block/dmg.c

   1 /*
   2  * QEMU Block driver for DMG images
   3  *
   4  * Copyright (c) 2004 Johannes E. Schindelin
   5  *
   6  * Permission is hereby granted, free of charge, to any person obtaining a copy
   7  * of this software and associated documentation files (the "Software"), to deal
   8  * in the Software without restriction, including without limitation the rights
   9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10  * copies of the Software, and to permit persons to whom the Software is
  11  * furnished to do so, subject to the following conditions:
  12  *
  13  * The above copyright notice and this permission notice shall be included in
  14  * all copies or substantial portions of the Software.
  15  *
  16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22  * THE SOFTWARE.
  23  */
  24 #include "qemu/osdep.h"
  25 #include "qapi/error.h"
  26 #include "block/block-io.h"
  27 #include "block/block_int.h"
  28 #include "qemu/bswap.h"
  29 #include "qemu/error-report.h"
  30 #include "qemu/module.h"
  31 #include "qemu/memalign.h"
  32 #include "dmg.h"
  33
  34 BdrvDmgUncompressFunc *dmg_uncompress_bz2;
  35 BdrvDmgUncompressFunc *dmg_uncompress_lzfse;
  36
  37 enum {
  38     /* Limit chunk sizes to prevent unreasonable amounts of memory being used
  39      * or truncating when converting to 32-bit types
  40      */
  41     DMG_LENGTHS_MAX = 64 * 1024 * 1024, /* 64 MB */
  42     DMG_SECTORCOUNTS_MAX = DMG_LENGTHS_MAX / 512,
  43 };
  44
  45 enum {
  46     /* DMG Block Type */
  47     UDZE = 0, /* Zeroes */
  48     UDRW,     /* RAW type */
  49     UDIG,     /* Ignore */
  50     UDCO = 0x80000004,
  51     UDZO,
  52     UDBZ,
  53     ULFO,
  54     UDCM = 0x7ffffffe, /* Comments */
  55     UDLE = 0xffffffff  /* Last Entry */
  56 };
  57
  58 static int dmg_probe(const uint8_t *buf, int buf_size, const char *filename)
  59 {
  60     int len;
  61
  62     if (!filename) {
  63         return 0;
  64     }
  65
  66     len = strlen(filename);
  67     if (len > 4 && !strcmp(filename + len - 4, ".dmg")) {
  68         return 2;
  69     }
  70     return 0;
  71 }
  72
  73 static int read_uint64(BlockDriverState *bs, int64_t offset, uint64_t *result)
  74 {
  75     uint64_t buffer;
  76     int ret;
  77
  78     ret = bdrv_pread(bs->file, offset, 8, &buffer, 0);
  79     if (ret < 0) {
  80         return ret;
  81     }
  82
  83     *result = be64_to_cpu(buffer);
  84     return 0;
  85 }
  86
  87 static int read_uint32(BlockDriverState *bs, int64_t offset, uint32_t *result)
  88 {
  89     uint32_t buffer;
  90     int ret;
  91
  92     ret = bdrv_pread(bs->file, offset, 4, &buffer, 0);
  93     if (ret < 0) {
  94         return ret;
  95     }
  96
  97     *result = be32_to_cpu(buffer);
  98     return 0;
  99 }
 100
 101 static inline uint64_t buff_read_uint64(const uint8_t *buffer, int64_t offset)
 102 {
 103     return be64_to_cpu(*(uint64_t *)&buffer[offset]);
 104 }
 105
 106 static inline uint32_t buff_read_uint32(const uint8_t *buffer, int64_t offset)
 107 {
 108     return be32_to_cpu(*(uint32_t *)&buffer[offset]);
 109 }
 110
 111 /* Increase max chunk sizes, if necessary.  This function is used to calculate
 112  * the buffer sizes needed for compressed/uncompressed chunk I/O.
