qcow2.c 103.4 KB
Newer Older
B
bellard 已提交
1 2
/*
 * Block driver for the QCOW version 2 format
3
 *
B
bellard 已提交
4
 * Copyright (c) 2004-2006 Fabrice Bellard
5
 *
B
bellard 已提交
6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
 * in the Software without restriction, including without limitation the rights
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 * copies of the Software, and to permit persons to whom the Software is
 * furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in
 * all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */
P
pbrook 已提交
24
#include "qemu-common.h"
25
#include "block/block_int.h"
26
#include "qemu/module.h"
B
bellard 已提交
27
#include <zlib.h>
K
Kevin Wolf 已提交
28
#include "block/qcow2.h"
29
#include "qemu/error-report.h"
30
#include "qapi/qmp/qerror.h"
31
#include "qapi/qmp/qbool.h"
32
#include "qapi/util.h"
M
Max Reitz 已提交
33 34
#include "qapi/qmp/types.h"
#include "qapi-event.h"
K
Kevin Wolf 已提交
35
#include "trace.h"
36
#include "qemu/option_int.h"
B
bellard 已提交
37 38 39 40 41 42 43 44

/*
  Differences with QCOW:

  - Support for multiple incremental snapshots.
  - Memory management by reference counts.
  - Clusters which have a reference count of one have the bit
    QCOW_OFLAG_COPIED to optimize write performance.
45
  - Size of compressed clusters is stored in sectors to reduce bit usage
B
bellard 已提交
46 47
    in the cluster offsets.
  - Support for storing additional data (such as the VM state) in the
48
    snapshots.
B
bellard 已提交
49 50 51 52 53
  - If a backing store is used, the cluster size is not constrained
    (could be backported to QCOW).
  - L2 tables have always a size of one cluster.
*/

54 55 56 57

typedef struct {
    uint32_t magic;
    uint32_t len;
58
} QEMU_PACKED QCowExtension;
J
Jeff Cody 已提交
59

60 61
#define  QCOW2_EXT_MAGIC_END 0
#define  QCOW2_EXT_MAGIC_BACKING_FORMAT 0xE2792ACA
62
#define  QCOW2_EXT_MAGIC_FEATURE_TABLE 0x6803f857
63

64
static int qcow2_probe(const uint8_t *buf, int buf_size, const char *filename)
B
bellard 已提交
65 66
{
    const QCowHeader *cow_header = (const void *)buf;
67

B
bellard 已提交
68 69
    if (buf_size >= sizeof(QCowHeader) &&
        be32_to_cpu(cow_header->magic) == QCOW_MAGIC &&
K
Kevin Wolf 已提交
70
        be32_to_cpu(cow_header->version) >= 2)
B
bellard 已提交
71 72 73 74 75
        return 100;
    else
        return 0;
}

76 77 78 79 80 81 82 83

/* 
 * read qcow2 extension and fill bs
 * start reading from start_offset
 * finish reading upon magic of value 0 or when end_offset reached
 * unknown magic is skipped (future extension this version knows nothing about)
 * return 0 upon success, non-0 otherwise
 */
84
static int qcow2_read_extensions(BlockDriverState *bs, uint64_t start_offset,
M
Max Reitz 已提交
85 86
                                 uint64_t end_offset, void **p_feature_table,
                                 Error **errp)
87
{
88
    BDRVQcow2State *s = bs->opaque;
89 90
    QCowExtension ext;
    uint64_t offset;
91
    int ret;
92 93

#ifdef DEBUG_EXT
94
    printf("qcow2_read_extensions: start=%ld end=%ld\n", start_offset, end_offset);
95 96 97 98 99 100 101
#endif
    offset = start_offset;
    while (offset < end_offset) {

#ifdef DEBUG_EXT
        /* Sanity check */
        if (offset > s->cluster_size)
102
            printf("qcow2_read_extension: suspicious offset %lu\n", offset);
103

D
Dong Xu Wang 已提交
104
        printf("attempting to read extended header in offset %lu\n", offset);
105 106
#endif

K
Kevin Wolf 已提交
107
        ret = bdrv_pread(bs->file->bs, offset, &ext, sizeof(ext));
M
Max Reitz 已提交
108 109 110
        if (ret < 0) {
            error_setg_errno(errp, -ret, "qcow2_read_extension: ERROR: "
                             "pread fail from offset %" PRIu64, offset);
111 112 113 114 115 116 117 118
            return 1;
        }
        be32_to_cpus(&ext.magic);
        be32_to_cpus(&ext.len);
        offset += sizeof(ext);
#ifdef DEBUG_EXT
        printf("ext.magic = 0x%x\n", ext.magic);
#endif
119
        if (offset > end_offset || ext.len > end_offset - offset) {
M
Max Reitz 已提交
120
            error_setg(errp, "Header extension too large");
121 122 123
            return -EINVAL;
        }

124
        switch (ext.magic) {
125
        case QCOW2_EXT_MAGIC_END:
126
            return 0;
127

128
        case QCOW2_EXT_MAGIC_BACKING_FORMAT:
129
            if (ext.len >= sizeof(bs->backing_format)) {
130 131 132
                error_setg(errp, "ERROR: ext_backing_format: len=%" PRIu32
                           " too large (>=%zu)", ext.len,
                           sizeof(bs->backing_format));
133 134
                return 2;
            }
K
Kevin Wolf 已提交
135
            ret = bdrv_pread(bs->file->bs, offset, bs->backing_format, ext.len);
M
Max Reitz 已提交
136 137 138
            if (ret < 0) {
                error_setg_errno(errp, -ret, "ERROR: ext_backing_format: "
                                 "Could not read format name");
139
                return 3;
M
Max Reitz 已提交
140
            }
141
            bs->backing_format[ext.len] = '\0';
142
            s->image_backing_format = g_strdup(bs->backing_format);
143 144 145 146 147
#ifdef DEBUG_EXT
            printf("Qcow2: Got format extension %s\n", bs->backing_format);
#endif
            break;

148 149 150
        case QCOW2_EXT_MAGIC_FEATURE_TABLE:
            if (p_feature_table != NULL) {
                void* feature_table = g_malloc0(ext.len + 2 * sizeof(Qcow2Feature));
K
Kevin Wolf 已提交
151
                ret = bdrv_pread(bs->file->bs, offset , feature_table, ext.len);
152
                if (ret < 0) {
M
Max Reitz 已提交
153 154
                    error_setg_errno(errp, -ret, "ERROR: ext_feature_table: "
                                     "Could not read table");
155 156 157 158 159 160 161
                    return ret;
                }

                *p_feature_table = feature_table;
            }
            break;

162
        default:
163 164 165 166 167 168 169 170 171
            /* unknown magic - save it in case we need to rewrite the header */
            {
                Qcow2UnknownHeaderExtension *uext;

                uext = g_malloc0(sizeof(*uext)  + ext.len);
                uext->magic = ext.magic;
                uext->len = ext.len;
                QLIST_INSERT_HEAD(&s->unknown_header_ext, uext, next);

K
Kevin Wolf 已提交
172
                ret = bdrv_pread(bs->file->bs, offset , uext->data, uext->len);
173
                if (ret < 0) {
M
Max Reitz 已提交
174 175
                    error_setg_errno(errp, -ret, "ERROR: unknown extension: "
                                     "Could not read data");
176 177 178
                    return ret;
                }
            }
179 180
            break;
        }
181 182

        offset += ((ext.len + 7) & ~7);
183 184 185 186 187
    }

    return 0;
}

188 189
static void cleanup_unknown_header_ext(BlockDriverState *bs)
{
190
    BDRVQcow2State *s = bs->opaque;
191 192 193 194 195 196 197
    Qcow2UnknownHeaderExtension *uext, *next;

    QLIST_FOREACH_SAFE(uext, &s->unknown_header_ext, next, next) {
        QLIST_REMOVE(uext, next);
        g_free(uext);
    }
}
198

M
Max Reitz 已提交
199 200
static void GCC_FMT_ATTR(3, 4) report_unsupported(BlockDriverState *bs,
    Error **errp, const char *fmt, ...)
K
Kevin Wolf 已提交
201 202 203 204 205 206 207 208
{
    char msg[64];
    va_list ap;

    va_start(ap, fmt);
    vsnprintf(msg, sizeof(msg), fmt, ap);
    va_end(ap);

209 210
    error_setg(errp, QERR_UNKNOWN_BLOCK_FORMAT_FEATURE,
               bdrv_get_device_or_node_name(bs), "qcow2", msg);
K
Kevin Wolf 已提交
211 212
}

213
static void report_unsupported_feature(BlockDriverState *bs,
M
Max Reitz 已提交
214
    Error **errp, Qcow2Feature *table, uint64_t mask)
215
{
216 217 218
    char *features = g_strdup("");
    char *old;

219 220
    while (table && table->name[0] != '\0') {
        if (table->type == QCOW2_FEAT_TYPE_INCOMPATIBLE) {
221 222 223 224 225 226
            if (mask & (1ULL << table->bit)) {
                old = features;
                features = g_strdup_printf("%s%s%.46s", old, *old ? ", " : "",
                                           table->name);
                g_free(old);
                mask &= ~(1ULL << table->bit);
227 228 229 230 231 232
            }
        }
        table++;
    }

    if (mask) {
233 234 235 236
        old = features;
        features = g_strdup_printf("%s%sUnknown incompatible feature: %" PRIx64,
                                   old, *old ? ", " : "", mask);
        g_free(old);
237
    }
238 239 240

    report_unsupported(bs, errp, "%s", features);
    g_free(features);
241 242
}

243 244 245 246 247 248 249
/*
 * Sets the dirty bit and flushes afterwards if necessary.
 *
 * The incompatible_features bit is only set if the image file header was
 * updated successfully.  Therefore it is not required to check the return
 * value of this function.
 */
250
int qcow2_mark_dirty(BlockDriverState *bs)
251
{
252
    BDRVQcow2State *s = bs->opaque;
253 254 255 256 257 258 259 260 261 262
    uint64_t val;
    int ret;

    assert(s->qcow_version >= 3);

    if (s->incompatible_features & QCOW2_INCOMPAT_DIRTY) {
        return 0; /* already dirty */
    }

    val = cpu_to_be64(s->incompatible_features | QCOW2_INCOMPAT_DIRTY);
K
Kevin Wolf 已提交
263
    ret = bdrv_pwrite(bs->file->bs, offsetof(QCowHeader, incompatible_features),
264 265 266 267
                      &val, sizeof(val));
    if (ret < 0) {
        return ret;
    }
K
Kevin Wolf 已提交
268
    ret = bdrv_flush(bs->file->bs);
269 270 271 272 273 274 275 276 277
    if (ret < 0) {
        return ret;
    }

    /* Only treat image as dirty if the header was updated successfully */
    s->incompatible_features |= QCOW2_INCOMPAT_DIRTY;
    return 0;
}

S
Stefan Hajnoczi 已提交
278 279 280 281 282 283 284
/*
 * Clears the dirty bit and flushes before if necessary.  Only call this
 * function when there are no pending requests, it does not guard against
 * concurrent requests dirtying the image.
 */
static int qcow2_mark_clean(BlockDriverState *bs)
{
285
    BDRVQcow2State *s = bs->opaque;
S
Stefan Hajnoczi 已提交
286 287

    if (s->incompatible_features & QCOW2_INCOMPAT_DIRTY) {
288 289 290 291 292
        int ret;

        s->incompatible_features &= ~QCOW2_INCOMPAT_DIRTY;

        ret = bdrv_flush(bs);
S
Stefan Hajnoczi 已提交
293 294 295 296 297 298 299 300 301
        if (ret < 0) {
            return ret;
        }

        return qcow2_update_header(bs);
    }
    return 0;
}

M
Max Reitz 已提交
302 303 304 305 306
/*
 * Marks the image as corrupt.
 */
int qcow2_mark_corrupt(BlockDriverState *bs)
{
307
    BDRVQcow2State *s = bs->opaque;
M
Max Reitz 已提交
308 309 310 311 312 313 314 315 316 317 318

    s->incompatible_features |= QCOW2_INCOMPAT_CORRUPT;
    return qcow2_update_header(bs);
}

/*
 * Marks the image as consistent, i.e., unsets the corrupt bit, and flushes
 * before if necessary.
 */
int qcow2_mark_consistent(BlockDriverState *bs)
{
319
    BDRVQcow2State *s = bs->opaque;
M
Max Reitz 已提交
320 321 322 323 324 325 326 327 328 329 330 331 332

    if (s->incompatible_features & QCOW2_INCOMPAT_CORRUPT) {
        int ret = bdrv_flush(bs);
        if (ret < 0) {
            return ret;
        }

        s->incompatible_features &= ~QCOW2_INCOMPAT_CORRUPT;
        return qcow2_update_header(bs);
    }
    return 0;
}

333 334 335 336 337 338 339 340 341
static int qcow2_check(BlockDriverState *bs, BdrvCheckResult *result,
                       BdrvCheckMode fix)
{
    int ret = qcow2_check_refcounts(bs, result, fix);
    if (ret < 0) {
        return ret;
    }

    if (fix && result->check_errors == 0 && result->corruptions == 0) {
M
Max Reitz 已提交
342 343 344 345 346
        ret = qcow2_mark_clean(bs);
        if (ret < 0) {
            return ret;
        }
        return qcow2_mark_consistent(bs);
347 348 349 350
    }
    return ret;
}

351 352 353
static int validate_table_offset(BlockDriverState *bs, uint64_t offset,
                                 uint64_t entries, size_t entry_len)
{
354
    BDRVQcow2State *s = bs->opaque;
355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376
    uint64_t size;

    /* Use signed INT64_MAX as the maximum even for uint64_t header fields,
     * because values will be passed to qemu functions taking int64_t. */
    if (entries > INT64_MAX / entry_len) {
        return -EINVAL;
    }

    size = entries * entry_len;

    if (INT64_MAX - size < offset) {
        return -EINVAL;
    }

    /* Tables must be cluster aligned */
    if (offset & (s->cluster_size - 1)) {
        return -EINVAL;
    }

    return 0;
}

377 378 379 380 381
static QemuOptsList qcow2_runtime_opts = {
    .name = "qcow2",
    .head = QTAILQ_HEAD_INITIALIZER(qcow2_runtime_opts.head),
    .desc = {
        {
382
            .name = QCOW2_OPT_LAZY_REFCOUNTS,
383 384 385
            .type = QEMU_OPT_BOOL,
            .help = "Postpone refcount updates",
        },
386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401
        {
            .name = QCOW2_OPT_DISCARD_REQUEST,
            .type = QEMU_OPT_BOOL,
            .help = "Pass guest discard requests to the layer below",
        },
        {
            .name = QCOW2_OPT_DISCARD_SNAPSHOT,
            .type = QEMU_OPT_BOOL,
            .help = "Generate discard requests when snapshot related space "
                    "is freed",
        },
        {
            .name = QCOW2_OPT_DISCARD_OTHER,
            .type = QEMU_OPT_BOOL,
            .help = "Generate discard requests when other clusters are freed",
        },
M
Max Reitz 已提交
402 403 404 405 406 407
        {
            .name = QCOW2_OPT_OVERLAP,
            .type = QEMU_OPT_STRING,
            .help = "Selects which overlap checks to perform from a range of "
                    "templates (none, constant, cached, all)",
        },
408 409 410 411 412 413
        {
            .name = QCOW2_OPT_OVERLAP_TEMPLATE,
            .type = QEMU_OPT_STRING,
            .help = "Selects which overlap checks to perform from a range of "
                    "templates (none, constant, cached, all)",
        },
M
Max Reitz 已提交
414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453
        {
            .name = QCOW2_OPT_OVERLAP_MAIN_HEADER,
            .type = QEMU_OPT_BOOL,
            .help = "Check for unintended writes into the main qcow2 header",
        },
        {
            .name = QCOW2_OPT_OVERLAP_ACTIVE_L1,
            .type = QEMU_OPT_BOOL,
            .help = "Check for unintended writes into the active L1 table",
        },
        {
            .name = QCOW2_OPT_OVERLAP_ACTIVE_L2,
            .type = QEMU_OPT_BOOL,
            .help = "Check for unintended writes into an active L2 table",
        },
        {
            .name = QCOW2_OPT_OVERLAP_REFCOUNT_TABLE,
            .type = QEMU_OPT_BOOL,
            .help = "Check for unintended writes into the refcount table",
        },
        {
            .name = QCOW2_OPT_OVERLAP_REFCOUNT_BLOCK,
            .type = QEMU_OPT_BOOL,
            .help = "Check for unintended writes into a refcount block",
        },
        {
            .name = QCOW2_OPT_OVERLAP_SNAPSHOT_TABLE,
            .type = QEMU_OPT_BOOL,
            .help = "Check for unintended writes into the snapshot table",
        },
        {
            .name = QCOW2_OPT_OVERLAP_INACTIVE_L1,
            .type = QEMU_OPT_BOOL,
            .help = "Check for unintended writes into an inactive L1 table",
        },
        {
            .name = QCOW2_OPT_OVERLAP_INACTIVE_L2,
            .type = QEMU_OPT_BOOL,
            .help = "Check for unintended writes into an inactive L2 table",
        },
454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469
        {
            .name = QCOW2_OPT_CACHE_SIZE,
            .type = QEMU_OPT_SIZE,
            .help = "Maximum combined metadata (L2 tables and refcount blocks) "
                    "cache size",
        },
        {
            .name = QCOW2_OPT_L2_CACHE_SIZE,
            .type = QEMU_OPT_SIZE,
            .help = "Maximum L2 table cache size",
        },
        {
            .name = QCOW2_OPT_REFCOUNT_CACHE_SIZE,
            .type = QEMU_OPT_SIZE,
            .help = "Maximum refcount block cache size",
        },
470 471 472 473 474
        {
            .name = QCOW2_OPT_CACHE_CLEAN_INTERVAL,
            .type = QEMU_OPT_NUMBER,
            .help = "Clean unused cache entries after this time (in seconds)",
        },
475 476 477 478
        { /* end of list */ }
    },
};

