* [Qemu-devel] [PATCH] qtest: add a fuzz test to fdc-test
@ 2012-05-19 12:54 Blue Swirl
2012-05-21 7:51 ` Kevin Wolf
0 siblings, 1 reply; 8+ messages in thread
From: Blue Swirl @ 2012-05-19 12:54 UTC (permalink / raw)
To: Kevin Wolf, Paolo Bonzini, qemu-devel
[-- Attachment #1: Type: text/plain, Size: 2390 bytes --]
Add a simple register fuzzing test to floppy controller tests.
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
---
There's a lot of output like:
GTESTER check-qtest-i386
FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
FLOPPY ERROR: fdctrl_unimplemented: unimplemented command 0x1f
FLOPPY ERROR: fdctrl_unimplemented: unimplemented command 0xa8
FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
FLOPPY ERROR: fdctrl_unimplemented: unimplemented command 0x37
FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
FLOPPY ERROR: fdctrl_unimplemented: unimplemented command 0x93
FLOPPY ERROR: fdctrl_unimplemented: unimplemented command 0xe4
FLOPPY ERROR: fdctrl_unimplemented: unimplemented command 0xc1
FLOPPY ERROR: fdctrl_unimplemented: unimplemented command 0x92
Maybe they should be fixed first.
---
tests/fdc-test.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
diff --git a/tests/fdc-test.c b/tests/fdc-test.c
index 5b5dd74..5a22a31 100644
--- a/tests/fdc-test.c
+++ b/tests/fdc-test.c
@@ -154,6 +154,22 @@ static void test_media_change(void)
assert_bit_clear(dir, DSKCHG);
}
+/* success if no crash or abort */
+static void fuzz_registers(void)
+{
+ unsigned int i;
+
+ for (i = 0; i < 1000; i++) {
+ uint8_t reg, val;
+
+ reg = (uint8_t)g_test_rand_int_range(0, 8);
+ val = (uint8_t)g_test_rand_int_range(0, 256);
+
+ outb(FLOPPY_BASE + reg, val);
+ inb(FLOPPY_BASE + reg);
+ }
+}
+
int main(int argc, char **argv)
{
const char *arch = qtest_get_arch();
@@ -184,6 +200,7 @@ int main(int argc, char **argv)
qtest_start(cmdline);
qtest_irq_intercept_in(global_qtest, "ioapic");
qtest_add_func("/fdc/media_change", test_media_change);
+ qtest_add_func("/fdc/fuzz-registers", fuzz_registers);
ret = g_test_run();
--
1.7.10
[-- Attachment #2: 0001-qtest-add-a-fuzz-test-to-fdc-test.patch --]
[-- Type: text/x-patch, Size: 1454 bytes --]
From 1ccf05afa5560127b9ccf88348bddf4a2765fe95 Mon Sep 17 00:00:00 2001
Message-Id: <1ccf05afa5560127b9ccf88348bddf4a2765fe95.1337431940.git.blauwirbel@gmail.com>
From: Blue Swirl <blauwirbel@gmail.com>
Date: Thu, 17 May 2012 18:55:58 +0000
Subject: [PATCH] qtest: add a fuzz test to fdc-test
Add a simple register fuzzing test to floppy controller tests.
