vpc: Validate block size (CVE-2014-0142)
[qemu.git] / block / vpc.c
1 /*
2 * Block driver for Connectix / Microsoft Virtual PC images
3 *
4 * Copyright (c) 2005 Alex Beregszaszi
5 * Copyright (c) 2009 Kevin Wolf <kwolf@suse.de>
6 *
7 * Permission is hereby granted, free of charge, to any person obtaining a copy
8 * of this software and associated documentation files (the "Software"), to deal
9 * in the Software without restriction, including without limitation the rights
10 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11 * copies of the Software, and to permit persons to whom the Software is
12 * furnished to do so, subject to the following conditions:
13 *
14 * The above copyright notice and this permission notice shall be included in
15 * all copies or substantial portions of the Software.
16 *
17 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23 * THE SOFTWARE.
24 */
25 #include "qemu-common.h"
26 #include "block/block_int.h"
27 #include "qemu/module.h"
28 #include "migration/migration.h"
29 #if defined(CONFIG_UUID)
30 #include <uuid/uuid.h>
31 #endif
32
33 /**************************************************************/
34
35 #define HEADER_SIZE 512
36
37 //#define CACHE
38
39 enum vhd_type {
40 VHD_FIXED = 2,
41 VHD_DYNAMIC = 3,
42 VHD_DIFFERENCING = 4,
43 };
44
45 // Seconds since Jan 1, 2000 0:00:00 (UTC)
46 #define VHD_TIMESTAMP_BASE 946684800
47
48 #define VHD_MAX_SECTORS (65535LL * 255 * 255)
49
50 // always big-endian
51 typedef struct vhd_footer {
52 char creator[8]; // "conectix"
53 uint32_t features;
54 uint32_t version;
55
56 // Offset of next header structure, 0xFFFFFFFF if none
57 uint64_t data_offset;
58
59 // Seconds since Jan 1, 2000 0:00:00 (UTC)
60 uint32_t timestamp;
61
62 char creator_app[4]; // "vpc "
63 uint16_t major;
64 uint16_t minor;
65 char creator_os[4]; // "Wi2k"
66
67 uint64_t orig_size;
68 uint64_t size;
69
70 uint16_t cyls;
71 uint8_t heads;
72 uint8_t secs_per_cyl;
73
74 uint32_t type;
75
76 // Checksum of the Hard Disk Footer ("one's complement of the sum of all
77 // the bytes in the footer without the checksum field")
78 uint32_t checksum;
79
80 // UUID used to identify a parent hard disk (backing file)
81 uint8_t uuid[16];
82
83 uint8_t in_saved_state;
84 } QEMU_PACKED VHDFooter;
85
86 typedef struct vhd_dyndisk_header {
87 char magic[8]; // "cxsparse"
88
89 // Offset of next header structure, 0xFFFFFFFF if none
90 uint64_t data_offset;
91
92 // Offset of the Block Allocation Table (BAT)
93 uint64_t table_offset;
94
95 uint32_t version;
96 uint32_t max_table_entries; // 32bit/entry
97
98 // 2 MB by default, must be a power of two
99 uint32_t block_size;
100
101 uint32_t checksum;
102 uint8_t parent_uuid[16];
103 uint32_t parent_timestamp;
104 uint32_t reserved;
105
106 // Backing file name (in UTF-16)
107 uint8_t parent_name[512];
108
109 struct {
110 uint32_t platform;
111 uint32_t data_space;
112 uint32_t data_length;
