esp: check dma length before reading scsi command(CVE-2016-4441)
[qemu/ar7.git] / tests / virtio-net-test.c
blob04cfcd594e3ad2152b7cc531ea3e9573bb02d8f3
1 /*
2 * QTest testcase for VirtIO NIC
4 * Copyright (c) 2014 SUSE LINUX Products GmbH
6 * This work is licensed under the terms of the GNU GPL, version 2 or later.
7 * See the COPYING file in the top-level directory.
8 */
10 #include "qemu/osdep.h"
11 #include <glib.h>
12 #include "libqtest.h"
13 #include "qemu-common.h"
14 #include "qemu/sockets.h"
15 #include "qemu/iov.h"
16 #include "libqos/pci-pc.h"
17 #include "libqos/virtio.h"
18 #include "libqos/virtio-pci.h"
19 #include "libqos/malloc.h"
20 #include "libqos/malloc-pc.h"
21 #include "libqos/malloc-generic.h"
22 #include "qemu/bswap.h"
23 #include "hw/virtio/virtio-net.h"
25 #define PCI_SLOT_HP 0x06
26 #define PCI_SLOT 0x04
27 #define PCI_FN 0x00
29 #define QVIRTIO_NET_TIMEOUT_US (30 * 1000 * 1000)
30 #define VNET_HDR_SIZE sizeof(struct virtio_net_hdr_mrg_rxbuf)
32 static void test_end(void)
34 qtest_end();
37 #ifndef _WIN32
39 static QVirtioPCIDevice *virtio_net_pci_init(QPCIBus *bus, int slot)
41 QVirtioPCIDevice *dev;
43 dev = qvirtio_pci_device_find(bus, QVIRTIO_NET_DEVICE_ID);
44 g_assert(dev != NULL);
45 g_assert_cmphex(dev->vdev.device_type, ==, QVIRTIO_NET_DEVICE_ID);
47 qvirtio_pci_device_enable(dev);
48 qvirtio_reset(&qvirtio_pci, &dev->vdev);
49 qvirtio_set_acknowledge(&qvirtio_pci, &dev->vdev);
50 qvirtio_set_driver(&qvirtio_pci, &dev->vdev);
52 return dev;
55 static QPCIBus *pci_test_start(int socket)
57 char *cmdline;
59 cmdline = g_strdup_printf("-netdev socket,fd=%d,id=hs0 -device "
60 "virtio-net-pci,netdev=hs0", socket);
61 qtest_start(cmdline);
62 g_free(cmdline);
64 return qpci_init_pc();
67 static void driver_init(const QVirtioBus *bus, QVirtioDevice *dev)
69 uint32_t features;
71 features = qvirtio_get_features(bus, dev);
72 features = features & ~(QVIRTIO_F_BAD_FEATURE |
73 QVIRTIO_F_RING_INDIRECT_DESC |
74 QVIRTIO_F_RING_EVENT_IDX);
75 qvirtio_set_features(bus, dev, features);
77 qvirtio_set_driver_ok(bus, dev);
80 static void rx_test(const QVirtioBus *bus, QVirtioDevice *dev,
81 QGuestAllocator *alloc, QVirtQueue *vq,
82 int socket)
84 uint64_t req_addr;
85 uint32_t free_head;
86 char test[] = "TEST";
87 char buffer[64];
88 int len = htonl(sizeof(test));
89 struct iovec iov[] = {
91 .iov_base = &len,
92 .iov_len = sizeof(len),
93 }, {
94 .iov_base = test,
95 .iov_len = sizeof(test),
98 int ret;
100 req_addr = guest_alloc(alloc, 64);
102 free_head = qvirtqueue_add(vq, req_addr, 64, true, false);
103 qvirtqueue_kick(bus, dev, vq, free_head);
105 ret = iov_send(socket, iov, 2, 0, sizeof(len) + sizeof(test));
106 g_assert_cmpint(ret, ==, sizeof(test) + sizeof(len));
108 qvirtio_wait_queue_isr(bus, dev, vq, QVIRTIO_NET_TIMEOUT_US);
109 memread(req_addr + VNET_HDR_SIZE, buffer, sizeof(test));
110 g_assert_cmpstr(buffer, ==, "TEST");
112 guest_free(alloc, req_addr);
115 static void tx_test(const QVirtioBus *bus, QVirtioDevice *dev,
116 QGuestAllocator *alloc, QVirtQueue *vq,
117 int socket)
119 uint64_t req_addr;
120 uint32_t free_head;
121 uint32_t len;
122 char buffer[64];
123 int ret;
125 req_addr = guest_alloc(alloc, 64);
126 memwrite(req_addr + VNET_HDR_SIZE, "TEST", 4);
128 free_head = qvirtqueue_add(vq, req_addr, 64, false, false);
129 qvirtqueue_kick(bus, dev, vq, free_head);
131 qvirtio_wait_queue_isr(bus, dev, vq, QVIRTIO_NET_TIMEOUT_US);