479 480 481 482 483 484 485 486 487 488 489
static const char *overlap_bool_option_names[QCOW2_OL_MAX_BITNR] = {
    [QCOW2_OL_MAIN_HEADER_BITNR]    = QCOW2_OPT_OVERLAP_MAIN_HEADER,
    [QCOW2_OL_ACTIVE_L1_BITNR]      = QCOW2_OPT_OVERLAP_ACTIVE_L1,
    [QCOW2_OL_ACTIVE_L2_BITNR]      = QCOW2_OPT_OVERLAP_ACTIVE_L2,
    [QCOW2_OL_REFCOUNT_TABLE_BITNR] = QCOW2_OPT_OVERLAP_REFCOUNT_TABLE,
    [QCOW2_OL_REFCOUNT_BLOCK_BITNR] = QCOW2_OPT_OVERLAP_REFCOUNT_BLOCK,
    [QCOW2_OL_SNAPSHOT_TABLE_BITNR] = QCOW2_OPT_OVERLAP_SNAPSHOT_TABLE,
    [QCOW2_OL_INACTIVE_L1_BITNR]    = QCOW2_OPT_OVERLAP_INACTIVE_L1,
    [QCOW2_OL_INACTIVE_L2_BITNR]    = QCOW2_OPT_OVERLAP_INACTIVE_L2,
};

490 491 492
static void cache_clean_timer_cb(void *opaque)
{
    BlockDriverState *bs = opaque;
493
    BDRVQcow2State *s = bs->opaque;
494 495 496 497 498 499 500 501
    qcow2_cache_clean_unused(bs, s->l2_table_cache);
    qcow2_cache_clean_unused(bs, s->refcount_block_cache);
    timer_mod(s->cache_clean_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) +
              (int64_t) s->cache_clean_interval * 1000);
}

static void cache_clean_timer_init(BlockDriverState *bs, AioContext *context)
{
502
    BDRVQcow2State *s = bs->opaque;
503 504 505 506 507 508 509 510 511 512 513
    if (s->cache_clean_interval > 0) {
        s->cache_clean_timer = aio_timer_new(context, QEMU_CLOCK_VIRTUAL,
                                             SCALE_MS, cache_clean_timer_cb,
                                             bs);
        timer_mod(s->cache_clean_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) +
                  (int64_t) s->cache_clean_interval * 1000);
    }
}

static void cache_clean_timer_del(BlockDriverState *bs)
{
514
    BDRVQcow2State *s = bs->opaque;
515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532
    if (s->cache_clean_timer) {
        timer_del(s->cache_clean_timer);
        timer_free(s->cache_clean_timer);
        s->cache_clean_timer = NULL;
    }
}

static void qcow2_detach_aio_context(BlockDriverState *bs)
{
    cache_clean_timer_del(bs);
}

static void qcow2_attach_aio_context(BlockDriverState *bs,
                                     AioContext *new_context)
{
    cache_clean_timer_init(bs, new_context);
}

M
Max Reitz 已提交
533 534
static void read_cache_sizes(BlockDriverState *bs, QemuOpts *opts,
                             uint64_t *l2_cache_size,
535 536
                             uint64_t *refcount_cache_size, Error **errp)
{
537
    BDRVQcow2State *s = bs->opaque;
538 539 540 541 542 543 544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564 565 566 567 568 569 570 571 572 573 574 575 576
    uint64_t combined_cache_size;
    bool l2_cache_size_set, refcount_cache_size_set, combined_cache_size_set;

    combined_cache_size_set = qemu_opt_get(opts, QCOW2_OPT_CACHE_SIZE);
    l2_cache_size_set = qemu_opt_get(opts, QCOW2_OPT_L2_CACHE_SIZE);
    refcount_cache_size_set = qemu_opt_get(opts, QCOW2_OPT_REFCOUNT_CACHE_SIZE);

    combined_cache_size = qemu_opt_get_size(opts, QCOW2_OPT_CACHE_SIZE, 0);
    *l2_cache_size = qemu_opt_get_size(opts, QCOW2_OPT_L2_CACHE_SIZE, 0);
    *refcount_cache_size = qemu_opt_get_size(opts,
                                             QCOW2_OPT_REFCOUNT_CACHE_SIZE, 0);

    if (combined_cache_size_set) {
        if (l2_cache_size_set && refcount_cache_size_set) {
            error_setg(errp, QCOW2_OPT_CACHE_SIZE ", " QCOW2_OPT_L2_CACHE_SIZE
                       " and " QCOW2_OPT_REFCOUNT_CACHE_SIZE " may not be set "
                       "the same time");
            return;
        } else if (*l2_cache_size > combined_cache_size) {
            error_setg(errp, QCOW2_OPT_L2_CACHE_SIZE " may not exceed "
                       QCOW2_OPT_CACHE_SIZE);
            return;
        } else if (*refcount_cache_size > combined_cache_size) {
            error_setg(errp, QCOW2_OPT_REFCOUNT_CACHE_SIZE " may not exceed "
                       QCOW2_OPT_CACHE_SIZE);
            return;
        }

        if (l2_cache_size_set) {
            *refcount_cache_size = combined_cache_size - *l2_cache_size;
        } else if (refcount_cache_size_set) {
            *l2_cache_size = combined_cache_size - *refcount_cache_size;
        } else {
            *refcount_cache_size = combined_cache_size
                                 / (DEFAULT_L2_REFCOUNT_SIZE_RATIO + 1);
            *l2_cache_size = combined_cache_size - *refcount_cache_size;
        }
    } else {
        if (!l2_cache_size_set && !refcount_cache_size_set) {
M
Max Reitz 已提交
577 578 579
            *l2_cache_size = MAX(DEFAULT_L2_CACHE_BYTE_SIZE,
                                 (uint64_t)DEFAULT_L2_CACHE_CLUSTERS
                                 * s->cluster_size);
580 581 582 583 584 585 586 587 588 589 590 591
            *refcount_cache_size = *l2_cache_size
                                 / DEFAULT_L2_REFCOUNT_SIZE_RATIO;
        } else if (!l2_cache_size_set) {
            *l2_cache_size = *refcount_cache_size
                           * DEFAULT_L2_REFCOUNT_SIZE_RATIO;
        } else if (!refcount_cache_size_set) {
            *refcount_cache_size = *l2_cache_size
                                 / DEFAULT_L2_REFCOUNT_SIZE_RATIO;
        }
    }
}

592 593 594 595 596 597 598 599 600 601 602 603 604
typedef struct Qcow2ReopenState {
    Qcow2Cache *l2_table_cache;
    Qcow2Cache *refcount_block_cache;
    bool use_lazy_refcounts;
    int overlap_check;
    bool discard_passthrough[QCOW2_DISCARD_MAX];
    uint64_t cache_clean_interval;
} Qcow2ReopenState;

static int qcow2_update_options_prepare(BlockDriverState *bs,
                                        Qcow2ReopenState *r,
                                        QDict *options, int flags,
                                        Error **errp)
605 606
{
    BDRVQcow2State *s = bs->opaque;
607
    QemuOpts *opts = NULL;
608 609
    const char *opt_overlap_check, *opt_overlap_check_template;
    int overlap_check_template = 0;
610
    uint64_t l2_cache_size, refcount_cache_size;
611
    int i;
612
    Error *local_err = NULL;
613 614
    int ret;

615 616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643 644 645 646 647 648 649 650 651
    opts = qemu_opts_create(&qcow2_runtime_opts, NULL, 0, &error_abort);
    qemu_opts_absorb_qdict(opts, options, &local_err);
    if (local_err) {
        error_propagate(errp, local_err);
        ret = -EINVAL;
        goto fail;
    }

    /* get L2 table/refcount block cache size from command line options */
    read_cache_sizes(bs, opts, &l2_cache_size, &refcount_cache_size,
                     &local_err);
    if (local_err) {
        error_propagate(errp, local_err);
        ret = -EINVAL;
        goto fail;
    }

    l2_cache_size /= s->cluster_size;
    if (l2_cache_size < MIN_L2_CACHE_SIZE) {
        l2_cache_size = MIN_L2_CACHE_SIZE;
    }
    if (l2_cache_size > INT_MAX) {
        error_setg(errp, "L2 cache size too big");
        ret = -EINVAL;
        goto fail;
    }

    refcount_cache_size /= s->cluster_size;
    if (refcount_cache_size < MIN_REFCOUNT_CACHE_SIZE) {
        refcount_cache_size = MIN_REFCOUNT_CACHE_SIZE;
    }
    if (refcount_cache_size > INT_MAX) {
        error_setg(errp, "Refcount cache size too big");
        ret = -EINVAL;
        goto fail;
    }

652 653 654 655 656 657 658 659 660 661 662 663 664 665 666 667 668 669
    /* alloc new L2 table/refcount block cache, flush old one */
    if (s->l2_table_cache) {
        ret = qcow2_cache_flush(bs, s->l2_table_cache);
        if (ret) {
            error_setg_errno(errp, -ret, "Failed to flush the L2 table cache");
            goto fail;
        }
    }

    if (s->refcount_block_cache) {
        ret = qcow2_cache_flush(bs, s->refcount_block_cache);
        if (ret) {
            error_setg_errno(errp, -ret,
                             "Failed to flush the refcount block cache");
            goto fail;
        }
    }

670 671 672
    r->l2_table_cache = qcow2_cache_create(bs, l2_cache_size);
    r->refcount_block_cache = qcow2_cache_create(bs, refcount_cache_size);
    if (r->l2_table_cache == NULL || r->refcount_block_cache == NULL) {
673 674 675 676 677 678
        error_setg(errp, "Could not allocate metadata caches");
        ret = -ENOMEM;
        goto fail;
    }

    /* New interval for cache cleanup timer */
679
    r->cache_clean_interval =
680 681
        qemu_opt_get_number(opts, QCOW2_OPT_CACHE_CLEAN_INTERVAL,
                            s->cache_clean_interval);
682
    if (r->cache_clean_interval > UINT_MAX) {
683 684 685 686 687
        error_setg(errp, "Cache clean interval too big");
        ret = -EINVAL;
        goto fail;
    }

688
    /* lazy-refcounts; flush if going from enabled to disabled */
689
    r->use_lazy_refcounts = qemu_opt_get_bool(opts, QCOW2_OPT_LAZY_REFCOUNTS,
690
        (s->compatible_features & QCOW2_COMPAT_LAZY_REFCOUNTS));
691
    if (r->use_lazy_refcounts && s->qcow_version < 3) {
692 693 694 695 696
        error_setg(errp, "Lazy refcounts require a qcow2 image with at least "
                   "qemu 1.1 compatibility level");
        ret = -EINVAL;
        goto fail;
    }
697

698 699 700 701 702 703 704 705
    if (s->use_lazy_refcounts && !r->use_lazy_refcounts) {
        ret = qcow2_mark_clean(bs);
        if (ret < 0) {
            error_setg_errno(errp, -ret, "Failed to disable lazy refcounts");
            goto fail;
        }
    }

706
    /* Overlap check options */
707 708 709 710 711 712 713 714 715 716 717 718 719 720 721 722 723 724 725 726 727 728 729 730 731 732 733 734 735 736 737
    opt_overlap_check = qemu_opt_get(opts, QCOW2_OPT_OVERLAP);
    opt_overlap_check_template = qemu_opt_get(opts, QCOW2_OPT_OVERLAP_TEMPLATE);
    if (opt_overlap_check_template && opt_overlap_check &&
        strcmp(opt_overlap_check_template, opt_overlap_check))
    {
        error_setg(errp, "Conflicting values for qcow2 options '"
                   QCOW2_OPT_OVERLAP "' ('%s') and '" QCOW2_OPT_OVERLAP_TEMPLATE
                   "' ('%s')", opt_overlap_check, opt_overlap_check_template);
        ret = -EINVAL;
        goto fail;
    }
    if (!opt_overlap_check) {
        opt_overlap_check = opt_overlap_check_template ?: "cached";
    }

    if (!strcmp(opt_overlap_check, "none")) {
        overlap_check_template = 0;
    } else if (!strcmp(opt_overlap_check, "constant")) {
        overlap_check_template = QCOW2_OL_CONSTANT;
    } else if (!strcmp(opt_overlap_check, "cached")) {
        overlap_check_template = QCOW2_OL_CACHED;
    } else if (!strcmp(opt_overlap_check, "all")) {
        overlap_check_template = QCOW2_OL_ALL;
    } else {
        error_setg(errp, "Unsupported value '%s' for qcow2 option "
                   "'overlap-check'. Allowed are any of the following: "
                   "none, constant, cached, all", opt_overlap_check);
        ret = -EINVAL;
        goto fail;
    }

738
    r->overlap_check = 0;
739 740 741
    for (i = 0; i < QCOW2_OL_MAX_BITNR; i++) {
        /* overlap-check defines a template bitmask, but every flag may be
         * overwritten through the associated boolean option */
742
        r->overlap_check |=
743 744 745 746
            qemu_opt_get_bool(opts, overlap_bool_option_names[i],
                              overlap_check_template & (1 << i)) << i;
    }

747 748 749
    r->discard_passthrough[QCOW2_DISCARD_NEVER] = false;
    r->discard_passthrough[QCOW2_DISCARD_ALWAYS] = true;
    r->discard_passthrough[QCOW2_DISCARD_REQUEST] =
750 751
        qemu_opt_get_bool(opts, QCOW2_OPT_DISCARD_REQUEST,
                          flags & BDRV_O_UNMAP);
752
    r->discard_passthrough[QCOW2_DISCARD_SNAPSHOT] =
753
        qemu_opt_get_bool(opts, QCOW2_OPT_DISCARD_SNAPSHOT, true);
754
    r->discard_passthrough[QCOW2_DISCARD_OTHER] =
755 756
        qemu_opt_get_bool(opts, QCOW2_OPT_DISCARD_OTHER, false);

757 758
    ret = 0;
fail:
759 760
    qemu_opts_del(opts);
    opts = NULL;
761 762 763 764 765 766 767 768 769
    return ret;
}

static void qcow2_update_options_commit(BlockDriverState *bs,
                                        Qcow2ReopenState *r)
{
    BDRVQcow2State *s = bs->opaque;
    int i;

770 771 772 773 774 775
    if (s->l2_table_cache) {
        qcow2_cache_destroy(bs, s->l2_table_cache);
    }
    if (s->refcount_block_cache) {
        qcow2_cache_destroy(bs, s->refcount_block_cache);
    }
776 777 778 779 780 781 782 783 784 785
    s->l2_table_cache = r->l2_table_cache;
    s->refcount_block_cache = r->refcount_block_cache;

    s->overlap_check = r->overlap_check;
    s->use_lazy_refcounts = r->use_lazy_refcounts;

    for (i = 0; i < QCOW2_DISCARD_MAX; i++) {
        s->discard_passthrough[i] = r->discard_passthrough[i];
    }

786 787 788 789 790
    if (s->cache_clean_interval != r->cache_clean_interval) {
        cache_clean_timer_del(bs);
        s->cache_clean_interval = r->cache_clean_interval;
        cache_clean_timer_init(bs, bdrv_get_aio_context(bs));
    }
791 792 793 794 795 796 797 798 799 800 801 802 803 804 805 806 807 808 809 810 811 812 813 814 815
}

static void qcow2_update_options_abort(BlockDriverState *bs,
                                       Qcow2ReopenState *r)
{
    if (r->l2_table_cache) {
        qcow2_cache_destroy(bs, r->l2_table_cache);
    }
    if (r->refcount_block_cache) {
        qcow2_cache_destroy(bs, r->refcount_block_cache);
    }
}

static int qcow2_update_options(BlockDriverState *bs, QDict *options,
                                int flags, Error **errp)
{
    Qcow2ReopenState r = {};
    int ret;

    ret = qcow2_update_options_prepare(bs, &r, options, flags, errp);
    if (ret >= 0) {
        qcow2_update_options_commit(bs, &r);
    } else {
        qcow2_update_options_abort(bs, &r);
    }
816

817 818 819
    return ret;
}

M
Max Reitz 已提交
820 821
static int qcow2_open(BlockDriverState *bs, QDict *options, int flags,
                      Error **errp)
B
bellard 已提交
822
{
823
    BDRVQcow2State *s = bs->opaque;
824 825
    unsigned int len, i;
    int ret = 0;
B
bellard 已提交
826
    QCowHeader header;
827
    Error *local_err = NULL;
828
    uint64_t ext_end;
829
    uint64_t l1_vm_state_index;
B
bellard 已提交
830

K
Kevin Wolf 已提交
831
    ret = bdrv_pread(bs->file->bs, 0, &header, sizeof(header));
832
    if (ret < 0) {
M
Max Reitz 已提交
833
        error_setg_errno(errp, -ret, "Could not read qcow2 header");
B
bellard 已提交
834
        goto fail;
835
    }
B
bellard 已提交
836 837 838 839 840 841 842 843 844 845 846 847 848
    be32_to_cpus(&header.magic);
    be32_to_cpus(&header.version);
    be64_to_cpus(&header.backing_file_offset);
    be32_to_cpus(&header.backing_file_size);
    be64_to_cpus(&header.size);
    be32_to_cpus(&header.cluster_bits);
    be32_to_cpus(&header.crypt_method);
    be64_to_cpus(&header.l1_table_offset);
    be32_to_cpus(&header.l1_size);
    be64_to_cpus(&header.refcount_table_offset);
    be32_to_cpus(&header.refcount_table_clusters);
    be64_to_cpus(&header.snapshots_offset);
    be32_to_cpus(&header.nb_snapshots);
849

K
Kevin Wolf 已提交
850
    if (header.magic != QCOW_MAGIC) {
M
Max Reitz 已提交
851
        error_setg(errp, "Image is not in qcow2 format");
P
Paolo Bonzini 已提交
852
        ret = -EINVAL;
B
bellard 已提交
853
        goto fail;
854
    }
K
Kevin Wolf 已提交
855
    if (header.version < 2 || header.version > 3) {
856
        report_unsupported(bs, errp, "QCOW version %" PRIu32, header.version);
K
Kevin Wolf 已提交
857 858 859 860 861 862
        ret = -ENOTSUP;
        goto fail;
    }

    s->qcow_version = header.version;

863 864 865
    /* Initialise cluster size */
    if (header.cluster_bits < MIN_CLUSTER_BITS ||
        header.cluster_bits > MAX_CLUSTER_BITS) {
866 867
        error_setg(errp, "Unsupported cluster size: 2^%" PRIu32,
                   header.cluster_bits);
868 869 870 871 872 873 874 875
        ret = -EINVAL;
        goto fail;
    }

    s->cluster_bits = header.cluster_bits;
    s->cluster_size = 1 << s->cluster_bits;
    s->cluster_sectors = 1 << (s->cluster_bits - 9);

