qemu/block/qcow2-snapshot.c
<<
>>
Prefs
   1/*
   2 * Block driver for the QCOW version 2 format
   3 *
   4 * Copyright (c) 2004-2006 Fabrice Bellard
   5 *
   6 * Permission is hereby granted, free of charge, to any person obtaining a copy
   7 * of this software and associated documentation files (the "Software"), to deal
   8 * in the Software without restriction, including without limitation the rights
   9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10 * copies of the Software, and to permit persons to whom the Software is
  11 * furnished to do so, subject to the following conditions:
  12 *
  13 * The above copyright notice and this permission notice shall be included in
  14 * all copies or substantial portions of the Software.
  15 *
  16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22 * THE SOFTWARE.
  23 */
  24
  25#include "qemu/osdep.h"
  26#include "qapi/error.h"
  27#include "block/block_int.h"
  28#include "qcow2.h"
  29#include "qemu/bswap.h"
  30#include "qemu/error-report.h"
  31#include "qemu/cutils.h"
  32
  33void qcow2_free_snapshots(BlockDriverState *bs)
  34{
  35    BDRVQcow2State *s = bs->opaque;
  36    int i;
  37
  38    for(i = 0; i < s->nb_snapshots; i++) {
  39        g_free(s->snapshots[i].name);
  40        g_free(s->snapshots[i].id_str);
  41    }
  42    g_free(s->snapshots);
  43    s->snapshots = NULL;
  44    s->nb_snapshots = 0;
  45}
  46
  47int qcow2_read_snapshots(BlockDriverState *bs)
  48{
  49    BDRVQcow2State *s = bs->opaque;
  50    QCowSnapshotHeader h;
  51    QCowSnapshotExtraData extra;
  52    QCowSnapshot *sn;
  53    int i, id_str_size, name_size;
  54    int64_t offset;
  55    uint32_t extra_data_size;
  56    int ret;
  57
  58    if (!s->nb_snapshots) {
  59        s->snapshots = NULL;
  60        s->snapshots_size = 0;
  61        return 0;
  62    }
  63
  64    offset = s->snapshots_offset;
  65    s->snapshots = g_new0(QCowSnapshot, s->nb_snapshots);
  66
  67    for(i = 0; i < s->nb_snapshots; i++) {
  68        /* Read statically sized part of the snapshot header */
  69        offset = ROUND_UP(offset, 8);
  70        ret = bdrv_pread(bs->file, offset, &h, sizeof(h));
  71        if (ret < 0) {
  72            goto fail;
  73        }
  74
  75        offset += sizeof(h);
  76        sn = s->snapshots + i;
  77        sn->l1_table_offset = be64_to_cpu(h.l1_table_offset);
  78        sn->l1_size = be32_to_cpu(h.l1_size);
  79        sn->vm_state_size = be32_to_cpu(h.vm_state_size);
  80        sn->date_sec = be32_to_cpu(h.date_sec);
  81        sn->date_nsec = be32_to_cpu(h.date_nsec);
  82        sn->vm_clock_nsec = be64_to_cpu(h.vm_clock_nsec);
  83        extra_data_size = be32_to_cpu(h.extra_data_size);
  84
  85        id_str_size = be16_to_cpu(h.id_str_size);
  86        name_size = be16_to_cpu(h.name_size);
  87
  88        /* Read extra data */
  89        ret = bdrv_pread(bs->file, offset, &extra,
  90                         MIN(sizeof(extra), extra_data_size));
  91        if (ret < 0) {
  92            goto fail;
  93        }
  94        offset += extra_data_size;
  95
  96        if (extra_data_size >= 8) {
  97            sn->vm_state_size = be64_to_cpu(extra.vm_state_size_large);
  98        }
  99
 100        if (extra_data_size >= 16) {
 101            sn->disk_size = be64_to_cpu(extra.disk_size);
 102        } else {
 103            sn->disk_size = bs->total_sectors * BDRV_SECTOR_SIZE;
 104        }
 105
 106        /* Read snapshot ID */
 107        sn->id_str = g_malloc(id_str_size + 1);
 108        ret = bdrv_pread(bs->file, offset, sn->id_str, id_str_size);
 109        if (ret < 0) {
 110            goto fail;
 111        }
 112        offset += id_str_size;
 113        sn->id_str[id_str_size] = '\0';
 114
 115        /* Read snapshot name */
 116        sn->name = g_malloc(name_size + 1);
 117        ret = bdrv_pread(bs->file, offset, sn->name, name_size);
 118        if (ret < 0) {
 119            goto fail;
 120        }
 121        offset += name_size;
 122        sn->name[name_size] = '\0';
 123
 124        if (offset - s->snapshots_offset > QCOW_MAX_SNAPSHOTS_SIZE) {
 125            ret = -EFBIG;
 126            goto fail;
 127        }
 128    }
 129
 130    assert(offset - s->snapshots_offset <= INT_MAX);
 131    s->snapshots_size = offset - s->snapshots_offset;
 132    return 0;
 133
 134fail:
 135    qcow2_free_snapshots(bs);
 136    return ret;
 137}
 138
 139/* add at the end of the file a new list of snapshots */
 140static int qcow2_write_snapshots(BlockDriverState *bs)
 141{
 142    BDRVQcow2State *s = bs->opaque;
 143    QCowSnapshot *sn;
 144    QCowSnapshotHeader h;
 145    QCowSnapshotExtraData extra;
 146    int i, name_size, id_str_size, snapshots_size;
 147    struct {
 148        uint32_t nb_snapshots;
 149        uint64_t snapshots_offset;
 150    } QEMU_PACKED header_data;
 151    int64_t offset, snapshots_offset = 0;
 152    int ret;
 153
 154    /* compute the size of the snapshots */
 155    offset = 0;
 156    for(i = 0; i < s->nb_snapshots; i++) {
 157        sn = s->snapshots + i;
 158        offset = ROUND_UP(offset, 8);
 159        offset += sizeof(h);
 160        offset += sizeof(extra);
 161        offset += strlen(sn->id_str);
 162        offset += strlen(sn->name);
 163
 164        if (offset > QCOW_MAX_SNAPSHOTS_SIZE) {
 165            ret = -EFBIG;
 166            goto fail;
 167        }
 168    }
 169
 170    assert(offset <= INT_MAX);
 171    snapshots_size = offset;
 172
 173    /* Allocate space for the new snapshot list */
 174    snapshots_offset = qcow2_alloc_clusters(bs, snapshots_size);
 175    offset = snapshots_offset;
 176    if (offset < 0) {
 177        ret = offset;
 178        goto fail;
 179    }
 180    ret = bdrv_flush(bs);
 181    if (ret < 0) {
 182        goto fail;
 183    }
 184
 185    /* The snapshot list position has not yet been updated, so these clusters
 186     * must indeed be completely free */
 187    ret = qcow2_pre_write_overlap_check(bs, 0, offset, snapshots_size);
 188    if (ret < 0) {
 189        goto fail;
 190    }
 191
 192
 193    /* Write all snapshots to the new list */
 194    for(i = 0; i < s->nb_snapshots; i++) {
 195        sn = s->snapshots + i;
 196        memset(&h, 0, sizeof(h));
 197        h.l1_table_offset = cpu_to_be64(sn->l1_table_offset);
 198        h.l1_size = cpu_to_be32(sn->l1_size);
 199        /* If it doesn't fit in 32 bit, older implementations should treat it
 200         * as a disk-only snapshot rather than truncate the VM state */
 201        if (sn->vm_state_size <= 0xffffffff) {
 202            h.vm_state_size = cpu_to_be32(sn->vm_state_size);
 203        }
 204        h.date_sec = cpu_to_be32(sn->date_sec);
 205        h.date_nsec = cpu_to_be32(sn->date_nsec);
 206        h.vm_clock_nsec = cpu_to_be64(sn->vm_clock_nsec);
 207        h.extra_data_size = cpu_to_be32(sizeof(extra));
 208
 209        memset(&extra, 0, sizeof(extra));
 210        extra.vm_state_size_large = cpu_to_be64(sn->vm_state_size);
 211        extra.disk_size = cpu_to_be64(sn->disk_size);
 212
 213        id_str_size = strlen(sn->id_str);
 214        name_size = strlen(sn->name);
 215        assert(id_str_size <= UINT16_MAX && name_size <= UINT16_MAX);
 216        h.id_str_size = cpu_to_be16(id_str_size);
 217        h.name_size = cpu_to_be16(name_size);
 218        offset = ROUND_UP(offset, 8);
 219
 220        ret = bdrv_pwrite(bs->file, offset, &h, sizeof(h));
 221        if (ret < 0) {
 222            goto fail;
 223        }
 224        offset += sizeof(h);
 225
 226        ret = bdrv_pwrite(bs->file, offset, &extra, sizeof(extra));
 227        if (ret < 0) {
 228            goto fail;
 229        }
 230        offset += sizeof(extra);
 231
 232        ret = bdrv_pwrite(bs->file, offset, sn->id_str, id_str_size);
 233        if (ret < 0) {
 234            goto fail;
 235        }
 236        offset += id_str_size;
 237
 238        ret = bdrv_pwrite(bs->file, offset, sn->name, name_size);
 239        if (ret < 0) {
 240            goto fail;
 241        }
 242        offset += name_size;
 243    }
 244
 245    /*
 246     * Update the header to point to the new snapshot table. This requires the
 247     * new table and its refcounts to be stable on disk.
