Re: [PATCH 2/2] tools/libs/guest: Use the system liblz4 in the bzimage loader

[Andrew Cooper <andrew.cooper3@xxxxxxxxxx>]

On 08/06/2026 11:46 am, Roger Pau Monné wrote:
> On Wed, Jun 03, 2026 at 09:53:31AM +0100, Andrew Cooper wrote:
>> Right now lz4, unlike every other compression scheme, unconditionally uses
>> Xen's unsafe decompressor.  Make it consistent with all other compression
>> schemes by using liblz4.
>>
>> The unsafe decompression is still required for the MiniOS build, so rename
>> xg_dom_decompress_lz4.c to xg_dom_decompress_unsafe_lz4.c and drop the
>> non-MiniOS content.
>>
>> Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
> Reviewed-by: Roger Pau Monné <roger.pau@xxxxxxxxxx>
>
>> ---
>> CC: Anthony PERARD <anthony.perard@xxxxxxxxxx>
>> CC: Juergen Gross <jgross@xxxxxxxx>
>> CC: Oleksii Kurochko <oleksii.kurochko@xxxxxxxxx>
>> ---
>>  tools/libs/guest/Makefile.common              |   2 +-
>>  tools/libs/guest/xg_dom_bzimageloader.c       | 128 +++++++++++++++-
>>  tools/libs/guest/xg_dom_decompress.h          |   6 -
>>  tools/libs/guest/xg_dom_decompress_lz4.c      | 143 ------------------
>>  tools/libs/guest/xg_dom_decompress_unsafe.h   |   2 +
>>  .../libs/guest/xg_dom_decompress_unsafe_lz4.c |  39 +++++
>>  6 files changed, 169 insertions(+), 151 deletions(-)
>>  delete mode 100644 tools/libs/guest/xg_dom_decompress.h
>>  delete mode 100644 tools/libs/guest/xg_dom_decompress_lz4.c
>>  create mode 100644 tools/libs/guest/xg_dom_decompress_unsafe_lz4.c
>>
>> diff --git a/tools/libs/guest/Makefile.common 
>> b/tools/libs/guest/Makefile.common
>> index b928a4a246a9..86b1f160e536 100644
>> --- a/tools/libs/guest/Makefile.common
>> +++ b/tools/libs/guest/Makefile.common
>> @@ -46,7 +46,6 @@ OBJS-y                 += xg_dom_core.o
>>  OBJS-y                 += xg_dom_boot.o
>>  OBJS-y                 += xg_dom_elfloader.o
>>  OBJS-$(CONFIG_X86)     += xg_dom_bzimageloader.o
>> -OBJS-$(CONFIG_X86)     += xg_dom_decompress_lz4.o
>>  OBJS-$(CONFIG_X86)     += xg_dom_hvmloader.o
>>  OBJS-$(CONFIG_ARM)     += xg_dom_armzimageloader.o
>>  OBJS-y                 += xg_dom_binloader.o
>> @@ -59,6 +58,7 @@ OBJS-$(CONFIG_ARM)     += xg_dom_arm.o
>>  ifeq ($(CONFIG_LIBXC_MINIOS),y)
>>  OBJS-y                 += xg_dom_decompress_unsafe.o
>>  OBJS-y                 += xg_dom_decompress_unsafe_bzip2.o
>> +OBJS-y                 += xg_dom_decompress_unsafe_lz4.o
>>  OBJS-y                 += xg_dom_decompress_unsafe_lzma.o
>>  OBJS-y                 += xg_dom_decompress_unsafe_lzo1x.o
>>  OBJS-y                 += xg_dom_decompress_unsafe_xz.o
>> diff --git a/tools/libs/guest/xg_dom_bzimageloader.c 
>> b/tools/libs/guest/xg_dom_bzimageloader.c
>> index 1fb4e5a1f728..32b3c682a447 100644
>> --- a/tools/libs/guest/xg_dom_bzimageloader.c
>> +++ b/tools/libs/guest/xg_dom_bzimageloader.c
>> @@ -32,7 +32,6 @@
>>  #include <inttypes.h>
>>  
>>  #include "xg_private.h"
>> -#include "xg_dom_decompress.h"
>>  
>>  #include <xen-tools/common-macros.h>
>>  
>> @@ -623,6 +622,133 @@ static int xc_try_zstd_decode(
>>  
>>  #endif
>>  
>> +#if defined(HAVE_LZ4)
>> +
>> +#include <lz4.h>
>> +
>> +#define ARCHIVE_MAGICNUMBER 0x184C2102
>> +
>> +static int xc_try_lz4_decode(struct xc_dom_image *dom, void **blob, size_t 
>> *size)
>> +{
>> +    size_t outsize, insize;
>> +    unsigned char *outbuf = NULL, *inp = *blob, *outp;
>> +    uint32_t chunksize;
>> +
>> +    /* Magic, descriptor byte, and trailing size field. */
>> +    if ( *size <= 8 )
>> +    {
>> +        DOMPRINTF("LZ4: insufficient input data");
>> +        goto err;
>> +    }
>> +
>> +    insize = *size - 4;
>> +    outsize = get_unaligned_le32(*blob + insize);
>> +
>> +    if ( xc_dom_kernel_check_size(dom, outsize) )
>> +    {
>> +        DOMPRINTF("LZ4: output too large");
>> +        goto err;
>> +    }
>> +
>> +    outbuf = malloc(outsize);
> I would use calloc() or memset() the buffer, just in case part of it
> is (wrongly) left uninitialized, as this is copied into guest memory.
>
> I see this is code moment, so possibly better to adjust afterwards if
> anything.

There's a later check:

    if ( (outp - outbuf) != outsize )

which will fail and free the buffer if the output length isn't exactly
as expected.

This code is all manner of horrible, including the fact that liblz4
doesn't actually have a function to decompress a full stream; only
chunk-by-chunk with the caller providing the framing.

~Andrew