mirror of https://github.com/Qortal/Brooklyn
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
407 lines
11 KiB
407 lines
11 KiB
/* |
|
* Wrapper for decompressing XZ-compressed kernel, initramfs, and initrd |
|
* |
|
* Author: Lasse Collin <[email protected]> |
|
* |
|
* This file has been put into the public domain. |
|
* You can do whatever you want with this file. |
|
*/ |
|
|
|
/* |
|
* Important notes about in-place decompression |
|
* |
|
* At least on x86, the kernel is decompressed in place: the compressed data |
|
* is placed to the end of the output buffer, and the decompressor overwrites |
|
* most of the compressed data. There must be enough safety margin to |
|
* guarantee that the write position is always behind the read position. |
|
* |
|
* The safety margin for XZ with LZMA2 or BCJ+LZMA2 is calculated below. |
|
* Note that the margin with XZ is bigger than with Deflate (gzip)! |
|
* |
|
* The worst case for in-place decompression is that the beginning of |
|
* the file is compressed extremely well, and the rest of the file is |
|
* incompressible. Thus, we must look for worst-case expansion when the |
|
* compressor is encoding incompressible data. |
|
* |
|
* The structure of the .xz file in case of a compressed kernel is as follows. |
|
* Sizes (as bytes) of the fields are in parenthesis. |
|
* |
|
* Stream Header (12) |
|
* Block Header: |
|
* Block Header (8-12) |
|
* Compressed Data (N) |
|
* Block Padding (0-3) |
|
* CRC32 (4) |
|
* Index (8-20) |
|
* Stream Footer (12) |
|
* |
|
* Normally there is exactly one Block, but let's assume that there are |
|
* 2-4 Blocks just in case. Because Stream Header and also Block Header |
|
* of the first Block don't make the decompressor produce any uncompressed |
|
* data, we can ignore them from our calculations. Block Headers of possible |
|
* additional Blocks have to be taken into account still. With these |
|
* assumptions, it is safe to assume that the total header overhead is |
|
* less than 128 bytes. |
|
* |
|
* Compressed Data contains LZMA2 or BCJ+LZMA2 encoded data. Since BCJ |
|
* doesn't change the size of the data, it is enough to calculate the |
|
* safety margin for LZMA2. |
|
* |
|
* LZMA2 stores the data in chunks. Each chunk has a header whose size is |
|
* a maximum of 6 bytes, but to get round 2^n numbers, let's assume that |
|
* the maximum chunk header size is 8 bytes. After the chunk header, there |
|
* may be up to 64 KiB of actual payload in the chunk. Often the payload is |
|
* quite a bit smaller though; to be safe, let's assume that an average |
|
* chunk has only 32 KiB of payload. |
|
* |
|
* The maximum uncompressed size of the payload is 2 MiB. The minimum |
|
* uncompressed size of the payload is in practice never less than the |
|
* payload size itself. The LZMA2 format would allow uncompressed size |
|
* to be less than the payload size, but no sane compressor creates such |
|
* files. LZMA2 supports storing incompressible data in uncompressed form, |
|
* so there's never a need to create payloads whose uncompressed size is |
|
* smaller than the compressed size. |
|
* |
|
* The assumption, that the uncompressed size of the payload is never |
|
* smaller than the payload itself, is valid only when talking about |
|
* the payload as a whole. It is possible that the payload has parts where |
|
* the decompressor consumes more input than it produces output. Calculating |
|
* the worst case for this would be tricky. Instead of trying to do that, |
|
* let's simply make sure that the decompressor never overwrites any bytes |
|
* of the payload which it is currently reading. |
|
* |
|
* Now we have enough information to calculate the safety margin. We need |
|
* - 128 bytes for the .xz file format headers; |
|
* - 8 bytes per every 32 KiB of uncompressed size (one LZMA2 chunk header |
|
* per chunk, each chunk having average payload size of 32 KiB); and |
|
* - 64 KiB (biggest possible LZMA2 chunk payload size) to make sure that |
|
* the decompressor never overwrites anything from the LZMA2 chunk |
|
* payload it is currently reading. |
|
* |
|
