?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Merge qemu-0.9.0
[qemu-kvm/fedora.git] / block-qcow2.c
blob67c85d710df56843486d7e05cc698c7c52d7d9fc
1 /*
2 * Block driver for the QCOW version 2 format
3 *
4 * Copyright (c) 2004-2006 Fabrice Bellard
5 *
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
12 *
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
15 *
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22 * THE SOFTWARE.
23 */
24 #include "vl.h"
25 #include "block_int.h"
26 #include <zlib.h>
27 #include "aes.h"
28 #include <assert.h>
29
30 /*
31 Differences with QCOW:
32
33 - Support for multiple incremental snapshots.
34 - Memory management by reference counts.
35 - Clusters which have a reference count of one have the bit
36 QCOW_OFLAG_COPIED to optimize write performance.
37 - Size of compressed clusters is stored in sectors to reduce bit usage
38 in the cluster offsets.
39 - Support for storing additional data (such as the VM state) in the
40 snapshots.
41 - If a backing store is used, the cluster size is not constrained
42 (could be backported to QCOW).
43 - L2 tables have always a size of one cluster.
44 */
45
46 //#define DEBUG_ALLOC
47 //#define DEBUG_ALLOC2
48
49 #define QCOW_MAGIC (('Q' << 24) | ('F' << 16) | ('I' << 8) | 0xfb)
50 #define QCOW_VERSION 2
51
52 #define QCOW_CRYPT_NONE 0
53 #define QCOW_CRYPT_AES 1
54
55 /* indicate that the refcount of the referenced cluster is exactly one. */
56 #define QCOW_OFLAG_COPIED (1LL << 63)
57 /* indicate that the cluster is compressed (they never have the copied flag) */
58 #define QCOW_OFLAG_COMPRESSED (1LL << 62)
59
60 #define REFCOUNT_SHIFT 1 /* refcount size is 2 bytes */
61
62 #ifndef offsetof
63 #define offsetof(type, field) ((size_t) &((type *)0)->field)
64 #endif
65
66 typedef struct QCowHeader {
67 uint32_t magic;
68 uint32_t version;
69 uint64_t backing_file_offset;
70 uint32_t backing_file_size;
71 uint32_t cluster_bits;
72 uint64_t size; /* in bytes */
73 uint32_t crypt_method;
74 uint32_t l1_size; /* XXX: save number of clusters instead ? */
75 uint64_t l1_table_offset;
76 uint64_t refcount_table_offset;
77 uint32_t refcount_table_clusters;
78 uint32_t nb_snapshots;
79 uint64_t snapshots_offset;
80 } QCowHeader;
81
82 typedef struct __attribute__((packed)) QCowSnapshotHeader {
83 /* header is 8 byte aligned */
84 uint64_t l1_table_offset;
85
86 uint32_t l1_size;
87 uint16_t id_str_size;
88 uint16_t name_size;
89
90 uint32_t date_sec;
91 uint32_t date_nsec;
92
93 uint64_t vm_clock_nsec;
94
95 uint32_t vm_state_size;
96 uint32_t extra_data_size; /* for extension */
97 /* extra data follows */
98 /* id_str follows */
99 /* name follows */
100 } QCowSnapshotHeader;
101
102 #define L2_CACHE_SIZE 16
103
104 typedef struct QCowSnapshot {
105 uint64_t l1_table_offset;
106 uint32_t l1_size;
107 char *id_str;
108 char *name;
109 uint32_t vm_state_size;
110 uint32_t date_sec;
111 uint32_t date_nsec;
112 uint64_t vm_clock_nsec;
113 } QCowSnapshot;
114
115 typedef struct BDRVQcowState {
116 BlockDriverState *hd;
117 int cluster_bits;
118 int cluster_size;
119 int cluster_sectors;
120 int l2_bits;
121 int l2_size;
122 int l1_size;
123 int l1_vm_state_index;
124 int csize_shift;
125 int csize_mask;
126 uint64_t cluster_offset_mask;
127 uint64_t l1_table_offset;
128 uint64_t *l1_table;
129 uint64_t *l2_cache;
130 uint64_t l2_cache_offsets[L2_CACHE_SIZE];
131 uint32_t l2_cache_counts[L2_CACHE_SIZE];
132 uint8_t *cluster_cache;
133 uint8_t *cluster_data;
134 uint64_t cluster_cache_offset;
135
136 uint64_t *refcount_table;
137 uint64_t refcount_table_offset;
138 uint32_t refcount_table_size;
139 uint64_t refcount_block_cache_offset;
140 uint16_t *refcount_block_cache;
141 int64_t free_cluster_index;
142 int64_t free_byte_offset;
143
144 uint32_t crypt_method; /* current crypt method, 0 if no key yet */
145 uint32_t crypt_method_header;
146 AES_KEY aes_encrypt_key;
147 AES_KEY aes_decrypt_key;
148 uint64_t snapshots_offset;
149 int snapshots_size;
150 int nb_snapshots;
151 QCowSnapshot *snapshots;
152 } BDRVQcowState;
153
154 static int decompress_cluster(BDRVQcowState *s, uint64_t cluster_offset);
155 static int qcow_read(BlockDriverState *bs, int64_t sector_num,
156 uint8_t *buf, int nb_sectors);
157 static int qcow_read_snapshots(BlockDriverState *bs);
158 static void qcow_free_snapshots(BlockDriverState *bs);
159 static int refcount_init(BlockDriverState *bs);
160 static void refcount_close(BlockDriverState *bs);
161 static int get_refcount(BlockDriverState *bs, int64_t cluster_index);
162 static int update_cluster_refcount(BlockDriverState *bs,
163 int64_t cluster_index,
164 int addend);
165 static void update_refcount(BlockDriverState *bs,
166 int64_t offset, int64_t length,
167 int addend);
168 static int64_t alloc_clusters(BlockDriverState *bs, int64_t size);
169 static int64_t alloc_bytes(BlockDriverState *bs, int size);
170 static void free_clusters(BlockDriverState *bs,
171 int64_t offset, int64_t size);
172 #ifdef DEBUG_ALLOC
173 static void check_refcounts(BlockDriverState *bs);
174 #endif
175
176 static int qcow_probe(const uint8_t *buf, int buf_size, const char *filename)
177 {
178 const QCowHeader *cow_header = (const void *)buf;
179
180 if (buf_size >= sizeof(QCowHeader) &&
181 be32_to_cpu(cow_header->magic) == QCOW_MAGIC &&
182 be32_to_cpu(cow_header->version) == QCOW_VERSION)
183 return 100;
184 else
185 return 0;
186 }
187
188 static int qcow_open(BlockDriverState *bs, const char *filename, int flags)
189 {
190 BDRVQcowState *s = bs->opaque;
191 int len, i, shift, ret;
192 QCowHeader header;
193
194 ret = bdrv_file_open(&s->hd, filename, flags);
195 if (ret < 0)
196 return ret;
197 if (bdrv_pread(s->hd, 0, &header, sizeof(header)) != sizeof(header))
198 goto fail;
199 be32_to_cpus(&header.magic);
200 be32_to_cpus(&header.version);
201 be64_to_cpus(&header.backing_file_offset);
202 be32_to_cpus(&header.backing_file_size);
203 be64_to_cpus(&header.size);
204 be32_to_cpus(&header.cluster_bits);
205 be32_to_cpus(&header.crypt_method);
206 be64_to_cpus(&header.l1_table_offset);
207 be32_to_cpus(&header.l1_size);
208 be64_to_cpus(&header.refcount_table_offset);
209 be32_to_cpus(&header.refcount_table_clusters);
210 be64_to_cpus(&header.snapshots_offset);
211 be32_to_cpus(&header.nb_snapshots);
212
213 if (header.magic != QCOW_MAGIC || header.version != QCOW_VERSION)
214 goto fail;
215 if (header.size <= 1 ||
216 header.cluster_bits < 9 ||
217 header.cluster_bits > 16)
218 goto fail;
219 if (header.crypt_method > QCOW_CRYPT_AES)
220 goto fail;
221 s->crypt_method_header = header.crypt_method;
222 if (s->crypt_method_header)
223 bs->encrypted = 1;
224 s->cluster_bits = header.cluster_bits;
225 s->cluster_size = 1 << s->cluster_bits;
226 s->cluster_sectors = 1 << (s->cluster_bits - 9);
227 s->l2_bits = s->cluster_bits - 3; /* L2 is always one cluster */
228 s->l2_size = 1 << s->l2_bits;
229 bs->total_sectors = header.size / 512;
230 s->csize_shift = (62 - (s->cluster_bits - 8));
231 s->csize_mask = (1 << (s->cluster_bits - 8)) - 1;
232 s->cluster_offset_mask = (1LL << s->csize_shift) - 1;
233 s->refcount_table_offset = header.refcount_table_offset;
234 s->refcount_table_size =
235 header.refcount_table_clusters << (s->cluster_bits - 3);
236
237 s->snapshots_offset = header.snapshots_offset;
238 s->nb_snapshots = header.nb_snapshots;
239
240 /* read the level 1 table */
241 s->l1_size = header.l1_size;
242 shift = s->cluster_bits + s->l2_bits;
243 s->l1_vm_state_index = (header.size + (1LL << shift) - 1) >> shift;
244 /* the L1 table must contain at least enough entries to put
245 header.size bytes */
246 if (s->l1_size < s->l1_vm_state_index)
247 goto fail;
248 s->l1_table_offset = header.l1_table_offset;
249 s->l1_table = qemu_malloc(s->l1_size * sizeof(uint64_t));
250 if (!s->l1_table)
251 goto fail;
252 if (bdrv_pread(s->hd, s->l1_table_offset, s->l1_table, s->l1_size * sizeof(uint64_t)) !=
253 s->l1_size * sizeof(uint64_t))
254 goto fail;
255 for(i = 0;i < s->l1_size; i++) {
256 be64_to_cpus(&s->l1_table[i]);
257 }
258 /* alloc L2 cache */
259 s->l2_cache = qemu_malloc(s->l2_size * L2_CACHE_SIZE * sizeof(uint64_t));
260 if (!s->l2_cache)
261 goto fail;
262 s->cluster_cache = qemu_malloc(s->cluster_size);
263 if (!s->cluster_cache)
264 goto fail;
265 /* one more sector for decompressed data alignment */
266 s->cluster_data = qemu_malloc(s->cluster_size + 512);
267 if (!s->cluster_data)
268 goto fail;
269 s->cluster_cache_offset = -1;
270
271 if (refcount_init(bs) < 0)
272 goto fail;
273
274 /* read the backing file name */
275 if (header.backing_file_offset != 0) {
276 len = header.backing_file_size;
277 if (len > 1023)
278 len = 1023;
279 if (bdrv_pread(s->hd, header.backing_file_offset, bs->backing_file, len) != len)
280 goto fail;
281 bs->backing_file[len] = '\0';
282 }
283 if (qcow_read_snapshots(bs) < 0)
284 goto fail;
285
286 #ifdef DEBUG_ALLOC
287 check_refcounts(bs);
288 #endif
289 return 0;
290
291 fail:
292 qcow_free_snapshots(bs);
293 refcount_close(bs);
294 qemu_free(s->l1_table);
295 qemu_free(s->l2_cache);
296 qemu_free(s->cluster_cache);
297 qemu_free(s->cluster_data);
298 bdrv_delete(s->hd);
299 return -1;
300 }
301
302 static int qcow_set_key(BlockDriverState *bs, const char *key)
303 {
304 BDRVQcowState *s = bs->opaque;
305 uint8_t keybuf[16];
306 int len, i;
307
308 memset(keybuf, 0, 16);
309 len = strlen(key);
310 if (len > 16)
311 len = 16;
312 /* XXX: we could compress the chars to 7 bits to increase
313 entropy */
314 for(i = 0;i < len;i++) {
315 keybuf[i] = key[i];
316 }
317 s->crypt_method = s->crypt_method_header;
318
319 if (AES_set_encrypt_key(keybuf, 128, &s->aes_encrypt_key) != 0)
320 return -1;
321 if (AES_set_decrypt_key(keybuf, 128, &s->aes_decrypt_key) != 0)
322 return -1;
323 #if 0
324 /* test */
325 {
326 uint8_t in[16];
327 uint8_t out[16];
328 uint8_t tmp[16];
329 for(i=0;i<16;i++)
330 in[i] = i;
331 AES_encrypt(in, tmp, &s->aes_encrypt_key);
332 AES_decrypt(tmp, out, &s->aes_decrypt_key);
333 for(i = 0; i < 16; i++)
334 printf(" %02x", tmp[i]);
335 printf("\n");
336 for(i = 0; i < 16; i++)
337 printf(" %02x", out[i]);
338 printf("\n");
339 }
340 #endif
341 return 0;
342 }
343
344 /* The crypt function is compatible with the linux cryptoloop
345 algorithm for < 4 GB images. NOTE: out_buf == in_buf is
346 supported */
347 static void encrypt_sectors(BDRVQcowState *s, int64_t sector_num,
348 uint8_t *out_buf, const uint8_t *in_buf,
349 int nb_sectors, int enc,
350 const AES_KEY *key)
351 {
352 union {
353 uint64_t ll[2];
354 uint8_t b[16];
355 } ivec;
356 int i;
357
358 for(i = 0; i < nb_sectors; i++) {
359 ivec.ll[0] = cpu_to_le64(sector_num);
360 ivec.ll[1] = 0;
361 AES_cbc_encrypt(in_buf, out_buf, 512, key,
362 ivec.b, enc);
363 sector_num++;
364 in_buf += 512;
365 out_buf += 512;
366 }
367 }
368
369 static int copy_sectors(BlockDriverState *bs, uint64_t start_sect,
370 uint64_t cluster_offset, int n_start, int n_end)
371 {
372 BDRVQcowState *s = bs->opaque;
373 int n, ret;
374
375 n = n_end - n_start;
376 if (n <= 0)
377 return 0;
378 ret = qcow_read(bs, start_sect + n_start, s->cluster_data, n);
379 if (ret < 0)
380 return ret;
381 if (s->crypt_method) {
382 encrypt_sectors(s, start_sect + n_start,
383 s->cluster_data,
384 s->cluster_data, n, 1,
385 &s->aes_encrypt_key);
386 }
387 ret = bdrv_write(s->hd, (cluster_offset >> 9) + n_start,
388 s->cluster_data, n);
389 if (ret < 0)
390 return ret;
391 return 0;
392 }
393
394 static void l2_cache_reset(BlockDriverState *bs)
395 {
396 BDRVQcowState *s = bs->opaque;
397
398 memset(s->l2_cache, 0, s->l2_size * L2_CACHE_SIZE * sizeof(uint64_t));
399 memset(s->l2_cache_offsets, 0, L2_CACHE_SIZE * sizeof(uint64_t));
400 memset(s->l2_cache_counts, 0, L2_CACHE_SIZE * sizeof(uint32_t));
401 }
402
403 static inline int l2_cache_new_entry(BlockDriverState *bs)
404 {
405 BDRVQcowState *s = bs->opaque;
406 uint32_t min_count;
407 int min_index, i;
408
409 /* find a new entry in the least used one */
410 min_index = 0;
411 min_count = 0xffffffff;
412 for(i = 0; i < L2_CACHE_SIZE; i++) {
413 if (s->l2_cache_counts[i] < min_count) {
414 min_count = s->l2_cache_counts[i];
415 min_index = i;
416 }
417 }
418 return min_index;
419 }
420
421 static int64_t align_offset(int64_t offset, int n)
422 {
423 offset = (offset + n - 1) & ~(n - 1);
424 return offset;
425 }
426
427 static int grow_l1_table(BlockDriverState *bs, int min_size)
428 {
429 BDRVQcowState *s = bs->opaque;
430 int new_l1_size, new_l1_size2, ret, i;
431 uint64_t *new_l1_table;
432 uint64_t new_l1_table_offset;
433 uint64_t data64;
434 uint32_t data32;
435
436 new_l1_size = s->l1_size;
437 if (min_size <= new_l1_size)
438 return 0;
439 while (min_size > new_l1_size) {
440 new_l1_size = (new_l1_size * 3 + 1) / 2;
441 }
442 #ifdef DEBUG_ALLOC2
443 printf("grow l1_table from %d to %d\n", s->l1_size, new_l1_size);
444 #endif
445
446 new_l1_size2 = sizeof(uint64_t) * new_l1_size;
447 new_l1_table = qemu_mallocz(new_l1_size2);
448 if (!new_l1_table)
449 return -ENOMEM;
450 memcpy(new_l1_table, s->l1_table, s->l1_size * sizeof(uint64_t));
451
452 /* write new table (align to cluster) */
453 new_l1_table_offset = alloc_clusters(bs, new_l1_size2);
454
455 for(i = 0; i < s->l1_size; i++)
456 new_l1_table[i] = cpu_to_be64(new_l1_table[i]);
457 ret = bdrv_pwrite(s->hd, new_l1_table_offset, new_l1_table, new_l1_size2);
458 if (ret != new_l1_size2)
459 goto fail;
460 for(i = 0; i < s->l1_size; i++)
461 new_l1_table[i] = be64_to_cpu(new_l1_table[i]);
462
463 /* set new table */
464 data64 = cpu_to_be64(new_l1_table_offset);
465 if (bdrv_pwrite(s->hd, offsetof(QCowHeader, l1_table_offset),
466 &data64, sizeof(data64)) != sizeof(data64))
467 goto fail;
468 data32 = cpu_to_be32(new_l1_size);
469 if (bdrv_pwrite(s->hd, offsetof(QCowHeader, l1_size),
470 &data32, sizeof(data32)) != sizeof(data32))
471 goto fail;
472 qemu_free(s->l1_table);
473 free_clusters(bs, s->l1_table_offset, s->l1_size * sizeof(uint64_t));
474 s->l1_table_offset = new_l1_table_offset;
475 s->l1_table = new_l1_table;
476 s->l1_size = new_l1_size;
477 return 0;
478 fail:
479 qemu_free(s->l1_table);
480 return -EIO;
481 }
482
483 /* 'allocate' is:
484 *
485 * 0 not to allocate.
486 *
487 * 1 to allocate a normal cluster (for sector indexes 'n_start' to
488 * 'n_end')
489 *
490 * 2 to allocate a compressed cluster of size
491 * 'compressed_size'. 'compressed_size' must be > 0 and <
492 * cluster_size
493 *
494 * return 0 if not allocated.
