xref: /openbmc/qemu/block/vvfat.c (revision f60a6f7e)
1 /* vim:set shiftwidth=4 ts=4: */
2 /*
3  * QEMU Block driver for virtual VFAT (shadows a local directory)
4  *
5  * Copyright (c) 2004,2005 Johannes E. Schindelin
6  *
7  * Permission is hereby granted, free of charge, to any person obtaining a copy
8  * of this software and associated documentation files (the "Software"), to deal
9  * in the Software without restriction, including without limitation the rights
10  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11  * copies of the Software, and to permit persons to whom the Software is
12  * furnished to do so, subject to the following conditions:
13  *
14  * The above copyright notice and this permission notice shall be included in
15  * all copies or substantial portions of the Software.
16  *
17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23  * THE SOFTWARE.
24  */
25 
26 #include "qemu/osdep.h"
27 #include <dirent.h>
28 #include <glib/gstdio.h>
29 #include "qapi/error.h"
30 #include "block/block-io.h"
31 #include "block/block_int.h"
32 #include "block/qdict.h"
33 #include "qemu/module.h"
34 #include "qemu/option.h"
35 #include "qemu/bswap.h"
36 #include "migration/blocker.h"
37 #include "qapi/qmp/qdict.h"
38 #include "qapi/qmp/qstring.h"
39 #include "qemu/ctype.h"
40 #include "qemu/cutils.h"
41 #include "qemu/error-report.h"
42 
43 #ifndef S_IWGRP
44 #define S_IWGRP 0
45 #endif
46 #ifndef S_IWOTH
47 #define S_IWOTH 0
48 #endif
49 
50 /* TODO: add ":bootsector=blabla.img:" */
51 /* LATER TODO: add automatic boot sector generation from
52     BOOTEASY.ASM and Ranish Partition Manager
53     Note that DOS assumes the system files to be the first files in the
54     file system (test if the boot sector still relies on that fact)! */
55 /* MAYBE TODO: write block-visofs.c */
56 /* TODO: call try_commit() only after a timeout */
57 
58 /* #define DEBUG */
59 
60 #ifdef DEBUG
61 
62 #define DLOG(a) a
63 
64 static void checkpoint(void);
65 
66 #else
67 
68 #define DLOG(a)
69 
70 #endif
71 
72 /* bootsector OEM name. see related compatibility problems at:
73  * https://jdebp.eu/FGA/volume-boot-block-oem-name-field.html
74  * http://seasip.info/Misc/oemid.html
75  */
76 #define BOOTSECTOR_OEM_NAME "MSWIN4.1"
77 
78 #define DIR_DELETED 0xe5
79 #define DIR_KANJI DIR_DELETED
80 #define DIR_KANJI_FAKE 0x05
81 #define DIR_FREE 0x00
82 
83 /* dynamic array functions */
84 typedef struct array_t {
85     char* pointer;
86     unsigned int size,next,item_size;
87 } array_t;
88 
89 static inline void array_init(array_t* array,unsigned int item_size)
90 {
91     array->pointer = NULL;
92     array->size=0;
93     array->next=0;
94     array->item_size=item_size;
95 }
96 
97 static inline void array_free(array_t* array)
98 {
99     g_free(array->pointer);
100     array->size=array->next=0;
101 }
102 
103 /* does not automatically grow */
104 static inline void* array_get(array_t* array,unsigned int index) {
105     assert(index < array->next);
106     assert(array->pointer);
107     return array->pointer + index * array->item_size;
108 }
109 
110 static inline void array_ensure_allocated(array_t *array, int index)
111 {
112     if((index + 1) * array->item_size > array->size) {
113         int new_size = (index + 32) * array->item_size;
114         array->pointer = g_realloc(array->pointer, new_size);
115         assert(array->pointer);
116         memset(array->pointer + array->size, 0, new_size - array->size);
117         array->size = new_size;
118         array->next = index + 1;
119     }
120 }
121 
122 static inline void* array_get_next(array_t* array) {
123     unsigned int next = array->next;
124 
125     array_ensure_allocated(array, next);
126     array->next = next + 1;
127     return array_get(array, next);
128 }
129 
130 static inline void* array_insert(array_t* array,unsigned int index,unsigned int count) {
131     if((array->next+count)*array->item_size>array->size) {
132         int increment=count*array->item_size;
133         array->pointer=g_realloc(array->pointer,array->size+increment);
134         if(!array->pointer)
135             return NULL;
136         array->size+=increment;
137     }
138     memmove(array->pointer+(index+count)*array->item_size,
139                 array->pointer+index*array->item_size,
140                 (array->next-index)*array->item_size);
141     array->next+=count;
142     return array->pointer+index*array->item_size;
143 }
144 
145 static inline int array_remove_slice(array_t* array,int index, int count)
146 {
147     assert(index >=0);
148     assert(count > 0);
149     assert(index + count <= array->next);
150 
151     memmove(array->pointer + index * array->item_size,
152             array->pointer + (index + count) * array->item_size,
153             (array->next - index - count) * array->item_size);
154 
155     array->next -= count;
156     return 0;
157 }
158 
159 static int array_remove(array_t* array,int index)
160 {
161     return array_remove_slice(array, index, 1);
162 }
163 
164 /* return the index for a given member */
165 static int array_index(array_t* array, void* pointer)
166 {
167     size_t offset = (char*)pointer - array->pointer;
168     assert((offset % array->item_size) == 0);
169     assert(offset/array->item_size < array->next);
170     return offset/array->item_size;
171 }
172 
173 /* These structures are used to fake a disk and the VFAT filesystem.
174  * For this reason we need to use QEMU_PACKED. */
175 
176 typedef struct bootsector_t {
177     uint8_t jump[3];
178     uint8_t name[8];
179     uint16_t sector_size;
180     uint8_t sectors_per_cluster;
181     uint16_t reserved_sectors;
182     uint8_t number_of_fats;
183     uint16_t root_entries;
184     uint16_t total_sectors16;
185     uint8_t media_type;
186     uint16_t sectors_per_fat;
187     uint16_t sectors_per_track;
188     uint16_t number_of_heads;
189     uint32_t hidden_sectors;
190     uint32_t total_sectors;
191     union {
192         struct {
193             uint8_t drive_number;
194             uint8_t reserved1;
195             uint8_t signature;
196             uint32_t id;
197             uint8_t volume_label[11];
198             uint8_t fat_type[8];
199             uint8_t ignored[0x1c0];
200         } QEMU_PACKED fat16;
201         struct {
202             uint32_t sectors_per_fat;
203             uint16_t flags;
204             uint8_t major,minor;
205             uint32_t first_cluster_of_root_dir;
206             uint16_t info_sector;
207             uint16_t backup_boot_sector;
208             uint8_t reserved[12];
209             uint8_t drive_number;
210             uint8_t reserved1;
211             uint8_t signature;
212             uint32_t id;
213             uint8_t volume_label[11];
214             uint8_t fat_type[8];
215             uint8_t ignored[0x1a4];
216         } QEMU_PACKED fat32;
217     } u;
218     uint8_t magic[2];
219 } QEMU_PACKED bootsector_t;
220 
221 typedef struct {
222     uint8_t head;
223     uint8_t sector;
224     uint8_t cylinder;
225 } mbr_chs_t;
226 
227 typedef struct partition_t {
228     uint8_t attributes; /* 0x80 = bootable */
229     mbr_chs_t start_CHS;
230     uint8_t   fs_type; /* 0x1 = FAT12, 0x6 = FAT16, 0xe = FAT16_LBA, 0xb = FAT32, 0xc = FAT32_LBA */
231     mbr_chs_t end_CHS;
232     uint32_t start_sector_long;
233     uint32_t length_sector_long;
234 } QEMU_PACKED partition_t;
235 
236 typedef struct mbr_t {
237     uint8_t ignored[0x1b8];
238     uint32_t nt_id;
239     uint8_t ignored2[2];
240     partition_t partition[4];
241     uint8_t magic[2];
242 } QEMU_PACKED mbr_t;
243 
244 typedef struct direntry_t {
245     uint8_t name[8 + 3];
246     uint8_t attributes;
247     uint8_t reserved[2];
248     uint16_t ctime;
249     uint16_t cdate;
250     uint16_t adate;
251     uint16_t begin_hi;
252     uint16_t mtime;
253     uint16_t mdate;
254     uint16_t begin;
255     uint32_t size;
256 } QEMU_PACKED direntry_t;
257 
258 /* this structure are used to transparently access the files */
259 
260 typedef struct mapping_t {
261     /* begin is the first cluster, end is the last+1 */
262     uint32_t begin,end;
263     /* as s->directory is growable, no pointer may be used here */
264     unsigned int dir_index;
265     /* the clusters of a file may be in any order; this points to the first */
266     int first_mapping_index;
267     union {
268         /* offset is
269          * - the offset in the file (in clusters) for a file, or
270          * - the next cluster of the directory for a directory
271          */
272         struct {
273             uint32_t offset;
274         } file;
275         struct {
276             int parent_mapping_index;
277             int first_dir_index;
278         } dir;
279     } info;
280     /* path contains the full path, i.e. it always starts with s->path */
281     char* path;
282 
283     enum {
284         MODE_UNDEFINED = 0,
285         MODE_NORMAL = 1,
286         MODE_MODIFIED = 2,
287         MODE_DIRECTORY = 4,
288         MODE_DELETED = 8,
289     } mode;
290     int read_only;
291 } mapping_t;
292 
293 #ifdef DEBUG
294 static void print_direntry(const struct direntry_t*);
295 static void print_mapping(const struct mapping_t* mapping);
296 #endif
297 
298 /* here begins the real VVFAT driver */
299 
300 typedef struct BDRVVVFATState {
301     CoMutex lock;
302     BlockDriverState* bs; /* pointer to parent */
303     unsigned char first_sectors[0x40*0x200];
304 
305     int fat_type; /* 16 or 32 */
306     array_t fat,directory,mapping;
307     char volume_label[11];
308 
309     uint32_t offset_to_bootsector; /* 0 for floppy, 0x3f for disk */
310 
311     unsigned int cluster_size;
312     unsigned int sectors_per_cluster;
313     unsigned int sectors_per_fat;
314     uint32_t last_cluster_of_root_directory;
315     /* how many entries are available in root directory (0 for FAT32) */
316     uint16_t root_entries;
317     uint32_t sector_count; /* total number of sectors of the partition */
318     uint32_t cluster_count; /* total number of clusters of this partition */
319     uint32_t max_fat_value;
320     uint32_t offset_to_fat;
321     uint32_t offset_to_root_dir;
322 
323     int current_fd;
324     mapping_t* current_mapping;
325     unsigned char* cluster; /* points to current cluster */
326     unsigned char* cluster_buffer; /* points to a buffer to hold temp data */
327     unsigned int current_cluster;
328 
329     /* write support */
330     char* qcow_filename;
331     BdrvChild* qcow;
332     void* fat2;
333     char* used_clusters;
334     array_t commits;
335     const char* path;
336     int downcase_short_names;
337 
338     Error *migration_blocker;
339 } BDRVVVFATState;
340 
341 /* take the sector position spos and convert it to Cylinder/Head/Sector position
342  * if the position is outside the specified geometry, fill maximum value for CHS
343  * and return 1 to signal overflow.
344  */
345 static int sector2CHS(mbr_chs_t *chs, int spos, int cyls, int heads, int secs)
346 {
347     int head,sector;
348     sector   = spos % secs;  spos /= secs;
349     head     = spos % heads; spos /= heads;
350     if (spos >= cyls) {
351         /* Overflow,
352         it happens if 32bit sector positions are used, while CHS is only 24bit.
