2 * Block driver for the QCOW version 2 format
4 * Copyright (c) 2004-2006 Fabrice Bellard
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
24 #include "qemu-common.h"
25 #include "block_int.h"
31 Differences with QCOW:
33 - Support for multiple incremental snapshots.
34 - Memory management by reference counts.
35 - Clusters which have a reference count of one have the bit
36 QCOW_OFLAG_COPIED to optimize write performance.
37 - Size of compressed clusters is stored in sectors to reduce bit usage
38 in the cluster offsets.
39 - Support for storing additional data (such as the VM state) in the
41 - If a backing store is used, the cluster size is not constrained
42 (could be backported to QCOW).
43 - L2 tables have always a size of one cluster.
47 //#define DEBUG_ALLOC2
50 #define QCOW_MAGIC (('Q' << 24) | ('F' << 16) | ('I' << 8) | 0xfb)
51 #define QCOW_VERSION 2
53 #define QCOW_CRYPT_NONE 0
54 #define QCOW_CRYPT_AES 1
56 #define QCOW_MAX_CRYPT_CLUSTERS 32
58 /* indicate that the refcount of the referenced cluster is exactly one. */
59 #define QCOW_OFLAG_COPIED (1LL << 63)
60 /* indicate that the cluster is compressed (they never have the copied flag) */
61 #define QCOW_OFLAG_COMPRESSED (1LL << 62)
63 #define REFCOUNT_SHIFT 1 /* refcount size is 2 bytes */
65 #define MIN_CLUSTER_BITS 9
66 #define MAX_CLUSTER_BITS 16
68 typedef struct QCowHeader {
71 uint64_t backing_file_offset;
72 uint32_t backing_file_size;
73 uint32_t cluster_bits;
74 uint64_t size; /* in bytes */
75 uint32_t crypt_method;
76 uint32_t l1_size; /* XXX: save number of clusters instead ? */
77 uint64_t l1_table_offset;
78 uint64_t refcount_table_offset;
79 uint32_t refcount_table_clusters;
80 uint32_t nb_snapshots;
81 uint64_t snapshots_offset;
89 #define QCOW_EXT_MAGIC_END 0
90 #define QCOW_EXT_MAGIC_BACKING_FORMAT 0xE2792ACA
93 typedef struct __attribute__((packed)) QCowSnapshotHeader {
94 /* header is 8 byte aligned */
95 uint64_t l1_table_offset;
104 uint64_t vm_clock_nsec;
106 uint32_t vm_state_size;
107 uint32_t extra_data_size; /* for extension */
108 /* extra data follows */
111 } QCowSnapshotHeader;
113 #define L2_CACHE_SIZE 16
115 typedef struct QCowSnapshot {
116 uint64_t l1_table_offset;
120 uint32_t vm_state_size;
123 uint64_t vm_clock_nsec;
126 typedef struct BDRVQcowState {
127 BlockDriverState *hd;
134 int l1_vm_state_index;
137 uint64_t cluster_offset_mask;
138 uint64_t l1_table_offset;
141 uint64_t l2_cache_offsets[L2_CACHE_SIZE];
142 uint32_t l2_cache_counts[L2_CACHE_SIZE];
143 uint8_t *cluster_cache;
144 uint8_t *cluster_data;
145 uint64_t cluster_cache_offset;
147 uint64_t *refcount_table;
148 uint64_t refcount_table_offset;
149 uint32_t refcount_table_size;
150 uint64_t refcount_block_cache_offset;
151 uint16_t *refcount_block_cache;
152 int64_t free_cluster_index;
153 int64_t free_byte_offset;
155 uint32_t crypt_method; /* current crypt method, 0 if no key yet */
156 uint32_t crypt_method_header;
157 AES_KEY aes_encrypt_key;
158 AES_KEY aes_decrypt_key;
159 uint64_t snapshots_offset;
162 QCowSnapshot *snapshots;
165 static int decompress_cluster(BDRVQcowState *s, uint64_t cluster_offset);
166 static int qcow_read(BlockDriverState *bs, int64_t sector_num,
167 uint8_t *buf, int nb_sectors);
168 static int qcow_read_snapshots(BlockDriverState *bs);
169 static void qcow_free_snapshots(BlockDriverState *bs);
170 static int refcount_init(BlockDriverState *bs);
171 static void refcount_close(BlockDriverState *bs);
172 static int get_refcount(BlockDriverState *bs, int64_t cluster_index);
173 static int update_cluster_refcount(BlockDriverState *bs,
174 int64_t cluster_index,
176 static int update_refcount(BlockDriverState *bs,
177 int64_t offset, int64_t length,
179 static int64_t alloc_clusters(BlockDriverState *bs, int64_t size);
180 static int64_t alloc_bytes(BlockDriverState *bs, int size);
181 static void free_clusters(BlockDriverState *bs,
182 int64_t offset, int64_t size);
183 static int check_refcounts(BlockDriverState *bs);
185 static int qcow_probe(const uint8_t *buf, int buf_size, const char *filename)
187 const QCowHeader *cow_header = (const void *)buf;
189 if (buf_size >= sizeof(QCowHeader) &&
190 be32_to_cpu(cow_header->magic) == QCOW_MAGIC &&
191 be32_to_cpu(cow_header->version) == QCOW_VERSION)
199 * read qcow2 extension and fill bs
200 * start reading from start_offset
201 * finish reading upon magic of value 0 or when end_offset reached
202 * unknown magic is skipped (future extension this version knows nothing about)
203 * return 0 upon success, non-0 otherwise
205 static int qcow_read_extensions(BlockDriverState *bs, uint64_t start_offset,
208 BDRVQcowState *s = bs->opaque;
213 printf("qcow_read_extensions: start=%ld end=%ld\n", start_offset, end_offset);
215 offset = start_offset;
216 while (offset < end_offset) {
220 if (offset > s->cluster_size)
221 printf("qcow_handle_extension: suspicious offset %lu\n", offset);
223 printf("attemting to read extended header in offset %lu\n", offset);
226 if (bdrv_pread(s->hd, offset, &ext, sizeof(ext)) != sizeof(ext)) {
227 fprintf(stderr, "qcow_handle_extension: ERROR: pread fail from offset %llu\n",
228 (unsigned long long)offset);
231 be32_to_cpus(&ext.magic);
232 be32_to_cpus(&ext.len);
233 offset += sizeof(ext);
235 printf("ext.magic = 0x%x\n", ext.magic);
238 case QCOW_EXT_MAGIC_END:
241 case QCOW_EXT_MAGIC_BACKING_FORMAT:
242 if (ext.len >= sizeof(bs->backing_format)) {
243 fprintf(stderr, "ERROR: ext_backing_format: len=%u too large"
245 ext.len, sizeof(bs->backing_format));
248 if (bdrv_pread(s->hd, offset , bs->backing_format,
251 bs->backing_format[ext.len] = '\0';
253 printf("Qcow2: Got format extension %s\n", bs->backing_format);
255 offset += ((ext.len + 7) & ~7);
259 /* unknown magic -- just skip it */
260 offset += ((ext.len + 7) & ~7);
269 static int qcow_open(BlockDriverState *bs, const char *filename, int flags)
271 BDRVQcowState *s = bs->opaque;
272 int len, i, shift, ret;
276 /* Performance is terrible right now with cache=writethrough due mainly
277 * to reference count updates. If the user does not explicitly specify
278 * a caching type, force to writeback caching.
280 if ((flags & BDRV_O_CACHE_DEF)) {
281 flags |= BDRV_O_CACHE_WB;
282 flags &= ~BDRV_O_CACHE_DEF;
284 ret = bdrv_file_open(&s->hd, filename, flags);
287 if (bdrv_pread(s->hd, 0, &header, sizeof(header)) != sizeof(header))
289 be32_to_cpus(&header.magic);
290 be32_to_cpus(&header.version);
291 be64_to_cpus(&header.backing_file_offset);
292 be32_to_cpus(&header.backing_file_size);
293 be64_to_cpus(&header.size);
294 be32_to_cpus(&header.cluster_bits);
295 be32_to_cpus(&header.crypt_method);
296 be64_to_cpus(&header.l1_table_offset);
297 be32_to_cpus(&header.l1_size);
298 be64_to_cpus(&header.refcount_table_offset);
299 be32_to_cpus(&header.refcount_table_clusters);
300 be64_to_cpus(&header.snapshots_offset);
301 be32_to_cpus(&header.nb_snapshots);
303 if (header.magic != QCOW_MAGIC || header.version != QCOW_VERSION)
305 if (header.size <= 1 ||
306 header.cluster_bits < MIN_CLUSTER_BITS ||
307 header.cluster_bits > MAX_CLUSTER_BITS)
309 if (header.crypt_method > QCOW_CRYPT_AES)
311 s->crypt_method_header = header.crypt_method;
312 if (s->crypt_method_header)
314 s->cluster_bits = header.cluster_bits;
315 s->cluster_size = 1 << s->cluster_bits;
316 s->cluster_sectors = 1 << (s->cluster_bits - 9);
317 s->l2_bits = s->cluster_bits - 3; /* L2 is always one cluster */
318 s->l2_size = 1 << s->l2_bits;
319 bs->total_sectors = header.size / 512;
320 s->csize_shift = (62 - (s->cluster_bits - 8));
321 s->csize_mask = (1 << (s->cluster_bits - 8)) - 1;
322 s->cluster_offset_mask = (1LL << s->csize_shift) - 1;
323 s->refcount_table_offset = header.refcount_table_offset;
324 s->refcount_table_size =
325 header.refcount_table_clusters << (s->cluster_bits - 3);
327 s->snapshots_offset = header.snapshots_offset;
328 s->nb_snapshots = header.nb_snapshots;
330 /* read the level 1 table */
331 s->l1_size = header.l1_size;
332 shift = s->cluster_bits + s->l2_bits;
333 s->l1_vm_state_index = (header.size + (1LL << shift) - 1) >> shift;
334 /* the L1 table must contain at least enough entries to put
336 if (s->l1_size < s->l1_vm_state_index)
338 s->l1_table_offset = header.l1_table_offset;
339 s->l1_table = qemu_malloc(s->l1_size * sizeof(uint64_t));
340 if (bdrv_pread(s->hd, s->l1_table_offset, s->l1_table, s->l1_size * sizeof(uint64_t)) !=
341 s->l1_size * sizeof(uint64_t))
343 for(i = 0;i < s->l1_size; i++) {
344 be64_to_cpus(&s->l1_table[i]);
347 s->l2_cache = qemu_malloc(s->l2_size * L2_CACHE_SIZE * sizeof(uint64_t));
348 s->cluster_cache = qemu_malloc(s->cluster_size);
349 /* one more sector for decompressed data alignment */
350 s->cluster_data = qemu_malloc(QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size
352 s->cluster_cache_offset = -1;
354 if (refcount_init(bs) < 0)
357 /* read qcow2 extensions */
358 if (header.backing_file_offset)
359 ext_end = header.backing_file_offset;
361 ext_end = s->cluster_size;
362 if (qcow_read_extensions(bs, sizeof(header), ext_end))
365 /* read the backing file name */
366 if (header.backing_file_offset != 0) {
367 len = header.backing_file_size;
370 if (bdrv_pread(s->hd, header.backing_file_offset, bs->backing_file, len) != len)
372 bs->backing_file[len] = '\0';
374 if (qcow_read_snapshots(bs) < 0)
383 qcow_free_snapshots(bs);
385 qemu_free(s->l1_table);
386 qemu_free(s->l2_cache);
387 qemu_free(s->cluster_cache);
388 qemu_free(s->cluster_data);
393 static int qcow_set_key(BlockDriverState *bs, const char *key)
395 BDRVQcowState *s = bs->opaque;
399 memset(keybuf, 0, 16);
403 /* XXX: we could compress the chars to 7 bits to increase
405 for(i = 0;i < len;i++) {