113 uint32_t reserved;
114 uint64_t data_offset;
115 } parent_locator[8];
116 } QEMU_PACKED VHDDynDiskHeader;
117
118 typedef struct BDRVVPCState {
119 CoMutex lock;
120 uint8_t footer_buf[HEADER_SIZE];
121 uint64_t free_data_block_offset;
122 int max_table_entries;
123 uint32_t *pagetable;
124 uint64_t bat_offset;
125 uint64_t last_bitmap_offset;
126
127 uint32_t block_size;
128 uint32_t bitmap_size;
129
130 #ifdef CACHE
131 uint8_t *pageentry_u8;
132 uint32_t *pageentry_u32;
133 uint16_t *pageentry_u16;
134
135 uint64_t last_bitmap;
136 #endif
137
138 Error *migration_blocker;
139 } BDRVVPCState;
140
141 static uint32_t vpc_checksum(uint8_t* buf, size_t size)
142 {
143 uint32_t res = 0;
144 int i;
145
146 for (i = 0; i < size; i++)
147 res += buf[i];
148
149 return ~res;
150 }
151
152
153 static int vpc_probe(const uint8_t *buf, int buf_size, const char *filename)
154 {
155 if (buf_size >= 8 && !strncmp((char *)buf, "conectix", 8))
156 return 100;
157 return 0;
158 }
159
160 static int vpc_open(BlockDriverState *bs, QDict *options, int flags,
161 Error **errp)
162 {
163 BDRVVPCState *s = bs->opaque;
164 int i;
165 VHDFooter *footer;
166 VHDDynDiskHeader *dyndisk_header;
167 uint8_t buf[HEADER_SIZE];
168 uint32_t checksum;
169 uint64_t computed_size;
170 int disk_type = VHD_DYNAMIC;
171 int ret;
172
173 ret = bdrv_pread(bs->file, 0, s->footer_buf, HEADER_SIZE);
174 if (ret < 0) {
175 goto fail;
176 }
177
178 footer = (VHDFooter *) s->footer_buf;
179 if (strncmp(footer->creator, "conectix", 8)) {
180 int64_t offset = bdrv_getlength(bs->file);
181 if (offset < 0) {
182 ret = offset;
183 goto fail;
184 } else if (offset < HEADER_SIZE) {
185 ret = -EINVAL;
186 goto fail;
187 }
188
189 /* If a fixed disk, the footer is found only at the end of the file */
190 ret = bdrv_pread(bs->file, offset-HEADER_SIZE, s->footer_buf,
191 HEADER_SIZE);
192 if (ret < 0) {
193 goto fail;
194 }
195 if (strncmp(footer->creator, "conectix", 8)) {
196 error_setg(errp, "invalid VPC image");
197 ret = -EINVAL;
198 goto fail;
199 }
200 disk_type = VHD_FIXED;
201 }
202
203 checksum = be32_to_cpu(footer->checksum);
204 footer->checksum = 0;
205 if (vpc_checksum(s->footer_buf, HEADER_SIZE) != checksum)
206 fprintf(stderr, "block-vpc: The header checksum of '%s' is "
207 "incorrect.\n", bs->filename);
208
209 /* Write 'checksum' back to footer, or else will leave it with zero. */
210 footer->checksum = be32_to_cpu(checksum);
211
212 // The visible size of a image in Virtual PC depends on the geometry
213 // rather than on the size stored in the footer (the size in the footer
214 // is too large usually)
215 bs->total_sectors = (int64_t)
216 be16_to_cpu(footer->cyls) * footer->heads * footer->secs_per_cyl;
217
218 /* images created with disk2vhd report a far higher virtual size
219 * than expected with the cyls * heads * sectors_per_cyl formula.
220 * use the footer->size instead if the image was created with
221 * disk2vhd.
