cachepc-qemu

Fork of AMDESE/qemu with changes for cachepc side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-qemu
Log | Files | Refs | Submodules | LICENSE | sfeed.txt

cloop.c (9494B)


      1/*
      2 * QEMU Block driver for CLOOP images
      3 *
      4 * Copyright (c) 2004 Johannes E. Schindelin
      5 *
      6 * Permission is hereby granted, free of charge, to any person obtaining a copy
      7 * of this software and associated documentation files (the "Software"), to deal
      8 * in the Software without restriction, including without limitation the rights
      9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
     10 * copies of the Software, and to permit persons to whom the Software is
     11 * furnished to do so, subject to the following conditions:
     12 *
     13 * The above copyright notice and this permission notice shall be included in
     14 * all copies or substantial portions of the Software.
     15 *
     16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
     17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
     18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
     19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
     20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
     21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
     22 * THE SOFTWARE.
     23 */
     24#include "qemu/osdep.h"
     25#include "qapi/error.h"
     26#include "qemu/error-report.h"
     27#include "block/block_int.h"
     28#include "qemu/module.h"
     29#include "qemu/bswap.h"
     30#include <zlib.h>
     31
     32/* Maximum compressed block size */
     33#define MAX_BLOCK_SIZE (64 * 1024 * 1024)
     34
     35typedef struct BDRVCloopState {
     36    CoMutex lock;
     37    uint32_t block_size;
     38    uint32_t n_blocks;
     39    uint64_t *offsets;
     40    uint32_t sectors_per_block;
     41    uint32_t current_block;
     42    uint8_t *compressed_block;
     43    uint8_t *uncompressed_block;
     44    z_stream zstream;
     45} BDRVCloopState;
     46
     47static int cloop_probe(const uint8_t *buf, int buf_size, const char *filename)
     48{
     49    const char *magic_version_2_0 = "#!/bin/sh\n"
     50        "#V2.0 Format\n"
     51        "modprobe cloop file=$0 && mount -r -t iso9660 /dev/cloop $1\n";
     52    int length = strlen(magic_version_2_0);
     53    if (length > buf_size) {
     54        length = buf_size;
     55    }
     56    if (!memcmp(magic_version_2_0, buf, length)) {
     57        return 2;
     58    }
     59    return 0;
     60}
     61
     62static int cloop_open(BlockDriverState *bs, QDict *options, int flags,
     63                      Error **errp)
     64{
     65    BDRVCloopState *s = bs->opaque;
     66    uint32_t offsets_size, max_compressed_block_size = 1, i;
     67    int ret;
     68
     69    ret = bdrv_apply_auto_read_only(bs, NULL, errp);
     70    if (ret < 0) {
     71        return ret;
     72    }
     73
     74    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
     75                               BDRV_CHILD_IMAGE, false, errp);
     76    if (!bs->file) {
     77        return -EINVAL;
     78    }
     79
     80    /* read header */
     81    ret = bdrv_pread(bs->file, 128, &s->block_size, 4);
     82    if (ret < 0) {
     83        return ret;
     84    }
     85    s->block_size = be32_to_cpu(s->block_size);
     86    if (s->block_size % 512) {
     87        error_setg(errp, "block_size %" PRIu32 " must be a multiple of 512",
     88                   s->block_size);
     89        return -EINVAL;
     90    }
     91    if (s->block_size == 0) {
     92        error_setg(errp, "block_size cannot be zero");
     93        return -EINVAL;
     94    }
     95
     96    /* cloop's create_compressed_fs.c warns about block sizes beyond 256 KB but
     97     * we can accept more.  Prevent ridiculous values like 4 GB - 1 since we
     98     * need a buffer this big.
