gpt/
format.rs

1// Copyright 2024 The Fuchsia Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5use anyhow::{Error, anyhow, ensure};
6use zerocopy::{FromBytes, Immutable, IntoBytes, KnownLayout};
7
8const MAX_PARTITION_ENTRIES: u32 = 128;
9
10pub const GPT_SIGNATURE: [u8; 8] = [0x45, 0x46, 0x49, 0x20, 0x50, 0x41, 0x52, 0x54];
11pub const GPT_REVISION: u32 = 0x10000;
12pub const GPT_HEADER_SIZE: usize = 92;
13
14/// GPT disk header.
15#[derive(Clone, Debug, Eq, PartialEq, Immutable, IntoBytes, KnownLayout, FromBytes)]
16#[repr(C)]
17pub struct Header {
18    /// Must be GPT_SIGNATURE
19    pub signature: [u8; 8],
20    /// Must be GPT_REVISION
21    pub revision: u32,
22    /// Must be GPT_HEADER_SIZE
23    pub header_size: u32,
24    /// CRC32 of the header with crc32 section zeroed
25    pub crc32: u32,
26    /// reserved; must be 0
27    pub reserved: u32,
28    /// Must be 1
29    pub current_lba: u64,
30    /// LBA of backup header
31    pub backup_lba: u64,
32    /// First usable LBA for partitions (primary table last LBA + 1)
33    pub first_usable: u64,
34    /// Last usable LBA (secondary partition table first LBA - 1)
35    pub last_usable: u64,
36    /// UUID of the disk
37    pub disk_guid: [u8; 16],
38    /// Starting LBA of partition entries
39    pub part_start: u64,
40    /// Number of partition entries
41    pub num_parts: u32,
42    /// Size of a partition entry, usually 128
43    pub part_size: u32,
44    /// CRC32 of the partition table
45    pub crc32_parts: u32,
46    /// Padding to satisfy zerocopy's alignment requirements.
47    /// Not actually part of the header, which should be GPT_HEADER_SIZE bytes.
48    zerocopy_padding: u32,
49}
50
51impl Header {
52    pub fn new(block_count: u64, block_size: u32, num_parts: u32) -> Result<Self, Error> {
53        ensure!(block_size > 0 && block_size.is_power_of_two(), "Invalid block size");
54        let bs = block_size as u64;
55
56        let part_size = std::mem::size_of::<PartitionTableEntry>();
57        let partition_table_len = num_parts as u64 * part_size as u64;
58        let partition_table_blocks = partition_table_len.checked_next_multiple_of(bs).unwrap() / bs;
59
60        // Ensure there are enough blocks for both copies of the metadata, plus the protective MBR
61        // block.
62        ensure!(block_count > 1 + 2 * (1 + partition_table_blocks), "Too few blocks");
63
64        let mut this = Self {
65            signature: GPT_SIGNATURE,
66            revision: GPT_REVISION,
67            header_size: GPT_HEADER_SIZE as u32,
68            crc32: 0,
69            reserved: 0,
70            current_lba: 1,
71            backup_lba: block_count - 1,
72            first_usable: 2 + partition_table_blocks,
73            last_usable: block_count - (2 + partition_table_blocks),
74            disk_guid: uuid::Uuid::new_v4().into_bytes(),
75            part_start: 2,
76            num_parts,
77            part_size: part_size as u32,
78            crc32_parts: 0,
79            zerocopy_padding: 0,
80        };
81        this.update_checksum();
82        Ok(this)
83    }
84
85    // NB: This is expensive as it deeply copies the header.
86    pub fn compute_checksum(&self) -> u32 {
87        let mut header_copy = self.clone();
88        header_copy.crc32 = 0;
89        crc::Crc::<u32>::new(&crc::CRC_32_ISO_HDLC)
90            .checksum(&header_copy.as_bytes()[..GPT_HEADER_SIZE])
91    }
92
93    fn update_checksum(&mut self) {
94        self.crc32 = 0;
95        let crc = crc::Crc::<u32>::new(&crc::CRC_32_ISO_HDLC)
96            .checksum(&self.as_bytes()[..GPT_HEADER_SIZE]);
97        self.crc32 = crc;
98    }
99
100    // NB: This does *not* validate the partition table checksum.