* We get the following formula: |
|
* |
|
* safety_margin = 128 + uncompressed_size * 8 / 32768 + 65536 |
|
* = 128 + (uncompressed_size >> 12) + 65536 |
|
* |
|
* For comparison, according to arch/x86/boot/compressed/misc.c, the |
|
* equivalent formula for Deflate is this: |
|
* |
|
* safety_margin = 18 + (uncompressed_size >> 12) + 32768 |
|
* |
|
* Thus, when updating Deflate-only in-place kernel decompressor to |
|
* support XZ, the fixed overhead has to be increased from 18+32768 bytes |
|
* to 128+65536 bytes. |
|
*/ |
|
|
|
/* |
|
* STATIC is defined to "static" if we are being built for kernel |
|
* decompression (pre-boot code). <linux/decompress/mm.h> will define |
|
* STATIC to empty if it wasn't already defined. Since we will need to |
|
* know later if we are being used for kernel decompression, we define |
|
* XZ_PREBOOT here. |
|
*/ |
|
#ifdef STATIC |
|
# define XZ_PREBOOT |
|
#endif |
|
#ifdef __KERNEL__ |
|
# include <linux/decompress/mm.h> |
|
#endif |
|
#define XZ_EXTERN STATIC |
|
|
|
#ifndef XZ_PREBOOT |
|
# include <linux/slab.h> |
|
# include <linux/xz.h> |
|
#else |
|
/* |
|
* Use the internal CRC32 code instead of kernel's CRC32 module, which |
|
* is not available in early phase of booting. |
|
*/ |
|
#define XZ_INTERNAL_CRC32 1 |
|
|
|
/* |
|
* For boot time use, we enable only the BCJ filter of the current |
|
* architecture or none if no BCJ filter is available for the architecture. |
|
*/ |
|
#ifdef CONFIG_X86 |
|
# define XZ_DEC_X86 |
|
#endif |
|
#ifdef CONFIG_PPC |
|
# define XZ_DEC_POWERPC |
|
#endif |
|
#ifdef CONFIG_ARM |
|
# define XZ_DEC_ARM |
|
#endif |
|
#ifdef CONFIG_IA64 |
|
# define XZ_DEC_IA64 |
|
#endif |
|
#ifdef CONFIG_SPARC |
|
# define XZ_DEC_SPARC |
|
#endif |
|
|
|
/* |
|
* This will get the basic headers so that memeq() and others |
|
* can be defined. |
|
*/ |
|
#include "xz/xz_private.h" |
|
|
|
/* |
|
* Replace the normal allocation functions with the versions from |
|
* <linux/decompress/mm.h>. vfree() needs to support vfree(NULL) |
|
* when XZ_DYNALLOC is used, but the pre-boot free() doesn't support it. |
|
* Workaround it here because the other decompressors don't need it. |
|
*/ |
|
#undef kmalloc |
|
#undef kfree |
|
#undef vmalloc |
|
#undef vfree |
|
#define kmalloc(size, flags) malloc(size) |
|
#define kfree(ptr) free(ptr) |
|
#define vmalloc(size) malloc(size) |
|
#define vfree(ptr) do { if (ptr != NULL) free(ptr); } while (0) |
|
|
|
/* |
|
* FIXME: Not all basic memory functions are provided in architecture-specific |
|
* files (yet). We define our own versions here for now, but this should be |
|
* only a temporary solution. |
|
* |
|
* memeq and memzero are not used much and any remotely sane implementation |
|
* is fast enough. memcpy/memmove speed matters in multi-call mode, but |
|
* the kernel image is decompressed in single-call mode, in which only |
|
* memmove speed can matter and only if there is a lot of incompressible data |
|
* (LZMA2 stores incompressible chunks in uncompressed form). Thus, the |
|
* functions below should just be kept small; it's probably not worth |
|
* optimizing for speed. |
|
*/ |
|
|
|
#ifndef memeq |
|
static bool memeq(const void *a, const void *b, size_t size) |
|
{ |
|
const uint8_t *x = a; |
|
const uint8_t *y = b; |
|
size_t i; |
|
|
|
for (i = 0; i < size; ++i) |
|
if (x[i] != y[i]) |
|
return false; |
|
|
|
return true; |
|
} |
|
#endif |
|
|
|
#ifndef memzero |
|
static void memzero(void *buf, size_t size) |
|
{ |
|
uint8_t *b = buf; |
|
uint8_t *e = b + size; |
|
|
|
while (b != e) |
|
*b++ = '\0'; |
|
} |
|
#endif |
|
|
|
#ifndef memmove |
|
/* Not static to avoid a conflict with the prototype in the Linux headers. */ |
|
void *memmove(void *dest, const void *src, size_t size) |
|
{ |
|
uint8_t *d = dest; |
|
const uint8_t *s = src; |
|
size_t i; |
|
|
|
if (d < s) { |
|
for (i = 0; i < size; ++i) |
|
d[i] = s[i]; |
|
} else if (d > s) { |
|
i = size; |
|
while (i-- > 0) |
|
d[i] = s[i]; |
|
} |
|
|
|
return dest; |
|
} |
|
#endif |
|
|
|
/* |
|
* Since we need memmove anyway, would use it as memcpy too. |
|