 248     */
 249    ret = bdrv_flush(bs);
 250    if (ret < 0) {
 251        goto fail;
 252    }
 253
 254    QEMU_BUILD_BUG_ON(offsetof(QCowHeader, snapshots_offset) !=
 255        offsetof(QCowHeader, nb_snapshots) + sizeof(header_data.nb_snapshots));
 256
 257    header_data.nb_snapshots        = cpu_to_be32(s->nb_snapshots);
 258    header_data.snapshots_offset    = cpu_to_be64(snapshots_offset);
 259
 260    ret = bdrv_pwrite_sync(bs->file, offsetof(QCowHeader, nb_snapshots),
 261                           &header_data, sizeof(header_data));
 262    if (ret < 0) {
 263        goto fail;
 264    }
 265
 266    /* free the old snapshot table */
 267    qcow2_free_clusters(bs, s->snapshots_offset, s->snapshots_size,
 268                        QCOW2_DISCARD_SNAPSHOT);
 269    s->snapshots_offset = snapshots_offset;
 270    s->snapshots_size = snapshots_size;
 271    return 0;
 272
 273fail:
 274    if (snapshots_offset > 0) {
 275        qcow2_free_clusters(bs, snapshots_offset, snapshots_size,
 276                            QCOW2_DISCARD_ALWAYS);
 277    }
 278    return ret;
 279}
 280
 281static void find_new_snapshot_id(BlockDriverState *bs,
 282                                 char *id_str, int id_str_size)
 283{
 284    BDRVQcow2State *s = bs->opaque;
 285    QCowSnapshot *sn;
 286    int i;
 287    unsigned long id, id_max = 0;
 288
 289    for(i = 0; i < s->nb_snapshots; i++) {
 290        sn = s->snapshots + i;
 291        id = strtoul(sn->id_str, NULL, 10);
 292        if (id > id_max)
 293            id_max = id;
 294    }
 295    snprintf(id_str, id_str_size, "%lu", id_max + 1);
 296}
 297
 298static int find_snapshot_by_id_and_name(BlockDriverState *bs,
 299                                        const char *id,
 300                                        const char *name)
 301{
 302    BDRVQcow2State *s = bs->opaque;
 303    int i;
 304
 305    if (id && name) {
 306        for (i = 0; i < s->nb_snapshots; i++) {
 307            if (!strcmp(s->snapshots[i].id_str, id) &&
 308                !strcmp(s->snapshots[i].name, name)) {
 309                return i;
 310            }
 311        }
 312    } else if (id) {
 313        for (i = 0; i < s->nb_snapshots; i++) {
 314            if (!strcmp(s->snapshots[i].id_str, id)) {
 315                return i;
 316            }
 317        }
 318    } else if (name) {
 319        for (i = 0; i < s->nb_snapshots; i++) {
 320            if (!strcmp(s->snapshots[i].name, name)) {
 321                return i;
 322            }
 323        }
 324    }
 325
 326    return -1;
 327}
 328
 329static int find_snapshot_by_id_or_name(BlockDriverState *bs,
 330                                       const char *id_or_name)