495 */
496 static uint64_t get_cluster_offset(BlockDriverState *bs,
497 uint64_t offset, int allocate,
498 int compressed_size,
499 int n_start, int n_end)
500 {
501 BDRVQcowState *s = bs->opaque;
502 int min_index, i, j, l1_index, l2_index, ret;
503 uint64_t l2_offset, *l2_table, cluster_offset, tmp, old_l2_offset;
504
505 l1_index = offset >> (s->l2_bits + s->cluster_bits);
506 if (l1_index >= s->l1_size) {
507 /* outside l1 table is allowed: we grow the table if needed */
508 if (!allocate)
509 return 0;
510 if (grow_l1_table(bs, l1_index + 1) < 0)
511 return 0;
512 }
513 l2_offset = s->l1_table[l1_index];
514 if (!l2_offset) {
515 if (!allocate)
516 return 0;
517 l2_allocate:
518 old_l2_offset = l2_offset;
519 /* allocate a new l2 entry */
520 l2_offset = alloc_clusters(bs, s->l2_size * sizeof(uint64_t));
521 /* update the L1 entry */
522 s->l1_table[l1_index] = l2_offset | QCOW_OFLAG_COPIED;
523 tmp = cpu_to_be64(l2_offset | QCOW_OFLAG_COPIED);
524 if (bdrv_pwrite(s->hd, s->l1_table_offset + l1_index * sizeof(tmp),
525 &tmp, sizeof(tmp)) != sizeof(tmp))
526 return 0;
527 min_index = l2_cache_new_entry(bs);
528 l2_table = s->l2_cache + (min_index << s->l2_bits);
529
530 if (old_l2_offset == 0) {
531 memset(l2_table, 0, s->l2_size * sizeof(uint64_t));
532 } else {
533 if (bdrv_pread(s->hd, old_l2_offset,
534 l2_table, s->l2_size * sizeof(uint64_t)) !=
535 s->l2_size * sizeof(uint64_t))
536 return 0;
537 }
538 if (bdrv_pwrite(s->hd, l2_offset,
539 l2_table, s->l2_size * sizeof(uint64_t)) !=
540 s->l2_size * sizeof(uint64_t))
541 return 0;
542 } else {
543 if (!(l2_offset & QCOW_OFLAG_COPIED)) {
544 if (allocate) {
545 free_clusters(bs, l2_offset, s->l2_size * sizeof(uint64_t));
546 goto l2_allocate;
547 }
548 } else {
549 l2_offset &= ~QCOW_OFLAG_COPIED;
550 }
551 for(i = 0; i < L2_CACHE_SIZE; i++) {
552 if (l2_offset == s->l2_cache_offsets[i]) {
553 /* increment the hit count */
554 if (++s->l2_cache_counts[i] == 0xffffffff) {
555 for(j = 0; j < L2_CACHE_SIZE; j++) {
556 s->l2_cache_counts[j] >>= 1;
557 }
558 }
559 l2_table = s->l2_cache + (i << s->l2_bits);
560 goto found;
561 }
562 }
563 /* not found: load a new entry in the least used one */
564 min_index = l2_cache_new_entry(bs);
565 l2_table = s->l2_cache + (min_index << s->l2_bits);
566 if (bdrv_pread(s->hd, l2_offset, l2_table, s->l2_size * sizeof(uint64_t)) !=
567 s->l2_size * sizeof(uint64_t))
568 return 0;
569 }
570 s->l2_cache_offsets[min_index] = l2_offset;
571 s->l2_cache_counts[min_index] = 1;
572 found:
573 l2_index = (offset >> s->cluster_bits) & (s->l2_size - 1);
574 cluster_offset = be64_to_cpu(l2_table[l2_index]);
575 if (!cluster_offset) {
576 if (!allocate)
577 return cluster_offset;
578 } else if (!(cluster_offset & QCOW_OFLAG_COPIED)) {
579 if (!allocate)
580 return cluster_offset;
581 /* free the cluster */
582 if (cluster_offset & QCOW_OFLAG_COMPRESSED) {
583 int nb_csectors;
584 nb_csectors = ((cluster_offset >> s->csize_shift) &
585 s->csize_mask) + 1;
586 free_clusters(bs, (cluster_offset & s->cluster_offset_mask) & ~511,
587 nb_csectors * 512);
588 } else {
589 free_clusters(bs, cluster_offset, s->cluster_size);
590 }
591 } else {
592 cluster_offset &= ~QCOW_OFLAG_COPIED;
593 return cluster_offset;
594 }
595 if (allocate == 1) {
596 /* allocate a new cluster */
597 cluster_offset = alloc_clusters(bs, s->cluster_size);
598
599 /* we must initialize the cluster content which won't be
600 written */
601 if ((n_end - n_start) < s->cluster_sectors) {
602 uint64_t start_sect;
603
604 start_sect = (offset & ~(s->cluster_size - 1)) >> 9;
605 ret = copy_sectors(bs, start_sect,
606 cluster_offset, 0, n_start);
607 if (ret < 0)
608 return 0;
609 ret = copy_sectors(bs, start_sect,
610 cluster_offset, n_end, s->cluster_sectors);
611 if (ret < 0)
612 return 0;
613 }
614 tmp = cpu_to_be64(cluster_offset | QCOW_OFLAG_COPIED);
615 } else {
616 int nb_csectors;
617 cluster_offset = alloc_bytes(bs, compressed_size);
618 nb_csectors = ((cluster_offset + compressed_size - 1) >> 9) -
619 (cluster_offset >> 9);
620 cluster_offset |= QCOW_OFLAG_COMPRESSED |
621 ((uint64_t)nb_csectors << s->csize_shift);
622 /* compressed clusters never have the copied flag */
623 tmp = cpu_to_be64(cluster_offset);
624 }
625 /* update L2 table */
626 l2_table[l2_index] = tmp;
627 if (bdrv_pwrite(s->hd,
628 l2_offset + l2_index * sizeof(tmp), &tmp, sizeof(tmp)) != sizeof(tmp))
629 return 0;
630 return cluster_offset;
631 }
632
633 static int qcow_is_allocated(BlockDriverState *bs, int64_t sector_num,
634 int nb_sectors, int *pnum)
635 {
636 BDRVQcowState *s = bs->opaque;
637 int index_in_cluster, n;
638 uint64_t cluster_offset;
639
640 cluster_offset = get_cluster_offset(bs, sector_num << 9, 0, 0, 0, 0);
641 index_in_cluster = sector_num & (s->cluster_sectors - 1);
642 n = s->cluster_sectors - index_in_cluster;
643 if (n > nb_sectors)
644 n = nb_sectors;
645 *pnum = n;
646 return (cluster_offset != 0);
647 }
648
649 static int decompress_buffer(uint8_t *out_buf, int out_buf_size,
650 const uint8_t *buf, int buf_size)
651 {
652 z_stream strm1, *strm = &strm1;
653 int ret, out_len;
654
655 memset(strm, 0, sizeof(*strm));
656
657 strm->next_in = (uint8_t *)buf;
658 strm->avail_in = buf_size;
659 strm->next_out = out_buf;
660 strm->avail_out = out_buf_size;
661
662 ret = inflateInit2(strm, -12);
663 if (ret != Z_OK)
664 return -1;
665 ret = inflate(strm, Z_FINISH);
666 out_len = strm->next_out - out_buf;
667 if ((ret != Z_STREAM_END && ret != Z_BUF_ERROR) ||
668 out_len != out_buf_size) {
669 inflateEnd(strm);
670 return -1;
671 }
672 inflateEnd(strm);
673 return 0;
674 }
675
676 static int decompress_cluster(BDRVQcowState *s, uint64_t cluster_offset)
677 {
678 int ret, csize, nb_csectors, sector_offset;
679 uint64_t coffset;
680
681 coffset = cluster_offset & s->cluster_offset_mask;
682 if (s->cluster_cache_offset != coffset) {
683 nb_csectors = ((cluster_offset >> s->csize_shift) & s->csize_mask) + 1;
684 sector_offset = coffset & 511;
685 csize = nb_csectors * 512 - sector_offset;
686 ret = bdrv_read(s->hd, coffset >> 9, s->cluster_data, nb_csectors);
687 if (ret < 0) {
688 return -1;
689 }
690 if (decompress_buffer(s->cluster_cache, s->cluster_size,
691 s->cluster_data + sector_offset, csize) < 0) {
692 return -1;
693 }
694 s->cluster_cache_offset = coffset;
695 }
696 return 0;
697 }
698
699 /* handle reading after the end of the backing file */
700 static int backing_read1(BlockDriverState *bs,
701 int64_t sector_num, uint8_t *buf, int nb_sectors)
702 {
703 int n1;
704 if ((sector_num + nb_sectors) <= bs->total_sectors)
705 return nb_sectors;
706 if (sector_num >= bs->total_sectors)
707 n1 = 0;
708 else
709 n1 = bs->total_sectors - sector_num;
710 memset(buf + n1 * 512, 0, 512 * (nb_sectors - n1));
711 return n1;
712 }
713
714 static int qcow_read(BlockDriverState *bs, int64_t sector_num,
715 uint8_t *buf, int nb_sectors)
716 {
717 BDRVQcowState *s = bs->opaque;
718 int ret, index_in_cluster, n, n1;
719 uint64_t cluster_offset;
720
721 while (nb_sectors > 0) {
722 cluster_offset = get_cluster_offset(bs, sector_num << 9, 0, 0, 0, 0);
723 index_in_cluster = sector_num & (s->cluster_sectors - 1);
724 n = s->cluster_sectors - index_in_cluster;
725 if (n > nb_sectors)
726 n = nb_sectors;
727 if (!cluster_offset) {
728 if (bs->backing_hd) {
729 /* read from the base image */
730 n1 = backing_read1(bs->backing_hd, sector_num, buf, n);
731 if (n1 > 0) {
732 ret = bdrv_read(bs->backing_hd, sector_num, buf, n1);
733 if (ret < 0)
734 return -1;
735 }
736 } else {
737 memset(buf, 0, 512 * n);
738 }
739 } else if (cluster_offset & QCOW_OFLAG_COMPRESSED) {
740 if (decompress_cluster(s, cluster_offset) < 0)
741 return -1;
742 memcpy(buf, s->cluster_cache + index_in_cluster * 512, 512 * n);
743 } else {
744 ret = bdrv_pread(s->hd, cluster_offset + index_in_cluster * 512, buf, n * 512);
745 if (ret != n * 512)
746 return -1;
747 if (s->crypt_method) {
748 encrypt_sectors(s, sector_num, buf, buf, n, 0,
749 &s->aes_decrypt_key);
750 }
751 }
752 nb_sectors -= n;
753 sector_num += n;
754 buf += n * 512;
755 }
756 return 0;
757 }
758
759 static int qcow_write(BlockDriverState *bs, int64_t sector_num,
760 const uint8_t *buf, int nb_sectors)
761 {
762 BDRVQcowState *s = bs->opaque;
763 int ret, index_in_cluster, n;
764 uint64_t cluster_offset;
765
766 while (nb_sectors > 0) {
767 index_in_cluster = sector_num & (s->cluster_sectors - 1);
768 n = s->cluster_sectors - index_in_cluster;
769 if (n > nb_sectors)
770 n = nb_sectors;
771 cluster_offset = get_cluster_offset(bs, sector_num << 9, 1, 0,
772 index_in_cluster,
773 index_in_cluster + n);
774 if (!cluster_offset)
775 return -1;
776 if (s->crypt_method) {
777 encrypt_sectors(s, sector_num, s->cluster_data, buf, n, 1,
778 &s->aes_encrypt_key);
779 ret = bdrv_pwrite(s->hd, cluster_offset + index_in_cluster * 512,
780 s->cluster_data, n * 512);
781 } else {
782 ret = bdrv_pwrite(s->hd, cluster_offset + index_in_cluster * 512, buf, n * 512);
783 }
784 if (ret != n * 512)
785 return -1;
786 nb_sectors -= n;
787 sector_num += n;
788 buf += n * 512;
789 }
790 s->cluster_cache_offset = -1; /* disable compressed cache */
791 return 0;
792 }
793
794 typedef struct QCowAIOCB {
795 BlockDriverAIOCB common;
796 int64_t sector_num;
797 uint8_t *buf;
798 int nb_sectors;
799 int n;
800 uint64_t cluster_offset;
801 uint8_t *cluster_data;
802 BlockDriverAIOCB *hd_aiocb;
803 } QCowAIOCB;
804
805 static void qcow_aio_read_cb(void *opaque, int ret)
806 {
807 QCowAIOCB *acb = opaque;
808 BlockDriverState *bs = acb->common.bs;
809 BDRVQcowState *s = bs->opaque;
810 int index_in_cluster, n1;
811
812 acb->hd_aiocb = NULL;
813 if (ret < 0) {
814 fail:
815 acb->common.cb(acb->common.opaque, ret);
816 qemu_aio_release(acb);
817 return;
818 }
819
820 redo:
821 /* post process the read buffer */
822 if (!acb->cluster_offset) {
823 /* nothing to do */
824 } else if (acb->cluster_offset & QCOW_OFLAG_COMPRESSED) {
825 /* nothing to do */
826 } else {
827 if (s->crypt_method) {
828 encrypt_sectors(s, acb->sector_num, acb->buf, acb->buf,
829 acb->n, 0,
830 &s->aes_decrypt_key);
831 }
832 }
833
834 acb->nb_sectors -= acb->n;
835 acb->sector_num += acb->n;
836 acb->buf += acb->n * 512;
837
838 if (acb->nb_sectors == 0) {
839 /* request completed */
840 acb->common.cb(acb->common.opaque, 0);
841 qemu_aio_release(acb);
842 return;
843 }
844
845 /* prepare next AIO request */
846 acb->cluster_offset = get_cluster_offset(bs, acb->sector_num << 9,
847 0, 0, 0, 0);
848 index_in_cluster = acb->sector_num & (s->cluster_sectors - 1);
849 acb->n = s->cluster_sectors - index_in_cluster;
850 if (acb->n > acb->nb_sectors)
851 acb->n = acb->nb_sectors;
852
853 if (!acb->cluster_offset) {
854 if (bs->backing_hd) {
855 /* read from the base image */
856 n1 = backing_read1(bs->backing_hd, acb->sector_num,
857 acb->buf, acb->n);
858 if (n1 > 0) {
859 acb->hd_aiocb = bdrv_aio_read(bs->backing_hd, acb->sector_num,
860 acb->buf, acb->n, qcow_aio_read_cb, acb);
861 if (acb->hd_aiocb == NULL)
862 goto fail;
863 } else {
864 goto redo;
865 }
866 } else {
867 /* Note: in this case, no need to wait */
868 memset(acb->buf, 0, 512 * acb->n);
869 goto redo;
870 }
871 } else if (acb->cluster_offset & QCOW_OFLAG_COMPRESSED) {
872 /* add AIO support for compressed blocks ? */
873 if (decompress_cluster(s, acb->cluster_offset) < 0)
874 goto fail;
875 memcpy(acb->buf,
876 s->cluster_cache + index_in_cluster * 512, 512 * acb->n);
877 goto redo;
878 } else {
879 if ((acb->cluster_offset & 511) != 0) {
880 ret = -EIO;
881 goto fail;
882 }
883 acb->hd_aiocb = bdrv_aio_read(s->hd,
884 (acb->cluster_offset >> 9) + index_in_cluster,
885 acb->buf, acb->n, qcow_aio_read_cb, acb);
886 if (acb->hd_aiocb == NULL)
887 goto fail;
888 }
889 }
890
891 static QCowAIOCB *qcow_aio_setup(BlockDriverState *bs,
892 int64_t sector_num, uint8_t *buf, int nb_sectors,
893 BlockDriverCompletionFunc *cb, void *opaque)
894 {
895 QCowAIOCB *acb;
896
897 acb = qemu_aio_get(bs, cb, opaque);
898 if (!acb)
899 return NULL;
900 acb->hd_aiocb = NULL;
901 acb->sector_num = sector_num;
902 acb->buf = buf;
903 acb->nb_sectors = nb_sectors;
904 acb->n = 0;
905 acb->cluster_offset = 0;
906 return acb;
907 }
908
909 static BlockDriverAIOCB *qcow_aio_read(BlockDriverState *bs,
910 int64_t sector_num, uint8_t *buf, int nb_sectors,
911 BlockDriverCompletionFunc *cb, void *opaque)
912 {
913 QCowAIOCB *acb;
914
915 acb = qcow_aio_setup(bs, sector_num, buf, nb_sectors, cb, opaque);
916 if (!acb)
917 return NULL;
918
919 qcow_aio_read_cb(acb, 0);
920 return &acb->common;
921 }
922
923 static void qcow_aio_write_cb(void *opaque, int ret)
924 {
925 QCowAIOCB *acb = opaque;
926 BlockDriverState *bs = acb->common.bs;
927 BDRVQcowState *s = bs->opaque;
928 int index_in_cluster;
929 uint64_t cluster_offset;
930 const uint8_t *src_buf;
931
932 acb->hd_aiocb = NULL;
933
934 if (ret < 0) {
935 fail:
936 acb->common.cb(acb->common.opaque, ret);
937 qemu_aio_release(acb);
938 return;
939 }
940
941 acb->nb_sectors -= acb->n;
942 acb->sector_num += acb->n;
943 acb->buf += acb->n * 512;
944
945 if (acb->nb_sectors == 0) {
946 /* request completed */
947 acb->common.cb(acb->common.opaque, 0);
948 qemu_aio_release(acb);
949 return;
950 }
951
952 index_in_cluster = acb->sector_num & (s->cluster_sectors - 1);
953 acb->n = s->cluster_sectors - index_in_cluster;
954 if (acb->n > acb->nb_sectors)
955 acb->n = acb->nb_sectors;
956 cluster_offset = get_cluster_offset(bs, acb->sector_num << 9, 1, 0,
957 index_in_cluster,
958 index_in_cluster + acb->n);
959 if (!cluster_offset || (cluster_offset & 511) != 0) {
960 ret = -EIO;
961 goto fail;
962 }
963 if (s->crypt_method) {
964 if (!acb->cluster_data) {
965 acb->cluster_data = qemu_mallocz(s->cluster_size);
966 if (!acb->cluster_data) {
967 ret = -ENOMEM;
968 goto fail;
969 }
970 }
971 encrypt_sectors(s, acb->sector_num, acb->cluster_data, acb->buf,
972 acb->n, 1, &s->aes_encrypt_key);
973 src_buf = acb->cluster_data;
974 } else {
975 src_buf = acb->buf;
976 }
977 acb->hd_aiocb = bdrv_aio_write(s->hd,
978 (cluster_offset >> 9) + index_in_cluster,
979 src_buf, acb->n,
980 qcow_aio_write_cb, acb);
981 if (acb->hd_aiocb == NULL)
982 goto fail;
983 }
984
985 static BlockDriverAIOCB *qcow_aio_write(BlockDriverState *bs,
986 int64_t sector_num, const uint8_t *buf, int nb_sectors,
987 BlockDriverCompletionFunc *cb, void *opaque)
988 {
989 BDRVQcowState *s = bs->opaque;
990 QCowAIOCB *acb;
991
992 s->cluster_cache_offset = -1; /* disable compressed cache */
993
994 acb = qcow_aio_setup(bs, sector_num, (uint8_t*)buf, nb_sectors, cb, opaque);
995 if (!acb)
996 return NULL;
997
998 qcow_aio_write_cb(acb, 0);
999 return &acb->common;
1000 }
1001
1002 static void qcow_aio_cancel(BlockDriverAIOCB *blockacb)
1003 {
1004 QCowAIOCB *acb = (QCowAIOCB *)blockacb;
1005 if (acb->hd_aiocb)
1006 bdrv_aio_cancel(acb->hd_aiocb);
1007 qemu_aio_release(acb);
1008 }
1009
1010 static void qcow_close(BlockDriverState *bs)
1011 {
1012 BDRVQcowState *s = bs->opaque;
1013 qemu_free(s->l1_table);
1014 qemu_free(s->l2_cache);
1015 qemu_free(s->cluster_cache);
1016 qemu_free(s->cluster_data);
1017 refcount_close(bs);
1018 bdrv_delete(s->hd);
1019 }
1020
1021 /* XXX: use std qcow open function ? */
1022 typedef struct QCowCreateState {
1023 int cluster_size;
1024 int cluster_bits;
1025 uint16_t *refcount_block;
1026 uint64_t *refcount_table;
1027 int64_t l1_table_offset;
1028 int64_t refcount_table_offset;
1029 int64_t refcount_block_offset;
1030 } QCowCreateState;
1031
1032 static void create_refcount_update(QCowCreateState *s,
1033 int64_t offset, int64_t size)
1034 {
1035 int refcount;
1036 int64_t start, last, cluster_offset;
1037 uint16_t *p;
1038
1039 start = offset & ~(s->cluster_size - 1);
1040 last = (offset + size - 1) & ~(s->cluster_size - 1);
1041 for(cluster_offset = start; cluster_offset <= last;
1042 cluster_offset += s->cluster_size) {
1043 p = &s->refcount_block[cluster_offset >> s->cluster_bits];
1044 refcount = be16_to_cpu(*p);
1045 refcount++;
1046 *p = cpu_to_be16(refcount);
1047 }
1048 }
1049
1050 static int qcow_create(const char *filename, int64_t total_size,
1051 const char *backing_file, int flags)
1052 {
1053 int fd, header_size, backing_filename_len, l1_size, i, shift, l2_bits;
1054 QCowHeader header;
1055 uint64_t tmp, offset;
1056 QCowCreateState s1, *s = &s1;
1057
1058 memset(s, 0, sizeof(*s));
1059
1060 fd = open(filename, O_WRONLY | O_CREAT | O_TRUNC | O_BINARY, 0644);
1061 if (fd < 0)
1062 return -1;
1063 memset(&header, 0, sizeof(header));
1064 header.magic = cpu_to_be32(QCOW_MAGIC);
1065 header.version = cpu_to_be32(QCOW_VERSION);
1066 header.size = cpu_to_be64(total_size * 512);
1067 header_size = sizeof(header);
1068 backing_filename_len = 0;
1069 if (backing_file) {
1070 header.backing_file_offset = cpu_to_be64(header_size);
1071 backing_filename_len = strlen(backing_file);
1072 header.backing_file_size = cpu_to_be32(backing_filename_len);
1073 header_size += backing_filename_len;
1074 }
1075 s->cluster_bits = 12; /* 4 KB clusters */
1076 s->cluster_size = 1 << s->cluster_bits;
1077 header.cluster_bits = cpu_to_be32(s->cluster_bits);
1078 header_size = (header_size + 7) & ~7;
1079 if (flags) {
1080 header.crypt_method = cpu_to_be32(QCOW_CRYPT_AES);
1081 } else {
1082 header.crypt_method = cpu_to_be32(QCOW_CRYPT_NONE);
1083 }
1084 l2_bits = s->cluster_bits - 3;
1085 shift = s->cluster_bits + l2_bits;
1086 l1_size = (((total_size * 512) + (1LL << shift) - 1) >> shift);
1087 offset = align_offset(header_size, s->cluster_size);
1088 s->l1_table_offset = offset;
1089 header.l1_table_offset = cpu_to_be64(s->l1_table_offset);
1090 header.l1_size = cpu_to_be32(l1_size);
1091 offset += align_offset(l1_size * sizeof(uint64_t), s->cluster_size);
1092
1093 s->refcount_table = qemu_mallocz(s->cluster_size);
1094 if (!s->refcount_table)
1095 goto fail;
1096 s->refcount_block = qemu_mallocz(s->cluster_size);
1097 if (!s->refcount_block)
1098 goto fail;
1099
1100 s->refcount_table_offset = offset;
1101 header.refcount_table_offset = cpu_to_be64(offset);
1102 header.refcount_table_clusters = cpu_to_be32(1);
1103 offset += s->cluster_size;
1104
1105 s->refcount_table[0] = cpu_to_be64(offset);
1106 s->refcount_block_offset = offset;
1107 offset += s->cluster_size;
1108
1109 /* update refcounts */
