qemu/block/qcow2-refcount.c
<<
>>
Prefs
   1/*
   2 * Block driver for the QCOW version 2 format
   3 *
   4 * Copyright (c) 2004-2006 Fabrice Bellard
   5 *
   6 * Permission is hereby granted, free of charge, to any person obtaining a copy
   7 * of this software and associated documentation files (the "Software"), to deal
   8 * in the Software without restriction, including without limitation the rights
   9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10 * copies of the Software, and to permit persons to whom the Software is
  11 * furnished to do so, subject to the following conditions:
  12 *
  13 * The above copyright notice and this permission notice shall be included in
  14 * all copies or substantial portions of the Software.
  15 *
  16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22 * THE SOFTWARE.
  23 */
  24
  25#include "qemu/osdep.h"
  26#include "qapi/error.h"
  27#include "qcow2.h"
  28#include "qemu/range.h"
  29#include "qemu/bswap.h"
  30#include "qemu/cutils.h"
  31#include "trace.h"
  32
  33static int64_t alloc_clusters_noref(BlockDriverState *bs, uint64_t size,
  34                                    uint64_t max);
  35static int QEMU_WARN_UNUSED_RESULT update_refcount(BlockDriverState *bs,
  36                            int64_t offset, int64_t length, uint64_t addend,
  37                            bool decrease, enum qcow2_discard_type type);
  38
  39static uint64_t get_refcount_ro0(const void *refcount_array, uint64_t index);
  40static uint64_t get_refcount_ro1(const void *refcount_array, uint64_t index);
  41static uint64_t get_refcount_ro2(const void *refcount_array, uint64_t index);
  42static uint64_t get_refcount_ro3(const void *refcount_array, uint64_t index);
  43static uint64_t get_refcount_ro4(const void *refcount_array, uint64_t index);
  44static uint64_t get_refcount_ro5(const void *refcount_array, uint64_t index);
  45static uint64_t get_refcount_ro6(const void *refcount_array, uint64_t index);
  46
  47static void set_refcount_ro0(void *refcount_array, uint64_t index,
  48                             uint64_t value);
  49static void set_refcount_ro1(void *refcount_array, uint64_t index,
  50                             uint64_t value);
  51static void set_refcount_ro2(void *refcount_array, uint64_t index,
  52                             uint64_t value);
  53static void set_refcount_ro3(void *refcount_array, uint64_t index,
  54                             uint64_t value);
  55static void set_refcount_ro4(void *refcount_array, uint64_t index,
  56                             uint64_t value);
  57static void set_refcount_ro5(void *refcount_array, uint64_t index,
  58                             uint64_t value);
  59static void set_refcount_ro6(void *refcount_array, uint64_t index,
  60                             uint64_t value);
  61
  62
  63static Qcow2GetRefcountFunc *const get_refcount_funcs[] = {
  64    &get_refcount_ro0,
  65    &get_refcount_ro1,
  66    &get_refcount_ro2,
  67    &get_refcount_ro3,
  68    &get_refcount_ro4,
  69    &get_refcount_ro5,
  70    &get_refcount_ro6
  71};
  72
  73static Qcow2SetRefcountFunc *const set_refcount_funcs[] = {
  74    &set_refcount_ro0,
  75    &set_refcount_ro1,
  76    &set_refcount_ro2,
  77    &set_refcount_ro3,
  78    &set_refcount_ro4,
  79    &set_refcount_ro5,
  80    &set_refcount_ro6
  81};
  82
  83
  84/*********************************************************/
  85/* refcount handling */
  86
  87static void update_max_refcount_table_index(BDRVQcow2State *s)
  88{
  89    unsigned i = s->refcount_table_size - 1;
  90    while (i > 0 && (s->refcount_table[i] & REFT_OFFSET_MASK) == 0) {
  91        i--;
  92    }
  93    /* Set s->max_refcount_table_index to the index of the last used entry */
  94    s->max_refcount_table_index = i;
  95}
  96
  97int qcow2_refcount_init(BlockDriverState *bs)
  98{
  99    BDRVQcow2State *s = bs->opaque;
 100    unsigned int refcount_table_size2, i;
 101    int ret;
 102
 103    assert(s->refcount_order >= 0 && s->refcount_order <= 6);
 104
 105    s->get_refcount = get_refcount_funcs[s->refcount_order];
 106    s->set_refcount = set_refcount_funcs[s->refcount_order];
 107
 108    assert(s->refcount_table_size <= INT_MAX / sizeof(uint64_t));
 109    refcount_table_size2 = s->refcount_table_size * sizeof(uint64_t);
 110    s->refcount_table = g_try_malloc(refcount_table_size2);
 111
 112    if (s->refcount_table_size > 0) {
 113        if (s->refcount_table == NULL) {
 114            ret = -ENOMEM;
 115            goto fail;
 116        }
 117        BLKDBG_EVENT(bs->file, BLKDBG_REFTABLE_LOAD);
 118        ret = bdrv_pread(bs->file, s->refcount_table_offset,
 119                         s->refcount_table, refcount_table_size2);
 120        if (ret < 0) {
 121            goto fail;
 122        }
 123        for(i = 0; i < s->refcount_table_size; i++)
 124            be64_to_cpus(&s->refcount_table[i]);
 125        update_max_refcount_table_index(s);
 126    }
 127    return 0;
 128 fail:
 129    return ret;
 130}
 131
 132void qcow2_refcount_close(BlockDriverState *bs)
 133{
 134    BDRVQcow2State *s = bs->opaque;
 135    g_free(s->refcount_table);
 136}
 137
 138
 139static uint64_t get_refcount_ro0(const void *refcount_array, uint64_t index)
 140{
 141    return (((const uint8_t *)refcount_array)[index / 8] >> (index % 8)) & 0x1;
 142}
 143
 144static void set_refcount_ro0(void *refcount_array, uint64_t index,
 145                             uint64_t value)
 146{
 147    assert(!(value >> 1));
 148    ((uint8_t *)refcount_array)[index / 8] &= ~(0x1 << (index % 8));
 149    ((uint8_t *)refcount_array)[index / 8] |= value << (index % 8);
 150}
 151
 152static uint64_t get_refcount_ro1(const void *refcount_array, uint64_t index)
 153{
 154    return (((const uint8_t *)refcount_array)[index / 4] >> (2 * (index % 4)))
 155           & 0x3;
 156}
 157
 158static void set_refcount_ro1(void *refcount_array, uint64_t index,
 159                             uint64_t value)
 160{
 161    assert(!(value >> 2));
 162    ((uint8_t *)refcount_array)[index / 4] &= ~(0x3 << (2 * (index % 4)));
 163    ((uint8_t *)refcount_array)[index / 4] |= value << (2 * (index % 4));
 164}
 165
 166static uint64_t get_refcount_ro2(const void *refcount_array, uint64_t index)
 167{
 168    return (((const uint8_t *)refcount_array)[index / 2] >> (4 * (index % 2)))
 169           & 0xf;
 170}
 171
 172static void set_refcount_ro2(void *refcount_array, uint64_t index,
 173                             uint64_t value)
 174{
 175    assert(!(value >> 4));
 176    ((uint8_t *)refcount_array)[index / 2] &= ~(0xf << (4 * (index % 2)));
 177    ((uint8_t *)refcount_array)[index / 2] |= value << (4 * (index % 2));
 178}
 179
 180static uint64_t get_refcount_ro3(const void *refcount_array, uint64_t index)
 181{
 182    return ((const uint8_t *)refcount_array)[index];
 183}
 184
 185static void set_refcount_ro3(void *refcount_array, uint64_t index,
 186                             uint64_t value)
 187{
 188    assert(!(value >> 8));
 189    ((uint8_t *)refcount_array)[index] = value;
 190}
 191
 192static uint64_t get_refcount_ro4(const void *refcount_array, uint64_t index)
 193{
 194    return be16_to_cpu(((const uint16_t *)refcount_array)[index]);
 195}
 196
 197static void set_refcount_ro4(void *refcount_array, uint64_t index,
 198                             uint64_t value)
 199{
 200    assert(!(value >> 16));
 201    ((uint16_t *)refcount_array)[index] = cpu_to_be16(value);
 202}
 203
 204static uint64_t get_refcount_ro5(const void *refcount_array, uint64_t index)
 205{
 206    return be32_to_cpu(((const uint32_t *)refcount_array)[index]);
 207}
 208
 209static void set_refcount_ro5(void *refcount_array, uint64_t index,
 210                             uint64_t value)
 211{
 212    assert(!(value >> 32));
 213    ((uint32_t *)refcount_array)[index] = cpu_to_be32(value);
 214}
 215
 216static uint64_t get_refcount_ro6(const void *refcount_array, uint64_t index)
 217{
 218    return be64_to_cpu(((const uint64_t *)refcount_array)[index]);
 219}
 220
 221static void set_refcount_ro6(void *refcount_array, uint64_t index,
 222                             uint64_t value)
 223{
 224    ((uint64_t *)refcount_array)[index] = cpu_to_be64(value);
 225}
 226
 227
 228static int load_refcount_block(BlockDriverState *bs,
 229                               int64_t refcount_block_offset,
 230                               void **refcount_block)
 231{
 232    BDRVQcow2State *s = bs->opaque;
 233
 234    BLKDBG_EVENT(bs->file, BLKDBG_REFBLOCK_LOAD);
 235    return qcow2_cache_get(bs, s->refcount_block_cache, refcount_block_offset,
 236                           refcount_block);
 237}
 238
 239/*
 240 * Retrieves the refcount of the cluster given by its index and stores it in
 241 * *refcount. Returns 0 on success and -errno on failure.
 242 */
 243int qcow2_get_refcount(BlockDriverState *bs, int64_t cluster_index,
 244                       uint64_t *refcount)
 245{
 246    BDRVQcow2State *s = bs->opaque;
 247    uint64_t refcount_table_index, block_index;
 248    int64_t refcount_block_offset;
 249    int ret;
 250    void *refcount_block;
 251
 252    refcount_table_index = cluster_index >> s->refcount_block_bits;
 253    if (refcount_table_index >= s->refcount_table_size) {
 254        *refcount = 0;
 255        return 0;
 256    }
 257    refcount_block_offset =
 258        s->refcount_table[refcount_table_index] & REFT_OFFSET_MASK;
 259    if (!refcount_block_offset) {
 260        *refcount = 0;
 261        return 0;
 262    }
 263
 264    if (offset_into_cluster(s, refcount_block_offset)) {
 265        qcow2_signal_corruption(bs, true, -1, -1, "Refblock offset %#" PRIx64
 266                                " unaligned (reftable index: %#" PRIx64 ")",
 267                                refcount_block_offset, refcount_table_index);
 268        return -EIO;
 269    }
 270
 271    ret = qcow2_cache_get(bs, s->refcount_block_cache, refcount_block_offset,
 272                          &refcount_block);
 273    if (ret < 0) {
 274        return ret;
 275    }
 276
 277    block_index = cluster_index & (s->refcount_block_size - 1);
 278    *refcount = s->get_refcount(refcount_block, block_index);
 279
 280    qcow2_cache_put(s->refcount_block_cache, &refcount_block);
 281
 282    return 0;
 283}
 284
 285/* Checks if two offsets are described by the same refcount block */
 286static int in_same_refcount_block(BDRVQcow2State *s, uint64_t offset_a,
 287    uint64_t offset_b)
 288{
 289    uint64_t block_a = offset_a >> (s->cluster_bits + s->refcount_block_bits);
 290    uint64_t block_b = offset_b >> (s->cluster_bits + s->refcount_block_bits);
 291
 292    return (block_a == block_b);
 293}
 294
 295/*
 296 * Loads a refcount block. If it doesn't exist yet, it is allocated first
 297 * (including growing the refcount table if needed).
 298 *
 299 * Returns 0 on success or -errno in error case
 300 */
 301static int alloc_refcount_block(BlockDriverState *bs,
 302                                int64_t cluster_index, void **refcount_block)
 303{
 304    BDRVQcow2State *s = bs->opaque;
 305    unsigned int refcount_table_index;
 306    int64_t ret;
 307
 308    BLKDBG_EVENT(bs->file, BLKDBG_REFBLOCK_ALLOC);
 309
 310    /* Find the refcount block for the given cluster */
 311    refcount_table_index = cluster_index >> s->refcount_block_bits;
 312
 313    if (refcount_table_index < s->refcount_table_size) {
 314
 315        uint64_t refcount_block_offset =
 316            s->refcount_table[refcount_table_index] & REFT_OFFSET_MASK;
 317
 318        /* If it's already there, we're done */
 319        if (refcount_block_offset) {
 320            if (offset_into_cluster(s, refcount_block_offset)) {
 321                qcow2_signal_corruption(bs, true, -1, -1, "Refblock offset %#"
 322                                        PRIx64 " unaligned (reftable index: "
 323                                        "%#x)", refcount_block_offset,
 324                                        refcount_table_index);
 325                return -EIO;
 326            }
 327
 328             return load_refcount_block(bs, refcount_block_offset,
 329                                        refcount_block);
 330        }
 331    }
 332
 333    /*
 334     * If we came here, we need to allocate something. Something is at least
 335     * a cluster for the new refcount block. It may also include a new refcount
 336     * table if the old refcount table is too small.
 337     *
 338     * Note that allocating clusters here needs some special care:
 339     *
 340     * - We can't use the normal qcow2_alloc_clusters(), it would try to
 341     *   increase the refcount and very likely we would end up with an endless
 342     *   recursion. Instead we must place the refcount blocks in a way that
 343     *   they can describe them themselves.
 344     *
 345     * - We need to consider that at this point we are inside update_refcounts
 346     *   and potentially doing an initial refcount increase. This means that
 347     *   some clusters have already been allocated by the caller, but their
 348     *   refcount isn't accurate yet. If we allocate clusters for metadata, we
 349     *   need to return -EAGAIN to signal the caller that it needs to restart
 350     *   the search for free clusters.
 351     *
 352     * - alloc_clusters_noref and qcow2_free_clusters may load a different
 353     *   refcount block into the cache
 354     */
 355
 356    *refcount_block = NULL;
 357
 358    /* We write to the refcount table, so we might depend on L2 tables */
 359    ret = qcow2_cache_flush(bs, s->l2_table_cache);
 360    if (ret < 0) {
 361        return ret;
 362    }
 363
 364    /* Allocate the refcount block itself and mark it as used */
 365    int64_t new_block = alloc_clusters_noref(bs, s->cluster_size, INT64_MAX);
 366    if (new_block < 0) {
 367        return new_block;
 368    }
 369
 370    /* The offset must fit in the offset field of the refcount table entry */
 371    assert((new_block & REFT_OFFSET_MASK) == new_block);
 372
 373    /* If we're allocating the block at offset 0 then something is wrong */
 374    if (new_block == 0) {
 375        qcow2_signal_corruption(bs, true, -1, -1, "Preventing invalid "
 376                                "allocation of refcount block at offset 0");
 377        return -EIO;
 378    }
 379
 380#ifdef DEBUG_ALLOC2
 381    fprintf(stderr, "qcow2: Allocate refcount block %d for %" PRIx64
 382        " at %" PRIx64 "\n",
 383        refcount_table_index, cluster_index << s->cluster_bits, new_block);
 384#endif
 385
 386    if (in_same_refcount_block(s, new_block, cluster_index << s->cluster_bits)) {
 387        /* Zero the new refcount block before updating it */
 388        ret = qcow2_cache_get_empty(bs, s->refcount_block_cache, new_block,
 389                                    refcount_block);
 390        if (ret < 0) {
 391            goto fail;
 392        }
 393
 394        memset(*refcount_block, 0, s->cluster_size);
 395
 396        /* The block describes itself, need to update the cache */
 397        int block_index = (new_block >> s->cluster_bits) &
 398            (s->refcount_block_size - 1);
 399        s->set_refcount(*refcount_block, block_index, 1);
 400    } else {
 401        /* Described somewhere else. This can recurse at most twice before we
 402         * arrive at a block that describes itself. */
 403        ret = update_refcount(bs, new_block, s->cluster_size, 1, false,
 404                              QCOW2_DISCARD_NEVER);
 405        if (ret < 0) {
 406            goto fail;
 407        }
 408
 409        ret = qcow2_cache_flush(bs, s->refcount_block_cache);
 410        if (ret < 0) {
 411            goto fail;
 412        }
 413
 414        /* Initialize the new refcount block only after updating its refcount,
 415         * update_refcount uses the refcount cache itself */
 416        ret = qcow2_cache_get_empty(bs, s->refcount_block_cache, new_block,
 417                                    refcount_block);
 418        if (ret < 0) {
 419            goto fail;
 420        }
 421
 422        memset(*refcount_block, 0, s->cluster_size);
 423    }
 424
 425    /* Now the new refcount block needs to be written to disk */
 426    BLKDBG_EVENT(bs->file, BLKDBG_REFBLOCK_ALLOC_WRITE);
 427    qcow2_cache_entry_mark_dirty(s->refcount_block_cache, *refcount_block);
 428    ret = qcow2_cache_flush(bs, s->refcount_block_cache);
 429    if (ret < 0) {
 430        goto fail;
 431    }
 432
 433    /* If the refcount table is big enough, just hook the block up there */
 434    if (refcount_table_index < s->refcount_table_size) {
 435        uint64_t data64 = cpu_to_be64(new_block);
 436        BLKDBG_EVENT(bs->file, BLKDBG_REFBLOCK_ALLOC_HOOKUP);
 437        ret = bdrv_pwrite_sync(bs->file,
 438            s->refcount_table_offset + refcount_table_index * sizeof(uint64_t),
 439            &data64, sizeof(data64));
 440        if (ret < 0) {
 441            goto fail;
 442        }
 443
 444        s->refcount_table[refcount_table_index] = new_block;
 445        /* If there's a hole in s->refcount_table then it can happen
 446         * that refcount_table_index < s->max_refcount_table_index */
 447        s->max_refcount_table_index =
 448            MAX(s->max_refcount_table_index, refcount_table_index);
 449
 450        /* The new refcount block may be where the caller intended to put its
 451         * data, so let it restart the search. */
 452        return -EAGAIN;
 453    }
 454
 455    qcow2_cache_put(s->refcount_block_cache, refcount_block);
 456
 457    /*
 458     * If we come here, we need to grow the refcount table. Again, a new
 459     * refcount table needs some space and we can't simply allocate to avoid
 460     * endless recursion.