K
Kevin Wolf 已提交
876 877 878 879 880 881 882 883 884 885 886 887 888
    /* Initialise version 3 header fields */
    if (header.version == 2) {
        header.incompatible_features    = 0;
        header.compatible_features      = 0;
        header.autoclear_features       = 0;
        header.refcount_order           = 4;
        header.header_length            = 72;
    } else {
        be64_to_cpus(&header.incompatible_features);
        be64_to_cpus(&header.compatible_features);
        be64_to_cpus(&header.autoclear_features);
        be32_to_cpus(&header.refcount_order);
        be32_to_cpus(&header.header_length);
889 890 891 892 893 894 895 896 897 898 899 900

        if (header.header_length < 104) {
            error_setg(errp, "qcow2 header too short");
            ret = -EINVAL;
            goto fail;
        }
    }

    if (header.header_length > s->cluster_size) {
        error_setg(errp, "qcow2 header exceeds cluster size");
        ret = -EINVAL;
        goto fail;
K
Kevin Wolf 已提交
901 902 903 904 905
    }

    if (header.header_length > sizeof(header)) {
        s->unknown_header_fields_size = header.header_length - sizeof(header);
        s->unknown_header_fields = g_malloc(s->unknown_header_fields_size);
K
Kevin Wolf 已提交
906
        ret = bdrv_pread(bs->file->bs, sizeof(header), s->unknown_header_fields,
K
Kevin Wolf 已提交
907 908
                         s->unknown_header_fields_size);
        if (ret < 0) {
M
Max Reitz 已提交
909 910
            error_setg_errno(errp, -ret, "Could not read unknown qcow2 header "
                             "fields");
K
Kevin Wolf 已提交
911 912 913 914
            goto fail;
        }
    }

915 916 917 918 919 920
    if (header.backing_file_offset > s->cluster_size) {
        error_setg(errp, "Invalid backing file offset");
        ret = -EINVAL;
        goto fail;
    }

921 922 923 924 925 926
    if (header.backing_file_offset) {
        ext_end = header.backing_file_offset;
    } else {
        ext_end = 1 << header.cluster_bits;
    }

K
Kevin Wolf 已提交
927 928 929 930 931
    /* Handle feature bits */
    s->incompatible_features    = header.incompatible_features;
    s->compatible_features      = header.compatible_features;
    s->autoclear_features       = header.autoclear_features;

S
Stefan Hajnoczi 已提交
932
    if (s->incompatible_features & ~QCOW2_INCOMPAT_MASK) {
933 934
        void *feature_table = NULL;
        qcow2_read_extensions(bs, header.header_length, ext_end,
M
Max Reitz 已提交
935 936
                              &feature_table, NULL);
        report_unsupported_feature(bs, errp, feature_table,
S
Stefan Hajnoczi 已提交
937 938
                                   s->incompatible_features &
                                   ~QCOW2_INCOMPAT_MASK);
K
Kevin Wolf 已提交
939
        ret = -ENOTSUP;
940
        g_free(feature_table);
K
Kevin Wolf 已提交
941 942 943
        goto fail;
    }

M
Max Reitz 已提交
944 945 946 947
    if (s->incompatible_features & QCOW2_INCOMPAT_CORRUPT) {
        /* Corrupt images may not be written to unless they are being repaired
         */
        if ((flags & BDRV_O_RDWR) && !(flags & BDRV_O_CHECK)) {
M
Max Reitz 已提交
948 949
            error_setg(errp, "qcow2: Image is corrupt; cannot be opened "
                       "read/write");
M
Max Reitz 已提交
950 951 952 953 954
            ret = -EACCES;
            goto fail;
        }
    }

K
Kevin Wolf 已提交
955
    /* Check support for various header values */
956 957 958 959
    if (header.refcount_order > 6) {
        error_setg(errp, "Reference count entry width too large; may not "
                   "exceed 64 bits");
        ret = -EINVAL;
K
Kevin Wolf 已提交
960 961
        goto fail;
    }
962
    s->refcount_order = header.refcount_order;
963 964 965
    s->refcount_bits = 1 << s->refcount_order;
    s->refcount_max = UINT64_C(1) << (s->refcount_bits - 1);
    s->refcount_max += s->refcount_max - 1;
K
Kevin Wolf 已提交
966

967
    if (header.crypt_method > QCOW_CRYPT_AES) {
968
        error_setg(errp, "Unsupported encryption method: %" PRIu32,
M
Max Reitz 已提交
969
                   header.crypt_method);
970
        ret = -EINVAL;
B
bellard 已提交
971
        goto fail;
972
    }
973 974 975 976 977
    if (!qcrypto_cipher_supports(QCRYPTO_CIPHER_ALG_AES_128)) {
        error_setg(errp, "AES cipher not available");
        ret = -EINVAL;
        goto fail;
    }
B
bellard 已提交
978
    s->crypt_method_header = header.crypt_method;
979
    if (s->crypt_method_header) {
B
bellard 已提交
980
        bs->encrypted = 1;
981
    }
982

B
bellard 已提交
983 984
    s->l2_bits = s->cluster_bits - 3; /* L2 is always one cluster */
    s->l2_size = 1 << s->l2_bits;
985 986 987
    /* 2^(s->refcount_order - 3) is the refcount width in bytes */
    s->refcount_block_bits = s->cluster_bits - (s->refcount_order - 3);
    s->refcount_block_size = 1 << s->refcount_block_bits;
B
bellard 已提交
988 989 990 991
    bs->total_sectors = header.size / 512;
    s->csize_shift = (62 - (s->cluster_bits - 8));
    s->csize_mask = (1 << (s->cluster_bits - 8)) - 1;
    s->cluster_offset_mask = (1LL << s->csize_shift) - 1;
992

B
bellard 已提交
993
    s->refcount_table_offset = header.refcount_table_offset;
994
    s->refcount_table_size =
B
bellard 已提交
995 996
        header.refcount_table_clusters << (s->cluster_bits - 3);

997
    if (header.refcount_table_clusters > qcow2_max_refcount_clusters(s)) {
998 999 1000 1001 1002
        error_setg(errp, "Reference count table too large");
        ret = -EINVAL;
        goto fail;
    }

1003 1004 1005 1006 1007 1008 1009
    ret = validate_table_offset(bs, s->refcount_table_offset,
                                s->refcount_table_size, sizeof(uint64_t));
    if (ret < 0) {
        error_setg(errp, "Invalid reference count table offset");
        goto fail;
    }

1010 1011 1012 1013 1014 1015 1016 1017 1018 1019 1020 1021 1022 1023 1024
    /* Snapshot table offset/length */
    if (header.nb_snapshots > QCOW_MAX_SNAPSHOTS) {
        error_setg(errp, "Too many snapshots");
        ret = -EINVAL;
        goto fail;
    }

    ret = validate_table_offset(bs, header.snapshots_offset,
                                header.nb_snapshots,
                                sizeof(QCowSnapshotHeader));
    if (ret < 0) {
        error_setg(errp, "Invalid snapshot table offset");
        goto fail;
    }

B
bellard 已提交
1025
    /* read the level 1 table */
1026
    if (header.l1_size > QCOW_MAX_L1_SIZE / sizeof(uint64_t)) {
1027 1028 1029 1030
        error_setg(errp, "Active L1 table too large");
        ret = -EFBIG;
        goto fail;
    }
B
bellard 已提交
1031
    s->l1_size = header.l1_size;
1032 1033 1034

    l1_vm_state_index = size_to_l1(s, header.size);
    if (l1_vm_state_index > INT_MAX) {
M
Max Reitz 已提交
1035
        error_setg(errp, "Image is too big");
1036 1037 1038 1039 1040
        ret = -EFBIG;
        goto fail;
    }
    s->l1_vm_state_index = l1_vm_state_index;

B
bellard 已提交
1041 1042
    /* the L1 table must contain at least enough entries to put
       header.size bytes */
1043
    if (s->l1_size < s->l1_vm_state_index) {
M
Max Reitz 已提交
1044
        error_setg(errp, "L1 table is too small");
1045
        ret = -EINVAL;
B
bellard 已提交
1046
        goto fail;
1047
    }
1048 1049 1050 1051 1052 1053 1054

    ret = validate_table_offset(bs, header.l1_table_offset,
                                header.l1_size, sizeof(uint64_t));
    if (ret < 0) {
        error_setg(errp, "Invalid L1 table offset");
        goto fail;
    }
B
bellard 已提交
1055
    s->l1_table_offset = header.l1_table_offset;
1056 1057


1058
    if (s->l1_size > 0) {
K
Kevin Wolf 已提交
1059
        s->l1_table = qemu_try_blockalign(bs->file->bs,
1060
            align_offset(s->l1_size * sizeof(uint64_t), 512));
1061 1062 1063 1064 1065
        if (s->l1_table == NULL) {
            error_setg(errp, "Could not allocate L1 table");
            ret = -ENOMEM;
            goto fail;
        }
K
Kevin Wolf 已提交
1066
        ret = bdrv_pread(bs->file->bs, s->l1_table_offset, s->l1_table,
1067 1068
                         s->l1_size * sizeof(uint64_t));
        if (ret < 0) {
M
Max Reitz 已提交
1069
            error_setg_errno(errp, -ret, "Could not read L1 table");
1070
            goto fail;
1071
        }
1072 1073 1074
        for(i = 0;i < s->l1_size; i++) {
            be64_to_cpus(&s->l1_table[i]);
        }
B
bellard 已提交
1075
    }
K
Kevin Wolf 已提交
1076

1077 1078
    /* Parse driver-specific options */
    ret = qcow2_update_options(bs, options, flags, errp);
1079 1080 1081 1082
    if (ret < 0) {
        goto fail;
    }

1083
    s->cluster_cache = g_malloc(s->cluster_size);
B
bellard 已提交
1084
    /* one more sector for decompressed data alignment */
K
Kevin Wolf 已提交
1085
    s->cluster_data = qemu_try_blockalign(bs->file->bs, QCOW_MAX_CRYPT_CLUSTERS
1086 1087 1088 1089 1090 1091 1092
                                                    * s->cluster_size + 512);
    if (s->cluster_data == NULL) {
        error_setg(errp, "Could not allocate temporary cluster buffer");
        ret = -ENOMEM;
        goto fail;
    }

B
bellard 已提交
1093
    s->cluster_cache_offset = -1;
1094
    s->flags = flags;
1095

1096 1097
    ret = qcow2_refcount_init(bs);
    if (ret != 0) {
M
Max Reitz 已提交
1098
        error_setg_errno(errp, -ret, "Could not initialize refcount handling");
B
bellard 已提交
1099
        goto fail;
1100
    }
B
bellard 已提交
1101

B
Blue Swirl 已提交
1102
    QLIST_INIT(&s->cluster_allocs);
K
Kevin Wolf 已提交
1103
    QTAILQ_INIT(&s->discards);
1104

1105
    /* read qcow2 extensions */
M
Max Reitz 已提交
1106 1107 1108
    if (qcow2_read_extensions(bs, header.header_length, ext_end, NULL,
        &local_err)) {
        error_propagate(errp, local_err);
1109
        ret = -EINVAL;
1110
        goto fail;
1111
    }
1112

B
bellard 已提交
1113 1114 1115
    /* read the backing file name */
    if (header.backing_file_offset != 0) {
        len = header.backing_file_size;
1116
        if (len > MIN(1023, s->cluster_size - header.backing_file_offset) ||
1117
            len >= sizeof(bs->backing_file)) {
1118 1119 1120
            error_setg(errp, "Backing file name too long");
            ret = -EINVAL;
            goto fail;
1121
        }
K
Kevin Wolf 已提交
1122
        ret = bdrv_pread(bs->file->bs, header.backing_file_offset,
1123 1124
                         bs->backing_file, len);
        if (ret < 0) {
M
Max Reitz 已提交
1125
            error_setg_errno(errp, -ret, "Could not read backing file name");
B
bellard 已提交
1126
            goto fail;
1127
        }
B
bellard 已提交
1128
        bs->backing_file[len] = '\0';
1129
        s->image_backing_file = g_strdup(bs->backing_file);
B
bellard 已提交
1130
    }
1131

1132 1133 1134 1135
    /* Internal snapshots */
    s->snapshots_offset = header.snapshots_offset;
    s->nb_snapshots = header.nb_snapshots;

1136 1137
    ret = qcow2_read_snapshots(bs);
    if (ret < 0) {
M
Max Reitz 已提交
1138
        error_setg_errno(errp, -ret, "Could not read snapshots");
B
bellard 已提交
1139
        goto fail;
1140
    }
B
bellard 已提交
1141

1142
    /* Clear unknown autoclear feature bits */
1143
    if (!bs->read_only && !(flags & BDRV_O_INCOMING) && s->autoclear_features) {
1144 1145 1146
        s->autoclear_features = 0;
        ret = qcow2_update_header(bs);
        if (ret < 0) {
M
Max Reitz 已提交
1147
            error_setg_errno(errp, -ret, "Could not update qcow2 header");
1148 1149 1150 1151
            goto fail;
        }
    }

K
Kevin Wolf 已提交
1152 1153 1154
    /* Initialise locks */
    qemu_co_mutex_init(&s->lock);

S
Stefan Hajnoczi 已提交
1155
    /* Repair image if dirty */
1156
    if (!(flags & (BDRV_O_CHECK | BDRV_O_INCOMING)) && !bs->read_only &&
1157
        (s->incompatible_features & QCOW2_INCOMPAT_DIRTY)) {
S
Stefan Hajnoczi 已提交
1158 1159
        BdrvCheckResult result = {0};

M
Max Reitz 已提交
1160
        ret = qcow2_check(bs, &result, BDRV_FIX_ERRORS | BDRV_FIX_LEAKS);
S
Stefan Hajnoczi 已提交
1161
        if (ret < 0) {
M
Max Reitz 已提交
1162
            error_setg_errno(errp, -ret, "Could not repair dirty image");
S
Stefan Hajnoczi 已提交
1163 1164 1165 1166
            goto fail;
        }
    }

B
bellard 已提交
1167
#ifdef DEBUG_ALLOC
P
Philipp Hahn 已提交
1168 1169
    {
        BdrvCheckResult result = {0};
1170
        qcow2_check_refcounts(bs, &result, 0);
P
Philipp Hahn 已提交
1171
    }
B
bellard 已提交
1172
#endif
1173
    return ret;
B
bellard 已提交
1174 1175

 fail:
K
Kevin Wolf 已提交
1176
    g_free(s->unknown_header_fields);
1177
    cleanup_unknown_header_ext(bs);
K
Kevin Wolf 已提交
1178 1179
    qcow2_free_snapshots(bs);
    qcow2_refcount_close(bs);
1180
    qemu_vfree(s->l1_table);
1181 1182
    /* else pre-write overlap checks in cache_destroy may crash */
    s->l1_table = NULL;
1183
    cache_clean_timer_del(bs);
K
Kevin Wolf 已提交
1184 1185 1186
    if (s->l2_table_cache) {
        qcow2_cache_destroy(bs, s->l2_table_cache);
    }
1187 1188 1189
    if (s->refcount_block_cache) {
        qcow2_cache_destroy(bs, s->refcount_block_cache);
    }
1190
    g_free(s->cluster_cache);
1191
    qemu_vfree(s->cluster_data);
1192
    return ret;
B
bellard 已提交
1193 1194
}

1195
static void qcow2_refresh_limits(BlockDriverState *bs, Error **errp)
1196
{
1197
    BDRVQcow2State *s = bs->opaque;
1198 1199 1200 1201

    bs->bl.write_zeroes_alignment = s->cluster_sectors;
}

1202
static int qcow2_set_key(BlockDriverState *bs, const char *key)
B
bellard 已提交
1203
{
1204
    BDRVQcow2State *s = bs->opaque;
B
bellard 已提交
1205 1206
    uint8_t keybuf[16];
    int len, i;
1207
    Error *err = NULL;
1208

B
bellard 已提交
1209 1210 1211 1212 1213 1214 1215 1216 1217
    memset(keybuf, 0, 16);
    len = strlen(key);
    if (len > 16)
        len = 16;
    /* XXX: we could compress the chars to 7 bits to increase
       entropy */
    for(i = 0;i < len;i++) {
        keybuf[i] = key[i];
    }
1218
    assert(bs->encrypted);
B
bellard 已提交
1219

1220 1221 1222 1223 1224 1225 1226 1227 1228 1229 1230 1231
    qcrypto_cipher_free(s->cipher);
    s->cipher = qcrypto_cipher_new(
        QCRYPTO_CIPHER_ALG_AES_128,
        QCRYPTO_CIPHER_MODE_CBC,
        keybuf, G_N_ELEMENTS(keybuf),
        &err);

    if (!s->cipher) {
        /* XXX would be nice if errors in this method could
         * be properly propagate to the caller. Would need
         * the bdrv_set_key() API signature to be fixed. */
        error_free(err);
B
bellard 已提交
1232 1233 1234 1235 1236
        return -1;
    }
    return 0;
}

J
Jeff Cody 已提交
1237 1238 1239
static int qcow2_reopen_prepare(BDRVReopenState *state,
                                BlockReopenQueue *queue, Error **errp)
{
1240
    Qcow2ReopenState *r;
1241 1242
    int ret;

1243 1244 1245 1246 1247 1248 1249 1250 1251 1252
    r = g_new0(Qcow2ReopenState, 1);
    state->opaque = r;

    ret = qcow2_update_options_prepare(state->bs, r, state->options,
                                       state->flags, errp);
    if (ret < 0) {
        goto fail;
    }

    /* We need to write out any unwritten data if we reopen read-only. */
1253 1254 1255
    if ((state->flags & BDRV_O_RDWR) == 0) {
        ret = bdrv_flush(state->bs);
        if (ret < 0) {
1256
            goto fail;
1257 1258 1259 1260
        }

        ret = qcow2_mark_clean(state->bs);
        if (ret < 0) {
1261
            goto fail;
1262 1263 1264
        }
    }

J
Jeff Cody 已提交
1265
    return 0;
1266 1267 1268 1269 1270 1271 1272 1273 1274 1275 1276 1277 1278 1279 1280 1281 1282

fail:
    qcow2_update_options_abort(state->bs, r);
    g_free(r);
    return ret;
}

static void qcow2_reopen_commit(BDRVReopenState *state)
{
    qcow2_update_options_commit(state->bs, state->opaque);
    g_free(state->opaque);
}

static void qcow2_reopen_abort(BDRVReopenState *state)
{
    qcow2_update_options_abort(state->bs, state->opaque);
    g_free(state->opaque);
J
Jeff Cody 已提交
1283 1284
}