1110 create_refcount_update(s, 0, header_size);
1111 create_refcount_update(s, s->l1_table_offset, l1_size * sizeof(uint64_t));
1112 create_refcount_update(s, s->refcount_table_offset, s->cluster_size);
1113 create_refcount_update(s, s->refcount_block_offset, s->cluster_size);
1114
1115 /* write all the data */
1116 write(fd, &header, sizeof(header));
1117 if (backing_file) {
1118 write(fd, backing_file, backing_filename_len);
1119 }
1120 lseek(fd, s->l1_table_offset, SEEK_SET);
1121 tmp = 0;
1122 for(i = 0;i < l1_size; i++) {
1123 write(fd, &tmp, sizeof(tmp));
1124 }
1125 lseek(fd, s->refcount_table_offset, SEEK_SET);
1126 write(fd, s->refcount_table, s->cluster_size);
1127
1128 lseek(fd, s->refcount_block_offset, SEEK_SET);
1129 write(fd, s->refcount_block, s->cluster_size);
1130
1131 qemu_free(s->refcount_table);
1132 qemu_free(s->refcount_block);
1133 close(fd);
1134 return 0;
1135 fail:
1136 qemu_free(s->refcount_table);
1137 qemu_free(s->refcount_block);
1138 close(fd);
1139 return -ENOMEM;
1140 }
1141
1142 static int qcow_make_empty(BlockDriverState *bs)
1143 {
1144 #if 0
1145 /* XXX: not correct */
1146 BDRVQcowState *s = bs->opaque;
1147 uint32_t l1_length = s->l1_size * sizeof(uint64_t);
1148 int ret;
1149
1150 memset(s->l1_table, 0, l1_length);
1151 if (bdrv_pwrite(s->hd, s->l1_table_offset, s->l1_table, l1_length) < 0)
1152 return -1;
1153 ret = bdrv_truncate(s->hd, s->l1_table_offset + l1_length);
1154 if (ret < 0)
1155 return ret;
1156
1157 l2_cache_reset(bs);
1158 #endif
1159 return 0;
1160 }
1161
1162 /* XXX: put compressed sectors first, then all the cluster aligned
1163 tables to avoid losing bytes in alignment */
1164 static int qcow_write_compressed(BlockDriverState *bs, int64_t sector_num,
1165 const uint8_t *buf, int nb_sectors)
1166 {
1167 BDRVQcowState *s = bs->opaque;
1168 z_stream strm;
1169 int ret, out_len;
1170 uint8_t *out_buf;
1171 uint64_t cluster_offset;
1172
1173 if (nb_sectors == 0) {
1174 /* align end of file to a sector boundary to ease reading with
1175 sector based I/Os */
1176 cluster_offset = bdrv_getlength(s->hd);
1177 cluster_offset = (cluster_offset + 511) & ~511;
1178 bdrv_truncate(s->hd, cluster_offset);
1179 return 0;
1180 }
1181
1182 if (nb_sectors != s->cluster_sectors)
1183 return -EINVAL;
1184
1185 out_buf = qemu_malloc(s->cluster_size + (s->cluster_size / 1000) + 128);
1186 if (!out_buf)
1187 return -ENOMEM;
1188
1189 /* best compression, small window, no zlib header */
1190 memset(&strm, 0, sizeof(strm));
1191 ret = deflateInit2(&strm, Z_DEFAULT_COMPRESSION,
1192 Z_DEFLATED, -12,
1193 9, Z_DEFAULT_STRATEGY);
1194 if (ret != 0) {
1195 qemu_free(out_buf);
1196 return -1;
1197 }
1198
1199 strm.avail_in = s->cluster_size;
1200 strm.next_in = (uint8_t *)buf;
1201 strm.avail_out = s->cluster_size;
1202 strm.next_out = out_buf;
1203
1204 ret = deflate(&strm, Z_FINISH);
1205 if (ret != Z_STREAM_END && ret != Z_OK) {
1206 qemu_free(out_buf);
1207 deflateEnd(&strm);
1208 return -1;
1209 }
1210 out_len = strm.next_out - out_buf;
1211
1212 deflateEnd(&strm);
1213
1214 if (ret != Z_STREAM_END || out_len >= s->cluster_size) {
1215 /* could not compress: write normal cluster */
1216 qcow_write(bs, sector_num, buf, s->cluster_sectors);
1217 } else {
1218 cluster_offset = get_cluster_offset(bs, sector_num << 9, 2,
1219 out_len, 0, 0);
1220 cluster_offset &= s->cluster_offset_mask;
1221 if (bdrv_pwrite(s->hd, cluster_offset, out_buf, out_len) != out_len) {
1222 qemu_free(out_buf);
1223 return -1;
1224 }
1225 }
1226
1227 qemu_free(out_buf);
1228 return 0;
1229 }
1230
1231 static void qcow_flush(BlockDriverState *bs)
1232 {
1233 BDRVQcowState *s = bs->opaque;
1234 bdrv_flush(s->hd);
1235 }
1236
1237 static int qcow_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
1238 {
1239 BDRVQcowState *s = bs->opaque;
1240 bdi->cluster_size = s->cluster_size;
1241 bdi->vm_state_offset = (int64_t)s->l1_vm_state_index <<
1242 (s->cluster_bits + s->l2_bits);
1243 return 0;
1244 }
1245
1246 /*********************************************************/
1247 /* snapshot support */
1248
1249 /* update the refcounts of snapshots and the copied flag */
1250 static int update_snapshot_refcount(BlockDriverState *bs,
1251 int64_t l1_table_offset,
1252 int l1_size,
1253 int addend)
1254 {
1255 BDRVQcowState *s = bs->opaque;
1256 uint64_t *l1_table, *l2_table, l2_offset, offset, l1_size2, l1_allocated;
1257 int64_t old_offset, old_l2_offset;
1258 int l2_size, i, j, l1_modified, l2_modified, nb_csectors, refcount;
1259
1260 l2_cache_reset(bs);
1261
1262 l2_table = NULL;
1263 l1_table = NULL;
1264 l1_size2 = l1_size * sizeof(uint64_t);
1265 l1_allocated = 0;
1266 if (l1_table_offset != s->l1_table_offset) {
1267 l1_table = qemu_malloc(l1_size2);
1268 if (!l1_table)
1269 goto fail;
1270 l1_allocated = 1;
1271 if (bdrv_pread(s->hd, l1_table_offset,
1272 l1_table, l1_size2) != l1_size2)
1273 goto fail;
1274 for(i = 0;i < l1_size; i++)
1275 be64_to_cpus(&l1_table[i]);
1276 } else {
1277 assert(l1_size == s->l1_size);
1278 l1_table = s->l1_table;
1279 l1_allocated = 0;
1280 }
1281
1282 l2_size = s->l2_size * sizeof(uint64_t);
1283 l2_table = qemu_malloc(l2_size);
1284 if (!l2_table)
1285 goto fail;
1286 l1_modified = 0;
1287 for(i = 0; i < l1_size; i++) {
1288 l2_offset = l1_table[i];
1289 if (l2_offset) {
1290 old_l2_offset = l2_offset;
1291 l2_offset &= ~QCOW_OFLAG_COPIED;
1292 l2_modified = 0;
1293 if (bdrv_pread(s->hd, l2_offset, l2_table, l2_size) != l2_size)
1294 goto fail;
1295 for(j = 0; j < s->l2_size; j++) {
1296 offset = be64_to_cpu(l2_table[j]);
1297 if (offset != 0) {
1298 old_offset = offset;
1299 offset &= ~QCOW_OFLAG_COPIED;
1300 if (offset & QCOW_OFLAG_COMPRESSED) {
1301 nb_csectors = ((offset >> s->csize_shift) &
1302 s->csize_mask) + 1;
1303 if (addend != 0)
1304 update_refcount(bs, (offset & s->cluster_offset_mask) & ~511,
1305 nb_csectors * 512, addend);
1306 /* compressed clusters are never modified */
1307 refcount = 2;
1308 } else {
1309 if (addend != 0) {
1310 refcount = update_cluster_refcount(bs, offset >> s->cluster_bits, addend);
1311 } else {
1312 refcount = get_refcount(bs, offset >> s->cluster_bits);
1313 }
1314 }
1315
1316 if (refcount == 1) {
1317 offset |= QCOW_OFLAG_COPIED;
1318 }
1319 if (offset != old_offset) {
1320 l2_table[j] = cpu_to_be64(offset);
1321 l2_modified = 1;
1322 }
1323 }
1324 }
1325 if (l2_modified) {
1326 if (bdrv_pwrite(s->hd,
1327 l2_offset, l2_table, l2_size) != l2_size)
1328 goto fail;
1329 }
1330
1331 if (addend != 0) {
1332 refcount = update_cluster_refcount(bs, l2_offset >> s->cluster_bits, addend);
1333 } else {
1334 refcount = get_refcount(bs, l2_offset >> s->cluster_bits);
1335 }
1336 if (refcount == 1) {
1337 l2_offset |= QCOW_OFLAG_COPIED;
1338 }
1339 if (l2_offset != old_l2_offset) {
1340 l1_table[i] = l2_offset;
1341 l1_modified = 1;
1342 }
1343 }
1344 }
1345 if (l1_modified) {
1346 for(i = 0; i < l1_size; i++)
1347 cpu_to_be64s(&l1_table[i]);
1348 if (bdrv_pwrite(s->hd, l1_table_offset, l1_table,
1349 l1_size2) != l1_size2)
1350 goto fail;
1351 for(i = 0; i < l1_size; i++)
1352 be64_to_cpus(&l1_table[i]);
1353 }
1354 if (l1_allocated)
1355 qemu_free(l1_table);
1356 qemu_free(l2_table);
1357 return 0;
1358 fail:
1359 if (l1_allocated)
1360 qemu_free(l1_table);
1361 qemu_free(l2_table);
1362 return -EIO;
1363 }
1364
1365 static void qcow_free_snapshots(BlockDriverState *bs)
1366 {
1367 BDRVQcowState *s = bs->opaque;
1368 int i;
1369
1370 for(i = 0; i < s->nb_snapshots; i++) {
1371 qemu_free(s->snapshots[i].name);
1372 qemu_free(s->snapshots[i].id_str);
1373 }
1374 qemu_free(s->snapshots);
1375 s->snapshots = NULL;
1376 s->nb_snapshots = 0;
1377 }
1378
1379 static int qcow_read_snapshots(BlockDriverState *bs)
1380 {
1381 BDRVQcowState *s = bs->opaque;
1382 QCowSnapshotHeader h;
1383 QCowSnapshot *sn;
1384 int i, id_str_size, name_size;
1385 int64_t offset;
1386 uint32_t extra_data_size;
1387
1388 offset = s->snapshots_offset;
1389 s->snapshots = qemu_mallocz(s->nb_snapshots * sizeof(QCowSnapshot));
1390 if (!s->snapshots)
1391 goto fail;
1392 for(i = 0; i < s->nb_snapshots; i++) {
1393 offset = align_offset(offset, 8);
1394 if (bdrv_pread(s->hd, offset, &h, sizeof(h)) != sizeof(h))
1395 goto fail;
1396 offset += sizeof(h);
1397 sn = s->snapshots + i;
1398 sn->l1_table_offset = be64_to_cpu(h.l1_table_offset);
1399 sn->l1_size = be32_to_cpu(h.l1_size);
1400 sn->vm_state_size = be32_to_cpu(h.vm_state_size);
1401 sn->date_sec = be32_to_cpu(h.date_sec);
1402 sn->date_nsec = be32_to_cpu(h.date_nsec);
1403 sn->vm_clock_nsec = be64_to_cpu(h.vm_clock_nsec);
1404 extra_data_size = be32_to_cpu(h.extra_data_size);
1405
1406 id_str_size = be16_to_cpu(h.id_str_size);
1407 name_size = be16_to_cpu(h.name_size);
1408
1409 offset += extra_data_size;
1410
1411 sn->id_str = qemu_malloc(id_str_size + 1);
1412 if (!sn->id_str)
1413 goto fail;
1414 if (bdrv_pread(s->hd, offset, sn->id_str, id_str_size) != id_str_size)
1415 goto fail;
1416 offset += id_str_size;
1417 sn->id_str[id_str_size] = '\0';
1418
1419 sn->name = qemu_malloc(name_size + 1);
1420 if (!sn->name)
1421 goto fail;
1422 if (bdrv_pread(s->hd, offset, sn->name, name_size) != name_size)
1423 goto fail;
1424 offset += name_size;
1425 sn->name[name_size] = '\0';
1426 }
1427 s->snapshots_size = offset - s->snapshots_offset;
1428 return 0;
1429 fail:
1430 qcow_free_snapshots(bs);
1431 return -1;
1432 }
1433
1434 /* add at the end of the file a new list of snapshots */
1435 static int qcow_write_snapshots(BlockDriverState *bs)
1436 {
1437 BDRVQcowState *s = bs->opaque;
1438 QCowSnapshot *sn;
1439 QCowSnapshotHeader h;
1440 int i, name_size, id_str_size, snapshots_size;
1441 uint64_t data64;
1442 uint32_t data32;
1443 int64_t offset, snapshots_offset;
1444
1445 /* compute the size of the snapshots */
1446 offset = 0;
1447 for(i = 0; i < s->nb_snapshots; i++) {
1448 sn = s->snapshots + i;
1449 offset = align_offset(offset, 8);
1450 offset += sizeof(h);
1451 offset += strlen(sn->id_str);
1452 offset += strlen(sn->name);
1453 }
1454 snapshots_size = offset;
1455
1456 snapshots_offset = alloc_clusters(bs, snapshots_size);
1457 offset = snapshots_offset;
1458
1459 for(i = 0; i < s->nb_snapshots; i++) {
1460 sn = s->snapshots + i;
1461 memset(&h, 0, sizeof(h));
1462 h.l1_table_offset = cpu_to_be64(sn->l1_table_offset);
1463 h.l1_size = cpu_to_be32(sn->l1_size);
1464 h.vm_state_size = cpu_to_be32(sn->vm_state_size);
1465 h.date_sec = cpu_to_be32(sn->date_sec);
1466 h.date_nsec = cpu_to_be32(sn->date_nsec);
1467 h.vm_clock_nsec = cpu_to_be64(sn->vm_clock_nsec);
1468
1469 id_str_size = strlen(sn->id_str);
1470 name_size = strlen(sn->name);
1471 h.id_str_size = cpu_to_be16(id_str_size);
1472 h.name_size = cpu_to_be16(name_size);
1473 offset = align_offset(offset, 8);
1474 if (bdrv_pwrite(s->hd, offset, &h, sizeof(h)) != sizeof(h))
1475 goto fail;
1476 offset += sizeof(h);
1477 if (bdrv_pwrite(s->hd, offset, sn->id_str, id_str_size) != id_str_size)
1478 goto fail;
1479 offset += id_str_size;
1480 if (bdrv_pwrite(s->hd, offset, sn->name, name_size) != name_size)
1481 goto fail;
1482 offset += name_size;
1483 }
1484
1485 /* update the various header fields */
1486 data64 = cpu_to_be64(snapshots_offset);
1487 if (bdrv_pwrite(s->hd, offsetof(QCowHeader, snapshots_offset),
1488 &data64, sizeof(data64)) != sizeof(data64))
1489 goto fail;
1490 data32 = cpu_to_be32(s->nb_snapshots);
1491 if (bdrv_pwrite(s->hd, offsetof(QCowHeader, nb_snapshots),
1492 &data32, sizeof(data32)) != sizeof(data32))
1493 goto fail;
1494
1495 /* free the old snapshot table */
1496 free_clusters(bs, s->snapshots_offset, s->snapshots_size);
1497 s->snapshots_offset = snapshots_offset;
1498 s->snapshots_size = snapshots_size;
1499 return 0;
1500 fail:
1501 return -1;
1502 }
1503
1504 static void find_new_snapshot_id(BlockDriverState *bs,
1505 char *id_str, int id_str_size)
1506 {
1507 BDRVQcowState *s = bs->opaque;
1508 QCowSnapshot *sn;
1509 int i, id, id_max = 0;
1510
1511 for(i = 0; i < s->nb_snapshots; i++) {
1512 sn = s->snapshots + i;
1513 id = strtoul(sn->id_str, NULL, 10);
1514 if (id > id_max)
1515 id_max = id;
1516 }
1517 snprintf(id_str, id_str_size, "%d", id_max + 1);
1518 }
1519
1520 static int find_snapshot_by_id(BlockDriverState *bs, const char *id_str)
1521 {
1522 BDRVQcowState *s = bs->opaque;
1523 int i;
1524
1525 for(i = 0; i < s->nb_snapshots; i++) {
1526 if (!strcmp(s->snapshots[i].id_str, id_str))
1527 return i;
1528 }
1529 return -1;
1530 }
1531
1532 static int find_snapshot_by_id_or_name(BlockDriverState *bs, const char *name)
1533 {
1534 BDRVQcowState *s = bs->opaque;
1535 int i, ret;
1536
1537 ret = find_snapshot_by_id(bs, name);
1538 if (ret >= 0)
1539 return ret;
1540 for(i = 0; i < s->nb_snapshots; i++) {
1541 if (!strcmp(s->snapshots[i].name, name))
1542 return i;
1543 }
1544 return -1;
1545 }
1546
1547 /* if no id is provided, a new one is constructed */
1548 static int qcow_snapshot_create(BlockDriverState *bs,
1549 QEMUSnapshotInfo *sn_info)
1550 {
1551 BDRVQcowState *s = bs->opaque;
1552 QCowSnapshot *snapshots1, sn1, *sn = &sn1;
1553 int i, ret;
1554 uint64_t *l1_table = NULL;
1555
1556 memset(sn, 0, sizeof(*sn));
1557
1558 if (sn_info->id_str[0] == '\0') {
1559 /* compute a new id */
1560 find_new_snapshot_id(bs, sn_info->id_str, sizeof(sn_info->id_str));
1561 }
1562
1563 /* check that the ID is unique */
1564 if (find_snapshot_by_id(bs, sn_info->id_str) >= 0)
1565 return -ENOENT;
1566
1567 sn->id_str = qemu_strdup(sn_info->id_str);
1568 if (!sn->id_str)
1569 goto fail;
1570 sn->name = qemu_strdup(sn_info->name);
1571 if (!sn->name)
1572 goto fail;
1573 sn->vm_state_size = sn_info->vm_state_size;
1574 sn->date_sec = sn_info->date_sec;
1575 sn->date_nsec = sn_info->date_nsec;
1576 sn->vm_clock_nsec = sn_info->vm_clock_nsec;
1577
1578 ret = update_snapshot_refcount(bs, s->l1_table_offset, s->l1_size, 1);
1579 if (ret < 0)
1580 goto fail;
1581
1582 /* create the L1 table of the snapshot */
1583 sn->l1_table_offset = alloc_clusters(bs, s->l1_size * sizeof(uint64_t));
1584 sn->l1_size = s->l1_size;
1585
1586 l1_table = qemu_malloc(s->l1_size * sizeof(uint64_t));
1587 if (!l1_table)
1588 goto fail;
1589 for(i = 0; i < s->l1_size; i++) {
1590 l1_table[i] = cpu_to_be64(s->l1_table[i]);
1591 }
1592 if (bdrv_pwrite(s->hd, sn->l1_table_offset,
1593 l1_table, s->l1_size * sizeof(uint64_t)) !=
1594 (s->l1_size * sizeof(uint64_t)))
1595 goto fail;
1596 qemu_free(l1_table);
1597 l1_table = NULL;
1598
1599 snapshots1 = qemu_malloc((s->nb_snapshots + 1) * sizeof(QCowSnapshot));
1600 if (!snapshots1)
1601 goto fail;
1602 memcpy(snapshots1, s->snapshots, s->nb_snapshots * sizeof(QCowSnapshot));
1603 s->snapshots = snapshots1;
1604 s->snapshots[s->nb_snapshots++] = *sn;
1605
1606 if (qcow_write_snapshots(bs) < 0)
1607 goto fail;
1608 #ifdef DEBUG_ALLOC
1609 check_refcounts(bs);
1610 #endif
1611 return 0;
1612 fail:
1613 qemu_free(sn->name);
1614 qemu_free(l1_table);
1615 return -1;
1616 }
1617
1618 /* copy the snapshot 'snapshot_name' into the current disk image */
1619 static int qcow_snapshot_goto(BlockDriverState *bs,
1620 const char *snapshot_id)
1621 {
1622 BDRVQcowState *s = bs->opaque;
1623 QCowSnapshot *sn;
1624 int i, snapshot_index, l1_size2;
1625
1626 snapshot_index = find_snapshot_by_id_or_name(bs, snapshot_id);
1627 if (snapshot_index < 0)
1628 return -ENOENT;
1629 sn = &s->snapshots[snapshot_index];
1630
1631 if (update_snapshot_refcount(bs, s->l1_table_offset, s->l1_size, -1) < 0)
1632 goto fail;
1633
1634 if (grow_l1_table(bs, sn->l1_size) < 0)
1635 goto fail;
1636
1637 s->l1_size = sn->l1_size;
1638 l1_size2 = s->l1_size * sizeof(uint64_t);
1639 /* copy the snapshot l1 table to the current l1 table */
1640 if (bdrv_pread(s->hd, sn->l1_table_offset,
1641 s->l1_table, l1_size2) != l1_size2)
1642 goto fail;
1643 if (bdrv_pwrite(s->hd, s->l1_table_offset,
1644 s->l1_table, l1_size2) != l1_size2)
1645 goto fail;
1646 for(i = 0;i < s->l1_size; i++) {
1647 be64_to_cpus(&s->l1_table[i]);
1648 }
1649
1650 if (update_snapshot_refcount(bs, s->l1_table_offset, s->l1_size, 1) < 0)
1651 goto fail;
1652
1653 #ifdef DEBUG_ALLOC
1654 check_refcounts(bs);
1655 #endif
1656 return 0;
1657 fail:
1658 return -EIO;
1659 }
1660
1661 static int qcow_snapshot_delete(BlockDriverState *bs, const char *snapshot_id)
1662 {
1663 BDRVQcowState *s = bs->opaque;
1664 QCowSnapshot *sn;
1665 int snapshot_index, ret;
1666
1667 snapshot_index = find_snapshot_by_id_or_name(bs, snapshot_id);
1668 if (snapshot_index < 0)
1669 return -ENOENT;
1670 sn = &s->snapshots[snapshot_index];
1671
1672 ret = update_snapshot_refcount(bs, sn->l1_table_offset, sn->l1_size, -1);
1673 if (ret < 0)
1674 return ret;
1675 /* must update the copied flag on the current cluster offsets */
1676 ret = update_snapshot_refcount(bs, s->l1_table_offset, s->l1_size, 0);
1677 if (ret < 0)
1678 return ret;
1679 free_clusters(bs, sn->l1_table_offset, sn->l1_size * sizeof(uint64_t));
1680
1681 qemu_free(sn->id_str);
1682 qemu_free(sn->name);
1683 memmove(sn, sn + 1, (s->nb_snapshots - snapshot_index - 1) * sizeof(*sn));
1684 s->nb_snapshots--;
1685 ret = qcow_write_snapshots(bs);
1686 if (ret < 0) {
1687 /* XXX: restore snapshot if error ? */
1688 return ret;
1689 }
1690 #ifdef DEBUG_ALLOC
1691 check_refcounts(bs);
1692 #endif
1693 return 0;
1694 }
1695
1696 static int qcow_snapshot_list(BlockDriverState *bs,
1697 QEMUSnapshotInfo **psn_tab)
1698 {
1699 BDRVQcowState *s = bs->opaque;
1700 QEMUSnapshotInfo *sn_tab, *sn_info;
1701 QCowSnapshot *sn;
1702 int i;
1703
1704 sn_tab = qemu_mallocz(s->nb_snapshots * sizeof(QEMUSnapshotInfo));
1705 if (!sn_tab)
1706 goto fail;
1707 for(i = 0; i < s->nb_snapshots; i++) {
1708 sn_info = sn_tab + i;
1709 sn = s->snapshots + i;
1710 pstrcpy(sn_info->id_str, sizeof(sn_info->id_str),
1711 sn->id_str);
1712 pstrcpy(sn_info->name, sizeof(sn_info->name),
1713 sn->name);
1714 sn_info->vm_state_size = sn->vm_state_size;
1715 sn_info->date_sec = sn->date_sec;
1716 sn_info->date_nsec = sn->date_nsec;
1717 sn_info->vm_clock_nsec = sn->vm_clock_nsec;
1718 }
1719 *psn_tab = sn_tab;
1720 return s->nb_snapshots;
1721 fail:
1722 qemu_free(sn_tab);
1723 *psn_tab = NULL;
1724 return -ENOMEM;
1725 }
1726
1727 /*********************************************************/
1728 /* refcount handling */
1729
1730 static int refcount_init(BlockDriverState *bs)
1731 {
