block/qcow2-snapshot.c

   1 /*
   2  * Block driver for the QCOW version 2 format
   3  *
   4  * Copyright (c) 2004-2006 Fabrice Bellard
   5  *
   6  * Permission is hereby granted, free of charge, to any person obtaining a copy
   7  * of this software and associated documentation files (the "Software"), to deal
   8  * in the Software without restriction, including without limitation the rights
   9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10  * copies of the Software, and to permit persons to whom the Software is
  11  * furnished to do so, subject to the following conditions:
  12  *
  13  * The above copyright notice and this permission notice shall be included in
  14  * all copies or substantial portions of the Software.
  15  *
  16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22  * THE SOFTWARE.
  23  */
  24
  25 #include "qemu/osdep.h"
  26 #include "qapi/error.h"
  27 #include "qcow2.h"
  28 #include "qemu/bswap.h"
  29 #include "qemu/error-report.h"
  30 #include "qemu/cutils.h"
  31
  32 void qcow2_free_snapshots(BlockDriverState *bs)
  33 {
  34     BDRVQcow2State *s = bs->opaque;
  35     int i;
  36
  37     for(i = 0; i < s->nb_snapshots; i++) {
  38         g_free(s->snapshots[i].name);
  39         g_free(s->snapshots[i].id_str);
  40         g_free(s->snapshots[i].unknown_extra_data);
  41     }
  42     g_free(s->snapshots);
  43     s->snapshots = NULL;
  44     s->nb_snapshots = 0;
  45 }
  46
  47 int qcow2_read_snapshots(BlockDriverState *bs, Error **errp)
  48 {
  49     BDRVQcow2State *s = bs->opaque;
  50     QCowSnapshotHeader h;
  51     QCowSnapshotExtraData extra;
  52     QCowSnapshot *sn;
  53     int i, id_str_size, name_size;
  54     int64_t offset;
  55     int ret;
  56
  57     if (!s->nb_snapshots) {
  58         s->snapshots = NULL;
  59         s->snapshots_size = 0;
  60         return 0;
  61     }
  62
  63     offset = s->snapshots_offset;
  64     s->snapshots = g_new0(QCowSnapshot, s->nb_snapshots);
  65
  66     for(i = 0; i < s->nb_snapshots; i++) {
  67         /* Read statically sized part of the snapshot header */
  68         offset = ROUND_UP(offset, 8);
  69         ret = bdrv_pread(bs->file, offset, &h, sizeof(h));
  70         if (ret < 0) {
  71             error_setg_errno(errp, -ret, "Failed to read snapshot table");
  72             goto fail;
  73         }
  74
  75         offset += sizeof(h);
  76         sn = s->snapshots + i;
  77         sn->l1_table_offset = be64_to_cpu(h.l1_table_offset);
  78         sn->l1_size = be32_to_cpu(h.l1_size);
  79         sn->vm_state_size = be32_to_cpu(h.vm_state_size);
  80         sn->date_sec = be32_to_cpu(h.date_sec);
  81         sn->date_nsec = be32_to_cpu(h.date_nsec);
  82         sn->vm_clock_nsec = be64_to_cpu(h.vm_clock_nsec);
  83         sn->extra_data_size = be32_to_cpu(h.extra_data_size);
  84
  85         id_str_size = be16_to_cpu(h.id_str_size);
  86         name_size = be16_to_cpu(h.name_size);
  87
  88         if (sn->extra_data_size > QCOW_MAX_SNAPSHOT_EXTRA_DATA) {
  89             ret = -EFBIG;
  90             error_setg(errp, "Too much extra metadata in snapshot table "
  91                        "entry %i", i);
  92             goto fail;
  93         }
  94
  95         /* Read known extra data */
  96         ret = bdrv_pread(bs->file, offset, &extra,
  97                          MIN(sizeof(extra), sn->extra_data_size));
  98         if (ret < 0) {
  99             error_setg_errno(errp, -ret, "Failed to read snapshot table");
 100             goto fail;
 101         }
