block: flush cached qcow2 metadata on device pause

The qcow2 backend caches L2 table and refcount updates in memory and
only writes them back on a guest-initiated flush, clean shutdown or
drop. A paused VM therefore leaves the on-disk image without the
mappings for any cluster allocated since the last guest flush: the
data clusters are present in the file, but nothing references them.

Anything that reads the image while the VM is paused sees those
writes as missing. Copying the disk alongside vm.snapshot (the
documented snapshot workflow) captures a stale image, and live
migration releases the disk locks after pausing so the destination
reopens the file with the same stale metadata. In both cases writes
the guest has completed, and may later read back, silently disappear.

Add a MetadataSync capability trait with a no-op default, fold it
into FullDiskFile, implement it for the qcow2 backend as a metadata
cache flush, and call it from the virtio-block pause path after
in-flight requests have drained. Pause is the quiesce point both
flows rely on, and it is a cold path, so the extra flush does not
affect runtime I/O.

Reproduced by writing to a qcow2 disk from the guest with O_DIRECT
and no explicit flush, pausing the VM and copying the image: qemu-img
map on the copy shows no mapped clusters and reads return zeros. With
this change the copy contains every completed write. A unit test
covers the same sequence at the format level: a completed write is
invisible to a fresh reader until sync_metadata, and visible after.

Signed-off-by: CMGS <ilskdw@gmail.com>

block/src/disk_file.rs

@@ -12,6 +12,7 @@
 //! - [`Geometry`] - sector/cluster geometry (default 512B)
 //! - [`SparseCapable`] - sparse and zero flag support
 //! - [`Resizable`] - online resize
+//! - [`MetadataSync`] - flush of format metadata cached in memory
 //!
 //! [`DiskFile`] is a supertrait that bundles the universal capabilities
 //! (`DiskSize` + `Geometry`). [`FullDiskFile`] adds all optional
@@ -25,7 +26,7 @@
 //! FullDiskFile:                           AsyncDiskFile:
 //!   DiskFile + PhysicalSize +               DiskFile + Unpin
 //!   DiskFd + SparseCapable +               try_clone, create_async_io
-//!   Resizable
+//!   Resizable + MetadataSync
 //!         \                                     /
 //!          AsyncFullDiskFile: FullDiskFile + AsyncDiskFile
 //! ```
@@ -91,6 +92,22 @@ pub trait Resizable: Send + Debug {
     fn resize(&mut self, size: u64) -> BlockResult<()>;
 }
 
+/// Flush of format metadata cached in memory.
+///
+/// Default is a no-op for formats that keep no metadata cache
+/// (e.g. raw, fixed vhd).
+pub trait MetadataSync: Send + Debug {
+    /// Flushes format metadata cached in memory (e.g. qcow2 L2/refcount
+    /// tables) to the underlying file.
+    ///
+    /// Called on device pause so that an externally copied or reopened
+    /// image is self-consistent without requiring a guest-initiated
+    /// flush.
+    fn sync_metadata(&self) -> BlockResult<()> {
+        Ok(())
+    }
+}
+
 /// Supertrait bundling universal disk capabilities.
 ///
 /// Every disk format implements `DiskSize` and `Geometry`.
@@ -101,14 +118,20 @@ pub trait DiskFile: DiskSize + Geometry + Sync {}
 /// Full capability disk file trait.
 ///
 /// Bundles all optional capabilities on top of [`DiskFile`]:
-/// file descriptor access, physical size, sparse operations, and resize.
-/// Used by consumers that need feature negotiation without async I/O
-/// (e.g. vhost user block).
-pub trait FullDiskFile: DiskFile + PhysicalSize + DiskFd + SparseCapable + Resizable {}
+/// file descriptor access, physical size, sparse operations, resize,
+/// and metadata sync. Used by consumers that need feature negotiation
+/// without async I/O (e.g. vhost user block).
+pub trait FullDiskFile:
+    DiskFile + PhysicalSize + DiskFd + SparseCapable + Resizable + MetadataSync
+{
+}
 
 /// Blanket implementation: any type implementing all constituent traits
 /// automatically satisfies [`FullDiskFile`].
-impl<T: DiskFile + PhysicalSize + DiskFd + SparseCapable + Resizable> FullDiskFile for T {}
+impl<T: DiskFile + PhysicalSize + DiskFd + SparseCapable + Resizable + MetadataSync> FullDiskFile
+    for T
+{
+}
 
 /// Extended disk file trait for virtio queue workers.
 ///