ahci: fix buffer overrun on invalid state load
[qemu.git] / block / qcow2.h
blobb49424b85e926154bb552a48f24ca9d472ffc2fc
1 /*
2 * Block driver for the QCOW version 2 format
4 * Copyright (c) 2004-2006 Fabrice Bellard
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22 * THE SOFTWARE.
25 #ifndef BLOCK_QCOW2_H
26 #define BLOCK_QCOW2_H
28 #include "qemu/aes.h"
29 #include "block/coroutine.h"
31 //#define DEBUG_ALLOC
32 //#define DEBUG_ALLOC2
33 //#define DEBUG_EXT
35 #define QCOW_MAGIC (('Q' << 24) | ('F' << 16) | ('I' << 8) | 0xfb)
37 #define QCOW_CRYPT_NONE 0
38 #define QCOW_CRYPT_AES 1
40 #define QCOW_MAX_CRYPT_CLUSTERS 32
41 #define QCOW_MAX_SNAPSHOTS 65536
43 /* 8 MB refcount table is enough for 2 PB images at 64k cluster size
44 * (128 GB for 512 byte clusters, 2 EB for 2 MB clusters) */
45 #define QCOW_MAX_REFTABLE_SIZE 0x800000
47 /* 32 MB L1 table is enough for 2 PB images at 64k cluster size
48 * (128 GB for 512 byte clusters, 2 EB for 2 MB clusters) */
49 #define QCOW_MAX_L1_SIZE 0x2000000
51 /* Allow for an average of 1k per snapshot table entry, should be plenty of
52 * space for snapshot names and IDs */
53 #define QCOW_MAX_SNAPSHOTS_SIZE (1024 * QCOW_MAX_SNAPSHOTS)
55 /* indicate that the refcount of the referenced cluster is exactly one. */
56 #define QCOW_OFLAG_COPIED (1ULL << 63)
57 /* indicate that the cluster is compressed (they never have the copied flag) */
58 #define QCOW_OFLAG_COMPRESSED (1ULL << 62)
59 /* The cluster reads as all zeros */
60 #define QCOW_OFLAG_ZERO (1ULL << 0)
62 #define REFCOUNT_SHIFT 1 /* refcount size is 2 bytes */
64 #define MIN_CLUSTER_BITS 9
65 #define MAX_CLUSTER_BITS 21
67 #define L2_CACHE_SIZE 16
69 /* Must be at least 4 to cover all cases of refcount table growth */
70 #define REFCOUNT_CACHE_SIZE 4
72 #define DEFAULT_CLUSTER_SIZE 65536
75 #define QCOW2_OPT_LAZY_REFCOUNTS "lazy-refcounts"
76 #define QCOW2_OPT_DISCARD_REQUEST "pass-discard-request"
77 #define QCOW2_OPT_DISCARD_SNAPSHOT "pass-discard-snapshot"
78 #define QCOW2_OPT_DISCARD_OTHER "pass-discard-other"
79 #define QCOW2_OPT_OVERLAP "overlap-check"
80 #define QCOW2_OPT_OVERLAP_MAIN_HEADER "overlap-check.main-header"
81 #define QCOW2_OPT_OVERLAP_ACTIVE_L1 "overlap-check.active-l1"
82 #define QCOW2_OPT_OVERLAP_ACTIVE_L2 "overlap-check.active-l2"
83 #define QCOW2_OPT_OVERLAP_REFCOUNT_TABLE "overlap-check.refcount-table"
84 #define QCOW2_OPT_OVERLAP_REFCOUNT_BLOCK "overlap-check.refcount-block"
85 #define QCOW2_OPT_OVERLAP_SNAPSHOT_TABLE "overlap-check.snapshot-table"
86 #define QCOW2_OPT_OVERLAP_INACTIVE_L1 "overlap-check.inactive-l1"
87 #define QCOW2_OPT_OVERLAP_INACTIVE_L2 "overlap-check.inactive-l2"
89 typedef struct QCowHeader {
90 uint32_t magic;
91 uint32_t version;
92 uint64_t backing_file_offset;
93 uint32_t backing_file_size;
94 uint32_t cluster_bits;
95 uint64_t size; /* in bytes */
96 uint32_t crypt_method;
97 uint32_t l1_size; /* XXX: save number of clusters instead ? */
98 uint64_t l1_table_offset;
99 uint64_t refcount_table_offset;
100 uint32_t refcount_table_clusters;
101 uint32_t nb_snapshots;
102 uint64_t snapshots_offset;
104 /* The following fields are only valid for version >= 3 */
105 uint64_t incompatible_features;
106 uint64_t compatible_features;
107 uint64_t autoclear_features;
109 uint32_t refcount_order;
110 uint32_t header_length;
111 } QEMU_PACKED QCowHeader;
113 typedef struct QEMU_PACKED QCowSnapshotHeader {
114 /* header is 8 byte aligned */
115 uint64_t l1_table_offset;
117 uint32_t l1_size;
118 uint16_t id_str_size;
119 uint16_t name_size;
121 uint32_t date_sec;
122 uint32_t date_nsec;
124 uint64_t vm_clock_nsec;
126 uint32_t vm_state_size;
127 uint32_t extra_data_size; /* for extension */
128 /* extra data follows */
129 /* id_str follows */
130 /* name follows */
131 } QCowSnapshotHeader;
133 typedef struct QEMU_PACKED QCowSnapshotExtraData {
134 uint64_t vm_state_size_large;
135 uint64_t disk_size;
136 } QCowSnapshotExtraData;
139 typedef struct QCowSnapshot {
140 uint64_t l1_table_offset;
141 uint32_t l1_size;
142 char *id_str;
143 char *name;
144 uint64_t disk_size;
145 uint64_t vm_state_size;
146 uint32_t date_sec;
147 uint32_t date_nsec;
148 uint64_t vm_clock_nsec;
149 } QCowSnapshot;
151 struct Qcow2Cache;
152 typedef struct Qcow2Cache Qcow2Cache;
154 typedef struct Qcow2UnknownHeaderExtension {
155 uint32_t magic;
156 uint32_t len;
157 QLIST_ENTRY(Qcow2UnknownHeaderExtension) next;
158 uint8_t data[];
159 } Qcow2UnknownHeaderExtension;
161 enum {
162 QCOW2_FEAT_TYPE_INCOMPATIBLE = 0,
163 QCOW2_FEAT_TYPE_COMPATIBLE = 1,
164 QCOW2_FEAT_TYPE_AUTOCLEAR = 2,
167 /* Incompatible feature bits */
168 enum {
169 QCOW2_INCOMPAT_DIRTY_BITNR = 0,
170 QCOW2_INCOMPAT_CORRUPT_BITNR = 1,
171 QCOW2_INCOMPAT_DIRTY = 1 << QCOW2_INCOMPAT_DIRTY_BITNR,
172 QCOW2_INCOMPAT_CORRUPT = 1 << QCOW2_INCOMPAT_CORRUPT_BITNR,
174 QCOW2_INCOMPAT_MASK = QCOW2_INCOMPAT_DIRTY
175 | QCOW2_INCOMPAT_CORRUPT,
178 /* Compatible feature bits */
179 enum {
180 QCOW2_COMPAT_LAZY_REFCOUNTS_BITNR = 0,
181 QCOW2_COMPAT_LAZY_REFCOUNTS = 1 << QCOW2_COMPAT_LAZY_REFCOUNTS_BITNR,
183 QCOW2_COMPAT_FEAT_MASK = QCOW2_COMPAT_LAZY_REFCOUNTS,
186 enum qcow2_discard_type {
187 QCOW2_DISCARD_NEVER = 0,
188 QCOW2_DISCARD_ALWAYS,
189 QCOW2_DISCARD_REQUEST,
190 QCOW2_DISCARD_SNAPSHOT,
191 QCOW2_DISCARD_OTHER,
192 QCOW2_DISCARD_MAX
195 typedef struct Qcow2Feature {
196 uint8_t type;
197 uint8_t bit;
198 char name[46];
199 } QEMU_PACKED Qcow2Feature;
201 typedef struct Qcow2DiscardRegion {
202 BlockDriverState *bs;
203 uint64_t offset;
204 uint64_t bytes;
205 QTAILQ_ENTRY(Qcow2DiscardRegion) next;
206 } Qcow2DiscardRegion;
208 typedef struct BDRVQcowState {
209 int cluster_bits;
210 int cluster_size;