 461     *
 462     * Therefore let's grab new refcount blocks at the end of the image, which
 463     * will describe themselves and the new refcount table. This way we can
 464     * reference them only in the new table and do the switch to the new
 465     * refcount table at once without producing an inconsistent state in
 466     * between.
 467     */
 468    BLKDBG_EVENT(bs->file, BLKDBG_REFTABLE_GROW);
 469
 470    /* Calculate the number of refcount blocks needed so far; this will be the
 471     * basis for calculating the index of the first cluster used for the
 472     * self-describing refcount structures which we are about to create.
 473     *
 474     * Because we reached this point, there cannot be any refcount entries for
 475     * cluster_index or higher indices yet. However, because new_block has been
 476     * allocated to describe that cluster (and it will assume this role later
 477     * on), we cannot use that index; also, new_block may actually have a higher
 478     * cluster index than cluster_index, so it needs to be taken into account
 479     * here (and 1 needs to be added to its value because that cluster is used).
 480     */
 481    uint64_t blocks_used = DIV_ROUND_UP(MAX(cluster_index + 1,
 482                                            (new_block >> s->cluster_bits) + 1),
 483                                        s->refcount_block_size);
 484
 485    /* Create the new refcount table and blocks */
 486    uint64_t meta_offset = (blocks_used * s->refcount_block_size) *
 487        s->cluster_size;
 488
 489    ret = qcow2_refcount_area(bs, meta_offset, 0, false,
 490                              refcount_table_index, new_block);
 491    if (ret < 0) {
 492        return ret;
 493    }
 494
 495    ret = load_refcount_block(bs, new_block, refcount_block);
 496    if (ret < 0) {
 497        return ret;
 498    }
 499
 500    /* If we were trying to do the initial refcount update for some cluster
 501     * allocation, we might have used the same clusters to store newly
 502     * allocated metadata. Make the caller search some new space. */
 503    return -EAGAIN;
 504
 505fail:
 506    if (*refcount_block != NULL) {
 507        qcow2_cache_put(s->refcount_block_cache, refcount_block);
 508    }
 509    return ret;
 510}
 511
 512/*
 513 * Starting at @start_offset, this function creates new self-covering refcount
 514 * structures: A new refcount table and refcount blocks which cover all of
 515 * themselves, and a number of @additional_clusters beyond their end.
 516 * @start_offset must be at the end of the image file, that is, there must be
 517 * only empty space beyond it.
 518 * If @exact_size is false, the refcount table will have 50 % more entries than
 519 * necessary so it will not need to grow again soon.
 520 * If @new_refblock_offset is not zero, it contains the offset of a refcount
 521 * block that should be entered into the new refcount table at index
 522 * @new_refblock_index.
 523 *
 524 * Returns: The offset after the new refcount structures (i.e. where the
 525 *          @additional_clusters may be placed) on success, -errno on error.
 526 */
 527int64_t qcow2_refcount_area(BlockDriverState *bs, uint64_t start_offset,
 528                            uint64_t additional_clusters, bool exact_size,
 529                            int new_refblock_index,
 530                            uint64_t new_refblock_offset)
 531{
 532    BDRVQcow2State *s = bs->opaque;
 533    uint64_t total_refblock_count_u64, additional_refblock_count;
 534    int total_refblock_count, table_size, area_reftable_index, table_clusters;
 535    int i;
 536    uint64_t table_offset, block_offset, end_offset;
 537    int ret;
 538    uint64_t *new_table;
 539
 540    assert(!(start_offset % s->cluster_size));
 541
 542    qcow2_refcount_metadata_size(start_offset / s->cluster_size +
 543                                 additional_clusters,
 544                                 s->cluster_size, s->refcount_order,
 545                                 !exact_size, &total_refblock_count_u64);
 546    if (total_refblock_count_u64 > QCOW_MAX_REFTABLE_SIZE) {
 547        return -EFBIG;
 548    }
 549    total_refblock_count = total_refblock_count_u64;
 550
 551    /* Index in the refcount table of the first refcount block to cover the area
 552     * of refcount structures we are about to create; we know that
 553     * @total_refblock_count can cover @start_offset, so this will definitely
 554     * fit into an int. */
 555    area_reftable_index = (start_offset / s->cluster_size) /
 556                          s->refcount_block_size;
 557
 558    if (exact_size) {
 559        table_size = total_refblock_count;
 560    } else {
 561        table_size = total_refblock_count +
 562                     DIV_ROUND_UP(total_refblock_count, 2);
 563    }
 564    /* The qcow2 file can only store the reftable size in number of clusters */
 565    table_size = ROUND_UP(table_size, s->cluster_size / sizeof(uint64_t));
 566    table_clusters = (table_size * sizeof(uint64_t)) / s->cluster_size;
 567
 568    if (table_size > QCOW_MAX_REFTABLE_SIZE) {
 569        return -EFBIG;
 570    }
 571
 572    new_table = g_try_new0(uint64_t, table_size);
 573
 574    assert(table_size > 0);
 575    if (new_table == NULL) {
 576        ret = -ENOMEM;
 577        goto fail;
 578    }
 579
 580    /* Fill the new refcount table */
 581    if (table_size > s->max_refcount_table_index) {
 582        /* We're actually growing the reftable */
 583        memcpy(new_table, s->refcount_table,
 584               (s->max_refcount_table_index + 1) * sizeof(uint64_t));
 585    } else {
 586        /* Improbable case: We're shrinking the reftable. However, the caller
 587         * has assured us that there is only empty space beyond @start_offset,
 588         * so we can simply drop all of the refblocks that won't fit into the
 589         * new reftable. */
 590        memcpy(new_table, s->refcount_table, table_size * sizeof(uint64_t));
 591    }
 592
 593    if (new_refblock_offset) {
 594        assert(new_refblock_index < total_refblock_count);
 595        new_table[new_refblock_index] = new_refblock_offset;
 596    }
 597
 598    /* Count how many new refblocks we have to create */
 599    additional_refblock_count = 0;
 600    for (i = area_reftable_index; i < total_refblock_count; i++) {
 601        if (!new_table[i]) {
 602            additional_refblock_count++;
 603        }
 604    }
 605
 606    table_offset = start_offset + additional_refblock_count * s->cluster_size;
 607    end_offset = table_offset + table_clusters * s->cluster_size;
 608
 609    /* Fill the refcount blocks, and create new ones, if necessary */
 610    block_offset = start_offset;
 611    for (i = area_reftable_index; i < total_refblock_count; i++) {
 612        void *refblock_data;
 613        uint64_t first_offset_covered;
 614
 615        /* Reuse an existing refblock if possible, create a new one otherwise */
 616        if (new_table[i]) {
 617            ret = qcow2_cache_get(bs, s->refcount_block_cache, new_table[i],
 618                                  &refblock_data);
 619            if (ret < 0) {
 620                goto fail;
 621            }
 622        } else {
 623            ret = qcow2_cache_get_empty(bs, s->refcount_block_cache,
 624                                        block_offset, &refblock_data);
 625            if (ret < 0) {
 626                goto fail;
 627            }
 628            memset(refblock_data, 0, s->cluster_size);
 629            qcow2_cache_entry_mark_dirty(s->refcount_block_cache,
 630                                         refblock_data);
 631
 632            new_table[i] = block_offset;
 633            block_offset += s->cluster_size;
 634        }
 635
 636        /* First host offset covered by this refblock */
 637        first_offset_covered = (uint64_t)i * s->refcount_block_size *
 638                               s->cluster_size;
 639        if (first_offset_covered < end_offset) {
 640            int j, end_index;
 641
 642            /* Set the refcount of all of the new refcount structures to 1 */
 643
 644            if (first_offset_covered < start_offset) {
 645                assert(i == area_reftable_index);
 646                j = (start_offset - first_offset_covered) / s->cluster_size;
 647                assert(j < s->refcount_block_size);
 648            } else {
 649                j = 0;
 650            }
 651
 652            end_index = MIN((end_offset - first_offset_covered) /
 653                            s->cluster_size,
 654                            s->refcount_block_size);
 655
 656            for (; j < end_index; j++) {
 657                /* The caller guaranteed us this space would be empty */
 658                assert(s->get_refcount(refblock_data, j) == 0);
 659                s->set_refcount(refblock_data, j, 1);
 660            }
 661
 662            qcow2_cache_entry_mark_dirty(s->refcount_block_cache,
 663                                         refblock_data);
 664        }
 665
 666        qcow2_cache_put(s->refcount_block_cache, &refblock_data);
 667    }
 668
 669    assert(block_offset == table_offset);
 670
 671    /* Write refcount blocks to disk */
 672    BLKDBG_EVENT(bs->file, BLKDBG_REFBLOCK_ALLOC_WRITE_BLOCKS);
 673    ret = qcow2_cache_flush(bs, s->refcount_block_cache);
 674    if (ret < 0) {
 675        goto fail;
 676    }
 677
 678    /* Write refcount table to disk */
 679    for (i = 0; i < total_refblock_count; i++) {
 680        cpu_to_be64s(&new_table[i]);
 681    }
 682
 683    BLKDBG_EVENT(bs->file, BLKDBG_REFBLOCK_ALLOC_WRITE_TABLE);
 684    ret = bdrv_pwrite_sync(bs->file, table_offset, new_table,
 685        table_size * sizeof(uint64_t));
 686    if (ret < 0) {
 687        goto fail;
 688    }
 689
 690    for (i = 0; i < total_refblock_count; i++) {
 691        be64_to_cpus(&new_table[i]);
 692    }
 693
 694    /* Hook up the new refcount table in the qcow2 header */
 695    struct QEMU_PACKED {
 696        uint64_t d64;
 697        uint32_t d32;
 698    } data;
 699    data.d64 = cpu_to_be64(table_offset);
 700    data.d32 = cpu_to_be32(table_clusters);
 701    BLKDBG_EVENT(bs->file, BLKDBG_REFBLOCK_ALLOC_SWITCH_TABLE);
 702    ret = bdrv_pwrite_sync(bs->file,
 703                           offsetof(QCowHeader, refcount_table_offset),
 704                           &data, sizeof(data));
 705    if (ret < 0) {
 706        goto fail;
 707    }
 708
 709    /* And switch it in memory */
 710    uint64_t old_table_offset = s->refcount_table_offset;
 711    uint64_t old_table_size = s->refcount_table_size;
 712
 713    g_free(s->refcount_table);
 714    s->refcount_table = new_table;
 715    s->refcount_table_size = table_size;
 716    s->refcount_table_offset = table_offset;
 717    update_max_refcount_table_index(s);
 718
 719    /* Free old table. */
 720    qcow2_free_clusters(bs, old_table_offset, old_table_size * sizeof(uint64_t),
 721                        QCOW2_DISCARD_OTHER);
 722
 723    return end_offset;
 724
 725fail:
 726    g_free(new_table);
 727    return ret;
 728}
 729
 730void qcow2_process_discards(BlockDriverState *bs, int ret)
 731{
 732    BDRVQcow2State *s = bs->opaque;
 733    Qcow2DiscardRegion *d, *next;
 734
 735    QTAILQ_FOREACH_SAFE(d, &s->discards, next, next) {
 736        QTAILQ_REMOVE(&s->discards, d, next);
 737
 738        /* Discard is optional, ignore the return value */
 739        if (ret >= 0) {
 740            int r2 = bdrv_pdiscard(bs->file, d->offset, d->bytes);
 741            if (r2 < 0) {
 742                trace_qcow2_process_discards_failed_region(d->offset, d->bytes,
 743                                                           r2);
 744            }
 745        }
 746
 747        g_free(d);
 748    }
 749}
 750
 751static void update_refcount_discard(BlockDriverState *bs,
 752                                    uint64_t offset, uint64_t length)
 753{
 754    BDRVQcow2State *s = bs->opaque;
 755    Qcow2DiscardRegion *d, *p, *next;
 756
 757    QTAILQ_FOREACH(d, &s->discards, next) {
 758        uint64_t new_start = MIN(offset, d->offset);
 759        uint64_t new_end = MAX(offset + length, d->offset + d->bytes);
 760
 761        if (new_end - new_start <= length + d->bytes) {
 762            /* There can't be any overlap, areas ending up here have no
 763             * references any more and therefore shouldn't get freed another
 764             * time. */
 765            assert(d->bytes + length == new_end - new_start);
 766            d->offset = new_start;
 767            d->bytes = new_end - new_start;
 768            goto found;
 769        }
 770    }
 771
 772    d = g_malloc(sizeof(*d));
 773    *d = (Qcow2DiscardRegion) {
 774        .bs     = bs,
 775        .offset = offset,
 776        .bytes  = length,
 777    };
 778    QTAILQ_INSERT_TAIL(&s->discards, d, next);
 779
 780found:
 781    /* Merge discard requests if they are adjacent now */
 782    QTAILQ_FOREACH_SAFE(p, &s->discards, next, next) {
 783        if (p == d
 784            || p->offset > d->offset + d->bytes
 785            || d->offset > p->offset + p->bytes)
 786        {
 787            continue;
 788        }
 789
 790        /* Still no overlap possible */
 791        assert(p->offset == d->offset + d->bytes
 792            || d->offset == p->offset + p->bytes);
 793
 794        QTAILQ_REMOVE(&s->discards, p, next);
 795        d->offset = MIN(d->offset, p->offset);
 796        d->bytes += p->bytes;
 797        g_free(p);
 798    }
 799}
 800
 801/* XXX: cache several refcount block clusters ? */
 802/* @addend is the absolute value of the addend; if @decrease is set, @addend
 803 * will be subtracted from the current refcount, otherwise it will be added */
 804static int QEMU_WARN_UNUSED_RESULT update_refcount(BlockDriverState *bs,
 805                                                   int64_t offset,
 806                                                   int64_t length,
 807                                                   uint64_t addend,
 808                                                   bool decrease,
 809                                                   enum qcow2_discard_type type)
 810{
 811    BDRVQcow2State *s = bs->opaque;
 812    int64_t start, last, cluster_offset;
 813    void *refcount_block = NULL;
 814    int64_t old_table_index = -1;
 815    int ret;
 816
 817#ifdef DEBUG_ALLOC2
 818    fprintf(stderr, "update_refcount: offset=%" PRId64 " size=%" PRId64
 819            " addend=%s%" PRIu64 "\n", offset, length, decrease ? "-" : "",
 820            addend);
 821#endif
 822    if (length < 0) {
 823        return -EINVAL;
 824    } else if (length == 0) {
 825        return 0;
 826    }
 827
 828    if (decrease) {
 829        qcow2_cache_set_dependency(bs, s->refcount_block_cache,
 830            s->l2_table_cache);
 831    }
 832
 833    start = start_of_cluster(s, offset);
 834    last = start_of_cluster(s, offset + length - 1);
 835    for(cluster_offset = start; cluster_offset <= last;
 836        cluster_offset += s->cluster_size)
 837    {
 838        int block_index;
 839        uint64_t refcount;
 840        int64_t cluster_index = cluster_offset >> s->cluster_bits;
 841        int64_t table_index = cluster_index >> s->refcount_block_bits;
 842
 843        /* Load the refcount block and allocate it if needed */
 844        if (table_index != old_table_index) {
 845            if (refcount_block) {
 846                qcow2_cache_put(s->refcount_block_cache, &refcount_block);
 847            }
 848            ret = alloc_refcount_block(bs, cluster_index, &refcount_block);
 849            /* If the caller needs to restart the search for free clusters,
 850             * try the same ones first to see if they're still free. */
 851            if (ret == -EAGAIN) {
 852                if (s->free_cluster_index > (start >> s->cluster_bits)) {
 853                    s->free_cluster_index = (start >> s->cluster_bits);
 854                }
 855            }
 856            if (ret < 0) {
 857                goto fail;
 858            }
 859        }
 860        old_table_index = table_index;
 861
 862        qcow2_cache_entry_mark_dirty(s->refcount_block_cache, refcount_block);
 863
 864        /* we can update the count and save it */
 865        block_index = cluster_index & (s->refcount_block_size - 1);
 866
 867        refcount = s->get_refcount(refcount_block, block_index);
 868        if (decrease ? (refcount - addend > refcount)
 869                     : (refcount + addend < refcount ||
 870                        refcount + addend > s->refcount_max))
 871        {
 872            ret = -EINVAL;
 873            goto fail;
 874        }
 875        if (decrease) {
 876            refcount -= addend;
 877        } else {
 878            refcount += addend;
 879        }
 880        if (refcount == 0 && cluster_index < s->free_cluster_index) {
 881            s->free_cluster_index = cluster_index;
 882        }
 883        s->set_refcount(refcount_block, block_index, refcount);
 884
 885        if (refcount == 0) {
 886            void *table;
 887
 888            table = qcow2_cache_is_table_offset(s->refcount_block_cache,
 889                                                offset);
 890            if (table != NULL) {
 891                qcow2_cache_put(s->refcount_block_cache, &refcount_block);
 892                old_table_index = -1;
 893                qcow2_cache_discard(s->refcount_block_cache, table);
 894            }
 895
 896            table = qcow2_cache_is_table_offset(s->l2_table_cache, offset);
 897            if (table != NULL) {
 898                qcow2_cache_discard(s->l2_table_cache, table);
 899            }
 900
 901            if (s->discard_passthrough[type]) {
 902                update_refcount_discard(bs, cluster_offset, s->cluster_size);
 903            }
 904        }
 905    }
 906
 907    ret = 0;
 908fail:
 909    if (!s->cache_discards) {
 910        qcow2_process_discards(bs, ret);
 911    }
 912
 913    /* Write last changed block to disk */
 914    if (refcount_block) {
 915        qcow2_cache_put(s->refcount_block_cache, &refcount_block);
 916    }
 917
 918    /*
 919     * Try do undo any updates if an error is returned (This may succeed in
 920     * some cases like ENOSPC for allocating a new refcount block)
 921     */
 922    if (ret < 0) {
 923        int dummy;
 924        dummy = update_refcount(bs, offset, cluster_offset - offset, addend,
 925                                !decrease, QCOW2_DISCARD_NEVER);
 926        (void)dummy;
 927    }
 928
 929    return ret;
 930}
 931
 932/*
 933 * Increases or decreases the refcount of a given cluster.
