VirtualBox

source: vbox/trunk/src/VBox/Devices/testcase/tstDeviceIoFuzz.cpp@ 92124

Last change on this file since 92124 was 92124, checked in by vboxsync, 3 years ago

Devices/testcase/tstDevice: Fuzz ring-0 device handlers as well, bugref:9006
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 9.5 KB
Line 
1/* $Id: tstDeviceIoFuzz.cpp 92124 2021-10-28 07:32:42Z vboxsync $ */
2/** @file
3 * tstDeviceSsmFuzz - I/O fuzzing testcase.
4 */
5
6/*
7 * Copyright (C) 2021 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 */
17
18
19/*********************************************************************************************************************************
20* Header Files *
21*********************************************************************************************************************************/
22#define LOG_GROUP LOG_GROUP_DEFAULT /** @todo */
23#include <VBox/types.h>
24#include <iprt/errcore.h>
25#include <iprt/mem.h>
26#include <iprt/fuzz.h>
27#include <iprt/time.h>
28#include <iprt/rand.h>
29#include <iprt/string.h>
30#include <iprt/stream.h>
31
32#include "tstDeviceBuiltin.h"
33#include "tstDeviceCfg.h"
34#include "tstDeviceInternal.h"
35
36
37/*********************************************************************************************************************************
38* Defined Constants And Macros *
39*********************************************************************************************************************************/
40
41
42/*********************************************************************************************************************************
43* Structures and Typedefs *
44*********************************************************************************************************************************/
45
46
47static const uint32_t g_aAccWidths[] = { 1, 2, 4, 8 };
48
49static PCTSTDEVCFGITEM tstDevSsmFuzzGetCfgItem(PCTSTDEVCFGITEM paCfg, uint32_t cCfgItems, const char *pszName)
50{
51 for (uint32_t i = 0; i < cCfgItems; i++)
52 {
53 if (!RTStrCmp(paCfg[i].pszKey, pszName))
54 return &paCfg[i];
55 }
56
57 return NULL;
58}
59
60
61static uint64_t tstDevSsmFuzzGetCfgU64(PCTSTDEVCFGITEM paCfg, uint32_t cCfgItems, const char *pszName)
62{
63 PCTSTDEVCFGITEM pCfgItem = tstDevSsmFuzzGetCfgItem(paCfg, cCfgItems, pszName);
64 if ( pCfgItem
65 && pCfgItem->enmType == TSTDEVCFGITEMTYPE_INTEGER)
66 return (uint64_t)pCfgItem->u.i64;
67
68 return 0;
69}
70
71
72/**
73 * Entry point for the SSM fuzzer.
74 *
75 * @returns VBox status code.
76 * @param hDut The device under test.
77 * @param paCfg The testcase config.
78 * @param cCfgItems Number of config items.
79 */
80static DECLCALLBACK(int) tstDevIoFuzzEntry(TSTDEVDUT hDut, PCTSTDEVCFGITEM paCfg, uint32_t cCfgItems)
81{
82 /* Determine the amount of I/O port handlers. */
83 uint32_t cIoPortRegs = 0;
84 PRTDEVDUTIOPORT pIoPort;
85 RTListForEach(&hDut->LstIoPorts, pIoPort, RTDEVDUTIOPORT, NdIoPorts)
86 {
87 cIoPortRegs++;
88 }
89
90 /* Determine the amount of MMIO regions. */
91 uint32_t cMmioRegions = 0;
92 PRTDEVDUTMMIO pMmio;
93 RTListForEach(&hDut->LstMmio, pMmio, RTDEVDUTMMIO, NdMmio)
94 {
95 cMmioRegions++;
96 }
97
98 RTRAND hRnd;
99 int rc = RTRandAdvCreateParkMiller(&hRnd);
100 if (RT_SUCCESS(rc))
101 {
102 RTRandAdvSeed(hRnd, 0x123456789);
103 uint64_t cRuntimeMs = tstDevSsmFuzzGetCfgU64(paCfg, cCfgItems, "RuntimeSec") * RT_MS_1SEC_64;
104 uint64_t tsStart = RTTimeMilliTS();
105 uint64_t cFuzzedInputs = 0;
106 RTCritSectEnter(&hDut->pDevIns->pCritSectRoR3->s.CritSect);
107 do
108 {
109 bool fMmio = false;
110
111 if ( cMmioRegions
112 && !cIoPortRegs)
113 fMmio = true;
114 else if ( !cMmioRegions
115 && cIoPortRegs)
116 fMmio = false;
117 else
118 fMmio = RT_BOOL(RTRandAdvU32Ex(hRnd, 0, 1));
119
120 if (fMmio)
121 {
122 uint32_t iMmio = RTRandAdvU32Ex(hRnd, 0, cMmioRegions - 1);