1732 BDRVQcowState *s = bs->opaque;
1733 int ret, refcount_table_size2, i;
1734
1735 s->refcount_block_cache = qemu_malloc(s->cluster_size);
1736 if (!s->refcount_block_cache)
1737 goto fail;
1738 refcount_table_size2 = s->refcount_table_size * sizeof(uint64_t);
1739 s->refcount_table = qemu_malloc(refcount_table_size2);
1740 if (!s->refcount_table)
1741 goto fail;
1742 if (s->refcount_table_size > 0) {
1743 ret = bdrv_pread(s->hd, s->refcount_table_offset,
1744 s->refcount_table, refcount_table_size2);
1745 if (ret != refcount_table_size2)
1746 goto fail;
1747 for(i = 0; i < s->refcount_table_size; i++)
1748 be64_to_cpus(&s->refcount_table[i]);
1749 }
1750 return 0;
1751 fail:
1752 return -ENOMEM;
1753 }
1754
1755 static void refcount_close(BlockDriverState *bs)
1756 {
1757 BDRVQcowState *s = bs->opaque;
1758 qemu_free(s->refcount_block_cache);
1759 qemu_free(s->refcount_table);
1760 }
1761
1762
1763 static int load_refcount_block(BlockDriverState *bs,
1764 int64_t refcount_block_offset)
1765 {
1766 BDRVQcowState *s = bs->opaque;
1767 int ret;
1768 ret = bdrv_pread(s->hd, refcount_block_offset, s->refcount_block_cache,
1769 s->cluster_size);
1770 if (ret != s->cluster_size)
1771 return -EIO;
1772 s->refcount_block_cache_offset = refcount_block_offset;
1773 return 0;
1774 }
1775
1776 static int get_refcount(BlockDriverState *bs, int64_t cluster_index)
1777 {
1778 BDRVQcowState *s = bs->opaque;
1779 int refcount_table_index, block_index;
1780 int64_t refcount_block_offset;
1781
1782 refcount_table_index = cluster_index >> (s->cluster_bits - REFCOUNT_SHIFT);
1783 if (refcount_table_index >= s->refcount_table_size)
1784 return 0;
1785 refcount_block_offset = s->refcount_table[refcount_table_index];
1786 if (!refcount_block_offset)
1787 return 0;
1788 if (refcount_block_offset != s->refcount_block_cache_offset) {
1789 /* better than nothing: return allocated if read error */
1790 if (load_refcount_block(bs, refcount_block_offset) < 0)
1791 return 1;
1792 }
1793 block_index = cluster_index &
1794 ((1 << (s->cluster_bits - REFCOUNT_SHIFT)) - 1);
1795 return be16_to_cpu(s->refcount_block_cache[block_index]);
1796 }
1797
1798 /* return < 0 if error */
1799 static int64_t alloc_clusters_noref(BlockDriverState *bs, int64_t size)
1800 {
1801 BDRVQcowState *s = bs->opaque;
1802 int i, nb_clusters;
1803
1804 nb_clusters = (size + s->cluster_size - 1) >> s->cluster_bits;
1805 for(;;) {
1806 if (get_refcount(bs, s->free_cluster_index) == 0) {
1807 s->free_cluster_index++;
1808 for(i = 1; i < nb_clusters; i++) {
1809 if (get_refcount(bs, s->free_cluster_index) != 0)
1810 goto not_found;
1811 s->free_cluster_index++;
1812 }
1813 #ifdef DEBUG_ALLOC2
1814 printf("alloc_clusters: size=%lld -> %lld\n",
1815 size,
1816 (s->free_cluster_index - nb_clusters) << s->cluster_bits);
1817 #endif
1818 return (s->free_cluster_index - nb_clusters) << s->cluster_bits;
1819 } else {
1820 not_found:
1821 s->free_cluster_index++;
1822 }
1823 }
1824 }
1825
1826 static int64_t alloc_clusters(BlockDriverState *bs, int64_t size)
1827 {
1828 int64_t offset;
1829
1830 offset = alloc_clusters_noref(bs, size);
1831 update_refcount(bs, offset, size, 1);
1832 return offset;
1833 }
1834
1835 /* only used to allocate compressed sectors. We try to allocate
1836 contiguous sectors. size must be <= cluster_size */
1837 static int64_t alloc_bytes(BlockDriverState *bs, int size)
1838 {
1839 BDRVQcowState *s = bs->opaque;
1840 int64_t offset, cluster_offset;
1841 int free_in_cluster;
1842
1843 assert(size > 0 && size <= s->cluster_size);
1844 if (s->free_byte_offset == 0) {
1845 s->free_byte_offset = alloc_clusters(bs, s->cluster_size);
1846 }
1847 redo:
1848 free_in_cluster = s->cluster_size -
1849 (s->free_byte_offset & (s->cluster_size - 1));
1850 if (size <= free_in_cluster) {
1851 /* enough space in current cluster */
1852 offset = s->free_byte_offset;
1853 s->free_byte_offset += size;
1854 free_in_cluster -= size;
1855 if (free_in_cluster == 0)
1856 s->free_byte_offset = 0;
1857 if ((offset & (s->cluster_size - 1)) != 0)
1858 update_cluster_refcount(bs, offset >> s->cluster_bits, 1);
1859 } else {
1860 offset = alloc_clusters(bs, s->cluster_size);
1861 cluster_offset = s->free_byte_offset & ~(s->cluster_size - 1);
1862 if ((cluster_offset + s->cluster_size) == offset) {
1863 /* we are lucky: contiguous data */
1864 offset = s->free_byte_offset;
1865 update_cluster_refcount(bs, offset >> s->cluster_bits, 1);
1866 s->free_byte_offset += size;
1867 } else {
1868 s->free_byte_offset = offset;
1869 goto redo;
1870 }
1871 }
1872 return offset;
1873 }
1874
1875 static void free_clusters(BlockDriverState *bs,
1876 int64_t offset, int64_t size)
1877 {
1878 update_refcount(bs, offset, size, -1);
1879 }
1880
1881 static int grow_refcount_table(BlockDriverState *bs, int min_size)
1882 {
1883 BDRVQcowState *s = bs->opaque;
1884 int new_table_size, new_table_size2, refcount_table_clusters, i, ret;
1885 uint64_t *new_table;
1886 int64_t table_offset;
1887 uint64_t data64;
1888 uint32_t data32;
1889
1890 if (min_size <= s->refcount_table_size)
1891 return 0;
1892 /* compute new table size */
1893 refcount_table_clusters = s->refcount_table_size >> (s->cluster_bits - 3);
1894 for(;;) {
1895 if (refcount_table_clusters == 0) {
1896 refcount_table_clusters = 1;
1897 } else {
1898 refcount_table_clusters = (refcount_table_clusters * 3 + 1) / 2;
1899 }
1900 new_table_size = refcount_table_clusters << (s->cluster_bits - 3);
1901 if (min_size <= new_table_size)
1902 break;
1903 }
1904 #ifdef DEBUG_ALLOC2
1905 printf("grow_refcount_table from %d to %d\n",
1906 s->refcount_table_size,
1907 new_table_size);
1908 #endif
1909 new_table_size2 = new_table_size * sizeof(uint64_t);
1910 new_table = qemu_mallocz(new_table_size2);
1911 if (!new_table)
1912 return -ENOMEM;
1913 memcpy(new_table, s->refcount_table,
1914 s->refcount_table_size * sizeof(uint64_t));
1915 for(i = 0; i < s->refcount_table_size; i++)
1916 cpu_to_be64s(&new_table[i]);
1917 /* Note: we cannot update the refcount now to avoid recursion */
1918 table_offset = alloc_clusters_noref(bs, new_table_size2);
1919 ret = bdrv_pwrite(s->hd, table_offset, new_table, new_table_size2);
1920 if (ret != new_table_size2)
1921 goto fail;
1922 for(i = 0; i < s->refcount_table_size; i++)
1923 be64_to_cpus(&new_table[i]);
1924
1925 data64 = cpu_to_be64(table_offset);
1926 if (bdrv_pwrite(s->hd, offsetof(QCowHeader, refcount_table_offset),
1927 &data64, sizeof(data64)) != sizeof(data64))
1928 goto fail;
1929 data32 = cpu_to_be32(refcount_table_clusters);
1930 if (bdrv_pwrite(s->hd, offsetof(QCowHeader, refcount_table_clusters),
1931 &data32, sizeof(data32)) != sizeof(data32))
1932 goto fail;
1933 qemu_free(s->refcount_table);
1934 s->refcount_table = new_table;
1935 s->refcount_table_size = new_table_size;
1936
1937 update_refcount(bs, table_offset, new_table_size2, 1);
1938 return 0;
1939 fail:
1940 free_clusters(bs, table_offset, new_table_size2);
1941 qemu_free(new_table);
1942 return -EIO;
1943 }
1944
1945 /* addend must be 1 or -1 */
1946 /* XXX: cache several refcount block clusters ? */
1947 static int update_cluster_refcount(BlockDriverState *bs,
1948 int64_t cluster_index,
1949 int addend)
1950 {
1951 BDRVQcowState *s = bs->opaque;
1952 int64_t offset, refcount_block_offset;
1953 int ret, refcount_table_index, block_index, refcount;
1954 uint64_t data64;
1955
1956 refcount_table_index = cluster_index >> (s->cluster_bits - REFCOUNT_SHIFT);
1957 if (refcount_table_index >= s->refcount_table_size) {
1958 if (addend < 0)
1959 return -EINVAL;
1960 ret = grow_refcount_table(bs, refcount_table_index + 1);
1961 if (ret < 0)
1962 return ret;
1963 }
1964 refcount_block_offset = s->refcount_table[refcount_table_index];
1965 if (!refcount_block_offset) {
1966 if (addend < 0)
1967 return -EINVAL;
1968 /* create a new refcount block */
1969 /* Note: we cannot update the refcount now to avoid recursion */
1970 offset = alloc_clusters_noref(bs, s->cluster_size);
1971 memset(s->refcount_block_cache, 0, s->cluster_size);
1972 ret = bdrv_pwrite(s->hd, offset, s->refcount_block_cache, s->cluster_size);
1973 if (ret != s->cluster_size)
1974 return -EINVAL;
1975 s->refcount_table[refcount_table_index] = offset;
1976 data64 = cpu_to_be64(offset);
1977 ret = bdrv_pwrite(s->hd, s->refcount_table_offset +
1978 refcount_table_index * sizeof(uint64_t),
1979 &data64, sizeof(data64));
1980 if (ret != sizeof(data64))
1981 return -EINVAL;
1982
1983 refcount_block_offset = offset;
1984 s->refcount_block_cache_offset = offset;
1985 update_refcount(bs, offset, s->cluster_size, 1);
1986 } else {
1987 if (refcount_block_offset != s->refcount_block_cache_offset) {
1988 if (load_refcount_block(bs, refcount_block_offset) < 0)
1989 return -EIO;
1990 }
1991 }
1992 /* we can update the count and save it */
1993 block_index = cluster_index &
1994 ((1 << (s->cluster_bits - REFCOUNT_SHIFT)) - 1);
1995 refcount = be16_to_cpu(s->refcount_block_cache[block_index]);
1996 refcount += addend;
1997 if (refcount < 0 || refcount > 0xffff)
1998 return -EINVAL;
1999 if (refcount == 0 && cluster_index < s->free_cluster_index) {
2000 s->free_cluster_index = cluster_index;
2001 }
2002 s->refcount_block_cache[block_index] = cpu_to_be16(refcount);
2003 if (bdrv_pwrite(s->hd,
2004 refcount_block_offset + (block_index << REFCOUNT_SHIFT),
2005 &s->refcount_block_cache[block_index], 2) != 2)
2006 return -EIO;
2007 return refcount;
2008 }
2009
2010 static void update_refcount(BlockDriverState *bs,
2011 int64_t offset, int64_t length,
2012 int addend)
2013 {
2014 BDRVQcowState *s = bs->opaque;
2015 int64_t start, last, cluster_offset;
2016
2017 #ifdef DEBUG_ALLOC2
2018 printf("update_refcount: offset=%lld size=%lld addend=%d\n",
2019 offset, length, addend);
2020 #endif
2021 if (length <= 0)
2022 return;
2023 start = offset & ~(s->cluster_size - 1);
2024 last = (offset + length - 1) & ~(s->cluster_size - 1);
2025 for(cluster_offset = start; cluster_offset <= last;
2026 cluster_offset += s->cluster_size) {
2027 update_cluster_refcount(bs, cluster_offset >> s->cluster_bits, addend);
2028 }
2029 }
2030
2031 #ifdef DEBUG_ALLOC
2032 static void inc_refcounts(BlockDriverState *bs,
2033 uint16_t *refcount_table,
2034 int refcount_table_size,
2035 int64_t offset, int64_t size)
2036 {
2037 BDRVQcowState *s = bs->opaque;
2038 int64_t start, last, cluster_offset;
2039 int k;
2040
2041 if (size <= 0)
2042 return;
2043
2044 start = offset & ~(s->cluster_size - 1);
2045 last = (offset + size - 1) & ~(s->cluster_size - 1);
2046 for(cluster_offset = start; cluster_offset <= last;
2047 cluster_offset += s->cluster_size) {
2048 k = cluster_offset >> s->cluster_bits;
2049 if (k < 0 || k >= refcount_table_size) {
2050 printf("ERROR: invalid cluster offset=0x%llx\n", cluster_offset);
2051 } else {
2052 if (++refcount_table[k] == 0) {
2053 printf("ERROR: overflow cluster offset=0x%llx\n", cluster_offset);
2054 }
2055 }
2056 }
2057 }
2058
2059 static int check_refcounts_l1(BlockDriverState *bs,
2060 uint16_t *refcount_table,
2061 int refcount_table_size,
2062 int64_t l1_table_offset, int l1_size,
2063 int check_copied)
2064 {
2065 BDRVQcowState *s = bs->opaque;
2066 uint64_t *l1_table, *l2_table, l2_offset, offset, l1_size2;
2067 int l2_size, i, j, nb_csectors, refcount;
2068
2069 l2_table = NULL;
2070 l1_size2 = l1_size * sizeof(uint64_t);
2071
2072 inc_refcounts(bs, refcount_table, refcount_table_size,
2073 l1_table_offset, l1_size2);
2074
2075 l1_table = qemu_malloc(l1_size2);
2076 if (!l1_table)
2077 goto fail;
2078 if (bdrv_pread(s->hd, l1_table_offset,
2079 l1_table, l1_size2) != l1_size2)
2080 goto fail;
2081 for(i = 0;i < l1_size; i++)
2082 be64_to_cpus(&l1_table[i]);
2083
2084 l2_size = s->l2_size * sizeof(uint64_t);
2085 l2_table = qemu_malloc(l2_size);
2086 if (!l2_table)
2087 goto fail;
2088 for(i = 0; i < l1_size; i++) {
2089 l2_offset = l1_table[i];
2090 if (l2_offset) {
2091 if (check_copied) {
2092 refcount = get_refcount(bs, (l2_offset & ~QCOW_OFLAG_COPIED) >> s->cluster_bits);
2093 if ((refcount == 1) != ((l2_offset & QCOW_OFLAG_COPIED) != 0)) {
2094 printf("ERROR OFLAG_COPIED: l2_offset=%llx refcount=%d\n",
2095 l2_offset, refcount);
2096 }
2097 }
2098 l2_offset &= ~QCOW_OFLAG_COPIED;
2099 if (bdrv_pread(s->hd, l2_offset, l2_table, l2_size) != l2_size)
2100 goto fail;
2101 for(j = 0; j < s->l2_size; j++) {
2102 offset = be64_to_cpu(l2_table[j]);
2103 if (offset != 0) {
2104 if (offset & QCOW_OFLAG_COMPRESSED) {
2105 if (offset & QCOW_OFLAG_COPIED) {
2106 printf("ERROR: cluster %lld: copied flag must never be set for compressed clusters\n",
2107 offset >> s->cluster_bits);
2108 offset &= ~QCOW_OFLAG_COPIED;
2109 }
2110 nb_csectors = ((offset >> s->csize_shift) &
2111 s->csize_mask) + 1;
2112 offset &= s->cluster_offset_mask;
2113 inc_refcounts(bs, refcount_table,
2114 refcount_table_size,
2115 offset & ~511, nb_csectors * 512);
2116 } else {
2117 if (check_copied) {
2118 refcount = get_refcount(bs, (offset & ~QCOW_OFLAG_COPIED) >> s->cluster_bits);
2119 if ((refcount == 1) != ((offset & QCOW_OFLAG_COPIED) != 0)) {
2120 printf("ERROR OFLAG_COPIED: offset=%llx refcount=%d\n",
2121 offset, refcount);
2122 }
2123 }
2124 offset &= ~QCOW_OFLAG_COPIED;
2125 inc_refcounts(bs, refcount_table,
2126 refcount_table_size,
2127 offset, s->cluster_size);
2128 }
2129 }
2130 }
2131 inc_refcounts(bs, refcount_table,
2132 refcount_table_size,
2133 l2_offset,
2134 s->cluster_size);
2135 }
2136 }
2137 qemu_free(l1_table);
2138 qemu_free(l2_table);
2139 return 0;
2140 fail:
2141 printf("ERROR: I/O error in check_refcounts_l1\n");
2142 qemu_free(l1_table);
2143 qemu_free(l2_table);
2144 return -EIO;
2145 }
2146
2147 static void check_refcounts(BlockDriverState *bs)
2148 {
2149 BDRVQcowState *s = bs->opaque;
2150 int64_t size;
2151 int nb_clusters, refcount1, refcount2, i;
2152 QCowSnapshot *sn;
2153 uint16_t *refcount_table;
2154
2155 size = bdrv_getlength(s->hd);
2156 nb_clusters = (size + s->cluster_size - 1) >> s->cluster_bits;
2157 refcount_table = qemu_mallocz(nb_clusters * sizeof(uint16_t));
2158
2159 /* header */
2160 inc_refcounts(bs, refcount_table, nb_clusters,
2161 0, s->cluster_size);
2162
2163 check_refcounts_l1(bs, refcount_table, nb_clusters,
2164 s->l1_table_offset, s->l1_size, 1);
2165
2166 /* snapshots */
2167 for(i = 0; i < s->nb_snapshots; i++) {
2168 sn = s->snapshots + i;
2169 check_refcounts_l1(bs, refcount_table, nb_clusters,
2170 sn->l1_table_offset, sn->l1_size, 0);
2171 }
2172 inc_refcounts(bs, refcount_table, nb_clusters,
2173 s->snapshots_offset, s->snapshots_size);
2174
2175 /* refcount data */
2176 inc_refcounts(bs, refcount_table, nb_clusters,
2177 s->refcount_table_offset,
2178 s->refcount_table_size * sizeof(uint64_t));
2179 for(i = 0; i < s->refcount_table_size; i++) {
2180 int64_t offset;
2181 offset = s->refcount_table[i];
2182 if (offset != 0) {
2183 inc_refcounts(bs, refcount_table, nb_clusters,
2184 offset, s->cluster_size);
2185 }
2186 }
2187
2188 /* compare ref counts */
2189 for(i = 0; i < nb_clusters; i++) {
2190 refcount1 = get_refcount(bs, i);
2191 refcount2 = refcount_table[i];
2192 if (refcount1 != refcount2)
2193 printf("ERROR cluster %d refcount=%d reference=%d\n",
2194 i, refcount1, refcount2);
2195 }
2196
2197 qemu_free(refcount_table);
2198 }
2199
2200 #if 0
2201 static void dump_refcounts(BlockDriverState *bs)
2202 {
2203 BDRVQcowState *s = bs->opaque;
2204 int64_t nb_clusters, k, k1, size;
2205 int refcount;
2206
2207 size = bdrv_getlength(s->hd);
2208 nb_clusters = (size + s->cluster_size - 1) >> s->cluster_bits;
2209 for(k = 0; k < nb_clusters;) {
2210 k1 = k;
2211 refcount = get_refcount(bs, k);
2212 k++;
2213 while (k < nb_clusters && get_refcount(bs, k) == refcount)
2214 k++;
2215 printf("%lld: refcount=%d nb=%lld\n", k, refcount, k - k1);
2216 }
2217 }
2218 #endif
2219 #endif
2220
2221 BlockDriver bdrv_qcow2 = {
2222 "qcow2",
2223 sizeof(BDRVQcowState),
2224 qcow_probe,
2225 qcow_open,
2226 NULL,
2227 NULL,
2228 qcow_close,
2229 qcow_create,
2230 qcow_flush,
2231 qcow_is_allocated,
2232 qcow_set_key,
2233 qcow_make_empty,
2234
2235 .bdrv_aio_read = qcow_aio_read,
2236 .bdrv_aio_write = qcow_aio_write,
2237 .bdrv_aio_cancel = qcow_aio_cancel,
2238 .aiocb_size = sizeof(QCowAIOCB),
2239 .bdrv_write_compressed = qcow_write_compressed,
2240
2241 .bdrv_snapshot_create = qcow_snapshot_create,
2242 .bdrv_snapshot_goto = qcow_snapshot_goto,
2243 .bdrv_snapshot_delete = qcow_snapshot_delete,
2244 .bdrv_snapshot_list = qcow_snapshot_list,
2245 .bdrv_get_info = qcow_get_info,
2246 };
2247 /*
2248 * Block driver for the QCOW version 2 format
2249 *
2250 * Copyright (c) 2004-2006 Fabrice Bellard
2251 *
2252 * Permission is hereby granted, free of charge, to any person obtaining a copy
2253 * of this software and associated documentation files (the "Software"), to deal
2254 * in the Software without restriction, including without limitation the rights
2255 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
2256 * copies of the Software, and to permit persons to whom the Software is
2257 * furnished to do so, subject to the following conditions:
2258 *
2259 * The above copyright notice and this permission notice shall be included in
2260 * all copies or substantial portions of the Software.
2261 *
2262 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
2263 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
2264 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
2265 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
2266 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
2267 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
2268 * THE SOFTWARE.
2269 */
2270 #include "vl.h"
2271 #include "block_int.h"
2272 #include <zlib.h>
2273 #include "aes.h"
2274 #include <assert.h>
2275
2276 /*
2277 Differences with QCOW:
2278
2279 - Support for multiple incremental snapshots.
2280 - Memory management by reference counts.
2281 - Clusters which have a reference count of one have the bit
2282 QCOW_OFLAG_COPIED to optimize write performance.
2283 - Size of compressed clusters is stored in sectors to reduce bit usage
2284 in the cluster offsets.
2285 - Support for storing additional data (such as the VM state) in the
2286 snapshots.
2287 - If a backing store is used, the cluster size is not constrained
2288 (could be backported to QCOW).