 113  */
 114 static void update_max_chunk_size(BDRVDMGState *s, uint32_t chunk,
 115                                   uint32_t *max_compressed_size,
 116                                   uint32_t *max_sectors_per_chunk)
 117 {
 118     uint32_t compressed_size = 0;
 119     uint32_t uncompressed_sectors = 0;
 120
 121     switch (s->types[chunk]) {
 122     case UDZO: /* zlib compressed */
 123     case UDBZ: /* bzip2 compressed */
 124     case ULFO: /* lzfse compressed */
 125         compressed_size = s->lengths[chunk];
 126         uncompressed_sectors = s->sectorcounts[chunk];
 127         break;
 128     case UDRW: /* copy */
 129         uncompressed_sectors = DIV_ROUND_UP(s->lengths[chunk], 512);
 130         break;
 131     case UDZE: /* zero */
 132     case UDIG: /* ignore */
 133         /* as the all-zeroes block may be large, it is treated specially: the
 134          * sector is not copied from a large buffer, a simple memset is used
 135          * instead. Therefore uncompressed_sectors does not need to be set. */
 136         break;
 137     }
 138
 139     if (compressed_size > *max_compressed_size) {
 140         *max_compressed_size = compressed_size;
 141     }
 142     if (uncompressed_sectors > *max_sectors_per_chunk) {
 143         *max_sectors_per_chunk = uncompressed_sectors;
 144     }
 145 }
 146
 147 static int64_t dmg_find_koly_offset(BdrvChild *file, Error **errp)
 148 {
 149     BlockDriverState *file_bs = file->bs;
 150     int64_t length;
 151     int64_t offset = 0;
 152     uint8_t buffer[515];
 153     int i, ret;
 154
 155     /* bdrv_getlength returns a multiple of block size (512), rounded up. Since
 156      * dmg images can have odd sizes, try to look for the "koly" magic which
 157      * marks the begin of the UDIF trailer (512 bytes). This magic can be found
 158      * in the last 511 bytes of the second-last sector or the first 4 bytes of
 159      * the last sector (search space: 515 bytes) */
 160     length = bdrv_getlength(file_bs);
 161     if (length < 0) {
 162         error_setg_errno(errp, -length,
 163             "Failed to get file size while reading UDIF trailer");
 164         return length;
 165     } else if (length < 512) {
 166         error_setg(errp, "dmg file must be at least 512 bytes long");
 167         return -EINVAL;
 168     }
 169     if (length > 511 + 512) {
 170         offset = length - 511 - 512;
 171     }
 172     length = length < 515 ? length : 515;
 173     ret = bdrv_pread(file, offset, length, buffer, 0);
 174     if (ret < 0) {
 175         error_setg_errno(errp, -ret, "Failed while reading UDIF trailer");
 176         return ret;
 177     }
 178     for (i = 0; i < length - 3; i++) {
 179         if (buffer[i] == 'k' && buffer[i+1] == 'o' &&
 180             buffer[i+2] == 'l' && buffer[i+3] == 'y') {
 181             return offset + i;
 182         }
 183     }
 184     error_setg(errp, "Could not locate UDIF trailer in dmg file");
 185     return -EINVAL;
 186 }
 187
 188 /* used when building the sector table */
 189 typedef struct DmgHeaderState {
 190     /* used internally by dmg_read_mish_block to remember offsets of blocks
 191      * across calls */
 192     uint64_t data_fork_offset;
 193     /* exported for dmg_open */
 194     uint32_t max_compressed_size;
 195     uint32_t max_sectors_per_chunk;
 196 } DmgHeaderState;
 197
 198 static bool dmg_is_known_block_type(uint32_t entry_type)
 199 {
 200     switch (entry_type) {
 201     case UDZE:    /* zeros */
 202     case UDRW:    /* uncompressed */
 203     case UDIG:    /* ignore */
 204     case UDZO:    /* zlib */
 205         return true;
 206     case UDBZ:    /* bzip2 */
 207         return !!dmg_uncompress_bz2;
 208     case ULFO:    /* lzfse */
 209         return !!dmg_uncompress_lzfse;
 210     default:
 211         return false;
 212     }
 213 }
 214
 215 static int dmg_read_mish_block(BDRVDMGState *s, DmgHeaderState *ds,
 216                                uint8_t *buffer, uint32_t count)
 217 {
 218     uint32_t type, i;
 219     int ret;
 220     size_t new_size;
 221     uint32_t chunk_count;
 222     int64_t offset = 0;
 223     uint64_t data_offset;
 224     uint64_t in_offset = ds->data_fork_offset;
 225     uint64_t out_offset;
 226
 227     type = buff_read_uint32(buffer, offset);
 228     /* skip data that is not a valid MISH block (invalid magic or too small) */