101    pub fn ensure_integrity(&self, block_count: u64, block_size: u64) -> Result<(), Error> {
102        ensure!(self.signature == GPT_SIGNATURE, "Bad signature {:x?}", self.signature);
103        ensure!(self.revision == GPT_REVISION, "Bad revision {:x}", self.revision);
104        ensure!(
105            self.header_size as usize == GPT_HEADER_SIZE,
106            "Bad header size {}",
107            self.header_size
108        );
109
110        // Now that we've checked the basic fields, check the CRC.  All other checks should be below
111        // this.
112        ensure!(self.crc32 == self.compute_checksum(), "Invalid header checksum");
113
114        ensure!(self.num_parts <= MAX_PARTITION_ENTRIES, "Invalid num_parts {}", self.num_parts);
115        ensure!(
116            self.part_size as usize == std::mem::size_of::<PartitionTableEntry>(),
117            "Invalid part_size {}",
118            self.part_size
119        );
120        let partition_table_blocks = (self
121            .num_parts
122            .checked_mul(self.part_size)
123            .and_then(|v| v.checked_next_multiple_of(block_size as u32))
124            .ok_or_else(|| anyhow!("Partition table size overflow"))?
125            as u64)
126            / block_size;
127        ensure!(partition_table_blocks < block_count, "Invalid partition table size");
128
129        // NB: The current LBA points to *this* header, so it's either at the start or the end.
130        // The last LBA points to the *other* header.  Since we want to check the absolute offsets,
131        // figure out which is which.
132        ensure!(
133            self.current_lba == 1 || self.current_lba == block_count - 1,
134            "Invalid current_lba {}",
135            self.current_lba
136        );
137        let (first_lba, second_lba) = if self.current_lba == 1 {
138            (self.current_lba, self.backup_lba)
139        } else {
140            (self.backup_lba, self.current_lba)
141        };
142
143        ensure!(
144            self.first_usable >= first_lba + partition_table_blocks,
145            "Invalid first_usable {}",
146            self.first_usable
147        );
148        ensure!(
149            self.first_usable <= self.last_usable
150                && self.last_usable + partition_table_blocks <= second_lba,
151            "Invalid last_usable {}",
152            self.last_usable
153        );
154
155        if first_lba == self.current_lba {
156            ensure!(self.part_start == first_lba + 1, "Invalid part_start {}", self.part_start);
157        } else {
158            ensure!(
159                self.part_start == self.last_usable + 1,
160                "Invalid part_start {}",
161                self.part_start
162            );
163        }
164
165        Ok(())
166    }
167}
168
169#[derive(Clone, Debug, Eq, PartialEq, Immutable, IntoBytes, KnownLayout, FromBytes)]
170#[repr(C)]
171pub struct PartitionTableEntry {
172    pub type_guid: [u8; 16],
173    pub instance_guid: [u8; 16],
174    pub first_lba: u64,
175    pub last_lba: u64,
176    pub flags: u64,
177    pub name: [u16; 36],
178}
179
180impl PartitionTableEntry {
181    pub fn is_empty(&self) -> bool {
182        self.as_bytes().iter().all(|b| *b == 0)
183    }
184
185    pub fn empty() -> Self {
186        Self {
187            type_guid: [0u8; 16],
188            instance_guid: [0u8; 16],
189            first_lba: 0,
190            last_lba: 0,
191            flags: 0,
192            name: [0u16; 36],
193        }
194    }
195
196    pub fn ensure_integrity(&self) -> Result<(), Error> {
197        ensure!(self.type_guid != [0u8; 16], "Empty type GUID");
198        ensure!(self.instance_guid != [0u8; 16], "Empty instance GUID");
199        ensure!(self.first_lba != 0, "Invalid first LBA");
200        ensure!(self.last_lba != 0 && self.last_lba >= self.first_lba, "Invalid last LBA");
201        Ok(())
202    }
203}
204
205#[derive(Eq, thiserror::Error, Clone, Debug, PartialEq)]
206pub enum FormatError {
207    #[error("Invalid arguments")]
208    InvalidArguments,
209    #[error("No space")]
210    NoSpace,
211}
212
213/// Serializes the partition table, and updates `header` to reflect the changes (including computing
214/// the CRC).  Returns the raw bytes of the partition table.