211 int cluster_sectors;
212 int l2_bits;
213 int l2_size;
214 int l1_size;
215 int l1_vm_state_index;
216 int csize_shift;
217 int csize_mask;
218 uint64_t cluster_offset_mask;
219 uint64_t l1_table_offset;
220 uint64_t *l1_table;
222 Qcow2Cache* l2_table_cache;
223 Qcow2Cache* refcount_block_cache;
225 uint8_t *cluster_cache;
226 uint8_t *cluster_data;
227 uint64_t cluster_cache_offset;
228 QLIST_HEAD(QCowClusterAlloc, QCowL2Meta) cluster_allocs;
230 uint64_t *refcount_table;
231 uint64_t refcount_table_offset;
232 uint32_t refcount_table_size;
233 uint64_t free_cluster_index;
234 uint64_t free_byte_offset;
236 CoMutex lock;
238 uint32_t crypt_method; /* current crypt method, 0 if no key yet */
239 uint32_t crypt_method_header;
240 AES_KEY aes_encrypt_key;
241 AES_KEY aes_decrypt_key;
242 uint64_t snapshots_offset;
243 int snapshots_size;
244 unsigned int nb_snapshots;
245 QCowSnapshot *snapshots;
247 int flags;
248 int qcow_version;
249 bool use_lazy_refcounts;
250 int refcount_order;
252 bool discard_passthrough[QCOW2_DISCARD_MAX];
254 int overlap_check; /* bitmask of Qcow2MetadataOverlap values */
256 uint64_t incompatible_features;
257 uint64_t compatible_features;
258 uint64_t autoclear_features;
260 size_t unknown_header_fields_size;
261 void* unknown_header_fields;
262 QLIST_HEAD(, Qcow2UnknownHeaderExtension) unknown_header_ext;
263 QTAILQ_HEAD (, Qcow2DiscardRegion) discards;
264 bool cache_discards;
265 } BDRVQcowState;
267 /* XXX: use std qcow open function ? */
268 typedef struct QCowCreateState {
269 int cluster_size;
270 int cluster_bits;
271 uint16_t *refcount_block;
272 uint64_t *refcount_table;
273 int64_t l1_table_offset;
274 int64_t refcount_table_offset;
275 int64_t refcount_block_offset;
276 } QCowCreateState;
278 struct QCowAIOCB;
280 typedef struct Qcow2COWRegion {
282 * Offset of the COW region in bytes from the start of the first cluster
283 * touched by the request.
285 uint64_t offset;
287 /** Number of sectors to copy */
288 int nb_sectors;
289 } Qcow2COWRegion;
292 * Describes an in-flight (part of a) write request that writes to clusters
293 * that are not referenced in their L2 table yet.
295 typedef struct QCowL2Meta
297 /** Guest offset of the first newly allocated cluster */
298 uint64_t offset;
300 /** Host offset of the first newly allocated cluster */
301 uint64_t alloc_offset;
304 * Number of sectors from the start of the first allocated cluster to
305 * the end of the (possibly shortened) request
307 int nb_available;
309 /** Number of newly allocated clusters */
310 int nb_clusters;
313 * Requests that overlap with this allocation and wait to be restarted
314 * when the allocating request has completed.
316 CoQueue dependent_requests;
319 * The COW Region between the start of the first allocated cluster and the
320 * area the guest actually writes to.