     99     */
    100    if (s->block_size > MAX_BLOCK_SIZE) {
    101        error_setg(errp, "block_size %" PRIu32 " must be %u MB or less",
    102                   s->block_size,
    103                   MAX_BLOCK_SIZE / (1024 * 1024));
    104        return -EINVAL;
    105    }
    106
    107    ret = bdrv_pread(bs->file, 128 + 4, &s->n_blocks, 4);
    108    if (ret < 0) {
    109        return ret;
    110    }
    111    s->n_blocks = be32_to_cpu(s->n_blocks);
    112
    113    /* read offsets */
    114    if (s->n_blocks > (UINT32_MAX - 1) / sizeof(uint64_t)) {
    115        /* Prevent integer overflow */
    116        error_setg(errp, "n_blocks %" PRIu32 " must be %zu or less",
    117                   s->n_blocks,
    118                   (UINT32_MAX - 1) / sizeof(uint64_t));
    119        return -EINVAL;
    120    }
    121    offsets_size = (s->n_blocks + 1) * sizeof(uint64_t);
    122    if (offsets_size > 512 * 1024 * 1024) {
    123        /* Prevent ridiculous offsets_size which causes memory allocation to
    124         * fail or overflows bdrv_pread() size.  In practice the 512 MB
    125         * offsets[] limit supports 16 TB images at 256 KB block size.
    126         */
    127        error_setg(errp, "image requires too many offsets, "
    128                   "try increasing block size");
    129        return -EINVAL;
    130    }
    131
    132    s->offsets = g_try_malloc(offsets_size);
    133    if (s->offsets == NULL) {
    134        error_setg(errp, "Could not allocate offsets table");
    135        return -ENOMEM;
    136    }
    137
    138    ret = bdrv_pread(bs->file, 128 + 4 + 4, s->offsets, offsets_size);
    139    if (ret < 0) {
    140        goto fail;
    141    }
    142
    143    for (i = 0; i < s->n_blocks + 1; i++) {
    144        uint64_t size;
    145
    146        s->offsets[i] = be64_to_cpu(s->offsets[i]);
    147        if (i == 0) {
    148            continue;
    149        }
    150
    151        if (s->offsets[i] < s->offsets[i - 1]) {
    152            error_setg(errp, "offsets not monotonically increasing at "
    153                       "index %" PRIu32 ", image file is corrupt", i);
    154            ret = -EINVAL;
    155            goto fail;
    156        }
    157
    158        size = s->offsets[i] - s->offsets[i - 1];
    159
    160        /* Compressed blocks should be smaller than the uncompressed block size
    161         * but maybe compression performed poorly so the compressed block is
    162         * actually bigger.  Clamp down on unrealistic values to prevent
    163         * ridiculous s->compressed_block allocation.
    164         */
    165        if (size > 2 * MAX_BLOCK_SIZE) {
    166            error_setg(errp, "invalid compressed block size at index %" PRIu32
    167                       ", image file is corrupt", i);
    168            ret = -EINVAL;
    169            goto fail;
    170        }
    171
    172        if (size > max_compressed_block_size) {
    173            max_compressed_block_size = size;
    174        }
    175    }
    176
    177    /* initialize zlib engine */
    178    s->compressed_block = g_try_malloc(max_compressed_block_size + 1);
    179    if (s->compressed_block == NULL) {
    180        error_setg(errp, "Could not allocate compressed_block");
    181        ret = -ENOMEM;
    182        goto fail;
    183    }
    184
    185    s->uncompressed_block = g_try_malloc(s->block_size);
    186    if (s->uncompressed_block == NULL) {
    187        error_setg(errp, "Could not allocate uncompressed_block");
    188        ret = -ENOMEM;
    189        goto fail;
    190    }
    191
    192    if (inflateInit(&s->zstream) != Z_OK) {
    193        ret = -EINVAL;
    194        goto fail;
    195    }