1285 1286 1287 1288 1289 1290 1291 1292 1293 1294 1295 1296 1297 1298 1299 1300 1301 1302 1303 1304 1305 1306 1307 1308 1309 1310 1311 1312 1313 1314 1315 1316 1317 1318 1319 1320 1321 1322 1323 1324 1325 1326 1327 1328 1329 1330
static void qcow2_join_options(QDict *options, QDict *old_options)
{
    bool has_new_overlap_template =
        qdict_haskey(options, QCOW2_OPT_OVERLAP) ||
        qdict_haskey(options, QCOW2_OPT_OVERLAP_TEMPLATE);
    bool has_new_total_cache_size =
        qdict_haskey(options, QCOW2_OPT_CACHE_SIZE);
    bool has_all_cache_options;

    /* New overlap template overrides all old overlap options */
    if (has_new_overlap_template) {
        qdict_del(old_options, QCOW2_OPT_OVERLAP);
        qdict_del(old_options, QCOW2_OPT_OVERLAP_TEMPLATE);
        qdict_del(old_options, QCOW2_OPT_OVERLAP_MAIN_HEADER);
        qdict_del(old_options, QCOW2_OPT_OVERLAP_ACTIVE_L1);
        qdict_del(old_options, QCOW2_OPT_OVERLAP_ACTIVE_L2);
        qdict_del(old_options, QCOW2_OPT_OVERLAP_REFCOUNT_TABLE);
        qdict_del(old_options, QCOW2_OPT_OVERLAP_REFCOUNT_BLOCK);
        qdict_del(old_options, QCOW2_OPT_OVERLAP_SNAPSHOT_TABLE);
        qdict_del(old_options, QCOW2_OPT_OVERLAP_INACTIVE_L1);
        qdict_del(old_options, QCOW2_OPT_OVERLAP_INACTIVE_L2);
    }

    /* New total cache size overrides all old options */
    if (qdict_haskey(options, QCOW2_OPT_CACHE_SIZE)) {
        qdict_del(old_options, QCOW2_OPT_L2_CACHE_SIZE);
        qdict_del(old_options, QCOW2_OPT_REFCOUNT_CACHE_SIZE);
    }

    qdict_join(options, old_options, false);

    /*
     * If after merging all cache size options are set, an old total size is
     * overwritten. Do keep all options, however, if all three are new. The
     * resulting error message is what we want to happen.
     */
    has_all_cache_options =
        qdict_haskey(options, QCOW2_OPT_CACHE_SIZE) ||
        qdict_haskey(options, QCOW2_OPT_L2_CACHE_SIZE) ||
        qdict_haskey(options, QCOW2_OPT_REFCOUNT_CACHE_SIZE);

    if (has_all_cache_options && !has_new_total_cache_size) {
        qdict_del(options, QCOW2_OPT_CACHE_SIZE);
    }
}

1331
static int64_t coroutine_fn qcow2_co_get_block_status(BlockDriverState *bs,
1332
        int64_t sector_num, int nb_sectors, int *pnum)
B
bellard 已提交
1333
{
1334
    BDRVQcow2State *s = bs->opaque;
B
bellard 已提交
1335
    uint64_t cluster_offset;
1336 1337
    int index_in_cluster, ret;
    int64_t status = 0;
B
bellard 已提交
1338

1339
    *pnum = nb_sectors;
1340
    qemu_co_mutex_lock(&s->lock);
1341
    ret = qcow2_get_cluster_offset(bs, sector_num << 9, pnum, &cluster_offset);
1342
    qemu_co_mutex_unlock(&s->lock);
1343
    if (ret < 0) {
1344
        return ret;
1345
    }
1346

1347
    if (cluster_offset != 0 && ret != QCOW2_CLUSTER_COMPRESSED &&
1348
        !s->cipher) {
1349 1350 1351 1352 1353 1354 1355 1356 1357 1358
        index_in_cluster = sector_num & (s->cluster_sectors - 1);
        cluster_offset |= (index_in_cluster << BDRV_SECTOR_BITS);
        status |= BDRV_BLOCK_OFFSET_VALID | cluster_offset;
    }
    if (ret == QCOW2_CLUSTER_ZERO) {
        status |= BDRV_BLOCK_ZERO;
    } else if (ret != QCOW2_CLUSTER_UNALLOCATED) {
        status |= BDRV_BLOCK_DATA;
    }
    return status;
B
bellard 已提交
1359 1360
}

B
bellard 已提交
1361
/* handle reading after the end of the backing file */
1362 1363
int qcow2_backing_read1(BlockDriverState *bs, QEMUIOVector *qiov,
                  int64_t sector_num, int nb_sectors)
B
bellard 已提交
1364 1365 1366 1367 1368 1369 1370 1371
{
    int n1;
    if ((sector_num + nb_sectors) <= bs->total_sectors)
        return nb_sectors;
    if (sector_num >= bs->total_sectors)
        n1 = 0;
    else
        n1 = bs->total_sectors - sector_num;
1372

1373
    qemu_iovec_memset(qiov, 512 * n1, 0, 512 * (nb_sectors - n1));
1374

B
bellard 已提交
1375 1376 1377
    return n1;
}

1378
static coroutine_fn int qcow2_co_readv(BlockDriverState *bs, int64_t sector_num,
1379
                          int remaining_sectors, QEMUIOVector *qiov)
B
bellard 已提交
1380
{
1381
    BDRVQcow2State *s = bs->opaque;
B
bellard 已提交
1382
    int index_in_cluster, n1;
K
Kevin Wolf 已提交
1383
    int ret;
1384
    int cur_nr_sectors; /* number of sectors in current iteration */
1385
    uint64_t cluster_offset = 0;
1386 1387 1388
    uint64_t bytes_done = 0;
    QEMUIOVector hd_qiov;
    uint8_t *cluster_data = NULL;
B
bellard 已提交
1389

1390 1391 1392 1393 1394
    qemu_iovec_init(&hd_qiov, qiov->niov);

    qemu_co_mutex_lock(&s->lock);

    while (remaining_sectors != 0) {
1395

1396
        /* prepare next request */
1397
        cur_nr_sectors = remaining_sectors;
1398
        if (s->cipher) {
1399 1400
            cur_nr_sectors = MIN(cur_nr_sectors,
                QCOW_MAX_CRYPT_CLUSTERS * s->cluster_sectors);
B
bellard 已提交
1401
        }
1402

1403
        ret = qcow2_get_cluster_offset(bs, sector_num << 9,
1404
            &cur_nr_sectors, &cluster_offset);
1405
        if (ret < 0) {
1406
            goto fail;
1407
        }
1408

1409
        index_in_cluster = sector_num & (s->cluster_sectors - 1);
1410

1411
        qemu_iovec_reset(&hd_qiov);
1412
        qemu_iovec_concat(&hd_qiov, qiov, bytes_done,
1413 1414
            cur_nr_sectors * 512);

1415 1416
        switch (ret) {
        case QCOW2_CLUSTER_UNALLOCATED:
1417

1418
            if (bs->backing) {
1419
                /* read from the base image */
1420
                n1 = qcow2_backing_read1(bs->backing->bs, &hd_qiov,
1421
                    sector_num, cur_nr_sectors);
1422
                if (n1 > 0) {
1423 1424 1425 1426 1427 1428
                    QEMUIOVector local_qiov;

                    qemu_iovec_init(&local_qiov, hd_qiov.niov);
                    qemu_iovec_concat(&local_qiov, &hd_qiov, 0,
                                      n1 * BDRV_SECTOR_SIZE);

1429 1430
                    BLKDBG_EVENT(bs->file, BLKDBG_READ_BACKING_AIO);
                    qemu_co_mutex_unlock(&s->lock);
1431
                    ret = bdrv_co_readv(bs->backing->bs, sector_num,
1432
                                        n1, &local_qiov);
1433
                    qemu_co_mutex_lock(&s->lock);
1434 1435 1436

                    qemu_iovec_destroy(&local_qiov);

1437
                    if (ret < 0) {
1438
                        goto fail;
1439 1440 1441 1442
                    }
                }
            } else {
                /* Note: in this case, no need to wait */
1443
                qemu_iovec_memset(&hd_qiov, 0, 0, 512 * cur_nr_sectors);
1444
            }
1445 1446
            break;

1447
        case QCOW2_CLUSTER_ZERO:
1448
            qemu_iovec_memset(&hd_qiov, 0, 0, 512 * cur_nr_sectors);
1449 1450
            break;

1451
        case QCOW2_CLUSTER_COMPRESSED:
1452 1453 1454
            /* add AIO support for compressed blocks ? */
            ret = qcow2_decompress_cluster(bs, cluster_offset);
            if (ret < 0) {
1455
                goto fail;
1456 1457
            }

1458
            qemu_iovec_from_buf(&hd_qiov, 0,
1459
                s->cluster_cache + index_in_cluster * 512,
1460
                512 * cur_nr_sectors);
1461 1462 1463
            break;

        case QCOW2_CLUSTER_NORMAL:
1464
            if ((cluster_offset & 511) != 0) {
1465 1466
                ret = -EIO;
                goto fail;
1467
            }
1468

1469
            if (bs->encrypted) {
1470
                assert(s->cipher);
1471

1472 1473 1474 1475
                /*
                 * For encrypted images, read everything into a temporary
                 * contiguous buffer on which the AES functions can work.
                 */
1476 1477
                if (!cluster_data) {
                    cluster_data =
K
Kevin Wolf 已提交
1478 1479 1480
                        qemu_try_blockalign(bs->file->bs,
                                            QCOW_MAX_CRYPT_CLUSTERS
                                            * s->cluster_size);
1481 1482 1483 1484
                    if (cluster_data == NULL) {
                        ret = -ENOMEM;
                        goto fail;
                    }
1485 1486 1487 1488
                }

                assert(cur_nr_sectors <=
                    QCOW_MAX_CRYPT_CLUSTERS * s->cluster_sectors);
1489 1490
                qemu_iovec_reset(&hd_qiov);
                qemu_iovec_add(&hd_qiov, cluster_data,
1491 1492 1493 1494 1495
                    512 * cur_nr_sectors);
            }

            BLKDBG_EVENT(bs->file, BLKDBG_READ_AIO);
            qemu_co_mutex_unlock(&s->lock);
K
Kevin Wolf 已提交
1496
            ret = bdrv_co_readv(bs->file->bs,
1497
                                (cluster_offset >> 9) + index_in_cluster,
1498
                                cur_nr_sectors, &hd_qiov);
1499 1500
            qemu_co_mutex_lock(&s->lock);
            if (ret < 0) {
1501
                goto fail;
1502
            }
1503
            if (bs->encrypted) {
1504 1505 1506 1507 1508 1509 1510 1511 1512
                assert(s->cipher);
                Error *err = NULL;
                if (qcow2_encrypt_sectors(s, sector_num,  cluster_data,
                                          cluster_data, cur_nr_sectors, false,
                                          &err) < 0) {
                    error_free(err);
                    ret = -EIO;
                    goto fail;
                }
1513 1514
                qemu_iovec_from_buf(qiov, bytes_done,
                    cluster_data, 512 * cur_nr_sectors);
1515
            }
1516 1517 1518 1519 1520 1521
            break;

        default:
            g_assert_not_reached();
            ret = -EIO;
            goto fail;
1522
        }
1523

1524 1525 1526
        remaining_sectors -= cur_nr_sectors;
        sector_num += cur_nr_sectors;
        bytes_done += cur_nr_sectors * 512;
1527
    }
1528
    ret = 0;
1529

1530
fail:
K
Kevin Wolf 已提交
1531
    qemu_co_mutex_unlock(&s->lock);
K
Kevin Wolf 已提交
1532

1533
    qemu_iovec_destroy(&hd_qiov);
1534
    qemu_vfree(cluster_data);
K
Kevin Wolf 已提交
1535 1536

    return ret;
B
bellard 已提交
1537 1538
}

1539
static coroutine_fn int qcow2_co_writev(BlockDriverState *bs,
1540 1541 1542
                           int64_t sector_num,
                           int remaining_sectors,
                           QEMUIOVector *qiov)
B
bellard 已提交
1543
{
1544
    BDRVQcow2State *s = bs->opaque;
B
bellard 已提交
1545
    int index_in_cluster;
K
Kevin Wolf 已提交
1546
    int ret;
1547
    int cur_nr_sectors; /* number of sectors in current iteration */
1548
    uint64_t cluster_offset;
1549 1550 1551
    QEMUIOVector hd_qiov;
    uint64_t bytes_done = 0;
    uint8_t *cluster_data = NULL;
1552
    QCowL2Meta *l2meta = NULL;
1553

K
Kevin Wolf 已提交
1554 1555 1556
    trace_qcow2_writev_start_req(qemu_coroutine_self(), sector_num,
                                 remaining_sectors);

1557 1558 1559
    qemu_iovec_init(&hd_qiov, qiov->niov);

    s->cluster_cache_offset = -1; /* disable compressed cache */
1560

1561 1562 1563 1564
    qemu_co_mutex_lock(&s->lock);

    while (remaining_sectors != 0) {

1565
        l2meta = NULL;
K
Kevin Wolf 已提交
1566

K
Kevin Wolf 已提交
1567
        trace_qcow2_writev_start_part(qemu_coroutine_self());
1568
        index_in_cluster = sector_num & (s->cluster_sectors - 1);
1569
        cur_nr_sectors = remaining_sectors;
1570
        if (bs->encrypted &&
1571 1572 1573 1574
            cur_nr_sectors >
            QCOW_MAX_CRYPT_CLUSTERS * s->cluster_sectors - index_in_cluster) {
            cur_nr_sectors =
                QCOW_MAX_CRYPT_CLUSTERS * s->cluster_sectors - index_in_cluster;
1575
        }
1576

1577
        ret = qcow2_alloc_cluster_offset(bs, sector_num << 9,
1578
            &cur_nr_sectors, &cluster_offset, &l2meta);
1579
        if (ret < 0) {
1580
            goto fail;
1581
        }
1582

1583
        assert((cluster_offset & 511) == 0);
1584

1585
        qemu_iovec_reset(&hd_qiov);
1586
        qemu_iovec_concat(&hd_qiov, qiov, bytes_done,
1587
            cur_nr_sectors * 512);
1588

1589
        if (bs->encrypted) {
1590 1591
            Error *err = NULL;
            assert(s->cipher);
1592
            if (!cluster_data) {
K
Kevin Wolf 已提交
1593
                cluster_data = qemu_try_blockalign(bs->file->bs,
1594 1595 1596 1597 1598 1599
                                                   QCOW_MAX_CRYPT_CLUSTERS
                                                   * s->cluster_size);
                if (cluster_data == NULL) {
                    ret = -ENOMEM;
                    goto fail;
                }
1600
            }
1601

1602
            assert(hd_qiov.size <=
1603
                   QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size);
1604
            qemu_iovec_to_buf(&hd_qiov, 0, cluster_data, hd_qiov.size);
1605

1606 1607 1608 1609 1610 1611 1612
            if (qcow2_encrypt_sectors(s, sector_num, cluster_data,
                                      cluster_data, cur_nr_sectors,
                                      true, &err) < 0) {
                error_free(err);
                ret = -EIO;
                goto fail;
            }
1613

1614 1615
            qemu_iovec_reset(&hd_qiov);
            qemu_iovec_add(&hd_qiov, cluster_data,
1616 1617
                cur_nr_sectors * 512);
        }
1618

M
Max Reitz 已提交
1619
        ret = qcow2_pre_write_overlap_check(bs, 0,
1620 1621 1622 1623 1624 1625
                cluster_offset + index_in_cluster * BDRV_SECTOR_SIZE,
                cur_nr_sectors * BDRV_SECTOR_SIZE);
        if (ret < 0) {
            goto fail;
        }

1626
        qemu_co_mutex_unlock(&s->lock);
1627
        BLKDBG_EVENT(bs->file, BLKDBG_WRITE_AIO);
K
Kevin Wolf 已提交
1628 1629
        trace_qcow2_writev_data(qemu_coroutine_self(),
                                (cluster_offset >> 9) + index_in_cluster);
K
Kevin Wolf 已提交
1630
        ret = bdrv_co_writev(bs->file->bs,
1631
                             (cluster_offset >> 9) + index_in_cluster,
1632
                             cur_nr_sectors, &hd_qiov);
1633 1634
        qemu_co_mutex_lock(&s->lock);
        if (ret < 0) {
1635
            goto fail;
1636
        }
1637

1638 1639 1640
        while (l2meta != NULL) {
            QCowL2Meta *next;

1641 1642 1643 1644
            ret = qcow2_alloc_cluster_link_l2(bs, l2meta);
            if (ret < 0) {
                goto fail;
            }
1645

1646 1647 1648 1649 1650 1651 1652
            /* Take the request off the list of running requests */
            if (l2meta->nb_clusters != 0) {
                QLIST_REMOVE(l2meta, next_in_flight);
            }

            qemu_co_queue_restart_all(&l2meta->dependent_requests);

1653
            next = l2meta->next;
1654
            g_free(l2meta);
1655
            l2meta = next;
1656
        }
1657

1658 1659 1660
        remaining_sectors -= cur_nr_sectors;
        sector_num += cur_nr_sectors;
        bytes_done += cur_nr_sectors * 512;
K
Kevin Wolf 已提交
1661
        trace_qcow2_writev_done_part(qemu_coroutine_self(), cur_nr_sectors);
1662
    }
1663
    ret = 0;
1664

1665
fail:
1666 1667
    qemu_co_mutex_unlock(&s->lock);

1668 1669 1670
    while (l2meta != NULL) {
        QCowL2Meta *next;

1671 1672 1673 1674
        if (l2meta->nb_clusters != 0) {
            QLIST_REMOVE(l2meta, next_in_flight);
        }
        qemu_co_queue_restart_all(&l2meta->dependent_requests);
1675 1676

        next = l2meta->next;
K
Kevin Wolf 已提交
1677
        g_free(l2meta);
1678
        l2meta = next;
K
Kevin Wolf 已提交
1679
    }
1680

1681
    qemu_iovec_destroy(&hd_qiov);
1682
    qemu_vfree(cluster_data);
K
Kevin Wolf 已提交
1683
    trace_qcow2_writev_done_req(qemu_coroutine_self(), ret);
K
Kevin Wolf 已提交
1684

K
Kevin Wolf 已提交
1685
    return ret;
B
bellard 已提交
1686 1687
}

1688
static void qcow2_close(BlockDriverState *bs)
B
bellard 已提交
1689
{
1690
    BDRVQcow2State *s = bs->opaque;
1691
    qemu_vfree(s->l1_table);
1692 1693
    /* else pre-write overlap checks in cache_destroy may crash */
    s->l1_table = NULL;
K
Kevin Wolf 已提交
1694