 934 *
 935 * @addend is the absolute value of the addend; if @decrease is set, @addend
 936 * will be subtracted from the current refcount, otherwise it will be added.
 937 *
 938 * On success 0 is returned; on failure -errno is returned.
 939 */
 940int qcow2_update_cluster_refcount(BlockDriverState *bs,
 941                                  int64_t cluster_index,
 942                                  uint64_t addend, bool decrease,
 943                                  enum qcow2_discard_type type)
 944{
 945    BDRVQcow2State *s = bs->opaque;
 946    int ret;
 947
 948    ret = update_refcount(bs, cluster_index << s->cluster_bits, 1, addend,
 949                          decrease, type);
 950    if (ret < 0) {
 951        return ret;
 952    }
 953
 954    return 0;
 955}
 956
 957
 958
 959/*********************************************************/
 960/* cluster allocation functions */
 961
 962
 963
 964/* return < 0 if error */
 965static int64_t alloc_clusters_noref(BlockDriverState *bs, uint64_t size,
 966                                    uint64_t max)
 967{
 968    BDRVQcow2State *s = bs->opaque;
 969    uint64_t i, nb_clusters, refcount;
 970    int ret;
 971
 972    /* We can't allocate clusters if they may still be queued for discard. */
 973    if (s->cache_discards) {
 974        qcow2_process_discards(bs, 0);
 975    }
 976
 977    nb_clusters = size_to_clusters(s, size);
 978retry:
 979    for(i = 0; i < nb_clusters; i++) {
 980        uint64_t next_cluster_index = s->free_cluster_index++;
 981        ret = qcow2_get_refcount(bs, next_cluster_index, &refcount);
 982
 983        if (ret < 0) {
 984            return ret;
 985        } else if (refcount != 0) {
 986            goto retry;
 987        }
 988    }
 989
 990    /* Make sure that all offsets in the "allocated" range are representable
 991     * in the requested max */
 992    if (s->free_cluster_index > 0 &&
 993        s->free_cluster_index - 1 > (max >> s->cluster_bits))
 994    {
 995        return -EFBIG;
 996    }
 997
 998#ifdef DEBUG_ALLOC2
 999    fprintf(stderr, "alloc_clusters: size=%" PRId64 " -> %" PRId64 "\n",
1000            size,
1001            (s->free_cluster_index - nb_clusters) << s->cluster_bits);
1002#endif
1003    return (s->free_cluster_index - nb_clusters) << s->cluster_bits;
1004}
1005
1006int64_t qcow2_alloc_clusters(BlockDriverState *bs, uint64_t size)
1007{
1008    int64_t offset;
1009    int ret;
1010
1011    BLKDBG_EVENT(bs->file, BLKDBG_CLUSTER_ALLOC);
1012    do {
1013        offset = alloc_clusters_noref(bs, size, QCOW_MAX_CLUSTER_OFFSET);
1014        if (offset < 0) {
1015            return offset;
1016        }
1017
1018        ret = update_refcount(bs, offset, size, 1, false, QCOW2_DISCARD_NEVER);
1019    } while (ret == -EAGAIN);
1020
1021    if (ret < 0) {
1022        return ret;
1023    }
1024
1025    return offset;
1026}
1027
1028int64_t qcow2_alloc_clusters_at(BlockDriverState *bs, uint64_t offset,
1029                                int64_t nb_clusters)
1030{
1031    BDRVQcow2State *s = bs->opaque;
1032    uint64_t cluster_index, refcount;
1033    uint64_t i;
1034    int ret;
1035
1036    assert(nb_clusters >= 0);
1037    if (nb_clusters == 0) {
1038        return 0;
1039    }
1040
1041    do {
1042        /* Check how many clusters there are free */
1043        cluster_index = offset >> s->cluster_bits;
1044        for(i = 0; i < nb_clusters; i++) {
1045            ret = qcow2_get_refcount(bs, cluster_index++, &refcount);
1046            if (ret < 0) {
1047                return ret;
1048            } else if (refcount != 0) {
1049                break;
1050            }
1051        }
1052
1053        /* And then allocate them */
1054        ret = update_refcount(bs, offset, i << s->cluster_bits, 1, false,
1055                              QCOW2_DISCARD_NEVER);
1056    } while (ret == -EAGAIN);
1057
1058    if (ret < 0) {
1059        return ret;
1060    }
1061
1062    return i;
1063}
1064
1065/* only used to allocate compressed sectors. We try to allocate
1066   contiguous sectors. size must be <= cluster_size */
1067int64_t qcow2_alloc_bytes(BlockDriverState *bs, int size)
1068{
1069    BDRVQcow2State *s = bs->opaque;
1070    int64_t offset;
1071    size_t free_in_cluster;
1072    int ret;
1073
1074    BLKDBG_EVENT(bs->file, BLKDBG_CLUSTER_ALLOC_BYTES);
1075    assert(size > 0 && size <= s->cluster_size);
1076    assert(!s->free_byte_offset || offset_into_cluster(s, s->free_byte_offset));
1077
1078    offset = s->free_byte_offset;
1079
1080    if (offset) {
1081        uint64_t refcount;
1082        ret = qcow2_get_refcount(bs, offset >> s->cluster_bits, &refcount);
1083        if (ret < 0) {
1084            return ret;
1085        }
1086
1087        if (refcount == s->refcount_max) {
1088            offset = 0;
1089        }
1090    }
1091
1092    free_in_cluster = s->cluster_size - offset_into_cluster(s, offset);
1093    do {
1094        if (!offset || free_in_cluster < size) {
1095            int64_t new_cluster;
1096
1097            new_cluster = alloc_clusters_noref(bs, s->cluster_size,
1098                                               MIN(s->cluster_offset_mask,
1099                                                   QCOW_MAX_CLUSTER_OFFSET));
1100            if (new_cluster < 0) {
1101                return new_cluster;
1102            }
1103
1104            if (new_cluster == 0) {
1105                qcow2_signal_corruption(bs, true, -1, -1, "Preventing invalid "
1106                                        "allocation of compressed cluster "
1107                                        "at offset 0");
1108                return -EIO;
1109            }
1110
1111            if (!offset || ROUND_UP(offset, s->cluster_size) != new_cluster) {
1112                offset = new_cluster;
1113                free_in_cluster = s->cluster_size;
1114            } else {
1115                free_in_cluster += s->cluster_size;
1116            }
1117        }
1118
1119        assert(offset);
1120        ret = update_refcount(bs, offset, size, 1, false, QCOW2_DISCARD_NEVER);
1121        if (ret < 0) {
1122            offset = 0;
1123        }
1124    } while (ret == -EAGAIN);
1125    if (ret < 0) {
1126        return ret;
1127    }
1128
1129    /* The cluster refcount was incremented; refcount blocks must be flushed
1130     * before the caller's L2 table updates. */
1131    qcow2_cache_set_dependency(bs, s->l2_table_cache, s->refcount_block_cache);
1132
1133    s->free_byte_offset = offset + size;
1134    if (!offset_into_cluster(s, s->free_byte_offset)) {
1135        s->free_byte_offset = 0;
1136    }
1137
1138    return offset;
1139}
1140
1141void qcow2_free_clusters(BlockDriverState *bs,
1142                          int64_t offset, int64_t size,
1143                          enum qcow2_discard_type type)
1144{
1145    int ret;
1146
1147    BLKDBG_EVENT(bs->file, BLKDBG_CLUSTER_FREE);
1148    ret = update_refcount(bs, offset, size, 1, true, type);
1149    if (ret < 0) {
1150        fprintf(stderr, "qcow2_free_clusters failed: %s\n", strerror(-ret));
1151        /* TODO Remember the clusters to free them later and avoid leaking */
1152    }
1153}
1154
1155/*
1156 * Free a cluster using its L2 entry (handles clusters of all types, e.g.
1157 * normal cluster, compressed cluster, etc.)
1158 */
1159void qcow2_free_any_clusters(BlockDriverState *bs, uint64_t l2_entry,
1160                             int nb_clusters, enum qcow2_discard_type type)
1161{
1162    BDRVQcow2State *s = bs->opaque;
1163    QCow2ClusterType ctype = qcow2_get_cluster_type(bs, l2_entry);
1164
1165    if (has_data_file(bs)) {
1166        if (s->discard_passthrough[type] &&
1167            (ctype == QCOW2_CLUSTER_NORMAL ||
1168             ctype == QCOW2_CLUSTER_ZERO_ALLOC))
1169        {
1170            bdrv_pdiscard(s->data_file, l2_entry & L2E_OFFSET_MASK,
1171                          nb_clusters << s->cluster_bits);
1172        }
1173        return;
1174    }
1175
1176    switch (ctype) {
1177    case QCOW2_CLUSTER_COMPRESSED:
1178        {
1179            int64_t offset = (l2_entry & s->cluster_offset_mask)
1180                & QCOW2_COMPRESSED_SECTOR_MASK;
1181            int size = QCOW2_COMPRESSED_SECTOR_SIZE *
1182                (((l2_entry >> s->csize_shift) & s->csize_mask) + 1);
1183            qcow2_free_clusters(bs, offset, size, type);
1184        }
1185        break;
1186    case QCOW2_CLUSTER_NORMAL:
1187    case QCOW2_CLUSTER_ZERO_ALLOC:
1188        if (offset_into_cluster(s, l2_entry & L2E_OFFSET_MASK)) {
1189            qcow2_signal_corruption(bs, false, -1, -1,
1190                                    "Cannot free unaligned cluster %#llx",
1191                                    l2_entry & L2E_OFFSET_MASK);
1192        } else {
1193            qcow2_free_clusters(bs, l2_entry & L2E_OFFSET_MASK,
1194                                nb_clusters << s->cluster_bits, type);
1195        }
1196        break;
1197    case QCOW2_CLUSTER_ZERO_PLAIN:
1198    case QCOW2_CLUSTER_UNALLOCATED:
1199        break;
1200    default:
1201        abort();
1202    }
1203}
1204
1205int coroutine_fn qcow2_write_caches(BlockDriverState *bs)
1206{
1207    BDRVQcow2State *s = bs->opaque;
1208    int ret;
1209
1210    ret = qcow2_cache_write(bs, s->l2_table_cache);
1211    if (ret < 0) {
1212        return ret;
1213    }
1214
1215    if (qcow2_need_accurate_refcounts(s)) {
1216        ret = qcow2_cache_write(bs, s->refcount_block_cache);
1217        if (ret < 0) {
1218            return ret;
1219        }
1220    }
1221
1222    return 0;
1223}
1224
1225int coroutine_fn qcow2_flush_caches(BlockDriverState *bs)
1226{
1227    int ret = qcow2_write_caches(bs);
1228    if (ret < 0) {
1229        return ret;
1230    }
1231
1232    return bdrv_flush(bs->file->bs);
1233}
1234
1235/*********************************************************/
1236/* snapshots and image creation */
1237
1238
1239
1240/* update the refcounts of snapshots and the copied flag */
1241int qcow2_update_snapshot_refcount(BlockDriverState *bs,
1242    int64_t l1_table_offset, int l1_size, int addend)
1243{
1244    BDRVQcow2State *s = bs->opaque;
1245    uint64_t *l1_table, *l2_slice, l2_offset, entry, l1_size2, refcount;
1246    bool l1_allocated = false;
1247    int64_t old_entry, old_l2_offset;
1248    unsigned slice, slice_size2, n_slices;
1249    int i, j, l1_modified = 0, nb_csectors;
1250    int ret;
1251
1252    assert(addend >= -1 && addend <= 1);
1253
1254    l2_slice = NULL;
1255    l1_table = NULL;
1256    l1_size2 = l1_size * sizeof(uint64_t);
1257    slice_size2 = s->l2_slice_size * sizeof(uint64_t);
1258    n_slices = s->cluster_size / slice_size2;
1259
1260    s->cache_discards = true;
1261
1262    /* WARNING: qcow2_snapshot_goto relies on this function not using the
1263     * l1_table_offset when it is the current s->l1_table_offset! Be careful
1264     * when changing this! */
1265    if (l1_table_offset != s->l1_table_offset) {
1266        l1_table = g_try_malloc0(l1_size2);
1267        if (l1_size2 && l1_table == NULL) {
1268            ret = -ENOMEM;
1269            goto fail;
1270        }
1271        l1_allocated = true;
1272
1273        ret = bdrv_pread(bs->file, l1_table_offset, l1_table, l1_size2);
1274        if (ret < 0) {
1275            goto fail;
1276        }
1277
1278        for (i = 0; i < l1_size; i++) {
1279            be64_to_cpus(&l1_table[i]);
1280        }
1281    } else {
1282        assert(l1_size == s->l1_size);
1283        l1_table = s->l1_table;
1284        l1_allocated = false;
1285    }
1286
1287    for (i = 0; i < l1_size; i++) {
1288        l2_offset = l1_table[i];
1289        if (l2_offset) {
1290            old_l2_offset = l2_offset;
1291            l2_offset &= L1E_OFFSET_MASK;
1292
1293            if (offset_into_cluster(s, l2_offset)) {
1294                qcow2_signal_corruption(bs, true, -1, -1, "L2 table offset %#"
1295                                        PRIx64 " unaligned (L1 index: %#x)",
1296                                        l2_offset, i);
1297                ret = -EIO;
1298                goto fail;
1299            }
1300
1301            for (slice = 0; slice < n_slices; slice++) {
1302                ret = qcow2_cache_get(bs, s->l2_table_cache,
1303                                      l2_offset + slice * slice_size2,
1304                                      (void **) &l2_slice);
1305                if (ret < 0) {
1306                    goto fail;
1307                }
1308
1309                for (j = 0; j < s->l2_slice_size; j++) {
1310                    uint64_t cluster_index;
1311                    uint64_t offset;
1312
1313                    entry = be64_to_cpu(l2_slice[j]);
1314                    old_entry = entry;
1315                    entry &= ~QCOW_OFLAG_COPIED;
1316                    offset = entry & L2E_OFFSET_MASK;
1317
1318                    switch (qcow2_get_cluster_type(bs, entry)) {
1319                    case QCOW2_CLUSTER_COMPRESSED:
1320                        nb_csectors = ((entry >> s->csize_shift) &
1321                                       s->csize_mask) + 1;
1322                        if (addend != 0) {
1323                            uint64_t coffset = (entry & s->cluster_offset_mask)
1324                                & QCOW2_COMPRESSED_SECTOR_MASK;
1325                            ret = update_refcount(
1326                                bs, coffset,
1327                                nb_csectors * QCOW2_COMPRESSED_SECTOR_SIZE,
1328                                abs(addend), addend < 0,
1329                                QCOW2_DISCARD_SNAPSHOT);
1330                            if (ret < 0) {
1331                                goto fail;
1332                            }
1333                        }
1334                        /* compressed clusters are never modified */
1335                        refcount = 2;
1336                        break;
1337
1338                    case QCOW2_CLUSTER_NORMAL:
1339                    case QCOW2_CLUSTER_ZERO_ALLOC:
1340                        if (offset_into_cluster(s, offset)) {
1341                            /* Here l2_index means table (not slice) index */
1342                            int l2_index = slice * s->l2_slice_size + j;
1343                            qcow2_signal_corruption(
1344                                bs, true, -1, -1, "Cluster "
1345                                "allocation offset %#" PRIx64
1346                                " unaligned (L2 offset: %#"
1347                                PRIx64 ", L2 index: %#x)",
1348                                offset, l2_offset, l2_index);
1349                            ret = -EIO;
1350                            goto fail;
1351                        }
1352
1353                        cluster_index = offset >> s->cluster_bits;
1354                        assert(cluster_index);
1355                        if (addend != 0) {
1356                            ret = qcow2_update_cluster_refcount(
1357                                bs, cluster_index, abs(addend), addend < 0,
1358                                QCOW2_DISCARD_SNAPSHOT);
1359                            if (ret < 0) {
1360                                goto fail;
1361                            }
1362                        }
1363
1364                        ret = qcow2_get_refcount(bs, cluster_index, &refcount);
1365                        if (ret < 0) {
1366                            goto fail;
1367                        }
1368                        break;
1369
1370                    case QCOW2_CLUSTER_ZERO_PLAIN:
1371                    case QCOW2_CLUSTER_UNALLOCATED:
1372                        refcount = 0;
1373                        break;
1374
1375                    default:
1376                        abort();
1377                    }
1378
1379                    if (refcount == 1) {
1380                        entry |= QCOW_OFLAG_COPIED;
1381                    }
1382                    if (entry != old_entry) {
1383                        if (addend > 0) {
1384                            qcow2_cache_set_dependency(bs, s->l2_table_cache,
1385                                                       s->refcount_block_cache);
1386                        }
1387                        l2_slice[j] = cpu_to_be64(entry);
1388                        qcow2_cache_entry_mark_dirty(s->l2_table_cache,
1389                                                     l2_slice);
1390                    }
1391                }
1392
1393                qcow2_cache_put(s->l2_table_cache, (void **) &l2_slice);
1394            }
1395
1396            if (addend != 0) {
1397                ret = qcow2_update_cluster_refcount(bs, l2_offset >>
1398                                                        s->cluster_bits,
1399                                                    abs(addend), addend < 0,
1400                                                    QCOW2_DISCARD_SNAPSHOT);
1401                if (ret < 0) {
1402                    goto fail;
1403                }
1404            }
1405            ret = qcow2_get_refcount(bs, l2_offset >> s->cluster_bits,
1406                                     &refcount);
1407            if (ret < 0) {
1408                goto fail;
1409            } else if (refcount == 1) {
1410                l2_offset |= QCOW_OFLAG_COPIED;
1411            }
1412            if (l2_offset != old_l2_offset) {
1413                l1_table[i] = l2_offset;
1414                l1_modified = 1;
1415            }
1416        }
1417    }
1418
1419    ret = bdrv_flush(bs);
1420fail:
1421    if (l2_slice) {
1422        qcow2_cache_put(s->l2_table_cache, (void **) &l2_slice);
1423    }
1424
1425    s->cache_discards = false;
1426    qcow2_process_discards(bs, ret);
1427
1428    /* Update L1 only if it isn't deleted anyway (addend = -1) */
1429    if (ret == 0 && addend >= 0 && l1_modified) {
1430        for (i = 0; i < l1_size; i++) {
1431            cpu_to_be64s(&l1_table[i]);
1432        }
1433
1434        ret = bdrv_pwrite_sync(bs->file, l1_table_offset,
1435                               l1_table, l1_size2);
1436
1437        for (i = 0; i < l1_size; i++) {
1438            be64_to_cpus(&l1_table[i]);
1439        }
1440    }
1441    if (l1_allocated)
1442        g_free(l1_table);
1443    return ret;
1444}
1445
1446
1447
1448
1449/*********************************************************/
1450/* refcount checking functions */
1451
1452
1453static uint64_t refcount_array_byte_size(BDRVQcow2State *s, uint64_t entries)
1454{
1455    /* This assertion holds because there is no way we can address more than
1456     * 2^(64 - 9) clusters at once (with cluster size 512 = 2^9, and because
1457     * offsets have to be representable in bytes); due to every cluster
1458     * corresponding to one refcount entry, we are well below that limit */
1459    assert(entries < (UINT64_C(1) << (64 - 9)));
1460
1461    /* Thanks to the assertion this will not overflow, because
1462     * s->refcount_order < 7.