353         Windows/Dos is said to take 1023/255/63 as nonrepresentable CHS */
354         chs->head     = 0xFF;
355         chs->sector   = 0xFF;
356         chs->cylinder = 0xFF;
357         return 1;
358     }
359     chs->head     = (uint8_t)head;
360     chs->sector   = (uint8_t)( (sector+1) | ((spos>>8)<<6) );
361     chs->cylinder = (uint8_t)spos;
362     return 0;
363 }
364 
365 static void init_mbr(BDRVVVFATState *s, int cyls, int heads, int secs)
366 {
367     /* TODO: if the files mbr.img and bootsect.img exist, use them */
368     mbr_t* real_mbr=(mbr_t*)s->first_sectors;
369     partition_t* partition = &(real_mbr->partition[0]);
370     int lba;
371 
372     memset(s->first_sectors,0,512);
373 
374     /* Win NT Disk Signature */
375     real_mbr->nt_id= cpu_to_le32(0xbe1afdfa);
376 
377     partition->attributes=0x80; /* bootable */
378 
379     /* LBA is used when partition is outside the CHS geometry */
380     lba  = sector2CHS(&partition->start_CHS, s->offset_to_bootsector,
381                      cyls, heads, secs);
382     lba |= sector2CHS(&partition->end_CHS,   s->bs->total_sectors - 1,
383                      cyls, heads, secs);
384 
385     /*LBA partitions are identified only by start/length_sector_long not by CHS*/
386     partition->start_sector_long  = cpu_to_le32(s->offset_to_bootsector);
387     partition->length_sector_long = cpu_to_le32(s->bs->total_sectors
388                                                 - s->offset_to_bootsector);
389 
390     /* FAT12/FAT16/FAT32 */
391     /* DOS uses different types when partition is LBA,
392        probably to prevent older versions from using CHS on them */
393     partition->fs_type = s->fat_type == 12 ? 0x1 :
394                          s->fat_type == 16 ? (lba ? 0xe : 0x06) :
395                        /*s->fat_type == 32*/ (lba ? 0xc : 0x0b);
396 
397     real_mbr->magic[0]=0x55; real_mbr->magic[1]=0xaa;
398 }
399 
400 /* direntry functions */
401 
402 static direntry_t *create_long_filename(BDRVVVFATState *s, const char *filename)
403 {
404     int number_of_entries, i;
405     glong length;
406     direntry_t *entry;
407 
408     gunichar2 *longname = g_utf8_to_utf16(filename, -1, NULL, &length, NULL);
409     if (!longname) {
410         fprintf(stderr, "vvfat: invalid UTF-8 name: %s\n", filename);
411         return NULL;
412     }
413 
414     number_of_entries = DIV_ROUND_UP(length * 2, 26);
415 
416     for(i=0;i<number_of_entries;i++) {
417         entry=array_get_next(&(s->directory));
418         entry->attributes=0xf;
419         entry->reserved[0]=0;
420         entry->begin=0;
421         entry->name[0]=(number_of_entries-i)|(i==0?0x40:0);
422     }
423     for(i=0;i<26*number_of_entries;i++) {
424         int offset=(i%26);
425         if(offset<10) offset=1+offset;
426         else if(offset<22) offset=14+offset-10;
427         else offset=28+offset-22;
428         entry=array_get(&(s->directory),s->directory.next-1-(i/26));
429         if (i >= 2 * length + 2) {
430             entry->name[offset] = 0xff;
431         } else if (i % 2 == 0) {
432             entry->name[offset] = longname[i / 2] & 0xff;
433         } else {
434             entry->name[offset] = longname[i / 2] >> 8;
435         }
436     }
437     g_free(longname);
438     return array_get(&(s->directory),s->directory.next-number_of_entries);
439 }
440 
441 static char is_free(const direntry_t* direntry)
442 {
443     return direntry->name[0] == DIR_DELETED || direntry->name[0] == DIR_FREE;
444 }
445 
446 static char is_volume_label(const direntry_t* direntry)
447 {
448     return direntry->attributes == 0x28;
449 }
450 
451 static char is_long_name(const direntry_t* direntry)
452 {
453     return direntry->attributes == 0xf;
454 }
455 
456 static char is_short_name(const direntry_t* direntry)
457 {
458     return !is_volume_label(direntry) && !is_long_name(direntry)
459         && !is_free(direntry);
460 }
461 
462 static char is_directory(const direntry_t* direntry)
463 {
464     return direntry->attributes & 0x10 && direntry->name[0] != DIR_DELETED;
465 }
466 
467 static inline char is_dot(const direntry_t* direntry)
468 {
469     return is_short_name(direntry) && direntry->name[0] == '.';
470 }
471 
472 static char is_file(const direntry_t* direntry)
473 {
474     return is_short_name(direntry) && !is_directory(direntry);
475 }
476 
477 static inline uint32_t begin_of_direntry(const direntry_t* direntry)
478 {
479     return le16_to_cpu(direntry->begin)|(le16_to_cpu(direntry->begin_hi)<<16);
480 }
481 
482 static inline uint32_t filesize_of_direntry(const direntry_t* direntry)
483 {
484     return le32_to_cpu(direntry->size);
485 }
486 
487 static void set_begin_of_direntry(direntry_t* direntry, uint32_t begin)
488 {
489     direntry->begin = cpu_to_le16(begin & 0xffff);
490     direntry->begin_hi = cpu_to_le16((begin >> 16) & 0xffff);
491 }
492 
493 static bool valid_filename(const unsigned char *name)
494 {
495     unsigned char c;
496     if (!strcmp((const char*)name, ".") || !strcmp((const char*)name, "..")) {
497         return false;
498     }
499     for (; (c = *name); name++) {
500         if (!((c >= '0' && c <= '9') ||
501               (c >= 'A' && c <= 'Z') ||
502               (c >= 'a' && c <= 'z') ||
503               c > 127 ||
504               strchr(" $%'-_@~`!(){}^#&.+,;=[]", c) != NULL))
505         {
506             return false;
507         }
508     }
509     return true;
510 }
511 
512 static uint8_t to_valid_short_char(gunichar c)
513 {
514     c = g_unichar_toupper(c);
515     if ((c >= '0' && c <= '9') ||
516         (c >= 'A' && c <= 'Z') ||
517         strchr("$%'-_@~`!(){}^#&", c) != NULL) {
518         return c;
519     } else {
520         return 0;
521     }
522 }
523 
524 static direntry_t *create_short_filename(BDRVVVFATState *s,
525                                          const char *filename,
526                                          unsigned int directory_start)
527 {
528     int i, j = 0;
529     direntry_t *entry = array_get_next(&(s->directory));
530     const gchar *p, *last_dot = NULL;
531     gunichar c;
532     bool lossy_conversion = false;
533     char tail[8];
534 
535     if (!entry) {
536         return NULL;
537     }
538     memset(entry->name, 0x20, sizeof(entry->name));
539 
540     /* copy filename and search last dot */
541     for (p = filename; ; p = g_utf8_next_char(p)) {
542         c = g_utf8_get_char(p);
543         if (c == '\0') {
544             break;
545         } else if (c == '.') {
546             if (j == 0) {
547                 /* '.' at start of filename */
548                 lossy_conversion = true;
549             } else {
550                 if (last_dot) {
551                     lossy_conversion = true;
552                 }
553                 last_dot = p;
554             }
555         } else if (!last_dot) {
556             /* first part of the name; copy it */
557             uint8_t v = to_valid_short_char(c);
558             if (j < 8 && v) {
559                 entry->name[j++] = v;
560             } else {
561                 lossy_conversion = true;
562             }
563         }
564     }
565 
566     /* copy extension (if any) */
567     if (last_dot) {
568         j = 0;
569         for (p = g_utf8_next_char(last_dot); ; p = g_utf8_next_char(p)) {
570             c = g_utf8_get_char(p);
571             if (c == '\0') {
572                 break;
573             } else {
574                 /* extension; copy it */
575                 uint8_t v = to_valid_short_char(c);
576                 if (j < 3 && v) {
577                     entry->name[8 + (j++)] = v;
578                 } else {
579                     lossy_conversion = true;
580                 }
581             }
582         }
583     }
584 
585     if (entry->name[0] == DIR_KANJI) {
586         entry->name[0] = DIR_KANJI_FAKE;
587     }
588 
589     /* numeric-tail generation */
590     for (j = 0; j < 8; j++) {
591         if (entry->name[j] == ' ') {
592             break;
593         }
594     }
595     for (i = lossy_conversion ? 1 : 0; i < 999999; i++) {
596         direntry_t *entry1;
597         if (i > 0) {
598             int len = snprintf(tail, sizeof(tail), "~%u", (unsigned)i);
599             assert(len <= 7);
600             memcpy(entry->name + MIN(j, 8 - len), tail, len);
601         }
602         for (entry1 = array_get(&(s->directory), directory_start);
603              entry1 < entry; entry1++) {
604             if (!is_long_name(entry1) &&
605                 !memcmp(entry1->name, entry->name, 11)) {
606                 break; /* found dupe */
607             }
608         }
609         if (entry1 == entry) {
610             /* no dupe found */
611             return entry;
612         }
613     }
614     return NULL;
615 }
616 
617 /* fat functions */
618 
619 static inline uint8_t fat_chksum(const direntry_t* entry)
620 {
621     uint8_t chksum=0;
622     int i;
623 
624     for (i = 0; i < ARRAY_SIZE(entry->name); i++) {
625         chksum = (((chksum & 0xfe) >> 1) |
626                   ((chksum & 0x01) ? 0x80 : 0)) + entry->name[i];
627     }
628 
629     return chksum;
630 }
631 
632 /* if return_time==0, this returns the fat_date, else the fat_time */
633 static uint16_t fat_datetime(time_t time,int return_time) {
634     struct tm* t;
635     struct tm t1;
636     t = &t1;
637     localtime_r(&time,t);
638     if(return_time)
639         return cpu_to_le16((t->tm_sec/2)|(t->tm_min<<5)|(t->tm_hour<<11));
640     return cpu_to_le16((t->tm_mday)|((t->tm_mon+1)<<5)|((t->tm_year-80)<<9));
641 }
642 
643 static inline void fat_set(BDRVVVFATState* s,unsigned int cluster,uint32_t value)
644 {
645     if(s->fat_type==32) {
646         uint32_t* entry=array_get(&(s->fat),cluster);
647         *entry=cpu_to_le32(value);
648     } else if(s->fat_type==16) {
649         uint16_t* entry=array_get(&(s->fat),cluster);
650         *entry=cpu_to_le16(value&0xffff);
651     } else {
652         int offset = (cluster*3/2);
653         unsigned char* p = array_get(&(s->fat), offset);
654         switch (cluster&1) {
655         case 0:
656                 p[0] = value&0xff;
657                 p[1] = (p[1]&0xf0) | ((value>>8)&0xf);
658                 break;
659         case 1:
660                 p[0] = (p[0]&0xf) | ((value&0xf)<<4);
661                 p[1] = (value>>4);
662                 break;
663         }
664     }
665 }
666 
667 static inline uint32_t fat_get(BDRVVVFATState* s,unsigned int cluster)
668 {
669     if(s->fat_type==32) {
670         uint32_t* entry=array_get(&(s->fat),cluster);
671         return le32_to_cpu(*entry);
672     } else if(s->fat_type==16) {
673         uint16_t* entry=array_get(&(s->fat),cluster);
674         return le16_to_cpu(*entry);
675     } else {
676         const uint8_t* x=(uint8_t*)(s->fat.pointer)+cluster*3/2;
677         return ((x[0]|(x[1]<<8))>>(cluster&1?4:0))&0x0fff;
678     }
679 }
680 
681 static inline int fat_eof(BDRVVVFATState* s,uint32_t fat_entry)
682 {
683     if(fat_entry>s->max_fat_value-8)
684         return -1;
685     return 0;
686 }
687 
688 static inline void init_fat(BDRVVVFATState* s)
689 {
690     if (s->fat_type == 12) {
691         array_init(&(s->fat),1);
692         array_ensure_allocated(&(s->fat),
693                 s->sectors_per_fat * 0x200 * 3 / 2 - 1);
694     } else {
695         array_init(&(s->fat),(s->fat_type==32?4:2));
696         array_ensure_allocated(&(s->fat),
697                 s->sectors_per_fat * 0x200 / s->fat.item_size - 1);
698     }
699     memset(s->fat.pointer,0,s->fat.size);
700 
701     switch(s->fat_type) {
702         case 12: s->max_fat_value=0xfff; break;
703         case 16: s->max_fat_value=0xffff; break;
704         case 32: s->max_fat_value=0x0fffffff; break;
705         default: s->max_fat_value=0; /* error... */
706     }
707 
708 }
709 
710 static inline direntry_t* create_short_and_long_name(BDRVVVFATState* s,
711         unsigned int directory_start, const char* filename, int is_dot)
712 {
713     int long_index = s->directory.next;
714     direntry_t* entry = NULL;
715     direntry_t* entry_long = NULL;
716 
717     if(is_dot) {
718         entry=array_get_next(&(s->directory));
719         memset(entry->name, 0x20, sizeof(entry->name));
720         memcpy(entry->name,filename,strlen(filename));
721         return entry;
722     }
723 
724     entry_long=create_long_filename(s,filename);
725     entry = create_short_filename(s, filename, directory_start);
726 
727     /* calculate checksum; propagate to long name */
728     if(entry_long) {
729         uint8_t chksum=fat_chksum(entry);
730 
731         /* calculate anew, because realloc could have taken place */
732         entry_long=array_get(&(s->directory),long_index);
733         while(entry_long<entry && is_long_name(entry_long)) {
734             entry_long->reserved[1]=chksum;
735             entry_long++;
736         }
737     }
738 
739     return entry;
740 }
741 
742 /*
743  * Read a directory. (the index of the corresponding mapping must be passed).
744  */
745 static int read_directory(BDRVVVFATState* s, int mapping_index)
746 {
747     mapping_t* mapping = array_get(&(s->mapping), mapping_index);
748     direntry_t* direntry;
749     const char* dirname = mapping->path;
750     int first_cluster = mapping->begin;
751     int parent_index = mapping->info.dir.parent_mapping_index;
752     mapping_t* parent_mapping = (mapping_t*)
753         (parent_index >= 0 ? array_get(&(s->mapping), parent_index) : NULL);
754     int first_cluster_of_parent = parent_mapping ? parent_mapping->begin : -1;
755 
756     DIR* dir=opendir(dirname);
757     struct dirent* entry;
758     int i;
759 
760     assert(mapping->mode & MODE_DIRECTORY);
761 
762     if(!dir) {
763         mapping->end = mapping->begin;
764         return -1;
765     }
766 
767     i = mapping->info.dir.first_dir_index =
768             first_cluster == 0 ? 0 : s->directory.next;
769 
770     if (first_cluster != 0) {
771         /* create the top entries of a subdirectory */
772         (void)create_short_and_long_name(s, i, ".", 1);
773         (void)create_short_and_long_name(s, i, "..", 1);
774     }
775 
776     /* actually read the directory, and allocate the mappings */
777     while((entry=readdir(dir))) {
778         unsigned int length=strlen(dirname)+2+strlen(entry->d_name);
779         char* buffer;
780         struct stat st;
781         int is_dot=!strcmp(entry->d_name,".");
782         int is_dotdot=!strcmp(entry->d_name,"..");
783 
784         if (first_cluster == 0 && s->directory.next >= s->root_entries - 1) {
785             fprintf(stderr, "Too many entries in root directory\n");
786             closedir(dir);
787             return -2;
788         }
789 
790         if(first_cluster == 0 && (is_dotdot || is_dot))
791             continue;
792 
793         buffer = g_malloc(length);
794         snprintf(buffer,length,"%s/%s",dirname,entry->d_name);
795 
796         if(stat(buffer,&st)<0) {
797             g_free(buffer);
798             continue;
799         }
800 
801         /* create directory entry for this file */
802         if (!is_dot && !is_dotdot) {
803             direntry = create_short_and_long_name(s, i, entry->d_name, 0);
804         } else {
805             direntry = array_get(&(s->directory), is_dot ? i : i + 1);
806         }
807         direntry->attributes=(S_ISDIR(st.st_mode)?0x10:0x20);
808         direntry->reserved[0]=direntry->reserved[1]=0;
809         direntry->ctime=fat_datetime(st.st_ctime,1);
810         direntry->cdate=fat_datetime(st.st_ctime,0);
811         direntry->adate=fat_datetime(st.st_atime,0);
812         direntry->begin_hi=0;
813         direntry->mtime=fat_datetime(st.st_mtime,1);
814         direntry->mdate=fat_datetime(st.st_mtime,0);
815         if(is_dotdot)
816             set_begin_of_direntry(direntry, first_cluster_of_parent);
817         else if(is_dot)
818             set_begin_of_direntry(direntry, first_cluster);
819         else
820             direntry->begin=0; /* do that later */
821         if (st.st_size > 0x7fffffff) {
822             fprintf(stderr, "File %s is larger than 2GB\n", buffer);
823             g_free(buffer);
824             closedir(dir);
825             return -2;
826         }
827         direntry->size=cpu_to_le32(S_ISDIR(st.st_mode)?0:st.st_size);
828 
829         /* create mapping for this file */
830         if(!is_dot && !is_dotdot && (S_ISDIR(st.st_mode) || st.st_size)) {
831             s->current_mapping = array_get_next(&(s->mapping));
832             s->current_mapping->begin=0;
833             s->current_mapping->end=st.st_size;
834             /*
835              * we get the direntry of the most recent direntry, which
836              * contains the short name and all the relevant information.
837              */
838             s->current_mapping->dir_index=s->directory.next-1;
839             s->current_mapping->first_mapping_index = -1;
840             if (S_ISDIR(st.st_mode)) {
841                 s->current_mapping->mode = MODE_DIRECTORY;
842                 s->current_mapping->info.dir.parent_mapping_index =
843                     mapping_index;
844             } else {
845                 s->current_mapping->mode = MODE_UNDEFINED;
846                 s->current_mapping->info.file.offset = 0;
847             }
848             s->current_mapping->path=buffer;
849             s->current_mapping->read_only =
850                 (st.st_mode & (S_IWUSR | S_IWGRP | S_IWOTH)) == 0;
851         } else {
852             g_free(buffer);
853         }
854     }
855     closedir(dir);
856 
857     /* fill with zeroes up to the end of the cluster */
858     while(s->directory.next%(0x10*s->sectors_per_cluster)) {
859         direntry = array_get_next(&(s->directory));
860         memset(direntry,0,sizeof(direntry_t));
861     }
862 
863     if (s->fat_type != 32 &&
864         mapping_index == 0 &&
865         s->directory.next < s->root_entries) {
866         /* root directory */
867         int cur = s->directory.next;
868         array_ensure_allocated(&(s->directory), s->root_entries - 1);
869         s->directory.next = s->root_entries;
870         memset(array_get(&(s->directory), cur), 0,
871                 (s->root_entries - cur) * sizeof(direntry_t));
872     }
873 
874     /* re-get the mapping, since s->mapping was possibly realloc()ed */
875     mapping = array_get(&(s->mapping), mapping_index);
876     first_cluster += (s->directory.next - mapping->info.dir.first_dir_index)
877         * 0x20 / s->cluster_size;
878     mapping->end = first_cluster;
879 
880     direntry = array_get(&(s->directory), mapping->dir_index);
881     set_begin_of_direntry(direntry, mapping->begin);
882 
883     return 0;
884 }
885 
886 static inline int32_t sector2cluster(BDRVVVFATState* s,off_t sector_num)
887 {
888     return (sector_num - s->offset_to_root_dir) / s->sectors_per_cluster;
889 }
890 
891 static inline off_t cluster2sector(BDRVVVFATState* s, uint32_t cluster_num)
892 {
893     return s->offset_to_root_dir + s->sectors_per_cluster * cluster_num;
894 }
895 
896 static int init_directories(BDRVVVFATState* s,
897                             const char *dirname, int heads, int secs,
898                             Error **errp)
899 {
900     bootsector_t* bootsector;
901     mapping_t* mapping;
902     unsigned int i;
903     unsigned int cluster;
904 
905     memset(&(s->first_sectors[0]),0,0x40*0x200);
906 
907     s->cluster_size=s->sectors_per_cluster*0x200;
908     s->cluster_buffer=g_malloc(s->cluster_size);
909 
910     /*
911      * The formula: sc = spf+1+spf*spc*(512*8/fat_type),
912      * where sc is sector_count,
913      * spf is sectors_per_fat,
914      * spc is sectors_per_clusters, and
915      * fat_type = 12, 16 or 32.