132 guest_free(alloc, req_addr);
134 ret = qemu_recv(socket, &len, sizeof(len), 0);
135 g_assert_cmpint(ret, ==, sizeof(len));
136 len = ntohl(len);
138 ret = qemu_recv(socket, buffer, len, 0);
139 g_assert_cmpstr(buffer, ==, "TEST");
142 static void rx_stop_cont_test(const QVirtioBus *bus, QVirtioDevice *dev,
143 QGuestAllocator *alloc, QVirtQueue *vq,
144 int socket)
146 uint64_t req_addr;
147 uint32_t free_head;
148 char test[] = "TEST";
149 char buffer[64];
150 int len = htonl(sizeof(test));
151 struct iovec iov[] = {
153 .iov_base = &len,
154 .iov_len = sizeof(len),
155 }, {
156 .iov_base = test,
157 .iov_len = sizeof(test),
160 int ret;
162 req_addr = guest_alloc(alloc, 64);
164 free_head = qvirtqueue_add(vq, req_addr, 64, true, false);
165 qvirtqueue_kick(bus, dev, vq, free_head);
167 qmp("{ 'execute' : 'stop'}");
169 ret = iov_send(socket, iov, 2, 0, sizeof(len) + sizeof(test));
170 g_assert_cmpint(ret, ==, sizeof(test) + sizeof(len));
172 /* We could check the status, but this command is more importantly to
173 * ensure the packet data gets queued in QEMU, before we do 'cont'.
175 qmp("{ 'execute' : 'query-status'}");
176 qmp("{ 'execute' : 'cont'}");
178 qvirtio_wait_queue_isr(bus, dev, vq, QVIRTIO_NET_TIMEOUT_US);
179 memread(req_addr + VNET_HDR_SIZE, buffer, sizeof(test));
180 g_assert_cmpstr(buffer, ==, "TEST");
182 guest_free(alloc, req_addr);
185 static void send_recv_test(const QVirtioBus *bus, QVirtioDevice *dev,
186 QGuestAllocator *alloc, QVirtQueue *rvq,
187 QVirtQueue *tvq, int socket)
189 rx_test(bus, dev, alloc, rvq, socket);
190 tx_test(bus, dev, alloc, tvq, socket);
193 static void stop_cont_test(const QVirtioBus *bus, QVirtioDevice *dev,
194 QGuestAllocator *alloc, QVirtQueue *rvq,
195 QVirtQueue *tvq, int socket)
197 rx_stop_cont_test(bus, dev, alloc, rvq, socket);
200 static void pci_basic(gconstpointer data)
202 QVirtioPCIDevice *dev;
203 QPCIBus *bus;
204 QVirtQueuePCI *tx, *rx;
205 QGuestAllocator *alloc;
206 void (*func) (const QVirtioBus *bus,
207 QVirtioDevice *dev,
208 QGuestAllocator *alloc,
209 QVirtQueue *rvq,
210 QVirtQueue *tvq,
211 int socket) = data;
212 int sv[2], ret;
214 ret = socketpair(PF_UNIX, SOCK_STREAM, 0, sv);
215 g_assert_cmpint(ret, !=, -1);
217 bus = pci_test_start(sv[1]);
218 dev = virtio_net_pci_init(bus, PCI_SLOT);
220 alloc = pc_alloc_init();
221 rx = (QVirtQueuePCI *)qvirtqueue_setup(&qvirtio_pci, &dev->vdev,
222 alloc, 0);
223 tx = (QVirtQueuePCI *)qvirtqueue_setup(&qvirtio_pci, &dev->vdev,
224 alloc, 1);
226 driver_init(&qvirtio_pci, &dev->vdev);
227 func(&qvirtio_pci, &dev->vdev, alloc, &rx->vq, &tx->vq, sv[0]);
229 /* End test */
230 close(sv[0]);
231 guest_free(alloc, tx->vq.desc);
232 pc_alloc_uninit(alloc);
233 qvirtio_pci_device_disable(dev);
234 g_free(dev);
235 qpci_free_pc(bus);
236 test_end();
238 #endif
240 static void hotplug(void)
242 qtest_start("-device virtio-net-pci");
244 qpci_plug_device_test("virtio-net-pci", "net1", PCI_SLOT_HP, NULL);
245 qpci_unplug_acpi_device_test("net1", PCI_SLOT_HP);
247 test_end();
250 int main(int argc, char **argv)
252 int ret;
254 g_test_init(&argc, &argv, NULL);
255 #ifndef _WIN32
256 qtest_add_data_func("/virtio/net/pci/basic", send_recv_test, pci_basic);
257 qtest_add_data_func("/virtio/net/pci/rx_stop_cont",
258 stop_cont_test, pci_basic);
259 #endif
260 qtest_add_func("/virtio/net/pci/hotplug", hotplug);
262 ret = g_test_run();
264 return ret;