1463     * (note: x << s->refcount_order == x * s->refcount_bits) */
1464    return DIV_ROUND_UP(entries << s->refcount_order, 8);
1465}
1466
1467/**
1468 * Reallocates *array so that it can hold new_size entries. *size must contain
1469 * the current number of entries in *array. If the reallocation fails, *array
1470 * and *size will not be modified and -errno will be returned. If the
1471 * reallocation is successful, *array will be set to the new buffer, *size
1472 * will be set to new_size and 0 will be returned. The size of the reallocated
1473 * refcount array buffer will be aligned to a cluster boundary, and the newly
1474 * allocated area will be zeroed.
1475 */
1476static int realloc_refcount_array(BDRVQcow2State *s, void **array,
1477                                  int64_t *size, int64_t new_size)
1478{
1479    int64_t old_byte_size, new_byte_size;
1480    void *new_ptr;
1481
1482    /* Round to clusters so the array can be directly written to disk */
1483    old_byte_size = size_to_clusters(s, refcount_array_byte_size(s, *size))
1484                    * s->cluster_size;
1485    new_byte_size = size_to_clusters(s, refcount_array_byte_size(s, new_size))
1486                    * s->cluster_size;
1487
1488    if (new_byte_size == old_byte_size) {
1489        *size = new_size;
1490        return 0;
1491    }
1492
1493    assert(new_byte_size > 0);
1494
1495    if (new_byte_size > SIZE_MAX) {
1496        return -ENOMEM;
1497    }
1498
1499    new_ptr = g_try_realloc(*array, new_byte_size);
1500    if (!new_ptr) {
1501        return -ENOMEM;
1502    }
1503
1504    if (new_byte_size > old_byte_size) {
1505        memset((char *)new_ptr + old_byte_size, 0,
1506               new_byte_size - old_byte_size);
1507    }
1508
1509    *array = new_ptr;
1510    *size  = new_size;
1511
1512    return 0;
1513}
1514
1515/*
1516 * Increases the refcount for a range of clusters in a given refcount table.
1517 * This is used to construct a temporary refcount table out of L1 and L2 tables
1518 * which can be compared to the refcount table saved in the image.
1519 *
1520 * Modifies the number of errors in res.
1521 */
1522int qcow2_inc_refcounts_imrt(BlockDriverState *bs, BdrvCheckResult *res,
1523                             void **refcount_table,
1524                             int64_t *refcount_table_size,
1525                             int64_t offset, int64_t size)
1526{
1527    BDRVQcow2State *s = bs->opaque;
1528    uint64_t start, last, cluster_offset, k, refcount;
1529    int64_t file_len;
1530    int ret;
1531
1532    if (size <= 0) {
1533        return 0;
1534    }
1535
1536    file_len = bdrv_getlength(bs->file->bs);
1537    if (file_len < 0) {
1538        return file_len;
1539    }
1540
1541    /*
1542     * Last cluster of qcow2 image may be semi-allocated, so it may be OK to
1543     * reference some space after file end but it should be less than one
1544     * cluster.
1545     */
1546    if (offset + size - file_len >= s->cluster_size) {
1547        fprintf(stderr, "ERROR: counting reference for region exceeding the "
1548                "end of the file by one cluster or more: offset 0x%" PRIx64
1549                " size 0x%" PRIx64 "\n", offset, size);
1550        res->corruptions++;
1551        return 0;
1552    }
1553
1554    start = start_of_cluster(s, offset);
1555    last = start_of_cluster(s, offset + size - 1);
1556    for(cluster_offset = start; cluster_offset <= last;
1557        cluster_offset += s->cluster_size) {
1558        k = cluster_offset >> s->cluster_bits;
1559        if (k >= *refcount_table_size) {
1560            ret = realloc_refcount_array(s, refcount_table,
1561                                         refcount_table_size, k + 1);
1562            if (ret < 0) {
1563                res->check_errors++;
1564                return ret;
1565            }
1566        }
1567
1568        refcount = s->get_refcount(*refcount_table, k);
1569        if (refcount == s->refcount_max) {
1570            fprintf(stderr, "ERROR: overflow cluster offset=0x%" PRIx64
1571                    "\n", cluster_offset);
1572            fprintf(stderr, "Use qemu-img amend to increase the refcount entry "
1573                    "width or qemu-img convert to create a clean copy if the "
1574                    "image cannot be opened for writing\n");
1575            res->corruptions++;
1576            continue;
1577        }
1578        s->set_refcount(*refcount_table, k, refcount + 1);
1579    }
1580
1581    return 0;
1582}
1583
1584/* Flags for check_refcounts_l1() and check_refcounts_l2() */
1585enum {
1586    CHECK_FRAG_INFO = 0x2,      /* update BlockFragInfo counters */
1587};
1588
1589/*
1590 * Increases the refcount in the given refcount table for the all clusters
1591 * referenced in the L2 table. While doing so, performs some checks on L2
1592 * entries.
1593 *
1594 * Returns the number of errors found by the checks or -errno if an internal
1595 * error occurred.
1596 */
1597static int check_refcounts_l2(BlockDriverState *bs, BdrvCheckResult *res,
1598                              void **refcount_table,
1599                              int64_t *refcount_table_size, int64_t l2_offset,
1600                              int flags, BdrvCheckMode fix, bool active)
1601{
1602    BDRVQcow2State *s = bs->opaque;
1603    uint64_t *l2_table, l2_entry;
1604    uint64_t next_contiguous_offset = 0;
1605    int i, l2_size, nb_csectors, ret;
1606
1607    /* Read L2 table from disk */
1608    l2_size = s->l2_size * sizeof(uint64_t);
1609    l2_table = g_malloc(l2_size);
1610
1611    ret = bdrv_pread(bs->file, l2_offset, l2_table, l2_size);
1612    if (ret < 0) {
1613        fprintf(stderr, "ERROR: I/O error in check_refcounts_l2\n");
1614        res->check_errors++;
1615        goto fail;
1616    }
1617
1618    /* Do the actual checks */
1619    for(i = 0; i < s->l2_size; i++) {
1620        l2_entry = be64_to_cpu(l2_table[i]);
1621
1622        switch (qcow2_get_cluster_type(bs, l2_entry)) {
1623        case QCOW2_CLUSTER_COMPRESSED:
1624            /* Compressed clusters don't have QCOW_OFLAG_COPIED */
1625            if (l2_entry & QCOW_OFLAG_COPIED) {
1626                fprintf(stderr, "ERROR: coffset=0x%" PRIx64 ": "
1627                    "copied flag must never be set for compressed "
1628                    "clusters\n", l2_entry & s->cluster_offset_mask);
1629                l2_entry &= ~QCOW_OFLAG_COPIED;
1630                res->corruptions++;
1631            }
1632
1633            if (has_data_file(bs)) {
1634                fprintf(stderr, "ERROR compressed cluster %d with data file, "
1635                        "entry=0x%" PRIx64 "\n", i, l2_entry);
1636                res->corruptions++;
1637                break;
1638            }
1639
1640            /* Mark cluster as used */
1641            nb_csectors = ((l2_entry >> s->csize_shift) &
1642                           s->csize_mask) + 1;
1643            l2_entry &= s->cluster_offset_mask;
1644            ret = qcow2_inc_refcounts_imrt(
1645                bs, res, refcount_table, refcount_table_size,
1646                l2_entry & QCOW2_COMPRESSED_SECTOR_MASK,
1647                nb_csectors * QCOW2_COMPRESSED_SECTOR_SIZE);
1648            if (ret < 0) {
1649                goto fail;
1650            }
1651
1652            if (flags & CHECK_FRAG_INFO) {
1653                res->bfi.allocated_clusters++;
1654                res->bfi.compressed_clusters++;
1655
1656                /* Compressed clusters are fragmented by nature.  Since they
1657                 * take up sub-sector space but we only have sector granularity
1658                 * I/O we need to re-read the same sectors even for adjacent
1659                 * compressed clusters.
1660                 */
1661                res->bfi.fragmented_clusters++;
1662            }
1663            break;
1664
1665        case QCOW2_CLUSTER_ZERO_ALLOC:
1666        case QCOW2_CLUSTER_NORMAL:
1667        {
1668            uint64_t offset = l2_entry & L2E_OFFSET_MASK;
1669
1670            /* Correct offsets are cluster aligned */
1671            if (offset_into_cluster(s, offset)) {
1672                res->corruptions++;
1673
1674                if (qcow2_get_cluster_type(bs, l2_entry) ==
1675                    QCOW2_CLUSTER_ZERO_ALLOC)
1676                {
1677                    fprintf(stderr, "%s offset=%" PRIx64 ": Preallocated zero "
1678                            "cluster is not properly aligned; L2 entry "
1679                            "corrupted.\n",
1680                            fix & BDRV_FIX_ERRORS ? "Repairing" : "ERROR",
1681                            offset);
1682                    if (fix & BDRV_FIX_ERRORS) {
1683                        uint64_t l2e_offset =
1684                            l2_offset + (uint64_t)i * sizeof(uint64_t);
1685                        int ign = active ? QCOW2_OL_ACTIVE_L2 :
1686                                           QCOW2_OL_INACTIVE_L2;
1687
1688                        l2_entry = QCOW_OFLAG_ZERO;
1689                        l2_table[i] = cpu_to_be64(l2_entry);
1690                        ret = qcow2_pre_write_overlap_check(bs, ign,
1691                                l2e_offset, sizeof(uint64_t), false);
1692                        if (ret < 0) {
1693                            fprintf(stderr, "ERROR: Overlap check failed\n");
1694                            res->check_errors++;
1695                            /* Something is seriously wrong, so abort checking
1696                             * this L2 table */
1697                            goto fail;
1698                        }
1699
1700                        ret = bdrv_pwrite_sync(bs->file, l2e_offset,
1701                                               &l2_table[i], sizeof(uint64_t));
1702                        if (ret < 0) {
1703                            fprintf(stderr, "ERROR: Failed to overwrite L2 "
1704                                    "table entry: %s\n", strerror(-ret));
1705                            res->check_errors++;
1706                            /* Do not abort, continue checking the rest of this
1707                             * L2 table's entries */
1708                        } else {
1709                            res->corruptions--;
1710                            res->corruptions_fixed++;
1711                            /* Skip marking the cluster as used
1712                             * (it is unused now) */
1713                            continue;
1714                        }
1715                    }
1716                } else {
1717                    fprintf(stderr, "ERROR offset=%" PRIx64 ": Data cluster is "
1718                        "not properly aligned; L2 entry corrupted.\n", offset);
1719                }
1720            }
1721
1722            if (flags & CHECK_FRAG_INFO) {
1723                res->bfi.allocated_clusters++;
1724                if (next_contiguous_offset &&
1725                    offset != next_contiguous_offset) {
1726                    res->bfi.fragmented_clusters++;
1727                }
1728                next_contiguous_offset = offset + s->cluster_size;
1729            }
1730
1731            /* Mark cluster as used */
1732            if (!has_data_file(bs)) {
1733                ret = qcow2_inc_refcounts_imrt(bs, res, refcount_table,
1734                                               refcount_table_size,
1735                                               offset, s->cluster_size);
1736                if (ret < 0) {
1737                    goto fail;
1738                }
1739            }
1740            break;
1741        }
1742
1743        case QCOW2_CLUSTER_ZERO_PLAIN:
1744        case QCOW2_CLUSTER_UNALLOCATED:
1745            break;
1746
1747        default:
1748            abort();
1749        }
1750    }
1751
1752    g_free(l2_table);
1753    return 0;
1754
1755fail:
1756    g_free(l2_table);
1757    return ret;
1758}
1759
1760/*
1761 * Increases the refcount for the L1 table, its L2 tables and all referenced
1762 * clusters in the given refcount table. While doing so, performs some checks
1763 * on L1 and L2 entries.
1764 *
1765 * Returns the number of errors found by the checks or -errno if an internal
1766 * error occurred.