408 s->crypt_method = s->crypt_method_header;
410 if (AES_set_encrypt_key(keybuf, 128, &s->aes_encrypt_key) != 0)
412 if (AES_set_decrypt_key(keybuf, 128, &s->aes_decrypt_key) != 0)
422 AES_encrypt(in, tmp, &s->aes_encrypt_key);
423 AES_decrypt(tmp, out, &s->aes_decrypt_key);
424 for(i = 0; i < 16; i++)
425 printf(" %02x", tmp[i]);
427 for(i = 0; i < 16; i++)
428 printf(" %02x", out[i]);
435 /* The crypt function is compatible with the linux cryptoloop
436 algorithm for < 4 GB images. NOTE: out_buf == in_buf is
438 static void encrypt_sectors(BDRVQcowState *s, int64_t sector_num,
439 uint8_t *out_buf, const uint8_t *in_buf,
440 int nb_sectors, int enc,
449 for(i = 0; i < nb_sectors; i++) {
450 ivec.ll[0] = cpu_to_le64(sector_num);
452 AES_cbc_encrypt(in_buf, out_buf, 512, key,
460 static int copy_sectors(BlockDriverState *bs, uint64_t start_sect,
461 uint64_t cluster_offset, int n_start, int n_end)
463 BDRVQcowState *s = bs->opaque;
469 ret = qcow_read(bs, start_sect + n_start, s->cluster_data, n);
472 if (s->crypt_method) {
473 encrypt_sectors(s, start_sect + n_start,
475 s->cluster_data, n, 1,
476 &s->aes_encrypt_key);
478 ret = bdrv_write(s->hd, (cluster_offset >> 9) + n_start,
485 static void l2_cache_reset(BlockDriverState *bs)
487 BDRVQcowState *s = bs->opaque;
489 memset(s->l2_cache, 0, s->l2_size * L2_CACHE_SIZE * sizeof(uint64_t));
490 memset(s->l2_cache_offsets, 0, L2_CACHE_SIZE * sizeof(uint64_t));
491 memset(s->l2_cache_counts, 0, L2_CACHE_SIZE * sizeof(uint32_t));
494 static inline int l2_cache_new_entry(BlockDriverState *bs)
496 BDRVQcowState *s = bs->opaque;
500 /* find a new entry in the least used one */
502 min_count = 0xffffffff;
503 for(i = 0; i < L2_CACHE_SIZE; i++) {
504 if (s->l2_cache_counts[i] < min_count) {
505 min_count = s->l2_cache_counts[i];
512 static int64_t align_offset(int64_t offset, int n)
514 offset = (offset + n - 1) & ~(n - 1);
518 static int grow_l1_table(BlockDriverState *bs, int min_size)
520 BDRVQcowState *s = bs->opaque;
521 int new_l1_size, new_l1_size2, ret, i;
522 uint64_t *new_l1_table;
523 uint64_t new_l1_table_offset;
526 new_l1_size = s->l1_size;
527 if (min_size <= new_l1_size)
529 while (min_size > new_l1_size) {
530 new_l1_size = (new_l1_size * 3 + 1) / 2;
533 printf("grow l1_table from %d to %d\n", s->l1_size, new_l1_size);
536 new_l1_size2 = sizeof(uint64_t) * new_l1_size;
537 new_l1_table = qemu_mallocz(new_l1_size2);
538 memcpy(new_l1_table, s->l1_table, s->l1_size * sizeof(uint64_t));
540 /* write new table (align to cluster) */
541 new_l1_table_offset = alloc_clusters(bs, new_l1_size2);
543 for(i = 0; i < s->l1_size; i++)
544 new_l1_table[i] = cpu_to_be64(new_l1_table[i]);
545 ret = bdrv_pwrite(s->hd, new_l1_table_offset, new_l1_table, new_l1_size2);
546 if (ret != new_l1_size2)
548 for(i = 0; i < s->l1_size; i++)
549 new_l1_table[i] = be64_to_cpu(new_l1_table[i]);
552 cpu_to_be32w((uint32_t*)data, new_l1_size);
553 cpu_to_be64w((uint64_t*)(data + 4), new_l1_table_offset);
554 if (bdrv_pwrite(s->hd, offsetof(QCowHeader, l1_size), data,
555 sizeof(data)) != sizeof(data))
557 qemu_free(s->l1_table);
558 free_clusters(bs, s->l1_table_offset, s->l1_size * sizeof(uint64_t));
559 s->l1_table_offset = new_l1_table_offset;
560 s->l1_table = new_l1_table;
561 s->l1_size = new_l1_size;
564 qemu_free(s->l1_table);
571 * seek l2_offset in the l2_cache table
572 * if not found, return NULL,
574 * increments the l2 cache hit count of the entry,
575 * if counter overflow, divide by two all counters
576 * return the pointer to the l2 cache entry
580 static uint64_t *seek_l2_table(BDRVQcowState *s, uint64_t l2_offset)
584 for(i = 0; i < L2_CACHE_SIZE; i++) {
585 if (l2_offset == s->l2_cache_offsets[i]) {
586 /* increment the hit count */
587 if (++s->l2_cache_counts[i] == 0xffffffff) {
588 for(j = 0; j < L2_CACHE_SIZE; j++) {
589 s->l2_cache_counts[j] >>= 1;
592 return s->l2_cache + (i << s->l2_bits);
601 * Loads a L2 table into memory. If the table is in the cache, the cache
602 * is used; otherwise the L2 table is loaded from the image file.
604 * Returns a pointer to the L2 table on success, or NULL if the read from
605 * the image file failed.
608 static uint64_t *l2_load(BlockDriverState *bs, uint64_t l2_offset)
610 BDRVQcowState *s = bs->opaque;
614 /* seek if the table for the given offset is in the cache */
616 l2_table = seek_l2_table(s, l2_offset);
617 if (l2_table != NULL)
620 /* not found: load a new entry in the least used one */
622 min_index = l2_cache_new_entry(bs);
623 l2_table = s->l2_cache + (min_index << s->l2_bits);
624 if (bdrv_pread(s->hd, l2_offset, l2_table, s->l2_size * sizeof(uint64_t)) !=
625 s->l2_size * sizeof(uint64_t))
627 s->l2_cache_offsets[min_index] = l2_offset;
628 s->l2_cache_counts[min_index] = 1;
636 * Allocate a new l2 entry in the file. If l1_index points to an already
637 * used entry in the L2 table (i.e. we are doing a copy on write for the L2
638 * table) copy the contents of the old L2 table into the newly allocated one.
639 * Otherwise the new table is initialized with zeros.
643 static uint64_t *l2_allocate(BlockDriverState *bs, int l1_index)
645 BDRVQcowState *s = bs->opaque;
647 uint64_t old_l2_offset, tmp;
648 uint64_t *l2_table, l2_offset;
650 old_l2_offset = s->l1_table[l1_index];
652 /* allocate a new l2 entry */
654 l2_offset = alloc_clusters(bs, s->l2_size * sizeof(uint64_t));
656 /* update the L1 entry */
658 s->l1_table[l1_index] = l2_offset | QCOW_OFLAG_COPIED;
660 tmp = cpu_to_be64(l2_offset | QCOW_OFLAG_COPIED);
661 if (bdrv_pwrite(s->hd, s->l1_table_offset + l1_index * sizeof(tmp),
662 &tmp, sizeof(tmp)) != sizeof(tmp))
665 /* allocate a new entry in the l2 cache */
667 min_index = l2_cache_new_entry(bs);
668 l2_table = s->l2_cache + (min_index << s->l2_bits);
670 if (old_l2_offset == 0) {
671 /* if there was no old l2 table, clear the new table */
672 memset(l2_table, 0, s->l2_size * sizeof(uint64_t));
674 /* if there was an old l2 table, read it from the disk */
675 if (bdrv_pread(s->hd, old_l2_offset,
676 l2_table, s->l2_size * sizeof(uint64_t)) !=
677 s->l2_size * sizeof(uint64_t))
680 /* write the l2 table to the file */
681 if (bdrv_pwrite(s->hd, l2_offset,
682 l2_table, s->l2_size * sizeof(uint64_t)) !=
683 s->l2_size * sizeof(uint64_t))
686 /* update the l2 cache entry */
688 s->l2_cache_offsets[min_index] = l2_offset;
689 s->l2_cache_counts[min_index] = 1;
694 static int size_to_clusters(BDRVQcowState *s, int64_t size)
696 return (size + (s->cluster_size - 1)) >> s->cluster_bits;
699 static int count_contiguous_clusters(uint64_t nb_clusters, int cluster_size,
700 uint64_t *l2_table, uint64_t start, uint64_t mask)
703 uint64_t offset = be64_to_cpu(l2_table[0]) & ~mask;
708 for (i = start; i < start + nb_clusters; i++)
709 if (offset + i * cluster_size != (be64_to_cpu(l2_table[i]) & ~mask))
715 static int count_contiguous_free_clusters(uint64_t nb_clusters, uint64_t *l2_table)
719 while(nb_clusters-- && l2_table[i] == 0)
728 * For a given offset of the disk image, return cluster offset in
731 * on entry, *num is the number of contiguous clusters we'd like to
732 * access following offset.
734 * on exit, *num is the number of contiguous clusters we can read.
736 * Return 1, if the offset is found
737 * Return 0, otherwise.
741 static uint64_t get_cluster_offset(BlockDriverState *bs,
742 uint64_t offset, int *num)
744 BDRVQcowState *s = bs->opaque;
745 int l1_index, l2_index;
746 uint64_t l2_offset, *l2_table, cluster_offset;
748 int index_in_cluster, nb_available, nb_needed, nb_clusters;
750 index_in_cluster = (offset >> 9) & (s->cluster_sectors - 1);
751 nb_needed = *num + index_in_cluster;
753 l1_bits = s->l2_bits + s->cluster_bits;
755 /* compute how many bytes there are between the offset and
756 * the end of the l1 entry
759 nb_available = (1 << l1_bits) - (offset & ((1 << l1_bits) - 1));
761 /* compute the number of available sectors */
763 nb_available = (nb_available >> 9) + index_in_cluster;
765 if (nb_needed > nb_available) {
766 nb_needed = nb_available;
771 /* seek the the l2 offset in the l1 table */
773 l1_index = offset >> l1_bits;
774 if (l1_index >= s->l1_size)
777 l2_offset = s->l1_table[l1_index];
779 /* seek the l2 table of the given l2 offset */
784 /* load the l2 table in memory */
786 l2_offset &= ~QCOW_OFLAG_COPIED;
787 l2_table = l2_load(bs, l2_offset);
788 if (l2_table == NULL)
791 /* find the cluster offset for the given disk offset */
793 l2_index = (offset >> s->cluster_bits) & (s->l2_size - 1);
794 cluster_offset = be64_to_cpu(l2_table[l2_index]);
795 nb_clusters = size_to_clusters(s, nb_needed << 9);
797 if (!cluster_offset) {
798 /* how many empty clusters ? */
799 c = count_contiguous_free_clusters(nb_clusters, &l2_table[l2_index]);
801 /* how many allocated clusters ? */
802 c = count_contiguous_clusters(nb_clusters, s->cluster_size,
803 &l2_table[l2_index], 0, QCOW_OFLAG_COPIED);
806 nb_available = (c * s->cluster_sectors);
808 if (nb_available > nb_needed)
809 nb_available = nb_needed;
811 *num = nb_available - index_in_cluster;
813 return cluster_offset & ~QCOW_OFLAG_COPIED;
819 * free clusters according to its type: compressed or not
823 static void free_any_clusters(BlockDriverState *bs,
824 uint64_t cluster_offset, int nb_clusters)
826 BDRVQcowState *s = bs->opaque;
828 /* free the cluster */
830 if (cluster_offset & QCOW_OFLAG_COMPRESSED) {
832 nb_csectors = ((cluster_offset >> s->csize_shift) &
834 free_clusters(bs, (cluster_offset & s->cluster_offset_mask) & ~511,
839 free_clusters(bs, cluster_offset, nb_clusters << s->cluster_bits);
847 * for a given disk offset, load (and allocate if needed)
850 * the l2 table offset in the qcow2 file and the cluster index
851 * in the l2 table are given to the caller.
855 static int get_cluster_table(BlockDriverState *bs, uint64_t offset,
856 uint64_t **new_l2_table,
857 uint64_t *new_l2_offset,
860 BDRVQcowState *s = bs->opaque;
861 int l1_index, l2_index, ret;
862 uint64_t l2_offset, *l2_table;
864 /* seek the the l2 offset in the l1 table */
866 l1_index = offset >> (s->l2_bits + s->cluster_bits);
867 if (l1_index >= s->l1_size) {
868 ret = grow_l1_table(bs, l1_index + 1);
872 l2_offset = s->l1_table[l1_index];
874 /* seek the l2 table of the given l2 offset */
876 if (l2_offset & QCOW_OFLAG_COPIED) {
877 /* load the l2 table in memory */
878 l2_offset &= ~QCOW_OFLAG_COPIED;
879 l2_table = l2_load(bs, l2_offset);
880 if (l2_table == NULL)
884 free_clusters(bs, l2_offset, s->l2_size * sizeof(uint64_t));
885 l2_table = l2_allocate(bs, l1_index);
886 if (l2_table == NULL)
888 l2_offset = s->l1_table[l1_index] & ~QCOW_OFLAG_COPIED;
891 /* find the cluster offset for the given disk offset */
893 l2_index = (offset >> s->cluster_bits) & (s->l2_size - 1);
895 *new_l2_table = l2_table;
896 *new_l2_offset = l2_offset;
897 *new_l2_index = l2_index;
903 * alloc_compressed_cluster_offset
905 * For a given offset of the disk image, return cluster offset in
908 * If the offset is not found, allocate a new compressed cluster.
910 * Return the cluster offset if successful,
911 * Return 0, otherwise.
915 static uint64_t alloc_compressed_cluster_offset(BlockDriverState *bs,
919 BDRVQcowState *s = bs->opaque;
921 uint64_t l2_offset, *l2_table, cluster_offset;
924 ret = get_cluster_table(bs, offset, &l2_table, &l2_offset, &l2_index);
928 cluster_offset = be64_to_cpu(l2_table[l2_index]);
929 if (cluster_offset & QCOW_OFLAG_COPIED)
930 return cluster_offset & ~QCOW_OFLAG_COPIED;
933 free_any_clusters(bs, cluster_offset, 1);
935 cluster_offset = alloc_bytes(bs, compressed_size);
936 nb_csectors = ((cluster_offset + compressed_size - 1) >> 9) -
937 (cluster_offset >> 9);
939 cluster_offset |= QCOW_OFLAG_COMPRESSED |
940 ((uint64_t)nb_csectors << s->csize_shift);
942 /* update L2 table */
944 /* compressed clusters never have the copied flag */
946 l2_table[l2_index] = cpu_to_be64(cluster_offset);
947 if (bdrv_pwrite(s->hd,
948 l2_offset + l2_index * sizeof(uint64_t),
950 sizeof(uint64_t)) != sizeof(uint64_t))
953 return cluster_offset;
956 typedef struct QCowL2Meta
964 static int alloc_cluster_link_l2(BlockDriverState *bs, uint64_t cluster_offset,
967 BDRVQcowState *s = bs->opaque;
968 int i, j = 0, l2_index, ret;
969 uint64_t *old_cluster, start_sect, l2_offset, *l2_table;
971 if (m->nb_clusters == 0)
974 old_cluster = qemu_malloc(m->nb_clusters * sizeof(uint64_t));
976 /* copy content of unmodified sectors */
977 start_sect = (m->offset & ~(s->cluster_size - 1)) >> 9;
979 ret = copy_sectors(bs, start_sect, cluster_offset, 0, m->n_start);
984 if (m->nb_available & (s->cluster_sectors - 1)) {
985 uint64_t end = m->nb_available & ~(uint64_t)(s->cluster_sectors - 1);
986 ret = copy_sectors(bs, start_sect + end, cluster_offset + (end << 9),
987 m->nb_available - end, s->cluster_sectors);
993 /* update L2 table */
994 if (!get_cluster_table(bs, m->offset, &l2_table, &l2_offset, &l2_index))
997 for (i = 0; i < m->nb_clusters; i++) {
998 /* if two concurrent writes happen to the same unallocated cluster
999 * each write allocates separate cluster and writes data concurrently.
1000 * The first one to complete updates l2 table with pointer to its
1001 * cluster the second one has to do RMW (which is done above by
1002 * copy_sectors()), update l2 table with its cluster pointer and free
1003 * old cluster. This is what this loop does */
1004 if(l2_table[l2_index + i] != 0)
1005 old_cluster[j++] = l2_table[l2_index + i];
1007 l2_table[l2_index + i] = cpu_to_be64((cluster_offset +
1008 (i << s->cluster_bits)) | QCOW_OFLAG_COPIED);
1011 if (bdrv_pwrite(s->hd, l2_offset + l2_index * sizeof(uint64_t),
1012 l2_table + l2_index, m->nb_clusters * sizeof(uint64_t)) !=
1013 m->nb_clusters * sizeof(uint64_t))
1016 for (i = 0; i < j; i++)
1017 free_any_clusters(bs, be64_to_cpu(old_cluster[i]) & ~QCOW_OFLAG_COPIED,
1022 qemu_free(old_cluster);
1027 * alloc_cluster_offset
1029 * For a given offset of the disk image, return cluster offset in
1032 * If the offset is not found, allocate a new cluster.
1034 * Return the cluster offset if successful,
1035 * Return 0, otherwise.
1039 static uint64_t alloc_cluster_offset(BlockDriverState *bs,
1041 int n_start, int n_end,
1042 int *num, QCowL2Meta *m)
1044 BDRVQcowState *s = bs->opaque;
1046 uint64_t l2_offset, *l2_table, cluster_offset;
1047 int nb_clusters, i = 0;
1049 ret = get_cluster_table(bs, offset, &l2_table, &l2_offset, &l2_index);
1053 nb_clusters = size_to_clusters(s, n_end << 9);
1055 nb_clusters = MIN(nb_clusters, s->l2_size - l2_index);
1057 cluster_offset = be64_to_cpu(l2_table[l2_index]);
1059 /* We keep all QCOW_OFLAG_COPIED clusters */
1061 if (cluster_offset & QCOW_OFLAG_COPIED) {
1062 nb_clusters = count_contiguous_clusters(nb_clusters, s->cluster_size,
1063 &l2_table[l2_index], 0, 0);
1065 cluster_offset &= ~QCOW_OFLAG_COPIED;
1071 /* for the moment, multiple compressed clusters are not managed */
1073 if (cluster_offset & QCOW_OFLAG_COMPRESSED)
1076 /* how many available clusters ? */
1078 while (i < nb_clusters) {
1079 i += count_contiguous_clusters(nb_clusters - i, s->cluster_size,
1080 &l2_table[l2_index], i, 0);
1082 if(be64_to_cpu(l2_table[l2_index + i]))
1085 i += count_contiguous_free_clusters(nb_clusters - i,
1086 &l2_table[l2_index + i]);
1088 cluster_offset = be64_to_cpu(l2_table[l2_index + i]);
1090 if ((cluster_offset & QCOW_OFLAG_COPIED) ||
1091 (cluster_offset & QCOW_OFLAG_COMPRESSED))
1096 /* allocate a new cluster */
1098 cluster_offset = alloc_clusters(bs, nb_clusters * s->cluster_size);
1100 /* save info needed for meta data update */
1102 m->n_start = n_start;
1103 m->nb_clusters = nb_clusters;
1106 m->nb_available = MIN(nb_clusters << (s->cluster_bits - 9), n_end);
1108 *num = m->nb_available - n_start;
1110 return cluster_offset;
1113 static int qcow_is_allocated(BlockDriverState *bs, int64_t sector_num,
1114 int nb_sectors, int *pnum)
1116 uint64_t cluster_offset;
1119 cluster_offset = get_cluster_offset(bs, sector_num << 9, pnum);
1121 return (cluster_offset != 0);
1124 static int decompress_buffer(uint8_t *out_buf, int out_buf_size,
1125 const uint8_t *buf, int buf_size)
1127 z_stream strm1, *strm = &strm1;
1130 memset(strm, 0, sizeof(*strm));
1132 strm->next_in = (uint8_t *)buf;
1133 strm->avail_in = buf_size;
1134 strm->next_out = out_buf;
1135 strm->avail_out = out_buf_size;
1137 ret = inflateInit2(strm, -12);
1140 ret = inflate(strm, Z_FINISH);
1141 out_len = strm->next_out - out_buf;
1142 if ((ret != Z_STREAM_END && ret != Z_BUF_ERROR) ||
1143 out_len != out_buf_size) {
1151 static int decompress_cluster(BDRVQcowState *s, uint64_t cluster_offset)
1153 int ret, csize, nb_csectors, sector_offset;
1156 coffset = cluster_offset & s->cluster_offset_mask;
1157 if (s->cluster_cache_offset != coffset) {
1158 nb_csectors = ((cluster_offset >> s->csize_shift) & s->csize_mask) + 1;
1159 sector_offset = coffset & 511;
1160 csize = nb_csectors * 512 - sector_offset;
1161 ret = bdrv_read(s->hd, coffset >> 9, s->cluster_data, nb_csectors);
1165 if (decompress_buffer(s->cluster_cache, s->cluster_size,
1166 s->cluster_data + sector_offset, csize) < 0) {
1169 s->cluster_cache_offset = coffset;
1174 /* handle reading after the end of the backing file */
1175 static int backing_read1(BlockDriverState *bs,
1176 int64_t sector_num, uint8_t *buf, int nb_sectors)
1179 if ((sector_num + nb_sectors) <= bs->total_sectors)
1181 if (sector_num >= bs->total_sectors)
1184 n1 = bs->total_sectors - sector_num;
1185 memset(buf + n1 * 512, 0, 512 * (nb_sectors - n1));
1189 static int qcow_read(BlockDriverState *bs, int64_t sector_num,
1190 uint8_t *buf, int nb_sectors)
1192 BDRVQcowState *s = bs->opaque;
1193 int ret, index_in_cluster, n, n1;
1194 uint64_t cluster_offset;
1196 while (nb_sectors > 0) {
1198 cluster_offset = get_cluster_offset(bs, sector_num << 9, &n);
1199 index_in_cluster = sector_num & (s->cluster_sectors - 1);
1200 if (!cluster_offset) {
1201 if (bs->backing_hd) {
1202 /* read from the base image */
1203 n1 = backing_read1(bs->backing_hd, sector_num, buf, n);
1205 ret = bdrv_read(bs->backing_hd, sector_num, buf, n1);
1210 memset(buf, 0, 512 * n);
1212 } else if (cluster_offset & QCOW_OFLAG_COMPRESSED) {
1213 if (decompress_cluster(s, cluster_offset) < 0)
1215 memcpy(buf, s->cluster_cache + index_in_cluster * 512, 512 * n);
1217 ret = bdrv_pread(s->hd, cluster_offset + index_in_cluster * 512, buf, n * 512);
1220 if (s->crypt_method) {
1221 encrypt_sectors(s, sector_num, buf, buf, n, 0,
1222 &s->aes_decrypt_key);
1232 typedef struct QCowAIOCB {
1233 BlockDriverAIOCB common;
1240 uint64_t cluster_offset;
1241 uint8_t *cluster_data;
1242 BlockDriverAIOCB *hd_aiocb;
1243 struct iovec hd_iov;
1244 QEMUIOVector hd_qiov;