 229     if (type != 0x6d697368 || count < 244) {
 230         /* assume success for now */
 231         return 0;
 232     }
 233
 234     /* chunk offsets are relative to this sector number */
 235     out_offset = buff_read_uint64(buffer, offset + 8);
 236
 237     /* location in data fork for (compressed) blob (in bytes) */
 238     data_offset = buff_read_uint64(buffer, offset + 0x18);
 239     in_offset += data_offset;
 240
 241     /* move to begin of chunk entries */
 242     offset += 204;
 243
 244     chunk_count = (count - 204) / 40;
 245     new_size = sizeof(uint64_t) * (s->n_chunks + chunk_count);
 246     s->types = g_realloc(s->types, new_size / 2);
 247     s->offsets = g_realloc(s->offsets, new_size);
 248     s->lengths = g_realloc(s->lengths, new_size);
 249     s->sectors = g_realloc(s->sectors, new_size);
 250     s->sectorcounts = g_realloc(s->sectorcounts, new_size);
 251
 252     for (i = s->n_chunks; i < s->n_chunks + chunk_count; i++) {
 253         s->types[i] = buff_read_uint32(buffer, offset);
 254         if (!dmg_is_known_block_type(s->types[i])) {
 255             switch (s->types[i]) {
 256             case UDBZ:
 257                 warn_report_once("dmg-bzip2 module is missing, accessing bzip2 "
 258                                  "compressed blocks will result in I/O errors");
 259                 break;
 260             case ULFO:
 261                 warn_report_once("dmg-lzfse module is missing, accessing lzfse "
 262                                  "compressed blocks will result in I/O errors");
 263                 break;
 264             case UDCM:
 265             case UDLE:
 266                 /* Comments and last entry can be ignored without problems */
 267                 break;
 268             default:
 269                 warn_report_once("Image contains chunks of unknown type %x, "
 270                                  "accessing them will result in I/O errors",
 271                                  s->types[i]);
 272                 break;
 273             }
 274             chunk_count--;
 275             i--;
 276             offset += 40;
 277             continue;
 278         }
 279
 280         /* sector number */
 281         s->sectors[i] = buff_read_uint64(buffer, offset + 8);
 282         s->sectors[i] += out_offset;
 283
 284         /* sector count */
 285         s->sectorcounts[i] = buff_read_uint64(buffer, offset + 0x10);
 286
 287         /* all-zeroes sector (type UDZE and UDIG) does not need to be
 288          * "uncompressed" and can therefore be unbounded. */
 289         if (s->types[i] != UDZE && s->types[i] != UDIG
 290             && s->sectorcounts[i] > DMG_SECTORCOUNTS_MAX) {
 291             error_report("sector count %" PRIu64 " for chunk %" PRIu32
 292                          " is larger than max (%u)",
 293                          s->sectorcounts[i], i, DMG_SECTORCOUNTS_MAX);
 294             ret = -EINVAL;
 295             goto fail;
 296         }
 297
 298         /* offset in (compressed) data fork */
 299         s->offsets[i] = buff_read_uint64(buffer, offset + 0x18);
 300         s->offsets[i] += in_offset;
 301
 302         /* length in (compressed) data fork */
 303         s->lengths[i] = buff_read_uint64(buffer, offset + 0x20);
 304
 305         if (s->lengths[i] > DMG_LENGTHS_MAX) {
 306             error_report("length %" PRIu64 " for chunk %" PRIu32
 307                          " is larger than max (%u)",
 308                          s->lengths[i], i, DMG_LENGTHS_MAX);
 309             ret = -EINVAL;
 310             goto fail;
 311         }
 312
 313         update_max_chunk_size(s, i, &ds->max_compressed_size,
 314                               &ds->max_sectors_per_chunk);
 315         offset += 40;
 316     }
 317     s->n_chunks += chunk_count;
 318     return 0;
 319
 320 fail:
 321     return ret;
 322 }
 323
 324 static int dmg_read_resource_fork(BlockDriverState *bs, DmgHeaderState *ds,
 325                                   uint64_t info_begin, uint64_t info_length)
 326 {
 327     BDRVDMGState *s = bs->opaque;
 328     int ret;
 329     uint32_t count, rsrc_data_offset;
 330     uint8_t *buffer = NULL;
 331     uint64_t info_end;
 332     uint64_t offset;
 333
 334     /* read offset from begin of resource fork (info_begin) to resource data */
 335     ret = read_uint32(bs, info_begin, &rsrc_data_offset);