222 */
223 if (!strncmp(footer->creator_app, "d2v", 4)) {
224 bs->total_sectors = be64_to_cpu(footer->size) / BDRV_SECTOR_SIZE;
225 }
226
227 /* Allow a maximum disk size of approximately 2 TB */
228 if (bs->total_sectors >= VHD_MAX_SECTORS) {
229 ret = -EFBIG;
230 goto fail;
231 }
232
233 if (disk_type == VHD_DYNAMIC) {
234 ret = bdrv_pread(bs->file, be64_to_cpu(footer->data_offset), buf,
235 HEADER_SIZE);
236 if (ret < 0) {
237 goto fail;
238 }
239
240 dyndisk_header = (VHDDynDiskHeader *) buf;
241
242 if (strncmp(dyndisk_header->magic, "cxsparse", 8)) {
243 ret = -EINVAL;
244 goto fail;
245 }
246
247 s->block_size = be32_to_cpu(dyndisk_header->block_size);
248 if (!is_power_of_2(s->block_size) || s->block_size < BDRV_SECTOR_SIZE) {
249 error_setg(errp, "Invalid block size %" PRIu32, s->block_size);
250 ret = -EINVAL;
251 goto fail;
252 }
253 s->bitmap_size = ((s->block_size / (8 * 512)) + 511) & ~511;
254
255 s->max_table_entries = be32_to_cpu(dyndisk_header->max_table_entries);
256
257 if ((bs->total_sectors * 512) / s->block_size > 0xffffffffU) {
258 ret = -EINVAL;
259 goto fail;
260 }
261 if (s->max_table_entries > (VHD_MAX_SECTORS * 512) / s->block_size) {
262 ret = -EINVAL;
263 goto fail;
264 }
265
266 computed_size = (uint64_t) s->max_table_entries * s->block_size;
267 if (computed_size < bs->total_sectors * 512) {
268 ret = -EINVAL;
269 goto fail;
270 }
271
272 s->pagetable = qemu_blockalign(bs, s->max_table_entries * 4);
273
274 s->bat_offset = be64_to_cpu(dyndisk_header->table_offset);
275
276 ret = bdrv_pread(bs->file, s->bat_offset, s->pagetable,
277 s->max_table_entries * 4);
278 if (ret < 0) {
279 goto fail;
280 }
281
282 s->free_data_block_offset =
283 (s->bat_offset + (s->max_table_entries * 4) + 511) & ~511;
284
285 for (i = 0; i < s->max_table_entries; i++) {
286 be32_to_cpus(&s->pagetable[i]);
287 if (s->pagetable[i] != 0xFFFFFFFF) {
288 int64_t next = (512 * (int64_t) s->pagetable[i]) +
289 s->bitmap_size + s->block_size;
290
291 if (next > s->free_data_block_offset) {
292 s->free_data_block_offset = next;
293 }
294 }
295 }
296
297 if (s->free_data_block_offset > bdrv_getlength(bs->file)) {
298 error_setg(errp, "block-vpc: free_data_block_offset points after "
299 "the end of file. The image has been truncated.");
300 ret = -EINVAL;
301 goto fail;
302 }
303
304 s->last_bitmap_offset = (int64_t) -1;
305
306 #ifdef CACHE
307 s->pageentry_u8 = g_malloc(512);
308 s->pageentry_u32 = s->pageentry_u8;
309 s->pageentry_u16 = s->pageentry_u8;
310 s->last_pagetable = -1;
311 #endif
312 }
313
314 qemu_co_mutex_init(&s->lock);
315
316 /* Disable migration when VHD images are used */
317 error_set(&s->migration_blocker,
318 QERR_BLOCK_FORMAT_FEATURE_NOT_SUPPORTED,
319 "vpc", bs->device_name, "live migration");
320 migrate_add_blocker(s->migration_blocker);
321
322 return 0;
323
324 fail:
325 qemu_vfree(s->pagetable);
326 #ifdef CACHE
327 g_free(s->pageentry_u8);
328 #endif
329 return ret;
330 }
331
332 static int vpc_reopen_prepare(BDRVReopenState *state,
333 BlockReopenQueue *queue, Error **errp)
334 {
335 return 0;
336 }
337
338 /*
339 * Returns the absolute byte offset of the given sector in the image file.
340 * If the sector is not allocated, -1 is returned instead.
341 *
342 * The parameter write must be 1 if the offset will be used for a write
343 * operation (the block bitmaps is updated then), 0 otherwise.