1695
    if (!(bs->open_flags & BDRV_O_INCOMING)) {
1696
        int ret1, ret2;
K
Kevin Wolf 已提交
1697

1698 1699 1700 1701 1702 1703 1704 1705 1706 1707 1708 1709 1710 1711 1712
        ret1 = qcow2_cache_flush(bs, s->l2_table_cache);
        ret2 = qcow2_cache_flush(bs, s->refcount_block_cache);

        if (ret1) {
            error_report("Failed to flush the L2 table cache: %s",
                         strerror(-ret1));
        }
        if (ret2) {
            error_report("Failed to flush the refcount block cache: %s",
                         strerror(-ret2));
        }

        if (!ret1 && !ret2) {
            qcow2_mark_clean(bs);
        }
1713
    }
S
Stefan Hajnoczi 已提交
1714

1715
    cache_clean_timer_del(bs);
K
Kevin Wolf 已提交
1716 1717 1718
    qcow2_cache_destroy(bs, s->l2_table_cache);
    qcow2_cache_destroy(bs, s->refcount_block_cache);

1719 1720 1721
    qcrypto_cipher_free(s->cipher);
    s->cipher = NULL;

K
Kevin Wolf 已提交
1722
    g_free(s->unknown_header_fields);
1723
    cleanup_unknown_header_ext(bs);
K
Kevin Wolf 已提交
1724

1725 1726 1727
    g_free(s->image_backing_file);
    g_free(s->image_backing_format);

1728
    g_free(s->cluster_cache);
1729
    qemu_vfree(s->cluster_data);
K
Kevin Wolf 已提交
1730
    qcow2_refcount_close(bs);
1731
    qcow2_free_snapshots(bs);
B
bellard 已提交
1732 1733
}

1734
static void qcow2_invalidate_cache(BlockDriverState *bs, Error **errp)
1735
{
1736
    BDRVQcow2State *s = bs->opaque;
1737
    int flags = s->flags;
1738
    QCryptoCipher *cipher = NULL;
1739
    QDict *options;
1740 1741
    Error *local_err = NULL;
    int ret;
1742 1743 1744 1745 1746 1747

    /*
     * Backing files are read-only which makes all of their metadata immutable,
     * that means we don't have to worry about reopening them here.
     */

1748 1749
    cipher = s->cipher;
    s->cipher = NULL;
1750 1751 1752

    qcow2_close(bs);

K
Kevin Wolf 已提交
1753
    bdrv_invalidate_cache(bs->file->bs, &local_err);
1754 1755 1756 1757
    if (local_err) {
        error_propagate(errp, local_err);
        return;
    }
1758

1759
    memset(s, 0, sizeof(BDRVQcow2State));
1760
    options = qdict_clone_shallow(bs->options);
1761 1762

    ret = qcow2_open(bs, options, flags, &local_err);
1763
    QDECREF(options);
1764 1765 1766 1767 1768 1769 1770 1771 1772
    if (local_err) {
        error_setg(errp, "Could not reopen qcow2 layer: %s",
                   error_get_pretty(local_err));
        error_free(local_err);
        return;
    } else if (ret < 0) {
        error_setg_errno(errp, -ret, "Could not reopen qcow2 layer");
        return;
    }
1773

1774
    s->cipher = cipher;
1775 1776
}

K
Kevin Wolf 已提交
1777 1778 1779 1780 1781 1782 1783 1784 1785 1786 1787 1788 1789 1790 1791 1792 1793 1794 1795
static size_t header_ext_add(char *buf, uint32_t magic, const void *s,
    size_t len, size_t buflen)
{
    QCowExtension *ext_backing_fmt = (QCowExtension*) buf;
    size_t ext_len = sizeof(QCowExtension) + ((len + 7) & ~7);

    if (buflen < ext_len) {
        return -ENOSPC;
    }

    *ext_backing_fmt = (QCowExtension) {
        .magic  = cpu_to_be32(magic),
        .len    = cpu_to_be32(len),
    };
    memcpy(buf + sizeof(QCowExtension), s, len);

    return ext_len;
}

K
Kevin Wolf 已提交
1796
/*
K
Kevin Wolf 已提交
1797 1798 1799 1800
 * Updates the qcow2 header, including the variable length parts of it, i.e.
 * the backing file name and all extensions. qcow2 was not designed to allow
 * such changes, so if we run out of space (we can only use the first cluster)
 * this function may fail.
K
Kevin Wolf 已提交
1801 1802 1803
 *
 * Returns 0 on success, -errno in error cases.
 */
K
Kevin Wolf 已提交
1804
int qcow2_update_header(BlockDriverState *bs)
K
Kevin Wolf 已提交
1805
{
1806
    BDRVQcow2State *s = bs->opaque;
K
Kevin Wolf 已提交
1807 1808 1809
    QCowHeader *header;
    char *buf;
    size_t buflen = s->cluster_size;
K
Kevin Wolf 已提交
1810
    int ret;
K
Kevin Wolf 已提交
1811 1812
    uint64_t total_size;
    uint32_t refcount_table_clusters;
K
Kevin Wolf 已提交
1813
    size_t header_length;
1814
    Qcow2UnknownHeaderExtension *uext;
K
Kevin Wolf 已提交
1815

K
Kevin Wolf 已提交
1816
    buf = qemu_blockalign(bs, buflen);
K
Kevin Wolf 已提交
1817

K
Kevin Wolf 已提交
1818 1819
    /* Header structure */
    header = (QCowHeader*) buf;
K
Kevin Wolf 已提交
1820

K
Kevin Wolf 已提交
1821 1822 1823
    if (buflen < sizeof(*header)) {
        ret = -ENOSPC;
        goto fail;
K
Kevin Wolf 已提交
1824 1825
    }

K
Kevin Wolf 已提交
1826
    header_length = sizeof(*header) + s->unknown_header_fields_size;
K
Kevin Wolf 已提交
1827 1828 1829 1830
    total_size = bs->total_sectors * BDRV_SECTOR_SIZE;
    refcount_table_clusters = s->refcount_table_size >> (s->cluster_bits - 3);

    *header = (QCowHeader) {
K
Kevin Wolf 已提交
1831
        /* Version 2 fields */
K
Kevin Wolf 已提交
1832
        .magic                  = cpu_to_be32(QCOW_MAGIC),
K
Kevin Wolf 已提交
1833
        .version                = cpu_to_be32(s->qcow_version),
K
Kevin Wolf 已提交
1834 1835 1836 1837 1838 1839 1840 1841 1842 1843 1844
        .backing_file_offset    = 0,
        .backing_file_size      = 0,
        .cluster_bits           = cpu_to_be32(s->cluster_bits),
        .size                   = cpu_to_be64(total_size),
        .crypt_method           = cpu_to_be32(s->crypt_method_header),
        .l1_size                = cpu_to_be32(s->l1_size),
        .l1_table_offset        = cpu_to_be64(s->l1_table_offset),
        .refcount_table_offset  = cpu_to_be64(s->refcount_table_offset),
        .refcount_table_clusters = cpu_to_be32(refcount_table_clusters),
        .nb_snapshots           = cpu_to_be32(s->nb_snapshots),
        .snapshots_offset       = cpu_to_be64(s->snapshots_offset),
K
Kevin Wolf 已提交
1845 1846 1847 1848 1849

        /* Version 3 fields */
        .incompatible_features  = cpu_to_be64(s->incompatible_features),
        .compatible_features    = cpu_to_be64(s->compatible_features),
        .autoclear_features     = cpu_to_be64(s->autoclear_features),
1850
        .refcount_order         = cpu_to_be32(s->refcount_order),
K
Kevin Wolf 已提交
1851
        .header_length          = cpu_to_be32(header_length),
K
Kevin Wolf 已提交
1852
    };
K
Kevin Wolf 已提交
1853

K
Kevin Wolf 已提交
1854 1855 1856 1857 1858 1859 1860 1861 1862
    /* For older versions, write a shorter header */
    switch (s->qcow_version) {
    case 2:
        ret = offsetof(QCowHeader, incompatible_features);
        break;
    case 3:
        ret = sizeof(*header);
        break;
    default:
1863 1864
        ret = -EINVAL;
        goto fail;
K
Kevin Wolf 已提交
1865 1866 1867 1868 1869 1870 1871 1872 1873 1874 1875 1876 1877 1878 1879 1880 1881
    }

    buf += ret;
    buflen -= ret;
    memset(buf, 0, buflen);

    /* Preserve any unknown field in the header */
    if (s->unknown_header_fields_size) {
        if (buflen < s->unknown_header_fields_size) {
            ret = -ENOSPC;
            goto fail;
        }

        memcpy(buf, s->unknown_header_fields, s->unknown_header_fields_size);
        buf += s->unknown_header_fields_size;
        buflen -= s->unknown_header_fields_size;
    }
K
Kevin Wolf 已提交
1882

K
Kevin Wolf 已提交
1883
    /* Backing file format header extension */
1884
    if (s->image_backing_format) {
K
Kevin Wolf 已提交
1885
        ret = header_ext_add(buf, QCOW2_EXT_MAGIC_BACKING_FORMAT,
1886 1887
                             s->image_backing_format,
                             strlen(s->image_backing_format),
K
Kevin Wolf 已提交
1888 1889 1890
                             buflen);
        if (ret < 0) {
            goto fail;
K
Kevin Wolf 已提交
1891 1892
        }

K
Kevin Wolf 已提交
1893 1894
        buf += ret;
        buflen -= ret;
K
Kevin Wolf 已提交
1895 1896
    }

1897 1898
    /* Feature table */
    Qcow2Feature features[] = {
S
Stefan Hajnoczi 已提交
1899 1900 1901 1902 1903
        {
            .type = QCOW2_FEAT_TYPE_INCOMPATIBLE,
            .bit  = QCOW2_INCOMPAT_DIRTY_BITNR,
            .name = "dirty bit",
        },
M
Max Reitz 已提交
1904 1905 1906 1907 1908
        {
            .type = QCOW2_FEAT_TYPE_INCOMPATIBLE,
            .bit  = QCOW2_INCOMPAT_CORRUPT_BITNR,
            .name = "corrupt bit",
        },
1909 1910 1911 1912 1913
        {
            .type = QCOW2_FEAT_TYPE_COMPATIBLE,
            .bit  = QCOW2_COMPAT_LAZY_REFCOUNTS_BITNR,
            .name = "lazy refcounts",
        },
1914 1915 1916 1917 1918 1919 1920 1921 1922 1923
    };

    ret = header_ext_add(buf, QCOW2_EXT_MAGIC_FEATURE_TABLE,
                         features, sizeof(features), buflen);
    if (ret < 0) {
        goto fail;
    }
    buf += ret;
    buflen -= ret;

1924 1925 1926 1927 1928 1929 1930 1931 1932 1933 1934
    /* Keep unknown header extensions */
    QLIST_FOREACH(uext, &s->unknown_header_ext, next) {
        ret = header_ext_add(buf, uext->magic, uext->data, uext->len, buflen);
        if (ret < 0) {
            goto fail;
        }

        buf += ret;
        buflen -= ret;
    }

K
Kevin Wolf 已提交
1935 1936
    /* End of header extensions */
    ret = header_ext_add(buf, QCOW2_EXT_MAGIC_END, NULL, 0, buflen);
K
Kevin Wolf 已提交
1937 1938 1939 1940
    if (ret < 0) {
        goto fail;
    }

K
Kevin Wolf 已提交
1941 1942
    buf += ret;
    buflen -= ret;
K
Kevin Wolf 已提交
1943

K
Kevin Wolf 已提交
1944
    /* Backing file name */
1945 1946
    if (s->image_backing_file) {
        size_t backing_file_len = strlen(s->image_backing_file);
K
Kevin Wolf 已提交
1947 1948 1949 1950 1951 1952

        if (buflen < backing_file_len) {
            ret = -ENOSPC;
            goto fail;
        }

1953
        /* Using strncpy is ok here, since buf is not NUL-terminated. */
1954
        strncpy(buf, s->image_backing_file, buflen);
K
Kevin Wolf 已提交
1955 1956 1957

        header->backing_file_offset = cpu_to_be64(buf - ((char*) header));
        header->backing_file_size   = cpu_to_be32(backing_file_len);
K
Kevin Wolf 已提交
1958 1959
    }

K
Kevin Wolf 已提交
1960
    /* Write the new header */
K
Kevin Wolf 已提交
1961
    ret = bdrv_pwrite(bs->file->bs, 0, header, s->cluster_size);
K
Kevin Wolf 已提交
1962 1963 1964 1965 1966 1967
    if (ret < 0) {
        goto fail;
    }

    ret = 0;
fail:
K
Kevin Wolf 已提交
1968
    qemu_vfree(header);
K
Kevin Wolf 已提交
1969 1970 1971 1972 1973 1974
    return ret;
}

static int qcow2_change_backing_file(BlockDriverState *bs,
    const char *backing_file, const char *backing_fmt)
{
1975
    BDRVQcow2State *s = bs->opaque;
1976

K
Kevin Wolf 已提交
1977 1978 1979
    pstrcpy(bs->backing_file, sizeof(bs->backing_file), backing_file ?: "");
    pstrcpy(bs->backing_format, sizeof(bs->backing_format), backing_fmt ?: "");

1980 1981 1982 1983 1984 1985
    g_free(s->image_backing_file);
    g_free(s->image_backing_format);

    s->image_backing_file = backing_file ? g_strdup(bs->backing_file) : NULL;
    s->image_backing_format = backing_fmt ? g_strdup(bs->backing_format) : NULL;

K
Kevin Wolf 已提交
1986
    return qcow2_update_header(bs);
K
Kevin Wolf 已提交
1987 1988
}

K
Kevin Wolf 已提交
1989 1990 1991 1992
static int preallocate(BlockDriverState *bs)
{
    uint64_t nb_sectors;
    uint64_t offset;
K
Kevin Wolf 已提交
1993
    uint64_t host_offset = 0;
K
Kevin Wolf 已提交
1994
    int num;
1995
    int ret;
1996
    QCowL2Meta *meta;
K
Kevin Wolf 已提交
1997

1998
    nb_sectors = bdrv_nb_sectors(bs);
K
Kevin Wolf 已提交
1999 2000 2001
    offset = 0;

    while (nb_sectors) {
H
Hu Tao 已提交
2002
        num = MIN(nb_sectors, INT_MAX >> BDRV_SECTOR_BITS);
2003
        ret = qcow2_alloc_cluster_offset(bs, offset, &num,
K
Kevin Wolf 已提交
2004
                                         &host_offset, &meta);
2005
        if (ret < 0) {
2006
            return ret;
K
Kevin Wolf 已提交
2007 2008
        }

2009 2010 2011
        while (meta) {
            QCowL2Meta *next = meta->next;

H
Hu Tao 已提交
2012 2013 2014 2015 2016 2017 2018 2019 2020
            ret = qcow2_alloc_cluster_link_l2(bs, meta);
            if (ret < 0) {
                qcow2_free_any_clusters(bs, meta->alloc_offset,
                                        meta->nb_clusters, QCOW2_DISCARD_NEVER);
                return ret;
            }

            /* There are no dependent requests, but we need to remove our
             * request from the list of in-flight requests */
2021
            QLIST_REMOVE(meta, next_in_flight);
2022 2023 2024

            g_free(meta);
            meta = next;
2025
        }
2026

K
Kevin Wolf 已提交
2027 2028 2029
        /* TODO Preallocate data if requested */

        nb_sectors -= num;
H
Hu Tao 已提交
2030
        offset += num << BDRV_SECTOR_BITS;
K
Kevin Wolf 已提交
2031 2032 2033 2034 2035 2036 2037
    }

    /*
     * It is expected that the image file is large enough to actually contain
     * all of the allocated clusters (otherwise we get failing reads after
     * EOF). Extend the image to the last allocated sector.
     */
K
Kevin Wolf 已提交
2038
    if (host_offset != 0) {
H
Hu Tao 已提交
2039 2040
        uint8_t buf[BDRV_SECTOR_SIZE];
        memset(buf, 0, BDRV_SECTOR_SIZE);
K
Kevin Wolf 已提交
2041 2042
        ret = bdrv_write(bs->file->bs,
                         (host_offset >> BDRV_SECTOR_BITS) + num - 1,
H
Hu Tao 已提交
2043
                         buf, 1);
2044 2045 2046
        if (ret < 0) {
            return ret;
        }
K
Kevin Wolf 已提交
2047 2048 2049 2050 2051
    }

    return 0;
}

2052 2053
static int qcow2_create2(const char *filename, int64_t total_size,
                         const char *backing_file, const char *backing_format,
2054
                         int flags, size_t cluster_size, PreallocMode prealloc,
2055
                         QemuOpts *opts, int version, int refcount_order,
M
Max Reitz 已提交
2056
                         Error **errp)
K
Kevin Wolf 已提交
2057 2058
{
    int cluster_bits;
2059 2060 2061
    QDict *options;

    /* Calculate cluster_bits */
2062
    cluster_bits = ctz32(cluster_size);
K
Kevin Wolf 已提交
2063 2064 2065
    if (cluster_bits < MIN_CLUSTER_BITS || cluster_bits > MAX_CLUSTER_BITS ||
        (1 << cluster_bits) != cluster_size)
    {
M
Max Reitz 已提交
2066 2067
        error_setg(errp, "Cluster size must be a power of two between %d and "
                   "%dk", 1 << MIN_CLUSTER_BITS, 1 << (MAX_CLUSTER_BITS - 10));
K
Kevin Wolf 已提交
2068 2069 2070 2071 2072 2073 2074 2075 2076 2077 2078 2079 2080 2081 2082 2083
        return -EINVAL;
    }

    /*
     * Open the image file and write a minimal qcow2 header.
     *
     * We keep things simple and start with a zero-sized image. We also
     * do without refcount blocks or a L1 table for now. We'll fix the
     * inconsistency later.
     *
     * We do need a refcount table because growing the refcount table means
     * allocating two new refcount blocks - the seconds of which would be at
     * 2 GB for 64k clusters, and we don't want to have a 2 GB initial file
     * size for any qcow2 image.
     */
    BlockDriverState* bs;
2084
    QCowHeader *header;
2085
    uint64_t* refcount_table;
M
Max Reitz 已提交
2086
    Error *local_err = NULL;
K
Kevin Wolf 已提交
2087 2088
    int ret;