123 RTListForEach(&hDut->LstMmio, pMmio, RTDEVDUTMMIO, NdMmio)
124 {
125 if (!iMmio)
126 break;
127 iMmio--;
128 }
129
130 uint32_t uMin = pMmio->pfnWriteR3 ? 0 : 1;
131 uint32_t uMax = pMmio->pfnReadR3 ? 1 : 0;
132
133 RTGCPHYS offRegion = RTRandAdvU64Ex(hRnd, 0, pMmio->cbRegion);
134 bool fRead = RT_BOOL(uMin == uMax ? uMin : RTRandAdvU32Ex(hRnd, uMin, uMax));
135 bool fRing0 = false;
136
137 if ( ( fRead
138 && pMmio->pfnReadR0)
139 || ( !fRead
140 && pMmio->pfnWriteR0))
141 fRing0 = RT_BOOL(RTRandAdvU32Ex(hRnd, 0, 1));
142
143 uint64_t u64Value = fRead ? 0 : RTRandAdvU64(hRnd);
144 uint32_t cbValue = g_aAccWidths[RTRandAdvU32Ex(hRnd, 0, 2)];
145
146 if (fRead)
147 {
148 if (fRing0)
149 {
150 VBOXSTRICTRC rcStrict = pMmio->pfnReadR0((PPDMDEVINS)hDut->pDevInsR0, pIoPort->pvUserR0, offRegion, &u64Value, cbValue);
151 if (VBOXSTRICTRC_VAL(rcStrict) == VINF_IOM_R3_MMIO_READ)
152 {
153 AssertRelease(pMmio->pfnReadR3);
154 pMmio->pfnReadR3(hDut->pDevIns, pIoPort->pvUserR3, offRegion, &u64Value, cbValue);
155 }
156
157 }
158 else
159 pMmio->pfnReadR3(hDut->pDevIns, pMmio->pvUserR3, offRegion, &u64Value, cbValue);
160 }
161 else
162 {
163 if (fRing0)
164 {
165 VBOXSTRICTRC rcStrict = pMmio->pfnWriteR0((PPDMDEVINS)hDut->pDevInsR0, pIoPort->pvUserR0, offRegion, &u64Value, cbValue);
166 if (VBOXSTRICTRC_VAL(rcStrict) == VINF_IOM_R3_MMIO_WRITE)
167 {
168 AssertRelease(pMmio->pfnWriteR3);
169 pMmio->pfnWriteR3(hDut->pDevIns, pIoPort->pvUserR3, offRegion, &u64Value, cbValue);
170 }
171
172 }
173 else
174 pMmio->pfnWriteR3(hDut->pDevIns, pMmio->pvUserR3, offRegion, &u64Value, cbValue);
175 }
176 }
177 else
178 {
179 uint32_t iIoPort = RTRandAdvU32Ex(hRnd, 0, cIoPortRegs - 1);
180 RTListForEach(&hDut->LstIoPorts, pIoPort, RTDEVDUTIOPORT, NdIoPorts)
181 {
182 if (!iIoPort)
183 break;
184 iIoPort--;
185 }
186
187 uint32_t uMin = pIoPort->pfnOutR3 ? 0 : 1;
188 uint32_t uMax = pIoPort->pfnInR3 ? 1 : 0;
189
190 uint32_t offPort = RTRandAdvU32Ex(hRnd, 0, pIoPort->cPorts);
191 bool fRead = RT_BOOL(uMin == uMax ? uMin : RTRandAdvU32Ex(hRnd, uMin, uMax));
192 bool fRing0 = false;
193
194 if ( ( fRead
195 && pIoPort->pfnInR0)
196 || ( !fRead
197 && pIoPort->pfnOutR3))
198 fRing0 = RT_BOOL(RTRandAdvU32Ex(hRnd, 0, 1));
199
200 uint32_t u32Value = fRead ? 0 : RTRandAdvU32(hRnd);
201 uint32_t cbValue = g_aAccWidths[RTRandAdvU32Ex(hRnd, 0, 2)];
202
203 if (fRead)
204 {
205 if (fRing0)
206 {
207 VBOXSTRICTRC rcStrict = pIoPort->pfnInR0((PPDMDEVINS)hDut->pDevInsR0, pIoPort->pvUserR0, offPort, &u32Value, cbValue);
208 if (VBOXSTRICTRC_VAL(rcStrict) == VINF_IOM_R3_IOPORT_READ)
209 {
210 AssertRelease(pIoPort->pfnInR3);
211 pIoPort->pfnInR3(hDut->pDevIns, pIoPort->pvUserR3, offPort, &u32Value, cbValue);
212 }
213
214 }
215 else
216 pIoPort->pfnInR3(hDut->pDevIns, pIoPort->pvUserR3, offPort, &u32Value, cbValue);
217 }
218 else
219 {
220 if (fRing0)
221 {
222 VBOXSTRICTRC rcStrict = pIoPort->pfnOutR0((PPDMDEVINS)hDut->pDevInsR0, pIoPort->pvUserR0, offPort, u32Value, cbValue);
223 if (VBOXSTRICTRC_VAL(rcStrict) == VINF_IOM_R3_IOPORT_WRITE)
224 {
225 AssertRelease(pIoPort->pfnOutR3);
226 pIoPort->pfnOutR3(hDut->pDevIns, pIoPort->pvUserR3, offPort, u32Value, cbValue);
227 }
228
229 }
230 else
231 pIoPort->pfnOutR3(hDut->pDevIns, pIoPort->pvUserR3, offPort, u32Value, cbValue);
232 }
233 }
234
235 cFuzzedInputs++;
236 } while ( RT_SUCCESS(rc)
237 && RTTimeMilliTS() - tsStart < cRuntimeMs);
238 RTCritSectLeave(&hDut->pDevIns->pCritSectRoR3->s.CritSect);
239
240 RTPrintf("Fuzzed inputs: %u\n", cFuzzedInputs);
241 RTRandAdvDestroy(hRnd);
242 }
243
244 return rc;
245}
246
247
248const TSTDEVTESTCASEREG g_TestcaseIoFuzz =
249{
250 /** szName */
251 "IoFuzz",
252 /** pszDesc */
253 "Fuzzes devices I/O handlers",
254 /** fFlags */
255 0,
256 /** pfnTestEntry */
257 tstDevIoFuzzEntry
258};
259
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette