cachepc-qemu

Fork of AMDESE/qemu with changes for cachepc side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-qemu
Log | Files | Refs | Submodules | LICENSE | sfeed.txt

214 (5350B)


      1#!/usr/bin/env bash
      2# group: rw auto
      3#
      4# Test qcow2 image compression
      5#
      6# Copyright (C) 2018 Igalia, S.L.
      7# Author: Alberto Garcia <berto@igalia.com>
      8#
      9# This program is free software; you can redistribute it and/or modify
     10# it under the terms of the GNU General Public License as published by
     11# the Free Software Foundation; either version 2 of the License, or
     12# (at your option) any later version.
     13#
     14# This program is distributed in the hope that it will be useful,
     15# but WITHOUT ANY WARRANTY; without even the implied warranty of
     16# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     17# GNU General Public License for more details.
     18#
     19# You should have received a copy of the GNU General Public License
     20# along with this program.  If not, see <http://www.gnu.org/licenses/>.
     21#
     22
     23seq=$(basename "$0")
     24echo "QA output created by $seq"
     25
     26status=1	# failure is the default!
     27
     28_cleanup()
     29{
     30    _cleanup_test_img
     31}
     32trap "_cleanup; exit \$status" 0 1 2 3 15
     33
     34# get standard environment, filters and checks
     35. ./common.rc
     36. ./common.filter
     37
     38_supported_fmt qcow2
     39_supported_proto file fuse
     40
     41# Repairing the corrupted image requires qemu-img check to store a
     42# refcount up to 3, which requires at least two refcount bits.
     43# External data files do not support compressed clusters.
     44_unsupported_imgopts 'refcount_bits=1[^0-9]' data_file
     45
     46
     47echo
     48echo "=== Corrupted size field in compressed cluster descriptor ==="
     49echo
     50# Create an empty image and fill half of it with compressed data.
     51# The L2 entries of the two compressed clusters are located at
     52# 0x800000 and 0x800008, their original values are 0x4008000000a00000
     53# and 0x4008000000a00802 (5 sectors for compressed data each).
     54_make_test_img 8M -o cluster_size=2M
     55$QEMU_IO -c "write -c -P 0x11 0 2M" -c "write -c -P 0x11 2M 2M" "$TEST_IMG" \
     56         2>&1 | _filter_qemu_io | _filter_testdir
     57
     58# Reduce size of compressed data to 4 sectors: this corrupts the image.
     59poke_file "$TEST_IMG" $((0x800000)) "\x40\x06"
     60$QEMU_IO -c "read  -P 0x11 0 4M" "$TEST_IMG" 2>&1 | _filter_qemu_io | _filter_testdir
     61
     62# 'qemu-img check' however doesn't see anything wrong because it
     63# doesn't try to decompress the data and the refcounts are consistent.
     64# TODO: update qemu-img so this can be detected.
     65_check_test_img
     66
     67# Increase size of compressed data to the maximum (8192 sectors).
     68# This makes QEMU read more data (8192 sectors instead of 5, host
     69# addresses [0xa00000, 0xdfffff]), but the decompression algorithm
     70# stops once we have enough to restore the uncompressed cluster, so
     71# the rest of the data is ignored.
     72poke_file "$TEST_IMG" $((0x800000)) "\x7f\xfe"
     73# Do it also for the second compressed cluster (L2 entry at 0x800008).
     74# In this case the compressed data would span 3 host clusters
     75# (host addresses: [0xa00802, 0xe00801])
     76poke_file "$TEST_IMG" $((0x800008)) "\x7f\xfe"
     77
     78# Here the image is too small so we're asking QEMU to read beyond the
     79# end of the image.
     80$QEMU_IO -c "read  -P 0x11  0 4M" "$TEST_IMG" 2>&1 | _filter_qemu_io | _filter_testdir
     81# But if we grow the image we won't be reading beyond its end anymore.
     82$QEMU_IO -c "write -P 0x22 4M 4M" "$TEST_IMG" 2>&1 | _filter_qemu_io | _filter_testdir
     83$QEMU_IO -c "read  -P 0x11  0 4M" "$TEST_IMG" 2>&1 | _filter_qemu_io | _filter_testdir
     84
     85# The refcount data is however wrong because due to the increased size
     86# of the compressed data it now reaches the following host clusters.
     87# This can be repaired by qemu-img check by increasing the refcount of
     88# those clusters.
     89# TODO: update qemu-img to correct the compressed cluster size instead.
     90_check_test_img -r all
     91$QEMU_IO -c "read  -P 0x11  0 4M" "$TEST_IMG" 2>&1 | _filter_qemu_io | _filter_testdir
     92$QEMU_IO -c "read  -P 0x22 4M 4M" "$TEST_IMG" 2>&1 | _filter_qemu_io | _filter_testdir
     93
     94echo
     95echo "=== Write compressed data of multiple clusters ==="
     96echo
     97cluster_size=0x10000
     98_make_test_img 2M -o cluster_size=$cluster_size
     99
    100echo "Write uncompressed data:"
    101let data_size="8 * $cluster_size"
    102$QEMU_IO -c "write -P 0xaa 0 $data_size" "$TEST_IMG" \
    103         2>&1 | _filter_qemu_io | _filter_testdir
    104sizeA=$($QEMU_IMG info --output=json "$TEST_IMG" |
    105        sed -n '/"actual-size":/ s/[^0-9]//gp')
    106
    107_make_test_img 2M -o cluster_size=$cluster_size
    108echo "Write compressed data:"
    109let data_size="3 * $cluster_size + $cluster_size / 2"
    110# Set compress on. That will align the written data
    111# by the cluster size and will write them compressed.
    112QEMU_IO_OPTIONS=$QEMU_IO_OPTIONS_NO_FMT \
    113$QEMU_IO -c "write -P 0xbb 0 $data_size" --image-opts \
    114         "driver=compress,file.driver=$IMGFMT,file.file.driver=file,file.file.filename=$TEST_IMG" \
    115         2>&1 | _filter_qemu_io | _filter_testdir
    116
    117let offset="4 * $cluster_size + $cluster_size / 4"
    118QEMU_IO_OPTIONS=$QEMU_IO_OPTIONS_NO_FMT \
    119$QEMU_IO -c "write -P 0xcc $offset $data_size" "json:{\
    120    'driver': 'compress',
    121    'file': {'driver': '$IMGFMT',
    122             'file': {'driver': 'file',
    123                      'filename': '$TEST_IMG'}}}" | \
    124                          _filter_qemu_io | _filter_testdir
    125
    126sizeB=$($QEMU_IMG info --output=json "$TEST_IMG" |
    127        sed -n '/"actual-size":/ s/[^0-9]//gp')
    128
    129if [ $sizeA -lt $sizeB ]
    130then
    131    echo "Compression ERROR ($sizeA < $sizeB)"
    132fi
    133
    134$QEMU_IMG check --output=json "$TEST_IMG" |
    135          sed -n 's/,$//; /"compressed-clusters":/ s/^ *//p'
    136
    137# success, all done
    138echo '*** done'
    139rm -f $seq.full
    140status=0