xref: /openbmc/qemu/tests/qemu-iotests/060 (revision b097ba37)
1#!/usr/bin/env bash
2#
3# Test case for image corruption (overlapping data structures) in qcow2
4#
5# Copyright (C) 2013 Red Hat, Inc.
6#
7# This program is free software; you can redistribute it and/or modify
8# it under the terms of the GNU General Public License as published by
9# the Free Software Foundation; either version 2 of the License, or
10# (at your option) any later version.
11#
12# This program is distributed in the hope that it will be useful,
13# but WITHOUT ANY WARRANTY; without even the implied warranty of
14# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15# GNU General Public License for more details.
16#
17# You should have received a copy of the GNU General Public License
18# along with this program.  If not, see <http://www.gnu.org/licenses/>.
19#
20
21# creator
22owner=mreitz@redhat.com
23
24seq="$(basename $0)"
25echo "QA output created by $seq"
26
27status=1	# failure is the default!
28
29_cleanup()
30{
31	_cleanup_test_img
32}
33trap "_cleanup; exit \$status" 0 1 2 3 15
34
35# Sometimes the error line might be dumped before/after an event
36# randomly.  Mask it out for specific test that may trigger this
37# uncertainty for current test for now.
38_filter_io_error()
39{
40    sed '/Input\/output error/d'
41}
42
43# get standard environment, filters and checks
44. ./common.rc
45. ./common.filter
46
47# This tests qocw2-specific low-level functionality
48_supported_fmt qcow2
49_supported_proto file
50_supported_os Linux
51
52rt_offset=65536  # 0x10000 (XXX: just an assumption)
53rb_offset=131072 # 0x20000 (XXX: just an assumption)
54l1_offset=196608 # 0x30000 (XXX: just an assumption)
55l2_offset=262144 # 0x40000 (XXX: just an assumption)
56l2_offset_after_snapshot=524288 # 0x80000 (XXX: just an assumption)
57
58IMGOPTS="compat=1.1"
59
60OPEN_RW="open -o overlap-check=all $TEST_IMG"
61# Overlap checks are done before write operations only, therefore opening an
62# image read-only makes the overlap-check option irrelevant
63OPEN_RO="open -r $TEST_IMG"
64
65echo
66echo "=== Testing L2 reference into L1 ==="
67echo
68_make_test_img 64M
69# Link first L1 entry (first L2 table) onto itself
70# (Note the MSb in the L1 entry is set, ensuring the refcount is one - else any
71# later write will result in a COW operation, effectively ruining this attempt
72# on image corruption)
73poke_file "$TEST_IMG" "$l1_offset" "\x80\x00\x00\x00\x00\x03\x00\x00"
74_check_test_img
75
76# The corrupt bit should not be set anyway
77$PYTHON qcow2.py "$TEST_IMG" dump-header | grep incompatible_features
78
79# Try to write something, thereby forcing the corrupt bit to be set
80$QEMU_IO -c "$OPEN_RW" -c "write -P 0x2a 0 512" | _filter_qemu_io
81
82# The corrupt bit must now be set
83$PYTHON qcow2.py "$TEST_IMG" dump-header | grep incompatible_features
84
85# This information should be available through qemu-img info
86_img_info --format-specific
87
88# Try to open the image R/W (which should fail)
89$QEMU_IO -c "$OPEN_RW" -c "read 0 512" 2>&1 | _filter_qemu_io \
90                                            | _filter_testdir \
91                                            | _filter_imgfmt
92
93# Try to open it RO (which should succeed)
94$QEMU_IO -c "$OPEN_RO" -c "read 0 512" | _filter_qemu_io
95
96# We could now try to fix the image, but this would probably fail (how should an
97# L2 table linked onto the L1 table be fixed?)