 331{
 332    int ret;
 333
 334    ret = find_snapshot_by_id_and_name(bs, id_or_name, NULL);
 335    if (ret >= 0) {
 336        return ret;
 337    }
 338    return find_snapshot_by_id_and_name(bs, NULL, id_or_name);
 339}
 340
 341/* if no id is provided, a new one is constructed */
 342int qcow2_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)
 343{
 344    BDRVQcow2State *s = bs->opaque;
 345    QCowSnapshot *new_snapshot_list = NULL;
 346    QCowSnapshot *old_snapshot_list = NULL;
 347    QCowSnapshot sn1, *sn = &sn1;
 348    int i, ret;
 349    uint64_t *l1_table = NULL;
 350    int64_t l1_table_offset;
 351
 352    if (s->nb_snapshots >= QCOW_MAX_SNAPSHOTS) {
 353        return -EFBIG;
 354    }
 355
 356    memset(sn, 0, sizeof(*sn));
 357
 358    /* Generate an ID */
 359    find_new_snapshot_id(bs, sn_info->id_str, sizeof(sn_info->id_str));
 360
 361    /* Check that the ID is unique */
 362    if (find_snapshot_by_id_and_name(bs, sn_info->id_str, NULL) >= 0) {
 363        return -EEXIST;
 364    }
 365
 366    /* Populate sn with passed data */
 367    sn->id_str = g_strdup(sn_info->id_str);
 368    sn->name = g_strdup(sn_info->name);
 369
 370    sn->disk_size = bs->total_sectors * BDRV_SECTOR_SIZE;
 371    sn->vm_state_size = sn_info->vm_state_size;
 372    sn->date_sec = sn_info->date_sec;
 373    sn->date_nsec = sn_info->date_nsec;
 374    sn->vm_clock_nsec = sn_info->vm_clock_nsec;
 375
 376    /* Allocate the L1 table of the snapshot and copy the current one there. */
 377    l1_table_offset = qcow2_alloc_clusters(bs, s->l1_size * sizeof(uint64_t));
 378    if (l1_table_offset < 0) {
 379        ret = l1_table_offset;
 380        goto fail;
 381    }
 382
 383    sn->l1_table_offset = l1_table_offset;
 384    sn->l1_size = s->l1_size;
 385
 386    l1_table = g_try_new(uint64_t, s->l1_size);
 387    if (s->l1_size && l1_table == NULL) {
 388        ret = -ENOMEM;
 389        goto fail;
 390    }
 391
 392    for(i = 0; i < s->l1_size; i++) {
 393        l1_table[i] = cpu_to_be64(s->l1_table[i]);
 394    }
 395
 396    ret = qcow2_pre_write_overlap_check(bs, 0, sn->l1_table_offset,
 397                                        s->l1_size * sizeof(uint64_t));
 398    if (ret < 0) {
 399        goto fail;
 400    }
 401
 402    ret = bdrv_pwrite(bs->file, sn->l1_table_offset, l1_table,
 403                      s->l1_size * sizeof(uint64_t));
 404    if (ret < 0) {
 405        goto fail;
 406    }
 407
 408    g_free(l1_table);
 409    l1_table = NULL;
 410
 411    /*
 412     * Increase the refcounts of all clusters and make sure everything is
 413     * stable on disk before updating the snapshot table to contain a pointer
 414     * to the new L1 table.
