this directory and
1980      *     its files
1981      * - check that the cumulative used cluster count agrees with the
1982      *   FAT
1983      * - if all is fine, return number of used clusters
1984      */
1985     if (s->fat2 == NULL) {
1986 	int size = 0x200 * s->sectors_per_fat;
1987 	s->fat2 = g_malloc(size);
1988 	memcpy(s->fat2, s->fat.pointer, size);
1989     }
1990     check = vvfat_read(s->bs,
1991 	    s->first_sectors_number, s->fat2, s->sectors_per_fat);
1992     if (check) {
1993 	fprintf(stderr, "Could not copy fat\n");
1994 	return 0;
1995     }
1996     assert (s->used_clusters);
1997     for (i = 0; i < sector2cluster(s, s->sector_count); i++)
1998 	s->used_clusters[i] &= ~USED_ANY;
1999 
2000     clear_commits(s);
2001 
2002     /* mark every mapped file/directory as deleted.
2003      * (check_directory_consistency() will unmark those still present). */
2004     if (s->qcow)
2005 	for (i = 0; i < s->mapping.next; i++) {
2006 	    mapping_t* mapping = array_get(&(s->mapping), i);
2007 	    if (mapping->first_mapping_index < 0)
2008 		mapping->mode |= MODE_DELETED;
2009 	}
2010 
2011     used_clusters_count = check_directory_consistency(s, 0, s->path);
2012     if (used_clusters_count <= 0) {
2013 	DLOG(fprintf(stderr, "problem in directory\n"));
2014 	return 0;
2015     }
2016 
2017     check = s->last_cluster_of_root_directory;
2018     for (i = check; i < sector2cluster(s, s->sector_count); i++) {
2019 	if (modified_fat_get(s, i)) {
2020 	    if(!s->used_clusters[i]) {
2021 		DLOG(fprintf(stderr, "FAT was modified (%d), but cluster is not used?\n", i));
2022 		return 0;
2023 	    }
2024 	    check++;
2025 	}
2026 
2027 	if (s->used_clusters[i] == USED_ALLOCATED) {
2028 	    /* allocated, but not used... */
2029 	    DLOG(fprintf(stderr, "unused, modified cluster: %d\n", i));
2030 	    return 0;
2031 	}
2032     }
2033 
2034     if (check != used_clusters_count)
2035 	return 0;
2036 
2037     return used_clusters_count;
2038 }
2039 
2040 static inline void adjust_mapping_indices(BDRVVVFATState* s,
2041 	int offset, int adjust)
2042 {
2043     int i;
2044 
2045     for (i = 0; i < s->mapping.next; i++) {
2046 	mapping_t* mapping = array_get(&(s->mapping), i);
2047 
2048 #define ADJUST_MAPPING_INDEX(name) \
2049 	if (mapping->name >= offset) \
2050 	    mapping->name += adjust
2051 
2052 	ADJUST_MAPPING_INDEX(first_mapping_index);
2053 	if (mapping->mode & MODE_DIRECTORY)
2054 	    ADJUST_MAPPING_INDEX(info.dir.parent_mapping_index);
2055     }
2056 }
2057 
2058 /* insert or update mapping */
2059 static mapping_t* insert_mapping(BDRVVVFATState* s,
2060 	uint32_t begin, uint32_t end)
2061 {
2062     /*
2063      * - find mapping where mapping->begin >= begin,
2064      * - if mapping->begin > begin: insert
2065      *   - adjust all references to mappings!
2066      * - else: adjust
2067      * - replace name
2068      */
2069     int index = find_mapping_for_cluster_aux(s, begin, 0, s->mapping.next);
2070     mapping_t* mapping = NULL;
2071     mapping_t* first_mapping = array_get(&(s->mapping), 0);
2072 
2073     if (index < s->mapping.next && (mapping = array_get(&(s->mapping), index))
2074 	    && mapping->begin < begin) {
2075 	mapping->end = begin;
2076 	index++;
2077 	mapping = array_get(&(s->mapping), index);
2078     }
2079     if (index >= s->mapping.next || mapping->begin > begin) {
2080 	mapping = array_insert(&(s->mapping), index, 1);
2081 	mapping->path = NULL;
2082 	adjust_mapping_indices(s, index, +1);
2083     }
2084 
2085     mapping->begin = begin;
2086     mapping->end = end;
2087 
2088 DLOG(mapping_t* next_mapping;
2089 assert(index + 1 >= s->mapping.next ||
2090 ((next_mapping = array_get(&(s->mapping), index + 1)) &&
2091  next_mapping->begin >= end)));
2092 
2093     if (s->current_mapping && first_mapping != (mapping_t*)s->mapping.pointer)
2094 	s->current_mapping = array_get(&(s->mapping),
2095 		s->current_mapping - first_mapping);
2096 
2097     return mapping;
2098 }
2099 