344 */
345 static inline int64_t get_sector_offset(BlockDriverState *bs,
346 int64_t sector_num, int write)
347 {
348 BDRVVPCState *s = bs->opaque;
349 uint64_t offset = sector_num * 512;
350 uint64_t bitmap_offset, block_offset;
351 uint32_t pagetable_index, pageentry_index;
352
353 pagetable_index = offset / s->block_size;
354 pageentry_index = (offset % s->block_size) / 512;
355
356 if (pagetable_index >= s->max_table_entries || s->pagetable[pagetable_index] == 0xffffffff)
357 return -1; // not allocated
358
359 bitmap_offset = 512 * (uint64_t) s->pagetable[pagetable_index];
360 block_offset = bitmap_offset + s->bitmap_size + (512 * pageentry_index);
361
362 // We must ensure that we don't write to any sectors which are marked as
363 // unused in the bitmap. We get away with setting all bits in the block
364 // bitmap each time we write to a new block. This might cause Virtual PC to
365 // miss sparse read optimization, but it's not a problem in terms of
366 // correctness.
367 if (write && (s->last_bitmap_offset != bitmap_offset)) {
368 uint8_t bitmap[s->bitmap_size];
369
370 s->last_bitmap_offset = bitmap_offset;
371 memset(bitmap, 0xff, s->bitmap_size);
372 bdrv_pwrite_sync(bs->file, bitmap_offset, bitmap, s->bitmap_size);
373 }
374
375 // printf("sector: %" PRIx64 ", index: %x, offset: %x, bioff: %" PRIx64 ", bloff: %" PRIx64 "\n",
376 // sector_num, pagetable_index, pageentry_index,
377 // bitmap_offset, block_offset);
378
379 // disabled by reason
380 #if 0
381 #ifdef CACHE
382 if (bitmap_offset != s->last_bitmap)
383 {
384 lseek(s->fd, bitmap_offset, SEEK_SET);
385
386 s->last_bitmap = bitmap_offset;
387
388 // Scary! Bitmap is stored as big endian 32bit entries,
389 // while we used to look it up byte by byte
390 read(s->fd, s->pageentry_u8, 512);
391 for (i = 0; i < 128; i++)
392 be32_to_cpus(&s->pageentry_u32[i]);
393 }
394
395 if ((s->pageentry_u8[pageentry_index / 8] >> (pageentry_index % 8)) & 1)
396 return -1;
397 #else
398 lseek(s->fd, bitmap_offset + (pageentry_index / 8), SEEK_SET);
399
400 read(s->fd, &bitmap_entry, 1);
401
402 if ((bitmap_entry >> (pageentry_index % 8)) & 1)
403 return -1; // not allocated
404 #endif
405 #endif
406
407 return block_offset;
408 }
409
410 /*
411 * Writes the footer to the end of the image file. This is needed when the
412 * file grows as it overwrites the old footer
413 *
414 * Returns 0 on success and < 0 on error
415 */
416 static int rewrite_footer(BlockDriverState* bs)
417 {
418 int ret;
419 BDRVVPCState *s = bs->opaque;
420 int64_t offset = s->free_data_block_offset;
421
422 ret = bdrv_pwrite_sync(bs->file, offset, s->footer_buf, HEADER_SIZE);
423 if (ret < 0)
424 return ret;
425
426 return 0;
427 }
428
429 /*
430 * Allocates a new block. This involves writing a new footer and updating
431 * the Block Allocation Table to use the space at the old end of the image
432 * file (overwriting the old footer)
433 *
434 * Returns the sectors' offset in the image file on success and < 0 on error
435 */
436 static int64_t alloc_block(BlockDriverState* bs, int64_t sector_num)
437 {
438 BDRVVPCState *s = bs->opaque;
439 int64_t bat_offset;
440 uint32_t index, bat_value;
441 int ret;
442 uint8_t bitmap[s->bitmap_size];
443
444 // Check if sector_num is valid
445 if ((sector_num < 0) || (sector_num > bs->total_sectors))
446 return -1;
447
448 // Write entry into in-memory BAT
449 index = (sector_num * 512) / s->block_size;
450 if (s->pagetable[index] != 0xFFFFFFFF)
451 return -1;
452
453 s->pagetable[index] = s->free_data_block_offset / 512;
454
455 // Initialize the block's bitmap
456 memset(bitmap, 0xff, s->bitmap_size);
457 ret = bdrv_pwrite_sync(bs->file, s->free_data_block_offset, bitmap,
458 s->bitmap_size);
459 if (ret < 0) {
460 return ret;
461 }
462
463 // Write new footer (the old one will be overwritten)