1767 */
1768static int check_refcounts_l1(BlockDriverState *bs,
1769                              BdrvCheckResult *res,
1770                              void **refcount_table,
1771                              int64_t *refcount_table_size,
1772                              int64_t l1_table_offset, int l1_size,
1773                              int flags, BdrvCheckMode fix, bool active)
1774{
1775    BDRVQcow2State *s = bs->opaque;
1776    uint64_t *l1_table = NULL, l2_offset, l1_size2;
1777    int i, ret;
1778
1779    l1_size2 = l1_size * sizeof(uint64_t);
1780
1781    /* Mark L1 table as used */
1782    ret = qcow2_inc_refcounts_imrt(bs, res, refcount_table, refcount_table_size,
1783                                   l1_table_offset, l1_size2);
1784    if (ret < 0) {
1785        goto fail;
1786    }
1787
1788    /* Read L1 table entries from disk */
1789    if (l1_size2 > 0) {
1790        l1_table = g_try_malloc(l1_size2);
1791        if (l1_table == NULL) {
1792            ret = -ENOMEM;
1793            res->check_errors++;
1794            goto fail;
1795        }
1796        ret = bdrv_pread(bs->file, l1_table_offset, l1_table, l1_size2);
1797        if (ret < 0) {
1798            fprintf(stderr, "ERROR: I/O error in check_refcounts_l1\n");
1799            res->check_errors++;
1800            goto fail;
1801        }
1802        for(i = 0;i < l1_size; i++)
1803            be64_to_cpus(&l1_table[i]);
1804    }
1805
1806    /* Do the actual checks */
1807    for(i = 0; i < l1_size; i++) {
1808        l2_offset = l1_table[i];
1809        if (l2_offset) {
1810            /* Mark L2 table as used */
1811            l2_offset &= L1E_OFFSET_MASK;
1812            ret = qcow2_inc_refcounts_imrt(bs, res,
1813                                           refcount_table, refcount_table_size,
1814                                           l2_offset, s->cluster_size);
1815            if (ret < 0) {
1816                goto fail;
1817            }
1818
1819            /* L2 tables are cluster aligned */
1820            if (offset_into_cluster(s, l2_offset)) {
1821                fprintf(stderr, "ERROR l2_offset=%" PRIx64 ": Table is not "
1822                    "cluster aligned; L1 entry corrupted\n", l2_offset);
1823                res->corruptions++;
1824            }
1825
1826            /* Process and check L2 entries */
1827            ret = check_refcounts_l2(bs, res, refcount_table,
1828                                     refcount_table_size, l2_offset, flags,
1829                                     fix, active);
1830            if (ret < 0) {
1831                goto fail;
1832            }
1833        }
1834    }
1835    g_free(l1_table);
1836    return 0;
1837
1838fail:
1839    g_free(l1_table);
1840    return ret;
1841}
1842
1843/*
1844 * Checks the OFLAG_COPIED flag for all L1 and L2 entries.
1845 *
1846 * This function does not print an error message nor does it increment
1847 * check_errors if qcow2_get_refcount fails (this is because such an error will
1848 * have been already detected and sufficiently signaled by the calling function
1849 * (qcow2_check_refcounts) by the time this function is called).
1850 */
1851static int check_oflag_copied(BlockDriverState *bs, BdrvCheckResult *res,
1852                              BdrvCheckMode fix)
1853{
1854    BDRVQcow2State *s = bs->opaque;
1855    uint64_t *l2_table = qemu_blockalign(bs, s->cluster_size);
1856    int ret;
1857    uint64_t refcount;
1858    int i, j;
1859    bool repair;
1860
1861    if (fix & BDRV_FIX_ERRORS) {
1862        /* Always repair */
1863        repair = true;
1864    } else if (fix & BDRV_FIX_LEAKS) {
1865        /* Repair only if that seems safe: This function is always
1866         * called after the refcounts have been fixed, so the refcount
1867         * is accurate if that repair was successful */
1868        repair = !res->check_errors && !res->corruptions && !res->leaks;
1869    } else {
1870        repair = false;
1871    }
1872
1873    for (i = 0; i < s->l1_size; i++) {
1874        uint64_t l1_entry = s->l1_table[i];
1875        uint64_t l2_offset = l1_entry & L1E_OFFSET_MASK;
1876        int l2_dirty = 0;
1877
1878        if (!l2_offset) {
1879            continue;
1880        }
1881
1882        ret = qcow2_get_refcount(bs, l2_offset >> s->cluster_bits,
1883                                 &refcount);
1884        if (ret < 0) {
1885            /* don't print message nor increment check_errors */
1886            continue;
1887        }
1888        if ((refcount == 1) != ((l1_entry & QCOW_OFLAG_COPIED) != 0)) {
1889            res->corruptions++;
1890            fprintf(stderr, "%s OFLAG_COPIED L2 cluster: l1_index=%d "
1891                    "l1_entry=%" PRIx64 " refcount=%" PRIu64 "\n",
1892                    repair ? "Repairing" : "ERROR", i, l1_entry, refcount);
1893            if (repair) {
1894                s->l1_table[i] = refcount == 1
1895                               ? l1_entry |  QCOW_OFLAG_COPIED
1896                               : l1_entry & ~QCOW_OFLAG_COPIED;
1897                ret = qcow2_write_l1_entry(bs, i);
1898                if (ret < 0) {
1899                    res->check_errors++;
1900                    goto fail;
1901                }
1902                res->corruptions--;
1903                res->corruptions_fixed++;
1904            }
1905        }
1906
1907        ret = bdrv_pread(bs->file, l2_offset, l2_table,
1908                         s->l2_size * sizeof(uint64_t));
1909        if (ret < 0) {
1910            fprintf(stderr, "ERROR: Could not read L2 table: %s\n",
1911                    strerror(-ret));
1912            res->check_errors++;
1913            goto fail;
1914        }
1915
1916        for (j = 0; j < s->l2_size; j++) {
1917            uint64_t l2_entry = be64_to_cpu(l2_table[j]);
1918            uint64_t data_offset = l2_entry & L2E_OFFSET_MASK;
1919            QCow2ClusterType cluster_type = qcow2_get_cluster_type(bs, l2_entry);
1920
1921            if (cluster_type == QCOW2_CLUSTER_NORMAL ||
1922                cluster_type == QCOW2_CLUSTER_ZERO_ALLOC) {
1923                if (has_data_file(bs)) {
1924                    refcount = 1;
1925                } else {
1926                    ret = qcow2_get_refcount(bs,
1927                                             data_offset >> s->cluster_bits,
1928                                             &refcount);
1929                    if (ret < 0) {
1930                        /* don't print message nor increment check_errors */
1931                        continue;
1932                    }
1933                }
1934                if ((refcount == 1) != ((l2_entry & QCOW_OFLAG_COPIED) != 0)) {
1935                    res->corruptions++;
1936                    fprintf(stderr, "%s OFLAG_COPIED data cluster: "
1937                            "l2_entry=%" PRIx64 " refcount=%" PRIu64 "\n",
1938                            repair ? "Repairing" : "ERROR", l2_entry, refcount);
1939                    if (repair) {
1940                        l2_table[j] = cpu_to_be64(refcount == 1
1941                                    ? l2_entry |  QCOW_OFLAG_COPIED
1942                                    : l2_entry & ~QCOW_OFLAG_COPIED);
1943                        l2_dirty++;
1944                    }
1945                }
1946            }
1947        }
1948
1949        if (l2_dirty > 0) {
1950            ret = qcow2_pre_write_overlap_check(bs, QCOW2_OL_ACTIVE_L2,
1951                                                l2_offset, s->cluster_size,
1952                                                false);
1953            if (ret < 0) {
1954                fprintf(stderr, "ERROR: Could not write L2 table; metadata "
1955                        "overlap check failed: %s\n", strerror(-ret));
1956                res->check_errors++;
1957                goto fail;
1958            }
1959
1960            ret = bdrv_pwrite(bs->file, l2_offset, l2_table,
1961                              s->cluster_size);
1962            if (ret < 0) {
1963                fprintf(stderr, "ERROR: Could not write L2 table: %s\n",
1964                        strerror(-ret));
1965                res->check_errors++;
1966                goto fail;
1967            }
1968            res->corruptions -= l2_dirty;
1969            res->corruptions_fixed += l2_dirty;
1970        }
1971    }
1972
1973    ret = 0;
1974
1975fail:
1976    qemu_vfree(l2_table);
1977    return ret;
1978}
1979
1980/*
1981 * Checks consistency of refblocks and accounts for each refblock in
1982 * *refcount_table.
1983 */
1984static int check_refblocks(BlockDriverState *bs, BdrvCheckResult *res,
1985                           BdrvCheckMode fix, bool *rebuild,
1986                           void **refcount_table, int64_t *nb_clusters)
1987{
1988    BDRVQcow2State *s = bs->opaque;
1989    int64_t i, size;
1990    int ret;
1991
1992    for(i = 0; i < s->refcount_table_size; i++) {
1993        uint64_t offset, cluster;
1994        offset = s->refcount_table[i];
1995        cluster = offset >> s->cluster_bits;
1996
1997        /* Refcount blocks are cluster aligned */
1998        if (offset_into_cluster(s, offset)) {
1999            fprintf(stderr, "ERROR refcount block %" PRId64 " is not "
2000                "cluster aligned; refcount table entry corrupted\n", i);
2001            res->corruptions++;
2002            *rebuild = true;
2003            continue;
2004        }
2005
2006        if (cluster >= *nb_clusters) {
2007            res->corruptions++;
2008            fprintf(stderr, "%s refcount block %" PRId64 " is outside image\n",
2009                    fix & BDRV_FIX_ERRORS ? "Repairing" : "ERROR", i);
2010
2011            if (fix & BDRV_FIX_ERRORS) {
2012                int64_t new_nb_clusters;
2013                Error *local_err = NULL;
2014
2015                if (offset > INT64_MAX - s->cluster_size) {
2016                    ret = -EINVAL;
2017                    goto resize_fail;
2018                }
2019
2020                ret = bdrv_truncate(bs->file, offset + s->cluster_size, false,
2021                                    PREALLOC_MODE_OFF, 0, &local_err);
2022                if (ret < 0) {
2023                    error_report_err(local_err);
2024                    goto resize_fail;
2025                }
2026                size = bdrv_getlength(bs->file->bs);
2027                if (size < 0) {
2028                    ret = size;
2029                    goto resize_fail;
2030                }
2031
2032                new_nb_clusters = size_to_clusters(s, size);
2033                assert(new_nb_clusters >= *nb_clusters);
2034
2035                ret = realloc_refcount_array(s, refcount_table,
2036                                             nb_clusters, new_nb_clusters);
2037                if (ret < 0) {
2038                    res->check_errors++;
2039                    return ret;
2040                }
2041
2042                if (cluster >= *nb_clusters) {
2043                    ret = -EINVAL;
2044                    goto resize_fail;
2045                }
2046
2047                res->corruptions--;
2048                res->corruptions_fixed++;
2049                ret = qcow2_inc_refcounts_imrt(bs, res,
2050                                               refcount_table, nb_clusters,
2051                                               offset, s->cluster_size);
2052                if (ret < 0) {
2053                    return ret;
2054                }
2055                /* No need to check whether the refcount is now greater than 1:
2056                 * This area was just allocated and zeroed, so it can only be
2057                 * exactly 1 after qcow2_inc_refcounts_imrt() */
2058                continue;
2059
2060resize_fail:
2061                *rebuild = true;
2062                fprintf(stderr, "ERROR could not resize image: %s\n",
2063                        strerror(-ret));
2064            }
2065            continue;
2066        }
2067
2068        if (offset != 0) {
2069            ret = qcow2_inc_refcounts_imrt(bs, res, refcount_table, nb_clusters,
2070                                           offset, s->cluster_size);
2071            if (ret < 0) {
2072                return ret;
2073            }
2074            if (s->get_refcount(*refcount_table, cluster) != 1) {
2075                fprintf(stderr, "ERROR refcount block %" PRId64
2076                        " refcount=%" PRIu64 "\n", i,
2077                        s->get_refcount(*refcount_table, cluster));
2078                res->corruptions++;
2079                *rebuild = true;
2080            }
2081        }
2082    }
2083
2084    return 0;
2085}
2086
2087/*
2088 * Calculates an in-memory refcount table.
2089 */
2090static int calculate_refcounts(BlockDriverState *bs, BdrvCheckResult *res,
2091                               BdrvCheckMode fix, bool *rebuild,
2092                               void **refcount_table, int64_t *nb_clusters)
2093{
2094    BDRVQcow2State *s = bs->opaque;
2095    int64_t i;
2096    QCowSnapshot *sn;
2097    int ret;
2098
2099    if (!*refcount_table) {
2100        int64_t old_size = 0;
2101        ret = realloc_refcount_array(s, refcount_table,
2102                                     &old_size, *nb_clusters);
2103        if (ret < 0) {
2104            res->check_errors++;
2105            return ret;
2106        }
2107    }
2108
2109    /* header */
2110    ret = qcow2_inc_refcounts_imrt(bs, res, refcount_table, nb_clusters,
2111                                   0, s->cluster_size);
2112    if (ret < 0) {
2113        return ret;
2114    }
2115
2116    /* current L1 table */
2117    ret = check_refcounts_l1(bs, res, refcount_table, nb_clusters,
2118                             s->l1_table_offset, s->l1_size, CHECK_FRAG_INFO,
2119                             fix, true);
2120    if (ret < 0) {
2121        return ret;
2122    }
2123
2124    /* snapshots */
2125    if (has_data_file(bs) && s->nb_snapshots) {
2126        fprintf(stderr, "ERROR %d snapshots in image with data file\n",
2127                s->nb_snapshots);
2128        res->corruptions++;
2129    }
2130
2131    for (i = 0; i < s->nb_snapshots; i++) {
2132        sn = s->snapshots + i;
2133        if (offset_into_cluster(s, sn->l1_table_offset)) {
2134            fprintf(stderr, "ERROR snapshot %s (%s) l1_offset=%#" PRIx64 ": "
2135                    "L1 table is not cluster aligned; snapshot table entry "
2136                    "corrupted\n", sn->id_str, sn->name, sn->l1_table_offset);
2137            res->corruptions++;
2138            continue;
2139        }
2140        if (sn->l1_size > QCOW_MAX_L1_SIZE / sizeof(uint64_t)) {
2141            fprintf(stderr, "ERROR snapshot %s (%s) l1_size=%#" PRIx32 ": "
2142                    "L1 table is too large; snapshot table entry corrupted\n",
2143                    sn->id_str, sn->name, sn->l1_size);
2144            res->corruptions++;
2145            continue;
2146        }
2147        ret = check_refcounts_l1(bs, res, refcount_table, nb_clusters,
2148                                 sn->l1_table_offset, sn->l1_size, 0, fix,
2149                                 false);
2150        if (ret < 0) {
2151            return ret;
2152        }
2153    }
2154    ret = qcow2_inc_refcounts_imrt(bs, res, refcount_table, nb_clusters,
2155                                   s->snapshots_offset, s->snapshots_size);
2156    if (ret < 0) {
2157        return ret;
2158    }
2159
2160    /* refcount data */
2161    ret = qcow2_inc_refcounts_imrt(bs, res, refcount_table, nb_clusters,
2162                                   s->refcount_table_offset,
2163                                   s->refcount_table_size * sizeof(uint64_t));
2164    if (ret < 0) {
2165        return ret;
2166    }
2167
2168    /* encryption */
2169    if (s->crypto_header.length) {
2170        ret = qcow2_inc_refcounts_imrt(bs, res, refcount_table, nb_clusters,
2171                                       s->crypto_header.offset,
2172                                       s->crypto_header.length);
2173        if (ret < 0) {
2174            return ret;
2175        }
2176    }
2177
2178    /* bitmaps */
2179    ret = qcow2_check_bitmaps_refcounts(bs, res, refcount_table, nb_clusters);
2180    if (ret < 0) {
2181        return ret;
2182    }
2183
2184    return check_refblocks(bs, res, fix, rebuild, refcount_table, nb_clusters);
2185}
2186
2187/*
2188 * Compares the actual reference count for each cluster in the image against the
2189 * refcount as reported by the refcount structures on-disk.