322 Qcow2COWRegion cow_start;
325 * The COW Region between the area the guest actually writes to and the
326 * end of the last allocated cluster.
328 Qcow2COWRegion cow_end;
330 /** Pointer to next L2Meta of the same write request */
331 struct QCowL2Meta *next;
333 QLIST_ENTRY(QCowL2Meta) next_in_flight;
334 } QCowL2Meta;
336 enum {
337 QCOW2_CLUSTER_UNALLOCATED,
338 QCOW2_CLUSTER_NORMAL,
339 QCOW2_CLUSTER_COMPRESSED,
340 QCOW2_CLUSTER_ZERO
343 typedef enum QCow2MetadataOverlap {
344 QCOW2_OL_MAIN_HEADER_BITNR = 0,
345 QCOW2_OL_ACTIVE_L1_BITNR = 1,
346 QCOW2_OL_ACTIVE_L2_BITNR = 2,
347 QCOW2_OL_REFCOUNT_TABLE_BITNR = 3,
348 QCOW2_OL_REFCOUNT_BLOCK_BITNR = 4,
349 QCOW2_OL_SNAPSHOT_TABLE_BITNR = 5,
350 QCOW2_OL_INACTIVE_L1_BITNR = 6,
351 QCOW2_OL_INACTIVE_L2_BITNR = 7,
353 QCOW2_OL_MAX_BITNR = 8,
355 QCOW2_OL_NONE = 0,
356 QCOW2_OL_MAIN_HEADER = (1 << QCOW2_OL_MAIN_HEADER_BITNR),
357 QCOW2_OL_ACTIVE_L1 = (1 << QCOW2_OL_ACTIVE_L1_BITNR),
358 QCOW2_OL_ACTIVE_L2 = (1 << QCOW2_OL_ACTIVE_L2_BITNR),
359 QCOW2_OL_REFCOUNT_TABLE = (1 << QCOW2_OL_REFCOUNT_TABLE_BITNR),
360 QCOW2_OL_REFCOUNT_BLOCK = (1 << QCOW2_OL_REFCOUNT_BLOCK_BITNR),
361 QCOW2_OL_SNAPSHOT_TABLE = (1 << QCOW2_OL_SNAPSHOT_TABLE_BITNR),
362 QCOW2_OL_INACTIVE_L1 = (1 << QCOW2_OL_INACTIVE_L1_BITNR),
363 /* NOTE: Checking overlaps with inactive L2 tables will result in bdrv
364 * reads. */
365 QCOW2_OL_INACTIVE_L2 = (1 << QCOW2_OL_INACTIVE_L2_BITNR),
366 } QCow2MetadataOverlap;
368 /* Perform all overlap checks which can be done in constant time */
369 #define QCOW2_OL_CONSTANT \
370 (QCOW2_OL_MAIN_HEADER | QCOW2_OL_ACTIVE_L1 | QCOW2_OL_REFCOUNT_TABLE | \
371 QCOW2_OL_SNAPSHOT_TABLE)
373 /* Perform all overlap checks which don't require disk access */
374 #define QCOW2_OL_CACHED \
375 (QCOW2_OL_CONSTANT | QCOW2_OL_ACTIVE_L2 | QCOW2_OL_REFCOUNT_BLOCK | \
376 QCOW2_OL_INACTIVE_L1)
378 /* Perform all overlap checks */
379 #define QCOW2_OL_ALL \
380 (QCOW2_OL_CACHED | QCOW2_OL_INACTIVE_L2)
382 #define L1E_OFFSET_MASK 0x00fffffffffffe00ULL
383 #define L2E_OFFSET_MASK 0x00fffffffffffe00ULL
384 #define L2E_COMPRESSED_OFFSET_SIZE_MASK 0x3fffffffffffffffULL
386 #define REFT_OFFSET_MASK 0xfffffffffffffe00ULL
388 static inline int64_t start_of_cluster(BDRVQcowState *s, int64_t offset)
390 return offset & ~(s->cluster_size - 1);
393 static inline int64_t offset_into_cluster(BDRVQcowState *s, int64_t offset)
395 return offset & (s->cluster_size - 1);
398 static inline int size_to_clusters(BDRVQcowState *s, int64_t size)
400 return (size + (s->cluster_size - 1)) >> s->cluster_bits;
403 static inline int64_t size_to_l1(BDRVQcowState *s, int64_t size)
405 int shift = s->cluster_bits + s->l2_bits;
406 return (size + (1ULL << shift) - 1) >> shift;