464 s->free_data_block_offset += s->block_size + s->bitmap_size;
465 ret = rewrite_footer(bs);
466 if (ret < 0)
467 goto fail;
468
469 // Write BAT entry to disk
470 bat_offset = s->bat_offset + (4 * index);
471 bat_value = be32_to_cpu(s->pagetable[index]);
472 ret = bdrv_pwrite_sync(bs->file, bat_offset, &bat_value, 4);
473 if (ret < 0)
474 goto fail;
475
476 return get_sector_offset(bs, sector_num, 0);
477
478 fail:
479 s->free_data_block_offset -= (s->block_size + s->bitmap_size);
480 return -1;
481 }
482
483 static int vpc_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
484 {
485 BDRVVPCState *s = (BDRVVPCState *)bs->opaque;
486 VHDFooter *footer = (VHDFooter *) s->footer_buf;
487
488 if (cpu_to_be32(footer->type) != VHD_FIXED) {
489 bdi->cluster_size = s->block_size;
490 }
491
492 bdi->unallocated_blocks_are_zero = true;
493 return 0;
494 }
495
496 static int vpc_read(BlockDriverState *bs, int64_t sector_num,
497 uint8_t *buf, int nb_sectors)
498 {
499 BDRVVPCState *s = bs->opaque;
500 int ret;
501 int64_t offset;
502 int64_t sectors, sectors_per_block;
503 VHDFooter *footer = (VHDFooter *) s->footer_buf;
504
505 if (cpu_to_be32(footer->type) == VHD_FIXED) {
506 return bdrv_read(bs->file, sector_num, buf, nb_sectors);
507 }
508 while (nb_sectors > 0) {
509 offset = get_sector_offset(bs, sector_num, 0);
510
511 sectors_per_block = s->block_size >> BDRV_SECTOR_BITS;
512 sectors = sectors_per_block - (sector_num % sectors_per_block);
513 if (sectors > nb_sectors) {
514 sectors = nb_sectors;
515 }
516
517 if (offset == -1) {
518 memset(buf, 0, sectors * BDRV_SECTOR_SIZE);
519 } else {
520 ret = bdrv_pread(bs->file, offset, buf,
521 sectors * BDRV_SECTOR_SIZE);
522 if (ret != sectors * BDRV_SECTOR_SIZE) {
523 return -1;
524 }
525 }
526
527 nb_sectors -= sectors;
528 sector_num += sectors;
529 buf += sectors * BDRV_SECTOR_SIZE;
530 }
531 return 0;
532 }
533
534 static coroutine_fn int vpc_co_read(BlockDriverState *bs, int64_t sector_num,
535 uint8_t *buf, int nb_sectors)
536 {
537 int ret;
538 BDRVVPCState *s = bs->opaque;
539 qemu_co_mutex_lock(&s->lock);
540 ret = vpc_read(bs, sector_num, buf, nb_sectors);
541 qemu_co_mutex_unlock(&s->lock);
542 return ret;
543 }
544
545 static int vpc_write(BlockDriverState *bs, int64_t sector_num,
546 const uint8_t *buf, int nb_sectors)
547 {
548 BDRVVPCState *s = bs->opaque;
549 int64_t offset;
550 int64_t sectors, sectors_per_block;
551 int ret;
552 VHDFooter *footer = (VHDFooter *) s->footer_buf;
553
554 if (cpu_to_be32(footer->type) == VHD_FIXED) {
555 return bdrv_write(bs->file, sector_num, buf, nb_sectors);
556 }
557 while (nb_sectors > 0) {
558 offset = get_sector_offset(bs, sector_num, 1);
559
560 sectors_per_block = s->block_size >> BDRV_SECTOR_BITS;
561 sectors = sectors_per_block - (sector_num % sectors_per_block);
562 if (sectors > nb_sectors) {
563 sectors = nb_sectors;
564 }
565
566 if (offset == -1) {
567 offset = alloc_block(bs, sector_num);
568 if (offset < 0)
569 return -1;
570 }
571
572 ret = bdrv_pwrite(bs->file, offset, buf, sectors * BDRV_SECTOR_SIZE);
573 if (ret != sectors * BDRV_SECTOR_SIZE) {
574 return -1;
575 }
576
577 nb_sectors -= sectors;
578 sector_num += sectors;
579 buf += sectors * BDRV_SECTOR_SIZE;
580 }
581
582 return 0;
583 }
584
585 static coroutine_fn int vpc_co_write(BlockDriverState *bs, int64_t sector_num,
586 const uint8_t *buf, int nb_sectors)
587 {
588 int ret;
589 BDRVVPCState *s = bs->opaque;
590 qemu_co_mutex_lock(&s->lock);
591 ret = vpc_write(bs, sector_num, buf, nb_sectors);
592 qemu_co_mutex_unlock(&s->lock);
593 return ret;
594 }
595
596 /*
597 * Calculates the number of cylinders, heads and sectors per cylinder
598 * based on a given number of sectors. This is the algorithm described
599 * in the VHD specification.