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
---
tests/fdc-test.c | 17 +++++++++++++++++
1 files changed, 17 insertions(+), 0 deletions(-)
diff --git a/tests/fdc-test.c b/tests/fdc-test.c
index 5b5dd74..5a22a31 100644
--- a/tests/fdc-test.c
+++ b/tests/fdc-test.c
@@ -154,6 +154,22 @@ static void test_media_change(void)
assert_bit_clear(dir, DSKCHG);
}
+/* success if no crash or abort */
+static void fuzz_registers(void)
+{
+ unsigned int i;
+
+ for (i = 0; i < 1000; i++) {
+ uint8_t reg, val;
+
+ reg = (uint8_t)g_test_rand_int_range(0, 8);
+ val = (uint8_t)g_test_rand_int_range(0, 256);
+
+ outb(FLOPPY_BASE + reg, val);
+ inb(FLOPPY_BASE + reg);
+ }
+}
+
int main(int argc, char **argv)
{
const char *arch = qtest_get_arch();
@@ -184,6 +200,7 @@ int main(int argc, char **argv)
qtest_start(cmdline);
qtest_irq_intercept_in(global_qtest, "ioapic");
qtest_add_func("/fdc/media_change", test_media_change);
+ qtest_add_func("/fdc/fuzz-registers", fuzz_registers);
ret = g_test_run();
--
1.7.2.5
^ permalink raw reply related [flat|nested] 8+ messages in thread
* Re: [Qemu-devel] [PATCH] qtest: add a fuzz test to fdc-test
2012-05-19 12:54 [Qemu-devel] [PATCH] qtest: add a fuzz test to fdc-test Blue Swirl
@ 2012-05-21 7:51 ` Kevin Wolf
2012-05-21 8:11 ` Paolo Bonzini
0 siblings, 1 reply; 8+ messages in thread
From: Kevin Wolf @ 2012-05-21 7:51 UTC (permalink / raw)
To: Blue Swirl; +Cc: Paolo Bonzini, qemu-devel
Am 19.05.2012 14:54, schrieb Blue Swirl:
> Add a simple register fuzzing test to floppy controller tests.
>
> Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
> ---
> There's a lot of output like:
> GTESTER check-qtest-i386
> FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
> FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
> FLOPPY ERROR: fdctrl_unimplemented: unimplemented command 0x1f
> FLOPPY ERROR: fdctrl_unimplemented: unimplemented command 0xa8
> FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
> FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
> FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
> FLOPPY ERROR: fdctrl_unimplemented: unimplemented command 0x37
> FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
> FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
> FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
> FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
> FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
> FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
> FLOPPY ERROR: fdctrl_unimplemented: unimplemented command 0x93
> FLOPPY ERROR: fdctrl_unimplemented: unimplemented command 0xe4
> FLOPPY ERROR: fdctrl_unimplemented: unimplemented command 0xc1
> FLOPPY ERROR: fdctrl_unimplemented: unimplemented command 0x92
>
> Maybe they should be fixed first.
What do you mean by fixing? Turning them into DPRINTFs?
Kevin
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [Qemu-devel] [PATCH] qtest: add a fuzz test to fdc-test
2012-05-21 7:51 ` Kevin Wolf
@ 2012-05-21 8:11 ` Paolo Bonzini
2012-05-21 8:14 ` Kevin Wolf
0 siblings, 1 reply; 8+ messages in thread
From: Paolo Bonzini @ 2012-05-21 8:11 UTC (permalink / raw)
To: Kevin Wolf; +Cc: Blue Swirl, qemu-devel
Il 21/05/2012 09:51, Kevin Wolf ha scritto:
>> > GTESTER check-qtest-i386
>> > FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
>> > FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
>> > FLOPPY ERROR: fdctrl_unimplemented: unimplemented command 0x1f
>> > FLOPPY ERROR: fdctrl_unimplemented: unimplemented command 0xa8
>> > FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
>> > FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
>> > FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
>> > FLOPPY ERROR: fdctrl_unimplemented: unimplemented command 0x37
>> > FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
>> > FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
>> > FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
>> > FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
>> > FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
>> > FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
>> > FLOPPY ERROR: fdctrl_unimplemented: unimplemented command 0x93
>> > FLOPPY ERROR: fdctrl_unimplemented: unimplemented command 0xe4
>> > FLOPPY ERROR: fdctrl_unimplemented: unimplemented command 0xc1
>> > FLOPPY ERROR: fdctrl_unimplemented: unimplemented command 0x92
>> >
>> > Maybe they should be fixed first.
> What do you mean by fixing? Turning them into DPRINTFs?
Or trace events?