1249 static void qcow_aio_cancel(BlockDriverAIOCB *blockacb)
1251 QCowAIOCB *acb = (QCowAIOCB *)blockacb;
1253 bdrv_aio_cancel(acb->hd_aiocb);
1254 qemu_aio_release(acb);
1257 static AIOPool qcow_aio_pool = {
1258 .aiocb_size = sizeof(QCowAIOCB),
1259 .cancel = qcow_aio_cancel,
1262 static void qcow_aio_read_cb(void *opaque, int ret);
1263 static void qcow_aio_read_bh(void *opaque)
1265 QCowAIOCB *acb = opaque;
1266 qemu_bh_delete(acb->bh);
1268 qcow_aio_read_cb(opaque, 0);
1271 static int qcow_schedule_bh(QEMUBHFunc *cb, QCowAIOCB *acb)
1276 acb->bh = qemu_bh_new(cb, acb);
1280 qemu_bh_schedule(acb->bh);
1285 static void qcow_aio_read_cb(void *opaque, int ret)
1287 QCowAIOCB *acb = opaque;
1288 BlockDriverState *bs = acb->common.bs;
1289 BDRVQcowState *s = bs->opaque;
1290 int index_in_cluster, n1;
1292 acb->hd_aiocb = NULL;
1296 /* post process the read buffer */
1297 if (!acb->cluster_offset) {
1299 } else if (acb->cluster_offset & QCOW_OFLAG_COMPRESSED) {
1302 if (s->crypt_method) {
1303 encrypt_sectors(s, acb->sector_num, acb->buf, acb->buf,
1305 &s->aes_decrypt_key);
1309 acb->nb_sectors -= acb->n;
1310 acb->sector_num += acb->n;
1311 acb->buf += acb->n * 512;
1313 if (acb->nb_sectors == 0) {
1314 /* request completed */
1319 /* prepare next AIO request */
1320 acb->n = acb->nb_sectors;
1321 acb->cluster_offset = get_cluster_offset(bs, acb->sector_num << 9, &acb->n);
1322 index_in_cluster = acb->sector_num & (s->cluster_sectors - 1);
1324 if (!acb->cluster_offset) {
1325 if (bs->backing_hd) {
1326 /* read from the base image */
1327 n1 = backing_read1(bs->backing_hd, acb->sector_num,
1330 acb->hd_iov.iov_base = (void *)acb->buf;
1331 acb->hd_iov.iov_len = acb->n * 512;
1332 qemu_iovec_init_external(&acb->hd_qiov, &acb->hd_iov, 1);
1333 acb->hd_aiocb = bdrv_aio_readv(bs->backing_hd, acb->sector_num,
1334 &acb->hd_qiov, acb->n,
1335 qcow_aio_read_cb, acb);
1336 if (acb->hd_aiocb == NULL)
1339 ret = qcow_schedule_bh(qcow_aio_read_bh, acb);
1344 /* Note: in this case, no need to wait */
1345 memset(acb->buf, 0, 512 * acb->n);
1346 ret = qcow_schedule_bh(qcow_aio_read_bh, acb);
1350 } else if (acb->cluster_offset & QCOW_OFLAG_COMPRESSED) {
1351 /* add AIO support for compressed blocks ? */
1352 if (decompress_cluster(s, acb->cluster_offset) < 0)
1355 s->cluster_cache + index_in_cluster * 512, 512 * acb->n);
1356 ret = qcow_schedule_bh(qcow_aio_read_bh, acb);
1360 if ((acb->cluster_offset & 511) != 0) {
1365 acb->hd_iov.iov_base = (void *)acb->buf;
1366 acb->hd_iov.iov_len = acb->n * 512;
1367 qemu_iovec_init_external(&acb->hd_qiov, &acb->hd_iov, 1);
1368 acb->hd_aiocb = bdrv_aio_readv(s->hd,
1369 (acb->cluster_offset >> 9) + index_in_cluster,
1370 &acb->hd_qiov, acb->n, qcow_aio_read_cb, acb);
1371 if (acb->hd_aiocb == NULL)
1377 if (acb->qiov->niov > 1) {
1378 qemu_iovec_from_buffer(acb->qiov, acb->orig_buf, acb->qiov->size);
1379 qemu_vfree(acb->orig_buf);
1381 acb->common.cb(acb->common.opaque, ret);
1382 qemu_aio_release(acb);
1385 static QCowAIOCB *qcow_aio_setup(BlockDriverState *bs,
1386 int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
1387 BlockDriverCompletionFunc *cb, void *opaque, int is_write)
1391 acb = qemu_aio_get(&qcow_aio_pool, bs, cb, opaque);
1394 acb->hd_aiocb = NULL;
1395 acb->sector_num = sector_num;
1397 if (qiov->niov > 1) {
1398 acb->buf = acb->orig_buf = qemu_blockalign(bs, qiov->size);
1400 qemu_iovec_to_buffer(qiov, acb->buf);
1402 acb->buf = (uint8_t *)qiov->iov->iov_base;
1404 acb->nb_sectors = nb_sectors;
1406 acb->cluster_offset = 0;
1407 acb->l2meta.nb_clusters = 0;
1411 static BlockDriverAIOCB *qcow_aio_readv(BlockDriverState *bs,
1412 int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
1413 BlockDriverCompletionFunc *cb, void *opaque)
1417 acb = qcow_aio_setup(bs, sector_num, qiov, nb_sectors, cb, opaque, 0);
1421 qcow_aio_read_cb(acb, 0);
1422 return &acb->common;
1425 static void qcow_aio_write_cb(void *opaque, int ret)
1427 QCowAIOCB *acb = opaque;
1428 BlockDriverState *bs = acb->common.bs;
1429 BDRVQcowState *s = bs->opaque;
1430 int index_in_cluster;
1431 const uint8_t *src_buf;
1434 acb->hd_aiocb = NULL;
1439 if (alloc_cluster_link_l2(bs, acb->cluster_offset, &acb->l2meta) < 0) {
1440 free_any_clusters(bs, acb->cluster_offset, acb->l2meta.nb_clusters);
1444 acb->nb_sectors -= acb->n;
1445 acb->sector_num += acb->n;
1446 acb->buf += acb->n * 512;
1448 if (acb->nb_sectors == 0) {
1449 /* request completed */
1454 index_in_cluster = acb->sector_num & (s->cluster_sectors - 1);
1455 n_end = index_in_cluster + acb->nb_sectors;
1456 if (s->crypt_method &&
1457 n_end > QCOW_MAX_CRYPT_CLUSTERS * s->cluster_sectors)
1458 n_end = QCOW_MAX_CRYPT_CLUSTERS * s->cluster_sectors;
1460 acb->cluster_offset = alloc_cluster_offset(bs, acb->sector_num << 9,
1462 n_end, &acb->n, &acb->l2meta);
1463 if (!acb->cluster_offset || (acb->cluster_offset & 511) != 0) {
1467 if (s->crypt_method) {
1468 if (!acb->cluster_data) {
1469 acb->cluster_data = qemu_mallocz(QCOW_MAX_CRYPT_CLUSTERS *
1472 encrypt_sectors(s, acb->sector_num, acb->cluster_data, acb->buf,
1473 acb->n, 1, &s->aes_encrypt_key);
1474 src_buf = acb->cluster_data;
1478 acb->hd_iov.iov_base = (void *)src_buf;
1479 acb->hd_iov.iov_len = acb->n * 512;
1480 qemu_iovec_init_external(&acb->hd_qiov, &acb->hd_iov, 1);
1481 acb->hd_aiocb = bdrv_aio_writev(s->hd,
1482 (acb->cluster_offset >> 9) + index_in_cluster,
1483 &acb->hd_qiov, acb->n,
1484 qcow_aio_write_cb, acb);
1485 if (acb->hd_aiocb == NULL)
1491 if (acb->qiov->niov > 1)
1492 qemu_vfree(acb->orig_buf);
1493 acb->common.cb(acb->common.opaque, ret);
1494 qemu_aio_release(acb);
1497 static BlockDriverAIOCB *qcow_aio_writev(BlockDriverState *bs,
1498 int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
1499 BlockDriverCompletionFunc *cb, void *opaque)
1501 BDRVQcowState *s = bs->opaque;
1504 s->cluster_cache_offset = -1; /* disable compressed cache */
1506 acb = qcow_aio_setup(bs, sector_num, qiov, nb_sectors, cb, opaque, 1);
1510 qcow_aio_write_cb(acb, 0);
1511 return &acb->common;
1514 static void qcow_close(BlockDriverState *bs)
1516 BDRVQcowState *s = bs->opaque;
1517 qemu_free(s->l1_table);
1518 qemu_free(s->l2_cache);
1519 qemu_free(s->cluster_cache);
1520 qemu_free(s->cluster_data);
1525 /* XXX: use std qcow open function ? */
1526 typedef struct QCowCreateState {
1529 uint16_t *refcount_block;
1530 uint64_t *refcount_table;
1531 int64_t l1_table_offset;
1532 int64_t refcount_table_offset;
1533 int64_t refcount_block_offset;
1536 static void create_refcount_update(QCowCreateState *s,
1537 int64_t offset, int64_t size)
1540 int64_t start, last, cluster_offset;
1543 start = offset & ~(s->cluster_size - 1);
1544 last = (offset + size - 1) & ~(s->cluster_size - 1);
1545 for(cluster_offset = start; cluster_offset <= last;
1546 cluster_offset += s->cluster_size) {
1547 p = &s->refcount_block[cluster_offset >> s->cluster_bits];
1548 refcount = be16_to_cpu(*p);
1550 *p = cpu_to_be16(refcount);
1554 static int get_bits_from_size(size_t size)
1563 /* Not a power of two */
1575 static int qcow_create2(const char *filename, int64_t total_size,
1576 const char *backing_file, const char *backing_format,
1577 int flags, size_t cluster_size)
1580 int fd, header_size, backing_filename_len, l1_size, i, shift, l2_bits;
1581 int ref_clusters, backing_format_len = 0;
1583 uint64_t tmp, offset;
1584 QCowCreateState s1, *s = &s1;
1585 QCowExtension ext_bf = {0, 0};
1588 memset(s, 0, sizeof(*s));
1590 fd = open(filename, O_WRONLY | O_CREAT | O_TRUNC | O_BINARY, 0644);
1593 memset(&header, 0, sizeof(header));
1594 header.magic = cpu_to_be32(QCOW_MAGIC);
1595 header.version = cpu_to_be32(QCOW_VERSION);
1596 header.size = cpu_to_be64(total_size * 512);
1597 header_size = sizeof(header);
1598 backing_filename_len = 0;
1600 if (backing_format) {
1601 ext_bf.magic = QCOW_EXT_MAGIC_BACKING_FORMAT;
1602 backing_format_len = strlen(backing_format);
1603 ext_bf.len = (backing_format_len + 7) & ~7;
1604 header_size += ((sizeof(ext_bf) + ext_bf.len + 7) & ~7);
1606 header.backing_file_offset = cpu_to_be64(header_size);
1607 backing_filename_len = strlen(backing_file);
1608 header.backing_file_size = cpu_to_be32(backing_filename_len);
1609 header_size += backing_filename_len;
1613 s->cluster_bits = get_bits_from_size(cluster_size);
1614 if (s->cluster_bits < MIN_CLUSTER_BITS ||
1615 s->cluster_bits > MAX_CLUSTER_BITS)
1617 fprintf(stderr, "Cluster size must be a power of two between "
1619 1 << MIN_CLUSTER_BITS,
1620 1 << (MAX_CLUSTER_BITS - 10));
1623 s->cluster_size = 1 << s->cluster_bits;
1625 header.cluster_bits = cpu_to_be32(s->cluster_bits);
1626 header_size = (header_size + 7) & ~7;
1627 if (flags & BLOCK_FLAG_ENCRYPT) {
1628 header.crypt_method = cpu_to_be32(QCOW_CRYPT_AES);
1630 header.crypt_method = cpu_to_be32(QCOW_CRYPT_NONE);
1632 l2_bits = s->cluster_bits - 3;
1633 shift = s->cluster_bits + l2_bits;
1634 l1_size = (((total_size * 512) + (1LL << shift) - 1) >> shift);
1635 offset = align_offset(header_size, s->cluster_size);
1636 s->l1_table_offset = offset;
1637 header.l1_table_offset = cpu_to_be64(s->l1_table_offset);
1638 header.l1_size = cpu_to_be32(l1_size);
1639 offset += align_offset(l1_size * sizeof(uint64_t), s->cluster_size);
1641 s->refcount_table = qemu_mallocz(s->cluster_size);
1643 s->refcount_table_offset = offset;
1644 header.refcount_table_offset = cpu_to_be64(offset);
1645 header.refcount_table_clusters = cpu_to_be32(1);
1646 offset += s->cluster_size;
1647 s->refcount_block_offset = offset;
1649 /* count how many refcount blocks needed */
1650 tmp = offset >> s->cluster_bits;
1651 ref_clusters = (tmp >> (s->cluster_bits - REFCOUNT_SHIFT)) + 1;
1652 for (i=0; i < ref_clusters; i++) {
1653 s->refcount_table[i] = cpu_to_be64(offset);
1654 offset += s->cluster_size;
1657 s->refcount_block = qemu_mallocz(ref_clusters * s->cluster_size);
1659 /* update refcounts */
1660 create_refcount_update(s, 0, header_size);
1661 create_refcount_update(s, s->l1_table_offset, l1_size * sizeof(uint64_t));
1662 create_refcount_update(s, s->refcount_table_offset, s->cluster_size);
1663 create_refcount_update(s, s->refcount_block_offset, ref_clusters * s->cluster_size);
1665 /* write all the data */
1666 write(fd, &header, sizeof(header));
1668 if (backing_format_len) {
1670 int d = ext_bf.len - backing_format_len;
1672 memset(zero, 0, sizeof(zero));
1673 cpu_to_be32s(&ext_bf.magic);
1674 cpu_to_be32s(&ext_bf.len);
1675 write(fd, &ext_bf, sizeof(ext_bf));
1676 write(fd, backing_format, backing_format_len);
1681 write(fd, backing_file, backing_filename_len);
1683 lseek(fd, s->l1_table_offset, SEEK_SET);
1685 for(i = 0;i < l1_size; i++) {
1686 write(fd, &tmp, sizeof(tmp));
1688 lseek(fd, s->refcount_table_offset, SEEK_SET);
1689 write(fd, s->refcount_table, s->cluster_size);
1691 lseek(fd, s->refcount_block_offset, SEEK_SET);
1692 write(fd, s->refcount_block, ref_clusters * s->cluster_size);
1694 qemu_free(s->refcount_table);
1695 qemu_free(s->refcount_block);
1700 static int qcow_create(const char *filename, QEMUOptionParameter *options)
1702 const char *backing_file = NULL;
1703 const char *backing_fmt = NULL;
1704 uint64_t sectors = 0;
1706 size_t cluster_size = 4096;
1708 /* Read out options */
1709 while (options && options->name) {
1710 if (!strcmp(options->name, BLOCK_OPT_SIZE)) {
1711 sectors = options->value.n / 512;
1712 } else if (!strcmp(options->name, BLOCK_OPT_BACKING_FILE)) {
1713 backing_file = options->value.s;
1714 } else if (!strcmp(options->name, BLOCK_OPT_BACKING_FMT)) {
1715 backing_fmt = options->value.s;
1716 } else if (!strcmp(options->name, BLOCK_OPT_ENCRYPT)) {
1717 flags |= options->value.n ? BLOCK_FLAG_ENCRYPT : 0;
1718 } else if (!strcmp(options->name, BLOCK_OPT_CLUSTER_SIZE)) {
1719 if (options->value.n) {
1720 cluster_size = options->value.n;
1726 return qcow_create2(filename, sectors, backing_file, backing_fmt, flags,
1730 static int qcow_make_empty(BlockDriverState *bs)
1733 /* XXX: not correct */
1734 BDRVQcowState *s = bs->opaque;
1735 uint32_t l1_length = s->l1_size * sizeof(uint64_t);
1738 memset(s->l1_table, 0, l1_length);
1739 if (bdrv_pwrite(s->hd, s->l1_table_offset, s->l1_table, l1_length) < 0)
1741 ret = bdrv_truncate(s->hd, s->l1_table_offset + l1_length);
1750 /* XXX: put compressed sectors first, then all the cluster aligned
1751 tables to avoid losing bytes in alignment */
1752 static int qcow_write_compressed(BlockDriverState *bs, int64_t sector_num,
1753 const uint8_t *buf, int nb_sectors)
1755 BDRVQcowState *s = bs->opaque;
1759 uint64_t cluster_offset;
1761 if (nb_sectors == 0) {
1762 /* align end of file to a sector boundary to ease reading with
1763 sector based I/Os */
1764 cluster_offset = bdrv_getlength(s->hd);
1765 cluster_offset = (cluster_offset + 511) & ~511;
1766 bdrv_truncate(s->hd, cluster_offset);
1770 if (nb_sectors != s->cluster_sectors)
1773 out_buf = qemu_malloc(s->cluster_size + (s->cluster_size / 1000) + 128);
1775 /* best compression, small window, no zlib header */
1776 memset(&strm, 0, sizeof(strm));
1777 ret = deflateInit2(&strm, Z_DEFAULT_COMPRESSION,
1779 9, Z_DEFAULT_STRATEGY);
1785 strm.avail_in = s->cluster_size;
1786 strm.next_in = (uint8_t *)buf;
1787 strm.avail_out = s->cluster_size;
1788 strm.next_out = out_buf;
1790 ret = deflate(&strm, Z_FINISH);
1791 if (ret != Z_STREAM_END && ret != Z_OK) {
1796 out_len = strm.next_out - out_buf;
1800 if (ret != Z_STREAM_END || out_len >= s->cluster_size) {
1801 /* could not compress: write normal cluster */
1802 bdrv_write(bs, sector_num, buf, s->cluster_sectors);
1804 cluster_offset = alloc_compressed_cluster_offset(bs, sector_num << 9,
1806 if (!cluster_offset)
1808 cluster_offset &= s->cluster_offset_mask;
1809 if (bdrv_pwrite(s->hd, cluster_offset, out_buf, out_len) != out_len) {
1819 static void qcow_flush(BlockDriverState *bs)
1821 BDRVQcowState *s = bs->opaque;
1825 static int qcow_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
1827 BDRVQcowState *s = bs->opaque;
1828 bdi->cluster_size = s->cluster_size;
1829 bdi->vm_state_offset = (int64_t)s->l1_vm_state_index <<
1830 (s->cluster_bits + s->l2_bits);
1834 /*********************************************************/
1835 /* snapshot support */
1837 /* update the refcounts of snapshots and the copied flag */
1838 static int update_snapshot_refcount(BlockDriverState *bs,
1839 int64_t l1_table_offset,
1843 BDRVQcowState *s = bs->opaque;
1844 uint64_t *l1_table, *l2_table, l2_offset, offset, l1_size2, l1_allocated;
1845 int64_t old_offset, old_l2_offset;
1846 int l2_size, i, j, l1_modified, l2_modified, nb_csectors, refcount;
1852 l1_size2 = l1_size * sizeof(uint64_t);
1854 if (l1_table_offset != s->l1_table_offset) {
1855 l1_table = qemu_malloc(l1_size2);
1857 if (bdrv_pread(s->hd, l1_table_offset,
1858 l1_table, l1_size2) != l1_size2)
1860 for(i = 0;i < l1_size; i++)
1861 be64_to_cpus(&l1_table[i]);
1863 assert(l1_size == s->l1_size);
1864 l1_table = s->l1_table;
1868 l2_size = s->l2_size * sizeof(uint64_t);
1869 l2_table = qemu_malloc(l2_size);
1871 for(i = 0; i < l1_size; i++) {
1872 l2_offset = l1_table[i];
1874 old_l2_offset = l2_offset;
1875 l2_offset &= ~QCOW_OFLAG_COPIED;
1877 if (bdrv_pread(s->hd, l2_offset, l2_table, l2_size) != l2_size)
1879 for(j = 0; j < s->l2_size; j++) {
1880 offset = be64_to_cpu(l2_table[j]);
1882 old_offset = offset;
1883 offset &= ~QCOW_OFLAG_COPIED;
1884 if (offset & QCOW_OFLAG_COMPRESSED) {
1885 nb_csectors = ((offset >> s->csize_shift) &
1888 update_refcount(bs, (offset & s->cluster_offset_mask) & ~511,
1889 nb_csectors * 512, addend);
1890 /* compressed clusters are never modified */
1894 refcount = update_cluster_refcount(bs, offset >> s->cluster_bits, addend);
1896 refcount = get_refcount(bs, offset >> s->cluster_bits);
1900 if (refcount == 1) {
1901 offset |= QCOW_OFLAG_COPIED;
1903 if (offset != old_offset) {
1904 l2_table[j] = cpu_to_be64(offset);
1910 if (bdrv_pwrite(s->hd,
1911 l2_offset, l2_table, l2_size) != l2_size)
1916 refcount = update_cluster_refcount(bs, l2_offset >> s->cluster_bits, addend);
1918 refcount = get_refcount(bs, l2_offset >> s->cluster_bits);
1920 if (refcount == 1) {
1921 l2_offset |= QCOW_OFLAG_COPIED;
1923 if (l2_offset != old_l2_offset) {
1924 l1_table[i] = l2_offset;
1930 for(i = 0; i < l1_size; i++)
1931 cpu_to_be64s(&l1_table[i]);
1932 if (bdrv_pwrite(s->hd, l1_table_offset, l1_table,
1933 l1_size2) != l1_size2)
1935 for(i = 0; i < l1_size; i++)
1936 be64_to_cpus(&l1_table[i]);
1939 qemu_free(l1_table);
1940 qemu_free(l2_table);
1944 qemu_free(l1_table);
1945 qemu_free(l2_table);
1949 static void qcow_free_snapshots(BlockDriverState *bs)
1951 BDRVQcowState *s = bs->opaque;
1954 for(i = 0; i < s->nb_snapshots; i++) {
1955 qemu_free(s->snapshots[i].name);
1956 qemu_free(s->snapshots[i].id_str);
1958 qemu_free(s->snapshots);
1959 s->snapshots = NULL;
1960 s->nb_snapshots = 0;
1963 static int qcow_read_snapshots(BlockDriverState *bs)
1965 BDRVQcowState *s = bs->opaque;
1966 QCowSnapshotHeader h;
1968 int i, id_str_size, name_size;
1970 uint32_t extra_data_size;
1972 if (!s->nb_snapshots) {
1973 s->snapshots = NULL;
1974 s->snapshots_size = 0;
1978 offset = s->snapshots_offset;
1979 s->snapshots = qemu_mallocz(s->nb_snapshots * sizeof(QCowSnapshot));
1980 for(i = 0; i < s->nb_snapshots; i++) {
1981 offset = align_offset(offset, 8);
1982 if (bdrv_pread(s->hd, offset, &h, sizeof(h)) != sizeof(h))
1984 offset += sizeof(h);
1985 sn = s->snapshots + i;
1986 sn->l1_table_offset = be64_to_cpu(h.l1_table_offset);
1987 sn->l1_size = be32_to_cpu(h.l1_size);
1988 sn->vm_state_size = be32_to_cpu(h.vm_state_size);
1989 sn->date_sec = be32_to_cpu(h.date_sec);
1990 sn->date_nsec = be32_to_cpu(h.date_nsec);
1991 sn->vm_clock_nsec = be64_to_cpu(h.vm_clock_nsec);
1992 extra_data_size = be32_to_cpu(h.extra_data_size);
1994 id_str_size = be16_to_cpu(h.id_str_size);