 415     */
 416    ret = qcow2_update_snapshot_refcount(bs, s->l1_table_offset, s->l1_size, 1);
 417    if (ret < 0) {
 418        goto fail;
 419    }
 420
 421    /* Append the new snapshot to the snapshot list */
 422    new_snapshot_list = g_new(QCowSnapshot, s->nb_snapshots + 1);
 423    if (s->snapshots) {
 424        memcpy(new_snapshot_list, s->snapshots,
 425               s->nb_snapshots * sizeof(QCowSnapshot));
 426        old_snapshot_list = s->snapshots;
 427    }
 428    s->snapshots = new_snapshot_list;
 429    s->snapshots[s->nb_snapshots++] = *sn;
 430
 431    ret = qcow2_write_snapshots(bs);
 432    if (ret < 0) {
 433        g_free(s->snapshots);
 434        s->snapshots = old_snapshot_list;
 435        s->nb_snapshots--;
 436        goto fail;
 437    }
 438
 439    g_free(old_snapshot_list);
 440
 441    /* The VM state isn't needed any more in the active L1 table; in fact, it
 442     * hurts by causing expensive COW for the next snapshot. */
 443    qcow2_cluster_discard(bs, qcow2_vm_state_offset(s),
 444                          ROUND_UP(sn->vm_state_size, s->cluster_size),
 445                          QCOW2_DISCARD_NEVER, false);
 446
 447#ifdef DEBUG_ALLOC
 448    {
 449      BdrvCheckResult result = {0};
 450      qcow2_check_refcounts(bs, &result, 0);
 451    }
 452#endif
 453    return 0;
 454
 455fail:
 456    g_free(sn->id_str);
 457    g_free(sn->name);
 458    g_free(l1_table);
 459
 460    return ret;
 461}
 462
 463/* copy the snapshot 'snapshot_name' into the current disk image */
 464int qcow2_snapshot_goto(BlockDriverState *bs, const char *snapshot_id)
 465{
 466    BDRVQcow2State *s = bs->opaque;
 467    QCowSnapshot *sn;
 468    Error *local_err = NULL;
 469    int i, snapshot_index;
 470    int cur_l1_bytes, sn_l1_bytes;
 471    int ret;
 472    uint64_t *sn_l1_table = NULL;
 473
 474    /* Search the snapshot */
 475    snapshot_index = find_snapshot_by_id_or_name(bs, snapshot_id);
 476    if (snapshot_index < 0) {
 477        return -ENOENT;
 478    }
 479    sn = &s->snapshots[snapshot_index];
 480
 481    ret = qcow2_validate_table(bs, sn->l1_table_offset, sn->l1_size,
 482                               sizeof(uint64_t), QCOW_MAX_L1_SIZE,
 483                               "Snapshot L1 table", &local_err);
 484    if (ret < 0) {
 485        error_report_err(local_err);
 486        goto fail;
 487    }
 488
 489    if (sn->disk_size != bs->total_sectors * BDRV_SECTOR_SIZE) {
 490        error_report("qcow2: Loading snapshots with different disk "
 491            "size is not implemented");
 492        ret = -ENOTSUP;
 493        goto fail;
 494    }
 495
 496    /*
 497     * Make sure that the current L1 table is big enough to contain the whole
 498     * L1 table of the snapshot. If the snapshot L1 table is smaller, the
 499     * current one must be padded with zeros.
 500     */
 501    ret = qcow2_grow_l1_table(bs, sn->l1_size, true);
 502    if (ret < 0) {
 503        goto fail;
 504    }
 505
 506    cur_l1_bytes = s->l1_size * sizeof(uint64_t);
 507    sn_l1_bytes = sn->l1_size * sizeof(uint64_t);
 508
 509    /*
 510     * Copy the snapshot L1 table to the current L1 table.
 511     *
 512     * Before overwriting the old current L1 table on disk, make sure to
 513     * increase all refcounts for the clusters referenced by the new one.
 514     * Decrease the refcount referenced by the old one only when the L1
 515     * table is overwritten.
 516     */
 517    sn_l1_table = g_try_malloc0(cur_l1_bytes);
 518    if (cur_l1_bytes && sn_l1_table == NULL) {
 519        ret = -ENOMEM;
 520        goto fail;
 521    }
 522
 523    ret = bdrv_pread(bs->file, sn->l1_table_offset,
 524                     sn_l1_table, sn_l1_bytes);
 525    if (ret < 0) {
 526        goto fail;
 527    }
 528
 529    ret = qcow2_update_snapshot_refcount(bs, sn->l1_table_offset,
 530                                         sn->l1_size, 1);
 531    if (ret < 0) {
 532        goto fail;
 533    }
 534
 535    ret = qcow2_pre_write_overlap_check(bs, QCOW2_OL_ACTIVE_L1,
 536                                        s->l1_table_offset, cur_l1_bytes);
 537    if (ret < 0) {
 538        goto fail;
 539    }
 540
 541    ret = bdrv_pwrite_sync(bs->file, s->l1_table_offset, sn_l1_table,
 542                           cur_l1_bytes);
 543    if (ret < 0) {
 544        goto fail;
 545    }
 546
 547    /*
 548     * Decrease refcount of clusters of current L1 table.