2289 - L2 tables have always a size of one cluster.
2290 */
2291
2292 //#define DEBUG_ALLOC
2293 //#define DEBUG_ALLOC2
2294
2295 #define QCOW_MAGIC (('Q' << 24) | ('F' << 16) | ('I' << 8) | 0xfb)
2296 #define QCOW_VERSION 2
2297
2298 #define QCOW_CRYPT_NONE 0
2299 #define QCOW_CRYPT_AES 1
2300
2301 /* indicate that the refcount of the referenced cluster is exactly one. */
2302 #define QCOW_OFLAG_COPIED (1LL << 63)
2303 /* indicate that the cluster is compressed (they never have the copied flag) */
2304 #define QCOW_OFLAG_COMPRESSED (1LL << 62)
2305
2306 #define REFCOUNT_SHIFT 1 /* refcount size is 2 bytes */
2307
2308 #ifndef offsetof
2309 #define offsetof(type, field) ((size_t) &((type *)0)->field)
2310 #endif
2311
2312 typedef struct QCowHeader {
2313 uint32_t magic;
2314 uint32_t version;
2315 uint64_t backing_file_offset;
2316 uint32_t backing_file_size;
2317 uint32_t cluster_bits;
2318 uint64_t size; /* in bytes */
2319 uint32_t crypt_method;
2320 uint32_t l1_size; /* XXX: save number of clusters instead ? */
2321 uint64_t l1_table_offset;
2322 uint64_t refcount_table_offset;
2323 uint32_t refcount_table_clusters;
2324 uint32_t nb_snapshots;
2325 uint64_t snapshots_offset;
2326 } QCowHeader;
2327
2328 typedef struct __attribute__((packed)) QCowSnapshotHeader {
2329 /* header is 8 byte aligned */
2330 uint64_t l1_table_offset;
2331
2332 uint32_t l1_size;
2333 uint16_t id_str_size;
2334 uint16_t name_size;
2335
2336 uint32_t date_sec;
2337 uint32_t date_nsec;
2338
2339 uint64_t vm_clock_nsec;
2340
2341 uint32_t vm_state_size;
2342 uint32_t extra_data_size; /* for extension */
2343 /* extra data follows */
2344 /* id_str follows */
2345 /* name follows */
2346 } QCowSnapshotHeader;
2347
2348 #define L2_CACHE_SIZE 16
2349
2350 typedef struct QCowSnapshot {
2351 uint64_t l1_table_offset;
2352 uint32_t l1_size;
2353 char *id_str;
2354 char *name;
2355 uint32_t vm_state_size;
2356 uint32_t date_sec;
2357 uint32_t date_nsec;
2358 uint64_t vm_clock_nsec;
2359 } QCowSnapshot;
2360
2361 typedef struct BDRVQcowState {
2362 BlockDriverState *hd;
2363 int cluster_bits;
2364 int cluster_size;
2365 int cluster_sectors;
2366 int l2_bits;
2367 int l2_size;
2368 int l1_size;
2369 int l1_vm_state_index;
2370 int csize_shift;
2371 int csize_mask;
2372 uint64_t cluster_offset_mask;
2373 uint64_t l1_table_offset;
2374 uint64_t *l1_table;
2375 uint64_t *l2_cache;
2376 uint64_t l2_cache_offsets[L2_CACHE_SIZE];
2377 uint32_t l2_cache_counts[L2_CACHE_SIZE];
2378 uint8_t *cluster_cache;
2379 uint8_t *cluster_data;
2380 uint64_t cluster_cache_offset;
2381
2382 uint64_t *refcount_table;
2383 uint64_t refcount_table_offset;
2384 uint32_t refcount_table_size;
2385 uint64_t refcount_block_cache_offset;
2386 uint16_t *refcount_block_cache;
2387 int64_t free_cluster_index;
2388 int64_t free_byte_offset;
2389
2390 uint32_t crypt_method; /* current crypt method, 0 if no key yet */
2391 uint32_t crypt_method_header;
2392 AES_KEY aes_encrypt_key;
2393 AES_KEY aes_decrypt_key;
2394 uint64_t snapshots_offset;
2395 int snapshots_size;
2396 int nb_snapshots;
2397 QCowSnapshot *snapshots;
2398 } BDRVQcowState;
2399
2400 static int decompress_cluster(BDRVQcowState *s, uint64_t cluster_offset);
2401 static int qcow_read(BlockDriverState *bs, int64_t sector_num,
2402 uint8_t *buf, int nb_sectors);
2403 static int qcow_read_snapshots(BlockDriverState *bs);
2404 static void qcow_free_snapshots(BlockDriverState *bs);
2405 static int refcount_init(BlockDriverState *bs);
2406 static void refcount_close(BlockDriverState *bs);
2407 static int get_refcount(BlockDriverState *bs, int64_t cluster_index);
2408 static int update_cluster_refcount(BlockDriverState *bs,
2409 int64_t cluster_index,
2410 int addend);
2411 static void update_refcount(BlockDriverState *bs,
2412 int64_t offset, int64_t length,
2413 int addend);
2414 static int64_t alloc_clusters(BlockDriverState *bs, int64_t size);
2415 static int64_t alloc_bytes(BlockDriverState *bs, int size);
2416 static void free_clusters(BlockDriverState *bs,
2417 int64_t offset, int64_t size);
2418 #ifdef DEBUG_ALLOC
2419 static void check_refcounts(BlockDriverState *bs);
2420 #endif
2421
2422 static int qcow_probe(const uint8_t *buf, int buf_size, const char *filename)
2423 {
2424 const QCowHeader *cow_header = (const void *)buf;
2425
2426 if (buf_size >= sizeof(QCowHeader) &&
2427 be32_to_cpu(cow_header->magic) == QCOW_MAGIC &&
2428 be32_to_cpu(cow_header->version) == QCOW_VERSION)
2429 return 100;
2430 else
2431 return 0;
2432 }
2433
2434 static int qcow_open(BlockDriverState *bs, const char *filename, int flags)
2435 {
2436 BDRVQcowState *s = bs->opaque;
2437 int len, i, shift, ret;
2438 QCowHeader header;
2439
2440 ret = bdrv_file_open(&s->hd, filename, flags);
2441 if (ret < 0)
2442 return ret;
2443 if (bdrv_pread(s->hd, 0, &header, sizeof(header)) != sizeof(header))
2444 goto fail;
2445 be32_to_cpus(&header.magic);
2446 be32_to_cpus(&header.version);
2447 be64_to_cpus(&header.backing_file_offset);
2448 be32_to_cpus(&header.backing_file_size);
2449 be64_to_cpus(&header.size);
2450 be32_to_cpus(&header.cluster_bits);
2451 be32_to_cpus(&header.crypt_method);
2452 be64_to_cpus(&header.l1_table_offset);
2453 be32_to_cpus(&header.l1_size);
2454 be64_to_cpus(&header.refcount_table_offset);
2455 be32_to_cpus(&header.refcount_table_clusters);
2456 be64_to_cpus(&header.snapshots_offset);
2457 be32_to_cpus(&header.nb_snapshots);
2458
2459 if (header.magic != QCOW_MAGIC || header.version != QCOW_VERSION)
2460 goto fail;
2461 if (header.size <= 1 ||
2462 header.cluster_bits < 9 ||
2463 header.cluster_bits > 16)
2464 goto fail;
2465 if (header.crypt_method > QCOW_CRYPT_AES)
2466 goto fail;
2467 s->crypt_method_header = header.crypt_method;
2468 if (s->crypt_method_header)
2469 bs->encrypted = 1;
2470 s->cluster_bits = header.cluster_bits;
2471 s->cluster_size = 1 << s->cluster_bits;
2472 s->cluster_sectors = 1 << (s->cluster_bits - 9);
2473 s->l2_bits = s->cluster_bits - 3; /* L2 is always one cluster */
2474 s->l2_size = 1 << s->l2_bits;
2475 bs->total_sectors = header.size / 512;
2476 s->csize_shift = (62 - (s->cluster_bits - 8));
2477 s->csize_mask = (1 << (s->cluster_bits - 8)) - 1;
2478 s->cluster_offset_mask = (1LL << s->csize_shift) - 1;
2479 s->refcount_table_offset = header.refcount_table_offset;
2480 s->refcount_table_size =
2481 header.refcount_table_clusters << (s->cluster_bits - 3);
2482
2483 s->snapshots_offset = header.snapshots_offset;
2484 s->nb_snapshots = header.nb_snapshots;
2485
2486 /* read the level 1 table */
2487 s->l1_size = header.l1_size;
2488 shift = s->cluster_bits + s->l2_bits;
2489 s->l1_vm_state_index = (header.size + (1LL << shift) - 1) >> shift;
2490 /* the L1 table must contain at least enough entries to put
2491 header.size bytes */
2492 if (s->l1_size < s->l1_vm_state_index)
2493 goto fail;
2494 s->l1_table_offset = header.l1_table_offset;
2495 s->l1_table = qemu_malloc(s->l1_size * sizeof(uint64_t));
2496 if (!s->l1_table)
2497 goto fail;
2498 if (bdrv_pread(s->hd, s->l1_table_offset, s->l1_table, s->l1_size * sizeof(uint64_t)) !=
2499 s->l1_size * sizeof(uint64_t))
2500 goto fail;
2501 for(i = 0;i < s->l1_size; i++) {
2502 be64_to_cpus(&s->l1_table[i]);
2503 }
2504 /* alloc L2 cache */
2505 s->l2_cache = qemu_malloc(s->l2_size * L2_CACHE_SIZE * sizeof(uint64_t));
2506 if (!s->l2_cache)
2507 goto fail;
2508 s->cluster_cache = qemu_malloc(s->cluster_size);
2509 if (!s->cluster_cache)
2510 goto fail;
2511 /* one more sector for decompressed data alignment */
2512 s->cluster_data = qemu_malloc(s->cluster_size + 512);
2513 if (!s->cluster_data)
2514 goto fail;
2515 s->cluster_cache_offset = -1;
2516
2517 if (refcount_init(bs) < 0)
2518 goto fail;
2519
2520 /* read the backing file name */
2521 if (header.backing_file_offset != 0) {
2522 len = header.backing_file_size;
2523 if (len > 1023)
2524 len = 1023;
2525 if (bdrv_pread(s->hd, header.backing_file_offset, bs->backing_file, len) != len)
2526 goto fail;
2527 bs->backing_file[len] = '\0';
2528 }
2529 if (qcow_read_snapshots(bs) < 0)
2530 goto fail;
2531
2532 #ifdef DEBUG_ALLOC
2533 check_refcounts(bs);
2534 #endif
2535 return 0;
2536
2537 fail:
2538 qcow_free_snapshots(bs);
2539 refcount_close(bs);
2540 qemu_free(s->l1_table);
2541 qemu_free(s->l2_cache);
2542 qemu_free(s->cluster_cache);
2543 qemu_free(s->cluster_data);
2544 bdrv_delete(s->hd);
2545 return -1;
2546 }
2547
2548 static int qcow_set_key(BlockDriverState *bs, const char *key)
2549 {
2550 BDRVQcowState *s = bs->opaque;
2551 uint8_t keybuf[16];
2552 int len, i;
2553
2554 memset(keybuf, 0, 16);
2555 len = strlen(key);
2556 if (len > 16)
2557 len = 16;
2558 /* XXX: we could compress the chars to 7 bits to increase
2559 entropy */
2560 for(i = 0;i < len;i++) {
2561 keybuf[i] = key[i];
2562 }
2563 s->crypt_method = s->crypt_method_header;
2564
2565 if (AES_set_encrypt_key(keybuf, 128, &s->aes_encrypt_key) != 0)
2566 return -1;
2567 if (AES_set_decrypt_key(keybuf, 128, &s->aes_decrypt_key) != 0)
2568 return -1;
2569 #if 0
2570 /* test */
2571 {
2572 uint8_t in[16];
2573 uint8_t out[16];
2574 uint8_t tmp[16];
2575 for(i=0;i<16;i++)
2576 in[i] = i;
2577 AES_encrypt(in, tmp, &s->aes_encrypt_key);
2578 AES_decrypt(tmp, out, &s->aes_decrypt_key);
2579 for(i = 0; i < 16; i++)
2580 printf(" %02x", tmp[i]);
2581 printf("\n");
2582 for(i = 0; i < 16; i++)
2583 printf(" %02x", out[i]);
2584 printf("\n");
2585 }
2586 #endif
2587 return 0;
2588 }
2589
2590 /* The crypt function is compatible with the linux cryptoloop
2591 algorithm for < 4 GB images. NOTE: out_buf == in_buf is
2592 supported */
2593 static void encrypt_sectors(BDRVQcowState *s, int64_t sector_num,
2594 uint8_t *out_buf, const uint8_t *in_buf,
2595 int nb_sectors, int enc,
2596 const AES_KEY *key)
2597 {
2598 union {
2599 uint64_t ll[2];
2600 uint8_t b[16];
2601 } ivec;
2602 int i;
2603
2604 for(i = 0; i < nb_sectors; i++) {
2605 ivec.ll[0] = cpu_to_le64(sector_num);
2606 ivec.ll[1] = 0;
2607 AES_cbc_encrypt(in_buf, out_buf, 512, key,
2608 ivec.b, enc);
2609 sector_num++;
2610 in_buf += 512;
2611 out_buf += 512;
2612 }
2613 }
2614
2615 static int copy_sectors(BlockDriverState *bs, uint64_t start_sect,
2616 uint64_t cluster_offset, int n_start, int n_end)
2617 {
2618 BDRVQcowState *s = bs->opaque;
2619 int n, ret;
2620
2621 n = n_end - n_start;
2622 if (n <= 0)
2623 return 0;
2624 ret = qcow_read(bs, start_sect + n_start, s->cluster_data, n);
2625 if (ret < 0)
2626 return ret;
2627 if (s->crypt_method) {
2628 encrypt_sectors(s, start_sect + n_start,
2629 s->cluster_data,
2630 s->cluster_data, n, 1,
2631 &s->aes_encrypt_key);
2632 }
2633 ret = bdrv_write(s->hd, (cluster_offset >> 9) + n_start,
2634 s->cluster_data, n);
2635 if (ret < 0)
2636 return ret;
2637 return 0;
2638 }
2639
2640 static void l2_cache_reset(BlockDriverState *bs)
2641 {
2642 BDRVQcowState *s = bs->opaque;
2643
2644 memset(s->l2_cache, 0, s->l2_size * L2_CACHE_SIZE * sizeof(uint64_t));
2645 memset(s->l2_cache_offsets, 0, L2_CACHE_SIZE * sizeof(uint64_t));
2646 memset(s->l2_cache_counts, 0, L2_CACHE_SIZE * sizeof(uint32_t));
2647 }
2648
2649 static inline int l2_cache_new_entry(BlockDriverState *bs)
2650 {
2651 BDRVQcowState *s = bs->opaque;
2652 uint32_t min_count;
2653 int min_index, i;
2654
2655 /* find a new entry in the least used one */
2656 min_index = 0;
2657 min_count = 0xffffffff;
2658 for(i = 0; i < L2_CACHE_SIZE; i++) {
2659 if (s->l2_cache_counts[i] < min_count) {
2660 min_count = s->l2_cache_counts[i];
2661 min_index = i;
2662 }
2663 }
2664 return min_index;
2665 }
2666
2667 static int64_t align_offset(int64_t offset, int n)
2668 {
2669 offset = (offset + n - 1) & ~(n - 1);
2670 return offset;
2671 }
2672
2673 static int grow_l1_table(BlockDriverState *bs, int min_size)
2674 {
2675 BDRVQcowState *s = bs->opaque;
2676 int new_l1_size, new_l1_size2, ret, i;
2677 uint64_t *new_l1_table;
2678 uint64_t new_l1_table_offset;
2679 uint64_t data64;
2680 uint32_t data32;
2681
2682 new_l1_size = s->l1_size;
2683 if (min_size <= new_l1_size)
2684 return 0;
2685 while (min_size > new_l1_size) {
2686 new_l1_size = (new_l1_size * 3 + 1) / 2;
2687 }
2688 #ifdef DEBUG_ALLOC2
2689 printf("grow l1_table from %d to %d\n", s->l1_size, new_l1_size);
2690 #endif
2691
2692 new_l1_size2 = sizeof(uint64_t) * new_l1_size;
2693 new_l1_table = qemu_mallocz(new_l1_size2);
2694 if (!new_l1_table)
2695 return -ENOMEM;
2696 memcpy(new_l1_table, s->l1_table, s->l1_size * sizeof(uint64_t));
2697
2698 /* write new table (align to cluster) */
2699 new_l1_table_offset = alloc_clusters(bs, new_l1_size2);
2700
2701 for(i = 0; i < s->l1_size; i++)
2702 new_l1_table[i] = cpu_to_be64(new_l1_table[i]);
2703 ret = bdrv_pwrite(s->hd, new_l1_table_offset, new_l1_table, new_l1_size2);
2704 if (ret != new_l1_size2)
2705 goto fail;
2706 for(i = 0; i < s->l1_size; i++)
2707 new_l1_table[i] = be64_to_cpu(new_l1_table[i]);
2708
2709 /* set new table */
2710 data64 = cpu_to_be64(new_l1_table_offset);
2711 if (bdrv_pwrite(s->hd, offsetof(QCowHeader, l1_table_offset),
2712 &data64, sizeof(data64)) != sizeof(data64))
2713 goto fail;
2714 data32 = cpu_to_be32(new_l1_size);
2715 if (bdrv_pwrite(s->hd, offsetof(QCowHeader, l1_size),
2716 &data32, sizeof(data32)) != sizeof(data32))
2717 goto fail;
2718 qemu_free(s->l1_table);
2719 free_clusters(bs, s->l1_table_offset, s->l1_size * sizeof(uint64_t));
2720 s->l1_table_offset = new_l1_table_offset;
2721 s->l1_table = new_l1_table;
2722 s->l1_size = new_l1_size;
2723 return 0;
2724 fail:
2725 qemu_free(s->l1_table);
2726 return -EIO;
2727 }
2728
2729 /* 'allocate' is:
2730 *
2731 * 0 not to allocate.
2732 *
2733 * 1 to allocate a normal cluster (for sector indexes 'n_start' to
2734 * 'n_end')
2735 *
2736 * 2 to allocate a compressed cluster of size
2737 * 'compressed_size'. 'compressed_size' must be > 0 and <
2738 * cluster_size
2739 *
2740 * return 0 if not allocated.