2089
    if (prealloc == PREALLOC_MODE_FULL || prealloc == PREALLOC_MODE_FALLOC) {
2090 2091 2092 2093 2094
        /* Note: The following calculation does not need to be exact; if it is a
         * bit off, either some bytes will be "leaked" (which is fine) or we
         * will need to increase the file size by some bytes (which is fine,
         * too, as long as the bulk is allocated here). Therefore, using
         * floating point arithmetic is fine. */
2095 2096 2097
        int64_t meta_size = 0;
        uint64_t nreftablee, nrefblocke, nl1e, nl2e;
        int64_t aligned_total_size = align_offset(total_size, cluster_size);
2098 2099 2100 2101 2102 2103 2104
        int refblock_bits, refblock_size;
        /* refcount entry size in bytes */
        double rces = (1 << refcount_order) / 8.;

        /* see qcow2_open() */
        refblock_bits = cluster_bits - (refcount_order - 3);
        refblock_size = 1 << refblock_bits;
2105 2106 2107 2108 2109 2110 2111 2112 2113 2114 2115 2116 2117 2118 2119 2120 2121 2122 2123 2124 2125 2126 2127 2128

        /* header: 1 cluster */
        meta_size += cluster_size;

        /* total size of L2 tables */
        nl2e = aligned_total_size / cluster_size;
        nl2e = align_offset(nl2e, cluster_size / sizeof(uint64_t));
        meta_size += nl2e * sizeof(uint64_t);

        /* total size of L1 tables */
        nl1e = nl2e * sizeof(uint64_t) / cluster_size;
        nl1e = align_offset(nl1e, cluster_size / sizeof(uint64_t));
        meta_size += nl1e * sizeof(uint64_t);

        /* total size of refcount blocks
         *
         * note: every host cluster is reference-counted, including metadata
         * (even refcount blocks are recursively included).
         * Let:
         *   a = total_size (this is the guest disk size)
         *   m = meta size not including refcount blocks and refcount tables
         *   c = cluster size
         *   y1 = number of refcount blocks entries
         *   y2 = meta size including everything
2129
         *   rces = refcount entry size in bytes
2130 2131
         * then,
         *   y1 = (y2 + a)/c
2132
         *   y2 = y1 * rces + y1 * rces * sizeof(u64) / c + m
2133
         * we can get y1:
2134
         *   y1 = (a + m) / (c - rces - rces * sizeof(u64) / c)
2135
         */
2136 2137 2138 2139
        nrefblocke = (aligned_total_size + meta_size + cluster_size)
                   / (cluster_size - rces - rces * sizeof(uint64_t)
                                                 / cluster_size);
        meta_size += DIV_ROUND_UP(nrefblocke, refblock_size) * cluster_size;
2140 2141

        /* total size of refcount tables */
2142
        nreftablee = nrefblocke / refblock_size;
2143 2144 2145 2146
        nreftablee = align_offset(nreftablee, cluster_size / sizeof(uint64_t));
        meta_size += nreftablee * sizeof(uint64_t);

        qemu_opt_set_number(opts, BLOCK_OPT_SIZE,
2147
                            aligned_total_size + meta_size, &error_abort);
2148 2149
        qemu_opt_set(opts, BLOCK_OPT_PREALLOC, PreallocMode_lookup[prealloc],
                     &error_abort);
2150 2151
    }

C
Chunyan Liu 已提交
2152
    ret = bdrv_create_file(filename, opts, &local_err);
K
Kevin Wolf 已提交
2153
    if (ret < 0) {
M
Max Reitz 已提交
2154
        error_propagate(errp, local_err);
K
Kevin Wolf 已提交
2155 2156 2157
        return ret;
    }

M
Max Reitz 已提交
2158 2159
    bs = NULL;
    ret = bdrv_open(&bs, filename, NULL, NULL, BDRV_O_RDWR | BDRV_O_PROTOCOL,
2160
                    &local_err);
K
Kevin Wolf 已提交
2161
    if (ret < 0) {
M
Max Reitz 已提交
2162
        error_propagate(errp, local_err);
K
Kevin Wolf 已提交
2163 2164 2165 2166
        return ret;
    }

    /* Write the header */
2167 2168 2169 2170 2171 2172 2173 2174 2175 2176 2177
    QEMU_BUILD_BUG_ON((1 << MIN_CLUSTER_BITS) < sizeof(*header));
    header = g_malloc0(cluster_size);
    *header = (QCowHeader) {
        .magic                      = cpu_to_be32(QCOW_MAGIC),
        .version                    = cpu_to_be32(version),
        .cluster_bits               = cpu_to_be32(cluster_bits),
        .size                       = cpu_to_be64(0),
        .l1_table_offset            = cpu_to_be64(0),
        .l1_size                    = cpu_to_be32(0),
        .refcount_table_offset      = cpu_to_be64(cluster_size),
        .refcount_table_clusters    = cpu_to_be32(1),
2178
        .refcount_order             = cpu_to_be32(refcount_order),
2179 2180
        .header_length              = cpu_to_be32(sizeof(*header)),
    };
K
Kevin Wolf 已提交
2181 2182

    if (flags & BLOCK_FLAG_ENCRYPT) {
2183
        header->crypt_method = cpu_to_be32(QCOW_CRYPT_AES);
K
Kevin Wolf 已提交
2184
    } else {
2185
        header->crypt_method = cpu_to_be32(QCOW_CRYPT_NONE);
K
Kevin Wolf 已提交
2186 2187
    }

2188
    if (flags & BLOCK_FLAG_LAZY_REFCOUNTS) {
2189
        header->compatible_features |=
2190 2191 2192
            cpu_to_be64(QCOW2_COMPAT_LAZY_REFCOUNTS);
    }

2193 2194
    ret = bdrv_pwrite(bs, 0, header, cluster_size);
    g_free(header);
K
Kevin Wolf 已提交
2195
    if (ret < 0) {
M
Max Reitz 已提交
2196
        error_setg_errno(errp, -ret, "Could not write qcow2 header");
K
Kevin Wolf 已提交
2197 2198 2199
        goto out;
    }

2200 2201 2202 2203
    /* Write a refcount table with one refcount block */
    refcount_table = g_malloc0(2 * cluster_size);
    refcount_table[0] = cpu_to_be64(2 * cluster_size);
    ret = bdrv_pwrite(bs, cluster_size, refcount_table, 2 * cluster_size);
2204
    g_free(refcount_table);
K
Kevin Wolf 已提交
2205 2206

    if (ret < 0) {
M
Max Reitz 已提交
2207
        error_setg_errno(errp, -ret, "Could not write refcount table");
K
Kevin Wolf 已提交
2208 2209 2210
        goto out;
    }

2211 2212
    bdrv_unref(bs);
    bs = NULL;
K
Kevin Wolf 已提交
2213 2214 2215 2216 2217 2218

    /*
     * And now open the image and make it consistent first (i.e. increase the
     * refcount of the cluster that is occupied by the header and the refcount
     * table)
     */
2219 2220 2221
    options = qdict_new();
    qdict_put(options, "driver", qstring_from_str("qcow2"));
    ret = bdrv_open(&bs, filename, NULL, options,
2222
                    BDRV_O_RDWR | BDRV_O_CACHE_WB | BDRV_O_NO_FLUSH,
2223
                    &local_err);
K
Kevin Wolf 已提交
2224
    if (ret < 0) {
M
Max Reitz 已提交
2225
        error_propagate(errp, local_err);
K
Kevin Wolf 已提交
2226 2227 2228
        goto out;
    }

2229
    ret = qcow2_alloc_clusters(bs, 3 * cluster_size);
K
Kevin Wolf 已提交
2230
    if (ret < 0) {
M
Max Reitz 已提交
2231 2232
        error_setg_errno(errp, -ret, "Could not allocate clusters for qcow2 "
                         "header and refcount table");
K
Kevin Wolf 已提交
2233 2234 2235 2236 2237 2238 2239 2240
        goto out;

    } else if (ret != 0) {
        error_report("Huh, first cluster in empty image is already in use?");
        abort();
    }

    /* Okay, now that we have a valid image, let's give it the right size */
2241
    ret = bdrv_truncate(bs, total_size);
K
Kevin Wolf 已提交
2242
    if (ret < 0) {
M
Max Reitz 已提交
2243
        error_setg_errno(errp, -ret, "Could not resize image");
K
Kevin Wolf 已提交
2244 2245 2246 2247 2248 2249 2250
        goto out;
    }

    /* Want a backing file? There you go.*/
    if (backing_file) {
        ret = bdrv_change_backing_file(bs, backing_file, backing_format);
        if (ret < 0) {
M
Max Reitz 已提交
2251 2252
            error_setg_errno(errp, -ret, "Could not assign backing file '%s' "
                             "with format '%s'", backing_file, backing_format);
K
Kevin Wolf 已提交
2253 2254 2255 2256 2257
            goto out;
        }
    }

    /* And if we're supposed to preallocate metadata, do that now */
2258
    if (prealloc != PREALLOC_MODE_OFF) {
2259
        BDRVQcow2State *s = bs->opaque;
Z
Zhi Yong Wu 已提交
2260
        qemu_co_mutex_lock(&s->lock);
K
Kevin Wolf 已提交
2261
        ret = preallocate(bs);
Z
Zhi Yong Wu 已提交
2262
        qemu_co_mutex_unlock(&s->lock);
K
Kevin Wolf 已提交
2263
        if (ret < 0) {
M
Max Reitz 已提交
2264
            error_setg_errno(errp, -ret, "Could not preallocate metadata");
K
Kevin Wolf 已提交
2265 2266 2267 2268
            goto out;
        }
    }

2269 2270
    bdrv_unref(bs);
    bs = NULL;
M
Max Reitz 已提交
2271 2272

    /* Reopen the image without BDRV_O_NO_FLUSH to flush it before returning */
2273 2274 2275
    options = qdict_new();
    qdict_put(options, "driver", qstring_from_str("qcow2"));
    ret = bdrv_open(&bs, filename, NULL, options,
2276
                    BDRV_O_RDWR | BDRV_O_CACHE_WB | BDRV_O_NO_BACKING,
2277
                    &local_err);
2278
    if (local_err) {
M
Max Reitz 已提交
2279 2280 2281 2282
        error_propagate(errp, local_err);
        goto out;
    }

K
Kevin Wolf 已提交
2283 2284
    ret = 0;
out:
2285 2286 2287
    if (bs) {
        bdrv_unref(bs);
    }
K
Kevin Wolf 已提交
2288 2289
    return ret;
}
K
Kevin Wolf 已提交
2290

2291
static int qcow2_create(const char *filename, QemuOpts *opts, Error **errp)
K
Kevin Wolf 已提交
2292
{
2293 2294 2295
    char *backing_file = NULL;
    char *backing_fmt = NULL;
    char *buf = NULL;
2296
    uint64_t size = 0;
K
Kevin Wolf 已提交
2297
    int flags = 0;
2298
    size_t cluster_size = DEFAULT_CLUSTER_SIZE;
2299
    PreallocMode prealloc;
2300
    int version = 3;
2301 2302
    uint64_t refcount_bits = 16;
    int refcount_order;
M
Max Reitz 已提交
2303 2304
    Error *local_err = NULL;
    int ret;
K
Kevin Wolf 已提交
2305 2306

    /* Read out options */
2307 2308
    size = ROUND_UP(qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0),
                    BDRV_SECTOR_SIZE);
2309 2310 2311 2312 2313 2314 2315 2316
    backing_file = qemu_opt_get_del(opts, BLOCK_OPT_BACKING_FILE);
    backing_fmt = qemu_opt_get_del(opts, BLOCK_OPT_BACKING_FMT);
    if (qemu_opt_get_bool_del(opts, BLOCK_OPT_ENCRYPT, false)) {
        flags |= BLOCK_FLAG_ENCRYPT;
    }
    cluster_size = qemu_opt_get_size_del(opts, BLOCK_OPT_CLUSTER_SIZE,
                                         DEFAULT_CLUSTER_SIZE);
    buf = qemu_opt_get_del(opts, BLOCK_OPT_PREALLOC);
2317
    prealloc = qapi_enum_parse(PreallocMode_lookup, buf,
2318
                               PREALLOC_MODE__MAX, PREALLOC_MODE_OFF,
2319 2320 2321
                               &local_err);
    if (local_err) {
        error_propagate(errp, local_err);
2322 2323 2324 2325 2326 2327 2328 2329 2330 2331 2332 2333 2334 2335 2336 2337 2338 2339 2340
        ret = -EINVAL;
        goto finish;
    }
    g_free(buf);
    buf = qemu_opt_get_del(opts, BLOCK_OPT_COMPAT_LEVEL);
    if (!buf) {
        /* keep the default */
    } else if (!strcmp(buf, "0.10")) {
        version = 2;
    } else if (!strcmp(buf, "1.1")) {
        version = 3;
    } else {
        error_setg(errp, "Invalid compatibility level: '%s'", buf);
        ret = -EINVAL;
        goto finish;
    }

    if (qemu_opt_get_bool_del(opts, BLOCK_OPT_LAZY_REFCOUNTS, false)) {
        flags |= BLOCK_FLAG_LAZY_REFCOUNTS;
K
Kevin Wolf 已提交
2341 2342
    }

2343
    if (backing_file && prealloc != PREALLOC_MODE_OFF) {
M
Max Reitz 已提交
2344 2345
        error_setg(errp, "Backing file and preallocation cannot be used at "
                   "the same time");
2346 2347
        ret = -EINVAL;
        goto finish;
K
Kevin Wolf 已提交
2348 2349
    }

2350
    if (version < 3 && (flags & BLOCK_FLAG_LAZY_REFCOUNTS)) {
M
Max Reitz 已提交
2351 2352
        error_setg(errp, "Lazy refcounts only supported with compatibility "
                   "level 1.1 and above (use compat=1.1 or greater)");
2353 2354
        ret = -EINVAL;
        goto finish;
2355 2356
    }

2357 2358 2359 2360 2361 2362 2363 2364 2365
    refcount_bits = qemu_opt_get_number_del(opts, BLOCK_OPT_REFCOUNT_BITS,
                                            refcount_bits);
    if (refcount_bits > 64 || !is_power_of_2(refcount_bits)) {
        error_setg(errp, "Refcount width must be a power of two and may not "
                   "exceed 64 bits");
        ret = -EINVAL;
        goto finish;
    }

2366 2367 2368 2369 2370 2371 2372 2373
    if (version < 3 && refcount_bits != 16) {
        error_setg(errp, "Different refcount widths than 16 bits require "
                   "compatibility level 1.1 or above (use compat=1.1 or "
                   "greater)");
        ret = -EINVAL;
        goto finish;
    }

2374
    refcount_order = ctz32(refcount_bits);
2375

2376
    ret = qcow2_create2(filename, size, backing_file, backing_fmt, flags,
2377 2378
                        cluster_size, prealloc, opts, version, refcount_order,
                        &local_err);
2379
    if (local_err) {
M
Max Reitz 已提交
2380 2381
        error_propagate(errp, local_err);
    }
2382 2383 2384 2385 2386

finish:
    g_free(backing_file);
    g_free(backing_fmt);
    g_free(buf);
M
Max Reitz 已提交
2387
    return ret;
K
Kevin Wolf 已提交
2388 2389
}

K
Kevin Wolf 已提交
2390
static coroutine_fn int qcow2_co_write_zeroes(BlockDriverState *bs,
2391
    int64_t sector_num, int nb_sectors, BdrvRequestFlags flags)
K
Kevin Wolf 已提交
2392 2393
{
    int ret;
2394
    BDRVQcow2State *s = bs->opaque;
K
Kevin Wolf 已提交
2395 2396 2397 2398 2399 2400 2401 2402 2403 2404 2405 2406 2407 2408 2409

    /* Emulate misaligned zero writes */
    if (sector_num % s->cluster_sectors || nb_sectors % s->cluster_sectors) {
        return -ENOTSUP;
    }

    /* Whatever is left can use real zero clusters */
    qemu_co_mutex_lock(&s->lock);
    ret = qcow2_zero_clusters(bs, sector_num << BDRV_SECTOR_BITS,
        nb_sectors);
    qemu_co_mutex_unlock(&s->lock);

    return ret;
}

2410 2411
static coroutine_fn int qcow2_co_discard(BlockDriverState *bs,
    int64_t sector_num, int nb_sectors)
K
Kevin Wolf 已提交
2412
{
2413
    int ret;
2414
    BDRVQcow2State *s = bs->opaque;
2415 2416 2417

    qemu_co_mutex_lock(&s->lock);
    ret = qcow2_discard_clusters(bs, sector_num << BDRV_SECTOR_BITS,
M
Max Reitz 已提交
2418
        nb_sectors, QCOW2_DISCARD_REQUEST, false);
2419 2420
    qemu_co_mutex_unlock(&s->lock);
    return ret;
K
Kevin Wolf 已提交
2421 2422
}

2423 2424
static int qcow2_truncate(BlockDriverState *bs, int64_t offset)
{
2425
    BDRVQcow2State *s = bs->opaque;
2426 2427
    int64_t new_l1_size;
    int ret;
2428 2429

    if (offset & 511) {
2430
        error_report("The new size must be a multiple of 512");
2431 2432 2433 2434 2435
        return -EINVAL;
    }

    /* cannot proceed if image has snapshots */
    if (s->nb_snapshots) {
2436
        error_report("Can't resize an image which has snapshots");
2437 2438 2439 2440 2441
        return -ENOTSUP;
    }

    /* shrinking is currently not supported */
    if (offset < bs->total_sectors * 512) {
2442
        error_report("qcow2 doesn't support shrinking images yet");
2443 2444 2445 2446
        return -ENOTSUP;
    }

    new_l1_size = size_to_l1(s, offset);
2447
    ret = qcow2_grow_l1_table(bs, new_l1_size, true);
2448 2449 2450 2451 2452 2453
    if (ret < 0) {
        return ret;
    }

    /* write updated header.size */
    offset = cpu_to_be64(offset);
K
Kevin Wolf 已提交
2454
    ret = bdrv_pwrite_sync(bs->file->bs, offsetof(QCowHeader, size),
2455
                           &offset, sizeof(uint64_t));
2456 2457 2458 2459 2460 2461 2462 2463
    if (ret < 0) {
        return ret;
    }

    s->l1_vm_state_index = new_l1_size;
    return 0;
}

B
Blue Swirl 已提交
2464 2465
/* XXX: put compressed sectors first, then all the cluster aligned
   tables to avoid losing bytes in alignment */
2466 2467
static int qcow2_write_compressed(BlockDriverState *bs, int64_t sector_num,
                                  const uint8_t *buf, int nb_sectors)
B
Blue Swirl 已提交
2468
{
2469
    BDRVQcow2State *s = bs->opaque;
B
Blue Swirl 已提交
2470 2471 2472 2473 2474 2475 2476 2477
    z_stream strm;
    int ret, out_len;
    uint8_t *out_buf;
    uint64_t cluster_offset;

    if (nb_sectors == 0) {
        /* align end of file to a sector boundary to ease reading with
           sector based I/Os */
K
Kevin Wolf 已提交
2478 2479
        cluster_offset = bdrv_getlength(bs->file->bs);
        return bdrv_truncate(bs->file->bs, cluster_offset);
B
Blue Swirl 已提交
2480 2481
    }