1995 name_size = be16_to_cpu(h.name_size);
1997 offset += extra_data_size;
1999 sn->id_str = qemu_malloc(id_str_size + 1);
2000 if (bdrv_pread(s->hd, offset, sn->id_str, id_str_size) != id_str_size)
2002 offset += id_str_size;
2003 sn->id_str[id_str_size] = '\0';
2005 sn->name = qemu_malloc(name_size + 1);
2006 if (bdrv_pread(s->hd, offset, sn->name, name_size) != name_size)
2008 offset += name_size;
2009 sn->name[name_size] = '\0';
2011 s->snapshots_size = offset - s->snapshots_offset;
2014 qcow_free_snapshots(bs);
2018 /* add at the end of the file a new list of snapshots */
2019 static int qcow_write_snapshots(BlockDriverState *bs)
2021 BDRVQcowState *s = bs->opaque;
2023 QCowSnapshotHeader h;
2024 int i, name_size, id_str_size, snapshots_size;
2027 int64_t offset, snapshots_offset;
2029 /* compute the size of the snapshots */
2031 for(i = 0; i < s->nb_snapshots; i++) {
2032 sn = s->snapshots + i;
2033 offset = align_offset(offset, 8);
2034 offset += sizeof(h);
2035 offset += strlen(sn->id_str);
2036 offset += strlen(sn->name);
2038 snapshots_size = offset;
2040 snapshots_offset = alloc_clusters(bs, snapshots_size);
2041 offset = snapshots_offset;
2043 for(i = 0; i < s->nb_snapshots; i++) {
2044 sn = s->snapshots + i;
2045 memset(&h, 0, sizeof(h));
2046 h.l1_table_offset = cpu_to_be64(sn->l1_table_offset);
2047 h.l1_size = cpu_to_be32(sn->l1_size);
2048 h.vm_state_size = cpu_to_be32(sn->vm_state_size);
2049 h.date_sec = cpu_to_be32(sn->date_sec);
2050 h.date_nsec = cpu_to_be32(sn->date_nsec);
2051 h.vm_clock_nsec = cpu_to_be64(sn->vm_clock_nsec);
2053 id_str_size = strlen(sn->id_str);
2054 name_size = strlen(sn->name);
2055 h.id_str_size = cpu_to_be16(id_str_size);
2056 h.name_size = cpu_to_be16(name_size);
2057 offset = align_offset(offset, 8);
2058 if (bdrv_pwrite(s->hd, offset, &h, sizeof(h)) != sizeof(h))
2060 offset += sizeof(h);
2061 if (bdrv_pwrite(s->hd, offset, sn->id_str, id_str_size) != id_str_size)
2063 offset += id_str_size;
2064 if (bdrv_pwrite(s->hd, offset, sn->name, name_size) != name_size)
2066 offset += name_size;
2069 /* update the various header fields */
2070 data64 = cpu_to_be64(snapshots_offset);
2071 if (bdrv_pwrite(s->hd, offsetof(QCowHeader, snapshots_offset),
2072 &data64, sizeof(data64)) != sizeof(data64))
2074 data32 = cpu_to_be32(s->nb_snapshots);
2075 if (bdrv_pwrite(s->hd, offsetof(QCowHeader, nb_snapshots),
2076 &data32, sizeof(data32)) != sizeof(data32))
2079 /* free the old snapshot table */
2080 free_clusters(bs, s->snapshots_offset, s->snapshots_size);
2081 s->snapshots_offset = snapshots_offset;
2082 s->snapshots_size = snapshots_size;
2088 static void find_new_snapshot_id(BlockDriverState *bs,
2089 char *id_str, int id_str_size)
2091 BDRVQcowState *s = bs->opaque;
2093 int i, id, id_max = 0;
2095 for(i = 0; i < s->nb_snapshots; i++) {
2096 sn = s->snapshots + i;
2097 id = strtoul(sn->id_str, NULL, 10);
2101 snprintf(id_str, id_str_size, "%d", id_max + 1);
2104 static int find_snapshot_by_id(BlockDriverState *bs, const char *id_str)
2106 BDRVQcowState *s = bs->opaque;
2109 for(i = 0; i < s->nb_snapshots; i++) {
2110 if (!strcmp(s->snapshots[i].id_str, id_str))
2116 static int find_snapshot_by_id_or_name(BlockDriverState *bs, const char *name)
2118 BDRVQcowState *s = bs->opaque;
2121 ret = find_snapshot_by_id(bs, name);
2124 for(i = 0; i < s->nb_snapshots; i++) {
2125 if (!strcmp(s->snapshots[i].name, name))
2131 /* if no id is provided, a new one is constructed */
2132 static int qcow_snapshot_create(BlockDriverState *bs,
2133 QEMUSnapshotInfo *sn_info)
2135 BDRVQcowState *s = bs->opaque;
2136 QCowSnapshot *snapshots1, sn1, *sn = &sn1;
2138 uint64_t *l1_table = NULL;
2140 memset(sn, 0, sizeof(*sn));
2142 if (sn_info->id_str[0] == '\0') {
2143 /* compute a new id */
2144 find_new_snapshot_id(bs, sn_info->id_str, sizeof(sn_info->id_str));
2147 /* check that the ID is unique */
2148 if (find_snapshot_by_id(bs, sn_info->id_str) >= 0)
2151 sn->id_str = qemu_strdup(sn_info->id_str);
2154 sn->name = qemu_strdup(sn_info->name);
2157 sn->vm_state_size = sn_info->vm_state_size;
2158 sn->date_sec = sn_info->date_sec;
2159 sn->date_nsec = sn_info->date_nsec;
2160 sn->vm_clock_nsec = sn_info->vm_clock_nsec;
2162 ret = update_snapshot_refcount(bs, s->l1_table_offset, s->l1_size, 1);
2166 /* create the L1 table of the snapshot */
2167 sn->l1_table_offset = alloc_clusters(bs, s->l1_size * sizeof(uint64_t));
2168 sn->l1_size = s->l1_size;
2170 l1_table = qemu_malloc(s->l1_size * sizeof(uint64_t));
2171 for(i = 0; i < s->l1_size; i++) {
2172 l1_table[i] = cpu_to_be64(s->l1_table[i]);
2174 if (bdrv_pwrite(s->hd, sn->l1_table_offset,
2175 l1_table, s->l1_size * sizeof(uint64_t)) !=
2176 (s->l1_size * sizeof(uint64_t)))
2178 qemu_free(l1_table);
2181 snapshots1 = qemu_malloc((s->nb_snapshots + 1) * sizeof(QCowSnapshot));
2183 memcpy(snapshots1, s->snapshots, s->nb_snapshots * sizeof(QCowSnapshot));
2184 qemu_free(s->snapshots);
2186 s->snapshots = snapshots1;
2187 s->snapshots[s->nb_snapshots++] = *sn;
2189 if (qcow_write_snapshots(bs) < 0)
2192 check_refcounts(bs);
2196 qemu_free(sn->name);
2197 qemu_free(l1_table);
2201 /* copy the snapshot 'snapshot_name' into the current disk image */
2202 static int qcow_snapshot_goto(BlockDriverState *bs,
2203 const char *snapshot_id)
2205 BDRVQcowState *s = bs->opaque;
2207 int i, snapshot_index, l1_size2;
2209 snapshot_index = find_snapshot_by_id_or_name(bs, snapshot_id);
2210 if (snapshot_index < 0)
2212 sn = &s->snapshots[snapshot_index];
2214 if (update_snapshot_refcount(bs, s->l1_table_offset, s->l1_size, -1) < 0)
2217 if (grow_l1_table(bs, sn->l1_size) < 0)
2220 s->l1_size = sn->l1_size;
2221 l1_size2 = s->l1_size * sizeof(uint64_t);
2222 /* copy the snapshot l1 table to the current l1 table */
2223 if (bdrv_pread(s->hd, sn->l1_table_offset,
2224 s->l1_table, l1_size2) != l1_size2)
2226 if (bdrv_pwrite(s->hd, s->l1_table_offset,
2227 s->l1_table, l1_size2) != l1_size2)
2229 for(i = 0;i < s->l1_size; i++) {
2230 be64_to_cpus(&s->l1_table[i]);
2233 if (update_snapshot_refcount(bs, s->l1_table_offset, s->l1_size, 1) < 0)
2237 check_refcounts(bs);
2244 static int qcow_snapshot_delete(BlockDriverState *bs, const char *snapshot_id)
2246 BDRVQcowState *s = bs->opaque;
2248 int snapshot_index, ret;
2250 snapshot_index = find_snapshot_by_id_or_name(bs, snapshot_id);
2251 if (snapshot_index < 0)
2253 sn = &s->snapshots[snapshot_index];
2255 ret = update_snapshot_refcount(bs, sn->l1_table_offset, sn->l1_size, -1);
2258 /* must update the copied flag on the current cluster offsets */
2259 ret = update_snapshot_refcount(bs, s->l1_table_offset, s->l1_size, 0);
2262 free_clusters(bs, sn->l1_table_offset, sn->l1_size * sizeof(uint64_t));
2264 qemu_free(sn->id_str);
2265 qemu_free(sn->name);
2266 memmove(sn, sn + 1, (s->nb_snapshots - snapshot_index - 1) * sizeof(*sn));
2268 ret = qcow_write_snapshots(bs);
2270 /* XXX: restore snapshot if error ? */
2274 check_refcounts(bs);
2279 static int qcow_snapshot_list(BlockDriverState *bs,
2280 QEMUSnapshotInfo **psn_tab)
2282 BDRVQcowState *s = bs->opaque;
2283 QEMUSnapshotInfo *sn_tab, *sn_info;
2287 if (!s->nb_snapshots) {
2289 return s->nb_snapshots;
2292 sn_tab = qemu_mallocz(s->nb_snapshots * sizeof(QEMUSnapshotInfo));
2293 for(i = 0; i < s->nb_snapshots; i++) {
2294 sn_info = sn_tab + i;
2295 sn = s->snapshots + i;
2296 pstrcpy(sn_info->id_str, sizeof(sn_info->id_str),
2298 pstrcpy(sn_info->name, sizeof(sn_info->name),
2300 sn_info->vm_state_size = sn->vm_state_size;
2301 sn_info->date_sec = sn->date_sec;
2302 sn_info->date_nsec = sn->date_nsec;
2303 sn_info->vm_clock_nsec = sn->vm_clock_nsec;
2306 return s->nb_snapshots;
2309 /*********************************************************/
2310 /* refcount handling */
2312 static int refcount_init(BlockDriverState *bs)
2314 BDRVQcowState *s = bs->opaque;
2315 int ret, refcount_table_size2, i;
2317 s->refcount_block_cache = qemu_malloc(s->cluster_size);
2318 refcount_table_size2 = s->refcount_table_size * sizeof(uint64_t);
2319 s->refcount_table = qemu_malloc(refcount_table_size2);
2320 if (s->refcount_table_size > 0) {
2321 ret = bdrv_pread(s->hd, s->refcount_table_offset,
2322 s->refcount_table, refcount_table_size2);
2323 if (ret != refcount_table_size2)
2325 for(i = 0; i < s->refcount_table_size; i++)
2326 be64_to_cpus(&s->refcount_table[i]);
2333 static void refcount_close(BlockDriverState *bs)
2335 BDRVQcowState *s = bs->opaque;
2336 qemu_free(s->refcount_block_cache);
2337 qemu_free(s->refcount_table);
2341 static int load_refcount_block(BlockDriverState *bs,
2342 int64_t refcount_block_offset)
2344 BDRVQcowState *s = bs->opaque;
2346 ret = bdrv_pread(s->hd, refcount_block_offset, s->refcount_block_cache,
2348 if (ret != s->cluster_size)
2350 s->refcount_block_cache_offset = refcount_block_offset;
2354 static int get_refcount(BlockDriverState *bs, int64_t cluster_index)
2356 BDRVQcowState *s = bs->opaque;
2357 int refcount_table_index, block_index;