409 static inline int offset_to_l2_index(BDRVQcowState *s, int64_t offset)
411 return (offset >> s->cluster_bits) & (s->l2_size - 1);
414 static inline int64_t align_offset(int64_t offset, int n)
416 offset = (offset + n - 1) & ~(n - 1);
417 return offset;
420 static inline int64_t qcow2_vm_state_offset(BDRVQcowState *s)
422 return (int64_t)s->l1_vm_state_index << (s->cluster_bits + s->l2_bits);
425 static inline uint64_t qcow2_max_refcount_clusters(BDRVQcowState *s)
427 return QCOW_MAX_REFTABLE_SIZE >> s->cluster_bits;
430 static inline int qcow2_get_cluster_type(uint64_t l2_entry)
432 if (l2_entry & QCOW_OFLAG_COMPRESSED) {
433 return QCOW2_CLUSTER_COMPRESSED;
434 } else if (l2_entry & QCOW_OFLAG_ZERO) {
435 return QCOW2_CLUSTER_ZERO;
436 } else if (!(l2_entry & L2E_OFFSET_MASK)) {
437 return QCOW2_CLUSTER_UNALLOCATED;
438 } else {
439 return QCOW2_CLUSTER_NORMAL;
443 /* Check whether refcounts are eager or lazy */
444 static inline bool qcow2_need_accurate_refcounts(BDRVQcowState *s)
446 return !(s->incompatible_features & QCOW2_INCOMPAT_DIRTY);
449 static inline uint64_t l2meta_cow_start(QCowL2Meta *m)
451 return m->offset + m->cow_start.offset;
454 static inline uint64_t l2meta_cow_end(QCowL2Meta *m)
456 return m->offset + m->cow_end.offset
457 + (m->cow_end.nb_sectors << BDRV_SECTOR_BITS);
460 // FIXME Need qcow2_ prefix to global functions
462 /* qcow2.c functions */
463 int qcow2_backing_read1(BlockDriverState *bs, QEMUIOVector *qiov,
464 int64_t sector_num, int nb_sectors);
466 int qcow2_mark_dirty(BlockDriverState *bs);
467 int qcow2_mark_corrupt(BlockDriverState *bs);
468 int qcow2_mark_consistent(BlockDriverState *bs);
469 int qcow2_update_header(BlockDriverState *bs);
471 /* qcow2-refcount.c functions */
472 int qcow2_refcount_init(BlockDriverState *bs);
473 void qcow2_refcount_close(BlockDriverState *bs);
475 int qcow2_update_cluster_refcount(BlockDriverState *bs, int64_t cluster_index,
476 int addend, enum qcow2_discard_type type);
478 int64_t qcow2_alloc_clusters(BlockDriverState *bs, uint64_t size);
479 int qcow2_alloc_clusters_at(BlockDriverState *bs, uint64_t offset,
480 int nb_clusters);
481 int64_t qcow2_alloc_bytes(BlockDriverState *bs, int size);
482 void qcow2_free_clusters(BlockDriverState *bs,
483 int64_t offset, int64_t size,
484 enum qcow2_discard_type type);
485 void qcow2_free_any_clusters(BlockDriverState *bs, uint64_t l2_entry,
486 int nb_clusters, enum qcow2_discard_type type);
488 int qcow2_update_snapshot_refcount(BlockDriverState *bs,
489 int64_t l1_table_offset, int l1_size, int addend);
491 int qcow2_check_refcounts(BlockDriverState *bs, BdrvCheckResult *res,
492 BdrvCheckMode fix);
494 void qcow2_process_discards(BlockDriverState *bs, int ret);
496 int qcow2_check_metadata_overlap(BlockDriverState *bs, int ign, int64_t offset,
