blob: 3ef916f3718f6e3212e95a81dcbc13104177992c [file] [log] [blame]
Keun Soo Yim08400372016-03-03 13:28:51 -08001/*
2 * Copyright (C) 2016 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17#include "specification_parser/SpecificationBuilder.h"
18
19#include <dirent.h>
20
21#include <iostream>
Keun Soo Yim2ee90792016-04-27 14:53:54 -070022#include <queue>
Keun Soo Yim08400372016-03-03 13:28:51 -080023#include <string>
24
25#include "fuzz_tester/FuzzerBase.h"
26#include "fuzz_tester/FuzzerWrapper.h"
27#include "specification_parser/InterfaceSpecificationParser.h"
28
Keun Soo Yimf5185852016-06-01 19:37:10 -070029#include "test/vts/runners/host/proto/InterfaceSpecificationMessage.pb.h"
Keun Soo Yim34067de2016-05-17 09:46:37 -070030#include <google/protobuf/text_format.h>
Keun Soo Yim08400372016-03-03 13:28:51 -080031
32namespace android {
33namespace vts {
34
Keun Soo Yim8103c912016-04-22 20:07:13 -070035SpecificationBuilder::SpecificationBuilder(
Keun Soo Yima4a6d532016-06-08 09:11:40 -070036 const string dir_path, int epoch_count, int agent_port)
Keun Soo Yim8103c912016-04-22 20:07:13 -070037 : dir_path_(dir_path),
Keun Soo Yimfeceb4d2016-05-11 20:01:00 -070038 epoch_count_(epoch_count),
Keun Soo Yim34067de2016-05-17 09:46:37 -070039 if_spec_msg_(NULL),
Keun Soo Yima4a6d532016-06-08 09:11:40 -070040 module_name_(NULL),
41 agent_port_(agent_port) {}
Keun Soo Yim08400372016-03-03 13:28:51 -080042
43
44vts::InterfaceSpecificationMessage*
45SpecificationBuilder::FindInterfaceSpecification(
46 const int target_class,
47 const int target_type,
Keun Soo Yim2ee90792016-04-27 14:53:54 -070048 const float target_version,
49 const string submodule_name) {
Keun Soo Yim08400372016-03-03 13:28:51 -080050 DIR* dir;
51 struct dirent* ent;
52
53 if (!(dir = opendir(dir_path_.c_str()))) {
54 cerr << __FUNCTION__ << ": Can't opendir " << dir_path_ << endl;
55 return NULL;
56 }
57
58 while ((ent = readdir(dir))) {
59 if (string(ent->d_name).find(SPEC_FILE_EXT) != std::string::npos) {
60 cout << __FUNCTION__ << ": Checking a file " << ent->d_name << endl;
61 const string file_path = string(dir_path_) + "/" + string(ent->d_name);
62 vts::InterfaceSpecificationMessage* message =
63 new vts::InterfaceSpecificationMessage();
64 if (InterfaceSpecificationParser::parse(file_path.c_str(), message)) {
Keun Soo Yim2ee90792016-04-27 14:53:54 -070065 if (message->component_type() == target_type
Keun Soo Yim08400372016-03-03 13:28:51 -080066 && message->component_type_version() == target_version) {
Keun Soo Yim2ee90792016-04-27 14:53:54 -070067 if (submodule_name.length() > 0) {
68 if (message->component_class() != HAL_SUBMODULE
69 || message->original_data_structure_name() != submodule_name) {
70 continue;
71 }
72 } else if (message->component_class() != target_class) continue;
Keun Soo Yim08400372016-03-03 13:28:51 -080073 closedir(dir);
74 return message;
75 }
76 }
77 delete message;
78 }
79 }
80 closedir(dir);
81 return NULL;
82}
83
84
Keun Soo Yim52f51662016-05-12 17:23:24 -070085FuzzerBase* SpecificationBuilder::GetFuzzerBase(
86 const vts::InterfaceSpecificationMessage& iface_spec_msg,
87 const char* dll_file_name,
88 const char* target_func_name) {
Keun Soo Yim6d944952016-05-31 16:30:56 -070089 cout << __func__ << ":" << __LINE__ << " " << "entry" << endl;
Keun Soo Yim52f51662016-05-12 17:23:24 -070090 FuzzerBase* fuzzer = wrapper_.GetFuzzer(iface_spec_msg);
91 if (!fuzzer) {
92 cerr << __FUNCTION__ << ": couldn't get a fuzzer base class" << endl;
93 return NULL;
94 }
Keun Soo Yim6d944952016-05-31 16:30:56 -070095
96 // TODO: don't load multiple times. reuse FuzzerBase*.
97 cout << __func__ << ":" << __LINE__ << " " << "got fuzzer" << endl;
98 if (!fuzzer->LoadTargetComponent(dll_file_name)) {
Keun Soo Yim34067de2016-05-17 09:46:37 -070099 cerr << __FUNCTION__ << ": couldn't load target component file, "
100 << dll_file_name << endl;
Keun Soo Yim072337b2016-05-13 15:58:26 -0700101 return NULL;
102 }
Keun Soo Yim6d944952016-05-31 16:30:56 -0700103 cout << __func__ << ":" << __LINE__ << " " << "loaded target comp" << endl;
104
Keun Soo Yim91d634a2016-06-02 11:38:00 -0700105 return fuzzer;
106 /*
107 * TODO: now always return the fuzzer. this change is due to the difficulty
108 * in checking nested apis although that's possible. need to check whether
109 * Fuzz() found the function, while still distinguishing the difference
110 * between that and defined but non-set api.