 102         offset += MIN(sizeof(extra), sn->extra_data_size);
 103
 104         if (sn->extra_data_size >= endof(QCowSnapshotExtraData,
 105                                          vm_state_size_large)) {
 106             sn->vm_state_size = be64_to_cpu(extra.vm_state_size_large);
 107         }
 108
 109         if (sn->extra_data_size >= endof(QCowSnapshotExtraData, disk_size)) {
 110             sn->disk_size = be64_to_cpu(extra.disk_size);
 111         } else {
 112             sn->disk_size = bs->total_sectors * BDRV_SECTOR_SIZE;
 113         }
 114
 115         if (sn->extra_data_size > sizeof(extra)) {
 116             /* Store unknown extra data */
 117             size_t unknown_extra_data_size =
 118                 sn->extra_data_size - sizeof(extra);
 119
 120             sn->unknown_extra_data = g_malloc(unknown_extra_data_size);
 121             ret = bdrv_pread(bs->file, offset, sn->unknown_extra_data,
 122                              unknown_extra_data_size);
 123             if (ret < 0) {
 124                 error_setg_errno(errp, -ret, "Failed to read snapshot table");
 125                 goto fail;
 126             }
 127             offset += unknown_extra_data_size;
 128         }
 129
 130         /* Read snapshot ID */
 131         sn->id_str = g_malloc(id_str_size + 1);
 132         ret = bdrv_pread(bs->file, offset, sn->id_str, id_str_size);
 133         if (ret < 0) {
 134             error_setg_errno(errp, -ret, "Failed to read snapshot table");
 135             goto fail;
 136         }
 137         offset += id_str_size;
 138         sn->id_str[id_str_size] = '\0';
 139
 140         /* Read snapshot name */
 141         sn->name = g_malloc(name_size + 1);
 142         ret = bdrv_pread(bs->file, offset, sn->name, name_size);
 143         if (ret < 0) {
 144             error_setg_errno(errp, -ret, "Failed to read snapshot table");
 145             goto fail;
 146         }
 147         offset += name_size;
 148         sn->name[name_size] = '\0';
 149
 150         if (offset - s->snapshots_offset > QCOW_MAX_SNAPSHOTS_SIZE) {
 151             ret = -EFBIG;
 152             error_setg(errp, "Snapshot table is too big");
 153             goto fail;
 154         }
 155     }
 156
 157     assert(offset - s->snapshots_offset <= INT_MAX);
 158     s->snapshots_size = offset - s->snapshots_offset;
 159     return 0;
 160
 161 fail:
 162     qcow2_free_snapshots(bs);
 163     return ret;
 164 }
 165
 166 /* add at the end of the file a new list of snapshots */
 167 int qcow2_write_snapshots(BlockDriverState *bs)
 168 {
 169     BDRVQcow2State *s = bs->opaque;
 170     QCowSnapshot *sn;
 171     QCowSnapshotHeader h;
 172     QCowSnapshotExtraData extra;
 173     int i, name_size, id_str_size, snapshots_size;
 174     struct {
 175         uint32_t nb_snapshots;
 176         uint64_t snapshots_offset;
 177     } QEMU_PACKED header_data;
 178     int64_t offset, snapshots_offset = 0;
 179     int ret;
 180
 181     /* compute the size of the snapshots */
 182     offset = 0;
 183     for(i = 0; i < s->nb_snapshots; i++) {
 184         sn = s->snapshots + i;
 185         offset = ROUND_UP(offset, 8);
 186         offset += sizeof(h);
 187         offset += MAX(sizeof(extra), sn->extra_data_size);
 188         offset += strlen(sn->id_str);
 189         offset += strlen(sn->name);
 190
 191         if (offset > QCOW_MAX_SNAPSHOTS_SIZE) {
 192             ret = -EFBIG;
 193             goto fail;
 194         }
 195     }
 196
 197     assert(offset <= INT_MAX);
 198     snapshots_size = offset;
 199