2741 */
2742 static uint64_t get_cluster_offset(BlockDriverState *bs,
2743 uint64_t offset, int allocate,
2744 int compressed_size,
2745 int n_start, int n_end)
2746 {
2747 BDRVQcowState *s = bs->opaque;
2748 int min_index, i, j, l1_index, l2_index, ret;
2749 uint64_t l2_offset, *l2_table, cluster_offset, tmp, old_l2_offset;
2750
2751 l1_index = offset >> (s->l2_bits + s->cluster_bits);
2752 if (l1_index >= s->l1_size) {
2753 /* outside l1 table is allowed: we grow the table if needed */
2754 if (!allocate)
2755 return 0;
2756 if (grow_l1_table(bs, l1_index + 1) < 0)
2757 return 0;
2758 }
2759 l2_offset = s->l1_table[l1_index];
2760 if (!l2_offset) {
2761 if (!allocate)
2762 return 0;
2763 l2_allocate:
2764 old_l2_offset = l2_offset;
2765 /* allocate a new l2 entry */
2766 l2_offset = alloc_clusters(bs, s->l2_size * sizeof(uint64_t));
2767 /* update the L1 entry */
2768 s->l1_table[l1_index] = l2_offset | QCOW_OFLAG_COPIED;
2769 tmp = cpu_to_be64(l2_offset | QCOW_OFLAG_COPIED);
2770 if (bdrv_pwrite(s->hd, s->l1_table_offset + l1_index * sizeof(tmp),
2771 &tmp, sizeof(tmp)) != sizeof(tmp))
2772 return 0;
2773 min_index = l2_cache_new_entry(bs);
2774 l2_table = s->l2_cache + (min_index << s->l2_bits);
2775
2776 if (old_l2_offset == 0) {
2777 memset(l2_table, 0, s->l2_size * sizeof(uint64_t));
2778 } else {
2779 if (bdrv_pread(s->hd, old_l2_offset,
2780 l2_table, s->l2_size * sizeof(uint64_t)) !=
2781 s->l2_size * sizeof(uint64_t))
2782 return 0;
2783 }
2784 if (bdrv_pwrite(s->hd, l2_offset,
2785 l2_table, s->l2_size * sizeof(uint64_t)) !=
2786 s->l2_size * sizeof(uint64_t))
2787 return 0;
2788 } else {
2789 if (!(l2_offset & QCOW_OFLAG_COPIED)) {
2790 if (allocate) {
2791 free_clusters(bs, l2_offset, s->l2_size * sizeof(uint64_t));
2792 goto l2_allocate;
2793 }
2794 } else {
2795 l2_offset &= ~QCOW_OFLAG_COPIED;
2796 }
2797 for(i = 0; i < L2_CACHE_SIZE; i++) {
2798 if (l2_offset == s->l2_cache_offsets[i]) {
2799 /* increment the hit count */
2800 if (++s->l2_cache_counts[i] == 0xffffffff) {
2801 for(j = 0; j < L2_CACHE_SIZE; j++) {
2802 s->l2_cache_counts[j] >>= 1;
2803 }
2804 }
2805 l2_table = s->l2_cache + (i << s->l2_bits);
2806 goto found;
2807 }
2808 }
2809 /* not found: load a new entry in the least used one */
2810 min_index = l2_cache_new_entry(bs);
2811 l2_table = s->l2_cache + (min_index << s->l2_bits);
2812 if (bdrv_pread(s->hd, l2_offset, l2_table, s->l2_size * sizeof(uint64_t)) !=
2813 s->l2_size * sizeof(uint64_t))
2814 return 0;
2815 }
2816 s->l2_cache_offsets[min_index] = l2_offset;
2817 s->l2_cache_counts[min_index] = 1;
2818 found:
2819 l2_index = (offset >> s->cluster_bits) & (s->l2_size - 1);
2820 cluster_offset = be64_to_cpu(l2_table[l2_index]);
2821 if (!cluster_offset) {
2822 if (!allocate)
2823 return cluster_offset;
2824 } else if (!(cluster_offset & QCOW_OFLAG_COPIED)) {
2825 if (!allocate)
2826 return cluster_offset;
2827 /* free the cluster */
2828 if (cluster_offset & QCOW_OFLAG_COMPRESSED) {
2829 int nb_csectors;
2830 nb_csectors = ((cluster_offset >> s->csize_shift) &
2831 s->csize_mask) + 1;
2832 free_clusters(bs, (cluster_offset & s->cluster_offset_mask) & ~511,
2833 nb_csectors * 512);
2834 } else {
2835 free_clusters(bs, cluster_offset, s->cluster_size);
2836 }
2837 } else {
2838 cluster_offset &= ~QCOW_OFLAG_COPIED;
2839 return cluster_offset;
2840 }
2841 if (allocate == 1) {
2842 /* allocate a new cluster */
2843 cluster_offset = alloc_clusters(bs, s->cluster_size);
2844
2845 /* we must initialize the cluster content which won't be
2846 written */
2847 if ((n_end - n_start) < s->cluster_sectors) {
2848 uint64_t start_sect;
2849
2850 start_sect = (offset & ~(s->cluster_size - 1)) >> 9;
2851 ret = copy_sectors(bs, start_sect,
2852 cluster_offset, 0, n_start);
2853 if (ret < 0)
2854 return 0;
2855 ret = copy_sectors(bs, start_sect,
2856 cluster_offset, n_end, s->cluster_sectors);
2857 if (ret < 0)
2858 return 0;
2859 }
2860 tmp = cpu_to_be64(cluster_offset | QCOW_OFLAG_COPIED);
2861 } else {
2862 int nb_csectors;
2863 cluster_offset = alloc_bytes(bs, compressed_size);
2864 nb_csectors = ((cluster_offset + compressed_size - 1) >> 9) -
2865 (cluster_offset >> 9);
2866 cluster_offset |= QCOW_OFLAG_COMPRESSED |
2867 ((uint64_t)nb_csectors << s->csize_shift);
2868 /* compressed clusters never have the copied flag */
2869 tmp = cpu_to_be64(cluster_offset);
2870 }
2871 /* update L2 table */
2872 l2_table[l2_index] = tmp;
2873 if (bdrv_pwrite(s->hd,
2874 l2_offset + l2_index * sizeof(tmp), &tmp, sizeof(tmp)) != sizeof(tmp))
2875 return 0;
2876 return cluster_offset;
2877 }
2878
2879 static int qcow_is_allocated(BlockDriverState *bs, int64_t sector_num,
2880 int nb_sectors, int *pnum)
2881 {
2882 BDRVQcowState *s = bs->opaque;
2883 int index_in_cluster, n;
2884 uint64_t cluster_offset;
2885
2886 cluster_offset = get_cluster_offset(bs, sector_num << 9, 0, 0, 0, 0);
2887 index_in_cluster = sector_num & (s->cluster_sectors - 1);
2888 n = s->cluster_sectors - index_in_cluster;
2889 if (n > nb_sectors)
2890 n = nb_sectors;
2891 *pnum = n;
2892 return (cluster_offset != 0);
2893 }
2894
2895 static int decompress_buffer(uint8_t *out_buf, int out_buf_size,
2896 const uint8_t *buf, int buf_size)
2897 {
2898 z_stream strm1, *strm = &strm1;
2899 int ret, out_len;
2900
2901 memset(strm, 0, sizeof(*strm));
2902
2903 strm->next_in = (uint8_t *)buf;
2904 strm->avail_in = buf_size;
2905 strm->next_out = out_buf;
2906 strm->avail_out = out_buf_size;
2907
2908 ret = inflateInit2(strm, -12);
2909 if (ret != Z_OK)
2910 return -1;
2911 ret = inflate(strm, Z_FINISH);
2912 out_len = strm->next_out - out_buf;
2913 if ((ret != Z_STREAM_END && ret != Z_BUF_ERROR) ||
2914 out_len != out_buf_size) {
2915 inflateEnd(strm);
2916 return -1;
2917 }
2918 inflateEnd(strm);
2919 return 0;
2920 }
2921
2922 static int decompress_cluster(BDRVQcowState *s, uint64_t cluster_offset)
2923 {
2924 int ret, csize, nb_csectors, sector_offset;
2925 uint64_t coffset;
2926
2927 coffset = cluster_offset & s->cluster_offset_mask;
2928 if (s->cluster_cache_offset != coffset) {
2929 nb_csectors = ((cluster_offset >> s->csize_shift) & s->csize_mask) + 1;
2930 sector_offset = coffset & 511;
2931 csize = nb_csectors * 512 - sector_offset;
2932 ret = bdrv_read(s->hd, coffset >> 9, s->cluster_data, nb_csectors);
2933 if (ret < 0) {
2934 return -1;
2935 }
2936 if (decompress_buffer(s->cluster_cache, s->cluster_size,
2937 s->cluster_data + sector_offset, csize) < 0) {
2938 return -1;
2939 }
2940 s->cluster_cache_offset = coffset;
2941 }
2942 return 0;
2943 }
2944
2945 /* handle reading after the end of the backing file */
2946 static int backing_read1(BlockDriverState *bs,
2947 int64_t sector_num, uint8_t *buf, int nb_sectors)
2948 {
2949 int n1;
2950 if ((sector_num + nb_sectors) <= bs->total_sectors)
2951 return nb_sectors;
2952 if (sector_num >= bs->total_sectors)
2953 n1 = 0;
2954 else
2955 n1 = bs->total_sectors - sector_num;
2956 memset(buf + n1 * 512, 0, 512 * (nb_sectors - n1));
2957 return n1;
2958 }
2959
2960 static int qcow_read(BlockDriverState *bs, int64_t sector_num,
2961 uint8_t *buf, int nb_sectors)
2962 {
2963 BDRVQcowState *s = bs->opaque;
2964 int ret, index_in_cluster, n, n1;
2965 uint64_t cluster_offset;
2966
2967 while (nb_sectors > 0) {
2968 cluster_offset = get_cluster_offset(bs, sector_num << 9, 0, 0, 0, 0);
2969 index_in_cluster = sector_num & (s->cluster_sectors - 1);
2970 n = s->cluster_sectors - index_in_cluster;
2971 if (n > nb_sectors)
2972 n = nb_sectors;
2973 if (!cluster_offset) {
2974 if (bs->backing_hd) {
2975 /* read from the base image */
2976 n1 = backing_read1(bs->backing_hd, sector_num, buf, n);
2977 if (n1 > 0) {
2978 ret = bdrv_read(bs->backing_hd, sector_num, buf, n1);
2979 if (ret < 0)
2980 return -1;
2981 }
2982 } else {
2983 memset(buf, 0, 512 * n);
2984 }
2985 } else if (cluster_offset & QCOW_OFLAG_COMPRESSED) {
2986 if (decompress_cluster(s, cluster_offset) < 0)
2987 return -1;
2988 memcpy(buf, s->cluster_cache + index_in_cluster * 512, 512 * n);
2989 } else {
2990 ret = bdrv_pread(s->hd, cluster_offset + index_in_cluster * 512, buf, n * 512);
2991 if (ret != n * 512)
2992 return -1;
2993 if (s->crypt_method) {
2994 encrypt_sectors(s, sector_num, buf, buf, n, 0,
2995 &s->aes_decrypt_key);
2996 }
2997 }
2998 nb_sectors -= n;
2999 sector_num += n;
3000 buf += n * 512;
3001 }
3002 return 0;
3003 }
3004
3005 static int qcow_write(BlockDriverState *bs, int64_t sector_num,
3006 const uint8_t *buf, int nb_sectors)
3007 {
3008 BDRVQcowState *s = bs->opaque;
3009 int ret, index_in_cluster, n;
3010 uint64_t cluster_offset;
3011
3012 while (nb_sectors > 0) {
3013 index_in_cluster = sector_num & (s->cluster_sectors - 1);
3014 n = s->cluster_sectors - index_in_cluster;
3015 if (n > nb_sectors)
3016 n = nb_sectors;
3017 cluster_offset = get_cluster_offset(bs, sector_num << 9, 1, 0,
3018 index_in_cluster,
3019 index_in_cluster + n);
3020 if (!cluster_offset)
3021 return -1;
3022 if (s->crypt_method) {
3023 encrypt_sectors(s, sector_num, s->cluster_data, buf, n, 1,
3024 &s->aes_encrypt_key);
3025 ret = bdrv_pwrite(s->hd, cluster_offset + index_in_cluster * 512,
3026 s->cluster_data, n * 512);
3027 } else {
3028 ret = bdrv_pwrite(s->hd, cluster_offset + index_in_cluster * 512, buf, n * 512);
3029 }
3030 if (ret != n * 512)
3031 return -1;
3032 nb_sectors -= n;
3033 sector_num += n;
3034 buf += n * 512;
3035 }
3036 s->cluster_cache_offset = -1; /* disable compressed cache */
3037 return 0;
3038 }
3039
3040 typedef struct QCowAIOCB {
3041 BlockDriverAIOCB common;
3042 int64_t sector_num;
3043 uint8_t *buf;
3044 int nb_sectors;
3045 int n;
3046 uint64_t cluster_offset;
3047 uint8_t *cluster_data;
3048 BlockDriverAIOCB *hd_aiocb;
3049 } QCowAIOCB;
3050
3051 static void qcow_aio_read_cb(void *opaque, int ret)
3052 {
3053 QCowAIOCB *acb = opaque;
3054 BlockDriverState *bs = acb->common.bs;
3055 BDRVQcowState *s = bs->opaque;
3056 int index_in_cluster, n1;
3057
3058 acb->hd_aiocb = NULL;
3059 if (ret < 0) {
3060 fail:
3061 acb->common.cb(acb->common.opaque, ret);
3062 qemu_aio_release(acb);
3063 return;
3064 }
3065
3066 redo:
3067 /* post process the read buffer */
3068 if (!acb->cluster_offset) {
3069 /* nothing to do */
3070 } else if (acb->cluster_offset & QCOW_OFLAG_COMPRESSED) {
3071 /* nothing to do */
3072 } else {
3073 if (s->crypt_method) {
3074 encrypt_sectors(s, acb->sector_num, acb->buf, acb->buf,
3075 acb->n, 0,
3076 &s->aes_decrypt_key);
3077 }
3078 }
3079
3080 acb->nb_sectors -= acb->n;
3081 acb->sector_num += acb->n;
3082 acb->buf += acb->n * 512;
3083
3084 if (acb->nb_sectors == 0) {
3085 /* request completed */
3086 acb->common.cb(acb->common.opaque, 0);
3087 qemu_aio_release(acb);
3088 return;
3089 }
3090
3091 /* prepare next AIO request */
3092 acb->cluster_offset = get_cluster_offset(bs, acb->sector_num << 9,
3093 0, 0, 0, 0);
3094 index_in_cluster = acb->sector_num & (s->cluster_sectors - 1);
3095 acb->n = s->cluster_sectors - index_in_cluster;
3096 if (acb->n > acb->nb_sectors)
3097 acb->n = acb->nb_sectors;
3098
3099 if (!acb->cluster_offset) {
3100 if (bs->backing_hd) {
3101 /* read from the base image */
3102 n1 = backing_read1(bs->backing_hd, acb->sector_num,
3103 acb->buf, acb->n);
3104 if (n1 > 0) {
3105 acb->hd_aiocb = bdrv_aio_read(bs->backing_hd, acb->sector_num,
3106 acb->buf, acb->n, qcow_aio_read_cb, acb);
3107 if (acb->hd_aiocb == NULL)
3108 goto fail;
3109 } else {
3110 goto redo;
3111 }
3112 } else {
3113 /* Note: in this case, no need to wait */
3114 memset(acb->buf, 0, 512 * acb->n);
3115 goto redo;
3116 }
3117 } else if (acb->cluster_offset & QCOW_OFLAG_COMPRESSED) {
3118 /* add AIO support for compressed blocks ? */
3119 if (decompress_cluster(s, acb->cluster_offset) < 0)
3120 goto fail;
3121 memcpy(acb->buf,
3122 s->cluster_cache + index_in_cluster * 512, 512 * acb->n);
3123 goto redo;
3124 } else {
3125 if ((acb->cluster_offset & 511) != 0) {
3126 ret = -EIO;
3127 goto fail;
3128 }
3129 acb->hd_aiocb = bdrv_aio_read(s->hd,
3130 (acb->cluster_offset >> 9) + index_in_cluster,
3131 acb->buf, acb->n, qcow_aio_read_cb, acb);
3132 if (acb->hd_aiocb == NULL)
3133 goto fail;
3134 }
3135 }
3136
3137 static QCowAIOCB *qcow_aio_setup(BlockDriverState *bs,
3138 int64_t sector_num, uint8_t *buf, int nb_sectors,
3139 BlockDriverCompletionFunc *cb, void *opaque)
3140 {
3141 QCowAIOCB *acb;
3142
3143 acb = qemu_aio_get(bs, cb, opaque);
3144 if (!acb)
3145 return NULL;
3146 acb->hd_aiocb = NULL;
3147 acb->sector_num = sector_num;
3148 acb->buf = buf;
3149 acb->nb_sectors = nb_sectors;
3150 acb->n = 0;
3151 acb->cluster_offset = 0;
3152 return acb;
3153 }
3154
3155 static BlockDriverAIOCB *qcow_aio_read(BlockDriverState *bs,
3156 int64_t sector_num, uint8_t *buf, int nb_sectors,
3157 BlockDriverCompletionFunc *cb, void *opaque)
3158 {
3159 QCowAIOCB *acb;
3160
3161 acb = qcow_aio_setup(bs, sector_num, buf, nb_sectors, cb, opaque);
3162 if (!acb)
3163 return NULL;
3164
3165 qcow_aio_read_cb(acb, 0);
3166 return &acb->common;
3167 }
3168
3169 static void qcow_aio_write_cb(void *opaque, int ret)
3170 {
3171 QCowAIOCB *acb = opaque;
3172 BlockDriverState *bs = acb->common.bs;
3173 BDRVQcowState *s = bs->opaque;
3174 int index_in_cluster;
3175 uint64_t cluster_offset;
3176 const uint8_t *src_buf;
3177
3178 acb->hd_aiocb = NULL;
3179
3180 if (ret < 0) {
3181 fail:
3182 acb->common.cb(acb->common.opaque, ret);
3183 qemu_aio_release(acb);
3184 return;
3185 }
3186
3187 acb->nb_sectors -= acb->n;
3188 acb->sector_num += acb->n;
3189 acb->buf += acb->n * 512;
3190
3191 if (acb->nb_sectors == 0) {
3192 /* request completed */
3193 acb->common.cb(acb->common.opaque, 0);
3194 qemu_aio_release(acb);
3195 return;
3196 }
3197
3198 index_in_cluster = acb->sector_num & (s->cluster_sectors - 1);
3199 acb->n = s->cluster_sectors - index_in_cluster;
3200 if (acb->n > acb->nb_sectors)
3201 acb->n = acb->nb_sectors;
3202 cluster_offset = get_cluster_offset(bs, acb->sector_num << 9, 1, 0,
3203 index_in_cluster,
3204 index_in_cluster + acb->n);
3205 if (!cluster_offset || (cluster_offset & 511) != 0) {
3206 ret = -EIO;
3207 goto fail;
3208 }
3209 if (s->crypt_method) {
3210 if (!acb->cluster_data) {
3211 acb->cluster_data = qemu_mallocz(s->cluster_size);
3212 if (!acb->cluster_data) {
3213 ret = -ENOMEM;
3214 goto fail;
3215 }
3216 }
3217 encrypt_sectors(s, acb->sector_num, acb->cluster_data, acb->buf,
3218 acb->n, 1, &s->aes_encrypt_key);
3219 src_buf = acb->cluster_data;
3220 } else {
3221 src_buf = acb->buf;
3222 }
3223 acb->hd_aiocb = bdrv_aio_write(s->hd,
3224 (cluster_offset >> 9) + index_in_cluster,
3225 src_buf, acb->n,
3226 qcow_aio_write_cb, acb);
3227 if (acb->hd_aiocb == NULL)
3228 goto fail;
3229 }
3230
3231 static BlockDriverAIOCB *qcow_aio_write(BlockDriverState *bs,
3232 int64_t sector_num, const uint8_t *buf, int nb_sectors,
3233 BlockDriverCompletionFunc *cb, void *opaque)
3234 {
3235 BDRVQcowState *s = bs->opaque;
3236 QCowAIOCB *acb;
3237
3238 s->cluster_cache_offset = -1; /* disable compressed cache */
3239
3240 acb = qcow_aio_setup(bs, sector_num, (uint8_t*)buf, nb_sectors, cb, opaque);
3241 if (!acb)
3242 return NULL;
3243
3244 qcow_aio_write_cb(acb, 0);
3245 return &acb->common;
3246 }
3247
3248 static void qcow_aio_cancel(BlockDriverAIOCB *blockacb)
3249 {
3250 QCowAIOCB *acb = (QCowAIOCB *)blockacb;
3251 if (acb->hd_aiocb)
3252 bdrv_aio_cancel(acb->hd_aiocb);
3253 qemu_aio_release(acb);
3254 }
3255
3256 static void qcow_close(BlockDriverState *bs)
3257 {
3258 BDRVQcowState *s = bs->opaque;
3259 qemu_free(s->l1_table);
3260 qemu_free(s->l2_cache);
3261 qemu_free(s->cluster_cache);
3262 qemu_free(s->cluster_data);
3263 refcount_close(bs);
3264 bdrv_delete(s->hd);
3265 }
3266
3267 /* XXX: use std qcow open function ? */
3268 typedef struct QCowCreateState {
3269 int cluster_size;
3270 int cluster_bits;
3271 uint16_t *refcount_block;
3272 uint64_t *refcount_table;
3273 int64_t l1_table_offset;
3274 int64_t refcount_table_offset;
3275 int64_t refcount_block_offset;
3276 } QCowCreateState;
3277
3278 static void create_refcount_update(QCowCreateState *s,
3279 int64_t offset, int64_t size)
3280 {
3281 int refcount;
3282 int64_t start, last, cluster_offset;
3283 uint16_t *p;
3284
3285 start = offset & ~(s->cluster_size - 1);
3286 last = (offset + size - 1) & ~(s->cluster_size - 1);
3287 for(cluster_offset = start; cluster_offset <= last;
3288 cluster_offset += s->cluster_size) {
3289 p = &s->refcount_block[cluster_offset >> s->cluster_bits];
3290 refcount = be16_to_cpu(*p);
3291 refcount++;
3292 *p = cpu_to_be16(refcount);
3293 }
3294 }
3295
3296 static int qcow_create(const char *filename, int64_t total_size,
3297 const char *backing_file, int flags)
3298 {
3299 int fd, header_size, backing_filename_len, l1_size, i, shift, l2_bits;
3300 QCowHeader header;
3301 uint64_t tmp, offset;
3302 QCowCreateState s1, *s = &s1;
3303
3304 memset(s, 0, sizeof(*s));
3305
3306 fd = open(filename, O_WRONLY | O_CREAT | O_TRUNC | O_BINARY, 0644);
3307 if (fd < 0)
3308 return -1;
3309 memset(&header, 0, sizeof(header));
3310 header.magic = cpu_to_be32(QCOW_MAGIC);
3311 header.version = cpu_to_be32(QCOW_VERSION);
3312 header.size = cpu_to_be64(total_size * 512);
3313 header_size = sizeof(header);
3314 backing_filename_len = 0;
3315 if (backing_file) {
3316 header.backing_file_offset = cpu_to_be64(header_size);
3317 backing_filename_len = strlen(backing_file);
3318 header.backing_file_size = cpu_to_be32(backing_filename_len);
3319 header_size += backing_filename_len;
3320 }
3321 s->cluster_bits = 12; /* 4 KB clusters */
3322 s->cluster_size = 1 << s->cluster_bits;
3323 header.cluster_bits = cpu_to_be32(s->cluster_bits);
3324 header_size = (header_size + 7) & ~7;
3325 if (flags) {
3326 header.crypt_method = cpu_to_be32(QCOW_CRYPT_AES);
3327 } else {
3328 header.crypt_method = cpu_to_be32(QCOW_CRYPT_NONE);
3329 }
3330 l2_bits = s->cluster_bits - 3;
3331 shift = s->cluster_bits + l2_bits;