2190 */
2191static void compare_refcounts(BlockDriverState *bs, BdrvCheckResult *res,
2192                              BdrvCheckMode fix, bool *rebuild,
2193                              int64_t *highest_cluster,
2194                              void *refcount_table, int64_t nb_clusters)
2195{
2196    BDRVQcow2State *s = bs->opaque;
2197    int64_t i;
2198    uint64_t refcount1, refcount2;
2199    int ret;
2200
2201    for (i = 0, *highest_cluster = 0; i < nb_clusters; i++) {
2202        ret = qcow2_get_refcount(bs, i, &refcount1);
2203        if (ret < 0) {
2204            fprintf(stderr, "Can't get refcount for cluster %" PRId64 ": %s\n",
2205                    i, strerror(-ret));
2206            res->check_errors++;
2207            continue;
2208        }
2209
2210        refcount2 = s->get_refcount(refcount_table, i);
2211
2212        if (refcount1 > 0 || refcount2 > 0) {
2213            *highest_cluster = i;
2214        }
2215
2216        if (refcount1 != refcount2) {
2217            /* Check if we're allowed to fix the mismatch */
2218            int *num_fixed = NULL;
2219            if (refcount1 == 0) {
2220                *rebuild = true;
2221            } else if (refcount1 > refcount2 && (fix & BDRV_FIX_LEAKS)) {
2222                num_fixed = &res->leaks_fixed;
2223            } else if (refcount1 < refcount2 && (fix & BDRV_FIX_ERRORS)) {
2224                num_fixed = &res->corruptions_fixed;
2225            }
2226
2227            fprintf(stderr, "%s cluster %" PRId64 " refcount=%" PRIu64
2228                    " reference=%" PRIu64 "\n",
2229                   num_fixed != NULL     ? "Repairing" :
2230                   refcount1 < refcount2 ? "ERROR" :
2231                                           "Leaked",
2232                   i, refcount1, refcount2);
2233
2234            if (num_fixed) {
2235                ret = update_refcount(bs, i << s->cluster_bits, 1,
2236                                      refcount_diff(refcount1, refcount2),
2237                                      refcount1 > refcount2,
2238                                      QCOW2_DISCARD_ALWAYS);
2239                if (ret >= 0) {
2240                    (*num_fixed)++;
2241                    continue;
2242                }
2243            }
2244
2245            /* And if we couldn't, print an error */
2246            if (refcount1 < refcount2) {
2247                res->corruptions++;
2248            } else {
2249                res->leaks++;
2250            }
2251        }
2252    }
2253}
2254
2255/*
2256 * Allocates clusters using an in-memory refcount table (IMRT) in contrast to
2257 * the on-disk refcount structures.
2258 *
2259 * On input, *first_free_cluster tells where to start looking, and need not
2260 * actually be a free cluster; the returned offset will not be before that
2261 * cluster.  On output, *first_free_cluster points to the first gap found, even
2262 * if that gap was too small to be used as the returned offset.
2263 *
2264 * Note that *first_free_cluster is a cluster index whereas the return value is
2265 * an offset.
2266 */
2267static int64_t alloc_clusters_imrt(BlockDriverState *bs,
2268                                   int cluster_count,
2269                                   void **refcount_table,
2270                                   int64_t *imrt_nb_clusters,
2271                                   int64_t *first_free_cluster)
2272{
2273    BDRVQcow2State *s = bs->opaque;
2274    int64_t cluster = *first_free_cluster, i;
2275    bool first_gap = true;
2276    int contiguous_free_clusters;
2277    int ret;
2278
2279    /* Starting at *first_free_cluster, find a range of at least cluster_count
2280     * continuously free clusters */
2281    for (contiguous_free_clusters = 0;
2282         cluster < *imrt_nb_clusters &&
2283         contiguous_free_clusters < cluster_count;
2284         cluster++)
2285    {
2286        if (!s->get_refcount(*refcount_table, cluster)) {
2287            contiguous_free_clusters++;
2288            if (first_gap) {
2289                /* If this is the first free cluster found, update
2290                 * *first_free_cluster accordingly */
2291                *first_free_cluster = cluster;
2292                first_gap = false;
2293            }
2294        } else if (contiguous_free_clusters) {
2295            contiguous_free_clusters = 0;
2296        }
2297    }
2298
2299    /* If contiguous_free_clusters is greater than zero, it contains the number
2300     * of continuously free clusters until the current cluster; the first free
2301     * cluster in the current "gap" is therefore
2302     * cluster - contiguous_free_clusters */
2303
2304    /* If no such range could be found, grow the in-memory refcount table
2305     * accordingly to append free clusters at the end of the image */
2306    if (contiguous_free_clusters < cluster_count) {
2307        /* contiguous_free_clusters clusters are already empty at the image end;
2308         * we need cluster_count clusters; therefore, we have to allocate
2309         * cluster_count - contiguous_free_clusters new clusters at the end of
2310         * the image (which is the current value of cluster; note that cluster
2311         * may exceed old_imrt_nb_clusters if *first_free_cluster pointed beyond
2312         * the image end) */
2313        ret = realloc_refcount_array(s, refcount_table, imrt_nb_clusters,
2314                                     cluster + cluster_count
2315                                     - contiguous_free_clusters);
2316        if (ret < 0) {
2317            return ret;
2318        }
2319    }
2320
2321    /* Go back to the first free cluster */
2322    cluster -= contiguous_free_clusters;
2323    for (i = 0; i < cluster_count; i++) {
2324        s->set_refcount(*refcount_table, cluster + i, 1);
2325    }
2326
2327    return cluster << s->cluster_bits;
2328}
2329
2330/*
2331 * Creates a new refcount structure based solely on the in-memory information
2332 * given through *refcount_table. All necessary allocations will be reflected
2333 * in that array.
2334 *
2335 * On success, the old refcount structure is leaked (it will be covered by the
2336 * new refcount structure).
2337 */
2338static int rebuild_refcount_structure(BlockDriverState *bs,
2339                                      BdrvCheckResult *res,
2340                                      void **refcount_table,
2341                                      int64_t *nb_clusters)
2342{
2343    BDRVQcow2State *s = bs->opaque;
2344    int64_t first_free_cluster = 0, reftable_offset = -1, cluster = 0;
2345    int64_t refblock_offset, refblock_start, refblock_index;
2346    uint32_t reftable_size = 0;
2347    uint64_t *on_disk_reftable = NULL;
2348    void *on_disk_refblock;
2349    int ret = 0;
2350    struct {
2351        uint64_t reftable_offset;
2352        uint32_t reftable_clusters;
2353    } QEMU_PACKED reftable_offset_and_clusters;
2354
2355    qcow2_cache_empty(bs, s->refcount_block_cache);
2356
2357write_refblocks:
2358    for (; cluster < *nb_clusters; cluster++) {
2359        if (!s->get_refcount(*refcount_table, cluster)) {
2360            continue;
2361        }
2362
2363        refblock_index = cluster >> s->refcount_block_bits;
2364        refblock_start = refblock_index << s->refcount_block_bits;
2365
2366        /* Don't allocate a cluster in a refblock already written to disk */
2367        if (first_free_cluster < refblock_start) {
2368            first_free_cluster = refblock_start;
2369        }
2370        refblock_offset = alloc_clusters_imrt(bs, 1, refcount_table,
2371                                              nb_clusters, &first_free_cluster);
2372        if (refblock_offset < 0) {
2373            fprintf(stderr, "ERROR allocating refblock: %s\n",
2374                    strerror(-refblock_offset));
2375            res->check_errors++;
2376            ret = refblock_offset;
2377            goto fail;
2378        }
2379
2380        if (reftable_size <= refblock_index) {
2381            uint32_t old_reftable_size = reftable_size;
2382            uint64_t *new_on_disk_reftable;
2383
2384            reftable_size = ROUND_UP((refblock_index + 1) * sizeof(uint64_t),
2385                                     s->cluster_size) / sizeof(uint64_t);
2386            new_on_disk_reftable = g_try_realloc(on_disk_reftable,
2387                                                 reftable_size *
2388                                                 sizeof(uint64_t));
2389            if (!new_on_disk_reftable) {
2390                res->check_errors++;
2391                ret = -ENOMEM;
2392                goto fail;
2393            }
2394            on_disk_reftable = new_on_disk_reftable;
2395
2396            memset(on_disk_reftable + old_reftable_size, 0,
2397                   (reftable_size - old_reftable_size) * sizeof(uint64_t));
2398
2399            /* The offset we have for the reftable is now no longer valid;
2400             * this will leak that range, but we can easily fix that by running
2401             * a leak-fixing check after this rebuild operation */
2402            reftable_offset = -1;
2403        } else {
2404            assert(on_disk_reftable);
2405        }
2406        on_disk_reftable[refblock_index] = refblock_offset;
2407
2408        /* If this is apparently the last refblock (for now), try to squeeze the
2409         * reftable in */
2410        if (refblock_index == (*nb_clusters - 1) >> s->refcount_block_bits &&
2411            reftable_offset < 0)
2412        {
2413            uint64_t reftable_clusters = size_to_clusters(s, reftable_size *
2414                                                          sizeof(uint64_t));
2415            reftable_offset = alloc_clusters_imrt(bs, reftable_clusters,
2416                                                  refcount_table, nb_clusters,
2417                                                  &first_free_cluster);
2418            if (reftable_offset < 0) {
2419                fprintf(stderr, "ERROR allocating reftable: %s\n",
2420                        strerror(-reftable_offset));
2421                res->check_errors++;
2422                ret = reftable_offset;
2423                goto fail;
2424            }
2425        }
2426
2427        ret = qcow2_pre_write_overlap_check(bs, 0, refblock_offset,
2428                                            s->cluster_size, false);
2429        if (ret < 0) {
2430            fprintf(stderr, "ERROR writing refblock: %s\n", strerror(-ret));
2431            goto fail;
2432        }
2433
2434        /* The size of *refcount_table is always cluster-aligned, therefore the
2435         * write operation will not overflow */
2436        on_disk_refblock = (void *)((char *) *refcount_table +
2437                                    refblock_index * s->cluster_size);
2438
2439        ret = bdrv_pwrite(bs->file, refblock_offset, on_disk_refblock,
2440                          s->cluster_size);
2441        if (ret < 0) {
2442            fprintf(stderr, "ERROR writing refblock: %s\n", strerror(-ret));
2443            goto fail;
2444        }
2445
2446        /* Go to the end of this refblock */
2447        cluster = refblock_start + s->refcount_block_size - 1;
2448    }
2449
2450    if (reftable_offset < 0) {
2451        uint64_t post_refblock_start, reftable_clusters;
2452
2453        post_refblock_start = ROUND_UP(*nb_clusters, s->refcount_block_size);
2454        reftable_clusters = size_to_clusters(s,
2455                                             reftable_size * sizeof(uint64_t));
2456        /* Not pretty but simple */
2457        if (first_free_cluster < post_refblock_start) {
2458            first_free_cluster = post_refblock_start;
2459        }
2460        reftable_offset = alloc_clusters_imrt(bs, reftable_clusters,
2461                                              refcount_table, nb_clusters,
2462                                              &first_free_cluster);
2463        if (reftable_offset < 0) {
2464            fprintf(stderr, "ERROR allocating reftable: %s\n",
2465                    strerror(-reftable_offset));
2466            res->check_errors++;
2467            ret = reftable_offset;
2468            goto fail;
2469        }
2470
2471        goto write_refblocks;
2472    }
2473
2474    for (refblock_index = 0; refblock_index < reftable_size; refblock_index++) {
2475        cpu_to_be64s(&on_disk_reftable[refblock_index]);
2476    }
2477
2478    ret = qcow2_pre_write_overlap_check(bs, 0, reftable_offset,
2479                                        reftable_size * sizeof(uint64_t),
2480                                        false);
2481    if (ret < 0) {
2482        fprintf(stderr, "ERROR writing reftable: %s\n", strerror(-ret));
2483        goto fail;
2484    }
2485
2486    assert(reftable_size < INT_MAX / sizeof(uint64_t));
2487    ret = bdrv_pwrite(bs->file, reftable_offset, on_disk_reftable,
2488                      reftable_size * sizeof(uint64_t));
2489    if (ret < 0) {
2490        fprintf(stderr, "ERROR writing reftable: %s\n", strerror(-ret));
2491        goto fail;
2492    }
2493
2494    /* Enter new reftable into the image header */
2495    reftable_offset_and_clusters.reftable_offset = cpu_to_be64(reftable_offset);
2496    reftable_offset_and_clusters.reftable_clusters =
2497        cpu_to_be32(size_to_clusters(s, reftable_size * sizeof(uint64_t)));
2498    ret = bdrv_pwrite_sync(bs->file,
2499                           offsetof(QCowHeader, refcount_table_offset),
2500                           &reftable_offset_and_clusters,
2501                           sizeof(reftable_offset_and_clusters));
2502    if (ret < 0) {
2503        fprintf(stderr, "ERROR setting reftable: %s\n", strerror(-ret));
2504        goto fail;
2505    }
2506
2507    for (refblock_index = 0; refblock_index < reftable_size; refblock_index++) {
2508        be64_to_cpus(&on_disk_reftable[refblock_index]);
2509    }
2510    s->refcount_table = on_disk_reftable;
2511    s->refcount_table_offset = reftable_offset;
2512    s->refcount_table_size = reftable_size;
2513    update_max_refcount_table_index(s);
2514
2515    return 0;
2516
2517fail:
2518    g_free(on_disk_reftable);
2519    return ret;
2520}
2521
2522/*
2523 * Checks an image for refcount consistency.
2524 *
2525 * Returns 0 if no errors are found, the number of errors in case the image is
2526 * detected as corrupted, and -errno when an internal error occurred.
2527 */
2528int qcow2_check_refcounts(BlockDriverState *bs, BdrvCheckResult *res,
2529                          BdrvCheckMode fix)
2530{
2531    BDRVQcow2State *s = bs->opaque;
2532    BdrvCheckResult pre_compare_res;
2533    int64_t size, highest_cluster, nb_clusters;
2534    void *refcount_table = NULL;
2535    bool rebuild = false;
2536    int ret;
2537
2538    size = bdrv_getlength(bs->file->bs);
2539    if (size < 0) {
2540        res->check_errors++;
2541        return size;
2542    }
2543
2544    nb_clusters = size_to_clusters(s, size);
2545    if (nb_clusters > INT_MAX) {
2546        res->check_errors++;
2547        return -EFBIG;
2548    }
2549
2550    res->bfi.total_clusters =
2551        size_to_clusters(s, bs->total_sectors * BDRV_SECTOR_SIZE);
2552
2553    ret = calculate_refcounts(bs, res, fix, &rebuild, &refcount_table,
2554                              &nb_clusters);
2555    if (ret < 0) {
2556        goto fail;
2557    }
2558
2559    /* In case we don't need to rebuild the refcount structure (but want to fix
2560     * something), this function is immediately called again, in which case the
2561     * result should be ignored */
2562    pre_compare_res = *res;
2563    compare_refcounts(bs, res, 0, &rebuild, &highest_cluster, refcount_table,
2564                      nb_clusters);
2565
2566    if (rebuild && (fix & BDRV_FIX_ERRORS)) {
2567        BdrvCheckResult old_res = *res;
2568        int fresh_leaks = 0;
2569
2570        fprintf(stderr, "Rebuilding refcount structure\n");
2571        ret = rebuild_refcount_structure(bs, res, &refcount_table,
2572                                         &nb_clusters);
2573        if (ret < 0) {
2574            goto fail;
2575        }
2576
2577        res->corruptions = 0;
2578        res->leaks = 0;
2579
2580        /* Because the old reftable has been exchanged for a new one the
2581         * references have to be recalculated */
2582        rebuild = false;
2583        memset(refcount_table, 0, refcount_array_byte_size(s, nb_clusters));
2584        ret = calculate_refcounts(bs, res, 0, &rebuild, &refcount_table,
2585                                  &nb_clusters);
2586        if (ret < 0) {
2587            goto fail;
2588        }
2589
2590        if (fix & BDRV_FIX_LEAKS) {
2591            /* The old refcount structures are now leaked, fix it; the result
2592             * can be ignored, aside from leaks which were introduced by
2593             * rebuild_refcount_structure() that could not be fixed */
2594            BdrvCheckResult saved_res = *res;
2595            *res = (BdrvCheckResult){ 0 };
2596
2597            compare_refcounts(bs, res, BDRV_FIX_LEAKS, &rebuild,
2598                              &highest_cluster, refcount_table, nb_clusters);
2599            if (rebuild) {
2600                fprintf(stderr, "ERROR rebuilt refcount structure is still "
2601                        "broken\n");
2602            }
2603
2604            /* Any leaks accounted for here were introduced by
2605             * rebuild_refcount_structure() because that function has created a
2606             * new refcount structure from scratch */
2607            fresh_leaks = res->leaks;
2608            *res = saved_res;
2609        }
2610
2611        if (res->corruptions < old_res.corruptions) {
2612            res->corruptions_fixed += old_res.corruptions - res->corruptions;
2613        }
2614        if (res->leaks < old_res.leaks) {
2615            res->leaks_fixed += old_res.leaks - res->leaks;
2616        }
2617        res->leaks += fresh_leaks;
2618    } else if (fix) {
2619        if (rebuild) {
2620            fprintf(stderr, "ERROR need to rebuild refcount structures\n");
2621            res->check_errors++;
2622            ret = -EIO;
2623            goto fail;
2624        }
2625
2626        if (res->leaks || res->corruptions) {
2627            *res = pre_compare_res;
2628            compare_refcounts(bs, res, fix, &rebuild, &highest_cluster,
2629                              refcount_table, nb_clusters);
2630        }
2631    }
2632
2633    /* check OFLAG_COPIED */
2634    ret = check_oflag_copied(bs, res, fix);
2635    if (ret < 0) {
2636        goto fail;
2637    }
2638
2639    res->image_end_offset = (highest_cluster + 1) * s->cluster_size;
2640    ret = 0;
2641
2642fail:
2643    g_free(refcount_table);
2644
2645    return ret;
2646}
2647
2648#define overlaps_with(ofs, sz) \
2649    ranges_overlap(offset, size, ofs, sz)
2650
2651/*
2652 * Checks if the given offset into the image file is actually free to use by
2653 * looking for overlaps with important metadata sections (L1/L2 tables etc.),
2654 * i.e. a sanity check without relying on the refcount tables.
