xref: /openbmc/qemu/tests/qemu-iotests/060 (revision e38e943a)
1#!/bin/bash
2#
3# Test case for image corruption (overlapping data structures) in qcow2
4#
5# Copyright (C) 2013 Red Hat, Inc.
6#
7# This program is free software; you can redistribute it and/or modify
8# it under the terms of the GNU General Public License as published by
9# the Free Software Foundation; either version 2 of the License, or
10# (at your option) any later version.
11#
12# This program is distributed in the hope that it will be useful,
13# but WITHOUT ANY WARRANTY; without even the implied warranty of
14# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15# GNU General Public License for more details.
16#
17# You should have received a copy of the GNU General Public License
18# along with this program.  If not, see <http://www.gnu.org/licenses/>.
19#
20
21# creator
22owner=mreitz@redhat.com
23
24seq="$(basename $0)"
25echo "QA output created by $seq"
26
27here="$PWD"
28tmp=/tmp/$$
29status=1	# failure is the default!
30
31_cleanup()
32{
33	_cleanup_test_img
34}
35trap "_cleanup; exit \$status" 0 1 2 3 15
36
37# get standard environment, filters and checks
38. ./common.rc
39. ./common.filter
40
41# This tests qocw2-specific low-level functionality
42_supported_fmt qcow2
43_supported_proto file
44_supported_os Linux
45
46rt_offset=65536  # 0x10000 (XXX: just an assumption)
47rb_offset=131072 # 0x20000 (XXX: just an assumption)
48l1_offset=196608 # 0x30000 (XXX: just an assumption)
49l2_offset=262144 # 0x40000 (XXX: just an assumption)
50l2_offset_after_snapshot=524288 # 0x80000 (XXX: just an assumption)
51
52IMGOPTS="compat=1.1"
53
54OPEN_RW="open -o overlap-check=all $TEST_IMG"
55# Overlap checks are done before write operations only, therefore opening an
56# image read-only makes the overlap-check option irrelevant
57OPEN_RO="open -r $TEST_IMG"
58
59echo
60echo "=== Testing L2 reference into L1 ==="
61echo
62_make_test_img 64M
63# Link first L1 entry (first L2 table) onto itself
64# (Note the MSb in the L1 entry is set, ensuring the refcount is one - else any
65# later write will result in a COW operation, effectively ruining this attempt
66# on image corruption)
67poke_file "$TEST_IMG" "$l1_offset" "\x80\x00\x00\x00\x00\x03\x00\x00"
68_check_test_img
69
70# The corrupt bit should not be set anyway
71$PYTHON qcow2.py "$TEST_IMG" dump-header | grep incompatible_features
72
73# Try to write something, thereby forcing the corrupt bit to be set
74$QEMU_IO -c "$OPEN_RW" -c "write -P 0x2a 0 512" | _filter_qemu_io
75
76# The corrupt bit must now be set
77$PYTHON qcow2.py "$TEST_IMG" dump-header | grep incompatible_features
78
79# Try to open the image R/W (which should fail)
80$QEMU_IO -c "$OPEN_RW" -c "read 0 512" 2>&1 | _filter_qemu_io \
81                                            | _filter_testdir \
82                                            | _filter_imgfmt
83
84# Try to open it RO (which should succeed)
85$QEMU_IO -c "$OPEN_RO" -c "read 0 512" | _filter_qemu_io
86
87# We could now try to fix the image, but this would probably fail (how should an
88# L2 table linked onto the L1 table be fixed?)
