1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
|
// SPDX-License-Identifier: GPL-2.0+
/*
* Copyright (c) 2022 Google, Inc.
* Written by Andrew Scull <[email protected]>
*/
#include <dm.h>
#include <virtio_types.h>
#include <virtio.h>
#include <virtio_ring.h>
#include <dm/device-internal.h>
#include <dm/test.h>
#include <rng.h>
#include <test/test.h>
#include <test/ut.h>
/* This is a brittle means of getting access to the virtqueue */
struct virtio_rng_priv {
struct virtqueue *rng_vq;
};
#define BUFFER_SIZE 16
#define CANARY "CANARYCANARYCANARYCANARY"
/* Test the virtio-rng driver validates the used size */
static int dm_test_virtio_rng_check_len(struct unit_test_state *uts)
{
struct udevice *bus, *dev;
struct virtio_rng_priv *priv;
u8 buffer[BUFFER_SIZE + sizeof(CANARY)];
/* write known data to buffer */
memset(buffer, 0xaa, BUFFER_SIZE);
memcpy(buffer + BUFFER_SIZE, CANARY, sizeof(CANARY));
/* check probe success */
ut_assertok(uclass_first_device_err(UCLASS_VIRTIO, &bus));
ut_assertnonnull(bus);
/* check the child virtio-rng device is bound */
ut_assertok(device_find_first_child(bus, &dev));
ut_assertnonnull(dev);
/* probe the virtio-rng driver */
ut_assertok(device_probe(dev));
/* simulate the device returning the buffer with too much data */
priv = dev_get_priv(dev);
priv->rng_vq->vring.used->idx = 1;
priv->rng_vq->vring.used->ring[0].id = 0;
priv->rng_vq->vring.used->ring[0].len = U32_MAX;
/* check the driver gracefully handles the error */
dm_rng_read(dev, buffer, BUFFER_SIZE);
/* check for the canary bytes behind the real buffer */
ut_asserteq_mem(buffer + BUFFER_SIZE, CANARY, sizeof(CANARY));
return 0;
}
DM_TEST(dm_test_virtio_rng_check_len, UTF_SCAN_PDATA | UTF_SCAN_FDT);
|