 336     if (ret < 0) {
 337         goto fail;
 338     } else if (rsrc_data_offset > info_length) {
 339         ret = -EINVAL;
 340         goto fail;
 341     }
 342
 343     /* read length of resource data */
 344     ret = read_uint32(bs, info_begin + 8, &count);
 345     if (ret < 0) {
 346         goto fail;
 347     } else if (count == 0 || rsrc_data_offset + count > info_length) {
 348         ret = -EINVAL;
 349         goto fail;
 350     }
 351
 352     /* begin of resource data (consisting of one or more resources) */
 353     offset = info_begin + rsrc_data_offset;
 354
 355     /* end of resource data (there is possibly a following resource map
 356      * which will be ignored). */
 357     info_end = offset + count;
 358
 359     /* read offsets (mish blocks) from one or more resources in resource data */
 360     while (offset < info_end) {
 361         /* size of following resource */
 362         ret = read_uint32(bs, offset, &count);
 363         if (ret < 0) {
 364             goto fail;
 365         } else if (count == 0 || count > info_end - offset) {
 366             ret = -EINVAL;
 367             goto fail;
 368         }
 369         offset += 4;
 370
 371         buffer = g_realloc(buffer, count);
 372         ret = bdrv_pread(bs->file, offset, count, buffer, 0);
 373         if (ret < 0) {
 374             goto fail;
 375         }
 376
 377         ret = dmg_read_mish_block(s, ds, buffer, count);
 378         if (ret < 0) {
 379             goto fail;
 380         }
 381         /* advance offset by size of resource */
 382         offset += count;
 383     }
 384     ret = 0;
 385
 386 fail:
 387     g_free(buffer);
 388     return ret;
 389 }
 390
 391 static int dmg_read_plist_xml(BlockDriverState *bs, DmgHeaderState *ds,
 392                               uint64_t info_begin, uint64_t info_length)
 393 {
 394     BDRVDMGState *s = bs->opaque;
 395     int ret;
 396     uint8_t *buffer = NULL;
 397     char *data_begin, *data_end;
 398
 399     /* Have at least some length to avoid NULL for g_malloc. Attempt to set a
 400      * safe upper cap on the data length. A test sample had a XML length of
 401      * about 1 MiB. */
 402     if (info_length == 0 || info_length > 16 * 1024 * 1024) {
 403         ret = -EINVAL;
 404         goto fail;
 405     }
 406
 407     buffer = g_malloc(info_length + 1);
 408     buffer[info_length] = '\0';
 409     ret = bdrv_pread(bs->file, info_begin, info_length, buffer, 0);
 410     if (ret < 0) {
 411         ret = -EINVAL;
 412         goto fail;
 413     }
 414
 415     /* look for <data>...</data>. The data is 284 (0x11c) bytes after base64
 416      * decode. The actual data element has 431 (0x1af) bytes which includes tabs
 417      * and line feeds. */
 418     data_end = (char *)buffer;
 419     while ((data_begin = strstr(data_end, "<data>")) != NULL) {
 420         guchar *mish;
 421         gsize out_len = 0;
 422
 423         data_begin += 6;
 424         data_end = strstr(data_begin, "</data>");
 425         /* malformed XML? */
 426         if (data_end == NULL) {
 427             ret = -EINVAL;
 428             goto fail;
 429         }
 430         *data_end++ = '\0';
 431         mish = g_base64_decode(data_begin, &out_len);
 432         ret = dmg_read_mish_block(s, ds, mish, (uint32_t)out_len);
 433         g_free(mish);
 434         if (ret < 0) {
 435             goto fail;
 436         }
 437     }
 438     ret = 0;
 439
 440 fail:
 441     g_free(buffer);
 442     return ret;
 443 }
 444
 445 static int dmg_open(BlockDriverState *bs, QDict *options, int flags,
 446                     Error **errp)
 447 {
 448     BDRVDMGState *s = bs->opaque;
 449     DmgHeaderState ds;
 450     uint64_t rsrc_fork_offset, rsrc_fork_length;
 451     uint64_t plist_xml_offset, plist_xml_length;
 452     int64_t offset;
 453     int ret;
 454
 455     bdrv_graph_rdlock_main_loop();
 456     ret = bdrv_apply_auto_read_only(bs, NULL, errp);
 457     bdrv_graph_rdunlock_main_loop();
 458     if (ret < 0) {
 459         return ret;
 460     }
 461
 462     ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 463     if (ret < 0) {
 464         return ret;
 465     }
 466     /*
 467      * NB: if uncompress submodules are absent,
 468      * ie block_module_load return value == 0, the function pointers
 469      * dmg_uncompress_bz2 and dmg_uncompress_lzfse will be NULL.