2358 int64_t refcount_block_offset;
2360 refcount_table_index = cluster_index >> (s->cluster_bits - REFCOUNT_SHIFT);
2361 if (refcount_table_index >= s->refcount_table_size)
2363 refcount_block_offset = s->refcount_table[refcount_table_index];
2364 if (!refcount_block_offset)
2366 if (refcount_block_offset != s->refcount_block_cache_offset) {
2367 /* better than nothing: return allocated if read error */
2368 if (load_refcount_block(bs, refcount_block_offset) < 0)
2371 block_index = cluster_index &
2372 ((1 << (s->cluster_bits - REFCOUNT_SHIFT)) - 1);
2373 return be16_to_cpu(s->refcount_block_cache[block_index]);
2376 /* return < 0 if error */
2377 static int64_t alloc_clusters_noref(BlockDriverState *bs, int64_t size)
2379 BDRVQcowState *s = bs->opaque;
2382 nb_clusters = size_to_clusters(s, size);
2384 for(i = 0; i < nb_clusters; i++) {
2385 int64_t i = s->free_cluster_index++;
2386 if (get_refcount(bs, i) != 0)
2390 printf("alloc_clusters: size=%lld -> %lld\n",
2392 (s->free_cluster_index - nb_clusters) << s->cluster_bits);
2394 return (s->free_cluster_index - nb_clusters) << s->cluster_bits;
2397 static int64_t alloc_clusters(BlockDriverState *bs, int64_t size)
2401 offset = alloc_clusters_noref(bs, size);
2402 update_refcount(bs, offset, size, 1);
2406 /* only used to allocate compressed sectors. We try to allocate
2407 contiguous sectors. size must be <= cluster_size */
2408 static int64_t alloc_bytes(BlockDriverState *bs, int size)
2410 BDRVQcowState *s = bs->opaque;
2411 int64_t offset, cluster_offset;
2412 int free_in_cluster;
2414 assert(size > 0 && size <= s->cluster_size);
2415 if (s->free_byte_offset == 0) {
2416 s->free_byte_offset = alloc_clusters(bs, s->cluster_size);
2419 free_in_cluster = s->cluster_size -
2420 (s->free_byte_offset & (s->cluster_size - 1));
2421 if (size <= free_in_cluster) {
2422 /* enough space in current cluster */
2423 offset = s->free_byte_offset;
2424 s->free_byte_offset += size;
2425 free_in_cluster -= size;
2426 if (free_in_cluster == 0)
2427 s->free_byte_offset = 0;
2428 if ((offset & (s->cluster_size - 1)) != 0)
2429 update_cluster_refcount(bs, offset >> s->cluster_bits, 1);
2431 offset = alloc_clusters(bs, s->cluster_size);
2432 cluster_offset = s->free_byte_offset & ~(s->cluster_size - 1);
2433 if ((cluster_offset + s->cluster_size) == offset) {
2434 /* we are lucky: contiguous data */
2435 offset = s->free_byte_offset;
2436 update_cluster_refcount(bs, offset >> s->cluster_bits, 1);
2437 s->free_byte_offset += size;
2439 s->free_byte_offset = offset;
2446 static void free_clusters(BlockDriverState *bs,
2447 int64_t offset, int64_t size)
2449 update_refcount(bs, offset, size, -1);
2452 static int grow_refcount_table(BlockDriverState *bs, int min_size)
2454 BDRVQcowState *s = bs->opaque;
2455 int new_table_size, new_table_size2, refcount_table_clusters, i, ret;
2456 uint64_t *new_table;
2457 int64_t table_offset;
2460 int64_t old_table_offset;
2462 if (min_size <= s->refcount_table_size)
2464 /* compute new table size */
2465 refcount_table_clusters = s->refcount_table_size >> (s->cluster_bits - 3);
2467 if (refcount_table_clusters == 0) {
2468 refcount_table_clusters = 1;
2470 refcount_table_clusters = (refcount_table_clusters * 3 + 1) / 2;
2472 new_table_size = refcount_table_clusters << (s->cluster_bits - 3);
2473 if (min_size <= new_table_size)
2477 printf("grow_refcount_table from %d to %d\n",
2478 s->refcount_table_size,
2481 new_table_size2 = new_table_size * sizeof(uint64_t);
2482 new_table = qemu_mallocz(new_table_size2);
2483 memcpy(new_table, s->refcount_table,
2484 s->refcount_table_size * sizeof(uint64_t));
2485 for(i = 0; i < s->refcount_table_size; i++)
2486 cpu_to_be64s(&new_table[i]);
2487 /* Note: we cannot update the refcount now to avoid recursion */
2488 table_offset = alloc_clusters_noref(bs, new_table_size2);
2489 ret = bdrv_pwrite(s->hd, table_offset, new_table, new_table_size2);
2490 if (ret != new_table_size2)
2492 for(i = 0; i < s->refcount_table_size; i++)
2493 be64_to_cpus(&new_table[i]);
2495 cpu_to_be64w((uint64_t*)data, table_offset);
2496 cpu_to_be32w((uint32_t*)(data + 8), refcount_table_clusters);
2497 if (bdrv_pwrite(s->hd, offsetof(QCowHeader, refcount_table_offset),
2498 data, sizeof(data)) != sizeof(data))
2500 qemu_free(s->refcount_table);
2501 old_table_offset = s->refcount_table_offset;
2502 old_table_size = s->refcount_table_size;
2503 s->refcount_table = new_table;
2504 s->refcount_table_size = new_table_size;
2505 s->refcount_table_offset = table_offset;
2507 update_refcount(bs, table_offset, new_table_size2, 1);
2508 free_clusters(bs, old_table_offset, old_table_size * sizeof(uint64_t));
2511 free_clusters(bs, table_offset, new_table_size2);
2512 qemu_free(new_table);
2517 static int64_t alloc_refcount_block(BlockDriverState *bs, int64_t cluster_index)
2519 BDRVQcowState *s = bs->opaque;
2520 int64_t offset, refcount_block_offset;
2521 int ret, refcount_table_index;
2524 /* Find L1 index and grow refcount table if needed */
2525 refcount_table_index = cluster_index >> (s->cluster_bits - REFCOUNT_SHIFT);
2526 if (refcount_table_index >= s->refcount_table_size) {
2527 ret = grow_refcount_table(bs, refcount_table_index + 1);
2532 /* Load or allocate the refcount block */
2533 refcount_block_offset = s->refcount_table[refcount_table_index];
2534 if (!refcount_block_offset) {
2535 /* create a new refcount block */
2536 /* Note: we cannot update the refcount now to avoid recursion */
2537 offset = alloc_clusters_noref(bs, s->cluster_size);
2538 memset(s->refcount_block_cache, 0, s->cluster_size);
2539 ret = bdrv_pwrite(s->hd, offset, s->refcount_block_cache, s->cluster_size);
2540 if (ret != s->cluster_size)
2542 s->refcount_table[refcount_table_index] = offset;
2543 data64 = cpu_to_be64(offset);
2544 ret = bdrv_pwrite(s->hd, s->refcount_table_offset +
2545 refcount_table_index * sizeof(uint64_t),
2546 &data64, sizeof(data64));
2547 if (ret != sizeof(data64))
2550 refcount_block_offset = offset;
2551 s->refcount_block_cache_offset = offset;
2552 update_refcount(bs, offset, s->cluster_size, 1);
2554 if (refcount_block_offset != s->refcount_block_cache_offset) {
2555 if (load_refcount_block(bs, refcount_block_offset) < 0)
2560 return refcount_block_offset;
2563 /* addend must be 1 or -1 */
2564 static int update_cluster_refcount(BlockDriverState *bs,
2565 int64_t cluster_index,
2568 BDRVQcowState *s = bs->opaque;
2571 ret = update_refcount(bs, cluster_index << s->cluster_bits, 1, addend);
2576 return get_refcount(bs, cluster_index);
2579 /* XXX: cache several refcount block clusters ? */
2580 static int update_refcount(BlockDriverState *bs,
2581 int64_t offset, int64_t length,
2584 BDRVQcowState *s = bs->opaque;
2585 int64_t start, last, cluster_offset;
2586 int64_t refcount_block_offset = 0;
2587 int64_t table_index = -1, old_table_index;
2588 int first_index = -1, last_index = -1;
2591 printf("update_refcount: offset=%lld size=%lld addend=%d\n",
2592 offset, length, addend);
2596 start = offset & ~(s->cluster_size - 1);
2597 last = (offset + length - 1) & ~(s->cluster_size - 1);
2598 for(cluster_offset = start; cluster_offset <= last;
2599 cluster_offset += s->cluster_size)
2601 int block_index, refcount;
2602 int64_t cluster_index = cluster_offset >> s->cluster_bits;
2604 /* Only write refcount block to disk when we are done with it */
2605 old_table_index = table_index;
2606 table_index = cluster_index >> (s->cluster_bits - REFCOUNT_SHIFT);
2607 if ((old_table_index >= 0) && (table_index != old_table_index)) {
2608 size_t size = (last_index - first_index + 1) << REFCOUNT_SHIFT;
2609 if (bdrv_pwrite(s->hd,
2610 refcount_block_offset + (first_index << REFCOUNT_SHIFT),
2611 &s->refcount_block_cache[first_index], size) != size)
2620 /* Load the refcount block and allocate it if needed */
2621 refcount_block_offset = alloc_refcount_block(bs, cluster_index);
2622 if (refcount_block_offset < 0) {
2623 return refcount_block_offset;
2626 /* we can update the count and save it */
2627 block_index = cluster_index &
2628 ((1 << (s->cluster_bits - REFCOUNT_SHIFT)) - 1);
2629 if (first_index == -1 || block_index < first_index) {
2630 first_index = block_index;
2632 if (block_index > last_index) {
2633 last_index = block_index;
2636 refcount = be16_to_cpu(s->refcount_block_cache[block_index]);
2638 if (refcount < 0 || refcount > 0xffff)
2640 if (refcount == 0 && cluster_index < s->free_cluster_index) {
2641 s->free_cluster_index = cluster_index;
2643 s->refcount_block_cache[block_index] = cpu_to_be16(refcount);
2646 /* Write last changed block to disk */
2647 if (refcount_block_offset != 0) {
2648 size_t size = (last_index - first_index + 1) << REFCOUNT_SHIFT;
2649 if (bdrv_pwrite(s->hd,
2650 refcount_block_offset + (first_index << REFCOUNT_SHIFT),
2651 &s->refcount_block_cache[first_index], size) != size)
2661 * Increases the refcount for a range of clusters in a given refcount table.
