block: flush cached qcow2 metadata on device pause

The qcow2 backend caches L2 table and refcount updates in memory and
only writes them back on a guest-initiated flush, clean shutdown or
drop. A paused VM therefore leaves the on-disk image without the
mappings for any cluster allocated since the last guest flush: the
data clusters are present in the file, but nothing references them.

Anything that reads the image while the VM is paused sees those
writes as missing. Copying the disk alongside vm.snapshot (the
documented snapshot workflow) captures a stale image, and live
migration releases the disk locks after pausing so the destination
reopens the file with the same stale metadata. In both cases writes
the guest has completed, and may later read back, silently disappear.

Add a MetadataSync capability trait with a no-op default, fold it
into FullDiskFile, implement it for the qcow2 backend as a metadata
cache flush, and call it from the virtio-block pause path after
in-flight requests have drained. Pause is the quiesce point both
flows rely on, and it is a cold path, so the extra flush does not
affect runtime I/O.

Reproduced by writing to a qcow2 disk from the guest with O_DIRECT
and no explicit flush, pausing the VM and copying the image: qemu-img
map on the copy shows no mapped clusters and reads return zeros. With
this change the copy contains every completed write. A unit test
covers the same sequence at the format level: a completed write is
invisible to a fresh reader until sync_metadata, and visible after.

Signed-off-by: CMGS <ilskdw@gmail.com>

block/src/formats/qcow/engine_sync.rs

@@ -318,7 +318,7 @@ mod unit_tests {
     use super::*;
     use crate::aligned_file::AlignedFile;
     use crate::async_io::{AsyncIoCompletion, OwnedIoBuffer};
-    use crate::disk_file::{AsyncDiskFile, DiskSize, Resizable};
+    use crate::disk_file::{AsyncDiskFile, DiskSize, MetadataSync, Resizable};
     use crate::error::BlockErrorKind;
     use crate::formats::qcow;
     use crate::formats::qcow::common::unit_tests::compress_allocated_clusters;
@@ -582,6 +582,47 @@ mod unit_tests {
         );
     }
 
+    // sync_metadata must make completed writes visible to a fresh reader of
+    // the file while the writing disk stays open. Device pause relies on
+    // this so snapshot copies and migration reopen a self-consistent image
+    // without a guest-initiated flush.
+    #[test]
+    fn write_visible_after_sync_metadata_and_reopen() {
+        const CL: u64 = 65536;
+        let virtual_size = 512 * 1024 * 1024;
+        let (temp, disk) = create_disk_with_data(virtual_size, &[], 0, false, false);
+        let pattern = vec![0xA5u8; CL as usize];
+        async_write(&disk, 0, &pattern);
+
+        let reopen = || {
+            QcowDisk::new(
+                temp.as_file().try_clone().unwrap(),
+                false,
+                false,
+                false,
+                false,
+            )
+            .unwrap()
+        };
+
+        // Without the flush the L2 mapping exists only in the writer's
+        // in-memory cache: a fresh reader sees the cluster unallocated.
+        let stale = reopen();
+        assert_eq!(
+            async_read(&stale, 0, CL as usize),
+            vec![0u8; CL as usize],
+            "write leaked to disk without a metadata flush; test is vacuous",
+        );
+
+        disk.sync_metadata().unwrap();
+        let fresh = reopen();
+        assert_eq!(
+            async_read(&fresh, 0, CL as usize),
+            pattern,
+            "write not visible after sync_metadata and reopen",
+        );
+    }
+
     #[test]
     fn test_qcow_sync_rejects_out_of_bounds_allocated_l2_entry_on_read() {
         let data = vec![0x5a; 4096];

block/src/formats/qcow/mod.rs

@@ -294,6 +294,14 @@ impl disk_file::Resizable for QcowDisk {
     }
 }
 
+impl disk_file::MetadataSync for QcowDisk {
+    fn sync_metadata(&self) -> BlockResult<()> {
+        self.metadata
+            .flush()
+            .map_err(|e| BlockError::new(BlockErrorKind::Io, DiskFileError::SyncMetadata(e)))
+    }
+}
+
 impl disk_file::DiskFile for QcowDisk {}
 
 impl disk_file::AsyncDiskFile for QcowDisk {

block/src/formats/raw/mod.rs

@@ -132,6 +132,8 @@ impl disk_file::Resizable for RawDisk {
     }
 }
 
+impl disk_file::MetadataSync for RawDisk {}
+
 impl disk_file::DiskFile for RawDisk {}
 
 impl disk_file::AsyncDiskFile for RawDisk {

block/src/formats/vhd/mod.rs

@@ -104,6 +104,8 @@ impl disk_file::Resizable for VhdDisk {
     }
 }
 
+impl disk_file::MetadataSync for VhdDisk {}
+
 impl disk_file::DiskFile for VhdDisk {}
 
 impl disk_file::AsyncDiskFile for VhdDisk {

block/src/formats/vhdx/mod.rs

@@ -102,6 +102,8 @@ impl disk_file::Resizable for VhdxDisk {
     }
 }
 
+impl disk_file::MetadataSync for VhdxDisk {}
+
 impl disk_file::DiskFile for VhdxDisk {}
 
 impl disk_file::AsyncDiskFile for VhdxDisk {