 470      */
 471     if (block_module_load("dmg-bz2", errp) < 0) {
 472         return -EINVAL;
 473     }
 474     if (block_module_load("dmg-lzfse", errp) < 0) {
 475         return -EINVAL;
 476     }
 477
 478     s->n_chunks = 0;
 479     s->offsets = s->lengths = s->sectors = s->sectorcounts = NULL;
 480     /* used by dmg_read_mish_block to keep track of the current I/O position */
 481     ds.data_fork_offset = 0;
 482     ds.max_compressed_size = 1;
 483     ds.max_sectors_per_chunk = 1;
 484
 485     /* locate the UDIF trailer */
 486     offset = dmg_find_koly_offset(bs->file, errp);
 487     if (offset < 0) {
 488         ret = offset;
 489         goto fail;
 490     }
 491
 492     /* offset of data fork (DataForkOffset) */
 493     ret = read_uint64(bs, offset + 0x18, &ds.data_fork_offset);
 494     if (ret < 0) {
 495         goto fail;
 496     } else if (ds.data_fork_offset > offset) {
 497         ret = -EINVAL;
 498         goto fail;
 499     }
 500
 501     /* offset of resource fork (RsrcForkOffset) */
 502     ret = read_uint64(bs, offset + 0x28, &rsrc_fork_offset);
 503     if (ret < 0) {
 504         goto fail;
 505     }
 506     ret = read_uint64(bs, offset + 0x30, &rsrc_fork_length);
 507     if (ret < 0) {
 508         goto fail;
 509     }
 510     if (rsrc_fork_offset >= offset ||
 511         rsrc_fork_length > offset - rsrc_fork_offset) {
 512         ret = -EINVAL;
 513         goto fail;
 514     }
 515     /* offset of property list (XMLOffset) */
 516     ret = read_uint64(bs, offset + 0xd8, &plist_xml_offset);
 517     if (ret < 0) {
 518         goto fail;
 519     }
 520     ret = read_uint64(bs, offset + 0xe0, &plist_xml_length);
 521     if (ret < 0) {
 522         goto fail;
 523     }
 524     if (plist_xml_offset >= offset ||
 525         plist_xml_length > offset - plist_xml_offset) {
 526         ret = -EINVAL;
 527         goto fail;
 528     }
 529     ret = read_uint64(bs, offset + 0x1ec, (uint64_t *)&bs->total_sectors);
 530     if (ret < 0) {
 531         goto fail;
 532     }
 533     if (bs->total_sectors < 0) {
 534         ret = -EINVAL;
 535         goto fail;
 536     }
 537     if (rsrc_fork_length != 0) {
 538         ret = dmg_read_resource_fork(bs, &ds,
 539                                      rsrc_fork_offset, rsrc_fork_length);
 540         if (ret < 0) {
 541             goto fail;
 542         }
 543     } else if (plist_xml_length != 0) {
 544         ret = dmg_read_plist_xml(bs, &ds, plist_xml_offset, plist_xml_length);
 545         if (ret < 0) {
 546             goto fail;
 547         }
 548     } else {
 549         ret = -EINVAL;
 550         goto fail;
 551     }
 552
 553     /* initialize zlib engine */
 554     s->compressed_chunk = qemu_try_blockalign(bs->file->bs,
 555                                               ds.max_compressed_size + 1);
 556     s->uncompressed_chunk = qemu_try_blockalign(bs->file->bs,
 557                                                 512 * ds.max_sectors_per_chunk);
 558     if (s->compressed_chunk == NULL || s->uncompressed_chunk == NULL) {
 559         ret = -ENOMEM;
 560         goto fail;
 561     }
 562
 563     if (inflateInit(&s->zstream) != Z_OK) {
 564         ret = -EINVAL;
 565         goto fail;
 566     }
 567
 568     s->current_chunk = s->n_chunks;
 569
 570     qemu_co_mutex_init(&s->lock);
 571     return 0;
 572
 573 fail:
 574     g_free(s->types);
 575     g_free(s->offsets);
 576     g_free(s->lengths);
 577     g_free(s->sectors);
 578     g_free(s->sectorcounts);
 579     qemu_vfree(s->compressed_chunk);
 580     qemu_vfree(s->uncompressed_chunk);
 581     return ret;
 582 }
 583
 584 static void dmg_refresh_limits(BlockDriverState *bs, Error **errp)
 585 {
 586     bs->bl.request_alignment = BDRV_SECTOR_SIZE; /* No sub-sector I/O */
 587 }