    196    s->current_block = s->n_blocks;
    197
    198    s->sectors_per_block = s->block_size/512;
    199    bs->total_sectors = s->n_blocks * s->sectors_per_block;
    200    qemu_co_mutex_init(&s->lock);
    201    return 0;
    202
    203fail:
    204    g_free(s->offsets);
    205    g_free(s->compressed_block);
    206    g_free(s->uncompressed_block);
    207    return ret;
    208}
    209
    210static void cloop_refresh_limits(BlockDriverState *bs, Error **errp)
    211{
    212    bs->bl.request_alignment = BDRV_SECTOR_SIZE; /* No sub-sector I/O */
    213}
    214
    215static inline int cloop_read_block(BlockDriverState *bs, int block_num)
    216{
    217    BDRVCloopState *s = bs->opaque;
    218
    219    if (s->current_block != block_num) {
    220        int ret;
    221        uint32_t bytes = s->offsets[block_num + 1] - s->offsets[block_num];
    222
    223        ret = bdrv_pread(bs->file, s->offsets[block_num],
    224                         s->compressed_block, bytes);
    225        if (ret != bytes) {
    226            return -1;
    227        }
    228
    229        s->zstream.next_in = s->compressed_block;
    230        s->zstream.avail_in = bytes;
    231        s->zstream.next_out = s->uncompressed_block;
    232        s->zstream.avail_out = s->block_size;
    233        ret = inflateReset(&s->zstream);
    234        if (ret != Z_OK) {
    235            return -1;
    236        }
    237        ret = inflate(&s->zstream, Z_FINISH);
    238        if (ret != Z_STREAM_END || s->zstream.total_out != s->block_size) {
    239            return -1;
    240        }
    241
    242        s->current_block = block_num;
    243    }
    244    return 0;
    245}
    246
    247static int coroutine_fn
    248cloop_co_preadv(BlockDriverState *bs, int64_t offset, int64_t bytes,
    249                QEMUIOVector *qiov, BdrvRequestFlags flags)
    250{
    251    BDRVCloopState *s = bs->opaque;
    252    uint64_t sector_num = offset >> BDRV_SECTOR_BITS;
    253    int nb_sectors = bytes >> BDRV_SECTOR_BITS;
    254    int ret, i;
    255
    256    assert(QEMU_IS_ALIGNED(offset, BDRV_SECTOR_SIZE));
    257    assert(QEMU_IS_ALIGNED(bytes, BDRV_SECTOR_SIZE));
    258
    259    qemu_co_mutex_lock(&s->lock);
    260
    261    for (i = 0; i < nb_sectors; i++) {
    262        void *data;
    263        uint32_t sector_offset_in_block =
    264            ((sector_num + i) % s->sectors_per_block),
    265            block_num = (sector_num + i) / s->sectors_per_block;
    266        if (cloop_read_block(bs, block_num) != 0) {
    267            ret = -EIO;
    268            goto fail;
    269        }
    270
    271        data = s->uncompressed_block + sector_offset_in_block * 512;
    272        qemu_iovec_from_buf(qiov, i * 512, data, 512);
    273    }
    274
    275    ret = 0;
    276fail:
    277    qemu_co_mutex_unlock(&s->lock);
    278
    279    return ret;
    280}
    281
    282static void cloop_close(BlockDriverState *bs)
    283{
    284    BDRVCloopState *s = bs->opaque;
    285    g_free(s->offsets);
    286    g_free(s->compressed_block);
    287    g_free(s->uncompressed_block);
    288    inflateEnd(&s->zstream);
    289}
    290
    291static BlockDriver bdrv_cloop = {
    292    .format_name    = "cloop",
    293    .instance_size  = sizeof(BDRVCloopState),
    294    .bdrv_probe     = cloop_probe,
    295    .bdrv_open      = cloop_open,
    296    .bdrv_child_perm     = bdrv_default_perms,
    297    .bdrv_refresh_limits = cloop_refresh_limits,
    298    .bdrv_co_preadv = cloop_co_preadv,
    299    .bdrv_close     = cloop_close,
    300    .is_format      = true,
    301};
    302
    303static void bdrv_cloop_init(void)
    304{
    305    bdrv_register(&bdrv_cloop);
    306}
    307
    308block_init(bdrv_cloop_init);