2100 static int remove_mapping(BDRVVVFATState* s, int mapping_index)
2101 {
2102     mapping_t* mapping = array_get(&(s->mapping), mapping_index);
2103     mapping_t* first_mapping = array_get(&(s->mapping), 0);
2104 
2105     /* free mapping */
2106     if (mapping->first_mapping_index < 0) {
2107         g_free(mapping->path);
2108     }
2109 
2110     /* remove from s->mapping */
2111     array_remove(&(s->mapping), mapping_index);
2112 
2113     /* adjust all references to mappings */
2114     adjust_mapping_indices(s, mapping_index, -1);
2115 
2116     if (s->current_mapping && first_mapping != (mapping_t*)s->mapping.pointer)
2117 	s->current_mapping = array_get(&(s->mapping),
2118 		s->current_mapping - first_mapping);
2119 
2120     return 0;
2121 }
2122 
2123 static void adjust_dirindices(BDRVVVFATState* s, int offset, int adjust)
2124 {
2125     int i;
2126     for (i = 0; i < s->mapping.next; i++) {
2127 	mapping_t* mapping = array_get(&(s->mapping), i);
2128 	if (mapping->dir_index >= offset)
2129 	    mapping->dir_index += adjust;
2130 	if ((mapping->mode & MODE_DIRECTORY) &&
2131 		mapping->info.dir.first_dir_index >= offset)
2132 	    mapping->info.dir.first_dir_index += adjust;
2133     }
2134 }
2135 
2136 static direntry_t* insert_direntries(BDRVVVFATState* s,
2137 	int dir_index, int count)
2138 {
2139     /*
2140      * make room in s->directory,
2141      * adjust_dirindices
2142      */
2143     direntry_t* result = array_insert(&(s->directory), dir_index, count);
2144     if (result == NULL)
2145 	return NULL;
2146     adjust_dirindices(s, dir_index, count);
2147     return result;
2148 }
2149 
2150 static int remove_direntries(BDRVVVFATState* s, int dir_index, int count)
2151 {
2152     int ret = array_remove_slice(&(s->directory), dir_index, count);
2153     if (ret)
2154 	return ret;
2155     adjust_dirindices(s, dir_index, -count);
2156     return 0;
2157 }
2158 
2159 /*
2160  * Adapt the mappings of the cluster chain starting at first cluster
2161  * (i.e. if a file starts at first_cluster, the chain is followed according
2162  * to the modified fat, and the corresponding entries in s->mapping are
2163  * adjusted)
2164  */
2165 static int commit_mappings(BDRVVVFATState* s,
2166 	uint32_t first_cluster, int dir_index)
2167 {
2168     mapping_t* mapping = find_mapping_for_cluster(s, first_cluster);
2169     direntry_t* direntry = array_get(&(s->directory), dir_index);
2170     uint32_t cluster = first_cluster;
2171 
2172     vvfat_close_current_file(s);
2173 
2174     assert(mapping);
2175     assert(mapping->begin == first_cluster);
2176     mapping->first_mapping_index = -1;
2177     mapping->dir_index = dir_index;
2178     mapping->mode = (dir_index <= 0 || is_directory(direntry)) ?
2179 	MODE_DIRECTORY : MODE_NORMAL;
2180 
2181     while (!fat_eof(s, cluster)) {
2182 	uint32_t c, c1;
2183 
2184 	for (c = cluster, c1 = modified_fat_get(s, c); c + 1 == c1;
2185 		c = c1, c1 = modified_fat_get(s, c1));
2186 
2187 	c++;
2188 	if (c > mapping->end) {
2189 	    int index = array_index(&(s->mapping), mapping);
2190 	    int i, max_i = s->mapping.next - index;
2191 	    for (i = 1; i < max_i && mapping[i].begin < c; i++);
2192 	    while (--i > 0)
2193 		remove_mapping(s, index + 1);
2194 	}
2195 	assert(mapping == array_get(&(s->mapping), s->mapping.next - 1)
2196 		|| mapping[1].begin >= c);
2197 	mapping->end = c;
2198 
2199 	if (!fat_eof(s, c1)) {
2200 	    int i = find_mapping_for_cluster_aux(s, c1, 0, s->mapping.next);
2201 	    mapping_t* next_mapping = i >= s->mapping.next ? NULL :
2202 		array_get(&(s->mapping), i);
2203 
2204 	    if (next_mapping == NULL || next_mapping->begin > c1) {
2205 		int i1 = array_index(&(s->mapping), mapping);
2206 
2207 		next_mapping = insert_mapping(s, c1, c1+1);
2208 
2209 		if (c1 < c)
2210 		    i1++;
2211 		mapping = array_get(&(s->mapping), i1);
2212 	    }
2213 
2214 	    next_mapping->dir_index = mapping->dir_index;
2215 	    next_mapping->first_mapping_index =
2216 		mapping->first_mapping_index < 0 ?
