cachepc-qemu

Fork of AMDESE/qemu with changes for cachepc side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-qemu
Log | Files | Refs | Submodules | LICENSE | sfeed.txt

138 (3498B)


      1#!/usr/bin/env bash
      2# group: rw auto quick
      3#
      4# General test case for qcow2's image check
      5#
      6# Copyright (C) 2015 Red Hat, Inc.
      7#
      8# This program is free software; you can redistribute it and/or modify
      9# it under the terms of the GNU General Public License as published by
     10# the Free Software Foundation; either version 2 of the License, or
     11# (at your option) any later version.
     12#
     13# This program is distributed in the hope that it will be useful,
     14# but WITHOUT ANY WARRANTY; without even the implied warranty of
     15# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     16# GNU General Public License for more details.
     17#
     18# You should have received a copy of the GNU General Public License
     19# along with this program.  If not, see <http://www.gnu.org/licenses/>.
     20#
     21
     22# creator
     23owner=mreitz@redhat.com
     24
     25seq="$(basename $0)"
     26echo "QA output created by $seq"
     27
     28status=1	# failure is the default!
     29
     30_cleanup()
     31{
     32	_cleanup_test_img
     33}
     34trap "_cleanup; exit \$status" 0 1 2 3 15
     35
     36# get standard environment, filters and checks
     37. ./common.rc
     38. ./common.filter
     39
     40# This tests qcow2-specific low-level functionality
     41_supported_fmt qcow2
     42_supported_proto file fuse
     43_supported_os Linux
     44# With an external data file, data clusters are not refcounted
     45# (so qemu-img check would not do much);
     46# we want to modify the refcounts, so we need them to have a specific
     47# format (namely u16)
     48_unsupported_imgopts data_file 'refcount_bits=\([^1]\|.\([^6]\|$\)\)'
     49
     50echo
     51echo '=== Check on an image with a multiple of 2^32 clusters ==='
     52echo
     53
     54_make_test_img -o "cluster_size=512" 512
     55
     56# Allocate L2 table
     57$QEMU_IO -c 'write 0 512' "$TEST_IMG" | _filter_qemu_io
     58
     59# Put the data cluster at a multiple of 2 TB, resulting in the image apparently
     60# having a multiple of 2^32 clusters
     61# (To be more specific: It is at 32 PB)
     62poke_file "$TEST_IMG" $((2048 + 8)) "\x00\x80\x00\x00\x00\x00\x00\x00"
     63
     64# An offset of 32 PB results in qemu-img check having to allocate an in-memory
     65# refcount table of 128 TB (16 bit refcounts, 512 byte clusters), if qemu-img
     66# don't check that referenced data cluster is far beyond the end of file.
     67# But starting from 4.0, qemu-img does this check, and instead of "Cannot
     68# allocate memory", we have an error showing that l2 entry is invalid.
     69_check_test_img
     70
     71echo
     72echo '=== Check leaks-fixed/corruptions-fixed report'
     73echo
     74
     75# After leaks and corruptions were fixed, those numbers should be
     76# reported by qemu-img check
     77_make_test_img 64k
     78
     79# Allocate data cluster
     80$QEMU_IO -c 'write 0 64k' "$TEST_IMG" | _filter_qemu_io
     81
     82reftable_ofs=$(peek_file_be "$TEST_IMG" 48 8)
     83refblock_ofs=$(peek_file_be "$TEST_IMG" $reftable_ofs 8)
     84
     85# Introduce a leak: Make the image header's refcount 2
     86poke_file_be "$TEST_IMG" "$refblock_ofs" 2 2
     87
     88l1_ofs=$(peek_file_be "$TEST_IMG" 40 8)
     89
     90# Introduce a corruption: Drop the COPIED flag from the (first) L1 entry
     91l1_entry=$(peek_file_be "$TEST_IMG" $l1_ofs 8)
     92l1_entry=$((l1_entry & ~(1 << 63)))
     93poke_file_be "$TEST_IMG" $l1_ofs 8 $l1_entry
     94
     95echo
     96# Should print the number of corruptions and leaks fixed
     97# (Filter out all JSON fields (recognizable by their four-space
     98# indentation), but keep the "-fixed" fields (by removing two spaces
     99# from their indentation))
    100# (Also filter out the L1 entry, because why not)
    101_check_test_img -r all --output=json \
    102    | sed -e 's/^  \(.*\)-fixed"/\1-fixed"/' \
    103          -e '/^    /d' \
    104          -e "s/\\([^0-9a-f]\\)$(printf %x $l1_entry)\\([^0-9a-f]\\)/\1L1_ENTRY_VALUE\2/"
    105
    106# success, all done
    107echo "*** done"
    108rm -f $seq.full
    109status=0