 200     /* Allocate space for the new snapshot list */
 201     snapshots_offset = qcow2_alloc_clusters(bs, snapshots_size);
 202     offset = snapshots_offset;
 203     if (offset < 0) {
 204         ret = offset;
 205         goto fail;
 206     }
 207     ret = bdrv_flush(bs);
 208     if (ret < 0) {
 209         goto fail;
 210     }
 211
 212     /* The snapshot list position has not yet been updated, so these clusters
 213      * must indeed be completely free */
 214     ret = qcow2_pre_write_overlap_check(bs, 0, offset, snapshots_size, false);
 215     if (ret < 0) {
 216         goto fail;
 217     }
 218
 219
 220     /* Write all snapshots to the new list */
 221     for(i = 0; i < s->nb_snapshots; i++) {
 222         sn = s->snapshots + i;
 223         memset(&h, 0, sizeof(h));
 224         h.l1_table_offset = cpu_to_be64(sn->l1_table_offset);
 225         h.l1_size = cpu_to_be32(sn->l1_size);
 226         /* If it doesn't fit in 32 bit, older implementations should treat it
 227          * as a disk-only snapshot rather than truncate the VM state */
 228         if (sn->vm_state_size <= 0xffffffff) {
 229             h.vm_state_size = cpu_to_be32(sn->vm_state_size);
 230         }
 231         h.date_sec = cpu_to_be32(sn->date_sec);
 232         h.date_nsec = cpu_to_be32(sn->date_nsec);
 233         h.vm_clock_nsec = cpu_to_be64(sn->vm_clock_nsec);
 234         h.extra_data_size = cpu_to_be32(MAX(sizeof(extra),
 235                                             sn->extra_data_size));
 236
 237         memset(&extra, 0, sizeof(extra));
 238         extra.vm_state_size_large = cpu_to_be64(sn->vm_state_size);
 239         extra.disk_size = cpu_to_be64(sn->disk_size);
 240
 241         id_str_size = strlen(sn->id_str);
 242         name_size = strlen(sn->name);
 243         assert(id_str_size <= UINT16_MAX && name_size <= UINT16_MAX);
 244         h.id_str_size = cpu_to_be16(id_str_size);
 245         h.name_size = cpu_to_be16(name_size);
 246         offset = ROUND_UP(offset, 8);
 247
 248         ret = bdrv_pwrite(bs->file, offset, &h, sizeof(h));
 249         if (ret < 0) {
 250             goto fail;
 251         }
 252         offset += sizeof(h);
 253
 254         ret = bdrv_pwrite(bs->file, offset, &extra, sizeof(extra));
 255         if (ret < 0) {
 256             goto fail;
 257         }
 258         offset += sizeof(extra);
 259
 260         if (sn->extra_data_size > sizeof(extra)) {
 261             size_t unknown_extra_data_size =
 262                 sn->extra_data_size - sizeof(extra);
 263
 264             /* qcow2_read_snapshots() ensures no unbounded allocation */
 265             assert(unknown_extra_data_size <= BDRV_REQUEST_MAX_BYTES);
 266             assert(sn->unknown_extra_data);
 267
 268             ret = bdrv_pwrite(bs->file, offset, sn->unknown_extra_data,
 269                               unknown_extra_data_size);
 270             if (ret < 0) {
 271                 goto fail;
 272             }
 273             offset += unknown_extra_data_size;
 274         }
 275
 276         ret = bdrv_pwrite(bs->file, offset, sn->id_str, id_str_size);
 277         if (ret < 0) {
 278             goto fail;
 279         }
 280         offset += id_str_size;
 281
 282         ret = bdrv_pwrite(bs->file, offset, sn->name, name_size);
 283         if (ret < 0) {
 284             goto fail;
 285         }
 286         offset += name_size;
 287     }
 288
 289     /*
 290      * Update the header to point to the new snapshot table. This requires the
 291      * new table and its refcounts to be stable on disk.