Paolo
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [Qemu-devel] [PATCH] qtest: add a fuzz test to fdc-test
2012-05-21 8:11 ` Paolo Bonzini
@ 2012-05-21 8:14 ` Kevin Wolf
2012-05-21 8:18 ` Paolo Bonzini
2012-05-21 17:30 ` Blue Swirl
0 siblings, 2 replies; 8+ messages in thread
From: Kevin Wolf @ 2012-05-21 8:14 UTC (permalink / raw)
To: Paolo Bonzini; +Cc: Blue Swirl, qemu-devel
Am 21.05.2012 10:11, schrieb Paolo Bonzini:
> Il 21/05/2012 09:51, Kevin Wolf ha scritto:
>>>> GTESTER check-qtest-i386
>>>> FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
>>>> FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
>>>> FLOPPY ERROR: fdctrl_unimplemented: unimplemented command 0x1f
>>>> FLOPPY ERROR: fdctrl_unimplemented: unimplemented command 0xa8
>>>> FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
>>>> FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
>>>> FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
>>>> FLOPPY ERROR: fdctrl_unimplemented: unimplemented command 0x37
>>>> FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
>>>> FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
>>>> FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
>>>> FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
>>>> FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
>>>> FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
>>>> FLOPPY ERROR: fdctrl_unimplemented: unimplemented command 0x93
>>>> FLOPPY ERROR: fdctrl_unimplemented: unimplemented command 0xe4
>>>> FLOPPY ERROR: fdctrl_unimplemented: unimplemented command 0xc1
>>>> FLOPPY ERROR: fdctrl_unimplemented: unimplemented command 0x92
>>>>
>>>> Maybe they should be fixed first.
>> What do you mean by fixing? Turning them into DPRINTFs?
>
> Or trace events?
Yeah, you could turn all FLOPPY_DPRINTFs into trace events. But the
point here is that today it's a FLOPPY_ERROR, and except for register
fuzzing they report real problems with the emulation and not just some
debugging information. So I'm not sure if hiding them is really a fix.
Kevin
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [Qemu-devel] [PATCH] qtest: add a fuzz test to fdc-test
2012-05-21 8:14 ` Kevin Wolf
@ 2012-05-21 8:18 ` Paolo Bonzini
2012-05-21 17:33 ` Blue Swirl
2012-05-21 17:30 ` Blue Swirl
1 sibling, 1 reply; 8+ messages in thread
From: Paolo Bonzini @ 2012-05-21 8:18 UTC (permalink / raw)
To: Kevin Wolf; +Cc: Blue Swirl, qemu-devel
> >> What do you mean by fixing? Turning them into DPRINTFs?
> >
> > Or trace events?
>
> Yeah, you could turn all FLOPPY_DPRINTFs into trace events. But the
> point here is that today it's a FLOPPY_ERROR, and except for register
> fuzzing they report real problems with the emulation and not just
> some debugging information. So I'm not sure if hiding them is really a
> fix.
It depends, "controller not ready for reading" is most likely just caused by
fuzzing. Most unimplemented commands are also invalid on real hardware too.
Paolo
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [Qemu-devel] [PATCH] qtest: add a fuzz test to fdc-test
2012-05-21 8:14 ` Kevin Wolf
2012-05-21 8:18 ` Paolo Bonzini
@ 2012-05-21 17:30 ` Blue Swirl
2012-05-21 17:47 ` Peter Maydell
1 sibling, 1 reply; 8+ messages in thread
From: Blue Swirl @ 2012-05-21 17:30 UTC (permalink / raw)
To: Kevin Wolf; +Cc: Paolo Bonzini, qemu-devel
On Mon, May 21, 2012 at 8:14 AM, Kevin Wolf <kwolf@redhat.com> wrote:
> Am 21.05.2012 10:11, schrieb Paolo Bonzini:
>> Il 21/05/2012 09:51, Kevin Wolf ha scritto:
>>>>> GTESTER check-qtest-i386
>>>>> FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
>>>>> FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
>>>>> FLOPPY ERROR: fdctrl_unimplemented: unimplemented command 0x1f
>>>>> FLOPPY ERROR: fdctrl_unimplemented: unimplemented command 0xa8
>>>>> FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
>>>>> FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
>>>>> FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
>>>>> FLOPPY ERROR: fdctrl_unimplemented: unimplemented command 0x37
>>>>> FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
>>>>> FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
>>>>> FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
>>>>> FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
>>>>> FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
>>>>> FLOPPY ERROR: fdctrl_read_data: controller not ready for reading
>>>>> FLOPPY ERROR: fdctrl_unimplemented: unimplemented command 0x93
>>>>> FLOPPY ERROR: fdctrl_unimplemented: unimplemented command 0xe4
>>>>> FLOPPY ERROR: fdctrl_unimplemented: unimplemented command 0xc1
>>>>> FLOPPY ERROR: fdctrl_unimplemented: unimplemented command 0x92
>>>>>
>>>>> Maybe they should be fixed first.