98
99echo
100echo "=== Testing cluster data reference into refcount block ==="
101echo
102_make_test_img 64M
103# Allocate L2 table
104truncate -s "$(($l2_offset+65536))" "$TEST_IMG"
105poke_file "$TEST_IMG" "$l1_offset" "\x80\x00\x00\x00\x00\x04\x00\x00"
106# Mark cluster as used
107poke_file "$TEST_IMG" "$(($rb_offset+8))" "\x00\x01"
108# Redirect new data cluster onto refcount block
109poke_file "$TEST_IMG" "$l2_offset" "\x80\x00\x00\x00\x00\x02\x00\x00"
110_check_test_img
111$PYTHON qcow2.py "$TEST_IMG" dump-header | grep incompatible_features
112$QEMU_IO -c "$OPEN_RW" -c "write -P 0x2a 0 512" | _filter_qemu_io
113$PYTHON qcow2.py "$TEST_IMG" dump-header | grep incompatible_features
114
115# Try to fix it
116_check_test_img -r all
117
118# The corrupt bit should be cleared
119$PYTHON qcow2.py "$TEST_IMG" dump-header | grep incompatible_features
120
121# Look if it's really really fixed
122$QEMU_IO -c "$OPEN_RW" -c "write -P 0x2a 0 512" | _filter_qemu_io
123$PYTHON qcow2.py "$TEST_IMG" dump-header | grep incompatible_features
124
125echo
126echo "=== Testing cluster data reference into inactive L2 table ==="
127echo
128_make_test_img 64M
129$QEMU_IO -c "$OPEN_RW" -c "write -P 1 0 512" | _filter_qemu_io
130$QEMU_IMG snapshot -c foo "$TEST_IMG"
131$QEMU_IO -c "$OPEN_RW" -c "write -P 2 0 512" | _filter_qemu_io
132# The inactive L2 table remains at its old offset
133poke_file "$TEST_IMG" "$l2_offset_after_snapshot" \
134                      "\x80\x00\x00\x00\x00\x04\x00\x00"
135_check_test_img
136$PYTHON qcow2.py "$TEST_IMG" dump-header | grep incompatible_features
137$QEMU_IO -c "$OPEN_RW" -c "write -P 3 0 512" | _filter_qemu_io
138$PYTHON qcow2.py "$TEST_IMG" dump-header | grep incompatible_features
139_check_test_img -r all
140$PYTHON qcow2.py "$TEST_IMG" dump-header | grep incompatible_features
141$QEMU_IO -c "$OPEN_RW" -c "write -P 4 0 512" | _filter_qemu_io
142$PYTHON qcow2.py "$TEST_IMG" dump-header | grep incompatible_features
143
144# Check data
145$QEMU_IO -c "$OPEN_RO" -c "read -P 4 0 512" | _filter_qemu_io
146$QEMU_IMG snapshot -a foo "$TEST_IMG"
147_check_test_img
148$QEMU_IO -c "$OPEN_RO" -c "read -P 1 0 512" | _filter_qemu_io
149
150echo
151echo "=== Testing overlap while COW is in flight ==="
152echo
153# compat=0.10 is required in order to make the following discard actually
154# unallocate the sector rather than make it a zero sector - we want COW, after
155# all.
156IMGOPTS='compat=0.10' _make_test_img 1G
157# Write two clusters, the second one enforces creation of an L2 table after
158# the first data cluster.
159$QEMU_IO -c 'write 0k 64k' -c 'write 512M 64k' "$TEST_IMG" | _filter_qemu_io
160# Discard the first cluster. This cluster will soon enough be reallocated and
161# used for COW.
162$QEMU_IO -c 'discard 0k 64k' "$TEST_IMG" | _filter_qemu_io
163# Now, corrupt the image by marking the second L2 table cluster as free.
164poke_file "$TEST_IMG" '131084' "\x00\x00" # 0x2000c
165# Start a write operation requiring COW on the image stopping it right before
166# doing the read; then, trigger the corruption prevention by writing anything to
167# any unallocated cluster, leading to an attempt to overwrite the second L2
168# table. Finally, resume the COW write and see it fail (but not crash).
169echo "open -o file.driver=blkdebug $TEST_IMG
170break cow_read 0
171aio_write 0k 1k
172wait_break 0
173write 64k 64k
174resume 0" | $QEMU_IO | _filter_qemu_io
175
176echo
177echo "=== Testing unallocated image header ==="
178echo
179_make_test_img 64M
180# Create L1/L2
181$QEMU_IO -c "write 0 64k" "$TEST_IMG" | _filter_qemu_io
182poke_file "$TEST_IMG" "$rb_offset" "\x00\x00"
183$QEMU_IO -c "write 64k 64k" "$TEST_IMG" | _filter_qemu_io
184
185echo
186echo "=== Testing unaligned L1 entry ==="
187echo
188_make_test_img 64M
189$QEMU_IO -c "write 0 64k" "$TEST_IMG" | _filter_qemu_io
190# This will be masked with ~(512 - 1) = ~0x1ff, so whether the lower 9 bits are
191# aligned or not does not matter
192poke_file "$TEST_IMG" "$l1_offset" "\x80\x00\x00\x00\x00\x04\x2a\x00"
193$QEMU_IO -c "read 0 64k" "$TEST_IMG" | _filter_qemu_io
194
195# Test how well zero cluster expansion can cope with this
196_make_test_img 64M
197$QEMU_IO -c "write 0 64k" "$TEST_IMG" | _filter_qemu_io
198poke_file "$TEST_IMG" "$l1_offset" "\x80\x00\x00\x00\x00\x04\x2a\x00"
199$QEMU_IMG amend -o compat=0.10 "$TEST_IMG"
200
201echo
202echo "=== Testing unaligned L2 entry ==="
203echo
204_make_test_img 64M
205$QEMU_IO -c "write 0 64k" "$TEST_IMG" | _filter_qemu_io
206poke_file "$TEST_IMG" "$l2_offset" "\x80\x00\x00\x00\x00\x05\x2a\x00"
207$QEMU_IO -c "read 0 64k" "$TEST_IMG" | _filter_qemu_io
208
209echo
210echo "=== Testing unaligned pre-allocated zero cluster ==="
211echo
212_make_test_img 64M
213$QEMU_IO -c "write 0 64k" "$TEST_IMG" | _filter_qemu_io
214poke_file "$TEST_IMG" "$l2_offset" "\x80\x00\x00\x00\x00\x05\x2a\x01"
215# zero cluster expansion
216$QEMU_IMG amend -o compat=0.10 "$TEST_IMG"
217
218echo
219echo "=== Testing unaligned reftable entry ==="
220echo
221_make_test_img 64M
222poke_file "$TEST_IMG" "$rt_offset" "\x00\x00\x00\x00\x00\x02\x2a\x00"
223$QEMU_IO -c "write 0 64k" "$TEST_IMG" | _filter_qemu_io
224
225echo
226echo "=== Testing non-fatal corruption on freeing ==="
227echo
228_make_test_img 64M
229$QEMU_IO -c "write 0 64k" "$TEST_IMG" | _filter_qemu_io
230poke_file "$TEST_IMG" "$l2_offset" "\x80\x00\x00\x00\x00\x05\x2a\x00"
231$QEMU_IO -c "discard 0 64k" "$TEST_IMG" | _filter_qemu_io
232
233echo
234echo "=== Testing read-only corruption report ==="
235echo
236_make_test_img 64M
237$QEMU_IO -c "write 0 64k" "$TEST_IMG" | _filter_qemu_io
238poke_file "$TEST_IMG" "$l2_offset" "\x80\x00\x00\x00\x00\x05\x2a\x00"
239# Should only emit a single error message
240$QEMU_IO -c "$OPEN_RO" -c "read 0 64k" -c "read 0 64k" | _filter_qemu_io
241
242echo
243echo "=== Testing non-fatal and then fatal corruption report ==="
244echo
245_make_test_img 64M
246$QEMU_IO -c "write 0 128k" "$TEST_IMG" | _filter_qemu_io
247poke_file "$TEST_IMG" "$l2_offset"        "\x80\x00\x00\x00\x00\x05\x2a\x00"
248poke_file "$TEST_IMG" "$(($l2_offset+8))" "\x80\x00\x00\x00\x00\x06\x2a\x00"
249# Should emit two error messages
250$QEMU_IO -c "discard 0 64k" -c "read 64k 64k" "$TEST_IMG" | _filter_qemu_io
251
252echo
253echo "=== Testing empty refcount table ==="
254echo
255_make_test_img 64M
256poke_file "$TEST_IMG" "$rt_offset"        "\x00\x00\x00\x00\x00\x00\x00\x00"
257$QEMU_IO -c "write 0 64k" "$TEST_IMG" | _filter_qemu_io
258# Repair the image
259_check_test_img -r all
260
261echo
262echo "=== Testing empty refcount table with valid L1 and L2 tables ==="
263echo
264_make_test_img 64M
265$QEMU_IO -c "write 0 64k" "$TEST_IMG" | _filter_qemu_io
266poke_file "$TEST_IMG" "$rt_offset"        "\x00\x00\x00\x00\x00\x00\x00\x00"
267# Since the first data cluster is already allocated this triggers an
268# allocation with an explicit offset (using qcow2_alloc_clusters_at())
269# causing a refcount block to be allocated at offset 0
270$QEMU_IO -c "write 0 128k" "$TEST_IMG" | _filter_qemu_io
271# Repair the image
272_check_test_img -r all
273
274echo
275echo "=== Testing empty refcount block ==="
276echo
277_make_test_img 64M
278poke_file "$TEST_IMG" "$rb_offset"        "\x00\x00\x00\x00\x00\x00\x00\x00"
279$QEMU_IO -c "write 0 64k" "$TEST_IMG" | _filter_qemu_io
280# Repair the image
281_check_test_img -r all
282
283echo
284echo "=== Testing empty refcount block with compressed write ==="
285echo
286_make_test_img 64M
287$QEMU_IO -c "write 64k 64k" "$TEST_IMG" | _filter_qemu_io
288poke_file "$TEST_IMG" "$rb_offset"        "\x00\x00\x00\x00\x00\x00\x00\x00"
289# The previous write already allocated an L2 table, so now this new
290# write will try to allocate a compressed data cluster at offset 0.