 292      */
 293     ret = bdrv_flush(bs);
 294     if (ret < 0) {
 295         goto fail;
 296     }
 297
 298     QEMU_BUILD_BUG_ON(offsetof(QCowHeader, snapshots_offset) !=
 299                       endof(QCowHeader, nb_snapshots));
 300
 301     header_data.nb_snapshots        = cpu_to_be32(s->nb_snapshots);
 302     header_data.snapshots_offset    = cpu_to_be64(snapshots_offset);
 303
 304     ret = bdrv_pwrite_sync(bs->file, offsetof(QCowHeader, nb_snapshots),
 305                            &header_data, sizeof(header_data));
 306     if (ret < 0) {
 307         goto fail;
 308     }
 309
 310     /* free the old snapshot table */
 311     qcow2_free_clusters(bs, s->snapshots_offset, s->snapshots_size,
 312                         QCOW2_DISCARD_SNAPSHOT);
 313     s->snapshots_offset = snapshots_offset;
 314     s->snapshots_size = snapshots_size;
 315     return 0;
 316
 317 fail:
 318     if (snapshots_offset > 0) {
 319         qcow2_free_clusters(bs, snapshots_offset, snapshots_size,
 320                             QCOW2_DISCARD_ALWAYS);
 321     }
 322     return ret;
 323 }
 324
 325 static void find_new_snapshot_id(BlockDriverState *bs,
 326                                  char *id_str, int id_str_size)
 327 {
 328     BDRVQcow2State *s = bs->opaque;
 329     QCowSnapshot *sn;
 330     int i;
 331     unsigned long id, id_max = 0;
 332
 333     for(i = 0; i < s->nb_snapshots; i++) {
 334         sn = s->snapshots + i;
 335         id = strtoul(sn->id_str, NULL, 10);
 336         if (id > id_max)
 337             id_max = id;
 338     }
 339     snprintf(id_str, id_str_size, "%lu", id_max + 1);
 340 }
 341
 342 static int find_snapshot_by_id_and_name(BlockDriverState *bs,
 343                                         const char *id,
 344                                         const char *name)
 345 {
 346     BDRVQcow2State *s = bs->opaque;
 347     int i;
 348
 349     if (id && name) {
 350         for (i = 0; i < s->nb_snapshots; i++) {
 351             if (!strcmp(s->snapshots[i].id_str, id) &&
 352                 !strcmp(s->snapshots[i].name, name)) {
 353                 return i;
 354             }
 355         }
 356     } else if (id) {
 357         for (i = 0; i < s->nb_snapshots; i++) {
 358             if (!strcmp(s->snapshots[i].id_str, id)) {
 359                 return i;
 360             }
 361         }
 362     } else if (name) {
 363         for (i = 0; i < s->nb_snapshots; i++) {
 364             if (!strcmp(s->snapshots[i].name, name)) {
 365                 return i;
 366             }
 367         }
 368     }
 369
 370     return -1;
 371 }
 372
 373 static int find_snapshot_by_id_or_name(BlockDriverState *bs,
 374                                        const char *id_or_name)
 375 {
 376     int ret;
 377
 378     ret = find_snapshot_by_id_and_name(bs, id_or_name, NULL);
 379     if (ret >= 0) {
 380         return ret;
 381     }
 382     return find_snapshot_by_id_and_name(bs, NULL, id_or_name);
 383 }
 384
 385 /* if no id is provided, a new one is constructed */
 386 int qcow2_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)
 387 {
 388     BDRVQcow2State *s = bs->opaque;
 389     QCowSnapshot *new_snapshot_list = NULL;
 390     QCowSnapshot *old_snapshot_list = NULL;
 391     QCowSnapshot sn1, *sn = &sn1;
 392     int i, ret;
 393     uint64_t *l1_table = NULL;
 394     int64_t l1_table_offset;
 395
 396     if (s->nb_snapshots >= QCOW_MAX_SNAPSHOTS) {
 397         return -EFBIG;
 398     }
 399
 400     if (has_data_file(bs)) {