* Commented out for now to avoid breaking things. |
|
*/ |
|
/* |
|
#ifndef memcpy |
|
# define memcpy memmove |
|
#endif |
|
*/ |
|
|
|
#include "xz/xz_crc32.c" |
|
#include "xz/xz_dec_stream.c" |
|
#include "xz/xz_dec_lzma2.c" |
|
#include "xz/xz_dec_bcj.c" |
|
|
|
#endif /* XZ_PREBOOT */ |
|
|
|
/* Size of the input and output buffers in multi-call mode */ |
|
#define XZ_IOBUF_SIZE 4096 |
|
|
|
/* |
|
* This function implements the API defined in <linux/decompress/generic.h>. |
|
* |
|
* This wrapper will automatically choose single-call or multi-call mode |
|
* of the native XZ decoder API. The single-call mode can be used only when |
|
* both input and output buffers are available as a single chunk, i.e. when |
|
* fill() and flush() won't be used. |
|
*/ |
|
STATIC int INIT unxz(unsigned char *in, long in_size, |
|
long (*fill)(void *dest, unsigned long size), |
|
long (*flush)(void *src, unsigned long size), |
|
unsigned char *out, long *in_used, |
|
void (*error)(char *x)) |
|
{ |
|
struct xz_buf b; |
|
struct xz_dec *s; |
|
enum xz_ret ret; |
|
bool must_free_in = false; |
|
|
|
#if XZ_INTERNAL_CRC32 |
|
xz_crc32_init(); |
|
#endif |
|
|
|
if (in_used != NULL) |
|
*in_used = 0; |
|
|
|
if (fill == NULL && flush == NULL) |
|
s = xz_dec_init(XZ_SINGLE, 0); |
|
else |
|
s = xz_dec_init(XZ_DYNALLOC, (uint32_t)-1); |
|
|
|
if (s == NULL) |
|
goto error_alloc_state; |
|
|
|
if (flush == NULL) { |
|
b.out = out; |
|
b.out_size = (size_t)-1; |
|
} else { |
|
b.out_size = XZ_IOBUF_SIZE; |
|
b.out = malloc(XZ_IOBUF_SIZE); |
|
if (b.out == NULL) |
|
goto error_alloc_out; |
|
} |
|
|
|
if (in == NULL) { |
|
must_free_in = true; |
|
in = malloc(XZ_IOBUF_SIZE); |
|
if (in == NULL) |
|
goto error_alloc_in; |
|
} |
|
|
|
b.in = in; |
|
b.in_pos = 0; |
|
b.in_size = in_size; |
|
b.out_pos = 0; |
|
|
|
if (fill == NULL && flush == NULL) { |
|
ret = xz_dec_run(s, &b); |
|
} else { |
|
do { |
|
if (b.in_pos == b.in_size && fill != NULL) { |
|
if (in_used != NULL) |
|
*in_used += b.in_pos; |
|
|
|
b.in_pos = 0; |
|
|
|
in_size = fill(in, XZ_IOBUF_SIZE); |
|
if (in_size < 0) { |
|
/* |
|
* This isn't an optimal error code |
|
* but it probably isn't worth making |
|
* a new one either. |
|
*/ |
|
ret = XZ_BUF_ERROR; |
|
break; |
|
} |
|
|
|
b.in_size = in_size; |
|
} |
|
|
|
ret = xz_dec_run(s, &b); |
|
|
|
if (flush != NULL && (b.out_pos == b.out_size |
|
|| (ret != XZ_OK && b.out_pos > 0))) { |
|
/* |
|
* Setting ret here may hide an error |
|
* returned by xz_dec_run(), but probably |
|
* it's not too bad. |
|
*/ |
|
if (flush(b.out, b.out_pos) != (long)b.out_pos) |
|
ret = XZ_BUF_ERROR; |
|
|
|
b.out_pos = 0; |
|
} |
|
} while (ret == XZ_OK); |
|
|
|
if (must_free_in) |
|
free(in); |
|
|
|
if (flush != NULL) |
|
free(b.out); |
|
} |
|
|
|
if (in_used != NULL) |
|
*in_used += b.in_pos; |
|
|
|
xz_dec_end(s); |
|
|
|
switch (ret) { |
|
case XZ_STREAM_END: |
|
return 0; |
|
|
|
case XZ_MEM_ERROR: |
|
/* This can occur only in multi-call mode. */ |
|
error("XZ decompressor ran out of memory"); |
|
break; |
|
|
|
case XZ_FORMAT_ERROR: |
|
error("Input is not in the XZ format (wrong magic bytes)"); |
|
break; |
|
|
|
case XZ_OPTIONS_ERROR: |
|
error("Input was encoded with settings that are not " |
|
"supported by this XZ decoder"); |
|
break; |
|
|
|
case XZ_DATA_ERROR: |
|
case XZ_BUF_ERROR: |
|
error("XZ-compressed data is corrupt"); |
|
break; |
|
|
|
default: |
|
error("Bug in the XZ decompressor"); |
|
break; |
|
} |
|
|
|
return -1; |
|
|
|
error_alloc_in: |
|
if (flush != NULL) |
|
free(b.out); |
|
|
|
error_alloc_out: |
|
xz_dec_end(s); |
|
|
|
error_alloc_state: |
|
error("XZ decompressor ran out of memory"); |
|
return -1; |
|
} |
|
|
|
/* |
|
* This macro is used by architecture-specific files to decompress |
|
* the kernel image. |
|
*/ |
|
#ifdef XZ_PREBOOT |
|
STATIC int INIT __decompress(unsigned char *buf, long len, |
|
long (*fill)(void*, unsigned long), |
|
long (*flush)(void*, unsigned long), |
|
unsigned char *out_buf, long olen, |
|
long *pos, |
|
void (*error)(char *x)) |
|
{ |
|
return unxz(buf, len, fill, flush, out_buf, pos, error); |
|
} |
|
#endif
|
|
|