 588
 589 static inline int is_sector_in_chunk(BDRVDMGState *s,
 590                 uint32_t chunk_num, uint64_t sector_num)
 591 {
 592     if (chunk_num >= s->n_chunks || s->sectors[chunk_num] > sector_num ||
 593             s->sectors[chunk_num] + s->sectorcounts[chunk_num] <= sector_num) {
 594         return 0;
 595     } else {
 596         return -1;
 597     }
 598 }
 599
 600 static inline uint32_t search_chunk(BDRVDMGState *s, uint64_t sector_num)
 601 {
 602     /* binary search */
 603     uint32_t chunk1 = 0, chunk2 = s->n_chunks, chunk3;
 604     while (chunk1 <= chunk2) {
 605         chunk3 = (chunk1 + chunk2) / 2;
 606         if (s->sectors[chunk3] > sector_num) {
 607             if (chunk3 == 0) {
 608                 goto err;
 609             }
 610             chunk2 = chunk3 - 1;
 611         } else if (s->sectors[chunk3] + s->sectorcounts[chunk3] > sector_num) {
 612             return chunk3;
 613         } else {
 614             chunk1 = chunk3 + 1;
 615         }
 616     }
 617 err:
 618     return s->n_chunks; /* error */
 619 }
 620
 621 static int coroutine_fn GRAPH_RDLOCK
 622 dmg_read_chunk(BlockDriverState *bs, uint64_t sector_num)
 623 {
 624     BDRVDMGState *s = bs->opaque;
 625
 626     if (!is_sector_in_chunk(s, s->current_chunk, sector_num)) {
 627         int ret;
 628         uint32_t chunk = search_chunk(s, sector_num);
 629
 630         if (chunk >= s->n_chunks) {
 631             return -1;
 632         }
 633
 634         s->current_chunk = s->n_chunks;
 635         switch (s->types[chunk]) { /* block entry type */
 636         case UDZO: { /* zlib compressed */
 637             /* we need to buffer, because only the chunk as whole can be
 638              * inflated. */
 639             ret = bdrv_co_pread(bs->file, s->offsets[chunk], s->lengths[chunk],
 640                                 s->compressed_chunk, 0);
 641             if (ret < 0) {
 642                 return -1;
 643             }
 644
 645             s->zstream.next_in = s->compressed_chunk;
 646             s->zstream.avail_in = s->lengths[chunk];
 647             s->zstream.next_out = s->uncompressed_chunk;
 648             s->zstream.avail_out = 512 * s->sectorcounts[chunk];
 649             ret = inflateReset(&s->zstream);
 650             if (ret != Z_OK) {
 651                 return -1;
 652             }
 653             ret = inflate(&s->zstream, Z_FINISH);
 654             if (ret != Z_STREAM_END ||
 655                 s->zstream.total_out != 512 * s->sectorcounts[chunk]) {
 656                 return -1;
 657             }
 658             break; }
 659         case UDBZ: /* bzip2 compressed */
 660             if (!dmg_uncompress_bz2) {
 661                 break;
 662             }
 663             /* we need to buffer, because only the chunk as whole can be
 664              * inflated. */
 665             ret = bdrv_co_pread(bs->file, s->offsets[chunk], s->lengths[chunk],
 666                                 s->compressed_chunk, 0);
 667             if (ret < 0) {
 668                 return -1;
 669             }
 670
 671             ret = dmg_uncompress_bz2((char *)s->compressed_chunk,
 672                                      (unsigned int) s->lengths[chunk],
 673                                      (char *)s->uncompressed_chunk,
 674                                      (unsigned int)
 675                                          (512 * s->sectorcounts[chunk]));
 676             if (ret < 0) {
 677                 return ret;
 678             }
 679             break;
 680         case ULFO:
 681             if (!dmg_uncompress_lzfse) {
 682                 break;
 683             }
 684             /* we need to buffer, because only the chunk as whole can be
 685              * inflated. */