2482 2483 2484 2485 2486 2487 2488 2489 2490 2491 2492 2493 2494 2495 2496
    if (nb_sectors != s->cluster_sectors) {
        ret = -EINVAL;

        /* Zero-pad last write if image size is not cluster aligned */
        if (sector_num + nb_sectors == bs->total_sectors &&
            nb_sectors < s->cluster_sectors) {
            uint8_t *pad_buf = qemu_blockalign(bs, s->cluster_size);
            memset(pad_buf, 0, s->cluster_size);
            memcpy(pad_buf, buf, nb_sectors * BDRV_SECTOR_SIZE);
            ret = qcow2_write_compressed(bs, sector_num,
                                         pad_buf, s->cluster_sectors);
            qemu_vfree(pad_buf);
        }
        return ret;
    }
B
Blue Swirl 已提交
2497

2498
    out_buf = g_malloc(s->cluster_size + (s->cluster_size / 1000) + 128);
B
Blue Swirl 已提交
2499 2500 2501 2502 2503 2504 2505

    /* best compression, small window, no zlib header */
    memset(&strm, 0, sizeof(strm));
    ret = deflateInit2(&strm, Z_DEFAULT_COMPRESSION,
                       Z_DEFLATED, -12,
                       9, Z_DEFAULT_STRATEGY);
    if (ret != 0) {
2506 2507
        ret = -EINVAL;
        goto fail;
B
Blue Swirl 已提交
2508 2509 2510 2511 2512 2513 2514 2515 2516 2517
    }

    strm.avail_in = s->cluster_size;
    strm.next_in = (uint8_t *)buf;
    strm.avail_out = s->cluster_size;
    strm.next_out = out_buf;

    ret = deflate(&strm, Z_FINISH);
    if (ret != Z_STREAM_END && ret != Z_OK) {
        deflateEnd(&strm);
2518 2519
        ret = -EINVAL;
        goto fail;
B
Blue Swirl 已提交
2520 2521 2522 2523 2524 2525 2526
    }
    out_len = strm.next_out - out_buf;

    deflateEnd(&strm);

    if (ret != Z_STREAM_END || out_len >= s->cluster_size) {
        /* could not compress: write normal cluster */
2527 2528 2529 2530
        ret = bdrv_write(bs, sector_num, buf, s->cluster_sectors);
        if (ret < 0) {
            goto fail;
        }
B
Blue Swirl 已提交
2531 2532 2533
    } else {
        cluster_offset = qcow2_alloc_compressed_cluster_offset(bs,
            sector_num << 9, out_len);
2534 2535 2536 2537
        if (!cluster_offset) {
            ret = -EIO;
            goto fail;
        }
B
Blue Swirl 已提交
2538
        cluster_offset &= s->cluster_offset_mask;
2539

M
Max Reitz 已提交
2540
        ret = qcow2_pre_write_overlap_check(bs, 0, cluster_offset, out_len);
2541 2542 2543 2544
        if (ret < 0) {
            goto fail;
        }

2545
        BLKDBG_EVENT(bs->file, BLKDBG_WRITE_COMPRESSED);
K
Kevin Wolf 已提交
2546
        ret = bdrv_pwrite(bs->file->bs, cluster_offset, out_buf, out_len);
2547 2548
        if (ret < 0) {
            goto fail;
B
Blue Swirl 已提交
2549 2550 2551
        }
    }

2552 2553
    ret = 0;
fail:
2554
    g_free(out_buf);
2555
    return ret;
B
Blue Swirl 已提交
2556 2557
}

M
Max Reitz 已提交
2558 2559
static int make_completely_empty(BlockDriverState *bs)
{
2560
    BDRVQcow2State *s = bs->opaque;
M
Max Reitz 已提交
2561 2562 2563 2564 2565 2566 2567 2568 2569 2570 2571 2572 2573 2574 2575 2576 2577 2578 2579 2580 2581 2582 2583 2584 2585 2586 2587 2588 2589 2590 2591 2592 2593 2594
    int ret, l1_clusters;
    int64_t offset;
    uint64_t *new_reftable = NULL;
    uint64_t rt_entry, l1_size2;
    struct {
        uint64_t l1_offset;
        uint64_t reftable_offset;
        uint32_t reftable_clusters;
    } QEMU_PACKED l1_ofs_rt_ofs_cls;

    ret = qcow2_cache_empty(bs, s->l2_table_cache);
    if (ret < 0) {
        goto fail;
    }

    ret = qcow2_cache_empty(bs, s->refcount_block_cache);
    if (ret < 0) {
        goto fail;
    }

    /* Refcounts will be broken utterly */
    ret = qcow2_mark_dirty(bs);
    if (ret < 0) {
        goto fail;
    }

    BLKDBG_EVENT(bs->file, BLKDBG_L1_UPDATE);

    l1_clusters = DIV_ROUND_UP(s->l1_size, s->cluster_size / sizeof(uint64_t));
    l1_size2 = (uint64_t)s->l1_size * sizeof(uint64_t);

    /* After this call, neither the in-memory nor the on-disk refcount
     * information accurately describe the actual references */

K
Kevin Wolf 已提交
2595
    ret = bdrv_write_zeroes(bs->file->bs, s->l1_table_offset / BDRV_SECTOR_SIZE,
M
Max Reitz 已提交
2596 2597 2598 2599 2600 2601 2602 2603 2604 2605 2606 2607 2608
                            l1_clusters * s->cluster_sectors, 0);
    if (ret < 0) {
        goto fail_broken_refcounts;
    }
    memset(s->l1_table, 0, l1_size2);

    BLKDBG_EVENT(bs->file, BLKDBG_EMPTY_IMAGE_PREPARE);

    /* Overwrite enough clusters at the beginning of the sectors to place
     * the refcount table, a refcount block and the L1 table in; this may
     * overwrite parts of the existing refcount and L1 table, which is not
     * an issue because the dirty flag is set, complete data loss is in fact
     * desired and partial data loss is consequently fine as well */
K
Kevin Wolf 已提交
2609
    ret = bdrv_write_zeroes(bs->file->bs, s->cluster_size / BDRV_SECTOR_SIZE,
M
Max Reitz 已提交
2610 2611 2612 2613 2614 2615 2616 2617 2618 2619 2620 2621 2622 2623 2624 2625 2626 2627 2628
                            (2 + l1_clusters) * s->cluster_size /
                            BDRV_SECTOR_SIZE, 0);
    /* This call (even if it failed overall) may have overwritten on-disk
     * refcount structures; in that case, the in-memory refcount information
     * will probably differ from the on-disk information which makes the BDS
     * unusable */
    if (ret < 0) {
        goto fail_broken_refcounts;
    }

    BLKDBG_EVENT(bs->file, BLKDBG_L1_UPDATE);
    BLKDBG_EVENT(bs->file, BLKDBG_REFTABLE_UPDATE);

    /* "Create" an empty reftable (one cluster) directly after the image
     * header and an empty L1 table three clusters after the image header;
     * the cluster between those two will be used as the first refblock */
    cpu_to_be64w(&l1_ofs_rt_ofs_cls.l1_offset, 3 * s->cluster_size);
    cpu_to_be64w(&l1_ofs_rt_ofs_cls.reftable_offset, s->cluster_size);
    cpu_to_be32w(&l1_ofs_rt_ofs_cls.reftable_clusters, 1);
K
Kevin Wolf 已提交
2629
    ret = bdrv_pwrite_sync(bs->file->bs, offsetof(QCowHeader, l1_table_offset),
M
Max Reitz 已提交
2630 2631 2632 2633 2634 2635 2636 2637 2638 2639 2640 2641 2642 2643 2644 2645 2646 2647 2648 2649 2650 2651 2652 2653 2654 2655 2656 2657 2658 2659
                           &l1_ofs_rt_ofs_cls, sizeof(l1_ofs_rt_ofs_cls));
    if (ret < 0) {
        goto fail_broken_refcounts;
    }

    s->l1_table_offset = 3 * s->cluster_size;

    new_reftable = g_try_new0(uint64_t, s->cluster_size / sizeof(uint64_t));
    if (!new_reftable) {
        ret = -ENOMEM;
        goto fail_broken_refcounts;
    }

    s->refcount_table_offset = s->cluster_size;
    s->refcount_table_size   = s->cluster_size / sizeof(uint64_t);

    g_free(s->refcount_table);
    s->refcount_table = new_reftable;
    new_reftable = NULL;

    /* Now the in-memory refcount information again corresponds to the on-disk
     * information (reftable is empty and no refblocks (the refblock cache is
     * empty)); however, this means some clusters (e.g. the image header) are
     * referenced, but not refcounted, but the normal qcow2 code assumes that
     * the in-memory information is always correct */

    BLKDBG_EVENT(bs->file, BLKDBG_REFBLOCK_ALLOC);

    /* Enter the first refblock into the reftable */
    rt_entry = cpu_to_be64(2 * s->cluster_size);
K
Kevin Wolf 已提交
2660
    ret = bdrv_pwrite_sync(bs->file->bs, s->cluster_size,
M
Max Reitz 已提交
2661 2662 2663 2664 2665 2666 2667 2668 2669 2670 2671 2672 2673 2674 2675 2676 2677 2678 2679 2680 2681 2682 2683 2684
                           &rt_entry, sizeof(rt_entry));
    if (ret < 0) {
        goto fail_broken_refcounts;
    }
    s->refcount_table[0] = 2 * s->cluster_size;

    s->free_cluster_index = 0;
    assert(3 + l1_clusters <= s->refcount_block_size);
    offset = qcow2_alloc_clusters(bs, 3 * s->cluster_size + l1_size2);
    if (offset < 0) {
        ret = offset;
        goto fail_broken_refcounts;
    } else if (offset > 0) {
        error_report("First cluster in emptied image is in use");
        abort();
    }

    /* Now finally the in-memory information corresponds to the on-disk
     * structures and is correct */
    ret = qcow2_mark_clean(bs);
    if (ret < 0) {
        goto fail;
    }

K
Kevin Wolf 已提交
2685
    ret = bdrv_truncate(bs->file->bs, (3 + l1_clusters) * s->cluster_size);
M
Max Reitz 已提交
2686 2687 2688 2689 2690 2691 2692 2693 2694 2695 2696 2697 2698 2699 2700 2701 2702 2703 2704 2705
    if (ret < 0) {
        goto fail;
    }

    return 0;

fail_broken_refcounts:
    /* The BDS is unusable at this point. If we wanted to make it usable, we
     * would have to call qcow2_refcount_close(), qcow2_refcount_init(),
     * qcow2_check_refcounts(), qcow2_refcount_close() and qcow2_refcount_init()
     * again. However, because the functions which could have caused this error
     * path to be taken are used by those functions as well, it's very likely
     * that that sequence will fail as well. Therefore, just eject the BDS. */
    bs->drv = NULL;

fail:
    g_free(new_reftable);
    return ret;
}

M
Max Reitz 已提交
2706 2707
static int qcow2_make_empty(BlockDriverState *bs)
{
2708
    BDRVQcow2State *s = bs->opaque;
M
Max Reitz 已提交
2709 2710
    uint64_t start_sector;
    int sector_step = INT_MAX / BDRV_SECTOR_SIZE;
M
Max Reitz 已提交
2711 2712 2713 2714 2715 2716 2717 2718 2719 2720 2721 2722 2723
    int l1_clusters, ret = 0;

    l1_clusters = DIV_ROUND_UP(s->l1_size, s->cluster_size / sizeof(uint64_t));

    if (s->qcow_version >= 3 && !s->snapshots &&
        3 + l1_clusters <= s->refcount_block_size) {
        /* The following function only works for qcow2 v3 images (it requires
         * the dirty flag) and only as long as there are no snapshots (because
         * it completely empties the image). Furthermore, the L1 table and three
         * additional clusters (image header, refcount table, one refcount
         * block) have to fit inside one refcount block. */
        return make_completely_empty(bs);
    }
M
Max Reitz 已提交
2724

M
Max Reitz 已提交
2725 2726
    /* This fallback code simply discards every active cluster; this is slow,
     * but works in all cases */
M
Max Reitz 已提交
2727 2728 2729 2730 2731 2732 2733 2734 2735 2736 2737 2738 2739 2740 2741 2742 2743 2744 2745 2746
    for (start_sector = 0; start_sector < bs->total_sectors;
         start_sector += sector_step)
    {
        /* As this function is generally used after committing an external
         * snapshot, QCOW2_DISCARD_SNAPSHOT seems appropriate. Also, the
         * default action for this kind of discard is to pass the discard,
         * which will ideally result in an actually smaller image file, as
         * is probably desired. */
        ret = qcow2_discard_clusters(bs, start_sector * BDRV_SECTOR_SIZE,
                                     MIN(sector_step,
                                         bs->total_sectors - start_sector),
                                     QCOW2_DISCARD_SNAPSHOT, true);
        if (ret < 0) {
            break;
        }
    }

    return ret;
}

2747
static coroutine_fn int qcow2_co_flush_to_os(BlockDriverState *bs)
B
Blue Swirl 已提交
2748
{
2749
    BDRVQcow2State *s = bs->opaque;
K
Kevin Wolf 已提交
2750 2751
    int ret;

P
Paolo Bonzini 已提交
2752
    qemu_co_mutex_lock(&s->lock);
K
Kevin Wolf 已提交
2753 2754
    ret = qcow2_cache_flush(bs, s->l2_table_cache);
    if (ret < 0) {
D
Dong Xu Wang 已提交
2755
        qemu_co_mutex_unlock(&s->lock);
P
Paolo Bonzini 已提交
2756
        return ret;
K
Kevin Wolf 已提交
2757 2758
    }

2759 2760 2761 2762 2763 2764
    if (qcow2_need_accurate_refcounts(s)) {
        ret = qcow2_cache_flush(bs, s->refcount_block_cache);
        if (ret < 0) {
            qemu_co_mutex_unlock(&s->lock);
            return ret;
        }
K
Kevin Wolf 已提交
2765
    }
P
Paolo Bonzini 已提交
2766
    qemu_co_mutex_unlock(&s->lock);
K
Kevin Wolf 已提交
2767

K
Kevin Wolf 已提交
2768 2769 2770
    return 0;
}

2771
static int qcow2_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
B
Blue Swirl 已提交
2772
{
2773
    BDRVQcow2State *s = bs->opaque;
2774 2775
    bdi->unallocated_blocks_are_zero = true;
    bdi->can_write_zeroes_with_unmap = (s->qcow_version >= 3);
B
Blue Swirl 已提交
2776
    bdi->cluster_size = s->cluster_size;
2777
    bdi->vm_state_offset = qcow2_vm_state_offset(s);
B
Blue Swirl 已提交
2778 2779 2780
    return 0;
}

2781 2782
static ImageInfoSpecific *qcow2_get_specific_info(BlockDriverState *bs)
{
2783
    BDRVQcow2State *s = bs->opaque;
2784 2785 2786
    ImageInfoSpecific *spec_info = g_new(ImageInfoSpecific, 1);

    *spec_info = (ImageInfoSpecific){
2787 2788
        .type  = IMAGE_INFO_SPECIFIC_KIND_QCOW2,
        .u.qcow2 = g_new(ImageInfoSpecificQCow2, 1),
2789 2790
    };
    if (s->qcow_version == 2) {
2791
        *spec_info->u.qcow2 = (ImageInfoSpecificQCow2){
2792 2793
            .compat             = g_strdup("0.10"),
            .refcount_bits      = s->refcount_bits,
2794 2795
        };
    } else if (s->qcow_version == 3) {
2796
        *spec_info->u.qcow2 = (ImageInfoSpecificQCow2){
2797 2798 2799 2800
            .compat             = g_strdup("1.1"),
            .lazy_refcounts     = s->compatible_features &
                                  QCOW2_COMPAT_LAZY_REFCOUNTS,
            .has_lazy_refcounts = true,
2801 2802 2803
            .corrupt            = s->incompatible_features &
                                  QCOW2_INCOMPAT_CORRUPT,
            .has_corrupt        = true,
2804
            .refcount_bits      = s->refcount_bits,
2805 2806 2807 2808 2809 2810
        };
    }

    return spec_info;
}

B
Blue Swirl 已提交
2811 2812 2813
#if 0
static void dump_refcounts(BlockDriverState *bs)
{
2814
    BDRVQcow2State *s = bs->opaque;
B
Blue Swirl 已提交
2815 2816 2817
    int64_t nb_clusters, k, k1, size;
    int refcount;

K
Kevin Wolf 已提交
2818
    size = bdrv_getlength(bs->file->bs);
B
Blue Swirl 已提交
2819 2820 2821 2822 2823 2824 2825
    nb_clusters = size_to_clusters(s, size);
    for(k = 0; k < nb_clusters;) {
        k1 = k;
        refcount = get_refcount(bs, k);
        k++;
        while (k < nb_clusters && get_refcount(bs, k) == refcount)
            k++;
B
Blue Swirl 已提交
2826 2827
        printf("%" PRId64 ": refcount=%d nb=%" PRId64 "\n", k, refcount,
               k - k1);
B
Blue Swirl 已提交
2828 2829 2830 2831
    }
}
#endif

2832 2833
static int qcow2_save_vmstate(BlockDriverState *bs, QEMUIOVector *qiov,
                              int64_t pos)
B
Blue Swirl 已提交
2834
{
2835
    BDRVQcow2State *s = bs->opaque;
2836
    int64_t total_sectors = bs->total_sectors;
2837
    bool zero_beyond_eof = bs->zero_beyond_eof;
B
Blue Swirl 已提交
2838 2839
    int ret;

2840
    BLKDBG_EVENT(bs->file, BLKDBG_VMSTATE_SAVE);
2841
    bs->zero_beyond_eof = false;
2842
    ret = bdrv_pwritev(bs, qcow2_vm_state_offset(s) + pos, qiov);
2843
    bs->zero_beyond_eof = zero_beyond_eof;
B
Blue Swirl 已提交
2844