2662 * This is used to construct a temporary refcount table out of L1 and L2 tables
2663 * which can be compared the the refcount table saved in the image.
2665 * Returns the number of errors in the image that were found
2667 static int inc_refcounts(BlockDriverState *bs,
2668 uint16_t *refcount_table,
2669 int refcount_table_size,
2670 int64_t offset, int64_t size)
2672 BDRVQcowState *s = bs->opaque;
2673 int64_t start, last, cluster_offset;
2680 start = offset & ~(s->cluster_size - 1);
2681 last = (offset + size - 1) & ~(s->cluster_size - 1);
2682 for(cluster_offset = start; cluster_offset <= last;
2683 cluster_offset += s->cluster_size) {
2684 k = cluster_offset >> s->cluster_bits;
2685 if (k < 0 || k >= refcount_table_size) {
2686 fprintf(stderr, "ERROR: invalid cluster offset=0x%" PRIx64 "\n",
2690 if (++refcount_table[k] == 0) {
2691 fprintf(stderr, "ERROR: overflow cluster offset=0x%" PRIx64
2692 "\n", cluster_offset);
2702 * Increases the refcount in the given refcount table for the all clusters
2703 * referenced in the L2 table. While doing so, performs some checks on L2
2706 * Returns the number of errors found by the checks or -errno if an internal
2709 static int check_refcounts_l2(BlockDriverState *bs,
2710 uint16_t *refcount_table, int refcount_table_size, int64_t l2_offset,
2713 BDRVQcowState *s = bs->opaque;
2714 uint64_t *l2_table, offset;
2715 int i, l2_size, nb_csectors, refcount;
2718 /* Read L2 table from disk */
2719 l2_size = s->l2_size * sizeof(uint64_t);
2720 l2_table = qemu_malloc(l2_size);
2722 if (bdrv_pread(s->hd, l2_offset, l2_table, l2_size) != l2_size)
2725 /* Do the actual checks */
2726 for(i = 0; i < s->l2_size; i++) {
2727 offset = be64_to_cpu(l2_table[i]);
2729 if (offset & QCOW_OFLAG_COMPRESSED) {
2730 /* Compressed clusters don't have QCOW_OFLAG_COPIED */
2731 if (offset & QCOW_OFLAG_COPIED) {
2732 fprintf(stderr, "ERROR: cluster %" PRId64 ": "
2733 "copied flag must never be set for compressed "
2734 "clusters\n", offset >> s->cluster_bits);
2735 offset &= ~QCOW_OFLAG_COPIED;
2739 /* Mark cluster as used */
2740 nb_csectors = ((offset >> s->csize_shift) &
2742 offset &= s->cluster_offset_mask;
2743 errors += inc_refcounts(bs, refcount_table,
2744 refcount_table_size,
2745 offset & ~511, nb_csectors * 512);
2747 /* QCOW_OFLAG_COPIED must be set iff refcount == 1 */
2749 uint64_t entry = offset;
2750 offset &= ~QCOW_OFLAG_COPIED;
2751 refcount = get_refcount(bs, offset >> s->cluster_bits);
2752 if ((refcount == 1) != ((entry & QCOW_OFLAG_COPIED) != 0)) {
2753 fprintf(stderr, "ERROR OFLAG_COPIED: offset=%"
2754 PRIx64 " refcount=%d\n", entry, refcount);
2759 /* Mark cluster as used */
2760 offset &= ~QCOW_OFLAG_COPIED;
2761 errors += inc_refcounts(bs, refcount_table,
2762 refcount_table_size,
2763 offset, s->cluster_size);
2765 /* Correct offsets are cluster aligned */
2766 if (offset & (s->cluster_size - 1)) {
2767 fprintf(stderr, "ERROR offset=%" PRIx64 ": Cluster is not "
2768 "properly aligned; L2 entry corrupted.\n", offset);
2775 qemu_free(l2_table);
2779 fprintf(stderr, "ERROR: I/O error in check_refcounts_l1\n");
2780 qemu_free(l2_table);
2785 * Increases the refcount for the L1 table, its L2 tables and all referenced
2786 * clusters in the given refcount table. While doing so, performs some checks
2787 * on L1 and L2 entries.
2789 * Returns the number of errors found by the checks or -errno if an internal
2792 static int check_refcounts_l1(BlockDriverState *bs,
2793 uint16_t *refcount_table,
2794 int refcount_table_size,
2795 int64_t l1_table_offset, int l1_size,
2798 BDRVQcowState *s = bs->opaque;
2799 uint64_t *l1_table, l2_offset, l1_size2;
2800 int i, refcount, ret;
2803 l1_size2 = l1_size * sizeof(uint64_t);
2805 /* Mark L1 table as used */
2806 errors += inc_refcounts(bs, refcount_table, refcount_table_size,
2807 l1_table_offset, l1_size2);
2809 /* Read L1 table entries from disk */
2810 l1_table = qemu_malloc(l1_size2);
2811 if (bdrv_pread(s->hd, l1_table_offset,
2812 l1_table, l1_size2) != l1_size2)
2814 for(i = 0;i < l1_size; i++)
2815 be64_to_cpus(&l1_table[i]);
2817 /* Do the actual checks */
2818 for(i = 0; i < l1_size; i++) {
2819 l2_offset = l1_table[i];
2821 /* QCOW_OFLAG_COPIED must be set iff refcount == 1 */
2823 refcount = get_refcount(bs, (l2_offset & ~QCOW_OFLAG_COPIED)
2824 >> s->cluster_bits);
2825 if ((refcount == 1) != ((l2_offset & QCOW_OFLAG_COPIED) != 0)) {
2826 fprintf(stderr, "ERROR OFLAG_COPIED: l2_offset=%" PRIx64
2827 " refcount=%d\n", l2_offset, refcount);
2832 /* Mark L2 table as used */
2833 l2_offset &= ~QCOW_OFLAG_COPIED;
2834 errors += inc_refcounts(bs, refcount_table,
2835 refcount_table_size,
2839 /* L2 tables are cluster aligned */
2840 if (l2_offset & (s->cluster_size - 1)) {
2841 fprintf(stderr, "ERROR l2_offset=%" PRIx64 ": Table is not "
2842 "cluster aligned; L1 entry corrupted\n", l2_offset);
2846 /* Process and check L2 entries */
2847 ret = check_refcounts_l2(bs, refcount_table, refcount_table_size,
2848 l2_offset, check_copied);
2855 qemu_free(l1_table);
2859 fprintf(stderr, "ERROR: I/O error in check_refcounts_l1\n");
2860 qemu_free(l1_table);
2865 * Checks an image for refcount consistency.
2867 * Returns 0 if no errors are found, the number of errors in case the image is
2868 * detected as corrupted, and -errno when an internal error occured.
2870 static int check_refcounts(BlockDriverState *bs)
2872 BDRVQcowState *s = bs->opaque;
2874 int nb_clusters, refcount1, refcount2, i;
2876 uint16_t *refcount_table;
2877 int ret, errors = 0;
2879 size = bdrv_getlength(s->hd);
2880 nb_clusters = size_to_clusters(s, size);
2881 refcount_table = qemu_mallocz(nb_clusters * sizeof(uint16_t));
2884 errors += inc_refcounts(bs, refcount_table, nb_clusters,
2885 0, s->cluster_size);
2887 /* current L1 table */
2888 ret = check_refcounts_l1(bs, refcount_table, nb_clusters,
2889 s->l1_table_offset, s->l1_size, 1);
2896 for(i = 0; i < s->nb_snapshots; i++) {
2897 sn = s->snapshots + i;
2898 check_refcounts_l1(bs, refcount_table, nb_clusters,
2899 sn->l1_table_offset, sn->l1_size, 0);
2901 errors += inc_refcounts(bs, refcount_table, nb_clusters,
2902 s->snapshots_offset, s->snapshots_size);
2905 errors += inc_refcounts(bs, refcount_table, nb_clusters,
2906 s->refcount_table_offset,
2907 s->refcount_table_size * sizeof(uint64_t));
2908 for(i = 0; i < s->refcount_table_size; i++) {
2910 offset = s->refcount_table[i];
2912 errors += inc_refcounts(bs, refcount_table, nb_clusters,
2913 offset, s->cluster_size);
2917 /* compare ref counts */
2918 for(i = 0; i < nb_clusters; i++) {
2919 refcount1 = get_refcount(bs, i);
2920 refcount2 = refcount_table[i];
2921 if (refcount1 != refcount2) {
2922 fprintf(stderr, "ERROR cluster %d refcount=%d reference=%d\n",
2923 i, refcount1, refcount2);
2928 qemu_free(refcount_table);
2933 static int qcow_check(BlockDriverState *bs)
2935 return check_refcounts(bs);
2939 static void dump_refcounts(BlockDriverState *bs)
2941 BDRVQcowState *s = bs->opaque;
2942 int64_t nb_clusters, k, k1, size;
2945 size = bdrv_getlength(s->hd);
2946 nb_clusters = size_to_clusters(s, size);
2947 for(k = 0; k < nb_clusters;) {
2949 refcount = get_refcount(bs, k);
2951 while (k < nb_clusters && get_refcount(bs, k) == refcount)
2953 printf("%lld: refcount=%d nb=%lld\n", k, refcount, k - k1);
2958 static int qcow_put_buffer(BlockDriverState *bs, const uint8_t *buf,
2959 int64_t pos, int size)
2961 int growable = bs->growable;
2964 bdrv_pwrite(bs, pos, buf, size);
2965 bs->growable = growable;
2970 static int qcow_get_buffer(BlockDriverState *bs, uint8_t *buf,
2971 int64_t pos, int size)
2973 int growable = bs->growable;
2977 ret = bdrv_pread(bs, pos, buf, size);
2978 bs->growable = growable;
2983 static QEMUOptionParameter qcow_create_options[] = {
2985 .name = BLOCK_OPT_SIZE,
2987 .help = "Virtual disk size"
2990 .name = BLOCK_OPT_BACKING_FILE,
2992 .help = "File name of a base image"
2995 .name = BLOCK_OPT_BACKING_FMT,
2997 .help = "Image format of the base image"
3000 .name = BLOCK_OPT_ENCRYPT,
3002 .help = "Encrypt the image"
3005 .name = BLOCK_OPT_CLUSTER_SIZE,
3007 .help = "qcow2 cluster size"
3012 static BlockDriver bdrv_qcow2 = {
3013 .format_name = "qcow2",
3014 .instance_size = sizeof(BDRVQcowState),
3015 .bdrv_probe = qcow_probe,
3016 .bdrv_open = qcow_open,
3017 .bdrv_close = qcow_close,
3018 .bdrv_create = qcow_create,
3019 .bdrv_flush = qcow_flush,
3020 .bdrv_is_allocated = qcow_is_allocated,
3021 .bdrv_set_key = qcow_set_key,
3022 .bdrv_make_empty = qcow_make_empty,
3024 .bdrv_aio_readv = qcow_aio_readv,
3025 .bdrv_aio_writev = qcow_aio_writev,
3026 .bdrv_write_compressed = qcow_write_compressed,
3028 .bdrv_snapshot_create = qcow_snapshot_create,
3029 .bdrv_snapshot_goto = qcow_snapshot_goto,
3030 .bdrv_snapshot_delete = qcow_snapshot_delete,
3031 .bdrv_snapshot_list = qcow_snapshot_list,
3032 .bdrv_get_info = qcow_get_info,
3034 .bdrv_put_buffer = qcow_put_buffer,
3035 .bdrv_get_buffer = qcow_get_buffer,
3037 .create_options = qcow_create_options,
3038 .bdrv_check = qcow_check,
3041 static void bdrv_qcow2_init(void)
3043 bdrv_register(&bdrv_qcow2);
3046 block_init(bdrv_qcow2_init);