 549     *
 550     * At this point, the in-memory s->l1_table points to the old L1 table,
 551     * whereas on disk we already have the new one.
 552     *
 553     * qcow2_update_snapshot_refcount special cases the current L1 table to use
 554     * the in-memory data instead of really using the offset to load a new one,
 555     * which is why this works.
 556     */
 557    ret = qcow2_update_snapshot_refcount(bs, s->l1_table_offset,
 558                                         s->l1_size, -1);
 559
 560    /*
 561     * Now update the in-memory L1 table to be in sync with the on-disk one. We
 562     * need to do this even if updating refcounts failed.
 563     */
 564    for(i = 0;i < s->l1_size; i++) {
 565        s->l1_table[i] = be64_to_cpu(sn_l1_table[i]);
 566    }
 567
 568    if (ret < 0) {
 569        goto fail;
 570    }
 571
 572    g_free(sn_l1_table);
 573    sn_l1_table = NULL;
 574
 575    /*
 576     * Update QCOW_OFLAG_COPIED in the active L1 table (it may have changed
 577     * when we decreased the refcount of the old snapshot.
 578     */
 579    ret = qcow2_update_snapshot_refcount(bs, s->l1_table_offset, s->l1_size, 0);
 580    if (ret < 0) {
 581        goto fail;
 582    }
 583
 584#ifdef DEBUG_ALLOC
 585    {
 586        BdrvCheckResult result = {0};
 587        qcow2_check_refcounts(bs, &result, 0);
 588    }
 589#endif
 590    return 0;
 591
 592fail:
 593    g_free(sn_l1_table);
 594    return ret;
 595}
 596
 597int qcow2_snapshot_delete(BlockDriverState *bs,
 598                          const char *snapshot_id,
 599                          const char *name,
 600                          Error **errp)
 601{
 602    BDRVQcow2State *s = bs->opaque;
 603    QCowSnapshot sn;
 604    int snapshot_index, ret;
 605
 606    /* Search the snapshot */
 607    snapshot_index = find_snapshot_by_id_and_name(bs, snapshot_id, name);
 608    if (snapshot_index < 0) {
 609        error_setg(errp, "Can't find the snapshot");
 610        return -ENOENT;
 611    }
 612    sn = s->snapshots[snapshot_index];
 613
 614    ret = qcow2_validate_table(bs, sn.l1_table_offset, sn.l1_size,
 615                               sizeof(uint64_t), QCOW_MAX_L1_SIZE,
 616                               "Snapshot L1 table", errp);
 617    if (ret < 0) {
 618        return ret;
 619    }
 620
 621    /* Remove it from the snapshot list */
 622    memmove(s->snapshots + snapshot_index,
 623            s->snapshots + snapshot_index + 1,
 624            (s->nb_snapshots - snapshot_index - 1) * sizeof(sn));
 625    s->nb_snapshots--;
 626    ret = qcow2_write_snapshots(bs);
 627    if (ret < 0) {
 628        error_setg_errno(errp, -ret,
 629                         "Failed to remove snapshot from snapshot list");
 630        return ret;
 631    }
 632
 633    /*
 634     * The snapshot is now unused, clean up. If we fail after this point, we
 635     * won't recover but just leak clusters.
 636     */
 637    g_free(sn.id_str);
 638    g_free(sn.name);
 639
 640    /*
 641     * Now decrease the refcounts of clusters referenced by the snapshot and
 642     * free the L1 table.