2217 		array_index(&(s->mapping), mapping) :
2218 		mapping->first_mapping_index;
2219 	    next_mapping->path = mapping->path;
2220 	    next_mapping->mode = mapping->mode;
2221 	    next_mapping->read_only = mapping->read_only;
2222 	    if (mapping->mode & MODE_DIRECTORY) {
2223 		next_mapping->info.dir.parent_mapping_index =
2224 			mapping->info.dir.parent_mapping_index;
2225 		next_mapping->info.dir.first_dir_index =
2226 			mapping->info.dir.first_dir_index +
2227 			0x10 * s->sectors_per_cluster *
2228 			(mapping->end - mapping->begin);
2229 	    } else
2230 		next_mapping->info.file.offset = mapping->info.file.offset +
2231 			mapping->end - mapping->begin;
2232 
2233 	    mapping = next_mapping;
2234 	}
2235 
2236 	cluster = c1;
2237     }
2238 
2239     return 0;
2240 }
2241 
2242 static int commit_direntries(BDRVVVFATState* s,
2243 	int dir_index, int parent_mapping_index)
2244 {
2245     direntry_t* direntry = array_get(&(s->directory), dir_index);
2246     uint32_t first_cluster = dir_index == 0 ? 0 : begin_of_direntry(direntry);
2247     mapping_t* mapping = find_mapping_for_cluster(s, first_cluster);
2248 
2249     int factor = 0x10 * s->sectors_per_cluster;
2250     int old_cluster_count, new_cluster_count;
2251     int current_dir_index = mapping->info.dir.first_dir_index;
2252     int first_dir_index = current_dir_index;
2253     int ret, i;
2254     uint32_t c;
2255 
2256 DLOG(fprintf(stderr, "commit_direntries for %s, parent_mapping_index %d\n", mapping->path, parent_mapping_index));
2257 
2258     assert(direntry);
2259     assert(mapping);
2260     assert(mapping->begin == first_cluster);
2261     assert(mapping->info.dir.first_dir_index < s->directory.next);
2262     assert(mapping->mode & MODE_DIRECTORY);
2263     assert(dir_index == 0 || is_directory(direntry));
2264 
2265     mapping->info.dir.parent_mapping_index = parent_mapping_index;
2266 
2267     if (first_cluster == 0) {
2268 	old_cluster_count = new_cluster_count =
2269 	    s->last_cluster_of_root_directory;
2270     } else {
2271 	for (old_cluster_count = 0, c = first_cluster; !fat_eof(s, c);
2272 		c = fat_get(s, c))
2273 	    old_cluster_count++;
2274 
2275 	for (new_cluster_count = 0, c = first_cluster; !fat_eof(s, c);
2276 		c = modified_fat_get(s, c))
2277 	    new_cluster_count++;
2278     }
2279 
2280     if (new_cluster_count > old_cluster_count) {
2281 	if (insert_direntries(s,
2282 		current_dir_index + factor * old_cluster_count,
2283 		factor * (new_cluster_count - old_cluster_count)) == NULL)
2284 	    return -1;
2285     } else if (new_cluster_count < old_cluster_count)
2286 	remove_direntries(s,
2287 		current_dir_index + factor * new_cluster_count,
2288 		factor * (old_cluster_count - new_cluster_count));
2289 
2290     for (c = first_cluster; !fat_eof(s, c); c = modified_fat_get(s, c)) {
2291 	void* direntry = array_get(&(s->directory), current_dir_index);
2292 	int ret = vvfat_read(s->bs, cluster2sector(s, c), direntry,
2293 		s->sectors_per_cluster);
2294 	if (ret)
2295 	    return ret;
2296 	assert(!strncmp(s->directory.pointer, "QEMU", 4));
2297 	current_dir_index += factor;
2298     }
2299 
2300     ret = commit_mappings(s, first_cluster, dir_index);
2301     if (ret)
2302 	return ret;
2303 
2304     /* recurse */
2305     for (i = 0; i < factor * new_cluster_count; i++) {
2306 	direntry = array_get(&(s->directory), first_dir_index + i);
2307 	if (is_directory(direntry) && !is_dot(direntry)) {
2308 	    mapping = find_mapping_for_cluster(s, first_cluster);
2309 	    assert(mapping->mode & MODE_DIRECTORY);
2310 	    ret = commit_direntries(s, first_dir_index + i,
2311 		array_index(&(s->mapping), mapping));
2312 	    if (ret)
2313 		return ret;
2314 	}
2315     }
2316 
2317     return 0;
2318 }
2319 
2320 /* commit one file (adjust contents, adjust mapping),
2321    return first_mapping_index */
2322 static int commit_one_file(BDRVVVFATState* s,
2323 	int dir_index, uint32_t offset)
2324 {
2325     direntry_t* direntry = array_get(&(s->directory), dir_index);
2326     uint32_t c = begin_of_direntry(direntry);
2327     uint32_t first_cluster = c;
2328     mapping_t* mapping = find_mapping_for_cluster(s, c);
2329     uint32_t size = filesize_of_direntry(direntry);
2330     char* cluster = g_malloc(s->cluster_size);
2331     uint32_t i;
2332     int fd = 0;
2333 
2334     assert(offset < size);
2335     assert((offset % s->cluster_size) == 0);
2336 
2337     for (i = s->cluster_size; i < offset; i += s->cluster_size)
2338 	c = modified_fat_get(s, c);
2339 
2340     fd = qemu_open(mapping->path, O_RDWR | O_CREAT | O_BINARY, 0666);
2341     if (fd < 0) {
2342 	fprintf(stderr, "Could not open %s... (%s, %d)\n", mapping->path,
2343 		strerror(errno), errno);
2344         g_free(cluster);
2345 	return fd;
2346     }
2347     if (offset > 0) {
2348         if (lseek(fd, offset, SEEK_SET) != offset) {
2349             qemu_close(fd);
2350             g_free(cluster);
2351             return -3;
2352         }
2353     }
2354 
2355     while (offset < size) {
2356 	uint32_t c1;
2357 	int rest_size = (size - offset > s->cluster_size ?