600 *
601 * Note that the geometry doesn't always exactly match total_sectors but
602 * may round it down.
603 *
604 * Returns 0 on success, -EFBIG if the size is larger than ~2 TB. Override
605 * the hardware EIDE and ATA-2 limit of 16 heads (max disk size of 127 GB)
606 * and instead allow up to 255 heads.
607 */
608 static int calculate_geometry(int64_t total_sectors, uint16_t* cyls,
609 uint8_t* heads, uint8_t* secs_per_cyl)
610 {
611 uint32_t cyls_times_heads;
612
613 /* Allow a maximum disk size of approximately 2 TB */
614 if (total_sectors > 65535LL * 255 * 255) {
615 return -EFBIG;
616 }
617
618 if (total_sectors > 65535 * 16 * 63) {
619 *secs_per_cyl = 255;
620 if (total_sectors > 65535 * 16 * 255) {
621 *heads = 255;
622 } else {
623 *heads = 16;
624 }
625 cyls_times_heads = total_sectors / *secs_per_cyl;
626 } else {
627 *secs_per_cyl = 17;
628 cyls_times_heads = total_sectors / *secs_per_cyl;
629 *heads = (cyls_times_heads + 1023) / 1024;
630
631 if (*heads < 4)
632 *heads = 4;
633
634 if (cyls_times_heads >= (*heads * 1024) || *heads > 16) {
635 *secs_per_cyl = 31;
636 *heads = 16;
637 cyls_times_heads = total_sectors / *secs_per_cyl;
638 }
639
640 if (cyls_times_heads >= (*heads * 1024)) {
641 *secs_per_cyl = 63;
642 *heads = 16;
643 cyls_times_heads = total_sectors / *secs_per_cyl;
644 }
645 }
646
647 *cyls = cyls_times_heads / *heads;
648
649 return 0;
650 }
651
652 static int create_dynamic_disk(int fd, uint8_t *buf, int64_t total_sectors)
653 {
654 VHDDynDiskHeader *dyndisk_header =
655 (VHDDynDiskHeader *) buf;
656 size_t block_size, num_bat_entries;
657 int i;
658 int ret = -EIO;
659
660 // Write the footer (twice: at the beginning and at the end)
661 block_size = 0x200000;
662 num_bat_entries = (total_sectors + block_size / 512) / (block_size / 512);
663
664 if (write(fd, buf, HEADER_SIZE) != HEADER_SIZE) {
665 goto fail;
666 }
667
668 if (lseek(fd, 1536 + ((num_bat_entries * 4 + 511) & ~511), SEEK_SET) < 0) {
669 goto fail;
670 }
671 if (write(fd, buf, HEADER_SIZE) != HEADER_SIZE) {
672 goto fail;
673 }
674
675 // Write the initial BAT
676 if (lseek(fd, 3 * 512, SEEK_SET) < 0) {
677 goto fail;
678 }
679
680 memset(buf, 0xFF, 512);
681 for (i = 0; i < (num_bat_entries * 4 + 511) / 512; i++) {
682 if (write(fd, buf, 512) != 512) {
683 goto fail;
684 }
685 }
686
687 // Prepare the Dynamic Disk Header
688 memset(buf, 0, 1024);
689
690 memcpy(dyndisk_header->magic, "cxsparse", 8);
691
692 /*
693 * Note: The spec is actually wrong here for data_offset, it says
694 * 0xFFFFFFFF, but MS tools expect all 64 bits to be set.