215/// Fails if any of the entries in `entries` are invalid.
216pub fn serialize_partition_table(
217    header: &mut Header,
218    block_size: usize,
219    num_blocks: u64,
220    entries: &[PartitionTableEntry],
221) -> Result<Vec<u8>, FormatError> {
222    let crc_algo = crc::Crc::<u32>::new(&crc::CRC_32_ISO_HDLC);
223    let mut digest = crc_algo.digest();
224    let partition_table_len = header.part_size as usize * entries.len();
225    let partition_table_len = partition_table_len
226        .checked_next_multiple_of(block_size)
227        .ok_or(FormatError::InvalidArguments)?;
228    let partition_table_blocks = (partition_table_len / block_size) as u64;
229    let mut partition_table = vec![0u8; partition_table_len];
230    let mut partition_table_view = &mut partition_table[..];
231    // The first two blocks are resered for the PMBR and the primary GPT header.
232    let first_usable = partition_table_blocks + 2;
233    // The last block is reserved for the backup GPT header.  We subtract one more to get to the
234    // offset of the last usable block.
235    let last_usable = num_blocks.saturating_sub(partition_table_blocks + 2);
236    if first_usable > last_usable {
237        return Err(FormatError::NoSpace);
238    }
239    let mut used_ranges = vec![0..first_usable, last_usable + 1..num_blocks];
240    let part_size = header.part_size as usize;
241    for entry in entries {
242        let part_raw = entry.as_bytes();
243        assert!(part_raw.len() == part_size);
244        if !entry.is_empty() {
245            entry.ensure_integrity().map_err(|_| FormatError::InvalidArguments)?;
246            used_ranges.push(entry.first_lba..entry.last_lba + 1);
247            partition_table_view[..part_raw.len()].copy_from_slice(part_raw);
248        }
249        digest.update(part_raw);
250        partition_table_view = &mut partition_table_view[part_size..];
251    }
252    used_ranges.sort_by_key(|range| range.start);
253    for ranges in used_ranges.windows(2) {
254        if ranges[0].end > ranges[1].start {
255            return Err(FormatError::InvalidArguments);
256        }
257    }
258    header.first_usable = first_usable;
259    header.last_usable = last_usable;
260    header.num_parts = entries.len() as u32;
261    header.crc32_parts = digest.finalize();
262    header.crc32 = header.compute_checksum();
263    Ok(partition_table)
264}
265
266#[cfg(test)]
267mod tests {
268    use super::{GPT_HEADER_SIZE, Header};
269
270    #[fuchsia::test]
271    fn header_crc() {
272        let nblocks = 8;
273        let partition_table_nblocks = 1;
274        let mut header = Header {
275            signature: [0x45, 0x46, 0x49, 0x20, 0x50, 0x41, 0x52, 0x54],
276            revision: 0x10000,
277            header_size: GPT_HEADER_SIZE as u32,
278            crc32: 0,
279            reserved: 0,
280            current_lba: 1,
281            backup_lba: nblocks - 1,
282            first_usable: 2 + partition_table_nblocks,
283            last_usable: nblocks - (2 + partition_table_nblocks),
284            disk_guid: [0u8; 16],
285            part_start: 2,
286            num_parts: 1,
287            part_size: 128,
288            crc32_parts: 0,
289            zerocopy_padding: 0,
290        };
291        header.crc32 = header.compute_checksum();
292
293        header.ensure_integrity(nblocks, 512).expect("Header should be valid");
294
295        // Flip one bit, leaving an otherwise valid header.
296        header.num_parts = 2;
297
298        header.ensure_integrity(nblocks, 512).expect_err("Header should be invalid");
299    }
300}
gpt/format.rs

gpt/
format.rs