2358 		s->cluster_size : size - offset);
2359 	int ret;
2360 
2361 	c1 = modified_fat_get(s, c);
2362 
2363 	assert((size - offset == 0 && fat_eof(s, c)) ||
2364 		(size > offset && c >=2 && !fat_eof(s, c)));
2365 
2366 	ret = vvfat_read(s->bs, cluster2sector(s, c),
2367 	    (uint8_t*)cluster, (rest_size + 0x1ff) / 0x200);
2368 
2369         if (ret < 0) {
2370             qemu_close(fd);
2371             g_free(cluster);
2372             return ret;
2373         }
2374 
2375         if (write(fd, cluster, rest_size) < 0) {
2376             qemu_close(fd);
2377             g_free(cluster);
2378             return -2;
2379         }
2380 
2381 	offset += rest_size;
2382 	c = c1;
2383     }
2384 
2385     if (ftruncate(fd, size)) {
2386         perror("ftruncate()");
2387         qemu_close(fd);
2388         g_free(cluster);
2389         return -4;
2390     }
2391     qemu_close(fd);
2392     g_free(cluster);
2393 
2394     return commit_mappings(s, first_cluster, dir_index);
2395 }
2396 
2397 #ifdef DEBUG
2398 /* test, if all mappings point to valid direntries */
2399 static void check1(BDRVVVFATState* s)
2400 {
2401     int i;
2402     for (i = 0; i < s->mapping.next; i++) {
2403 	mapping_t* mapping = array_get(&(s->mapping), i);
2404 	if (mapping->mode & MODE_DELETED) {
2405 	    fprintf(stderr, "deleted\n");
2406 	    continue;
2407 	}
2408 	assert(mapping->dir_index < s->directory.next);
2409 	direntry_t* direntry = array_get(&(s->directory), mapping->dir_index);
2410 	assert(mapping->begin == begin_of_direntry(direntry) || mapping->first_mapping_index >= 0);
2411 	if (mapping->mode & MODE_DIRECTORY) {
2412 	    assert(mapping->info.dir.first_dir_index + 0x10 * s->sectors_per_cluster * (mapping->end - mapping->begin) <= s->directory.next);
2413 	    assert((mapping->info.dir.first_dir_index % (0x10 * s->sectors_per_cluster)) == 0);
2414 	}
2415     }
2416 }
2417 
2418 /* test, if all direntries have mappings */
2419 static void check2(BDRVVVFATState* s)
2420 {
2421     int i;
2422     int first_mapping = -1;
2423 
2424     for (i = 0; i < s->directory.next; i++) {
2425 	direntry_t* direntry = array_get(&(s->directory), i);
2426 
2427 	if (is_short_name(direntry) && begin_of_direntry(direntry)) {
2428 	    mapping_t* mapping = find_mapping_for_cluster(s, begin_of_direntry(direntry));
2429 	    assert(mapping);
2430 	    assert(mapping->dir_index == i || is_dot(direntry));
2431 	    assert(mapping->begin == begin_of_direntry(direntry) || is_dot(direntry));
2432 	}
2433 
2434 	if ((i % (0x10 * s->sectors_per_cluster)) == 0) {
2435 	    /* cluster start */
2436 	    int j, count = 0;
2437 
2438 	    for (j = 0; j < s->mapping.next; j++) {
2439 		mapping_t* mapping = array_get(&(s->mapping), j);
2440 		if (mapping->mode & MODE_DELETED)
2441 		    continue;
2442 		if (mapping->mode & MODE_DIRECTORY) {
2443 		    if (mapping->info.dir.first_dir_index <= i && mapping->info.dir.first_dir_index + 0x10 * s->sectors_per_cluster > i) {
2444 			assert(++count == 1);
2445 			if (mapping->first_mapping_index == -1)
2446 			    first_mapping = array_index(&(s->mapping), mapping);
2447 			else
2448 			    assert(first_mapping == mapping->first_mapping_index);
2449 			if (mapping->info.dir.parent_mapping_index < 0)
2450 			    assert(j == 0);
2451 			else {
2452 			    mapping_t* parent = array_get(&(s->mapping), mapping->info.dir.parent_mapping_index);
2453 			    assert(parent->mode & MODE_DIRECTORY);
2454 			    assert(parent->info.dir.first_dir_index < mapping->info.dir.first_dir_index);
2455 			}
2456 		    }
2457 		}
2458 	    }
2459 	    if (count == 0)
2460 		first_mapping = -1;
2461 	}
2462     }
2463 }
2464 #endif
2465 
2466 static int handle_renames_and_mkdirs(BDRVVVFATState* s)
2467 {
2468     int i;
2469 
2470 #ifdef DEBUG
2471     fprintf(stderr, "handle_renames\n");
2472     for (i = 0; i < s->commits.next; i++) {
2473 	commit_t* commit = array_get(&(s->commits), i);
2474 	fprintf(stderr, "%d, %s (%d, %d)\n", i, commit->path ? commit->path : "(null)", commit->param.rename.cluster, commit->action);
2475     }
2476 #endif
2477 
2478     for (i = 0; i < s->commits.next;) {
2479 	commit_t* commit = array_get(&(s->commits), i);
2480 	if (commit->action == ACTION_RENAME) {
2481 	    mapping_t* mapping = find_mapping_for_cluster(s,
2482 		    commit->param.rename.cluster);
2483 	    char* old_path = mapping->path;