 401         return -ENOTSUP;
 402     }
 403
 404     memset(sn, 0, sizeof(*sn));
 405
 406     /* Generate an ID */
 407     find_new_snapshot_id(bs, sn_info->id_str, sizeof(sn_info->id_str));
 408
 409     /* Populate sn with passed data */
 410     sn->id_str = g_strdup(sn_info->id_str);
 411     sn->name = g_strdup(sn_info->name);
 412
 413     sn->disk_size = bs->total_sectors * BDRV_SECTOR_SIZE;
 414     sn->vm_state_size = sn_info->vm_state_size;
 415     sn->date_sec = sn_info->date_sec;
 416     sn->date_nsec = sn_info->date_nsec;
 417     sn->vm_clock_nsec = sn_info->vm_clock_nsec;
 418     sn->extra_data_size = sizeof(QCowSnapshotExtraData);
 419
 420     /* Allocate the L1 table of the snapshot and copy the current one there. */
 421     l1_table_offset = qcow2_alloc_clusters(bs, s->l1_size * sizeof(uint64_t));
 422     if (l1_table_offset < 0) {
 423         ret = l1_table_offset;
 424         goto fail;
 425     }
 426
 427     sn->l1_table_offset = l1_table_offset;
 428     sn->l1_size = s->l1_size;
 429
 430     l1_table = g_try_new(uint64_t, s->l1_size);
 431     if (s->l1_size && l1_table == NULL) {
 432         ret = -ENOMEM;
 433         goto fail;
 434     }
 435
 436     for(i = 0; i < s->l1_size; i++) {
 437         l1_table[i] = cpu_to_be64(s->l1_table[i]);
 438     }
 439
 440     ret = qcow2_pre_write_overlap_check(bs, 0, sn->l1_table_offset,
 441                                         s->l1_size * sizeof(uint64_t), false);
 442     if (ret < 0) {
 443         goto fail;
 444     }
 445
 446     ret = bdrv_pwrite(bs->file, sn->l1_table_offset, l1_table,
 447                       s->l1_size * sizeof(uint64_t));
 448     if (ret < 0) {
 449         goto fail;
 450     }
 451
 452     g_free(l1_table);
 453     l1_table = NULL;
 454
 455     /*
 456      * Increase the refcounts of all clusters and make sure everything is
 457      * stable on disk before updating the snapshot table to contain a pointer
 458      * to the new L1 table.
 459      */
 460     ret = qcow2_update_snapshot_refcount(bs, s->l1_table_offset, s->l1_size, 1);
 461     if (ret < 0) {
 462         goto fail;
 463     }
 464
 465     /* Append the new snapshot to the snapshot list */
 466     new_snapshot_list = g_new(QCowSnapshot, s->nb_snapshots + 1);
 467     if (s->snapshots) {
 468         memcpy(new_snapshot_list, s->snapshots,
 469                s->nb_snapshots * sizeof(QCowSnapshot));
 470         old_snapshot_list = s->snapshots;
 471     }
 472     s->snapshots = new_snapshot_list;
 473     s->snapshots[s->nb_snapshots++] = *sn;
 474
 475     ret = qcow2_write_snapshots(bs);
 476     if (ret < 0) {
 477         g_free(s->snapshots);
 478         s->snapshots = old_snapshot_list;
 479         s->nb_snapshots--;
 480         goto fail;
 481     }
 482
 483     g_free(old_snapshot_list);
 484
 485     /* The VM state isn't needed any more in the active L1 table; in fact, it
 486      * hurts by causing expensive COW for the next snapshot. */
 487     qcow2_cluster_discard(bs, qcow2_vm_state_offset(s),
 488                           ROUND_UP(sn->vm_state_size, s->cluster_size),
 489                           QCOW2_DISCARD_NEVER, false);
 490
 491 #ifdef DEBUG_ALLOC
 492     {
 493       BdrvCheckResult result = {0};
 494       qcow2_check_refcounts(bs, &result, 0);
 495     }
 496 #endif
 497     return 0;
 498
 499 fail:
 500     g_free(sn->id_str);
 501     g_free(sn->name);
 502     g_free(l1_table);
 503
 504     return ret;
 505 }
 506