 643     */
 644    ret = qcow2_update_snapshot_refcount(bs, sn.l1_table_offset,
 645                                         sn.l1_size, -1);
 646    if (ret < 0) {
 647        error_setg_errno(errp, -ret, "Failed to free the cluster and L1 table");
 648        return ret;
 649    }
 650    qcow2_free_clusters(bs, sn.l1_table_offset, sn.l1_size * sizeof(uint64_t),
 651                        QCOW2_DISCARD_SNAPSHOT);
 652
 653    /* must update the copied flag on the current cluster offsets */
 654    ret = qcow2_update_snapshot_refcount(bs, s->l1_table_offset, s->l1_size, 0);
 655    if (ret < 0) {
 656        error_setg_errno(errp, -ret,
 657                         "Failed to update snapshot status in disk");
 658        return ret;
 659    }
 660
 661#ifdef DEBUG_ALLOC
 662    {
 663        BdrvCheckResult result = {0};
 664        qcow2_check_refcounts(bs, &result, 0);
 665    }
 666#endif
 667    return 0;
 668}
 669
 670int qcow2_snapshot_list(BlockDriverState *bs, QEMUSnapshotInfo **psn_tab)
 671{
 672    BDRVQcow2State *s = bs->opaque;
 673    QEMUSnapshotInfo *sn_tab, *sn_info;
 674    QCowSnapshot *sn;
 675    int i;
 676
 677    if (!s->nb_snapshots) {
 678        *psn_tab = NULL;
 679        return s->nb_snapshots;
 680    }
 681
 682    sn_tab = g_new0(QEMUSnapshotInfo, s->nb_snapshots);
 683    for(i = 0; i < s->nb_snapshots; i++) {
 684        sn_info = sn_tab + i;
 685        sn = s->snapshots + i;
 686        pstrcpy(sn_info->id_str, sizeof(sn_info->id_str),
 687                sn->id_str);
 688        pstrcpy(sn_info->name, sizeof(sn_info->name),
 689                sn->name);
 690        sn_info->vm_state_size = sn->vm_state_size;
 691        sn_info->date_sec = sn->date_sec;
 692        sn_info->date_nsec = sn->date_nsec;
 693        sn_info->vm_clock_nsec = sn->vm_clock_nsec;
 694    }
 695    *psn_tab = sn_tab;
 696    return s->nb_snapshots;
 697}
 698
 699int qcow2_snapshot_load_tmp(BlockDriverState *bs,
 700                            const char *snapshot_id,
 701                            const char *name,
 702                            Error **errp)
 703{
 704    int i, snapshot_index;
 705    BDRVQcow2State *s = bs->opaque;
 706    QCowSnapshot *sn;
 707    uint64_t *new_l1_table;
 708    int new_l1_bytes;
 709    int ret;
 710
 711    assert(bs->read_only);
 712
 713    /* Search the snapshot */
 714    snapshot_index = find_snapshot_by_id_and_name(bs, snapshot_id, name);
 715    if (snapshot_index < 0) {
 716        error_setg(errp,
 717                   "Can't find snapshot");
 718        return -ENOENT;
 719    }
 720    sn = &s->snapshots[snapshot_index];
 721
 722    /* Allocate and read in the snapshot's L1 table */
 723    ret = qcow2_validate_table(bs, sn->l1_table_offset, sn->l1_size,
 724                               sizeof(uint64_t), QCOW_MAX_L1_SIZE,
 725                               "Snapshot L1 table", errp);
 726    if (ret < 0) {
 727        return ret;
 728    }
 729    new_l1_bytes = sn->l1_size * sizeof(uint64_t);
 730    new_l1_table = qemu_try_blockalign(bs->file->bs,
 731                                       ROUND_UP(new_l1_bytes, 512));
 732    if (new_l1_table == NULL) {
 733        return -ENOMEM;
 734    }
 735
 736    ret = bdrv_pread(bs->file, sn->l1_table_offset,
 737                     new_l1_table, new_l1_bytes);
 738    if (ret < 0) {
 739        error_setg(errp, "Failed to read l1 table for snapshot");
 740        qemu_vfree(new_l1_table);
 741        return ret;
 742    }
 743
 744    /* Switch the L1 table */
 745    qemu_vfree(s->l1_table);
 746
 747    s->l1_size = sn->l1_size;
 748    s->l1_table_offset = sn->l1_table_offset;
 749    s->l1_table = new_l1_table;
 750
 751    for(i = 0;i < s->l1_size; i++) {
 752        be64_to_cpus(&s->l1_table[i]);
 753    }
 754
 755    return 0;
 756}
 757