2484 
2485 	    assert(commit->path);
2486 	    mapping->path = commit->path;
2487 	    if (rename(old_path, mapping->path))
2488 		return -2;
2489 
2490 	    if (mapping->mode & MODE_DIRECTORY) {
2491 		int l1 = strlen(mapping->path);
2492 		int l2 = strlen(old_path);
2493 		int diff = l1 - l2;
2494 		direntry_t* direntry = array_get(&(s->directory),
2495 			mapping->info.dir.first_dir_index);
2496 		uint32_t c = mapping->begin;
2497 		int i = 0;
2498 
2499 		/* recurse */
2500 		while (!fat_eof(s, c)) {
2501 		    do {
2502 			direntry_t* d = direntry + i;
2503 
2504 			if (is_file(d) || (is_directory(d) && !is_dot(d))) {
2505 			    mapping_t* m = find_mapping_for_cluster(s,
2506 				    begin_of_direntry(d));
2507 			    int l = strlen(m->path);
2508 			    char* new_path = g_malloc(l + diff + 1);
2509 
2510 			    assert(!strncmp(m->path, mapping->path, l2));
2511 
2512                             pstrcpy(new_path, l + diff + 1, mapping->path);
2513                             pstrcpy(new_path + l1, l + diff + 1 - l1,
2514                                     m->path + l2);
2515 
2516 			    schedule_rename(s, m->begin, new_path);
2517 			}
2518 			i++;
2519 		    } while((i % (0x10 * s->sectors_per_cluster)) != 0);
2520 		    c = fat_get(s, c);
2521 		}
2522 	    }
2523 
2524             g_free(old_path);
2525 	    array_remove(&(s->commits), i);
2526 	    continue;
2527 	} else if (commit->action == ACTION_MKDIR) {
2528 	    mapping_t* mapping;
2529 	    int j, parent_path_len;
2530 
2531 #ifdef __MINGW32__
2532             if (mkdir(commit->path))
2533                 return -5;
2534 #else
2535             if (mkdir(commit->path, 0755))
2536                 return -5;
2537 #endif
2538 
2539 	    mapping = insert_mapping(s, commit->param.mkdir.cluster,
2540 		    commit->param.mkdir.cluster + 1);
2541 	    if (mapping == NULL)
2542 		return -6;
2543 
2544 	    mapping->mode = MODE_DIRECTORY;
2545 	    mapping->read_only = 0;
2546 	    mapping->path = commit->path;
2547 	    j = s->directory.next;
2548 	    assert(j);
2549 	    insert_direntries(s, s->directory.next,
2550 		    0x10 * s->sectors_per_cluster);
2551 	    mapping->info.dir.first_dir_index = j;
2552 
2553 	    parent_path_len = strlen(commit->path)
2554 		- strlen(get_basename(commit->path)) - 1;
2555 	    for (j = 0; j < s->mapping.next; j++) {
2556 		mapping_t* m = array_get(&(s->mapping), j);
2557 		if (m->first_mapping_index < 0 && m != mapping &&
2558 			!strncmp(m->path, mapping->path, parent_path_len) &&
2559 			strlen(m->path) == parent_path_len)
2560 		    break;
2561 	    }
2562 	    assert(j < s->mapping.next);
2563 	    mapping->info.dir.parent_mapping_index = j;
2564 
2565 	    array_remove(&(s->commits), i);
2566 	    continue;
2567 	}
2568 
2569 	i++;
2570     }
2571     return 0;
2572 }
2573 
2574 /*
2575  * TODO: make sure that the short name is not matching *another* file
2576  */
2577 static int handle_commits(BDRVVVFATState* s)
2578 {
2579     int i, fail = 0;
2580 
2581     vvfat_close_current_file(s);
2582 
2583     for (i = 0; !fail && i < s->commits.next; i++) {
2584 	commit_t* commit = array_get(&(s->commits), i);
2585 	switch(commit->action) {
2586 	case ACTION_RENAME: case ACTION_MKDIR:
2587             abort();
2588 	    fail = -2;
2589 	    break;
2590 	case ACTION_WRITEOUT: {
2591 #ifndef NDEBUG
2592             /* these variables are only used by assert() below */
2593 	    direntry_t* entry = array_get(&(s->directory),
2594 		    commit->param.writeout.dir_index);
2595 	    uint32_t begin = begin_of_direntry(entry);
2596 	    mapping_t* mapping = find_mapping_for_cluster(s, begin);
2597 #endif
2598 
2599 	    assert(mapping);
2600 	    assert(mapping->begin == begin);
2601 	    assert(commit->path == NULL);
2602 
2603 	    if (commit_one_file(s, commit->param.writeout.dir_index,
2604 			commit->param.writeout.modified_offset))
2605 		fail = -3;
2606 
2607 	    break;
2608 	}
2609 	case ACTION_NEW_FILE: {
2610 	    int begin = commit->param.new_file.first_cluster;
2611 	    mapping_t* mapping = find_mapping_for_cluster(s, begin);
2612 	    direntry_t* entry;
2613 	    int i;
2614 
2615 	    /* find direntry */
2616 	    for (i = 0; i < s->directory.next; i++) {
2617 		entry = array_get(&(s->directory), i);
2618 		if (is_file(entry) && begin_of_direntry(entry) == begin)
2619 		    break;
2620 	    }
2621 