497 int64_t size);
498 int qcow2_pre_write_overlap_check(BlockDriverState *bs, int ign, int64_t offset,
499 int64_t size);
501 /* qcow2-cluster.c functions */
502 int qcow2_grow_l1_table(BlockDriverState *bs, uint64_t min_size,
503 bool exact_size);
504 int qcow2_write_l1_entry(BlockDriverState *bs, int l1_index);
505 void qcow2_l2_cache_reset(BlockDriverState *bs);
506 int qcow2_decompress_cluster(BlockDriverState *bs, uint64_t cluster_offset);
507 void qcow2_encrypt_sectors(BDRVQcowState *s, int64_t sector_num,
508 uint8_t *out_buf, const uint8_t *in_buf,
509 int nb_sectors, int enc,
510 const AES_KEY *key);
512 int qcow2_get_cluster_offset(BlockDriverState *bs, uint64_t offset,
513 int *num, uint64_t *cluster_offset);
514 int qcow2_alloc_cluster_offset(BlockDriverState *bs, uint64_t offset,
515 int *num, uint64_t *host_offset, QCowL2Meta **m);
516 uint64_t qcow2_alloc_compressed_cluster_offset(BlockDriverState *bs,
517 uint64_t offset,
518 int compressed_size);
520 int qcow2_alloc_cluster_link_l2(BlockDriverState *bs, QCowL2Meta *m);
521 int qcow2_discard_clusters(BlockDriverState *bs, uint64_t offset,
522 int nb_sectors, enum qcow2_discard_type type);
523 int qcow2_zero_clusters(BlockDriverState *bs, uint64_t offset, int nb_sectors);
525 int qcow2_expand_zero_clusters(BlockDriverState *bs);
527 /* qcow2-snapshot.c functions */
528 int qcow2_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info);
529 int qcow2_snapshot_goto(BlockDriverState *bs, const char *snapshot_id);
530 int qcow2_snapshot_delete(BlockDriverState *bs,
531 const char *snapshot_id,
532 const char *name,
533 Error **errp);
534 int qcow2_snapshot_list(BlockDriverState *bs, QEMUSnapshotInfo **psn_tab);
535 int qcow2_snapshot_load_tmp(BlockDriverState *bs,
536 const char *snapshot_id,
537 const char *name,
538 Error **errp);
540 void qcow2_free_snapshots(BlockDriverState *bs);
541 int qcow2_read_snapshots(BlockDriverState *bs);
543 /* qcow2-cache.c functions */
544 Qcow2Cache *qcow2_cache_create(BlockDriverState *bs, int num_tables);
545 int qcow2_cache_destroy(BlockDriverState* bs, Qcow2Cache *c);
547 void qcow2_cache_entry_mark_dirty(Qcow2Cache *c, void *table);
548 int qcow2_cache_flush(BlockDriverState *bs, Qcow2Cache *c);
549 int qcow2_cache_set_dependency(BlockDriverState *bs, Qcow2Cache *c,
550 Qcow2Cache *dependency);
551 void qcow2_cache_depends_on_flush(Qcow2Cache *c);
553 int qcow2_cache_empty(BlockDriverState *bs, Qcow2Cache *c);
555 int qcow2_cache_get(BlockDriverState *bs, Qcow2Cache *c, uint64_t offset,
556 void **table);
557 int qcow2_cache_get_empty(BlockDriverState *bs, Qcow2Cache *c, uint64_t offset,
558 void **table);
559 int qcow2_cache_put(BlockDriverState *bs, Qcow2Cache *c, void **table);
561 #endif