916      */
917     i = 1+s->sectors_per_cluster*0x200*8/s->fat_type;
918     s->sectors_per_fat=(s->sector_count+i)/i; /* round up */
919 
920     s->offset_to_fat = s->offset_to_bootsector + 1;
921     s->offset_to_root_dir = s->offset_to_fat + s->sectors_per_fat * 2;
922 
923     array_init(&(s->mapping),sizeof(mapping_t));
924     array_init(&(s->directory),sizeof(direntry_t));
925 
926     /* add volume label */
927     {
928         direntry_t* entry=array_get_next(&(s->directory));
929         entry->attributes=0x28; /* archive | volume label */
930         memcpy(entry->name, s->volume_label, sizeof(entry->name));
931     }
932 
933     /* Now build FAT, and write back information into directory */
934     init_fat(s);
935 
936     /* TODO: if there are more entries, bootsector has to be adjusted! */
937     s->root_entries = 0x02 * 0x10 * s->sectors_per_cluster;
938     s->cluster_count=sector2cluster(s, s->sector_count);
939 
940     mapping = array_get_next(&(s->mapping));
941     mapping->begin = 0;
942     mapping->dir_index = 0;
943     mapping->info.dir.parent_mapping_index = -1;
944     mapping->first_mapping_index = -1;
945     mapping->path = g_strdup(dirname);
946     i = strlen(mapping->path);
947     if (i > 0 && mapping->path[i - 1] == '/')
948         mapping->path[i - 1] = '\0';
949     mapping->mode = MODE_DIRECTORY;
950     mapping->read_only = 0;
951     s->path = mapping->path;
952 
953     for (i = 0, cluster = 0; i < s->mapping.next; i++) {
954         /* MS-DOS expects the FAT to be 0 for the root directory
955          * (except for the media byte). */
956         /* LATER TODO: still true for FAT32? */
957         int fix_fat = (i != 0);
958         mapping = array_get(&(s->mapping), i);
959 
960         if (mapping->mode & MODE_DIRECTORY) {
961             char *path = mapping->path;
962             mapping->begin = cluster;
963             if(read_directory(s, i)) {
964                 error_setg(errp, "Could not read directory %s", path);
965                 return -1;
966             }
967             mapping = array_get(&(s->mapping), i);
968         } else {
969             assert(mapping->mode == MODE_UNDEFINED);
970             mapping->mode=MODE_NORMAL;
971             mapping->begin = cluster;
972             if (mapping->end > 0) {
973                 direntry_t* direntry = array_get(&(s->directory),
974                         mapping->dir_index);
975 
976                 mapping->end = cluster + 1 + (mapping->end-1)/s->cluster_size;
977                 set_begin_of_direntry(direntry, mapping->begin);
978             } else {
979                 mapping->end = cluster + 1;
980                 fix_fat = 0;
981             }
982         }
983 
984         assert(mapping->begin < mapping->end);
985 
986         /* next free cluster */
987         cluster = mapping->end;
988 
989         if(cluster > s->cluster_count) {
990             error_setg(errp,
991                        "Directory does not fit in FAT%d (capacity %.2f MB)",
992                        s->fat_type, s->sector_count / 2000.0);
993             return -1;
994         }
995 
996         /* fix fat for entry */
997         if (fix_fat) {
998             int j;
999             for(j = mapping->begin; j < mapping->end - 1; j++)
1000                 fat_set(s, j, j+1);
1001             fat_set(s, mapping->end - 1, s->max_fat_value);
1002         }
1003     }
1004 
1005     mapping = array_get(&(s->mapping), 0);
1006     s->last_cluster_of_root_directory = mapping->end;
1007 
1008     /* the FAT signature */
1009     fat_set(s,0,s->max_fat_value);
1010     fat_set(s,1,s->max_fat_value);
1011 
1012     s->current_mapping = NULL;
1013 
1014     bootsector = (bootsector_t *)(s->first_sectors
1015                                   + s->offset_to_bootsector * 0x200);
1016     bootsector->jump[0]=0xeb;
1017     bootsector->jump[1]=0x3e;
1018     bootsector->jump[2]=0x90;
1019     memcpy(bootsector->name, BOOTSECTOR_OEM_NAME, 8);
1020     bootsector->sector_size=cpu_to_le16(0x200);
1021     bootsector->sectors_per_cluster=s->sectors_per_cluster;
1022     bootsector->reserved_sectors=cpu_to_le16(1);
1023     bootsector->number_of_fats=0x2; /* number of FATs */
1024     bootsector->root_entries = cpu_to_le16(s->root_entries);
1025     bootsector->total_sectors16=s->sector_count>0xffff?0:cpu_to_le16(s->sector_count);
1026     /* media descriptor: hard disk=0xf8, floppy=0xf0 */
1027     bootsector->media_type = (s->offset_to_bootsector > 0 ? 0xf8 : 0xf0);
1028     s->fat.pointer[0] = bootsector->media_type;
1029     bootsector->sectors_per_fat=cpu_to_le16(s->sectors_per_fat);
1030     bootsector->sectors_per_track = cpu_to_le16(secs);
1031     bootsector->number_of_heads = cpu_to_le16(heads);
1032     bootsector->hidden_sectors = cpu_to_le32(s->offset_to_bootsector);
1033     bootsector->total_sectors=cpu_to_le32(s->sector_count>0xffff?s->sector_count:0);
1034 
1035     /* LATER TODO: if FAT32, this is wrong */
1036     /* drive_number: fda=0, hda=0x80 */
1037     bootsector->u.fat16.drive_number = s->offset_to_bootsector == 0 ? 0 : 0x80;
1038     bootsector->u.fat16.signature=0x29;
1039     bootsector->u.fat16.id=cpu_to_le32(0xfabe1afd);
1040 
1041     memcpy(bootsector->u.fat16.volume_label, s->volume_label,
1042            sizeof(bootsector->u.fat16.volume_label));
1043     memcpy(bootsector->u.fat16.fat_type,
1044            s->fat_type == 12 ? "FAT12   " : "FAT16   ", 8);
1045     bootsector->magic[0]=0x55; bootsector->magic[1]=0xaa;
1046 
1047     return 0;
1048 }
1049 
1050 #ifdef DEBUG
1051 static BDRVVVFATState *vvv = NULL;
1052 #endif
1053 
1054 static int enable_write_target(BlockDriverState *bs, Error **errp);
1055 static int coroutine_fn is_consistent(BDRVVVFATState *s);
1056 
1057 static QemuOptsList runtime_opts = {
1058     .name = "vvfat",
1059     .head = QTAILQ_HEAD_INITIALIZER(runtime_opts.head),
1060     .desc = {
1061         {
1062             .name = "dir",
1063             .type = QEMU_OPT_STRING,
1064             .help = "Host directory to map to the vvfat device",
1065         },
1066         {
1067             .name = "fat-type",
1068             .type = QEMU_OPT_NUMBER,
1069             .help = "FAT type (12, 16 or 32)",
1070         },
1071         {
1072             .name = "floppy",
1073             .type = QEMU_OPT_BOOL,
1074             .help = "Create a floppy rather than a hard disk image",
1075         },
1076         {
1077             .name = "label",
1078             .type = QEMU_OPT_STRING,
1079             .help = "Use a volume label other than QEMU VVFAT",
1080         },
1081         {
1082             .name = "rw",
1083             .type = QEMU_OPT_BOOL,
1084             .help = "Make the image writable",
1085         },
1086         { /* end of list */ }
1087     },
1088 };
1089 
1090 static void vvfat_parse_filename(const char *filename, QDict *options,
1091                                  Error **errp)
1092 {
1093     int fat_type = 0;
1094     bool floppy = false;
1095     bool rw = false;
1096     int i;
1097 
1098     if (!strstart(filename, "fat:", NULL)) {
1099         error_setg(errp, "File name string must start with 'fat:'");
1100         return;
1101     }
1102 
1103     /* Parse options */
1104     if (strstr(filename, ":32:")) {
1105         fat_type = 32;
1106     } else if (strstr(filename, ":16:")) {
1107         fat_type = 16;
1108     } else if (strstr(filename, ":12:")) {
1109         fat_type = 12;
1110     }
1111 
1112     if (strstr(filename, ":floppy:")) {
1113         floppy = true;
1114     }
1115 
1116     if (strstr(filename, ":rw:")) {
1117         rw = true;
1118     }
1119 
1120     /* Get the directory name without options */
1121     i = strrchr(filename, ':') - filename;
1122     assert(i >= 3);
1123     if (filename[i - 2] == ':' && qemu_isalpha(filename[i - 1])) {
1124         /* workaround for DOS drive names */
1125         filename += i - 1;
1126     } else {
1127         filename += i + 1;
1128     }
1129 
1130     /* Fill in the options QDict */
1131     qdict_put_str(options, "dir", filename);
1132     qdict_put_int(options, "fat-type", fat_type);
1133     qdict_put_bool(options, "floppy", floppy);
1134     qdict_put_bool(options, "rw", rw);
1135 }
1136 
1137 static int vvfat_open(BlockDriverState *bs, QDict *options, int flags,
1138                       Error **errp)
1139 {
1140     BDRVVVFATState *s = bs->opaque;
1141     int cyls, heads, secs;
1142     bool floppy;
1143     const char *dirname, *label;
1144     QemuOpts *opts;
1145     int ret;
1146 
1147     GRAPH_RDLOCK_GUARD_MAINLOOP();
1148 
1149 #ifdef DEBUG
1150     vvv = s;
1151 #endif
1152 
1153     opts = qemu_opts_create(&runtime_opts, NULL, 0, &error_abort);
1154     if (!qemu_opts_absorb_qdict(opts, options, errp)) {
1155         ret = -EINVAL;
1156         goto fail;
1157     }
1158 
1159     dirname = qemu_opt_get(opts, "dir");
1160     if (!dirname) {
1161         error_setg(errp, "vvfat block driver requires a 'dir' option");
1162         ret = -EINVAL;
1163         goto fail;
1164     }
1165 
1166     s->fat_type = qemu_opt_get_number(opts, "fat-type", 0);
1167     floppy = qemu_opt_get_bool(opts, "floppy", false);
1168 
1169     memset(s->volume_label, ' ', sizeof(s->volume_label));
1170     label = qemu_opt_get(opts, "label");
1171     if (label) {
1172         size_t label_length = strlen(label);
1173         if (label_length > 11) {
1174             error_setg(errp, "vvfat label cannot be longer than 11 bytes");
1175             ret = -EINVAL;
1176             goto fail;
1177         }
1178         memcpy(s->volume_label, label, label_length);
1179     } else {
1180         memcpy(s->volume_label, "QEMU VVFAT", 10);
1181     }
1182 
1183     if (floppy) {
1184         /* 1.44MB or 2.88MB floppy.  2.88MB can be FAT12 (default) or FAT16. */
1185         if (!s->fat_type) {
1186             s->fat_type = 12;
1187             secs = 36;
1188             s->sectors_per_cluster = 2;
1189         } else {
1190             secs = s->fat_type == 12 ? 18 : 36;
1191             s->sectors_per_cluster = 1;
1192         }
1193         cyls = 80;
1194         heads = 2;
1195     } else {
1196         /* 32MB or 504MB disk*/
1197         if (!s->fat_type) {
1198             s->fat_type = 16;
1199         }
1200         s->offset_to_bootsector = 0x3f;
1201         cyls = s->fat_type == 12 ? 64 : 1024;
1202         heads = 16;
1203         secs = 63;
1204     }
1205 
1206     switch (s->fat_type) {
1207     case 32:
1208         warn_report("FAT32 has not been tested. You are welcome to do so!");
1209         break;
1210     case 16:
1211     case 12:
1212         break;
1213     default:
1214         error_setg(errp, "Valid FAT types are only 12, 16 and 32");
1215         ret = -EINVAL;
1216         goto fail;
1217     }
1218 
1219 
1220     s->bs = bs;
1221 
1222     /* LATER TODO: if FAT32, adjust */
1223     s->sectors_per_cluster=0x10;
1224 
1225     s->current_cluster=0xffffffff;
1226 
1227     s->qcow = NULL;
1228     s->qcow_filename = NULL;
1229     s->fat2 = NULL;
1230     s->downcase_short_names = 1;
1231 
1232     DLOG(fprintf(stderr, "vvfat %s chs %d,%d,%d\n",
1233                  dirname, cyls, heads, secs));
1234 
1235     s->sector_count = cyls * heads * secs - s->offset_to_bootsector;
1236     bs->total_sectors = cyls * heads * secs;
1237 
1238     if (qemu_opt_get_bool(opts, "rw", false)) {
1239         if (!bdrv_is_read_only(bs)) {
1240             ret = enable_write_target(bs, errp);
1241             if (ret < 0) {
1242                 goto fail;
1243             }
1244         } else {
1245             ret = -EPERM;
1246             error_setg(errp,
1247                        "Unable to set VVFAT to 'rw' when drive is read-only");
1248             goto fail;
1249         }
1250     } else {
1251         ret = bdrv_apply_auto_read_only(bs, NULL, errp);
1252         if (ret < 0) {
1253             goto fail;
1254         }
1255     }
1256 
1257     if (init_directories(s, dirname, heads, secs, errp)) {
1258         ret = -EIO;
1259         goto fail;
1260     }
1261 
1262     s->sector_count = s->offset_to_root_dir
1263                     + s->sectors_per_cluster * s->cluster_count;
1264 
1265     /* Disable migration when vvfat is used rw */
1266     if (s->qcow) {
1267         error_setg(&s->migration_blocker,
1268                    "The vvfat (rw) format used by node '%s' "
1269                    "does not support live migration",
1270                    bdrv_get_device_or_node_name(bs));
1271         ret = migrate_add_blocker_normal(&s->migration_blocker, errp);
1272         if (ret < 0) {
1273             goto fail;
1274         }
1275     }
1276 
1277     if (s->offset_to_bootsector > 0) {
1278         init_mbr(s, cyls, heads, secs);
1279     }
1280 
1281     qemu_co_mutex_init(&s->lock);
1282 
1283     qemu_opts_del(opts);
1284 
1285     return 0;
1286 
1287 fail:
1288     g_free(s->qcow_filename);
1289     s->qcow_filename = NULL;
1290     g_free(s->cluster_buffer);
1291     s->cluster_buffer = NULL;
1292     g_free(s->used_clusters);
1293     s->used_clusters = NULL;
1294 
1295     qemu_opts_del(opts);
1296     return ret;
1297 }
1298 
1299 static void vvfat_refresh_limits(BlockDriverState *bs, Error **errp)
1300 {
1301     bs->bl.request_alignment = BDRV_SECTOR_SIZE; /* No sub-sector I/O */
1302 }
1303 
1304 static inline void vvfat_close_current_file(BDRVVVFATState *s)
1305 {
1306     if(s->current_mapping) {
1307         s->current_mapping = NULL;
1308         if (s->current_fd) {
1309                 qemu_close(s->current_fd);