2655 *
2656 * The ign parameter specifies what checks not to perform (being a bitmask of
2657 * QCow2MetadataOverlap values), i.e., what sections to ignore.
2658 *
2659 * Returns:
2660 * - 0 if writing to this offset will not affect the mentioned metadata
2661 * - a positive QCow2MetadataOverlap value indicating one overlapping section
2662 * - a negative value (-errno) indicating an error while performing a check,
2663 *   e.g. when bdrv_pread failed on QCOW2_OL_INACTIVE_L2
2664 */
2665int qcow2_check_metadata_overlap(BlockDriverState *bs, int ign, int64_t offset,
2666                                 int64_t size)
2667{
2668    BDRVQcow2State *s = bs->opaque;
2669    int chk = s->overlap_check & ~ign;
2670    int i, j;
2671
2672    if (!size) {
2673        return 0;
2674    }
2675
2676    if (chk & QCOW2_OL_MAIN_HEADER) {
2677        if (offset < s->cluster_size) {
2678            return QCOW2_OL_MAIN_HEADER;
2679        }
2680    }
2681
2682    /* align range to test to cluster boundaries */
2683    size = ROUND_UP(offset_into_cluster(s, offset) + size, s->cluster_size);
2684    offset = start_of_cluster(s, offset);
2685
2686    if ((chk & QCOW2_OL_ACTIVE_L1) && s->l1_size) {
2687        if (overlaps_with(s->l1_table_offset, s->l1_size * sizeof(uint64_t))) {
2688            return QCOW2_OL_ACTIVE_L1;
2689        }
2690    }
2691
2692    if ((chk & QCOW2_OL_REFCOUNT_TABLE) && s->refcount_table_size) {
2693        if (overlaps_with(s->refcount_table_offset,
2694            s->refcount_table_size * sizeof(uint64_t))) {
2695            return QCOW2_OL_REFCOUNT_TABLE;
2696        }
2697    }
2698
2699    if ((chk & QCOW2_OL_SNAPSHOT_TABLE) && s->snapshots_size) {
2700        if (overlaps_with(s->snapshots_offset, s->snapshots_size)) {
2701            return QCOW2_OL_SNAPSHOT_TABLE;
2702        }
2703    }
2704
2705    if ((chk & QCOW2_OL_INACTIVE_L1) && s->snapshots) {
2706        for (i = 0; i < s->nb_snapshots; i++) {
2707            if (s->snapshots[i].l1_size &&
2708                overlaps_with(s->snapshots[i].l1_table_offset,
2709                s->snapshots[i].l1_size * sizeof(uint64_t))) {
2710                return QCOW2_OL_INACTIVE_L1;
2711            }
2712        }
2713    }
2714
2715    if ((chk & QCOW2_OL_ACTIVE_L2) && s->l1_table) {
2716        for (i = 0; i < s->l1_size; i++) {
2717            if ((s->l1_table[i] & L1E_OFFSET_MASK) &&
2718                overlaps_with(s->l1_table[i] & L1E_OFFSET_MASK,
2719                s->cluster_size)) {
2720                return QCOW2_OL_ACTIVE_L2;
2721            }
2722        }
2723    }
2724
2725    if ((chk & QCOW2_OL_REFCOUNT_BLOCK) && s->refcount_table) {
2726        unsigned last_entry = s->max_refcount_table_index;
2727        assert(last_entry < s->refcount_table_size);
2728        assert(last_entry + 1 == s->refcount_table_size ||
2729               (s->refcount_table[last_entry + 1] & REFT_OFFSET_MASK) == 0);
2730        for (i = 0; i <= last_entry; i++) {
2731            if ((s->refcount_table[i] & REFT_OFFSET_MASK) &&
2732                overlaps_with(s->refcount_table[i] & REFT_OFFSET_MASK,
2733                s->cluster_size)) {
2734                return QCOW2_OL_REFCOUNT_BLOCK;
2735            }
2736        }
2737    }
2738
2739    if ((chk & QCOW2_OL_INACTIVE_L2) && s->snapshots) {
2740        for (i = 0; i < s->nb_snapshots; i++) {
2741            uint64_t l1_ofs = s->snapshots[i].l1_table_offset;
2742            uint32_t l1_sz  = s->snapshots[i].l1_size;
2743            uint64_t l1_sz2 = l1_sz * sizeof(uint64_t);
2744            uint64_t *l1;
2745            int ret;
2746
2747            ret = qcow2_validate_table(bs, l1_ofs, l1_sz, sizeof(uint64_t),
2748                                       QCOW_MAX_L1_SIZE, "", NULL);
2749            if (ret < 0) {
2750                return ret;
2751            }
2752
2753            l1 = g_try_malloc(l1_sz2);
2754
2755            if (l1_sz2 && l1 == NULL) {
2756                return -ENOMEM;
2757            }
2758
2759            ret = bdrv_pread(bs->file, l1_ofs, l1, l1_sz2);
2760            if (ret < 0) {
2761                g_free(l1);
2762                return ret;
2763            }
2764
2765            for (j = 0; j < l1_sz; j++) {
2766                uint64_t l2_ofs = be64_to_cpu(l1[j]) & L1E_OFFSET_MASK;
2767                if (l2_ofs && overlaps_with(l2_ofs, s->cluster_size)) {
2768                    g_free(l1);
2769                    return QCOW2_OL_INACTIVE_L2;
2770                }
2771            }
2772
2773            g_free(l1);
2774        }
2775    }
2776
2777    if ((chk & QCOW2_OL_BITMAP_DIRECTORY) &&
2778        (s->autoclear_features & QCOW2_AUTOCLEAR_BITMAPS))
2779    {
2780        if (overlaps_with(s->bitmap_directory_offset,
2781                          s->bitmap_directory_size))
2782        {
2783            return QCOW2_OL_BITMAP_DIRECTORY;
2784        }
2785    }
2786
2787    return 0;
2788}
2789
2790static const char *metadata_ol_names[] = {
2791    [QCOW2_OL_MAIN_HEADER_BITNR]        = "qcow2_header",
2792    [QCOW2_OL_ACTIVE_L1_BITNR]          = "active L1 table",
2793    [QCOW2_OL_ACTIVE_L2_BITNR]          = "active L2 table",
2794    [QCOW2_OL_REFCOUNT_TABLE_BITNR]     = "refcount table",
2795    [QCOW2_OL_REFCOUNT_BLOCK_BITNR]     = "refcount block",
2796    [QCOW2_OL_SNAPSHOT_TABLE_BITNR]     = "snapshot table",
2797    [QCOW2_OL_INACTIVE_L1_BITNR]        = "inactive L1 table",
2798    [QCOW2_OL_INACTIVE_L2_BITNR]        = "inactive L2 table",
2799    [QCOW2_OL_BITMAP_DIRECTORY_BITNR]   = "bitmap directory",
2800};
2801QEMU_BUILD_BUG_ON(QCOW2_OL_MAX_BITNR != ARRAY_SIZE(metadata_ol_names));
2802
2803/*
2804 * First performs a check for metadata overlaps (through
2805 * qcow2_check_metadata_overlap); if that fails with a negative value (error
2806 * while performing a check), that value is returned. If an impending overlap
2807 * is detected, the BDS will be made unusable, the qcow2 file marked corrupt
2808 * and -EIO returned.
2809 *
2810 * Returns 0 if there were neither overlaps nor errors while checking for
2811 * overlaps; or a negative value (-errno) on error.
2812 */
2813int qcow2_pre_write_overlap_check(BlockDriverState *bs, int ign, int64_t offset,
2814                                  int64_t size, bool data_file)
2815{
2816    int ret;
2817
2818    if (data_file && has_data_file(bs)) {
2819        return 0;
2820    }
2821
2822    ret = qcow2_check_metadata_overlap(bs, ign, offset, size);
2823    if (ret < 0) {
2824        return ret;
2825    } else if (ret > 0) {
2826        int metadata_ol_bitnr = ctz32(ret);
2827        assert(metadata_ol_bitnr < QCOW2_OL_MAX_BITNR);
2828
2829        qcow2_signal_corruption(bs, true, offset, size, "Preventing invalid "
2830                                "write on metadata (overlaps with %s)",
2831                                metadata_ol_names[metadata_ol_bitnr]);
2832        return -EIO;
2833    }
2834
2835    return 0;
2836}
2837
2838/* A pointer to a function of this type is given to walk_over_reftable(). That
2839 * function will create refblocks and pass them to a RefblockFinishOp once they
2840 * are completed (@refblock). @refblock_empty is set if the refblock is
2841 * completely empty.
2842 *
2843 * Along with the refblock, a corresponding reftable entry is passed, in the
2844 * reftable @reftable (which may be reallocated) at @reftable_index.
2845 *
2846 * @allocated should be set to true if a new cluster has been allocated.
2847 */
2848typedef int (RefblockFinishOp)(BlockDriverState *bs, uint64_t **reftable,
2849                               uint64_t reftable_index, uint64_t *reftable_size,
2850                               void *refblock, bool refblock_empty,
2851                               bool *allocated, Error **errp);
2852
2853/**
2854 * This "operation" for walk_over_reftable() allocates the refblock on disk (if
2855 * it is not empty) and inserts its offset into the new reftable. The size of
2856 * this new reftable is increased as required.
2857 */
2858static int alloc_refblock(BlockDriverState *bs, uint64_t **reftable,
2859                          uint64_t reftable_index, uint64_t *reftable_size,
2860                          void *refblock, bool refblock_empty, bool *allocated,
2861                          Error **errp)
2862{
2863    BDRVQcow2State *s = bs->opaque;
2864    int64_t offset;
2865
2866    if (!refblock_empty && reftable_index >= *reftable_size) {
2867        uint64_t *new_reftable;
2868        uint64_t new_reftable_size;
2869
2870        new_reftable_size = ROUND_UP(reftable_index + 1,
2871                                     s->cluster_size / sizeof(uint64_t));
2872        if (new_reftable_size > QCOW_MAX_REFTABLE_SIZE / sizeof(uint64_t)) {
2873            error_setg(errp,
2874                       "This operation would make the refcount table grow "
2875                       "beyond the maximum size supported by QEMU, aborting");
2876            return -ENOTSUP;
2877        }
2878
2879        new_reftable = g_try_realloc(*reftable, new_reftable_size *
2880                                                sizeof(uint64_t));
2881        if (!new_reftable) {
2882            error_setg(errp, "Failed to increase reftable buffer size");
2883            return -ENOMEM;
2884        }
2885
2886        memset(new_reftable + *reftable_size, 0,
2887               (new_reftable_size - *reftable_size) * sizeof(uint64_t));
2888
2889        *reftable      = new_reftable;
2890        *reftable_size = new_reftable_size;
2891    }
2892
2893    if (!refblock_empty && !(*reftable)[reftable_index]) {
2894        offset = qcow2_alloc_clusters(bs, s->cluster_size);
2895        if (offset < 0) {
2896            error_setg_errno(errp, -offset, "Failed to allocate refblock");
2897            return offset;
2898        }
2899        (*reftable)[reftable_index] = offset;
2900        *allocated = true;
2901    }
2902
2903    return 0;
2904}
2905
2906/**
2907 * This "operation" for walk_over_reftable() writes the refblock to disk at the
2908 * offset specified by the new reftable's entry. It does not modify the new
2909 * reftable or change any refcounts.
2910 */
2911static int flush_refblock(BlockDriverState *bs, uint64_t **reftable,
2912                          uint64_t reftable_index, uint64_t *reftable_size,
2913                          void *refblock, bool refblock_empty, bool *allocated,
2914                          Error **errp)
2915{
2916    BDRVQcow2State *s = bs->opaque;
2917    int64_t offset;
2918    int ret;
2919
2920    if (reftable_index < *reftable_size && (*reftable)[reftable_index]) {
2921        offset = (*reftable)[reftable_index];
2922
2923        ret = qcow2_pre_write_overlap_check(bs, 0, offset, s->cluster_size,
2924                                            false);
2925        if (ret < 0) {
2926            error_setg_errno(errp, -ret, "Overlap check failed");
2927            return ret;
2928        }
2929
2930        ret = bdrv_pwrite(bs->file, offset, refblock, s->cluster_size);
2931        if (ret < 0) {
2932            error_setg_errno(errp, -ret, "Failed to write refblock");
2933            return ret;
2934        }
2935    } else {
2936        assert(refblock_empty);
2937    }
2938
2939    return 0;
2940}
2941
2942/**
2943 * This function walks over the existing reftable and every referenced refblock;
2944 * if @new_set_refcount is non-NULL, it is called for every refcount entry to
2945 * create an equal new entry in the passed @new_refblock. Once that
2946 * @new_refblock is completely filled, @operation will be called.
2947 *
2948 * @status_cb and @cb_opaque are used for the amend operation's status callback.
2949 * @index is the index of the walk_over_reftable() calls and @total is the total
2950 * number of walk_over_reftable() calls per amend operation. Both are used for
2951 * calculating the parameters for the status callback.
2952 *
2953 * @allocated is set to true if a new cluster has been allocated.