 507 /* copy the snapshot 'snapshot_name' into the current disk image */
 508 int qcow2_snapshot_goto(BlockDriverState *bs, const char *snapshot_id)
 509 {
 510     BDRVQcow2State *s = bs->opaque;
 511     QCowSnapshot *sn;
 512     Error *local_err = NULL;
 513     int i, snapshot_index;
 514     int cur_l1_bytes, sn_l1_bytes;
 515     int ret;
 516     uint64_t *sn_l1_table = NULL;
 517
 518     if (has_data_file(bs)) {
 519         return -ENOTSUP;
 520     }
 521
 522     /* Search the snapshot */
 523     snapshot_index = find_snapshot_by_id_or_name(bs, snapshot_id);
 524     if (snapshot_index < 0) {
 525         return -ENOENT;
 526     }
 527     sn = &s->snapshots[snapshot_index];
 528
 529     ret = qcow2_validate_table(bs, sn->l1_table_offset, sn->l1_size,
 530                                sizeof(uint64_t), QCOW_MAX_L1_SIZE,
 531                                "Snapshot L1 table", &local_err);
 532     if (ret < 0) {
 533         error_report_err(local_err);
 534         goto fail;
 535     }
 536
 537     if (sn->disk_size != bs->total_sectors * BDRV_SECTOR_SIZE) {
 538         error_report("qcow2: Loading snapshots with different disk "
 539             "size is not implemented");
 540         ret = -ENOTSUP;
 541         goto fail;
 542     }
 543
 544     /*
 545      * Make sure that the current L1 table is big enough to contain the whole
 546      * L1 table of the snapshot. If the snapshot L1 table is smaller, the
 547      * current one must be padded with zeros.
 548      */
 549     ret = qcow2_grow_l1_table(bs, sn->l1_size, true);
 550     if (ret < 0) {
 551         goto fail;
 552     }
 553
 554     cur_l1_bytes = s->l1_size * sizeof(uint64_t);
 555     sn_l1_bytes = sn->l1_size * sizeof(uint64_t);
 556
 557     /*
 558      * Copy the snapshot L1 table to the current L1 table.
 559      *
 560      * Before overwriting the old current L1 table on disk, make sure to
 561      * increase all refcounts for the clusters referenced by the new one.
 562      * Decrease the refcount referenced by the old one only when the L1
 563      * table is overwritten.
 564      */
 565     sn_l1_table = g_try_malloc0(cur_l1_bytes);
 566     if (cur_l1_bytes && sn_l1_table == NULL) {
 567         ret = -ENOMEM;
 568         goto fail;
 569     }
 570
 571     ret = bdrv_pread(bs->file, sn->l1_table_offset,
 572                      sn_l1_table, sn_l1_bytes);
 573     if (ret < 0) {
 574         goto fail;
 575     }
 576
 577     ret = qcow2_update_snapshot_refcount(bs, sn->l1_table_offset,
 578                                          sn->l1_size, 1);
 579     if (ret < 0) {
 580         goto fail;
 581     }
 582
 583     ret = qcow2_pre_write_overlap_check(bs, QCOW2_OL_ACTIVE_L1,
 584                                         s->l1_table_offset, cur_l1_bytes,
 585                                         false);
 586     if (ret < 0) {
 587         goto fail;
 588     }
 589
 590     ret = bdrv_pwrite_sync(bs->file, s->l1_table_offset, sn_l1_table,
 591                            cur_l1_bytes);
 592     if (ret < 0) {
 593         goto fail;
 594     }
 595
 596     /*
 597      * Decrease refcount of clusters of current L1 table.
 598      *
 599      * At this point, the in-memory s->l1_table points to the old L1 table,
 600      * whereas on disk we already have the new one.
 601      *
 602      * qcow2_update_snapshot_refcount special cases the current L1 table to use
 603      * the in-memory data instead of really using the offset to load a new one,
 604      * which is why this works.
 605      */
 606     ret = qcow2_update_snapshot_refcount(bs, s->l1_table_offset,
 607                                          s->l1_size, -1);
 608
 609     /*
 610      * Now update the in-memory L1 table to be in sync with the on-disk one. We
 611      * need to do this even if updating refcounts failed.
 612      */
 613     for(i = 0;i < s->l1_size; i++) {
 614         s->l1_table[i] = be64_to_cpu(sn_l1_table[i]);
 615     }
 616
 617     if (ret < 0) {
 618         goto fail;
 619     }
 620
 621     g_free(sn_l1_table);
 622     sn_l1_table = NULL;
 623
 624     /*
 625      * Update QCOW_OFLAG_COPIED in the active L1 table (it may have changed
 626      * when we decreased the refcount of the old snapshot.
 627      */
 628     ret = qcow2_update_snapshot_refcount(bs, s->l1_table_offset, s->l1_size, 0);
 629     if (ret < 0) {
 630         goto fail;
 631     }
 632
 633 #ifdef DEBUG_ALLOC
 634     {
 635         BdrvCheckResult result = {0};
 636         qcow2_check_refcounts(bs, &result, 0);
 637     }
 638 #endif
 639     return 0;
 640
 641 fail:
 642     g_free(sn_l1_table);
 643     return ret;
 644 }
 645
 646 int qcow2_snapshot_delete(BlockDriverState *bs,
 647                           const char *snapshot_id,
 648                           const char *name,
 649                           Error **errp)
 650 {
 651     BDRVQcow2State *s = bs->opaque;
 652     QCowSnapshot sn;
 653     int snapshot_index, ret;
 654
 655     if (has_data_file(bs)) {
 656         return -ENOTSUP;
 657     }
 658
 659     /* Search the snapshot */
 660     snapshot_index = find_snapshot_by_id_and_name(bs, snapshot_id, name);
 661     if (snapshot_index < 0) {
 662         error_setg(errp, "Can't find the snapshot");
 663         return -ENOENT;
 664     }
 665     sn = s->snapshots[snapshot_index];
 666
 667     ret = qcow2_validate_table(bs, sn.l1_table_offset, sn.l1_size,
 668                                sizeof(uint64_t), QCOW_MAX_L1_SIZE,
 669                                "Snapshot L1 table", errp);
 670     if (ret < 0) {
 671         return ret;
 672     }
 673
 674     /* Remove it from the snapshot list */
 675     memmove(s->snapshots + snapshot_index,
 676             s->snapshots + snapshot_index + 1,
 677             (s->nb_snapshots - snapshot_index - 1) * sizeof(sn));
 678     s->nb_snapshots--;
 679     ret = qcow2_write_snapshots(bs);
 680     if (ret < 0) {
 681         error_setg_errno(errp, -ret,
 682                          "Failed to remove snapshot from snapshot list");
 683         return ret;
 684     }
 685
 686     /*
 687      * The snapshot is now unused, clean up. If we fail after this point, we
 688      * won't recover but just leak clusters.
 689      */
 690     g_free(sn.unknown_extra_data);
 691     g_free(sn.id_str);
 692     g_free(sn.name);
 693
 694     /*
 695      * Now decrease the refcounts of clusters referenced by the snapshot and
 696      * free the L1 table.