1310                 s->current_fd = 0;
1311         }
1312     }
1313     s->current_cluster = -1;
1314 }
1315 
1316 /* mappings between index1 and index2-1 are supposed to be ordered
1317  * return value is the index of the last mapping for which end>cluster_num
1318  */
1319 static inline int find_mapping_for_cluster_aux(BDRVVVFATState* s,int cluster_num,int index1,int index2)
1320 {
1321     while(1) {
1322         int index3;
1323         mapping_t* mapping;
1324         index3=(index1+index2)/2;
1325         mapping=array_get(&(s->mapping),index3);
1326         assert(mapping->begin < mapping->end);
1327         if(mapping->begin>=cluster_num) {
1328             assert(index2!=index3 || index2==0);
1329             if(index2==index3)
1330                 return index1;
1331             index2=index3;
1332         } else {
1333             if(index1==index3)
1334                 return mapping->end<=cluster_num ? index2 : index1;
1335             index1=index3;
1336         }
1337         assert(index1<=index2);
1338         DLOG(mapping=array_get(&(s->mapping),index1);
1339         assert(mapping->begin<=cluster_num);
1340         assert(index2 >= s->mapping.next ||
1341                 ((mapping = array_get(&(s->mapping),index2)) &&
1342                 mapping->end>cluster_num)));
1343     }
1344 }
1345 
1346 static inline mapping_t* find_mapping_for_cluster(BDRVVVFATState* s,int cluster_num)
1347 {
1348     int index=find_mapping_for_cluster_aux(s,cluster_num,0,s->mapping.next);
1349     mapping_t* mapping;
1350     if(index>=s->mapping.next)
1351         return NULL;
1352     mapping=array_get(&(s->mapping),index);
1353     if(mapping->begin>cluster_num)
1354         return NULL;
1355     assert(mapping->begin<=cluster_num && mapping->end>cluster_num);
1356     return mapping;
1357 }
1358 
1359 static int open_file(BDRVVVFATState* s,mapping_t* mapping)
1360 {
1361     if(!mapping)
1362         return -1;
1363     if(!s->current_mapping ||
1364             strcmp(s->current_mapping->path,mapping->path)) {
1365         /* open file */
1366         int fd = qemu_open_old(mapping->path,
1367                                O_RDONLY | O_BINARY | O_LARGEFILE);
1368         if(fd<0)
1369             return -1;
1370         vvfat_close_current_file(s);
1371         s->current_fd = fd;
1372         s->current_mapping = mapping;
1373     }
1374     return 0;
1375 }
1376 
1377 static inline int read_cluster(BDRVVVFATState *s,int cluster_num)
1378 {
1379     if(s->current_cluster != cluster_num) {
1380         int result=0;
1381         off_t offset;
1382         assert(!s->current_mapping || s->current_fd || (s->current_mapping->mode & MODE_DIRECTORY));
1383         if(!s->current_mapping
1384                 || s->current_mapping->begin>cluster_num
1385                 || s->current_mapping->end<=cluster_num) {
1386             /* binary search of mappings for file */
1387             mapping_t* mapping=find_mapping_for_cluster(s,cluster_num);
1388 
1389             assert(!mapping || (cluster_num>=mapping->begin && cluster_num<mapping->end));
1390 
1391             if (mapping && mapping->mode & MODE_DIRECTORY) {
1392                 vvfat_close_current_file(s);
1393                 s->current_mapping = mapping;
1394 read_cluster_directory:
1395                 offset = s->cluster_size*(cluster_num-s->current_mapping->begin);
1396                 s->cluster = (unsigned char*)s->directory.pointer+offset
1397                         + 0x20*s->current_mapping->info.dir.first_dir_index;
1398                 assert(((s->cluster-(unsigned char*)s->directory.pointer)%s->cluster_size)==0);
1399                 assert((char*)s->cluster+s->cluster_size <= s->directory.pointer+s->directory.next*s->directory.item_size);
1400                 s->current_cluster = cluster_num;
1401                 return 0;
1402             }
1403 
1404             if(open_file(s,mapping))
1405                 return -2;
1406         } else if (s->current_mapping->mode & MODE_DIRECTORY)
1407             goto read_cluster_directory;
1408 
1409         assert(s->current_fd);
1410 
1411         offset = s->cluster_size *
1412             ((cluster_num - s->current_mapping->begin)
1413             + s->current_mapping->info.file.offset);
1414         if(lseek(s->current_fd, offset, SEEK_SET)!=offset)
1415             return -3;
1416         s->cluster=s->cluster_buffer;
1417         result=read(s->current_fd,s->cluster,s->cluster_size);
1418         if(result<0) {
1419             s->current_cluster = -1;
1420             return -1;
1421         }
1422         s->current_cluster = cluster_num;
1423     }
1424     return 0;
1425 }
1426 
1427 #ifdef DEBUG
1428 static void print_direntry(const direntry_t* direntry)
1429 {
1430     int j = 0;
1431     char buffer[1024];
1432 
1433     fprintf(stderr, "direntry %p: ", direntry);
1434     if(!direntry)
1435         return;
1436     if(is_long_name(direntry)) {
1437         unsigned char* c=(unsigned char*)direntry;
1438         int i;
1439         for(i=1;i<11 && c[i] && c[i]!=0xff;i+=2)
1440 #define ADD_CHAR(c) {buffer[j] = (c); if (buffer[j] < ' ') buffer[j] = 0xb0; j++;}
1441             ADD_CHAR(c[i]);
1442         for(i=14;i<26 && c[i] && c[i]!=0xff;i+=2)
1443             ADD_CHAR(c[i]);
1444         for(i=28;i<32 && c[i] && c[i]!=0xff;i+=2)
1445             ADD_CHAR(c[i]);
1446         buffer[j] = 0;
1447         fprintf(stderr, "%s\n", buffer);
1448     } else {
1449         int i;
1450         for(i=0;i<11;i++)
1451             ADD_CHAR(direntry->name[i]);
1452         buffer[j] = 0;
1453         fprintf(stderr, "%s attributes=0x%02x begin=%u size=%u\n",
1454                 buffer,
1455                 direntry->attributes,
1456                 begin_of_direntry(direntry),le32_to_cpu(direntry->size));
1457     }
1458 }
1459 
1460 static void print_mapping(const mapping_t* mapping)
1461 {
1462     fprintf(stderr, "mapping (%p): begin, end = %u, %u, dir_index = %u, "
1463         "first_mapping_index = %d, name = %s, mode = 0x%x, " ,
1464         mapping, mapping->begin, mapping->end, mapping->dir_index,
1465         mapping->first_mapping_index, mapping->path, mapping->mode);
1466 
1467     if (mapping->mode & MODE_DIRECTORY)
1468         fprintf(stderr, "parent_mapping_index = %d, first_dir_index = %d\n", mapping->info.dir.parent_mapping_index, mapping->info.dir.first_dir_index);
1469     else
1470         fprintf(stderr, "offset = %u\n", mapping->info.file.offset);
1471 }
1472 #endif
1473 
1474 static int coroutine_fn GRAPH_RDLOCK
1475 vvfat_read(BlockDriverState *bs, int64_t sector_num, uint8_t *buf, int nb_sectors)
1476 {
1477     BDRVVVFATState *s = bs->opaque;
1478     int i;
1479 
1480     for(i=0;i<nb_sectors;i++,sector_num++) {
1481         if (sector_num >= bs->total_sectors)
1482            return -1;
1483         if (s->qcow) {
1484             int64_t n;
1485             int ret;
1486             ret = bdrv_co_is_allocated(s->qcow->bs, sector_num * BDRV_SECTOR_SIZE,
1487                                        (nb_sectors - i) * BDRV_SECTOR_SIZE, &n);
1488             if (ret < 0) {
1489                 return ret;
1490             }
1491             if (ret) {
1492                 DLOG(fprintf(stderr, "sectors %" PRId64 "+%" PRId64
1493                              " allocated\n", sector_num,
1494                              n >> BDRV_SECTOR_BITS));
1495                 if (bdrv_co_pread(s->qcow, sector_num * BDRV_SECTOR_SIZE, n,
1496                                   buf + i * 0x200, 0) < 0) {
1497                     return -1;
1498                 }
1499                 i += (n >> BDRV_SECTOR_BITS) - 1;
1500                 sector_num += (n >> BDRV_SECTOR_BITS) - 1;
1501                 continue;
1502             }
1503             DLOG(fprintf(stderr, "sector %" PRId64 " not allocated\n",
1504                          sector_num));
1505         }
1506         if (sector_num < s->offset_to_root_dir) {
1507             if (sector_num < s->offset_to_fat) {
1508                 memcpy(buf + i * 0x200,
1509                        &(s->first_sectors[sector_num * 0x200]),
1510                        0x200);
1511             } else if (sector_num < s->offset_to_fat + s->sectors_per_fat) {
1512                 memcpy(buf + i * 0x200,
1513                        &(s->fat.pointer[(sector_num
1514                                        - s->offset_to_fat) * 0x200]),
1515                        0x200);
1516             } else if (sector_num < s->offset_to_root_dir) {
1517                 memcpy(buf + i * 0x200,
1518                        &(s->fat.pointer[(sector_num - s->offset_to_fat
1519                                        - s->sectors_per_fat) * 0x200]),
1520                        0x200);
1521             }
1522         } else {
1523             uint32_t sector = sector_num - s->offset_to_root_dir,
1524             sector_offset_in_cluster=(sector%s->sectors_per_cluster),
1525             cluster_num=sector/s->sectors_per_cluster;
1526             if(cluster_num > s->cluster_count || read_cluster(s, cluster_num) != 0) {
1527                 /* LATER TODO: strict: return -1; */
1528                 memset(buf+i*0x200,0,0x200);
1529                 continue;
1530             }
1531             memcpy(buf+i*0x200,s->cluster+sector_offset_in_cluster*0x200,0x200);
1532         }
1533     }
1534     return 0;
1535 }
1536 
1537 static int coroutine_fn GRAPH_RDLOCK
1538 vvfat_co_preadv(BlockDriverState *bs, int64_t offset, int64_t bytes,
1539                 QEMUIOVector *qiov, BdrvRequestFlags flags)
1540 {
1541     int ret;
1542     BDRVVVFATState *s = bs->opaque;
1543     uint64_t sector_num = offset >> BDRV_SECTOR_BITS;
1544     int nb_sectors = bytes >> BDRV_SECTOR_BITS;
1545     void *buf;
1546 
1547     assert(QEMU_IS_ALIGNED(offset, BDRV_SECTOR_SIZE));
1548     assert(QEMU_IS_ALIGNED(bytes, BDRV_SECTOR_SIZE));
1549 
1550     buf = g_try_malloc(bytes);
1551     if (bytes && buf == NULL) {
1552         return -ENOMEM;
1553     }
1554 
1555     qemu_co_mutex_lock(&s->lock);
1556     ret = vvfat_read(bs, sector_num, buf, nb_sectors);
1557     qemu_co_mutex_unlock(&s->lock);
1558 
1559     qemu_iovec_from_buf(qiov, 0, buf, bytes);
1560     g_free(buf);
1561 
1562     return ret;
1563 }
1564 
1565 /* LATER TODO: statify all functions */
1566 
1567 /*
1568  * Idea of the write support (use snapshot):
1569  *
1570  * 1. check if all data is consistent, recording renames, modifications,
1571  *    new files and directories (in s->commits).
1572  *
1573  * 2. if the data is not consistent, stop committing
1574  *
1575  * 3. handle renames, and create new files and directories (do not yet
1576  *    write their contents)
1577  *
1578  * 4. walk the directories, fixing the mapping and direntries, and marking
1579  *    the handled mappings as not deleted
1580  *
1581  * 5. commit the contents of the files
1582  *
1583  * 6. handle deleted files and directories
1584  *
1585  */
1586 
1587 typedef struct commit_t {
1588     char* path;
1589     union {
1590         struct { uint32_t cluster; } rename;
1591         struct { int dir_index; uint32_t modified_offset; } writeout;
1592         struct { uint32_t first_cluster; } new_file;
1593         struct { uint32_t cluster; } mkdir;
1594     } param;
1595     /* DELETEs and RMDIRs are handled differently: see handle_deletes() */
1596     enum {
1597         ACTION_RENAME, ACTION_WRITEOUT, ACTION_NEW_FILE, ACTION_MKDIR
1598     } action;
1599 } commit_t;
1600 
1601 static void clear_commits(BDRVVVFATState* s)
1602 {
1603     int i;
1604 DLOG(fprintf(stderr, "clear_commits (%u commits)\n", s->commits.next));
1605     for (i = 0; i < s->commits.next; i++) {
1606         commit_t* commit = array_get(&(s->commits), i);
1607         assert(commit->path || commit->action == ACTION_WRITEOUT);
1608         if (commit->action != ACTION_WRITEOUT) {
1609             assert(commit->path);
1610             g_free(commit->path);
1611         } else
1612             assert(commit->path == NULL);
1613     }
1614     s->commits.next = 0;
1615 }
1616 
1617 static void schedule_rename(BDRVVVFATState* s,
1618         uint32_t cluster, char* new_path)
1619 {
1620     commit_t* commit = array_get_next(&(s->commits));
1621     commit->path = new_path;
1622     commit->param.rename.cluster = cluster;
1623     commit->action = ACTION_RENAME;
1624 }
1625 
1626 static void schedule_writeout(BDRVVVFATState* s,
1627         int dir_index, uint32_t modified_offset)
1628 {
1629     commit_t* commit = array_get_next(&(s->commits));
1630     commit->path = NULL;
1631     commit->param.writeout.dir_index = dir_index;
1632     commit->param.writeout.modified_offset = modified_offset;
1633     commit->action = ACTION_WRITEOUT;
1634 }
1635 
1636 static void schedule_new_file(BDRVVVFATState* s,
1637         char* path, uint32_t first_cluster)
1638 {
1639     commit_t* commit = array_get_next(&(s->commits));
1640     commit->path = path;
1641     commit->param.new_file.first_cluster = first_cluster;
1642     commit->action = ACTION_NEW_FILE;
1643 }
1644 
1645 static void schedule_mkdir(BDRVVVFATState* s, uint32_t cluster, char* path)
1646 {
1647     commit_t* commit = array_get_next(&(s->commits));
1648     commit->path = path;
1649     commit->param.mkdir.cluster = cluster;
1650     commit->action = ACTION_MKDIR;
1651 }
1652 
1653 typedef struct {
1654     /*
1655      * Since the sequence number is at most 0x3f, and the filename
1656      * length is at most 13 times the sequence number, the maximal
1657      * filename length is 0x3f * 13 bytes.