2622 	    if (i >= s->directory.next) {
2623 		fail = -6;
2624 		continue;
2625 	    }
2626 
2627 	    /* make sure there exists an initial mapping */
2628 	    if (mapping && mapping->begin != begin) {
2629 		mapping->end = begin;
2630 		mapping = NULL;
2631 	    }
2632 	    if (mapping == NULL) {
2633 		mapping = insert_mapping(s, begin, begin+1);
2634 	    }
2635 	    /* most members will be fixed in commit_mappings() */
2636 	    assert(commit->path);
2637 	    mapping->path = commit->path;
2638 	    mapping->read_only = 0;
2639 	    mapping->mode = MODE_NORMAL;
2640 	    mapping->info.file.offset = 0;
2641 
2642 	    if (commit_one_file(s, i, 0))
2643 		fail = -7;
2644 
2645 	    break;
2646 	}
2647 	default:
2648             abort();
2649 	}
2650     }
2651     if (i > 0 && array_remove_slice(&(s->commits), 0, i))
2652 	return -1;
2653     return fail;
2654 }
2655 
2656 static int handle_deletes(BDRVVVFATState* s)
2657 {
2658     int i, deferred = 1, deleted = 1;
2659 
2660     /* delete files corresponding to mappings marked as deleted */
2661     /* handle DELETEs and unused mappings (modified_fat_get(s, mapping->begin) == 0) */
2662     while (deferred && deleted) {
2663 	deferred = 0;
2664 	deleted = 0;
2665 
2666 	for (i = 1; i < s->mapping.next; i++) {
2667 	    mapping_t* mapping = array_get(&(s->mapping), i);
2668 	    if (mapping->mode & MODE_DELETED) {
2669 		direntry_t* entry = array_get(&(s->directory),
2670 			mapping->dir_index);
2671 
2672 		if (is_free(entry)) {
2673 		    /* remove file/directory */
2674 		    if (mapping->mode & MODE_DIRECTORY) {
2675 			int j, next_dir_index = s->directory.next,
2676 			first_dir_index = mapping->info.dir.first_dir_index;
2677 
2678 			if (rmdir(mapping->path) < 0) {
2679 			    if (errno == ENOTEMPTY) {
2680 				deferred++;
2681 				continue;
2682 			    } else
2683 				return -5;
2684 			}
2685 
2686 			for (j = 1; j < s->mapping.next; j++) {
2687 			    mapping_t* m = array_get(&(s->mapping), j);
2688 			    if (m->mode & MODE_DIRECTORY &&
2689 				    m->info.dir.first_dir_index >
2690 				    first_dir_index &&
2691 				    m->info.dir.first_dir_index <
2692 				    next_dir_index)
2693 				next_dir_index =
2694 				    m->info.dir.first_dir_index;
2695 			}
2696 			remove_direntries(s, first_dir_index,
2697 				next_dir_index - first_dir_index);
2698 
2699 			deleted++;
2700 		    }
2701 		} else {
2702 		    if (unlink(mapping->path))
2703 			return -4;
2704 		    deleted++;
2705 		}
2706 		DLOG(fprintf(stderr, "DELETE (%d)\n", i); print_mapping(mapping); print_direntry(entry));
2707 		remove_mapping(s, i);
2708 	    }
2709 	}
2710     }
2711 
2712     return 0;
2713 }
2714 
2715 /*
2716  * synchronize mapping with new state:
2717  *
2718  * - copy FAT (with bdrv_read)
2719  * - mark all filenames corresponding to mappings as deleted
2720  * - recurse direntries from root (using bs->bdrv_read)
2721  * - delete files corresponding to mappings marked as deleted
2722  */
2723 static int do_commit(BDRVVVFATState* s)
2724 {
2725     int ret = 0;
2726 
2727     /* the real meat are the commits. Nothing to do? Move along! */
2728     if (s->commits.next == 0)
2729 	return 0;
2730 
2731     vvfat_close_current_file(s);
2732 
2733     ret = handle_renames_and_mkdirs(s);
2734     if (ret) {
2735 	fprintf(stderr, "Error handling renames (%d)\n", ret);
2736         abort();
2737 	return ret;
2738     }
2739 
2740     /* copy FAT (with bdrv_read) */
2741     memcpy(s->fat.pointer, s->fat2, 0x200 * s->sectors_per_fat);
2742 
2743     /* recurse direntries from root (using bs->bdrv_read) */
2744     ret = commit_direntries(s, 0, -1);
2745     if (ret) {
2746 	fprintf(stderr, "Fatal: error while committing (%d)\n", ret);
2747         abort();
2748 	return ret;
2749     }
2750 
2751     ret = handle_commits(s);
2752     if (ret) {
2753 	fprintf(stderr, "Error handling commits (%d)\n", ret);
2754         abort();
2755 	return ret;
2756     }
2757 
2758     ret = handle_deletes(s);
2759     if (ret) {
2760 	fprintf(stderr, "Error deleting\n");
2761         abort();
2762 	return ret;
2763     }
2764 
2765     if (s->qcow->drv->bdrv_make_empty) {
2766         s->qcow->drv->bdrv_make_empty(s->qcow);
2767     }
2768 
2769     memset(s->used_clusters, 0, sector2cluster(s, s->sector_count));
2770 
2771 DLOG(checkpoint());
2772     return 0;
2773 }
2774 