695 */
696 dyndisk_header->data_offset = be64_to_cpu(0xFFFFFFFFFFFFFFFFULL);
697 dyndisk_header->table_offset = be64_to_cpu(3 * 512);
698 dyndisk_header->version = be32_to_cpu(0x00010000);
699 dyndisk_header->block_size = be32_to_cpu(block_size);
700 dyndisk_header->max_table_entries = be32_to_cpu(num_bat_entries);
701
702 dyndisk_header->checksum = be32_to_cpu(vpc_checksum(buf, 1024));
703
704 // Write the header
705 if (lseek(fd, 512, SEEK_SET) < 0) {
706 goto fail;
707 }
708
709 if (write(fd, buf, 1024) != 1024) {
710 goto fail;
711 }
712 ret = 0;
713
714 fail:
715 return ret;
716 }
717
718 static int create_fixed_disk(int fd, uint8_t *buf, int64_t total_size)
719 {
720 int ret = -EIO;
721
722 /* Add footer to total size */
723 total_size += 512;
724 if (ftruncate(fd, total_size) != 0) {
725 ret = -errno;
726 goto fail;
727 }
728 if (lseek(fd, -512, SEEK_END) < 0) {
729 goto fail;
730 }
731 if (write(fd, buf, HEADER_SIZE) != HEADER_SIZE) {
732 goto fail;
733 }
734
735 ret = 0;
736
737 fail:
738 return ret;
739 }
740
741 static int vpc_create(const char *filename, QEMUOptionParameter *options,
742 Error **errp)
743 {
744 uint8_t buf[1024];
745 VHDFooter *footer = (VHDFooter *) buf;
746 QEMUOptionParameter *disk_type_param;
747 int fd, i;
748 uint16_t cyls = 0;
749 uint8_t heads = 0;
750 uint8_t secs_per_cyl = 0;
751 int64_t total_sectors;
752 int64_t total_size;
753 int disk_type;
754 int ret = -EIO;
755
756 /* Read out options */
757 total_size = get_option_parameter(options, BLOCK_OPT_SIZE)->value.n;
758
759 disk_type_param = get_option_parameter(options, BLOCK_OPT_SUBFMT);
760 if (disk_type_param && disk_type_param->value.s) {
761 if (!strcmp(disk_type_param->value.s, "dynamic")) {
762 disk_type = VHD_DYNAMIC;
763 } else if (!strcmp(disk_type_param->value.s, "fixed")) {
764 disk_type = VHD_FIXED;
765 } else {
766 return -EINVAL;
767 }
768 } else {
769 disk_type = VHD_DYNAMIC;
770 }
771
772 /* Create the file */
773 fd = qemu_open(filename, O_WRONLY | O_CREAT | O_TRUNC | O_BINARY, 0644);
774 if (fd < 0) {
775 return -EIO;
776 }
777
778 /*
779 * Calculate matching total_size and geometry. Increase the number of
780 * sectors requested until we get enough (or fail). This ensures that
781 * qemu-img convert doesn't truncate images, but rather rounds up.