1658      */
1659     unsigned char name[0x3f * 13 + 1];
1660     gunichar2 name2[0x3f * 13 + 1];
1661     int checksum, len;
1662     int sequence_number;
1663 } long_file_name;
1664 
1665 static void lfn_init(long_file_name* lfn)
1666 {
1667    lfn->sequence_number = lfn->len = 0;
1668    lfn->checksum = 0x100;
1669 }
1670 
1671 /* return 0 if parsed successfully, > 0 if no long name, < 0 if error */
1672 static int parse_long_name(long_file_name* lfn,
1673         const direntry_t* direntry)
1674 {
1675     int i, j, offset;
1676     const unsigned char* pointer = (const unsigned char*)direntry;
1677 
1678     if (!is_long_name(direntry))
1679         return 1;
1680 
1681     if (pointer[0] & 0x40) {
1682         /* first entry; do some initialization */
1683         lfn->sequence_number = pointer[0] & 0x3f;
1684         lfn->checksum = pointer[13];
1685         lfn->name[0] = 0;
1686         lfn->name[lfn->sequence_number * 13] = 0;
1687     } else if ((pointer[0] & 0x3f) != --lfn->sequence_number) {
1688         /* not the expected sequence number */
1689         return -1;
1690     } else if (pointer[13] != lfn->checksum) {
1691         /* not the expected checksum */
1692         return -2;
1693     } else if (pointer[12] || pointer[26] || pointer[27]) {
1694         /* invalid zero fields */
1695         return -3;
1696     }
1697 
1698     offset = 13 * (lfn->sequence_number - 1);
1699     for (i = 0, j = 1; i < 13; i++, j+=2) {
1700         if (j == 11)
1701             j = 14;
1702         else if (j == 26)
1703             j = 28;
1704 
1705         if (pointer[j] == 0 && pointer[j + 1] == 0) {
1706             /* end of long file name */
1707             break;
1708         }
1709         gunichar2 c = (pointer[j + 1] << 8) + pointer[j];
1710         lfn->name2[offset + i] = c;
1711     }
1712 
1713     if (pointer[0] & 0x40) {
1714         /* first entry; set len */
1715         lfn->len = offset + i;
1716     }
1717     if ((pointer[0] & 0x3f) == 0x01) {
1718         /* last entry; finalize entry */
1719         glong olen;
1720         gchar *utf8 = g_utf16_to_utf8(lfn->name2, lfn->len, NULL, &olen, NULL);
1721         if (!utf8) {
1722             return -4;
1723         }
1724         lfn->len = olen;
1725         memcpy(lfn->name, utf8, olen + 1);
1726         g_free(utf8);
1727     }
1728 
1729     return 0;
1730 }
1731 
1732 /* returns 0 if successful, >0 if no short_name, and <0 on error */
1733 static int parse_short_name(BDRVVVFATState* s,
1734         long_file_name* lfn, direntry_t* direntry)
1735 {
1736     int i, j;
1737 
1738     if (!is_short_name(direntry))
1739         return 1;
1740 
1741     for (j = 7; j >= 0 && direntry->name[j] == ' '; j--);
1742     for (i = 0; i <= j; i++) {
1743         uint8_t c = direntry->name[i];
1744         if (c != to_valid_short_char(c)) {
1745             return -1;
1746         } else if (s->downcase_short_names) {
1747             lfn->name[i] = qemu_tolower(direntry->name[i]);
1748         } else {
1749             lfn->name[i] = direntry->name[i];
1750         }
1751     }
1752 
1753     for (j = 2; j >= 0 && direntry->name[8 + j] == ' '; j--) {
1754     }
1755     if (j >= 0) {
1756         lfn->name[i++] = '.';
1757         lfn->name[i + j + 1] = '\0';
1758         for (;j >= 0; j--) {
1759             uint8_t c = direntry->name[8 + j];
1760             if (c != to_valid_short_char(c)) {
1761                 return -2;
1762             } else if (s->downcase_short_names) {
1763                 lfn->name[i + j] = qemu_tolower(c);
1764             } else {
1765                 lfn->name[i + j] = c;
1766             }
1767         }
1768     } else
1769         lfn->name[i + j + 1] = '\0';
1770 
1771     if (lfn->name[0] == DIR_KANJI_FAKE) {
1772         lfn->name[0] = DIR_KANJI;
1773     }
1774     lfn->len = strlen((char*)lfn->name);
1775 
1776     return 0;
1777 }
1778 
1779 static inline uint32_t modified_fat_get(BDRVVVFATState* s,
1780         unsigned int cluster)
1781 {
1782     if (cluster < s->last_cluster_of_root_directory) {
1783         if (cluster + 1 == s->last_cluster_of_root_directory)
1784             return s->max_fat_value;
1785         else
1786             return cluster + 1;
1787     }
1788 
1789     if (s->fat_type==32) {
1790         uint32_t* entry=((uint32_t*)s->fat2)+cluster;
1791         return le32_to_cpu(*entry);
1792     } else if (s->fat_type==16) {
1793         uint16_t* entry=((uint16_t*)s->fat2)+cluster;
1794         return le16_to_cpu(*entry);
1795     } else {
1796         const uint8_t* x=s->fat2+cluster*3/2;
1797         return ((x[0]|(x[1]<<8))>>(cluster&1?4:0))&0x0fff;
1798     }
1799 }
1800 
1801 static inline bool coroutine_fn GRAPH_RDLOCK
1802 cluster_was_modified(BDRVVVFATState *s, uint32_t cluster_num)
1803 {
1804     int was_modified = 0;
1805     int i;
1806 
1807     if (s->qcow == NULL) {
1808         return 0;
1809     }
1810 
1811     for (i = 0; !was_modified && i < s->sectors_per_cluster; i++) {
1812         was_modified = bdrv_co_is_allocated(s->qcow->bs,
1813                                             (cluster2sector(s, cluster_num) +
1814                                              i) * BDRV_SECTOR_SIZE,
1815                                             BDRV_SECTOR_SIZE, NULL);
1816     }
1817 
1818     /*
1819      * Note that this treats failures to learn allocation status the
1820      * same as if an allocation has occurred.  It's as safe as
1821      * anything else, given that a failure to learn allocation status
1822      * will probably result in more failures.
1823      */
1824     return !!was_modified;
1825 }
1826 
1827 static const char* get_basename(const char* path)
1828 {
1829     char* basename = strrchr(path, '/');
1830     if (basename == NULL)
1831         return path;
1832     else
1833         return basename + 1; /* strip '/' */
1834 }
1835 
1836 /*
1837  * The array s->used_clusters holds the states of the clusters. If it is
1838  * part of a file, it has bit 2 set, in case of a directory, bit 1. If it
1839  * was modified, bit 3 is set.
1840  * If any cluster is allocated, but not part of a file or directory, this
1841  * driver refuses to commit.
1842  */
1843 typedef enum {
1844      USED_DIRECTORY = 1, USED_FILE = 2, USED_ANY = 3, USED_ALLOCATED = 4
1845 } used_t;
1846 
1847 /*
1848  * get_cluster_count_for_direntry() not only determines how many clusters
1849  * are occupied by direntry, but also if it was renamed or modified.
1850  *
1851  * A file is thought to be renamed *only* if there already was a file with
1852  * exactly the same first cluster, but a different name.
1853  *
1854  * Further, the files/directories handled by this function are
1855  * assumed to be *not* deleted (and *only* those).
1856  */
1857 static uint32_t coroutine_fn GRAPH_RDLOCK
1858 get_cluster_count_for_direntry(BDRVVVFATState* s, direntry_t* direntry, const char* path)
1859 {
1860     /*
1861      * This is a little bit tricky:
1862      * IF the guest OS just inserts a cluster into the file chain,
1863      * and leaves the rest alone, (i.e. the original file had clusters
1864      * 15 -> 16, but now has 15 -> 32 -> 16), then the following happens:
1865      *
1866      * - do_commit will write the cluster into the file at the given
1867      *   offset, but
1868      *
1869      * - the cluster which is overwritten should be moved to a later
1870      *   position in the file.
1871      *
1872      * I am not aware that any OS does something as braindead, but this
1873      * situation could happen anyway when not committing for a long time.
1874      * Just to be sure that this does not bite us, detect it, and copy the
1875      * contents of the clusters to-be-overwritten into the qcow.
1876      */
1877     int copy_it = 0;
1878     int was_modified = 0;
1879     int32_t ret = 0;
1880 
1881     uint32_t cluster_num = begin_of_direntry(direntry);
1882     uint32_t offset = 0;
1883     mapping_t* mapping = NULL;
1884     const char* basename2 = NULL;
1885 
1886     vvfat_close_current_file(s);
1887 
1888     /* the root directory */
1889     if (cluster_num == 0)
1890         return 0;
1891 
1892     /* write support */
1893     if (s->qcow) {
1894         basename2 = get_basename(path);
1895 
1896         mapping = find_mapping_for_cluster(s, cluster_num);
1897 
1898         if (mapping) {
1899             const char* basename;
1900 
1901             assert(mapping->mode & MODE_DELETED);
1902             mapping->mode &= ~MODE_DELETED;
1903 
1904             basename = get_basename(mapping->path);
1905 
1906             assert(mapping->mode & MODE_NORMAL);
1907 
1908             /* rename */
1909             if (strcmp(basename, basename2))
1910                 schedule_rename(s, cluster_num, g_strdup(path));
1911         } else if (is_file(direntry))
1912             /* new file */
1913             schedule_new_file(s, g_strdup(path), cluster_num);
1914         else {
1915             abort();
1916             return 0;
1917         }
1918     }
1919 
1920     while(1) {
1921         if (s->qcow) {
1922             if (!copy_it && cluster_was_modified(s, cluster_num)) {
1923                 if (mapping == NULL ||
1924                         mapping->begin > cluster_num ||
1925                         mapping->end <= cluster_num)
1926                 mapping = find_mapping_for_cluster(s, cluster_num);
1927 
1928 
1929                 if (mapping &&
1930                         (mapping->mode & MODE_DIRECTORY) == 0) {
1931 
1932                     /* was modified in qcow */
1933                     if (offset != s->cluster_size
1934                             * ((cluster_num - mapping->begin)
1935                             + mapping->info.file.offset)) {
1936                         /* offset of this cluster in file chain has changed */
1937                         abort();
1938                         copy_it = 1;
1939                     } else if (offset == 0) {
1940                         const char* basename = get_basename(mapping->path);
1941 
1942                         if (strcmp(basename, basename2))
1943                             copy_it = 1;
1944                     }
1945                     assert(mapping->first_mapping_index == -1
1946                             || mapping->info.file.offset > 0);
1947 
1948                     /* need to write out? */
1949                     if (!was_modified && is_file(direntry)) {
1950                         was_modified = 1;
1951                         schedule_writeout(s, mapping->dir_index, offset);
1952                     }
1953                 }
1954             }
1955 
1956             if (copy_it) {
1957                 int i;
1958                 /*
1959                  * This is horribly inefficient, but that is okay, since
1960                  * it is rarely executed, if at all.
1961                  */
1962                 int64_t offs = cluster2sector(s, cluster_num);
1963 
1964                 vvfat_close_current_file(s);
1965                 for (i = 0; i < s->sectors_per_cluster; i++) {
1966                     int res;
1967 
1968                     res = bdrv_co_is_allocated(s->qcow->bs,
1969                                                (offs + i) * BDRV_SECTOR_SIZE,
1970                                                BDRV_SECTOR_SIZE, NULL);
1971                     if (res < 0) {
1972                         return -1;
1973                     }
1974                     if (!res) {
1975                         res = vvfat_read(s->bs, offs, s->cluster_buffer, 1);
1976                         if (res) {
1977                             return -1;
1978                         }
1979                         res = bdrv_co_pwrite(s->qcow, offs * BDRV_SECTOR_SIZE,
1980                                              BDRV_SECTOR_SIZE, s->cluster_buffer,
1981                                              0);
1982                         if (res < 0) {
1983                             return -2;
1984                         }
1985                     }
1986                 }
1987             }
1988         }
1989 
1990         ret++;
1991         if (s->used_clusters[cluster_num] & USED_ANY)
1992             return 0;
1993         s->used_clusters[cluster_num] = USED_FILE;
1994 
1995         cluster_num = modified_fat_get(s, cluster_num);
1996 
1997         if (fat_eof(s, cluster_num))
1998             return ret;
1999         else if (cluster_num < 2 || cluster_num > s->max_fat_value - 16)
2000             return -1;
2001 
2002         offset += s->cluster_size;
2003     }
2004 }
2005 
2006 /*
2007  * This function looks at the modified data (qcow).
2008  * It returns 0 upon inconsistency or error, and the number of clusters
2009  * used by the directory, its subdirectories and their files.
2010  */
2011 static int coroutine_fn GRAPH_RDLOCK
2012 check_directory_consistency(BDRVVVFATState *s, int cluster_num, const char* path)
2013 {
2014     int ret = 0;
2015     unsigned char* cluster = g_malloc(s->cluster_size);
2016     direntry_t* direntries = (direntry_t*)cluster;
2017     mapping_t* mapping = find_mapping_for_cluster(s, cluster_num);
2018 
2019     long_file_name lfn;
2020     int path_len = strlen(path);
2021     char path2[PATH_MAX + 1];
2022 
2023     assert(path_len < PATH_MAX); /* len was tested before! */
2024     pstrcpy(path2, sizeof(path2), path);
2025     path2[path_len] = '/';
2026     path2[path_len + 1] = '\0';
2027 
2028     if (mapping) {
2029         const char* basename = get_basename(mapping->path);
2030         const char* basename2 = get_basename(path);
2031 
2032         assert(mapping->mode & MODE_DIRECTORY);
2033 
2034         assert(mapping->mode & MODE_DELETED);
2035         mapping->mode &= ~MODE_DELETED;
2036 
2037         if (strcmp(basename, basename2))
2038             schedule_rename(s, cluster_num, g_strdup(path));
2039     } else
2040         /* new directory */
2041         schedule_mkdir(s, cluster_num, g_strdup(path));
2042 
2043     lfn_init(&lfn);
2044     do {
2045         int i;
2046         int subret = 0;
2047 
2048         ret++;
2049 
2050         if (s->used_clusters[cluster_num] & USED_ANY) {
2051             fprintf(stderr, "cluster %d used more than once\n", (int)cluster_num);
2052             goto fail;
2053         }
2054         s->used_clusters[cluster_num] = USED_DIRECTORY;
2055 
2056 DLOG(fprintf(stderr, "read cluster %d (sector %d)\n", (int)cluster_num, (int)cluster2sector(s, cluster_num)));
2057         subret = vvfat_read(s->bs, cluster2sector(s, cluster_num), cluster,
2058                 s->sectors_per_cluster);
2059         if (subret) {
2060             fprintf(stderr, "Error fetching direntries\n");
2061         fail:
2062             g_free(cluster);
2063             return 0;
2064         }
2065 
2066         for (i = 0; i < 0x10 * s->sectors_per_cluster; i++) {
2067             int cluster_count = 0;
2068 
2069 DLOG(fprintf(stderr, "check direntry %d:\n", i); print_direntry(direntries + i));
2070             if (is_volume_label(direntries + i) || is_dot(direntries + i) ||
2071                     is_free(direntries + i))
2072                 continue;
2073 
2074             subret = parse_long_name(&lfn, direntries + i);
2075             if (subret < 0) {
2076                 fprintf(stderr, "Error in long name\n");
2077                 goto fail;
2078             }
2079             if (subret == 0 || is_free(direntries + i))
2080                 continue;
2081 
2082             if (fat_chksum(direntries+i) != lfn.checksum) {
2083                 subret = parse_short_name(s, &lfn, direntries + i);
2084                 if (subret < 0) {
2085                     fprintf(stderr, "Error in short name (%d)\n", subret);
2086                     goto fail;
2087                 }
2088                 if (subret > 0 || !strcmp((char*)lfn.name, ".")