2775 static int try_commit(BDRVVVFATState* s)
2776 {
2777     vvfat_close_current_file(s);
2778 DLOG(checkpoint());
2779     if(!is_consistent(s))
2780 	return -1;
2781     return do_commit(s);
2782 }
2783 
2784 static int vvfat_write(BlockDriverState *bs, int64_t sector_num,
2785                     const uint8_t *buf, int nb_sectors)
2786 {
2787     BDRVVVFATState *s = bs->opaque;
2788     int i, ret;
2789 
2790 DLOG(checkpoint());
2791 
2792     /* Check if we're operating in read-only mode */
2793     if (s->qcow == NULL) {
2794         return -EACCES;
2795     }
2796 
2797     vvfat_close_current_file(s);
2798 
2799     /*
2800      * Some sanity checks:
2801      * - do not allow writing to the boot sector
2802      * - do not allow to write non-ASCII filenames
2803      */
2804 
2805     if (sector_num < s->first_sectors_number)
2806 	return -1;
2807 
2808     for (i = sector2cluster(s, sector_num);
2809 	    i <= sector2cluster(s, sector_num + nb_sectors - 1);) {
2810 	mapping_t* mapping = find_mapping_for_cluster(s, i);
2811 	if (mapping) {
2812 	    if (mapping->read_only) {
2813 		fprintf(stderr, "Tried to write to write-protected file %s\n",
2814 			mapping->path);
2815 		return -1;
2816 	    }
2817 
2818 	    if (mapping->mode & MODE_DIRECTORY) {
2819 		int begin = cluster2sector(s, i);
2820 		int end = begin + s->sectors_per_cluster, k;
2821 		int dir_index;
2822 		const direntry_t* direntries;
2823 		long_file_name lfn;
2824 
2825 		lfn_init(&lfn);
2826 
2827 		if (begin < sector_num)
2828 		    begin = sector_num;
2829 		if (end > sector_num + nb_sectors)
2830 		    end = sector_num + nb_sectors;
2831 		dir_index  = mapping->dir_index +
2832 		    0x10 * (begin - mapping->begin * s->sectors_per_cluster);
2833 		direntries = (direntry_t*)(buf + 0x200 * (begin - sector_num));
2834 
2835 		for (k = 0; k < (end - begin) * 0x10; k++) {
2836 		    /* do not allow non-ASCII filenames */
2837 		    if (parse_long_name(&lfn, direntries + k) < 0) {
2838 			fprintf(stderr, "Warning: non-ASCII filename\n");
2839 			return -1;
2840 		    }
2841 		    /* no access to the direntry of a read-only file */
2842 		    else if (is_short_name(direntries+k) &&
2843 			    (direntries[k].attributes & 1)) {
2844 			if (memcmp(direntries + k,
2845 				    array_get(&(s->directory), dir_index + k),
2846 				    sizeof(direntry_t))) {
2847 			    fprintf(stderr, "Warning: tried to write to write-protected file\n");
2848 			    return -1;
2849 			}
2850 		    }
2851 		}
2852 	    }
2853 	    i = mapping->end;
2854 	} else
2855 	    i++;
2856     }
2857 
2858     /*
2859      * Use qcow backend. Commit later.
2860      */
2861 DLOG(fprintf(stderr, "Write to qcow backend: %d + %d\n", (int)sector_num, nb_sectors));
2862     ret = bdrv_write(s->qcow, sector_num, buf, nb_sectors);
2863     if (ret < 0) {
2864 	fprintf(stderr, "Error writing to qcow backend\n");
2865 	return ret;
2866     }
2867 
2868     for (i = sector2cluster(s, sector_num);
2869 	    i <= sector2cluster(s, sector_num + nb_sectors - 1); i++)
2870 	if (i >= 0)
2871 	    s->used_clusters[i] |= USED_ALLOCATED;
2872 
2873 DLOG(checkpoint());
2874     /* TODO: add timeout */
2875     try_commit(s);
2876 
2877 DLOG(checkpoint());
2878     return 0;
2879 }
2880 
2881 static coroutine_fn int vvfat_co_write(BlockDriverState *bs, int64_t sector_num,
2882                                        const uint8_t *buf, int nb_sectors)
2883 {
2884     int ret;
2885     BDRVVVFATState *s = bs->opaque;
2886     qemu_co_mutex_lock(&s->lock);
2887     ret = vvfat_write(bs, sector_num, buf, nb_sectors);
2888     qemu_co_mutex_unlock(&s->lock);
2889     return ret;
2890 }
2891 
2892 static int64_t coroutine_fn vvfat_co_get_block_status(BlockDriverState *bs,
2893 	int64_t sector_num, int nb_sectors, int* n)
2894 {
2895     BDRVVVFATState* s = bs->opaque;
2896     *n = s->sector_count - sector_num;
2897     if (*n > nb_sectors) {
2898         *n = nb_sectors;
2899     } else if (*n < 0) {
2900         return 0;
2901     }
2902     return BDRV_BLOCK_DATA;
2903 }
2904 
2905 static int write_target_commit(BlockDriverState *bs, int64_t sector_num,
2906 	const uint8_t* buffer, int nb_sectors) {
2907     BDRVVVFATState* s = *((BDRVVVFATState**) bs->opaque);
2908     return try_commit(s);
2909 }
2910 
2911 static void write_target_close(BlockDriverState *bs) {
2912     BDRVVVFATState* s = *((BDRVVVFATState**) bs->opaque);