3332 l1_size = (((total_size * 512) + (1LL << shift) - 1) >> shift);
3333 offset = align_offset(header_size, s->cluster_size);
3334 s->l1_table_offset = offset;
3335 header.l1_table_offset = cpu_to_be64(s->l1_table_offset);
3336 header.l1_size = cpu_to_be32(l1_size);
3337 offset += align_offset(l1_size * sizeof(uint64_t), s->cluster_size);
3338
3339 s->refcount_table = qemu_mallocz(s->cluster_size);
3340 if (!s->refcount_table)
3341 goto fail;
3342 s->refcount_block = qemu_mallocz(s->cluster_size);
3343 if (!s->refcount_block)
3344 goto fail;
3345
3346 s->refcount_table_offset = offset;
3347 header.refcount_table_offset = cpu_to_be64(offset);
3348 header.refcount_table_clusters = cpu_to_be32(1);
3349 offset += s->cluster_size;
3350
3351 s->refcount_table[0] = cpu_to_be64(offset);
3352 s->refcount_block_offset = offset;
3353 offset += s->cluster_size;
3354
3355 /* update refcounts */
3356 create_refcount_update(s, 0, header_size);
3357 create_refcount_update(s, s->l1_table_offset, l1_size * sizeof(uint64_t));
3358 create_refcount_update(s, s->refcount_table_offset, s->cluster_size);
3359 create_refcount_update(s, s->refcount_block_offset, s->cluster_size);
3360
3361 /* write all the data */
3362 write(fd, &header, sizeof(header));
3363 if (backing_file) {
3364 write(fd, backing_file, backing_filename_len);
3365 }
3366 lseek(fd, s->l1_table_offset, SEEK_SET);
3367 tmp = 0;
3368 for(i = 0;i < l1_size; i++) {
3369 write(fd, &tmp, sizeof(tmp));
3370 }
3371 lseek(fd, s->refcount_table_offset, SEEK_SET);
3372 write(fd, s->refcount_table, s->cluster_size);
3373
3374 lseek(fd, s->refcount_block_offset, SEEK_SET);
3375 write(fd, s->refcount_block, s->cluster_size);
3376
3377 qemu_free(s->refcount_table);
3378 qemu_free(s->refcount_block);
3379 close(fd);
3380 return 0;
3381 fail:
3382 qemu_free(s->refcount_table);
3383 qemu_free(s->refcount_block);
3384 close(fd);
3385 return -ENOMEM;
3386 }
3387
3388 static int qcow_make_empty(BlockDriverState *bs)
3389 {
3390 #if 0
3391 /* XXX: not correct */
3392 BDRVQcowState *s = bs->opaque;
3393 uint32_t l1_length = s->l1_size * sizeof(uint64_t);
3394 int ret;
3395
3396 memset(s->l1_table, 0, l1_length);
3397 if (bdrv_pwrite(s->hd, s->l1_table_offset, s->l1_table, l1_length) < 0)
3398 return -1;
3399 ret = bdrv_truncate(s->hd, s->l1_table_offset + l1_length);
3400 if (ret < 0)
3401 return ret;
3402
3403 l2_cache_reset(bs);
3404 #endif
3405 return 0;
3406 }
3407
3408 /* XXX: put compressed sectors first, then all the cluster aligned
3409 tables to avoid losing bytes in alignment */
3410 static int qcow_write_compressed(BlockDriverState *bs, int64_t sector_num,
3411 const uint8_t *buf, int nb_sectors)
3412 {
3413 BDRVQcowState *s = bs->opaque;
3414 z_stream strm;
3415 int ret, out_len;
3416 uint8_t *out_buf;
3417 uint64_t cluster_offset;
3418
3419 if (nb_sectors == 0) {
3420 /* align end of file to a sector boundary to ease reading with
3421 sector based I/Os */
3422 cluster_offset = bdrv_getlength(s->hd);
3423 cluster_offset = (cluster_offset + 511) & ~511;
3424 bdrv_truncate(s->hd, cluster_offset);
3425 return 0;
3426 }
3427
3428 if (nb_sectors != s->cluster_sectors)
3429 return -EINVAL;
3430
3431 out_buf = qemu_malloc(s->cluster_size + (s->cluster_size / 1000) + 128);
3432 if (!out_buf)
3433 return -ENOMEM;
3434
3435 /* best compression, small window, no zlib header */
3436 memset(&strm, 0, sizeof(strm));
3437 ret = deflateInit2(&strm, Z_DEFAULT_COMPRESSION,
3438 Z_DEFLATED, -12,
3439 9, Z_DEFAULT_STRATEGY);
3440 if (ret != 0) {
3441 qemu_free(out_buf);
3442 return -1;
3443 }
3444
3445 strm.avail_in = s->cluster_size;
3446 strm.next_in = (uint8_t *)buf;
3447 strm.avail_out = s->cluster_size;
3448 strm.next_out = out_buf;
3449
3450 ret = deflate(&strm, Z_FINISH);
3451 if (ret != Z_STREAM_END && ret != Z_OK) {
3452 qemu_free(out_buf);
3453 deflateEnd(&strm);
3454 return -1;
3455 }
3456 out_len = strm.next_out - out_buf;
3457
3458 deflateEnd(&strm);
3459
3460 if (ret != Z_STREAM_END || out_len >= s->cluster_size) {
3461 /* could not compress: write normal cluster */
3462 qcow_write(bs, sector_num, buf, s->cluster_sectors);
3463 } else {
3464 cluster_offset = get_cluster_offset(bs, sector_num << 9, 2,
3465 out_len, 0, 0);
3466 cluster_offset &= s->cluster_offset_mask;
3467 if (bdrv_pwrite(s->hd, cluster_offset, out_buf, out_len) != out_len) {
3468 qemu_free(out_buf);
3469 return -1;
3470 }
3471 }
3472
3473 qemu_free(out_buf);
3474 return 0;
3475 }
3476
3477 static void qcow_flush(BlockDriverState *bs)
3478 {
3479 BDRVQcowState *s = bs->opaque;
3480 bdrv_flush(s->hd);
3481 }
3482
3483 static int qcow_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
3484 {
3485 BDRVQcowState *s = bs->opaque;
3486 bdi->cluster_size = s->cluster_size;
3487 bdi->vm_state_offset = (int64_t)s->l1_vm_state_index <<
3488 (s->cluster_bits + s->l2_bits);
3489 return 0;
3490 }
3491
3492 /*********************************************************/
3493 /* snapshot support */
3494
3495 /* update the refcounts of snapshots and the copied flag */
3496 static int update_snapshot_refcount(BlockDriverState *bs,
3497 int64_t l1_table_offset,
3498 int l1_size,
3499 int addend)
3500 {
3501 BDRVQcowState *s = bs->opaque;
3502 uint64_t *l1_table, *l2_table, l2_offset, offset, l1_size2, l1_allocated;
3503 int64_t old_offset, old_l2_offset;
3504 int l2_size, i, j, l1_modified, l2_modified, nb_csectors, refcount;
3505
3506 l2_cache_reset(bs);
3507
3508 l2_table = NULL;
3509 l1_table = NULL;
3510 l1_size2 = l1_size * sizeof(uint64_t);
3511 l1_allocated = 0;
3512 if (l1_table_offset != s->l1_table_offset) {
3513 l1_table = qemu_malloc(l1_size2);
3514 if (!l1_table)
3515 goto fail;
3516 l1_allocated = 1;
3517 if (bdrv_pread(s->hd, l1_table_offset,
3518 l1_table, l1_size2) != l1_size2)
3519 goto fail;
3520 for(i = 0;i < l1_size; i++)
3521 be64_to_cpus(&l1_table[i]);
3522 } else {
3523 assert(l1_size == s->l1_size);
3524 l1_table = s->l1_table;
3525 l1_allocated = 0;
3526 }
3527
3528 l2_size = s->l2_size * sizeof(uint64_t);
3529 l2_table = qemu_malloc(l2_size);
3530 if (!l2_table)
3531 goto fail;
3532 l1_modified = 0;
3533 for(i = 0; i < l1_size; i++) {
3534 l2_offset = l1_table[i];
3535 if (l2_offset) {
3536 old_l2_offset = l2_offset;
3537 l2_offset &= ~QCOW_OFLAG_COPIED;
3538 l2_modified = 0;
3539 if (bdrv_pread(s->hd, l2_offset, l2_table, l2_size) != l2_size)
3540 goto fail;
3541 for(j = 0; j < s->l2_size; j++) {
3542 offset = be64_to_cpu(l2_table[j]);
3543 if (offset != 0) {
3544 old_offset = offset;
3545 offset &= ~QCOW_OFLAG_COPIED;
3546 if (offset & QCOW_OFLAG_COMPRESSED) {
3547 nb_csectors = ((offset >> s->csize_shift) &
3548 s->csize_mask) + 1;
3549 if (addend != 0)
3550 update_refcount(bs, (offset & s->cluster_offset_mask) & ~511,
3551 nb_csectors * 512, addend);
3552 /* compressed clusters are never modified */
3553 refcount = 2;
3554 } else {
3555 if (addend != 0) {
3556 refcount = update_cluster_refcount(bs, offset >> s->cluster_bits, addend);
3557 } else {
3558 refcount = get_refcount(bs, offset >> s->cluster_bits);
3559 }
3560 }
3561
3562 if (refcount == 1) {
3563 offset |= QCOW_OFLAG_COPIED;
3564 }
3565 if (offset != old_offset) {
3566 l2_table[j] = cpu_to_be64(offset);
3567 l2_modified = 1;
3568 }
3569 }
3570 }
3571 if (l2_modified) {
3572 if (bdrv_pwrite(s->hd,
3573 l2_offset, l2_table, l2_size) != l2_size)
3574 goto fail;
3575 }
3576
3577 if (addend != 0) {
3578 refcount = update_cluster_refcount(bs, l2_offset >> s->cluster_bits, addend);
3579 } else {
3580 refcount = get_refcount(bs, l2_offset >> s->cluster_bits);
3581 }
3582 if (refcount == 1) {
3583 l2_offset |= QCOW_OFLAG_COPIED;
3584 }
3585 if (l2_offset != old_l2_offset) {
3586 l1_table[i] = l2_offset;
3587 l1_modified = 1;
3588 }
3589 }
3590 }
3591 if (l1_modified) {
3592 for(i = 0; i < l1_size; i++)
3593 cpu_to_be64s(&l1_table[i]);
3594 if (bdrv_pwrite(s->hd, l1_table_offset, l1_table,
3595 l1_size2) != l1_size2)
3596 goto fail;
3597 for(i = 0; i < l1_size; i++)
3598 be64_to_cpus(&l1_table[i]);
3599 }
3600 if (l1_allocated)
3601 qemu_free(l1_table);
3602 qemu_free(l2_table);
3603 return 0;
3604 fail:
3605 if (l1_allocated)
3606 qemu_free(l1_table);
3607 qemu_free(l2_table);
3608 return -EIO;
3609 }
3610
3611 static void qcow_free_snapshots(BlockDriverState *bs)
3612 {
3613 BDRVQcowState *s = bs->opaque;
3614 int i;
3615
3616 for(i = 0; i < s->nb_snapshots; i++) {
3617 qemu_free(s->snapshots[i].name);
3618 qemu_free(s->snapshots[i].id_str);
3619 }
3620 qemu_free(s->snapshots);
3621 s->snapshots = NULL;
3622 s->nb_snapshots = 0;
3623 }
3624
3625 static int qcow_read_snapshots(BlockDriverState *bs)
3626 {
3627 BDRVQcowState *s = bs->opaque;
3628 QCowSnapshotHeader h;
3629 QCowSnapshot *sn;
3630 int i, id_str_size, name_size;
3631 int64_t offset;
3632 uint32_t extra_data_size;
3633
3634 offset = s->snapshots_offset;
3635 s->snapshots = qemu_mallocz(s->nb_snapshots * sizeof(QCowSnapshot));
3636 if (!s->snapshots)
3637 goto fail;
3638 for(i = 0; i < s->nb_snapshots; i++) {
3639 offset = align_offset(offset, 8);
3640 if (bdrv_pread(s->hd, offset, &h, sizeof(h)) != sizeof(h))
3641 goto fail;
3642 offset += sizeof(h);
3643 sn = s->snapshots + i;
3644 sn->l1_table_offset = be64_to_cpu(h.l1_table_offset);
3645 sn->l1_size = be32_to_cpu(h.l1_size);
3646 sn->vm_state_size = be32_to_cpu(h.vm_state_size);
3647 sn->date_sec = be32_to_cpu(h.date_sec);
3648 sn->date_nsec = be32_to_cpu(h.date_nsec);
3649 sn->vm_clock_nsec = be64_to_cpu(h.vm_clock_nsec);
3650 extra_data_size = be32_to_cpu(h.extra_data_size);
3651
3652 id_str_size = be16_to_cpu(h.id_str_size);
3653 name_size = be16_to_cpu(h.name_size);
3654
3655 offset += extra_data_size;
3656
3657 sn->id_str = qemu_malloc(id_str_size + 1);
3658 if (!sn->id_str)
3659 goto fail;
3660 if (bdrv_pread(s->hd, offset, sn->id_str, id_str_size) != id_str_size)
3661 goto fail;
3662 offset += id_str_size;
3663 sn->id_str[id_str_size] = '\0';
3664
3665 sn->name = qemu_malloc(name_size + 1);
3666 if (!sn->name)
3667 goto fail;
3668 if (bdrv_pread(s->hd, offset, sn->name, name_size) != name_size)
3669 goto fail;
3670 offset += name_size;
3671 sn->name[name_size] = '\0';
3672 }
3673 s->snapshots_size = offset - s->snapshots_offset;
3674 return 0;
3675 fail:
3676 qcow_free_snapshots(bs);
3677 return -1;
3678 }
3679
3680 /* add at the end of the file a new list of snapshots */
3681 static int qcow_write_snapshots(BlockDriverState *bs)
3682 {
3683 BDRVQcowState *s = bs->opaque;
3684 QCowSnapshot *sn;
3685 QCowSnapshotHeader h;
3686 int i, name_size, id_str_size, snapshots_size;
3687 uint64_t data64;
3688 uint32_t data32;
3689 int64_t offset, snapshots_offset;
3690
3691 /* compute the size of the snapshots */
3692 offset = 0;
3693 for(i = 0; i < s->nb_snapshots; i++) {
3694 sn = s->snapshots + i;
3695 offset = align_offset(offset, 8);
3696 offset += sizeof(h);
3697 offset += strlen(sn->id_str);
3698 offset += strlen(sn->name);
3699 }
3700 snapshots_size = offset;
3701
3702 snapshots_offset = alloc_clusters(bs, snapshots_size);
3703 offset = snapshots_offset;
3704
3705 for(i = 0; i < s->nb_snapshots; i++) {
3706 sn = s->snapshots + i;
3707 memset(&h, 0, sizeof(h));
3708 h.l1_table_offset = cpu_to_be64(sn->l1_table_offset);
3709 h.l1_size = cpu_to_be32(sn->l1_size);
3710 h.vm_state_size = cpu_to_be32(sn->vm_state_size);
3711 h.date_sec = cpu_to_be32(sn->date_sec);
3712 h.date_nsec = cpu_to_be32(sn->date_nsec);
3713 h.vm_clock_nsec = cpu_to_be64(sn->vm_clock_nsec);
3714
3715 id_str_size = strlen(sn->id_str);
3716 name_size = strlen(sn->name);
3717 h.id_str_size = cpu_to_be16(id_str_size);
3718 h.name_size = cpu_to_be16(name_size);
3719 offset = align_offset(offset, 8);
3720 if (bdrv_pwrite(s->hd, offset, &h, sizeof(h)) != sizeof(h))
3721 goto fail;
3722 offset += sizeof(h);
3723 if (bdrv_pwrite(s->hd, offset, sn->id_str, id_str_size) != id_str_size)
3724 goto fail;
3725 offset += id_str_size;
3726 if (bdrv_pwrite(s->hd, offset, sn->name, name_size) != name_size)
3727 goto fail;
3728 offset += name_size;
3729 }
3730
3731 /* update the various header fields */
3732 data64 = cpu_to_be64(snapshots_offset);
3733 if (bdrv_pwrite(s->hd, offsetof(QCowHeader, snapshots_offset),
3734 &data64, sizeof(data64)) != sizeof(data64))
3735 goto fail;
3736 data32 = cpu_to_be32(s->nb_snapshots);
3737 if (bdrv_pwrite(s->hd, offsetof(QCowHeader, nb_snapshots),
3738 &data32, sizeof(data32)) != sizeof(data32))
3739 goto fail;
3740
3741 /* free the old snapshot table */
3742 free_clusters(bs, s->snapshots_offset, s->snapshots_size);
3743 s->snapshots_offset = snapshots_offset;
3744 s->snapshots_size = snapshots_size;
3745 return 0;
3746 fail:
3747 return -1;
3748 }
3749
3750 static void find_new_snapshot_id(BlockDriverState *bs,
3751 char *id_str, int id_str_size)
3752 {
3753 BDRVQcowState *s = bs->opaque;
3754 QCowSnapshot *sn;
3755 int i, id, id_max = 0;
3756
3757 for(i = 0; i < s->nb_snapshots; i++) {
3758 sn = s->snapshots + i;
3759 id = strtoul(sn->id_str, NULL, 10);
3760 if (id > id_max)
3761 id_max = id;
3762 }
3763 snprintf(id_str, id_str_size, "%d", id_max + 1);
3764 }
3765
3766 static int find_snapshot_by_id(BlockDriverState *bs, const char *id_str)
3767 {
3768 BDRVQcowState *s = bs->opaque;
3769 int i;
3770
3771 for(i = 0; i < s->nb_snapshots; i++) {
3772 if (!strcmp(s->snapshots[i].id_str, id_str))
3773 return i;
3774 }
3775 return -1;
3776 }
3777
3778 static int find_snapshot_by_id_or_name(BlockDriverState *bs, const char *name)
3779 {
3780 BDRVQcowState *s = bs->opaque;
3781 int i, ret;
3782
3783 ret = find_snapshot_by_id(bs, name);
3784 if (ret >= 0)
3785 return ret;
3786 for(i = 0; i < s->nb_snapshots; i++) {
3787 if (!strcmp(s->snapshots[i].name, name))
3788 return i;
3789 }
3790 return -1;
3791 }
3792
3793 /* if no id is provided, a new one is constructed */
3794 static int qcow_snapshot_create(BlockDriverState *bs,
3795 QEMUSnapshotInfo *sn_info)
3796 {
3797 BDRVQcowState *s = bs->opaque;
3798 QCowSnapshot *snapshots1, sn1, *sn = &sn1;
3799 int i, ret;
3800 uint64_t *l1_table = NULL;
3801
3802 memset(sn, 0, sizeof(*sn));
3803
3804 if (sn_info->id_str[0] == '\0') {
3805 /* compute a new id */
3806 find_new_snapshot_id(bs, sn_info->id_str, sizeof(sn_info->id_str));
3807 }
3808
3809 /* check that the ID is unique */
3810 if (find_snapshot_by_id(bs, sn_info->id_str) >= 0)
3811 return -ENOENT;
3812
3813 sn->id_str = qemu_strdup(sn_info->id_str);
3814 if (!sn->id_str)
3815 goto fail;
3816 sn->name = qemu_strdup(sn_info->name);
3817 if (!sn->name)
3818 goto fail;
3819 sn->vm_state_size = sn_info->vm_state_size;
3820 sn->date_sec = sn_info->date_sec;
3821 sn->date_nsec = sn_info->date_nsec;
3822 sn->vm_clock_nsec = sn_info->vm_clock_nsec;
3823
3824 ret = update_snapshot_refcount(bs, s->l1_table_offset, s->l1_size, 1);
3825 if (ret < 0)
3826 goto fail;
3827
3828 /* create the L1 table of the snapshot */
3829 sn->l1_table_offset = alloc_clusters(bs, s->l1_size * sizeof(uint64_t));
3830 sn->l1_size = s->l1_size;
3831
3832 l1_table = qemu_malloc(s->l1_size * sizeof(uint64_t));
3833 if (!l1_table)
3834 goto fail;
3835 for(i = 0; i < s->l1_size; i++) {
3836 l1_table[i] = cpu_to_be64(s->l1_table[i]);
3837 }
3838 if (bdrv_pwrite(s->hd, sn->l1_table_offset,
3839 l1_table, s->l1_size * sizeof(uint64_t)) !=
3840 (s->l1_size * sizeof(uint64_t)))
3841 goto fail;
3842 qemu_free(l1_table);
3843 l1_table = NULL;
3844
3845 snapshots1 = qemu_malloc((s->nb_snapshots + 1) * sizeof(QCowSnapshot));
3846 if (!snapshots1)
3847 goto fail;
3848 memcpy(snapshots1, s->snapshots, s->nb_snapshots * sizeof(QCowSnapshot));
3849 s->snapshots = snapshots1;
3850 s->snapshots[s->nb_snapshots++] = *sn;
3851
3852 if (qcow_write_snapshots(bs) < 0)
3853 goto fail;
3854 #ifdef DEBUG_ALLOC
3855 check_refcounts(bs);
3856 #endif
3857 return 0;
3858 fail:
3859 qemu_free(sn->name);
3860 qemu_free(l1_table);
3861 return -1;
3862 }
3863
3864 /* copy the snapshot 'snapshot_name' into the current disk image */
3865 static int qcow_snapshot_goto(BlockDriverState *bs,
3866 const char *snapshot_id)
3867 {
3868 BDRVQcowState *s = bs->opaque;
3869 QCowSnapshot *sn;
3870 int i, snapshot_index, l1_size2;
3871
3872 snapshot_index = find_snapshot_by_id_or_name(bs, snapshot_id);
3873 if (snapshot_index < 0)
3874 return -ENOENT;
3875 sn = &s->snapshots[snapshot_index];
3876
3877 if (update_snapshot_refcount(bs, s->l1_table_offset, s->l1_size, -1) < 0)
3878 goto fail;
3879
3880 if (grow_l1_table(bs, sn->l1_size) < 0)
3881 goto fail;
3882
3883 s->l1_size = sn->l1_size;
3884 l1_size2 = s->l1_size * sizeof(uint64_t);
3885 /* copy the snapshot l1 table to the current l1 table */
3886 if (bdrv_pread(s->hd, sn->l1_table_offset,
3887 s->l1_table, l1_size2) != l1_size2)
3888 goto fail;
3889 if (bdrv_pwrite(s->hd, s->l1_table_offset,
3890 s->l1_table, l1_size2) != l1_size2)
3891 goto fail;
3892 for(i = 0;i < s->l1_size; i++) {
3893 be64_to_cpus(&s->l1_table[i]);
3894 }
3895
3896 if (update_snapshot_refcount(bs, s->l1_table_offset, s->l1_size, 1) < 0)
3897 goto fail;
3898
3899 #ifdef DEBUG_ALLOC
3900 check_refcounts(bs);
3901 #endif
3902 return 0;
3903 fail:
3904 return -EIO;
3905 }
3906
3907 static int qcow_snapshot_delete(BlockDriverState *bs, const char *snapshot_id)
3908 {
3909 BDRVQcowState *s = bs->opaque;
3910 QCowSnapshot *sn;
3911 int snapshot_index, ret;
3912
3913 snapshot_index = find_snapshot_by_id_or_name(bs, snapshot_id);
3914 if (snapshot_index < 0)
3915 return -ENOENT;
3916 sn = &s->snapshots[snapshot_index];
3917
3918 ret = update_snapshot_refcount(bs, sn->l1_table_offset, sn->l1_size, -1);
3919 if (ret < 0)
3920 return ret;
3921 /* must update the copied flag on the current cluster offsets */
3922 ret = update_snapshot_refcount(bs, s->l1_table_offset, s->l1_size, 0);
3923 if (ret < 0)
3924 return ret;
3925 free_clusters(bs, sn->l1_table_offset, sn->l1_size * sizeof(uint64_t));
3926
3927 qemu_free(sn->id_str);
3928 qemu_free(sn->name);