 686             ret = bdrv_co_pread(bs->file, s->offsets[chunk], s->lengths[chunk],
 687                                 s->compressed_chunk, 0);
 688             if (ret < 0) {
 689                 return -1;
 690             }
 691
 692             ret = dmg_uncompress_lzfse((char *)s->compressed_chunk,
 693                                        (unsigned int) s->lengths[chunk],
 694                                        (char *)s->uncompressed_chunk,
 695                                        (unsigned int)
 696                                            (512 * s->sectorcounts[chunk]));
 697             if (ret < 0) {
 698                 return ret;
 699             }
 700             break;
 701         case UDRW: /* copy */
 702             ret = bdrv_co_pread(bs->file, s->offsets[chunk], s->lengths[chunk],
 703                                 s->uncompressed_chunk, 0);
 704             if (ret < 0) {
 705                 return -1;
 706             }
 707             break;
 708         case UDZE: /* zeros */
 709         case UDIG: /* ignore */
 710             /* see dmg_read, it is treated specially. No buffer needs to be
 711              * pre-filled, the zeroes can be set directly. */
 712             break;
 713         }
 714         s->current_chunk = chunk;
 715     }
 716     return 0;
 717 }
 718
 719 static int coroutine_fn GRAPH_RDLOCK
 720 dmg_co_preadv(BlockDriverState *bs, int64_t offset, int64_t bytes,
 721               QEMUIOVector *qiov, BdrvRequestFlags flags)
 722 {
 723     BDRVDMGState *s = bs->opaque;
 724     uint64_t sector_num = offset >> BDRV_SECTOR_BITS;
 725     int nb_sectors = bytes >> BDRV_SECTOR_BITS;
 726     int ret, i;
 727
 728     assert(QEMU_IS_ALIGNED(offset, BDRV_SECTOR_SIZE));
 729     assert(QEMU_IS_ALIGNED(bytes, BDRV_SECTOR_SIZE));
 730
 731     qemu_co_mutex_lock(&s->lock);
 732
 733     for (i = 0; i < nb_sectors; i++) {
 734         uint32_t sector_offset_in_chunk;
 735         void *data;
 736
 737         if (dmg_read_chunk(bs, sector_num + i) != 0) {
 738             ret = -EIO;
 739             goto fail;
 740         }
 741         /* Special case: current chunk is all zeroes. Do not perform a memcpy as
 742          * s->uncompressed_chunk may be too small to cover the large all-zeroes
 743          * section. dmg_read_chunk is called to find s->current_chunk */
 744         if (s->types[s->current_chunk] == UDZE
 745             || s->types[s->current_chunk] == UDIG) { /* all zeroes block entry */
 746             qemu_iovec_memset(qiov, i * 512, 0, 512);
 747             continue;
 748         }
 749         sector_offset_in_chunk = sector_num + i - s->sectors[s->current_chunk];
 750         data = s->uncompressed_chunk + sector_offset_in_chunk * 512;
 751         qemu_iovec_from_buf(qiov, i * 512, data, 512);
 752     }
 753
 754     ret = 0;
 755 fail:
 756     qemu_co_mutex_unlock(&s->lock);
 757     return ret;
 758 }
 759
 760 static void dmg_close(BlockDriverState *bs)
 761 {
 762     BDRVDMGState *s = bs->opaque;
 763
 764     g_free(s->types);
 765     g_free(s->offsets);
 766     g_free(s->lengths);
 767     g_free(s->sectors);
 768     g_free(s->sectorcounts);
 769     qemu_vfree(s->compressed_chunk);
 770     qemu_vfree(s->uncompressed_chunk);
 771
 772     inflateEnd(&s->zstream);
 773 }
 774
 775 static BlockDriver bdrv_dmg = {
 776     .format_name    = "dmg",
 777     .instance_size  = sizeof(BDRVDMGState),
 778     .bdrv_probe     = dmg_probe,
 779     .bdrv_open      = dmg_open,
 780     .bdrv_refresh_limits = dmg_refresh_limits,
 781     .bdrv_child_perm     = bdrv_default_perms,
 782     .bdrv_co_preadv = dmg_co_preadv,
 783     .bdrv_close     = dmg_close,
 784     .is_format      = true,
 785 };
 786
 787 static void bdrv_dmg_init(void)
 788 {
 789     bdrv_register(&bdrv_dmg);
 790 }
 791
 792 block_init(bdrv_dmg_init);