 697      */
 698     ret = qcow2_update_snapshot_refcount(bs, sn.l1_table_offset,
 699                                          sn.l1_size, -1);
 700     if (ret < 0) {
 701         error_setg_errno(errp, -ret, "Failed to free the cluster and L1 table");
 702         return ret;
 703     }
 704     qcow2_free_clusters(bs, sn.l1_table_offset, sn.l1_size * sizeof(uint64_t),
 705                         QCOW2_DISCARD_SNAPSHOT);
 706
 707     /* must update the copied flag on the current cluster offsets */
 708     ret = qcow2_update_snapshot_refcount(bs, s->l1_table_offset, s->l1_size, 0);
 709     if (ret < 0) {
 710         error_setg_errno(errp, -ret,
 711                          "Failed to update snapshot status in disk");
 712         return ret;
 713     }
 714
 715 #ifdef DEBUG_ALLOC
 716     {
 717         BdrvCheckResult result = {0};
 718         qcow2_check_refcounts(bs, &result, 0);
 719     }
 720 #endif
 721     return 0;
 722 }
 723
 724 int qcow2_snapshot_list(BlockDriverState *bs, QEMUSnapshotInfo **psn_tab)
 725 {
 726     BDRVQcow2State *s = bs->opaque;
 727     QEMUSnapshotInfo *sn_tab, *sn_info;
 728     QCowSnapshot *sn;
 729     int i;
 730
 731     if (has_data_file(bs)) {
 732         return -ENOTSUP;
 733     }
 734     if (!s->nb_snapshots) {
 735         *psn_tab = NULL;
 736         return s->nb_snapshots;
 737     }
 738
 739     sn_tab = g_new0(QEMUSnapshotInfo, s->nb_snapshots);
 740     for(i = 0; i < s->nb_snapshots; i++) {
 741         sn_info = sn_tab + i;
 742         sn = s->snapshots + i;
 743         pstrcpy(sn_info->id_str, sizeof(sn_info->id_str),
 744                 sn->id_str);
 745         pstrcpy(sn_info->name, sizeof(sn_info->name),
 746                 sn->name);
 747         sn_info->vm_state_size = sn->vm_state_size;
 748         sn_info->date_sec = sn->date_sec;
 749         sn_info->date_nsec = sn->date_nsec;
 750         sn_info->vm_clock_nsec = sn->vm_clock_nsec;
 751     }
 752     *psn_tab = sn_tab;
 753     return s->nb_snapshots;
 754 }
 755
 756 int qcow2_snapshot_load_tmp(BlockDriverState *bs,
 757                             const char *snapshot_id,
 758                             const char *name,
 759                             Error **errp)
 760 {
 761     int i, snapshot_index;
 762     BDRVQcow2State *s = bs->opaque;
 763     QCowSnapshot *sn;
 764     uint64_t *new_l1_table;
 765     int new_l1_bytes;
 766     int ret;
 767
 768     assert(bs->read_only);
 769
 770     /* Search the snapshot */
 771     snapshot_index = find_snapshot_by_id_and_name(bs, snapshot_id, name);
 772     if (snapshot_index < 0) {
 773         error_setg(errp,
 774                    "Can't find snapshot");
 775         return -ENOENT;
 776     }
 777     sn = &s->snapshots[snapshot_index];
 778
 779     /* Allocate and read in the snapshot's L1 table */
 780     ret = qcow2_validate_table(bs, sn->l1_table_offset, sn->l1_size,
 781                                sizeof(uint64_t), QCOW_MAX_L1_SIZE,
 782                                "Snapshot L1 table", errp);
 783     if (ret < 0) {
 784         return ret;
 785     }
 786     new_l1_bytes = sn->l1_size * sizeof(uint64_t);
 787     new_l1_table = qemu_try_blockalign(bs->file->bs,
 788                                        ROUND_UP(new_l1_bytes, 512));
 789     if (new_l1_table == NULL) {
 790         return -ENOMEM;
 791     }
 792
 793     ret = bdrv_pread(bs->file, sn->l1_table_offset,
 794                      new_l1_table, new_l1_bytes);
 795     if (ret < 0) {
 796         error_setg(errp, "Failed to read l1 table for snapshot");
 797         qemu_vfree(new_l1_table);
 798         return ret;
 799     }
 800
 801     /* Switch the L1 table */
 802     qemu_vfree(s->l1_table);
 803
 804     s->l1_size = sn->l1_size;
 805     s->l1_table_offset = sn->l1_table_offset;
 806     s->l1_table = new_l1_table;
 807
 808     for(i = 0;i < s->l1_size; i++) {
 809         be64_to_cpus(&s->l1_table[i]);
 810     }
 811
 812     return 0;
 813 }