291$QEMU_IO -c "write -c 0k 64k" "$TEST_IMG" | _filter_qemu_io
292# Repair the image
293_check_test_img -r all
294
295echo
296echo "=== Testing zero refcount table size ==="
297echo
298_make_test_img 64M
299poke_file "$TEST_IMG" "56"                "\x00\x00\x00\x00"
300$QEMU_IO -c "write 0 64k" "$TEST_IMG" 2>&1 | _filter_testdir | _filter_imgfmt
301# Repair the image
302_check_test_img -r all
303
304echo
305echo "=== Testing incorrect refcount table offset ==="
306echo
307_make_test_img 64M
308poke_file "$TEST_IMG" "48"                "\x00\x00\x00\x00\x00\x00\x00\x00"
309$QEMU_IO -c "write 0 64k" "$TEST_IMG" | _filter_qemu_io
310
311echo
312echo "=== Testing dirty corrupt image ==="
313echo
314
315_make_test_img 64M
316
317# Let the refblock appear unaligned
318poke_file "$TEST_IMG" "$rt_offset"        "\x00\x00\x00\x00\xff\xff\x2a\x00"
319# Mark the image dirty, thus forcing an automatic check when opening it
320poke_file "$TEST_IMG" 72 "\x00\x00\x00\x00\x00\x00\x00\x01"
321# Open the image (qemu should refuse to do so)
322$QEMU_IO -c close "$TEST_IMG" 2>&1 | _filter_testdir | _filter_imgfmt
323
324echo '--- Repairing ---'
325
326# The actual repair should have happened (because of the dirty bit),
327# but some cleanup may have failed (like freeing the old reftable)
328# because the image was already marked corrupt by that point
329_check_test_img -r all
330
331echo
332echo "=== Writing to an unaligned preallocated zero cluster ==="
333echo
334
335_make_test_img 64M
336
337# Allocate the L2 table
338$QEMU_IO -c "write 0 64k" -c "discard 0 64k" "$TEST_IMG" | _filter_qemu_io
339# Pretend there is a preallocated zero cluster somewhere inside the
340# image header
341poke_file "$TEST_IMG" "$l2_offset" "\x80\x00\x00\x00\x00\x00\x2a\x01"
342# Let's write to it!
343$QEMU_IO -c "write 0 64k" "$TEST_IMG" | _filter_qemu_io
344
345echo '--- Repairing ---'
346_check_test_img -r all
347
348echo
349echo '=== Discarding with an unaligned refblock ==='
350echo
351
352_make_test_img 64M
353
354$QEMU_IO -c "write 0 128k" "$TEST_IMG" | _filter_qemu_io
355# Make our refblock unaligned
356poke_file "$TEST_IMG" "$(($rt_offset))" "\x00\x00\x00\x00\x00\x00\x2a\x00"
357# Now try to discard something that will be submitted as two requests
358# (main part + tail)
359$QEMU_IO -c "discard 0 65537" "$TEST_IMG"
360
361echo '--- Repairing ---'
362# Fails the first repair because the corruption prevents the check
363# function from double-checking
364# (Using -q for the first invocation, because otherwise the
365#  double-check error message appears above the summary for some
366#  reason -- so let's just hide the summary)
367_check_test_img -q -r all
368_check_test_img -r all
369
370echo
371echo "=== Discarding an out-of-bounds refblock ==="
372echo
373
374_make_test_img 64M
375
376# Pretend there's a refblock really up high
377poke_file "$TEST_IMG" "$(($rt_offset+8))" "\x00\xff\xff\xff\x00\x00\x00\x00"
378# Let's try to shrink the qcow2 image so that the block driver tries
379# to discard that refblock (and see what happens!)