89
90echo
91echo "=== Testing cluster data reference into refcount block ==="
92echo
93_make_test_img 64M
94# Allocate L2 table
95truncate -s "$(($l2_offset+65536))" "$TEST_IMG"
96poke_file "$TEST_IMG" "$l1_offset" "\x80\x00\x00\x00\x00\x04\x00\x00"
97# Mark cluster as used
98poke_file "$TEST_IMG" "$(($rb_offset+8))" "\x00\x01"
99# Redirect new data cluster onto refcount block
100poke_file "$TEST_IMG" "$l2_offset" "\x80\x00\x00\x00\x00\x02\x00\x00"
101_check_test_img
102$PYTHON qcow2.py "$TEST_IMG" dump-header | grep incompatible_features
103$QEMU_IO -c "$OPEN_RW" -c "write -P 0x2a 0 512" | _filter_qemu_io
104$PYTHON qcow2.py "$TEST_IMG" dump-header | grep incompatible_features
105
106# Try to fix it
107_check_test_img -r all
108
109# The corrupt bit should be cleared
110$PYTHON qcow2.py "$TEST_IMG" dump-header | grep incompatible_features
111
112# Look if it's really really fixed
113$QEMU_IO -c "$OPEN_RW" -c "write -P 0x2a 0 512" | _filter_qemu_io
114$PYTHON qcow2.py "$TEST_IMG" dump-header | grep incompatible_features
115
116echo
117echo "=== Testing cluster data reference into inactive L2 table ==="
118echo
119_make_test_img 64M
120$QEMU_IO -c "$OPEN_RW" -c "write -P 1 0 512" | _filter_qemu_io
121$QEMU_IMG snapshot -c foo "$TEST_IMG"
122$QEMU_IO -c "$OPEN_RW" -c "write -P 2 0 512" | _filter_qemu_io
123# The inactive L2 table remains at its old offset
124poke_file "$TEST_IMG" "$l2_offset_after_snapshot" \
125                      "\x80\x00\x00\x00\x00\x04\x00\x00"
126_check_test_img
127$PYTHON qcow2.py "$TEST_IMG" dump-header | grep incompatible_features
128$QEMU_IO -c "$OPEN_RW" -c "write -P 3 0 512" | _filter_qemu_io
129$PYTHON qcow2.py "$TEST_IMG" dump-header | grep incompatible_features
130_check_test_img -r all
131$PYTHON qcow2.py "$TEST_IMG" dump-header | grep incompatible_features
132$QEMU_IO -c "$OPEN_RW" -c "write -P 4 0 512" | _filter_qemu_io
133$PYTHON qcow2.py "$TEST_IMG" dump-header | grep incompatible_features
134
135# Check data
136$QEMU_IO -c "$OPEN_RO" -c "read -P 4 0 512" | _filter_qemu_io
137$QEMU_IMG snapshot -a foo "$TEST_IMG"
138_check_test_img
139$QEMU_IO -c "$OPEN_RO" -c "read -P 1 0 512" | _filter_qemu_io
140
141echo
142echo "=== Testing overlap while COW is in flight ==="
143echo
144# compat=0.10 is required in order to make the following discard actually
145# unallocate the sector rather than make it a zero sector - we want COW, after
146# all.
147IMGOPTS='compat=0.10' _make_test_img 1G
148# Write two clusters, the second one enforces creation of an L2 table after
149# the first data cluster.
150$QEMU_IO -c 'write 0k 64k' -c 'write 512M 64k' "$TEST_IMG" | _filter_qemu_io
151# Discard the first cluster. This cluster will soon enough be reallocated and
152# used for COW.
153$QEMU_IO -c 'discard 0k 64k' "$TEST_IMG" | _filter_qemu_io
154# Now, corrupt the image by marking the second L2 table cluster as free.
155poke_file "$TEST_IMG" '131084' "\x00\x00" # 0x2000c
156# Start a write operation requiring COW on the image stopping it right before
157# doing the read; then, trigger the corruption prevention by writing anything to
158# any unallocated cluster, leading to an attempt to overwrite the second L2
159# table. Finally, resume the COW write and see it fail (but not crash).
160echo "open -o file.driver=blkdebug $TEST_IMG
161break cow_read 0
162aio_write 0k 1k
163wait_break 0
164write 64k 64k
165resume 0" | $QEMU_IO | _filter_qemu_io
166
167# success, all done
168echo "*** done"
169rm -f $seq.full
170status=0
171