2845 2846 2847 2848 2849
    /* bdrv_co_do_writev will have increased the total_sectors value to include
     * the VM state - the VM state is however not an actual part of the block
     * device, therefore, we need to restore the old value. */
    bs->total_sectors = total_sectors;

B
Blue Swirl 已提交
2850 2851 2852
    return ret;
}

2853 2854
static int qcow2_load_vmstate(BlockDriverState *bs, uint8_t *buf,
                              int64_t pos, int size)
B
Blue Swirl 已提交
2855
{
2856
    BDRVQcow2State *s = bs->opaque;
A
Asias He 已提交
2857
    bool zero_beyond_eof = bs->zero_beyond_eof;
B
Blue Swirl 已提交
2858 2859
    int ret;

2860
    BLKDBG_EVENT(bs->file, BLKDBG_VMSTATE_LOAD);
A
Asias He 已提交
2861
    bs->zero_beyond_eof = false;
2862
    ret = bdrv_pread(bs, qcow2_vm_state_offset(s) + pos, buf, size);
A
Asias He 已提交
2863
    bs->zero_beyond_eof = zero_beyond_eof;
B
Blue Swirl 已提交
2864 2865 2866 2867

    return ret;
}

M
Max Reitz 已提交
2868 2869 2870 2871
/*
 * Downgrades an image's version. To achieve this, any incompatible features
 * have to be removed.
 */
2872
static int qcow2_downgrade(BlockDriverState *bs, int target_version,
2873
                           BlockDriverAmendStatusCB *status_cb, void *cb_opaque)
M
Max Reitz 已提交
2874
{
2875
    BDRVQcow2State *s = bs->opaque;
M
Max Reitz 已提交
2876 2877 2878 2879 2880 2881 2882 2883 2884 2885 2886 2887 2888 2889 2890 2891 2892
    int current_version = s->qcow_version;
    int ret;

    if (target_version == current_version) {
        return 0;
    } else if (target_version > current_version) {
        return -EINVAL;
    } else if (target_version != 2) {
        return -EINVAL;
    }

    if (s->refcount_order != 4) {
        /* we would have to convert the image to a refcount_order == 4 image
         * here; however, since qemu (at the time of writing this) does not
         * support anything different than 4 anyway, there is no point in doing
         * so right now; however, we should error out (if qemu supports this in
         * the future and this code has not been adapted) */
2893
        error_report("qcow2_downgrade: Image refcount orders other than 4 are "
M
Max Reitz 已提交
2894 2895 2896 2897 2898 2899 2900 2901 2902 2903 2904 2905 2906 2907 2908 2909 2910 2911 2912 2913 2914 2915 2916 2917 2918 2919 2920 2921
                     "currently not supported.");
        return -ENOTSUP;
    }

    /* clear incompatible features */
    if (s->incompatible_features & QCOW2_INCOMPAT_DIRTY) {
        ret = qcow2_mark_clean(bs);
        if (ret < 0) {
            return ret;
        }
    }

    /* with QCOW2_INCOMPAT_CORRUPT, it is pretty much impossible to get here in
     * the first place; if that happens nonetheless, returning -ENOTSUP is the
     * best thing to do anyway */

    if (s->incompatible_features) {
        return -ENOTSUP;
    }

    /* since we can ignore compatible features, we can set them to 0 as well */
    s->compatible_features = 0;
    /* if lazy refcounts have been used, they have already been fixed through
     * clearing the dirty flag */

    /* clearing autoclear features is trivial */
    s->autoclear_features = 0;

2922
    ret = qcow2_expand_zero_clusters(bs, status_cb, cb_opaque);
M
Max Reitz 已提交
2923 2924 2925 2926 2927 2928 2929 2930 2931 2932 2933 2934 2935
    if (ret < 0) {
        return ret;
    }

    s->qcow_version = target_version;
    ret = qcow2_update_header(bs);
    if (ret < 0) {
        s->qcow_version = current_version;
        return ret;
    }
    return 0;
}

2936
static int qcow2_amend_options(BlockDriverState *bs, QemuOpts *opts,
2937 2938
                               BlockDriverAmendStatusCB *status_cb,
                               void *cb_opaque)
M
Max Reitz 已提交
2939
{
2940
    BDRVQcow2State *s = bs->opaque;
M
Max Reitz 已提交
2941 2942 2943 2944
    int old_version = s->qcow_version, new_version = old_version;
    uint64_t new_size = 0;
    const char *backing_file = NULL, *backing_format = NULL;
    bool lazy_refcounts = s->use_lazy_refcounts;
2945 2946 2947
    const char *compat = NULL;
    uint64_t cluster_size = s->cluster_size;
    bool encrypt;
M
Max Reitz 已提交
2948
    int ret;
2949
    QemuOptDesc *desc = opts->list->desc;
M
Max Reitz 已提交
2950

2951 2952
    while (desc && desc->name) {
        if (!qemu_opt_find(opts, desc->name)) {
M
Max Reitz 已提交
2953
            /* only change explicitly defined options */
2954
            desc++;
M
Max Reitz 已提交
2955 2956 2957
            continue;
        }

2958 2959
        if (!strcmp(desc->name, BLOCK_OPT_COMPAT_LEVEL)) {
            compat = qemu_opt_get(opts, BLOCK_OPT_COMPAT_LEVEL);
2960
            if (!compat) {
M
Max Reitz 已提交
2961
                /* preserve default */
2962
            } else if (!strcmp(compat, "0.10")) {
M
Max Reitz 已提交
2963
                new_version = 2;
2964
            } else if (!strcmp(compat, "1.1")) {
M
Max Reitz 已提交
2965 2966
                new_version = 3;
            } else {
2967
                error_report("Unknown compatibility level %s", compat);
M
Max Reitz 已提交
2968 2969
                return -EINVAL;
            }
2970
        } else if (!strcmp(desc->name, BLOCK_OPT_PREALLOC)) {
2971
            error_report("Cannot change preallocation mode");
M
Max Reitz 已提交
2972
            return -ENOTSUP;
2973 2974 2975 2976 2977 2978 2979 2980
        } else if (!strcmp(desc->name, BLOCK_OPT_SIZE)) {
            new_size = qemu_opt_get_size(opts, BLOCK_OPT_SIZE, 0);
        } else if (!strcmp(desc->name, BLOCK_OPT_BACKING_FILE)) {
            backing_file = qemu_opt_get(opts, BLOCK_OPT_BACKING_FILE);
        } else if (!strcmp(desc->name, BLOCK_OPT_BACKING_FMT)) {
            backing_format = qemu_opt_get(opts, BLOCK_OPT_BACKING_FMT);
        } else if (!strcmp(desc->name, BLOCK_OPT_ENCRYPT)) {
            encrypt = qemu_opt_get_bool(opts, BLOCK_OPT_ENCRYPT,
2981 2982 2983
                                        !!s->cipher);

            if (encrypt != !!s->cipher) {
2984
                error_report("Changing the encryption flag is not supported");
M
Max Reitz 已提交
2985 2986
                return -ENOTSUP;
            }
2987 2988
        } else if (!strcmp(desc->name, BLOCK_OPT_CLUSTER_SIZE)) {
            cluster_size = qemu_opt_get_size(opts, BLOCK_OPT_CLUSTER_SIZE,
2989 2990
                                             cluster_size);
            if (cluster_size != s->cluster_size) {
2991
                error_report("Changing the cluster size is not supported");
M
Max Reitz 已提交
2992 2993
                return -ENOTSUP;
            }
2994 2995
        } else if (!strcmp(desc->name, BLOCK_OPT_LAZY_REFCOUNTS)) {
            lazy_refcounts = qemu_opt_get_bool(opts, BLOCK_OPT_LAZY_REFCOUNTS,
2996
                                               lazy_refcounts);
2997 2998 2999
        } else if (!strcmp(desc->name, BLOCK_OPT_REFCOUNT_BITS)) {
            error_report("Cannot change refcount entry width");
            return -ENOTSUP;
M
Max Reitz 已提交
3000
        } else {
3001
            /* if this point is reached, this probably means a new option was
M
Max Reitz 已提交
3002
             * added without having it covered here */
3003
            abort();
M
Max Reitz 已提交
3004
        }
3005 3006

        desc++;
M
Max Reitz 已提交
3007 3008 3009 3010 3011 3012 3013 3014 3015 3016 3017 3018
    }

    if (new_version != old_version) {
        if (new_version > old_version) {
            /* Upgrade */
            s->qcow_version = new_version;
            ret = qcow2_update_header(bs);
            if (ret < 0) {
                s->qcow_version = old_version;
                return ret;
            }
        } else {
3019
            ret = qcow2_downgrade(bs, new_version, status_cb, cb_opaque);
M
Max Reitz 已提交
3020 3021 3022 3023 3024 3025 3026
            if (ret < 0) {
                return ret;
            }
        }
    }

    if (backing_file || backing_format) {
3027 3028 3029
        ret = qcow2_change_backing_file(bs,
                    backing_file ?: s->image_backing_file,
                    backing_format ?: s->image_backing_format);
M
Max Reitz 已提交
3030 3031 3032 3033 3034 3035 3036 3037
        if (ret < 0) {
            return ret;
        }
    }

    if (s->use_lazy_refcounts != lazy_refcounts) {
        if (lazy_refcounts) {
            if (s->qcow_version < 3) {
3038 3039
                error_report("Lazy refcounts only supported with compatibility "
                             "level 1.1 and above (use compat=1.1 or greater)");
M
Max Reitz 已提交
3040 3041 3042 3043 3044 3045 3046 3047 3048 3049 3050 3051 3052 3053 3054 3055 3056 3057 3058 3059 3060 3061 3062 3063 3064 3065 3066 3067 3068 3069 3070 3071 3072 3073 3074 3075
                return -EINVAL;
            }
            s->compatible_features |= QCOW2_COMPAT_LAZY_REFCOUNTS;
            ret = qcow2_update_header(bs);
            if (ret < 0) {
                s->compatible_features &= ~QCOW2_COMPAT_LAZY_REFCOUNTS;
                return ret;
            }
            s->use_lazy_refcounts = true;
        } else {
            /* make image clean first */
            ret = qcow2_mark_clean(bs);
            if (ret < 0) {
                return ret;
            }
            /* now disallow lazy refcounts */
            s->compatible_features &= ~QCOW2_COMPAT_LAZY_REFCOUNTS;
            ret = qcow2_update_header(bs);
            if (ret < 0) {
                s->compatible_features |= QCOW2_COMPAT_LAZY_REFCOUNTS;
                return ret;
            }
            s->use_lazy_refcounts = false;
        }
    }

    if (new_size) {
        ret = bdrv_truncate(bs, new_size);
        if (ret < 0) {
            return ret;
        }
    }

    return 0;
}

M
Max Reitz 已提交
3076 3077 3078 3079 3080 3081 3082 3083 3084
/*
 * If offset or size are negative, respectively, they will not be included in
 * the BLOCK_IMAGE_CORRUPTED event emitted.
 * fatal will be ignored for read-only BDS; corruptions found there will always
 * be considered non-fatal.
 */
void qcow2_signal_corruption(BlockDriverState *bs, bool fatal, int64_t offset,
                             int64_t size, const char *message_format, ...)
{
3085
    BDRVQcow2State *s = bs->opaque;
3086
    const char *node_name;
M
Max Reitz 已提交
3087 3088 3089 3090 3091 3092 3093 3094 3095 3096 3097 3098 3099 3100 3101 3102 3103 3104 3105 3106 3107 3108 3109
    char *message;
    va_list ap;

    fatal = fatal && !bs->read_only;

    if (s->signaled_corruption &&
        (!fatal || (s->incompatible_features & QCOW2_INCOMPAT_CORRUPT)))
    {
        return;
    }

    va_start(ap, message_format);
    message = g_strdup_vprintf(message_format, ap);
    va_end(ap);

    if (fatal) {
        fprintf(stderr, "qcow2: Marking image as corrupt: %s; further "
                "corruption events will be suppressed\n", message);
    } else {
        fprintf(stderr, "qcow2: Image is corrupt: %s; further non-fatal "
                "corruption events will be suppressed\n", message);
    }

3110 3111 3112 3113 3114
    node_name = bdrv_get_node_name(bs);
    qapi_event_send_block_image_corrupted(bdrv_get_device_name(bs),
                                          *node_name != '\0', node_name,
                                          message, offset >= 0, offset,
                                          size >= 0, size,
M
Max Reitz 已提交
3115 3116 3117 3118 3119 3120 3121 3122 3123 3124 3125
                                          fatal, &error_abort);
    g_free(message);

    if (fatal) {
        qcow2_mark_corrupt(bs);
        bs->drv = NULL; /* make BDS unusable */
    }

    s->signaled_corruption = true;
}

3126 3127 3128 3129 3130 3131 3132 3133 3134 3135 3136 3137 3138 3139 3140 3141 3142 3143 3144 3145 3146 3147 3148 3149 3150 3151 3152 3153 3154 3155 3156 3157 3158 3159 3160 3161 3162 3163 3164
static QemuOptsList qcow2_create_opts = {
    .name = "qcow2-create-opts",
    .head = QTAILQ_HEAD_INITIALIZER(qcow2_create_opts.head),
    .desc = {
        {
            .name = BLOCK_OPT_SIZE,
            .type = QEMU_OPT_SIZE,
            .help = "Virtual disk size"
        },
        {
            .name = BLOCK_OPT_COMPAT_LEVEL,
            .type = QEMU_OPT_STRING,
            .help = "Compatibility level (0.10 or 1.1)"
        },
        {
            .name = BLOCK_OPT_BACKING_FILE,
            .type = QEMU_OPT_STRING,
            .help = "File name of a base image"
        },
        {
            .name = BLOCK_OPT_BACKING_FMT,
            .type = QEMU_OPT_STRING,
            .help = "Image format of the base image"
        },
        {
            .name = BLOCK_OPT_ENCRYPT,
            .type = QEMU_OPT_BOOL,
            .help = "Encrypt the image",
            .def_value_str = "off"
        },
        {
            .name = BLOCK_OPT_CLUSTER_SIZE,
            .type = QEMU_OPT_SIZE,
            .help = "qcow2 cluster size",
            .def_value_str = stringify(DEFAULT_CLUSTER_SIZE)
        },
        {
            .name = BLOCK_OPT_PREALLOC,
            .type = QEMU_OPT_STRING,
3165 3166
            .help = "Preallocation mode (allowed values: off, metadata, "
                    "falloc, full)"
3167 3168 3169 3170 3171 3172 3173
        },
        {
            .name = BLOCK_OPT_LAZY_REFCOUNTS,
            .type = QEMU_OPT_BOOL,
            .help = "Postpone refcount updates",
            .def_value_str = "off"
        },
3174 3175 3176 3177 3178 3179
        {
            .name = BLOCK_OPT_REFCOUNT_BITS,
            .type = QEMU_OPT_NUMBER,
            .help = "Width of a reference count entry in bits",
            .def_value_str = "16"
        },
3180 3181
        { /* end of list */ }
    }
B
Blue Swirl 已提交
3182 3183
};

3184
BlockDriver bdrv_qcow2 = {
3185
    .format_name        = "qcow2",
3186
    .instance_size      = sizeof(BDRVQcow2State),
3187 3188 3189
    .bdrv_probe         = qcow2_probe,
    .bdrv_open          = qcow2_open,
    .bdrv_close         = qcow2_close,
J
Jeff Cody 已提交
3190
    .bdrv_reopen_prepare  = qcow2_reopen_prepare,
3191 3192
    .bdrv_reopen_commit   = qcow2_reopen_commit,
    .bdrv_reopen_abort    = qcow2_reopen_abort,
3193
    .bdrv_join_options    = qcow2_join_options,
C
Chunyan Liu 已提交
3194
    .bdrv_create        = qcow2_create,
3195
    .bdrv_has_zero_init = bdrv_has_zero_init_1,
3196
    .bdrv_co_get_block_status = qcow2_co_get_block_status,
3197 3198
    .bdrv_set_key       = qcow2_set_key,

3199 3200
    .bdrv_co_readv          = qcow2_co_readv,
    .bdrv_co_writev         = qcow2_co_writev,
K
Kevin Wolf 已提交
3201
    .bdrv_co_flush_to_os    = qcow2_co_flush_to_os,
3202

K
Kevin Wolf 已提交
3203
    .bdrv_co_write_zeroes   = qcow2_co_write_zeroes,
3204
    .bdrv_co_discard        = qcow2_co_discard,
3205
    .bdrv_truncate          = qcow2_truncate,
3206
    .bdrv_write_compressed  = qcow2_write_compressed,
M
Max Reitz 已提交
3207
    .bdrv_make_empty        = qcow2_make_empty,
B
Blue Swirl 已提交
3208 3209 3210 3211 3212

    .bdrv_snapshot_create   = qcow2_snapshot_create,
    .bdrv_snapshot_goto     = qcow2_snapshot_goto,
    .bdrv_snapshot_delete   = qcow2_snapshot_delete,
    .bdrv_snapshot_list     = qcow2_snapshot_list,
3213 3214
    .bdrv_snapshot_load_tmp = qcow2_snapshot_load_tmp,
    .bdrv_get_info          = qcow2_get_info,
3215
    .bdrv_get_specific_info = qcow2_get_specific_info,
B
Blue Swirl 已提交
3216

3217 3218
    .bdrv_save_vmstate    = qcow2_save_vmstate,
    .bdrv_load_vmstate    = qcow2_load_vmstate,
B
Blue Swirl 已提交
3219

3220
    .supports_backing           = true,
B
Blue Swirl 已提交
3221 3222
    .bdrv_change_backing_file   = qcow2_change_backing_file,

3223
    .bdrv_refresh_limits        = qcow2_refresh_limits,
3224 3225
    .bdrv_invalidate_cache      = qcow2_invalidate_cache,

3226 3227
    .create_opts         = &qcow2_create_opts,
    .bdrv_check          = qcow2_check,
C
Chunyan Liu 已提交
3228
    .bdrv_amend_options  = qcow2_amend_options,
3229 3230 3231

    .bdrv_detach_aio_context  = qcow2_detach_aio_context,
    .bdrv_attach_aio_context  = qcow2_attach_aio_context,
B
Blue Swirl 已提交
3232 3233
};

3234 3235 3236 3237 3238 3239
static void bdrv_qcow2_init(void)
{
    bdrv_register(&bdrv_qcow2);
}

block_init(bdrv_qcow2_init);