2089                         || !strcmp((char*)lfn.name, ".."))
2090                     continue;
2091             }
2092             lfn.checksum = 0x100; /* cannot use long name twice */
2093 
2094             if (!valid_filename(lfn.name)) {
2095                 fprintf(stderr, "Invalid file name\n");
2096                 goto fail;
2097             }
2098             if (path_len + 1 + lfn.len >= PATH_MAX) {
2099                 fprintf(stderr, "Name too long: %s/%s\n", path, lfn.name);
2100                 goto fail;
2101             }
2102             pstrcpy(path2 + path_len + 1, sizeof(path2) - path_len - 1,
2103                     (char*)lfn.name);
2104 
2105             if (is_directory(direntries + i)) {
2106                 if (begin_of_direntry(direntries + i) == 0) {
2107                     DLOG(fprintf(stderr, "invalid begin for directory: %s\n", path2); print_direntry(direntries + i));
2108                     goto fail;
2109                 }
2110                 cluster_count = check_directory_consistency(s,
2111                         begin_of_direntry(direntries + i), path2);
2112                 if (cluster_count == 0) {
2113                     DLOG(fprintf(stderr, "problem in directory %s:\n", path2); print_direntry(direntries + i));
2114                     goto fail;
2115                 }
2116             } else if (is_file(direntries + i)) {
2117                 /* check file size with FAT */
2118                 cluster_count = get_cluster_count_for_direntry(s, direntries + i, path2);
2119                 if (cluster_count !=
2120             DIV_ROUND_UP(le32_to_cpu(direntries[i].size), s->cluster_size)) {
2121                     DLOG(fprintf(stderr, "Cluster count mismatch\n"));
2122                     goto fail;
2123                 }
2124             } else
2125                 abort(); /* cluster_count = 0; */
2126 
2127             ret += cluster_count;
2128         }
2129 
2130         cluster_num = modified_fat_get(s, cluster_num);
2131     } while(!fat_eof(s, cluster_num));
2132 
2133     g_free(cluster);
2134     return ret;
2135 }
2136 
2137 /* returns 1 on success */
2138 static int coroutine_fn GRAPH_RDLOCK
2139 is_consistent(BDRVVVFATState* s)
2140 {
2141     int i, check;
2142     int used_clusters_count = 0;
2143 
2144 DLOG(checkpoint());
2145     /*
2146      * - get modified FAT
2147      * - compare the two FATs (TODO)
2148      * - get buffer for marking used clusters
2149      * - recurse direntries from root (using bs->bdrv_pread to make
2150      *    sure to get the new data)
2151      *   - check that the FAT agrees with the size
2152      *   - count the number of clusters occupied by this directory and
2153      *     its files
2154      * - check that the cumulative used cluster count agrees with the
2155      *   FAT
2156      * - if all is fine, return number of used clusters
2157      */
2158     if (s->fat2 == NULL) {
2159         int size = 0x200 * s->sectors_per_fat;
2160         s->fat2 = g_malloc(size);
2161         memcpy(s->fat2, s->fat.pointer, size);
2162     }
2163     check = vvfat_read(s->bs,
2164             s->offset_to_fat, s->fat2, s->sectors_per_fat);
2165     if (check) {
2166         fprintf(stderr, "Could not copy fat\n");
2167         return 0;
2168     }
2169     assert (s->used_clusters);
2170     for (i = 0; i < sector2cluster(s, s->sector_count); i++)
2171         s->used_clusters[i] &= ~USED_ANY;
2172 
2173     clear_commits(s);
2174 
2175     /* mark every mapped file/directory as deleted.
2176      * (check_directory_consistency() will unmark those still present). */
2177     if (s->qcow)
2178         for (i = 0; i < s->mapping.next; i++) {
2179             mapping_t* mapping = array_get(&(s->mapping), i);
2180             if (mapping->first_mapping_index < 0)
2181                 mapping->mode |= MODE_DELETED;
2182         }
2183 
2184     used_clusters_count = check_directory_consistency(s, 0, s->path);
2185     if (used_clusters_count <= 0) {
2186         DLOG(fprintf(stderr, "problem in directory\n"));
2187         return 0;
2188     }
2189 
2190     check = s->last_cluster_of_root_directory;
2191     for (i = check; i < sector2cluster(s, s->sector_count); i++) {
2192         if (modified_fat_get(s, i)) {
2193             if(!s->used_clusters[i]) {
2194                 DLOG(fprintf(stderr, "FAT was modified (%d), but cluster is not used?\n", i));
2195                 return 0;
2196             }
2197             check++;
2198         }
2199 
2200         if (s->used_clusters[i] == USED_ALLOCATED) {
2201             /* allocated, but not used... */
2202             DLOG(fprintf(stderr, "unused, modified cluster: %d\n", i));
2203             return 0;
2204         }
2205     }
2206 
2207     if (check != used_clusters_count)
2208         return 0;
2209 
2210     return used_clusters_count;
2211 }
2212 
2213 static inline void adjust_mapping_indices(BDRVVVFATState* s,
2214         int offset, int adjust)
2215 {
2216     int i;
2217 
2218     for (i = 0; i < s->mapping.next; i++) {
2219         mapping_t* mapping = array_get(&(s->mapping), i);
2220 
2221 #define ADJUST_MAPPING_INDEX(name) \
2222         if (mapping->name >= offset) \
2223             mapping->name += adjust
2224 
2225         ADJUST_MAPPING_INDEX(first_mapping_index);
2226         if (mapping->mode & MODE_DIRECTORY)
2227             ADJUST_MAPPING_INDEX(info.dir.parent_mapping_index);
2228     }
2229 }
2230 
2231 /* insert or update mapping */
2232 static mapping_t* insert_mapping(BDRVVVFATState* s,
2233         uint32_t begin, uint32_t end)
2234 {
2235     /*
2236      * - find mapping where mapping->begin >= begin,
2237      * - if mapping->begin > begin: insert
2238      *   - adjust all references to mappings!
2239      * - else: adjust
2240      * - replace name
2241      */
2242     int index = find_mapping_for_cluster_aux(s, begin, 0, s->mapping.next);
2243     mapping_t* mapping = NULL;
2244     mapping_t* first_mapping = array_get(&(s->mapping), 0);
2245 
2246     if (index < s->mapping.next && (mapping = array_get(&(s->mapping), index))
2247             && mapping->begin < begin) {
2248         mapping->end = begin;
2249         index++;
2250         mapping = array_get(&(s->mapping), index);
2251     }
2252     if (index >= s->mapping.next || mapping->begin > begin) {
2253         mapping = array_insert(&(s->mapping), index, 1);
2254         mapping->path = NULL;
2255         adjust_mapping_indices(s, index, +1);
2256     }
2257 
2258     mapping->begin = begin;
2259     mapping->end = end;
2260 
2261 DLOG(mapping_t* next_mapping;
2262 assert(index + 1 >= s->mapping.next ||
2263 ((next_mapping = array_get(&(s->mapping), index + 1)) &&
2264  next_mapping->begin >= end)));
2265 
2266     if (s->current_mapping && first_mapping != (mapping_t*)s->mapping.pointer)
2267         s->current_mapping = array_get(&(s->mapping),
2268                 s->current_mapping - first_mapping);
2269 
2270     return mapping;
2271 }
2272 
2273 static int remove_mapping(BDRVVVFATState* s, int mapping_index)
2274 {
2275     mapping_t* mapping = array_get(&(s->mapping), mapping_index);
2276     mapping_t* first_mapping = array_get(&(s->mapping), 0);
2277 
2278     /* free mapping */
2279     if (mapping->first_mapping_index < 0) {
2280         g_free(mapping->path);
2281     }
2282 
2283     /* remove from s->mapping */
2284     array_remove(&(s->mapping), mapping_index);
2285 
2286     /* adjust all references to mappings */
2287     adjust_mapping_indices(s, mapping_index, -1);
2288 
2289     if (s->current_mapping && first_mapping != (mapping_t*)s->mapping.pointer)
2290         s->current_mapping = array_get(&(s->mapping),
2291                 s->current_mapping - first_mapping);
2292 
2293     return 0;
2294 }
2295 
2296 static void adjust_dirindices(BDRVVVFATState* s, int offset, int adjust)
2297 {
2298     int i;
2299     for (i = 0; i < s->mapping.next; i++) {
2300         mapping_t* mapping = array_get(&(s->mapping), i);
2301         if (mapping->dir_index >= offset)
2302             mapping->dir_index += adjust;
2303         if ((mapping->mode & MODE_DIRECTORY) &&
2304                 mapping->info.dir.first_dir_index >= offset)
2305             mapping->info.dir.first_dir_index += adjust;
2306     }
2307 }
2308 
2309 static direntry_t* insert_direntries(BDRVVVFATState* s,
2310         int dir_index, int count)
2311 {
2312     /*
2313      * make room in s->directory,
2314      * adjust_dirindices
2315      */
2316     direntry_t* result = array_insert(&(s->directory), dir_index, count);
2317     if (result == NULL)
2318         return NULL;
2319     adjust_dirindices(s, dir_index, count);
2320     return result;
2321 }
2322 
2323 static int remove_direntries(BDRVVVFATState* s, int dir_index, int count)
2324 {
2325     int ret = array_remove_slice(&(s->directory), dir_index, count);
2326     if (ret)
2327         return ret;
2328     adjust_dirindices(s, dir_index, -count);
2329     return 0;
2330 }
2331 
2332 /*
2333  * Adapt the mappings of the cluster chain starting at first cluster
2334  * (i.e. if a file starts at first_cluster, the chain is followed according
2335  * to the modified fat, and the corresponding entries in s->mapping are
2336  * adjusted)
2337  */
2338 static int commit_mappings(BDRVVVFATState* s,
2339         uint32_t first_cluster, int dir_index)
2340 {
2341     mapping_t* mapping = find_mapping_for_cluster(s, first_cluster);
2342     direntry_t* direntry = array_get(&(s->directory), dir_index);
2343     uint32_t cluster = first_cluster;
2344 
2345     vvfat_close_current_file(s);
2346 
2347     assert(mapping);
2348     assert(mapping->begin == first_cluster);
2349     mapping->first_mapping_index = -1;
2350     mapping->dir_index = dir_index;
2351     mapping->mode = (dir_index <= 0 || is_directory(direntry)) ?
2352         MODE_DIRECTORY : MODE_NORMAL;
2353 
2354     while (!fat_eof(s, cluster)) {
2355         uint32_t c, c1;
2356 
2357         for (c = cluster, c1 = modified_fat_get(s, c); c + 1 == c1;
2358                 c = c1, c1 = modified_fat_get(s, c1));
2359 
2360         c++;
2361         if (c > mapping->end) {
2362             int index = array_index(&(s->mapping), mapping);
2363             int i, max_i = s->mapping.next - index;
2364             for (i = 1; i < max_i && mapping[i].begin < c; i++);
2365             while (--i > 0)
2366                 remove_mapping(s, index + 1);
2367         }
2368         assert(mapping == array_get(&(s->mapping), s->mapping.next - 1)
2369                 || mapping[1].begin >= c);
2370         mapping->end = c;
2371 
2372         if (!fat_eof(s, c1)) {
2373             int i = find_mapping_for_cluster_aux(s, c1, 0, s->mapping.next);
2374             mapping_t* next_mapping = i >= s->mapping.next ? NULL :
2375                 array_get(&(s->mapping), i);
2376 
2377             if (next_mapping == NULL || next_mapping->begin > c1) {
2378                 int i1 = array_index(&(s->mapping), mapping);
2379 
2380                 next_mapping = insert_mapping(s, c1, c1+1);
2381 
2382                 if (c1 < c)
2383                     i1++;
2384                 mapping = array_get(&(s->mapping), i1);
2385             }
2386 
2387             next_mapping->dir_index = mapping->dir_index;
2388             next_mapping->first_mapping_index =
2389                 mapping->first_mapping_index < 0 ?