>>> What do you mean by fixing? Turning them into DPRINTFs?
>>
>> Or trace events?
>
> Yeah, you could turn all FLOPPY_DPRINTFs into trace events. But the
> point here is that today it's a FLOPPY_ERROR, and except for register
> fuzzing they report real problems with the emulation and not just some
> debugging information. So I'm not sure if hiding them is really a fix.
While not a DoS, letting the guest spam the console at will is not
nice either. Maybe we need a new method to enable a selected set of
printouts, something like '-d unimplemented'. That way no recompiling
would be needed.
>
> Kevin
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [Qemu-devel] [PATCH] qtest: add a fuzz test to fdc-test
2012-05-21 8:18 ` Paolo Bonzini
@ 2012-05-21 17:33 ` Blue Swirl
0 siblings, 0 replies; 8+ messages in thread
From: Blue Swirl @ 2012-05-21 17:33 UTC (permalink / raw)
To: Paolo Bonzini; +Cc: Kevin Wolf, qemu-devel
On Mon, May 21, 2012 at 8:18 AM, Paolo Bonzini <pbonzini@redhat.com> wrote:
>> >> What do you mean by fixing? Turning them into DPRINTFs?
>> >
>> > Or trace events?
>>
>> Yeah, you could turn all FLOPPY_DPRINTFs into trace events. But the
>> point here is that today it's a FLOPPY_ERROR, and except for register
>> fuzzing they report real problems with the emulation and not just
>> some debugging information. So I'm not sure if hiding them is really a
>> fix.
>
> It depends, "controller not ready for reading" is most likely just caused by
> fuzzing. Most unimplemented commands are also invalid on real hardware too.
Yes, but a malevolent guest could issue the same commands if those
could cause problems to QEMU.
>
> Paolo
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [Qemu-devel] [PATCH] qtest: add a fuzz test to fdc-test
2012-05-21 17:30 ` Blue Swirl
@ 2012-05-21 17:47 ` Peter Maydell
0 siblings, 0 replies; 8+ messages in thread
From: Peter Maydell @ 2012-05-21 17:47 UTC (permalink / raw)
To: Blue Swirl; +Cc: Kevin Wolf, Paolo Bonzini, qemu-devel
On 21 May 2012 18:30, Blue Swirl <blauwirbel@gmail.com> wrote:
> On Mon, May 21, 2012 at 8:14 AM, Kevin Wolf <kwolf@redhat.com> wrote:
>> Yeah, you could turn all FLOPPY_DPRINTFs into trace events. But the
>> point here is that today it's a FLOPPY_ERROR, and except for register
>> fuzzing they report real problems with the emulation and not just some
>> debugging information. So I'm not sure if hiding them is really a fix.
>
> While not a DoS, letting the guest spam the console at will is not
> nice either. Maybe we need a new method to enable a selected set of
> printouts, something like '-d unimplemented'. That way no recompiling
> would be needed.
+1 for a better set of graduated logging/debug levels and a sensible
command line interface for turning them on and off. Possible severity
levels:
* debug output
* guest has done something that suggests it might be buggy, eg
accessing nonexistent register
* guest has tried to use something qemu doesn't implement
* qemu (fatal) error
These should be orthogonal to the "what area should we print logging
for" question, I think.
With a clean API for defining log messages I think we could clean
up a lot of the legacy functions for asserting/aborting in various
ways (in particular a lot of the hw_error() uses).
-- PMM
^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2012-05-21 17:47 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2012-05-19 12:54 [Qemu-devel] [PATCH] qtest: add a fuzz test to fdc-test Blue Swirl
2012-05-21 7:51 ` Kevin Wolf
2012-05-21 8:11 ` Paolo Bonzini
2012-05-21 8:14 ` Kevin Wolf
2012-05-21 8:18 ` Paolo Bonzini
2012-05-21 17:33 ` Blue Swirl
2012-05-21 17:30 ` Blue Swirl
2012-05-21 17:47 ` Peter Maydell
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.