2954 */
2955static int walk_over_reftable(BlockDriverState *bs, uint64_t **new_reftable,
2956                              uint64_t *new_reftable_index,
2957                              uint64_t *new_reftable_size,
2958                              void *new_refblock, int new_refblock_size,
2959                              int new_refcount_bits,
2960                              RefblockFinishOp *operation, bool *allocated,
2961                              Qcow2SetRefcountFunc *new_set_refcount,
2962                              BlockDriverAmendStatusCB *status_cb,
2963                              void *cb_opaque, int index, int total,
2964                              Error **errp)
2965{
2966    BDRVQcow2State *s = bs->opaque;
2967    uint64_t reftable_index;
2968    bool new_refblock_empty = true;
2969    int refblock_index;
2970    int new_refblock_index = 0;
2971    int ret;
2972
2973    for (reftable_index = 0; reftable_index < s->refcount_table_size;
2974         reftable_index++)
2975    {
2976        uint64_t refblock_offset = s->refcount_table[reftable_index]
2977                                 & REFT_OFFSET_MASK;
2978
2979        status_cb(bs, (uint64_t)index * s->refcount_table_size + reftable_index,
2980                  (uint64_t)total * s->refcount_table_size, cb_opaque);
2981
2982        if (refblock_offset) {
2983            void *refblock;
2984
2985            if (offset_into_cluster(s, refblock_offset)) {
2986                qcow2_signal_corruption(bs, true, -1, -1, "Refblock offset %#"
2987                                        PRIx64 " unaligned (reftable index: %#"
2988                                        PRIx64 ")", refblock_offset,
2989                                        reftable_index);
2990                error_setg(errp,
2991                           "Image is corrupt (unaligned refblock offset)");
2992                return -EIO;
2993            }
2994
2995            ret = qcow2_cache_get(bs, s->refcount_block_cache, refblock_offset,
2996                                  &refblock);
2997            if (ret < 0) {
2998                error_setg_errno(errp, -ret, "Failed to retrieve refblock");
2999                return ret;
3000            }
3001
3002            for (refblock_index = 0; refblock_index < s->refcount_block_size;
3003                 refblock_index++)
3004            {
3005                uint64_t refcount;
3006
3007                if (new_refblock_index >= new_refblock_size) {
3008                    /* new_refblock is now complete */
3009                    ret = operation(bs, new_reftable, *new_reftable_index,
3010                                    new_reftable_size, new_refblock,
3011                                    new_refblock_empty, allocated, errp);
3012                    if (ret < 0) {
3013                        qcow2_cache_put(s->refcount_block_cache, &refblock);
3014                        return ret;
3015                    }
3016
3017                    (*new_reftable_index)++;
3018                    new_refblock_index = 0;
3019                    new_refblock_empty = true;
3020                }
3021
3022                refcount = s->get_refcount(refblock, refblock_index);
3023                if (new_refcount_bits < 64 && refcount >> new_refcount_bits) {
3024                    uint64_t offset;
3025
3026                    qcow2_cache_put(s->refcount_block_cache, &refblock);
3027
3028                    offset = ((reftable_index << s->refcount_block_bits)
3029                              + refblock_index) << s->cluster_bits;
3030
3031                    error_setg(errp, "Cannot decrease refcount entry width to "
3032                               "%i bits: Cluster at offset %#" PRIx64 " has a "
3033                               "refcount of %" PRIu64, new_refcount_bits,
3034                               offset, refcount);
3035                    return -EINVAL;
3036                }
3037
3038                if (new_set_refcount) {
3039                    new_set_refcount(new_refblock, new_refblock_index++,
3040                                     refcount);
3041                } else {
3042                    new_refblock_index++;
3043                }
3044                new_refblock_empty = new_refblock_empty && refcount == 0;
3045            }
3046
3047            qcow2_cache_put(s->refcount_block_cache, &refblock);
3048        } else {
3049            /* No refblock means every refcount is 0 */
3050            for (refblock_index = 0; refblock_index < s->refcount_block_size;
3051                 refblock_index++)
3052            {
3053                if (new_refblock_index >= new_refblock_size) {
3054                    /* new_refblock is now complete */
3055                    ret = operation(bs, new_reftable, *new_reftable_index,
3056                                    new_reftable_size, new_refblock,
3057                                    new_refblock_empty, allocated, errp);
3058                    if (ret < 0) {
3059                        return ret;
3060                    }
3061
3062                    (*new_reftable_index)++;
3063                    new_refblock_index = 0;
3064                    new_refblock_empty = true;
3065                }
3066
3067                if (new_set_refcount) {
3068                    new_set_refcount(new_refblock, new_refblock_index++, 0);
3069                } else {
3070                    new_refblock_index++;
3071                }
3072            }
3073        }
3074    }
3075
3076    if (new_refblock_index > 0) {
3077        /* Complete the potentially existing partially filled final refblock */
3078        if (new_set_refcount) {
3079            for (; new_refblock_index < new_refblock_size;
3080                 new_refblock_index++)
3081            {
3082                new_set_refcount(new_refblock, new_refblock_index, 0);
3083            }
3084        }
3085
3086        ret = operation(bs, new_reftable, *new_reftable_index,
3087                        new_reftable_size, new_refblock, new_refblock_empty,
3088                        allocated, errp);
3089        if (ret < 0) {
3090            return ret;
3091        }
3092
3093        (*new_reftable_index)++;
3094    }
3095
3096    status_cb(bs, (uint64_t)(index + 1) * s->refcount_table_size,
3097              (uint64_t)total * s->refcount_table_size, cb_opaque);
3098
3099    return 0;
3100}
3101
3102int qcow2_change_refcount_order(BlockDriverState *bs, int refcount_order,
3103                                BlockDriverAmendStatusCB *status_cb,
3104                                void *cb_opaque, Error **errp)
3105{
3106    BDRVQcow2State *s = bs->opaque;
3107    Qcow2GetRefcountFunc *new_get_refcount;
3108    Qcow2SetRefcountFunc *new_set_refcount;
3109    void *new_refblock = qemu_blockalign(bs->file->bs, s->cluster_size);
3110    uint64_t *new_reftable = NULL, new_reftable_size = 0;
3111    uint64_t *old_reftable, old_reftable_size, old_reftable_offset;
3112    uint64_t new_reftable_index = 0;
3113    uint64_t i;
3114    int64_t new_reftable_offset = 0, allocated_reftable_size = 0;
3115    int new_refblock_size, new_refcount_bits = 1 << refcount_order;
3116    int old_refcount_order;
3117    int walk_index = 0;
3118    int ret;
3119    bool new_allocation;
3120
3121    assert(s->qcow_version >= 3);
3122    assert(refcount_order >= 0 && refcount_order <= 6);
3123
3124    /* see qcow2_open() */
3125    new_refblock_size = 1 << (s->cluster_bits - (refcount_order - 3));
3126
3127    new_get_refcount = get_refcount_funcs[refcount_order];
3128    new_set_refcount = set_refcount_funcs[refcount_order];
3129
3130
3131    do {
3132        int total_walks;
3133
3134        new_allocation = false;
3135
3136        /* At least we have to do this walk and the one which writes the
3137         * refblocks; also, at least we have to do this loop here at least
3138         * twice (normally), first to do the allocations, and second to
3139         * determine that everything is correctly allocated, this then makes
3140         * three walks in total */
3141        total_walks = MAX(walk_index + 2, 3);
3142
3143        /* First, allocate the structures so they are present in the refcount
3144         * structures */
3145        ret = walk_over_reftable(bs, &new_reftable, &new_reftable_index,
3146                                 &new_reftable_size, NULL, new_refblock_size,
3147                                 new_refcount_bits, &alloc_refblock,
3148                                 &new_allocation, NULL, status_cb, cb_opaque,
3149                                 walk_index++, total_walks, errp);
3150        if (ret < 0) {
3151            goto done;
3152        }
3153
3154        new_reftable_index = 0;
3155
3156        if (new_allocation) {
3157            if (new_reftable_offset) {
3158                qcow2_free_clusters(bs, new_reftable_offset,
3159                                    allocated_reftable_size * sizeof(uint64_t),
3160                                    QCOW2_DISCARD_NEVER);
3161            }
3162
3163            new_reftable_offset = qcow2_alloc_clusters(bs, new_reftable_size *
3164                                                           sizeof(uint64_t));
3165            if (new_reftable_offset < 0) {
3166                error_setg_errno(errp, -new_reftable_offset,
3167                                 "Failed to allocate the new reftable");
3168                ret = new_reftable_offset;
3169                goto done;
3170            }
3171            allocated_reftable_size = new_reftable_size;
3172        }
3173    } while (new_allocation);
3174
3175    /* Second, write the new refblocks */
3176    ret = walk_over_reftable(bs, &new_reftable, &new_reftable_index,
3177                             &new_reftable_size, new_refblock,
3178                             new_refblock_size, new_refcount_bits,
3179                             &flush_refblock, &new_allocation, new_set_refcount,
3180                             status_cb, cb_opaque, walk_index, walk_index + 1,
3181                             errp);
3182    if (ret < 0) {
3183        goto done;
3184    }
3185    assert(!new_allocation);
3186
3187
3188    /* Write the new reftable */
3189    ret = qcow2_pre_write_overlap_check(bs, 0, new_reftable_offset,
3190                                        new_reftable_size * sizeof(uint64_t),
3191                                        false);
3192    if (ret < 0) {
3193        error_setg_errno(errp, -ret, "Overlap check failed");
3194        goto done;
3195    }
3196
3197    for (i = 0; i < new_reftable_size; i++) {
3198        cpu_to_be64s(&new_reftable[i]);
3199    }
3200
3201    ret = bdrv_pwrite(bs->file, new_reftable_offset, new_reftable,
3202                      new_reftable_size * sizeof(uint64_t));
3203
3204    for (i = 0; i < new_reftable_size; i++) {
3205        be64_to_cpus(&new_reftable[i]);
3206    }
3207
3208    if (ret < 0) {
3209        error_setg_errno(errp, -ret, "Failed to write the new reftable");
3210        goto done;
3211    }
3212
3213
3214    /* Empty the refcount cache */
3215    ret = qcow2_cache_flush(bs, s->refcount_block_cache);
3216    if (ret < 0) {
3217        error_setg_errno(errp, -ret, "Failed to flush the refblock cache");
3218        goto done;
3219    }
3220
3221    /* Update the image header to point to the new reftable; this only updates
3222     * the fields which are relevant to qcow2_update_header(); other fields
3223     * such as s->refcount_table or s->refcount_bits stay stale for now
3224     * (because we have to restore everything if qcow2_update_header() fails) */
3225    old_refcount_order  = s->refcount_order;
3226    old_reftable_size   = s->refcount_table_size;
3227    old_reftable_offset = s->refcount_table_offset;
3228
3229    s->refcount_order        = refcount_order;
3230    s->refcount_table_size   = new_reftable_size;
3231    s->refcount_table_offset = new_reftable_offset;
3232
3233    ret = qcow2_update_header(bs);
3234    if (ret < 0) {
3235        s->refcount_order        = old_refcount_order;
3236        s->refcount_table_size   = old_reftable_size;
3237        s->refcount_table_offset = old_reftable_offset;
3238        error_setg_errno(errp, -ret, "Failed to update the qcow2 header");
3239        goto done;
3240    }
3241
3242    /* Now update the rest of the in-memory information */
3243    old_reftable = s->refcount_table;
3244    s->refcount_table = new_reftable;
3245    update_max_refcount_table_index(s);
3246
3247    s->refcount_bits = 1 << refcount_order;
3248    s->refcount_max = UINT64_C(1) << (s->refcount_bits - 1);
3249    s->refcount_max += s->refcount_max - 1;
3250
3251    s->refcount_block_bits = s->cluster_bits - (refcount_order - 3);
3252    s->refcount_block_size = 1 << s->refcount_block_bits;
3253
3254    s->get_refcount = new_get_refcount;
3255    s->set_refcount = new_set_refcount;
3256
3257    /* For cleaning up all old refblocks and the old reftable below the "done"
3258     * label */
3259    new_reftable        = old_reftable;
3260    new_reftable_size   = old_reftable_size;
3261    new_reftable_offset = old_reftable_offset;
3262
3263done:
3264    if (new_reftable) {
3265        /* On success, new_reftable actually points to the old reftable (and
3266         * new_reftable_size is the old reftable's size); but that is just
3267         * fine */
3268        for (i = 0; i < new_reftable_size; i++) {
3269            uint64_t offset = new_reftable[i] & REFT_OFFSET_MASK;
3270            if (offset) {
3271                qcow2_free_clusters(bs, offset, s->cluster_size,
3272                                    QCOW2_DISCARD_OTHER);
3273            }
3274        }
3275        g_free(new_reftable);
3276
3277        if (new_reftable_offset > 0) {
3278            qcow2_free_clusters(bs, new_reftable_offset,
3279                                new_reftable_size * sizeof(uint64_t),
3280                                QCOW2_DISCARD_OTHER);
3281        }
3282    }
3283
3284    qemu_vfree(new_refblock);
3285    return ret;
3286}
3287
3288static int64_t get_refblock_offset(BlockDriverState *bs, uint64_t offset)
3289{
3290    BDRVQcow2State *s = bs->opaque;
3291    uint32_t index = offset_to_reftable_index(s, offset);
3292    int64_t covering_refblock_offset = 0;
3293
3294    if (index < s->refcount_table_size) {
3295        covering_refblock_offset = s->refcount_table[index] & REFT_OFFSET_MASK;
3296    }
3297    if (!covering_refblock_offset) {
3298        qcow2_signal_corruption(bs, true, -1, -1, "Refblock at %#" PRIx64 " is "
3299                                "not covered by the refcount structures",
3300                                offset);
3301        return -EIO;
3302    }
3303
3304    return covering_refblock_offset;
3305}
3306
3307static int qcow2_discard_refcount_block(BlockDriverState *bs,
3308                                        uint64_t discard_block_offs)
3309{
3310    BDRVQcow2State *s = bs->opaque;
3311    int64_t refblock_offs;
3312    uint64_t cluster_index = discard_block_offs >> s->cluster_bits;
3313    uint32_t block_index = cluster_index & (s->refcount_block_size - 1);
3314    void *refblock;
3315    int ret;
3316
3317    refblock_offs = get_refblock_offset(bs, discard_block_offs);
3318    if (refblock_offs < 0) {
3319        return refblock_offs;
3320    }
3321
3322    assert(discard_block_offs != 0);
3323
3324    ret = qcow2_cache_get(bs, s->refcount_block_cache, refblock_offs,
3325                          &refblock);
3326    if (ret < 0) {
3327        return ret;
3328    }
3329
3330    if (s->get_refcount(refblock, block_index) != 1) {
3331        qcow2_signal_corruption(bs, true, -1, -1, "Invalid refcount:"
3332                                " refblock offset %#" PRIx64
3333                                ", reftable index %u"
3334                                ", block offset %#" PRIx64
3335                                ", refcount %#" PRIx64,
3336                                refblock_offs,
3337                                offset_to_reftable_index(s, discard_block_offs),
3338                                discard_block_offs,
3339                                s->get_refcount(refblock, block_index));
3340        qcow2_cache_put(s->refcount_block_cache, &refblock);
3341        return -EINVAL;
3342    }
3343    s->set_refcount(refblock, block_index, 0);
3344
3345    qcow2_cache_entry_mark_dirty(s->refcount_block_cache, refblock);
3346
3347    qcow2_cache_put(s->refcount_block_cache, &refblock);
3348
3349    if (cluster_index < s->free_cluster_index) {
3350        s->free_cluster_index = cluster_index;
3351    }
3352
3353    refblock = qcow2_cache_is_table_offset(s->refcount_block_cache,
3354                                           discard_block_offs);
3355    if (refblock) {
3356        /* discard refblock from the cache if refblock is cached */
3357        qcow2_cache_discard(s->refcount_block_cache, refblock);
3358    }
3359    update_refcount_discard(bs, discard_block_offs, s->cluster_size);
3360
3361    return 0;
3362}
3363
3364int qcow2_shrink_reftable(BlockDriverState *bs)
3365{
3366    BDRVQcow2State *s = bs->opaque;
3367    uint64_t *reftable_tmp =
3368        g_malloc(s->refcount_table_size * sizeof(uint64_t));
3369    int i, ret;
3370
3371    for (i = 0; i < s->refcount_table_size; i++) {
3372        int64_t refblock_offs = s->refcount_table[i] & REFT_OFFSET_MASK;
3373        void *refblock;
3374        bool unused_block;
3375
3376        if (refblock_offs == 0) {
3377            reftable_tmp[i] = 0;
3378            continue;
3379        }
3380        ret = qcow2_cache_get(bs, s->refcount_block_cache, refblock_offs,
3381                              &refblock);
3382        if (ret < 0) {
3383            goto out;
3384        }
3385
3386        /* the refblock has own reference */
3387        if (i == offset_to_reftable_index(s, refblock_offs)) {
3388            uint64_t block_index = (refblock_offs >> s->cluster_bits) &
3389                                   (s->refcount_block_size - 1);
3390            uint64_t refcount = s->get_refcount(refblock, block_index);
3391
3392            s->set_refcount(refblock, block_index, 0);
3393
3394            unused_block = buffer_is_zero(refblock, s->cluster_size);
3395
3396            s->set_refcount(refblock, block_index, refcount);
3397        } else {
3398            unused_block = buffer_is_zero(refblock, s->cluster_size);
3399        }
3400        qcow2_cache_put(s->refcount_block_cache, &refblock);
3401
3402        reftable_tmp[i] = unused_block ? 0 : cpu_to_be64(s->refcount_table[i]);
3403    }
3404
3405    ret = bdrv_pwrite_sync(bs->file, s->refcount_table_offset, reftable_tmp,
3406                           s->refcount_table_size * sizeof(uint64_t));
3407    /*
3408     * If the write in the reftable failed the image may contain a partially
3409     * overwritten reftable. In this case it would be better to clear the
3410     * reftable in memory to avoid possible image corruption.
3411     */
3412    for (i = 0; i < s->refcount_table_size; i++) {
3413        if (s->refcount_table[i] && !reftable_tmp[i]) {
3414            if (ret == 0) {
3415                ret = qcow2_discard_refcount_block(bs, s->refcount_table[i] &
3416                                                       REFT_OFFSET_MASK);
3417            }
3418            s->refcount_table[i] = 0;
3419        }
3420    }
3421
3422    if (!s->cache_discards) {
3423        qcow2_process_discards(bs, ret);
3424    }
3425
3426out:
3427    g_free(reftable_tmp);
3428    return ret;
3429}
3430
3431int64_t qcow2_get_last_cluster(BlockDriverState *bs, int64_t size)
3432{
3433    BDRVQcow2State *s = bs->opaque;
3434    int64_t i;
3435
3436    for (i = size_to_clusters(s, size) - 1; i >= 0; i--) {
3437        uint64_t refcount;
3438        int ret = qcow2_get_refcount(bs, i, &refcount);
3439        if (ret < 0) {
3440            fprintf(stderr, "Can't get refcount for cluster %" PRId64 ": %s\n",
3441                    i, strerror(-ret));
3442            return ret;
3443        }
3444        if (refcount > 0) {
3445            return i;
3446        }
3447    }
3448    qcow2_signal_corruption(bs, true, -1, -1,
3449                            "There are no references in the refcount table.");
3450    return -EIO;
3451}
3452
3453int qcow2_detect_metadata_preallocation(BlockDriverState *bs)
3454{
3455    BDRVQcow2State *s = bs->opaque;
3456    int64_t i, end_cluster, cluster_count = 0, threshold;
3457    int64_t file_length, real_allocation, real_clusters;
3458
3459    qemu_co_mutex_assert_locked(&s->lock);
3460
3461    file_length = bdrv_getlength(bs->file->bs);
3462    if (file_length < 0) {
3463        return file_length;
3464    }
3465
3466    real_allocation = bdrv_get_allocated_file_size(bs->file->bs);
3467    if (real_allocation < 0) {
3468        return real_allocation;
3469    }
3470
3471    real_clusters = real_allocation / s->cluster_size;
3472    threshold = MAX(real_clusters * 10 / 9, real_clusters + 2);
3473
3474    end_cluster = size_to_clusters(s, file_length);
3475    for (i = 0; i < end_cluster && cluster_count < threshold; i++) {
3476        uint64_t refcount;
3477        int ret = qcow2_get_refcount(bs, i, &refcount);
3478        if (ret < 0) {
3479            return ret;
3480        }
3481        cluster_count += !!refcount;
3482    }
3483
3484    return cluster_count >= threshold;
3485}
3486