380$QEMU_IMG resize --shrink "$TEST_IMG" 32M
381
382echo '--- Checking and retrying ---'
383# Image should not be resized
384_img_info | grep 'virtual size'
385# But it should pass this check, because the "partial" resize has
386# already overwritten refblocks past the end
387_check_test_img -r all
388# So let's try again
389$QEMU_IMG resize --shrink "$TEST_IMG" 32M
390_img_info | grep 'virtual size'
391
392echo
393echo "=== Discarding a non-covered in-bounds refblock ==="
394echo
395
396IMGOPTS='refcount_bits=1' _make_test_img 64M
397
398# Pretend there's a refblock somewhere where there is no refblock to
399# cover it (but the covering refblock has a valid index in the
400# reftable)
401# Every refblock covers 65536 * 8 * 65536 = 32 GB, so we have to point
402# to 0x10_0000_0000 (64G) to point to the third refblock
403poke_file "$TEST_IMG" "$(($rt_offset+8))" "\x00\x00\x00\x10\x00\x00\x00\x00"
404$QEMU_IMG resize --shrink "$TEST_IMG" 32M
405
406echo '--- Checking and retrying ---'
407# Image should not be resized
408_img_info | grep 'virtual size'
409# But it should pass this check, because the "partial" resize has
410# already overwritten refblocks past the end
411_check_test_img -r all
412# So let's try again
413$QEMU_IMG resize --shrink "$TEST_IMG" 32M
414_img_info | grep 'virtual size'
415
416echo
417echo "=== Discarding a refblock covered by an unaligned refblock ==="
418echo
419
420IMGOPTS='refcount_bits=1' _make_test_img 64M
421
422# Same as above
423poke_file "$TEST_IMG" "$(($rt_offset+8))" "\x00\x00\x00\x10\x00\x00\x00\x00"
424# But now we actually "create" an unaligned third refblock
425poke_file "$TEST_IMG" "$(($rt_offset+16))" "\x00\x00\x00\x00\x00\x00\x02\x00"
426$QEMU_IMG resize --shrink "$TEST_IMG" 32M
427
428echo '--- Repairing ---'
429# Fails the first repair because the corruption prevents the check
430# function from double-checking
431# (Using -q for the first invocation, because otherwise the
432#  double-check error message appears above the summary for some
433#  reason -- so let's just hide the summary)
434_check_test_img -q -r all
435_check_test_img -r all
436
437echo
438echo "=== Testing the QEMU shutdown with a corrupted image ==="
439echo
440_make_test_img 64M
441poke_file "$TEST_IMG" "$rt_offset"        "\x00\x00\x00\x00\x00\x00\x00\x00"
442echo "{'execute': 'qmp_capabilities'}
443      {'execute': 'human-monitor-command',
444       'arguments': {'command-line': 'qemu-io drive \"write 0 512\"'}}
445      {'execute': 'quit'}" \
446    | $QEMU -qmp stdio -nographic -nodefaults \
447            -drive if=none,node-name=drive,file="$TEST_IMG",driver=qcow2 \
448    | _filter_qmp | _filter_qemu_io
449
450echo
451echo "=== Testing incoming inactive corrupted image ==="
452echo
453
454_make_test_img 64M
455# Create an unaligned L1 entry, so qemu will signal a corruption when
456# reading from the covered area
457poke_file "$TEST_IMG" "$l1_offset" "\x00\x00\x00\x00\x2a\x2a\x2a\x2a"
458
459# Inactive images are effectively read-only images, so this should be a
460# non-fatal corruption (which does not modify the image)
461echo "{'execute': 'qmp_capabilities'}
462      {'execute': 'human-monitor-command',
463       'arguments': {'command-line': 'qemu-io drive \"read 0 512\"'}}
464      {'execute': 'quit'}" \
465    | $QEMU -qmp stdio -nographic -nodefaults \
466            -blockdev "{'node-name': 'drive',
467                        'driver': 'qcow2',
468                        'file': {
469                            'driver': 'file',
470                            'filename': '$TEST_IMG'
471                        }}" \
472            -incoming exec:'cat /dev/null' \
473            2>&1 \
474    | _filter_qmp | _filter_qemu_io | _filter_io_error
475
476echo
477# Image should not have been marked corrupt
478_img_info --format-specific | grep 'corrupt:'
479
480# success, all done
481echo "*** done"
482rm -f $seq.full
483status=0
484