3929 memmove(sn, sn + 1, (s->nb_snapshots - snapshot_index - 1) * sizeof(*sn));
3930 s->nb_snapshots--;
3931 ret = qcow_write_snapshots(bs);
3932 if (ret < 0) {
3933 /* XXX: restore snapshot if error ? */
3934 return ret;
3935 }
3936 #ifdef DEBUG_ALLOC
3937 check_refcounts(bs);
3938 #endif
3939 return 0;
3940 }
3941
3942 static int qcow_snapshot_list(BlockDriverState *bs,
3943 QEMUSnapshotInfo **psn_tab)
3944 {
3945 BDRVQcowState *s = bs->opaque;
3946 QEMUSnapshotInfo *sn_tab, *sn_info;
3947 QCowSnapshot *sn;
3948 int i;
3949
3950 sn_tab = qemu_mallocz(s->nb_snapshots * sizeof(QEMUSnapshotInfo));
3951 if (!sn_tab)
3952 goto fail;
3953 for(i = 0; i < s->nb_snapshots; i++) {
3954 sn_info = sn_tab + i;
3955 sn = s->snapshots + i;
3956 pstrcpy(sn_info->id_str, sizeof(sn_info->id_str),
3957 sn->id_str);
3958 pstrcpy(sn_info->name, sizeof(sn_info->name),
3959 sn->name);
3960 sn_info->vm_state_size = sn->vm_state_size;
3961 sn_info->date_sec = sn->date_sec;
3962 sn_info->date_nsec = sn->date_nsec;
3963 sn_info->vm_clock_nsec = sn->vm_clock_nsec;
3964 }
3965 *psn_tab = sn_tab;
3966 return s->nb_snapshots;
3967 fail:
3968 qemu_free(sn_tab);
3969 *psn_tab = NULL;
3970 return -ENOMEM;
3971 }
3972
3973 /*********************************************************/
3974 /* refcount handling */
3975
3976 static int refcount_init(BlockDriverState *bs)
3977 {
3978 BDRVQcowState *s = bs->opaque;
3979 int ret, refcount_table_size2, i;
3980
3981 s->refcount_block_cache = qemu_malloc(s->cluster_size);
3982 if (!s->refcount_block_cache)
3983 goto fail;
3984 refcount_table_size2 = s->refcount_table_size * sizeof(uint64_t);
3985 s->refcount_table = qemu_malloc(refcount_table_size2);
3986 if (!s->refcount_table)
3987 goto fail;
3988 if (s->refcount_table_size > 0) {
3989 ret = bdrv_pread(s->hd, s->refcount_table_offset,
3990 s->refcount_table, refcount_table_size2);
3991 if (ret != refcount_table_size2)
3992 goto fail;
3993 for(i = 0; i < s->refcount_table_size; i++)
3994 be64_to_cpus(&s->refcount_table[i]);
3995 }
3996 return 0;
3997 fail:
3998 return -ENOMEM;
3999 }
4000
4001 static void refcount_close(BlockDriverState *bs)
4002 {
4003 BDRVQcowState *s = bs->opaque;
4004 qemu_free(s->refcount_block_cache);
4005 qemu_free(s->refcount_table);
4006 }
4007
4008
4009 static int load_refcount_block(BlockDriverState *bs,
4010 int64_t refcount_block_offset)
4011 {
4012 BDRVQcowState *s = bs->opaque;
4013 int ret;
4014 ret = bdrv_pread(s->hd, refcount_block_offset, s->refcount_block_cache,
4015 s->cluster_size);
4016 if (ret != s->cluster_size)
4017 return -EIO;
4018 s->refcount_block_cache_offset = refcount_block_offset;
4019 return 0;
4020 }
4021
4022 static int get_refcount(BlockDriverState *bs, int64_t cluster_index)
4023 {
4024 BDRVQcowState *s = bs->opaque;
4025 int refcount_table_index, block_index;
4026 int64_t refcount_block_offset;
4027
4028 refcount_table_index = cluster_index >> (s->cluster_bits - REFCOUNT_SHIFT);
4029 if (refcount_table_index >= s->refcount_table_size)
4030 return 0;
4031 refcount_block_offset = s->refcount_table[refcount_table_index];
4032 if (!refcount_block_offset)
4033 return 0;
4034 if (refcount_block_offset != s->refcount_block_cache_offset) {
4035 /* better than nothing: return allocated if read error */
4036 if (load_refcount_block(bs, refcount_block_offset) < 0)
4037 return 1;
4038 }
4039 block_index = cluster_index &
4040 ((1 << (s->cluster_bits - REFCOUNT_SHIFT)) - 1);
4041 return be16_to_cpu(s->refcount_block_cache[block_index]);
4042 }
4043
4044 /* return < 0 if error */
4045 static int64_t alloc_clusters_noref(BlockDriverState *bs, int64_t size)
4046 {
4047 BDRVQcowState *s = bs->opaque;
4048 int i, nb_clusters;
4049
4050 nb_clusters = (size + s->cluster_size - 1) >> s->cluster_bits;
4051 for(;;) {
4052 if (get_refcount(bs, s->free_cluster_index) == 0) {
4053 s->free_cluster_index++;
4054 for(i = 1; i < nb_clusters; i++) {
4055 if (get_refcount(bs, s->free_cluster_index) != 0)
4056 goto not_found;
4057 s->free_cluster_index++;
4058 }
4059 #ifdef DEBUG_ALLOC2
4060 printf("alloc_clusters: size=%lld -> %lld\n",
4061 size,
4062 (s->free_cluster_index - nb_clusters) << s->cluster_bits);
4063 #endif
4064 return (s->free_cluster_index - nb_clusters) << s->cluster_bits;
4065 } else {
4066 not_found:
4067 s->free_cluster_index++;
4068 }
4069 }
4070 }
4071
4072 static int64_t alloc_clusters(BlockDriverState *bs, int64_t size)
4073 {
4074 int64_t offset;
4075
4076 offset = alloc_clusters_noref(bs, size);
4077 update_refcount(bs, offset, size, 1);
4078 return offset;
4079 }
4080
4081 /* only used to allocate compressed sectors. We try to allocate
4082 contiguous sectors. size must be <= cluster_size */
4083 static int64_t alloc_bytes(BlockDriverState *bs, int size)
4084 {
4085 BDRVQcowState *s = bs->opaque;
4086 int64_t offset, cluster_offset;
4087 int free_in_cluster;
4088
4089 assert(size > 0 && size <= s->cluster_size);
4090 if (s->free_byte_offset == 0) {
4091 s->free_byte_offset = alloc_clusters(bs, s->cluster_size);
4092 }
4093 redo:
4094 free_in_cluster = s->cluster_size -
4095 (s->free_byte_offset & (s->cluster_size - 1));
4096 if (size <= free_in_cluster) {
4097 /* enough space in current cluster */
4098 offset = s->free_byte_offset;
4099 s->free_byte_offset += size;
4100 free_in_cluster -= size;
4101 if (free_in_cluster == 0)
4102 s->free_byte_offset = 0;
4103 if ((offset & (s->cluster_size - 1)) != 0)
4104 update_cluster_refcount(bs, offset >> s->cluster_bits, 1);
4105 } else {
4106 offset = alloc_clusters(bs, s->cluster_size);
4107 cluster_offset = s->free_byte_offset & ~(s->cluster_size - 1);
4108 if ((cluster_offset + s->cluster_size) == offset) {
4109 /* we are lucky: contiguous data */
4110 offset = s->free_byte_offset;
4111 update_cluster_refcount(bs, offset >> s->cluster_bits, 1);
4112 s->free_byte_offset += size;
4113 } else {
4114 s->free_byte_offset = offset;
4115 goto redo;
4116 }
4117 }
4118 return offset;
4119 }
4120
4121 static void free_clusters(BlockDriverState *bs,
4122 int64_t offset, int64_t size)
4123 {
4124 update_refcount(bs, offset, size, -1);
4125 }
4126
4127 static int grow_refcount_table(BlockDriverState *bs, int min_size)
4128 {
4129 BDRVQcowState *s = bs->opaque;
4130 int new_table_size, new_table_size2, refcount_table_clusters, i, ret;
4131 uint64_t *new_table;
4132 int64_t table_offset;
4133 uint64_t data64;
4134 uint32_t data32;
4135
4136 if (min_size <= s->refcount_table_size)
4137 return 0;
4138 /* compute new table size */
4139 refcount_table_clusters = s->refcount_table_size >> (s->cluster_bits - 3);
4140 for(;;) {
4141 if (refcount_table_clusters == 0) {
4142 refcount_table_clusters = 1;
4143 } else {
4144 refcount_table_clusters = (refcount_table_clusters * 3 + 1) / 2;
4145 }
4146 new_table_size = refcount_table_clusters << (s->cluster_bits - 3);
4147 if (min_size <= new_table_size)
4148 break;
4149 }
4150 #ifdef DEBUG_ALLOC2
4151 printf("grow_refcount_table from %d to %d\n",
4152 s->refcount_table_size,
4153 new_table_size);
4154 #endif
4155 new_table_size2 = new_table_size * sizeof(uint64_t);
4156 new_table = qemu_mallocz(new_table_size2);
4157 if (!new_table)
4158 return -ENOMEM;
4159 memcpy(new_table, s->refcount_table,
4160 s->refcount_table_size * sizeof(uint64_t));
4161 for(i = 0; i < s->refcount_table_size; i++)
4162 cpu_to_be64s(&new_table[i]);
4163 /* Note: we cannot update the refcount now to avoid recursion */
4164 table_offset = alloc_clusters_noref(bs, new_table_size2);
4165 ret = bdrv_pwrite(s->hd, table_offset, new_table, new_table_size2);
4166 if (ret != new_table_size2)
4167 goto fail;
4168 for(i = 0; i < s->refcount_table_size; i++)
4169 be64_to_cpus(&new_table[i]);
4170
4171 data64 = cpu_to_be64(table_offset);
4172 if (bdrv_pwrite(s->hd, offsetof(QCowHeader, refcount_table_offset),
4173 &data64, sizeof(data64)) != sizeof(data64))
4174 goto fail;
4175 data32 = cpu_to_be32(refcount_table_clusters);
4176 if (bdrv_pwrite(s->hd, offsetof(QCowHeader, refcount_table_clusters),
4177 &data32, sizeof(data32)) != sizeof(data32))
4178 goto fail;
4179 qemu_free(s->refcount_table);
4180 s->refcount_table = new_table;
4181 s->refcount_table_size = new_table_size;
4182
4183 update_refcount(bs, table_offset, new_table_size2, 1);
4184 return 0;
4185 fail:
4186 free_clusters(bs, table_offset, new_table_size2);
4187 qemu_free(new_table);
4188 return -EIO;
4189 }
4190
4191 /* addend must be 1 or -1 */
4192 /* XXX: cache several refcount block clusters ? */
4193 static int update_cluster_refcount(BlockDriverState *bs,
4194 int64_t cluster_index,
4195 int addend)
4196 {
4197 BDRVQcowState *s = bs->opaque;
4198 int64_t offset, refcount_block_offset;
4199 int ret, refcount_table_index, block_index, refcount;
4200 uint64_t data64;
4201
4202 refcount_table_index = cluster_index >> (s->cluster_bits - REFCOUNT_SHIFT);
4203 if (refcount_table_index >= s->refcount_table_size) {
4204 if (addend < 0)
4205 return -EINVAL;
4206 ret = grow_refcount_table(bs, refcount_table_index + 1);
4207 if (ret < 0)
4208 return ret;
4209 }
4210 refcount_block_offset = s->refcount_table[refcount_table_index];
4211 if (!refcount_block_offset) {
4212 if (addend < 0)
4213 return -EINVAL;
4214 /* create a new refcount block */
4215 /* Note: we cannot update the refcount now to avoid recursion */
4216 offset = alloc_clusters_noref(bs, s->cluster_size);
4217 memset(s->refcount_block_cache, 0, s->cluster_size);
4218 ret = bdrv_pwrite(s->hd, offset, s->refcount_block_cache, s->cluster_size);
4219 if (ret != s->cluster_size)
4220 return -EINVAL;
4221 s->refcount_table[refcount_table_index] = offset;
4222 data64 = cpu_to_be64(offset);
4223 ret = bdrv_pwrite(s->hd, s->refcount_table_offset +
4224 refcount_table_index * sizeof(uint64_t),
4225 &data64, sizeof(data64));
4226 if (ret != sizeof(data64))
4227 return -EINVAL;
4228
4229 refcount_block_offset = offset;
4230 s->refcount_block_cache_offset = offset;
4231 update_refcount(bs, offset, s->cluster_size, 1);
4232 } else {
4233 if (refcount_block_offset != s->refcount_block_cache_offset) {
4234 if (load_refcount_block(bs, refcount_block_offset) < 0)
4235 return -EIO;
4236 }
4237 }
4238 /* we can update the count and save it */
4239 block_index = cluster_index &
4240 ((1 << (s->cluster_bits - REFCOUNT_SHIFT)) - 1);
4241 refcount = be16_to_cpu(s->refcount_block_cache[block_index]);
4242 refcount += addend;
4243 if (refcount < 0 || refcount > 0xffff)
4244 return -EINVAL;
4245 if (refcount == 0 && cluster_index < s->free_cluster_index) {
4246 s->free_cluster_index = cluster_index;
4247 }
4248 s->refcount_block_cache[block_index] = cpu_to_be16(refcount);
4249 if (bdrv_pwrite(s->hd,
4250 refcount_block_offset + (block_index << REFCOUNT_SHIFT),
4251 &s->refcount_block_cache[block_index], 2) != 2)
4252 return -EIO;
4253 return refcount;
4254 }
4255
4256 static void update_refcount(BlockDriverState *bs,
4257 int64_t offset, int64_t length,
4258 int addend)
4259 {
4260 BDRVQcowState *s = bs->opaque;
4261 int64_t start, last, cluster_offset;
4262
4263 #ifdef DEBUG_ALLOC2
4264 printf("update_refcount: offset=%lld size=%lld addend=%d\n",
4265 offset, length, addend);
4266 #endif
4267 if (length <= 0)
4268 return;
4269 start = offset & ~(s->cluster_size - 1);
4270 last = (offset + length - 1) & ~(s->cluster_size - 1);
4271 for(cluster_offset = start; cluster_offset <= last;
4272 cluster_offset += s->cluster_size) {
4273 update_cluster_refcount(bs, cluster_offset >> s->cluster_bits, addend);
4274 }
4275 }
4276
4277 #ifdef DEBUG_ALLOC
4278 static void inc_refcounts(BlockDriverState *bs,
4279 uint16_t *refcount_table,
4280 int refcount_table_size,
4281 int64_t offset, int64_t size)
4282 {
4283 BDRVQcowState *s = bs->opaque;
4284 int64_t start, last, cluster_offset;
4285 int k;
4286
4287 if (size <= 0)
4288 return;
4289
4290 start = offset & ~(s->cluster_size - 1);
4291 last = (offset + size - 1) & ~(s->cluster_size - 1);
4292 for(cluster_offset = start; cluster_offset <= last;
4293 cluster_offset += s->cluster_size) {
4294 k = cluster_offset >> s->cluster_bits;
4295 if (k < 0 || k >= refcount_table_size) {
4296 printf("ERROR: invalid cluster offset=0x%llx\n", cluster_offset);
4297 } else {
4298 if (++refcount_table[k] == 0) {
4299 printf("ERROR: overflow cluster offset=0x%llx\n", cluster_offset);
4300 }
4301 }
4302 }
4303 }
4304
4305 static int check_refcounts_l1(BlockDriverState *bs,
4306 uint16_t *refcount_table,
4307 int refcount_table_size,
4308 int64_t l1_table_offset, int l1_size,
4309 int check_copied)
4310 {
4311 BDRVQcowState *s = bs->opaque;
4312 uint64_t *l1_table, *l2_table, l2_offset, offset, l1_size2;
4313 int l2_size, i, j, nb_csectors, refcount;
4314
4315 l2_table = NULL;
4316 l1_size2 = l1_size * sizeof(uint64_t);
4317
4318 inc_refcounts(bs, refcount_table, refcount_table_size,
4319 l1_table_offset, l1_size2);
4320
4321 l1_table = qemu_malloc(l1_size2);
4322 if (!l1_table)
4323 goto fail;
4324 if (bdrv_pread(s->hd, l1_table_offset,
4325 l1_table, l1_size2) != l1_size2)
4326 goto fail;
4327 for(i = 0;i < l1_size; i++)
4328 be64_to_cpus(&l1_table[i]);
4329
4330 l2_size = s->l2_size * sizeof(uint64_t);
4331 l2_table = qemu_malloc(l2_size);
4332 if (!l2_table)
4333 goto fail;
4334 for(i = 0; i < l1_size; i++) {
4335 l2_offset = l1_table[i];
4336 if (l2_offset) {
4337 if (check_copied) {
4338 refcount = get_refcount(bs, (l2_offset & ~QCOW_OFLAG_COPIED) >> s->cluster_bits);
4339 if ((refcount == 1) != ((l2_offset & QCOW_OFLAG_COPIED) != 0)) {
4340 printf("ERROR OFLAG_COPIED: l2_offset=%llx refcount=%d\n",
4341 l2_offset, refcount);
4342 }
4343 }
4344 l2_offset &= ~QCOW_OFLAG_COPIED;
4345 if (bdrv_pread(s->hd, l2_offset, l2_table, l2_size) != l2_size)
4346 goto fail;
4347 for(j = 0; j < s->l2_size; j++) {
4348 offset = be64_to_cpu(l2_table[j]);
4349 if (offset != 0) {
4350 if (offset & QCOW_OFLAG_COMPRESSED) {
4351 if (offset & QCOW_OFLAG_COPIED) {
4352 printf("ERROR: cluster %lld: copied flag must never be set for compressed clusters\n",
4353 offset >> s->cluster_bits);
4354 offset &= ~QCOW_OFLAG_COPIED;
4355 }
4356 nb_csectors = ((offset >> s->csize_shift) &
4357 s->csize_mask) + 1;
4358 offset &= s->cluster_offset_mask;
4359 inc_refcounts(bs, refcount_table,
4360 refcount_table_size,
4361 offset & ~511, nb_csectors * 512);
4362 } else {
4363 if (check_copied) {
4364 refcount = get_refcount(bs, (offset & ~QCOW_OFLAG_COPIED) >> s->cluster_bits);
4365 if ((refcount == 1) != ((offset & QCOW_OFLAG_COPIED) != 0)) {
4366 printf("ERROR OFLAG_COPIED: offset=%llx refcount=%d\n",
4367 offset, refcount);
4368 }
4369 }
4370 offset &= ~QCOW_OFLAG_COPIED;
4371 inc_refcounts(bs, refcount_table,
4372 refcount_table_size,
4373 offset, s->cluster_size);
4374 }
4375 }
4376 }
4377 inc_refcounts(bs, refcount_table,
4378 refcount_table_size,
4379 l2_offset,
4380 s->cluster_size);
4381 }
4382 }
4383 qemu_free(l1_table);
4384 qemu_free(l2_table);
4385 return 0;
4386 fail:
4387 printf("ERROR: I/O error in check_refcounts_l1\n");
4388 qemu_free(l1_table);
4389 qemu_free(l2_table);
4390 return -EIO;
4391 }
4392
4393 static void check_refcounts(BlockDriverState *bs)
4394 {
4395 BDRVQcowState *s = bs->opaque;
4396 int64_t size;
4397 int nb_clusters, refcount1, refcount2, i;
4398 QCowSnapshot *sn;
4399 uint16_t *refcount_table;
4400
4401 size = bdrv_getlength(s->hd);
4402 nb_clusters = (size + s->cluster_size - 1) >> s->cluster_bits;
4403 refcount_table = qemu_mallocz(nb_clusters * sizeof(uint16_t));
4404
4405 /* header */
4406 inc_refcounts(bs, refcount_table, nb_clusters,
4407 0, s->cluster_size);
4408
4409 check_refcounts_l1(bs, refcount_table, nb_clusters,
4410 s->l1_table_offset, s->l1_size, 1);
4411
4412 /* snapshots */
4413 for(i = 0; i < s->nb_snapshots; i++) {
4414 sn = s->snapshots + i;
4415 check_refcounts_l1(bs, refcount_table, nb_clusters,
4416 sn->l1_table_offset, sn->l1_size, 0);
4417 }
4418 inc_refcounts(bs, refcount_table, nb_clusters,
4419 s->snapshots_offset, s->snapshots_size);
4420
4421 /* refcount data */
4422 inc_refcounts(bs, refcount_table, nb_clusters,
4423 s->refcount_table_offset,
4424 s->refcount_table_size * sizeof(uint64_t));
4425 for(i = 0; i < s->refcount_table_size; i++) {
4426 int64_t offset;
4427 offset = s->refcount_table[i];
4428 if (offset != 0) {
4429 inc_refcounts(bs, refcount_table, nb_clusters,
4430 offset, s->cluster_size);
4431 }
4432 }
4433
4434 /* compare ref counts */
4435 for(i = 0; i < nb_clusters; i++) {
4436 refcount1 = get_refcount(bs, i);
4437 refcount2 = refcount_table[i];
4438 if (refcount1 != refcount2)
4439 printf("ERROR cluster %d refcount=%d reference=%d\n",
4440 i, refcount1, refcount2);
4441 }
4442
4443 qemu_free(refcount_table);
4444 }
4445
4446 #if 0
4447 static void dump_refcounts(BlockDriverState *bs)
4448 {
4449 BDRVQcowState *s = bs->opaque;
4450 int64_t nb_clusters, k, k1, size;
4451 int refcount;
4452
4453 size = bdrv_getlength(s->hd);
4454 nb_clusters = (size + s->cluster_size - 1) >> s->cluster_bits;
4455 for(k = 0; k < nb_clusters;) {
4456 k1 = k;
4457 refcount = get_refcount(bs, k);
4458 k++;
4459 while (k < nb_clusters && get_refcount(bs, k) == refcount)
4460 k++;
4461 printf("%lld: refcount=%d nb=%lld\n", k, refcount, k - k1);
4462 }
4463 }
4464 #endif
4465 #endif
4466
4467 BlockDriver bdrv_qcow2 = {
4468 "qcow2",
4469 sizeof(BDRVQcowState),
4470 qcow_probe,
4471 qcow_open,
4472 NULL,
4473 NULL,
4474 qcow_close,
4475 qcow_create,
4476 qcow_flush,
4477 qcow_is_allocated,
4478 qcow_set_key,
4479 qcow_make_empty,
4480
4481 .bdrv_aio_read = qcow_aio_read,
4482 .bdrv_aio_write = qcow_aio_write,
4483 .bdrv_aio_cancel = qcow_aio_cancel,
4484 .aiocb_size = sizeof(QCowAIOCB),
4485 .bdrv_write_compressed = qcow_write_compressed,
4486
4487 .bdrv_snapshot_create = qcow_snapshot_create,
4488 .bdrv_snapshot_goto = qcow_snapshot_goto,
4489 .bdrv_snapshot_delete = qcow_snapshot_delete,
4490 .bdrv_snapshot_list = qcow_snapshot_list,
4491 .bdrv_get_info = qcow_get_info,
4492 };
Patches shipped by Fedora