2390                 array_index(&(s->mapping), mapping) :
2391                 mapping->first_mapping_index;
2392             next_mapping->path = mapping->path;
2393             next_mapping->mode = mapping->mode;
2394             next_mapping->read_only = mapping->read_only;
2395             if (mapping->mode & MODE_DIRECTORY) {
2396                 next_mapping->info.dir.parent_mapping_index =
2397                         mapping->info.dir.parent_mapping_index;
2398                 next_mapping->info.dir.first_dir_index =
2399                         mapping->info.dir.first_dir_index +
2400                         0x10 * s->sectors_per_cluster *
2401                         (mapping->end - mapping->begin);
2402             } else
2403                 next_mapping->info.file.offset = mapping->info.file.offset +
2404                         (mapping->end - mapping->begin);
2405 
2406             mapping = next_mapping;
2407         }
2408 
2409         cluster = c1;
2410     }
2411 
2412     return 0;
2413 }
2414 
2415 static int coroutine_fn GRAPH_RDLOCK
2416 commit_direntries(BDRVVVFATState* s, int dir_index, int parent_mapping_index)
2417 {
2418     direntry_t* direntry = array_get(&(s->directory), dir_index);
2419     uint32_t first_cluster = dir_index == 0 ? 0 : begin_of_direntry(direntry);
2420     mapping_t* mapping = find_mapping_for_cluster(s, first_cluster);
2421     int factor = 0x10 * s->sectors_per_cluster;
2422     int old_cluster_count, new_cluster_count;
2423     int current_dir_index;
2424     int first_dir_index;
2425     int ret, i;
2426     uint32_t c;
2427 
2428     assert(direntry);
2429     assert(mapping);
2430     assert(mapping->begin == first_cluster);
2431     assert(mapping->info.dir.first_dir_index < s->directory.next);
2432     assert(mapping->mode & MODE_DIRECTORY);
2433     assert(dir_index == 0 || is_directory(direntry));
2434 
2435     DLOG(fprintf(stderr, "commit_direntries for %s, parent_mapping_index %d\n",
2436                  mapping->path, parent_mapping_index));
2437 
2438     current_dir_index = mapping->info.dir.first_dir_index;
2439     first_dir_index = current_dir_index;
2440     mapping->info.dir.parent_mapping_index = parent_mapping_index;
2441 
2442     if (first_cluster == 0) {
2443         old_cluster_count = new_cluster_count =
2444             s->last_cluster_of_root_directory;
2445     } else {
2446         for (old_cluster_count = 0, c = first_cluster; !fat_eof(s, c);
2447                 c = fat_get(s, c))
2448             old_cluster_count++;
2449 
2450         for (new_cluster_count = 0, c = first_cluster; !fat_eof(s, c);
2451                 c = modified_fat_get(s, c))
2452             new_cluster_count++;
2453     }
2454 
2455     if (new_cluster_count > old_cluster_count) {
2456         if (insert_direntries(s,
2457                 current_dir_index + factor * old_cluster_count,
2458                 factor * (new_cluster_count - old_cluster_count)) == NULL)
2459             return -1;
2460     } else if (new_cluster_count < old_cluster_count)
2461         remove_direntries(s,
2462                 current_dir_index + factor * new_cluster_count,
2463                 factor * (old_cluster_count - new_cluster_count));
2464 
2465     for (c = first_cluster; !fat_eof(s, c); c = modified_fat_get(s, c)) {
2466         direntry_t *first_direntry;
2467 
2468         direntry = array_get(&(s->directory), current_dir_index);
2469         ret = vvfat_read(s->bs, cluster2sector(s, c), (uint8_t *)direntry,
2470                 s->sectors_per_cluster);
2471         if (ret)
2472             return ret;
2473 
2474         /* The first directory entry on the filesystem is the volume name */
2475         first_direntry = (direntry_t*) s->directory.pointer;
2476         assert(!memcmp(first_direntry->name, s->volume_label, 11));
2477 
2478         current_dir_index += factor;
2479     }
2480 
2481     ret = commit_mappings(s, first_cluster, dir_index);
2482     if (ret)
2483         return ret;
2484 
2485     /* recurse */
2486     for (i = 0; i < factor * new_cluster_count; i++) {
2487         direntry = array_get(&(s->directory), first_dir_index + i);
2488         if (is_directory(direntry) && !is_dot(direntry)) {
2489             mapping = find_mapping_for_cluster(s, first_cluster);
2490             if (mapping == NULL) {
2491                 return -1;
2492             }
2493             assert(mapping->mode & MODE_DIRECTORY);
2494             ret = commit_direntries(s, first_dir_index + i,
2495                 array_index(&(s->mapping), mapping));
2496             if (ret)
2497                 return ret;
2498         }
2499     }
2500 
2501     return 0;
2502 }
2503 
2504 /* commit one file (adjust contents, adjust mapping),
2505    return first_mapping_index */
2506 static int coroutine_fn GRAPH_RDLOCK
2507 commit_one_file(BDRVVVFATState* s, int dir_index, uint32_t offset)
2508 {
2509     direntry_t* direntry = array_get(&(s->directory), dir_index);
2510     uint32_t c = begin_of_direntry(direntry);
2511     uint32_t first_cluster = c;
2512     mapping_t* mapping = find_mapping_for_cluster(s, c);
2513     uint32_t size = filesize_of_direntry(direntry);
2514     char *cluster;
2515     uint32_t i;
2516     int fd = 0;
2517 
2518     assert(offset < size);
2519     assert((offset % s->cluster_size) == 0);
2520 
2521     if (mapping == NULL) {
2522         return -1;
2523     }
2524 
2525     for (i = 0; i < offset; i += s->cluster_size) {
2526         c = modified_fat_get(s, c);
2527     }
2528 
2529     fd = qemu_open_old(mapping->path, O_RDWR | O_CREAT | O_BINARY, 0666);
2530     if (fd < 0) {
2531         fprintf(stderr, "Could not open %s... (%s, %d)\n", mapping->path,
2532                 strerror(errno), errno);
2533         return fd;
2534     }
2535     if (offset > 0) {
2536         if (lseek(fd, offset, SEEK_SET) != offset) {
2537             qemu_close(fd);
2538             return -3;
2539         }
2540     }
2541 
2542     cluster = g_malloc(s->cluster_size);
2543 
2544     while (offset < size) {
2545         uint32_t c1;
2546         int rest_size = (size - offset > s->cluster_size ?
2547                 s->cluster_size : size - offset);
2548         int ret;
2549 
2550         c1 = modified_fat_get(s, c);
2551 
2552         assert((size - offset == 0 && fat_eof(s, c)) ||
2553                 (size > offset && c >=2 && !fat_eof(s, c)));
2554 
2555         ret = vvfat_read(s->bs, cluster2sector(s, c),
2556             (uint8_t*)cluster, DIV_ROUND_UP(rest_size, 0x200));
2557 
2558         if (ret < 0) {
2559             qemu_close(fd);
2560             g_free(cluster);
2561             return ret;
2562         }
2563 
2564         if (write(fd, cluster, rest_size) < 0) {
2565             qemu_close(fd);
2566             g_free(cluster);
2567             return -2;
2568         }
2569 
2570         offset += rest_size;
2571         c = c1;
2572     }
2573 
2574     if (ftruncate(fd, size)) {
2575         perror("ftruncate()");
2576         qemu_close(fd);
2577         g_free(cluster);
2578         return -4;
2579     }
2580     qemu_close(fd);
2581     g_free(cluster);
2582 
2583     return commit_mappings(s, first_cluster, dir_index);
2584 }
2585 
2586 #ifdef DEBUG
2587 /* test, if all mappings point to valid direntries */
2588 static void check1(BDRVVVFATState* s)
2589 {
2590     int i;
2591     for (i = 0; i < s->mapping.next; i++) {
2592         mapping_t* mapping = array_get(&(s->mapping), i);
2593         if (mapping->mode & MODE_DELETED) {
2594             fprintf(stderr, "deleted\n");
2595             continue;
2596         }
2597         assert(mapping->dir_index < s->directory.next);
2598         direntry_t* direntry = array_get(&(s->directory), mapping->dir_index);
2599         assert(mapping->begin == begin_of_direntry(direntry) || mapping->first_mapping_index >= 0);
2600         if (mapping->mode & MODE_DIRECTORY) {
2601             assert(mapping->info.dir.first_dir_index + 0x10 * s->sectors_per_cluster * (mapping->end - mapping->begin) <= s->directory.next);
2602             assert((mapping->info.dir.first_dir_index % (0x10 * s->sectors_per_cluster)) == 0);
2603         }
2604     }
2605 }
2606 
2607 /* test, if all direntries have mappings */
2608 static void check2(BDRVVVFATState* s)
2609 {
2610     int i;
2611     int first_mapping = -1;
2612 
2613     for (i = 0; i < s->directory.next; i++) {
2614         direntry_t* direntry = array_get(&(s->directory), i);
2615 
2616         if (is_short_name(direntry) && begin_of_direntry(direntry)) {
2617             mapping_t* mapping = find_mapping_for_cluster(s, begin_of_direntry(direntry));
2618             assert(mapping);
2619             assert(mapping->dir_index == i || is_dot(direntry));
2620             assert(mapping->begin == begin_of_direntry(direntry) || is_dot(direntry));
2621         }
2622 
2623         if ((i % (0x10 * s->sectors_per_cluster)) == 0) {
2624             /* cluster start */
2625             int j, count = 0;
2626 
2627             for (j = 0; j < s->mapping.next; j++) {
2628                 mapping_t* mapping = array_get(&(s->mapping), j);
2629                 if (mapping->mode & MODE_DELETED)
2630                     continue;
2631                 if (mapping->mode & MODE_DIRECTORY) {
2632                     if (mapping->info.dir.first_dir_index <= i && mapping->info.dir.first_dir_index + 0x10 * s->sectors_per_cluster > i) {
2633                         assert(++count == 1);
2634                         if (mapping->first_mapping_index == -1)
2635                             first_mapping = array_index(&(s->mapping), mapping);
2636                         else
2637                             assert(first_mapping == mapping->first_mapping_index);
2638                         if (mapping->info.dir.parent_mapping_index < 0)
2639                             assert(j == 0);
2640                         else {
2641                             mapping_t* parent = array_get(&(s->mapping), mapping->info.dir.parent_mapping_index);
2642                             assert(parent->mode & MODE_DIRECTORY);
2643                             assert(parent->info.dir.first_dir_index < mapping->info.dir.first_dir_index);
2644                         }
2645                     }
2646                 }
2647             }
2648             if (count == 0)
2649                 first_mapping = -1;
2650         }
2651     }
2652 }
2653 #endif
2654 
2655 static int handle_renames_and_mkdirs(BDRVVVFATState* s)
2656 {
2657     int i;
2658 
2659 #ifdef DEBUG
2660     fprintf(stderr, "handle_renames\n");
2661     for (i = 0; i < s->commits.next; i++) {
2662         commit_t* commit = array_get(&(s->commits), i);
2663         fprintf(stderr, "%d, %s (%u, %d)\n", i,
2664                 commit->path ? commit->path : "(null)",
2665                 commit->param.rename.cluster, commit->action);
2666     }
2667 #endif
2668 
2669     for (i = 0; i < s->commits.next;) {
2670         commit_t* commit = array_get(&(s->commits), i);
2671         if (commit->action == ACTION_RENAME) {
2672             mapping_t* mapping = find_mapping_for_cluster(s,
2673                     commit->param.rename.cluster);
2674             char *old_path;
2675 
2676             if (mapping == NULL) {
2677                 return -1;
2678             }
2679             old_path = mapping->path;
2680             assert(commit->path);
2681             mapping->path = commit->path;
2682             if (rename(old_path, mapping->path))
2683                 return -2;
2684 
2685             if (mapping->mode & MODE_DIRECTORY) {
2686                 int l1 = strlen(mapping->path);
2687                 int l2 = strlen(old_path);
2688                 int diff = l1 - l2;
2689                 direntry_t* direntry = array_get(&(s->directory),
2690                         mapping->info.dir.first_dir_index);
2691                 uint32_t c = mapping->begin;
2692                 int j = 0;
2693 
2694                 /* recurse */
2695                 while (!fat_eof(s, c)) {
2696                     do {
2697                         direntry_t *d = direntry + j;
2698 
2699                         if (is_file(d) || (is_directory(d) && !is_dot(d))) {
2700                             int l;
2701                             char *new_path;
2702                             mapping_t* m = find_mapping_for_cluster(s,
2703                                     begin_of_direntry(d));
2704                             if (m == NULL) {
2705                                 return -1;
2706                             }
2707                             l = strlen(m->path);
2708                             new_path = g_malloc(l + diff + 1);
2709 
2710                             assert(!strncmp(m->path, mapping->path, l2));
2711 
2712                             pstrcpy(new_path, l + diff + 1, mapping->path);
2713                             pstrcpy(new_path + l1, l + diff + 1 - l1,
2714                                     m->path + l2);
2715 
2716                             schedule_rename(s, m->begin, new_path);
2717                         }
2718                         j++;
2719                     } while (j % (0x10 * s->sectors_per_cluster) != 0);
2720                     c = fat_get(s, c);
2721                 }
2722             }
2723 
2724             g_free(old_path);
2725             array_remove(&(s->commits), i);
2726             continue;
2727         } else if (commit->action == ACTION_MKDIR) {
2728             mapping_t* mapping;
2729             int j, parent_path_len;
2730 
2731             if (g_mkdir(commit->path, 0755)) {
2732                 return -5;
2733             }
2734 
2735             mapping = insert_mapping(s, commit->param.mkdir.cluster,
2736                     commit->param.mkdir.cluster + 1);
2737             if (mapping == NULL)
2738                 return -6;
2739 
2740             mapping->mode = MODE_DIRECTORY;
2741             mapping->read_only = 0;
2742             mapping->path = commit->path;
2743             j = s->directory.next;
2744             assert(j);
2745             insert_direntries(s, s->directory.next,
2746                     0x10 * s->sectors_per_cluster);
2747             mapping->info.dir.first_dir_index = j;
2748 
2749             parent_path_len = strlen(commit->path)
2750                 - strlen(get_basename(commit->path)) - 1;
2751             for (j = 0; j < s->mapping.next; j++) {
2752                 mapping_t* m = array_get(&(s->mapping), j);
2753                 if (m->first_mapping_index < 0 && m != mapping &&
2754                         !strncmp(m->path, mapping->path, parent_path_len) &&
2755                         strlen(m->path) == parent_path_len)
2756                     break;
2757             }
2758             assert(j < s->mapping.next);
2759             mapping->info.dir.parent_mapping_index = j;
2760 
2761             array_remove(&(s->commits), i);
2762             continue;
2763         }
2764 
2765         i++;
2766     }
2767     return 0;
2768 }
2769 
2770 /*
2771  * TODO: make sure that the short name is not matching *another* file
2772  */
2773 static int coroutine_fn GRAPH_RDLOCK handle_commits(BDRVVVFATState* s)
2774 {
2775     int i, fail = 0;
2776 
2777     vvfat_close_current_file(s);
2778 
2779     for (i = 0; !fail && i < s->commits.next; i++) {
2780         commit_t* commit = array_get(&(s->commits), i);
2781         switch(commit->action) {
2782         case ACTION_RENAME: case ACTION_MKDIR:
2783             abort();
2784             fail = -2;
2785             break;
2786         case ACTION_WRITEOUT: {
2787             direntry_t* entry = array_get(&(s->directory),
2788                     commit->param.writeout.dir_index);
2789             uint32_t begin = begin_of_direntry(entry);
2790             mapping_t* mapping = find_mapping_for_cluster(s, begin);
2791 
2792             assert(mapping);
2793             assert(mapping->begin == begin);
2794             assert(commit->path == NULL);
2795 
2796             if (commit_one_file(s, commit->param.writeout.dir_index,
2797                         commit->param.writeout.modified_offset))
2798                 fail = -3;
2799 
2800             break;
2801         }
2802         case ACTION_NEW_FILE: {
2803             int begin = commit->param.new_file.first_cluster;
2804             mapping_t* mapping = find_mapping_for_cluster(s, begin);
2805             direntry_t* entry;
2806             int j;
2807 
2808             /* find direntry */
2809             for (j = 0; j < s->directory.next; j++) {
2810                 entry = array_get(&(s->directory), j);
2811                 if (is_file(entry) && begin_of_direntry(entry) == begin)