782 */
783 total_sectors = total_size / BDRV_SECTOR_SIZE;
784 for (i = 0; total_sectors > (int64_t)cyls * heads * secs_per_cyl; i++) {
785 if (calculate_geometry(total_sectors + i, &cyls, &heads,
786 &secs_per_cyl))
787 {
788 ret = -EFBIG;
789 goto fail;
790 }
791 }
792
793 total_sectors = (int64_t) cyls * heads * secs_per_cyl;
794
795 /* Prepare the Hard Disk Footer */
796 memset(buf, 0, 1024);
797
798 memcpy(footer->creator, "conectix", 8);
799 /* TODO Check if "qemu" creator_app is ok for VPC */
800 memcpy(footer->creator_app, "qemu", 4);
801 memcpy(footer->creator_os, "Wi2k", 4);
802
803 footer->features = be32_to_cpu(0x02);
804 footer->version = be32_to_cpu(0x00010000);
805 if (disk_type == VHD_DYNAMIC) {
806 footer->data_offset = be64_to_cpu(HEADER_SIZE);
807 } else {
808 footer->data_offset = be64_to_cpu(0xFFFFFFFFFFFFFFFFULL);
809 }
810 footer->timestamp = be32_to_cpu(time(NULL) - VHD_TIMESTAMP_BASE);
811
812 /* Version of Virtual PC 2007 */
813 footer->major = be16_to_cpu(0x0005);
814 footer->minor = be16_to_cpu(0x0003);
815 if (disk_type == VHD_DYNAMIC) {
816 footer->orig_size = be64_to_cpu(total_sectors * 512);
817 footer->size = be64_to_cpu(total_sectors * 512);
818 } else {
819 footer->orig_size = be64_to_cpu(total_size);
820 footer->size = be64_to_cpu(total_size);
821 }
822 footer->cyls = be16_to_cpu(cyls);
823 footer->heads = heads;
824 footer->secs_per_cyl = secs_per_cyl;
825
826 footer->type = be32_to_cpu(disk_type);
827
828 #if defined(CONFIG_UUID)
829 uuid_generate(footer->uuid);
830 #endif
831
832 footer->checksum = be32_to_cpu(vpc_checksum(buf, HEADER_SIZE));
833
834 if (disk_type == VHD_DYNAMIC) {
835 ret = create_dynamic_disk(fd, buf, total_sectors);
836 } else {
837 ret = create_fixed_disk(fd, buf, total_size);
838 }
839
840 fail:
841 qemu_close(fd);
842 return ret;
843 }
844
845 static int vpc_has_zero_init(BlockDriverState *bs)
846 {
847 BDRVVPCState *s = bs->opaque;
848 VHDFooter *footer = (VHDFooter *) s->footer_buf;
849
850 if (cpu_to_be32(footer->type) == VHD_FIXED) {
851 return bdrv_has_zero_init(bs->file);
852 } else {
853 return 1;
854 }
855 }
856
857 static void vpc_close(BlockDriverState *bs)
858 {
859 BDRVVPCState *s = bs->opaque;
860 qemu_vfree(s->pagetable);
861 #ifdef CACHE
862 g_free(s->pageentry_u8);
863 #endif
864
865 migrate_del_blocker(s->migration_blocker);
866 error_free(s->migration_blocker);
867 }
868
869 static QEMUOptionParameter vpc_create_options[] = {
870 {
871 .name = BLOCK_OPT_SIZE,
872 .type = OPT_SIZE,
873 .help = "Virtual disk size"
874 },
875 {
876 .name = BLOCK_OPT_SUBFMT,
877 .type = OPT_STRING,
878 .help =
879 "Type of virtual hard disk format. Supported formats are "
880 "{dynamic (default) | fixed} "
881 },
882 { NULL }
883 };
884
885 static BlockDriver bdrv_vpc = {
886 .format_name = "vpc",
887 .instance_size = sizeof(BDRVVPCState),
888
889 .bdrv_probe = vpc_probe,
890 .bdrv_open = vpc_open,
891 .bdrv_close = vpc_close,
892 .bdrv_reopen_prepare = vpc_reopen_prepare,
893 .bdrv_create = vpc_create,
894
895 .bdrv_read = vpc_co_read,
896 .bdrv_write = vpc_co_write,
897
898 .bdrv_get_info = vpc_get_info,
899
900 .create_options = vpc_create_options,
901 .bdrv_has_zero_init = vpc_has_zero_init,
902 };
903
904 static void bdrv_vpc_init(void)
905 {
906 bdrv_register(&bdrv_vpc);
907 }
908
909 block_init(bdrv_vpc_init);