2913     bdrv_unref(s->qcow);
2914     g_free(s->qcow_filename);
2915 }
2916 
2917 static BlockDriver vvfat_write_target = {
2918     .format_name        = "vvfat_write_target",
2919     .bdrv_write         = write_target_commit,
2920     .bdrv_close         = write_target_close,
2921 };
2922 
2923 static int enable_write_target(BDRVVVFATState *s, Error **errp)
2924 {
2925     BlockDriver *bdrv_qcow = NULL;
2926     QemuOpts *opts = NULL;
2927     int ret;
2928     int size = sector2cluster(s, s->sector_count);
2929     s->used_clusters = calloc(size, 1);
2930 
2931     array_init(&(s->commits), sizeof(commit_t));
2932 
2933     s->qcow_filename = g_malloc(PATH_MAX);
2934     ret = get_tmp_filename(s->qcow_filename, PATH_MAX);
2935     if (ret < 0) {
2936         error_setg_errno(errp, -ret, "can't create temporary file");
2937         goto err;
2938     }
2939 
2940     bdrv_qcow = bdrv_find_format("qcow");
2941     if (!bdrv_qcow) {
2942         error_setg(errp, "Failed to locate qcow driver");
2943         ret = -ENOENT;
2944         goto err;
2945     }
2946 
2947     opts = qemu_opts_create(bdrv_qcow->create_opts, NULL, 0, &error_abort);
2948     qemu_opt_set_number(opts, BLOCK_OPT_SIZE, s->sector_count * 512,
2949                         &error_abort);
2950     qemu_opt_set(opts, BLOCK_OPT_BACKING_FILE, "fat:", &error_abort);
2951 
2952     ret = bdrv_create(bdrv_qcow, s->qcow_filename, opts, errp);
2953     qemu_opts_del(opts);
2954     if (ret < 0) {
2955         goto err;
2956     }
2957 
2958     s->qcow = NULL;
2959     ret = bdrv_open(&s->qcow, s->qcow_filename, NULL, NULL,
2960                     BDRV_O_RDWR | BDRV_O_CACHE_WB | BDRV_O_NO_FLUSH,
2961                     bdrv_qcow, errp);
2962     if (ret < 0) {
2963         goto err;
2964     }
2965 
2966 #ifndef _WIN32
2967     unlink(s->qcow_filename);
2968 #endif
2969 
2970     bdrv_set_backing_hd(s->bs, bdrv_new());
2971     s->bs->backing_hd->drv = &vvfat_write_target;
2972     s->bs->backing_hd->opaque = g_new(void *, 1);
2973     *(void**)s->bs->backing_hd->opaque = s;
2974 
2975     return 0;
2976 
2977 err:
2978     g_free(s->qcow_filename);
2979     s->qcow_filename = NULL;
2980     return ret;
2981 }
2982 
2983 static void vvfat_close(BlockDriverState *bs)
2984 {
2985     BDRVVVFATState *s = bs->opaque;
2986 
2987     vvfat_close_current_file(s);
2988     array_free(&(s->fat));
2989     array_free(&(s->directory));
2990     array_free(&(s->mapping));
2991     g_free(s->cluster_buffer);
2992 
2993     if (s->qcow) {
2994         migrate_del_blocker(s->migration_blocker);
2995         error_free(s->migration_blocker);
2996     }
2997 }
2998 
2999 static BlockDriver bdrv_vvfat = {
3000     .format_name            = "vvfat",
3001     .protocol_name          = "fat",
3002     .instance_size          = sizeof(BDRVVVFATState),
3003 
3004     .bdrv_parse_filename    = vvfat_parse_filename,
3005     .bdrv_file_open         = vvfat_open,
3006     .bdrv_close             = vvfat_close,
3007     .bdrv_rebind            = vvfat_rebind,
3008 
3009     .bdrv_read              = vvfat_co_read,
3010     .bdrv_write             = vvfat_co_write,
3011     .bdrv_co_get_block_status = vvfat_co_get_block_status,
3012 };
3013 
3014 static void bdrv_vvfat_init(void)
3015 {
3016     bdrv_register(&bdrv_vvfat);
3017 }
3018 
3019 block_init(bdrv_vvfat_init);
3020 
3021 #ifdef DEBUG
3022 static void checkpoint(void) {
3023     assert(((mapping_t*)array_get(&(vvv->mapping), 0))->end == 2);
3024     check1(vvv);
3025     check2(vvv);
3026     assert(!vvv->current_mapping || vvv->current_fd || (vvv->current_mapping->mode & MODE_DIRECTORY));
3027 #if 0
3028     if (((direntry_t*)vvv->directory.pointer)[1].attributes != 0xf)
3029 	fprintf(stderr, "Nonono!\n");
3030     mapping_t* mapping;
3031     direntry_t* direntry;
3032     assert(vvv->mapping.size >= vvv->mapping.item_size * vvv->mapping.next);
3033     assert(vvv->directory.size >= vvv->directory.item_size * vvv->directory.next);
3034     if (vvv->mapping.next<47)
3035 	return;
3036     assert((mapping = array_get(&(vvv->mapping), 47)));
3037     assert(mapping->dir_index < vvv->directory.next);
3038     direntry = array_get(&(vvv->directory), mapping->dir_index);
3039     assert(!memcmp(direntry->name, "USB     H  ", 11) || direntry->name[0]==0);
3040 #endif
3041 }
3042 #endif
3043