2812                     break;
2813             }
2814 
2815             if (j >= s->directory.next) {
2816                 fail = -6;
2817                 continue;
2818             }
2819 
2820             /* make sure there exists an initial mapping */
2821             if (mapping && mapping->begin != begin) {
2822                 mapping->end = begin;
2823                 mapping = NULL;
2824             }
2825             if (mapping == NULL) {
2826                 mapping = insert_mapping(s, begin, begin+1);
2827             }
2828             /* most members will be fixed in commit_mappings() */
2829             assert(commit->path);
2830             mapping->path = commit->path;
2831             mapping->read_only = 0;
2832             mapping->mode = MODE_NORMAL;
2833             mapping->info.file.offset = 0;
2834 
2835             if (commit_one_file(s, j, 0)) {
2836                 fail = -7;
2837             }
2838 
2839             break;
2840         }
2841         default:
2842             abort();
2843         }
2844     }
2845     if (i > 0 && array_remove_slice(&(s->commits), 0, i))
2846         return -1;
2847     return fail;
2848 }
2849 
2850 static int handle_deletes(BDRVVVFATState* s)
2851 {
2852     int i, deferred = 1, deleted = 1;
2853 
2854     /* delete files corresponding to mappings marked as deleted */
2855     /* handle DELETEs and unused mappings (modified_fat_get(s, mapping->begin) == 0) */
2856     while (deferred && deleted) {
2857         deferred = 0;
2858         deleted = 0;
2859 
2860         for (i = 1; i < s->mapping.next; i++) {
2861             mapping_t* mapping = array_get(&(s->mapping), i);
2862             if (mapping->mode & MODE_DELETED) {
2863                 direntry_t* entry = array_get(&(s->directory),
2864                         mapping->dir_index);
2865 
2866                 if (is_free(entry)) {
2867                     /* remove file/directory */
2868                     if (mapping->mode & MODE_DIRECTORY) {
2869                         int j, next_dir_index = s->directory.next,
2870                         first_dir_index = mapping->info.dir.first_dir_index;
2871 
2872                         if (rmdir(mapping->path) < 0) {
2873                             if (errno == ENOTEMPTY) {
2874                                 deferred++;
2875                                 continue;
2876                             } else
2877                                 return -5;
2878                         }
2879 
2880                         for (j = 1; j < s->mapping.next; j++) {
2881                             mapping_t* m = array_get(&(s->mapping), j);
2882                             if (m->mode & MODE_DIRECTORY &&
2883                                     m->info.dir.first_dir_index >
2884                                     first_dir_index &&
2885                                     m->info.dir.first_dir_index <
2886                                     next_dir_index)
2887                                 next_dir_index =
2888                                     m->info.dir.first_dir_index;
2889                         }
2890                         remove_direntries(s, first_dir_index,
2891                                 next_dir_index - first_dir_index);
2892 
2893                         deleted++;
2894                     }
2895                 } else {
2896                     if (unlink(mapping->path))
2897                         return -4;
2898                     deleted++;
2899                 }
2900                 DLOG(fprintf(stderr, "DELETE (%d)\n", i); print_mapping(mapping); print_direntry(entry));
2901                 remove_mapping(s, i);
2902             }
2903         }
2904     }
2905 
2906     return 0;
2907 }
2908 
2909 /*
2910  * synchronize mapping with new state:
2911  *
2912  * - copy FAT (with bdrv_pread)
2913  * - mark all filenames corresponding to mappings as deleted
2914  * - recurse direntries from root (using bs->bdrv_pread)
2915  * - delete files corresponding to mappings marked as deleted
2916  */
2917 static int coroutine_fn GRAPH_RDLOCK do_commit(BDRVVVFATState* s)
2918 {
2919     int ret = 0;
2920 
2921     /* the real meat are the commits. Nothing to do? Move along! */
2922     if (s->commits.next == 0)
2923         return 0;
2924 
2925     vvfat_close_current_file(s);
2926 
2927     ret = handle_renames_and_mkdirs(s);
2928     if (ret) {
2929         fprintf(stderr, "Error handling renames (%d)\n", ret);
2930         abort();
2931         return ret;
2932     }
2933 
2934     /* copy FAT (with bdrv_pread) */
2935     memcpy(s->fat.pointer, s->fat2, 0x200 * s->sectors_per_fat);
2936 
2937     /* recurse direntries from root (using bs->bdrv_pread) */
2938     ret = commit_direntries(s, 0, -1);
2939     if (ret) {
2940         fprintf(stderr, "Fatal: error while committing (%d)\n", ret);
2941         abort();
2942         return ret;
2943     }
2944 
2945     ret = handle_commits(s);
2946     if (ret) {
2947         fprintf(stderr, "Error handling commits (%d)\n", ret);
2948         abort();
2949         return ret;
2950     }
2951 
2952     ret = handle_deletes(s);
2953     if (ret) {
2954         fprintf(stderr, "Error deleting\n");
2955         abort();
2956         return ret;
2957     }
2958 
2959     bdrv_make_empty(s->qcow, NULL);
2960 
2961     memset(s->used_clusters, 0, sector2cluster(s, s->sector_count));
2962 
2963 DLOG(checkpoint());
2964     return 0;
2965 }
2966 
2967 static int coroutine_fn GRAPH_RDLOCK try_commit(BDRVVVFATState* s)
2968 {
2969     vvfat_close_current_file(s);
2970 DLOG(checkpoint());
2971     if(!is_consistent(s))
2972         return -1;
2973     return do_commit(s);
2974 }
2975 
2976 static int coroutine_fn GRAPH_RDLOCK
2977 vvfat_write(BlockDriverState *bs, int64_t sector_num,
2978             const uint8_t *buf, int nb_sectors)
2979 {
2980     BDRVVVFATState *s = bs->opaque;
2981     int i, ret;
2982     int first_cluster, last_cluster;
2983 
2984 DLOG(checkpoint());
2985 
2986     /* Check if we're operating in read-only mode */
2987     if (s->qcow == NULL) {
2988         return -EACCES;
2989     }
2990 
2991     vvfat_close_current_file(s);
2992 
2993     if (sector_num == s->offset_to_bootsector && nb_sectors == 1) {
2994         /*
2995          * Write on bootsector. Allow only changing the reserved1 field,
2996          * used to mark volume dirtiness
2997          */
2998         unsigned char *bootsector = s->first_sectors
2999                                     + s->offset_to_bootsector * 0x200;
3000         /*
3001          * LATER TODO: if FAT32, this is wrong (see init_directories(),
3002          * which always creates a FAT16 bootsector)
3003          */
3004         const int reserved1_offset = offsetof(bootsector_t, u.fat16.reserved1);
3005 
3006         for (i = 0; i < 0x200; i++) {
3007             if (i != reserved1_offset && bootsector[i] != buf[i]) {
3008                 fprintf(stderr, "Tried to write to protected bootsector\n");
3009                 return -1;
3010             }
3011         }
3012 
3013         /* Update bootsector with the only updatable byte, and return success */
3014         bootsector[reserved1_offset] = buf[reserved1_offset];
3015         return 0;
3016     }
3017 
3018     /*
3019      * Some sanity checks:
3020      * - do not allow writing to the boot sector
3021      */
3022     if (sector_num < s->offset_to_fat)
3023         return -1;
3024 
3025     /*
3026      * Values will be negative for writes to the FAT, which is located before
3027      * the root directory.
3028      */
3029     first_cluster = sector2cluster(s, sector_num);
3030     last_cluster = sector2cluster(s, sector_num + nb_sectors - 1);
3031 
3032     for (i = first_cluster; i <= last_cluster;) {
3033         mapping_t *mapping = NULL;
3034 
3035         if (i >= 0) {
3036             mapping = find_mapping_for_cluster(s, i);
3037         }
3038 
3039         if (mapping) {
3040             if (mapping->read_only) {
3041                 fprintf(stderr, "Tried to write to write-protected file %s\n",
3042                         mapping->path);
3043                 return -1;
3044             }
3045 
3046             if (mapping->mode & MODE_DIRECTORY) {
3047                 int begin = cluster2sector(s, i);
3048                 int end = begin + s->sectors_per_cluster, k;
3049                 int dir_index;
3050                 const direntry_t* direntries;
3051                 long_file_name lfn;
3052 
3053                 lfn_init(&lfn);
3054 
3055                 if (begin < sector_num)
3056                     begin = sector_num;
3057                 if (end > sector_num + nb_sectors)
3058                     end = sector_num + nb_sectors;
3059                 dir_index  = mapping->dir_index +
3060                     0x10 * (begin - mapping->begin * s->sectors_per_cluster);
3061                 direntries = (direntry_t*)(buf + 0x200 * (begin - sector_num));
3062 
3063                 for (k = 0; k < (end - begin) * 0x10; k++) {
3064                     /* no access to the direntry of a read-only file */
3065                     if (is_short_name(direntries + k) &&
3066                             (direntries[k].attributes & 1)) {
3067                         if (memcmp(direntries + k,
3068                                     array_get(&(s->directory), dir_index + k),
3069                                     sizeof(direntry_t))) {
3070                             warn_report("tried to write to write-protected "
3071                                         "file");
3072                             return -1;
3073                         }
3074                     }
3075                 }
3076             }
3077             i = mapping->end;
3078         } else {
3079             i++;
3080         }
3081     }
3082 
3083     /*
3084      * Use qcow backend. Commit later.
3085      */
3086 DLOG(fprintf(stderr, "Write to qcow backend: %d + %d\n", (int)sector_num, nb_sectors));
3087     ret = bdrv_co_pwrite(s->qcow, sector_num * BDRV_SECTOR_SIZE,
3088                          nb_sectors * BDRV_SECTOR_SIZE, buf, 0);
3089     if (ret < 0) {
3090         fprintf(stderr, "Error writing to qcow backend\n");
3091         return ret;
3092     }
3093 
3094     for (i = first_cluster; i <= last_cluster; i++) {
3095         if (i >= 0) {
3096             s->used_clusters[i] |= USED_ALLOCATED;
3097         }
3098     }
3099 
3100 DLOG(checkpoint());
3101     /* TODO: add timeout */
3102     try_commit(s);
3103 
3104 DLOG(checkpoint());
3105     return 0;
3106 }
3107 
3108 static int coroutine_fn GRAPH_RDLOCK
3109 vvfat_co_pwritev(BlockDriverState *bs, int64_t offset, int64_t bytes,
3110                  QEMUIOVector *qiov, BdrvRequestFlags flags)
3111 {
3112     int ret;
3113     BDRVVVFATState *s = bs->opaque;
3114     uint64_t sector_num = offset >> BDRV_SECTOR_BITS;
3115     int nb_sectors = bytes >> BDRV_SECTOR_BITS;
3116     void *buf;
3117 
3118     assert(QEMU_IS_ALIGNED(offset, BDRV_SECTOR_SIZE));
3119     assert(QEMU_IS_ALIGNED(bytes, BDRV_SECTOR_SIZE));
3120 
3121     buf = g_try_malloc(bytes);
3122     if (bytes && buf == NULL) {
3123         return -ENOMEM;
3124     }
3125     qemu_iovec_to_buf(qiov, 0, buf, bytes);
3126 
3127     qemu_co_mutex_lock(&s->lock);
3128     ret = vvfat_write(bs, sector_num, buf, nb_sectors);
3129     qemu_co_mutex_unlock(&s->lock);
3130 
3131     g_free(buf);
3132 
3133     return ret;
3134 }
3135 
3136 static int coroutine_fn vvfat_co_block_status(BlockDriverState *bs,
3137                                               bool want_zero, int64_t offset,
3138                                               int64_t bytes, int64_t *n,
3139                                               int64_t *map,
3140                                               BlockDriverState **file)
3141 {
3142     *n = bytes;
3143     return BDRV_BLOCK_DATA;
3144 }
3145 
3146 static void vvfat_qcow_options(BdrvChildRole role, bool parent_is_format,
3147                                int *child_flags, QDict *child_options,
3148                                int parent_flags, QDict *parent_options)
3149 {
3150     qdict_set_default_str(child_options, BDRV_OPT_READ_ONLY, "off");
3151     qdict_set_default_str(child_options, BDRV_OPT_AUTO_READ_ONLY, "off");
3152     qdict_set_default_str(child_options, BDRV_OPT_CACHE_NO_FLUSH, "on");
3153 }
3154 
3155 static BdrvChildClass child_vvfat_qcow;
3156 
3157 static int enable_write_target(BlockDriverState *bs, Error **errp)
3158 {
3159     BDRVVVFATState *s = bs->opaque;
3160     BlockDriver *bdrv_qcow = NULL;
3161     QemuOpts *opts = NULL;
3162     int ret;
3163     int size = sector2cluster(s, s->sector_count);
3164     QDict *options;
3165 
3166     s->used_clusters = g_malloc0(size);
3167 
3168     array_init(&(s->commits), sizeof(commit_t));
3169 
3170     s->qcow_filename = create_tmp_file(errp);
3171     if (!s->qcow_filename) {
3172         ret = -ENOENT;
3173         goto err;
3174     }
3175 
3176     bdrv_qcow = bdrv_find_format("qcow");
3177     if (!bdrv_qcow) {
3178         error_setg(errp, "Failed to locate qcow driver");
3179         ret = -ENOENT;
3180         goto err;
3181     }
3182 
3183     opts = qemu_opts_create(bdrv_qcow->create_opts, NULL, 0, &error_abort);
3184     qemu_opt_set_number(opts, BLOCK_OPT_SIZE,
3185                         bs->total_sectors * BDRV_SECTOR_SIZE, &error_abort);
3186     qemu_opt_set(opts, BLOCK_OPT_BACKING_FILE, "fat:", &error_abort);
3187 
3188     ret = bdrv_create(bdrv_qcow, s->qcow_filename, opts, errp);
3189     qemu_opts_del(opts);
3190     if (ret < 0) {
3191         goto err;
3192     }
3193 
3194     options = qdict_new();
3195     qdict_put_str(options, "write-target.driver", "qcow");
3196     s->qcow = bdrv_open_child(s->qcow_filename, options, "write-target", bs,
3197                               &child_vvfat_qcow,
3198                               BDRV_CHILD_DATA | BDRV_CHILD_METADATA,
3199                               false, errp);
3200     qobject_unref(options);
3201     if (!s->qcow) {
3202         ret = -EINVAL;
3203         goto err;
3204     }
3205 
3206 #ifndef _WIN32
3207     unlink(s->qcow_filename);
3208 #endif
3209 
3210     return 0;
3211 
3212 err:
3213     return ret;
3214 }
3215 
3216 static void vvfat_child_perm(BlockDriverState *bs, BdrvChild *c,
3217                              BdrvChildRole role,
3218                              BlockReopenQueue *reopen_queue,
3219                              uint64_t perm, uint64_t shared,
3220                              uint64_t *nperm, uint64_t *nshared)
3221 {
3222     assert(role & BDRV_CHILD_DATA);
3223     /* This is a private node, nobody should try to attach to it */
3224     *nperm = BLK_PERM_CONSISTENT_READ | BLK_PERM_WRITE;
3225     *nshared = BLK_PERM_WRITE_UNCHANGED;
3226 }
3227 
3228 static void vvfat_close(BlockDriverState *bs)
3229 {
3230     BDRVVVFATState *s = bs->opaque;
3231 
3232     vvfat_close_current_file(s);
3233     array_free(&(s->fat));
3234     array_free(&(s->directory));
3235     array_free(&(s->mapping));
3236     g_free(s->cluster_buffer);
3237 
3238     if (s->qcow) {
3239         migrate_del_blocker(&s->migration_blocker);
3240     }
3241 }
3242 
3243 static const char *const vvfat_strong_runtime_opts[] = {
3244     "dir",
3245     "fat-type",
3246     "floppy",
3247     "label",
3248     "rw",
3249 
3250     NULL
3251 };
3252 
3253 static BlockDriver bdrv_vvfat = {
3254     .format_name            = "vvfat",
3255     .protocol_name          = "fat",
3256     .instance_size          = sizeof(BDRVVVFATState),
3257 
3258     .bdrv_parse_filename    = vvfat_parse_filename,
3259     .bdrv_open              = vvfat_open,
3260     .bdrv_refresh_limits    = vvfat_refresh_limits,
3261     .bdrv_close             = vvfat_close,
3262     .bdrv_child_perm        = vvfat_child_perm,
3263 
3264     .bdrv_co_preadv         = vvfat_co_preadv,
3265     .bdrv_co_pwritev        = vvfat_co_pwritev,
3266     .bdrv_co_block_status   = vvfat_co_block_status,
3267 
3268     .strong_runtime_opts    = vvfat_strong_runtime_opts,
3269 };
3270 
3271 static void bdrv_vvfat_init(void)
3272 {
3273     child_vvfat_qcow = child_of_bds;
3274     child_vvfat_qcow.inherit_options = vvfat_qcow_options;
3275     bdrv_register(&bdrv_vvfat);
3276 }
3277 
3278 block_init(bdrv_vvfat_init);
3279 
3280 #ifdef DEBUG
3281 static void checkpoint(void)
3282 {
3283     assert(((mapping_t*)array_get(&(vvv->mapping), 0))->end == 2);
3284     check1(vvv);
3285     check2(vvv);
3286     assert(!vvv->current_mapping || vvv->current_fd || (vvv->current_mapping->mode & MODE_DIRECTORY));
3287 }
3288 #endif
3289