Keun Soo Yim6d944952016-05-31 16:30:56 -0700111 if (!strcmp(target_func_name, "#Open")) return fuzzer;
Keun Soo Yim52f51662016-05-12 17:23:24 -0700112
113 for (const vts::FunctionSpecificationMessage& func_msg : iface_spec_msg.api()) {
Keun Soo Yim072337b2016-05-13 15:58:26 -0700114 cout << "checking " << func_msg.name() << endl;
Keun Soo Yim52f51662016-05-12 17:23:24 -0700115 if (!strcmp(target_func_name, func_msg.name().c_str())) {
116 return fuzzer;
117 }
118 }
119 return NULL;
Keun Soo Yim91d634a2016-06-02 11:38:00 -0700120 */
Keun Soo Yim52f51662016-05-12 17:23:24 -0700121}
122
123
Keun Soo Yim2ee90792016-04-27 14:53:54 -0700124FuzzerBase* SpecificationBuilder::GetFuzzerBaseAndAddAllFunctionsToQueue(
125 const vts::InterfaceSpecificationMessage& iface_spec_msg,
126 const char* dll_file_name) {
127 FuzzerBase* fuzzer = wrapper_.GetFuzzer(iface_spec_msg);
128 if (!fuzzer) {
129 cerr << __FUNCTION__ << ": couldn't get a fuzzer base class" << endl;
130 return NULL;
131 }
132 if (!fuzzer->LoadTargetComponent(dll_file_name)) return NULL;
133
134 for (const vts::FunctionSpecificationMessage& func_msg : iface_spec_msg.api()) {
135 cout << "Add a job " << func_msg.name() << endl;
136 FunctionSpecificationMessage* func_msg_copy = func_msg.New();
137 func_msg_copy->CopyFrom(func_msg);
138 job_queue_.push(make_pair(func_msg_copy, fuzzer));
139 }
140 return fuzzer;
141}
142
143
Keun Soo Yimfeceb4d2016-05-11 20:01:00 -0700144bool SpecificationBuilder::LoadTargetComponent(
145 const char* dll_file_name,
146 const char* spec_lib_file_path,
147 int target_class,
148 int target_type,
Keun Soo Yim34067de2016-05-17 09:46:37 -0700149 float target_version,
150 const char* module_name) {
Keun Soo Yimfeceb4d2016-05-11 20:01:00 -0700151 if_spec_msg_ = FindInterfaceSpecification(
152 target_class, target_type, target_version);
153 if (!if_spec_msg_) {
154 cerr << __FUNCTION__ <<
155 ": no interface specification file found for "
156 << "class " << target_class
157 << " type " << target_type
158 << " version " << target_version << endl;
159 return false;
160 }
Keun Soo Yim52f51662016-05-12 17:23:24 -0700161 spec_lib_file_path_ = (char*) malloc(strlen(spec_lib_file_path) + 1);
162 strcpy(spec_lib_file_path_, spec_lib_file_path);
163
164 dll_file_name_ = (char*) malloc(strlen(dll_file_name) + 1);
165 strcpy(dll_file_name_, dll_file_name);
166
Keun Soo Yim8e07a092016-05-04 16:30:35 -0700167 // cout << "ifspec addr load at " << if_spec_msg_ << endl;
Keun Soo Yimfeceb4d2016-05-11 20:01:00 -0700168 string output;
169 if_spec_msg_->SerializeToString(&output);
Keun Soo Yim8e07a092016-05-04 16:30:35 -0700170 cout << "loaded ifspec length " << output.length() << endl;
171 // cout << "loaded text " << strlen(output.c_str()) << endl;
172 // cout << "loaded text " << output << endl;
Keun Soo Yim34067de2016-05-17 09:46:37 -0700173
174 module_name_ = (char*) malloc(strlen(module_name) + 1);
175 strcpy(module_name_, module_name);
Keun Soo Yim8e07a092016-05-04 16:30:35 -0700176 cout << __FUNCTION__ << ":" << __LINE__ << " module_name " << module_name_
177 << endl;
Keun Soo Yimfeceb4d2016-05-11 20:01:00 -0700178 return true;
179}
180
181
Keun Soo Yim34067de2016-05-17 09:46:37 -0700182const string empty_string = string();
183
Keun Soo Yim04431a92016-05-24 16:26:42 -0700184const string& SpecificationBuilder::CallFunction(
185 FunctionSpecificationMessage* func_msg) {
Keun Soo Yim52f51662016-05-12 17:23:24 -0700186 if (!wrapper_.LoadInterfaceSpecificationLibrary(spec_lib_file_path_)) {
Keun Soo Yim34067de2016-05-17 09:46:37 -0700187 return empty_string;
Keun Soo Yim52f51662016-05-12 17:23:24 -0700188 }
Keun Soo Yim7ad64922016-06-07 18:14:40 -0700189 cout << __func__ << " " << "loaded if_spec lib" << endl;
190 cout << __func__ << " " << dll_file_name_ << " " << func_msg->name() << endl;
Keun Soo Yim52f51662016-05-12 17:23:24 -0700191
192 FuzzerBase* func_fuzzer = GetFuzzerBase(
193 *if_spec_msg_, dll_file_name_, func_msg->name().c_str());
Keun Soo Yim6d944952016-05-31 16:30:56 -0700194 cout << __func__ << ":" << __LINE__ << endl;
Keun Soo Yim52f51662016-05-12 17:23:24 -0700195 if (!func_fuzzer) {
Keun Soo Yim072337b2016-05-13 15:58:26 -0700196 cerr << "can't find FuzzerBase for " << func_msg->name() << " using "
197 << dll_file_name_ << endl;
Keun Soo Yim34067de2016-05-17 09:46:37 -0700198 return empty_string;
Keun Soo Yim52f51662016-05-12 17:23:24 -0700199 }
200
Keun Soo Yim6d944952016-05-31 16:30:56 -0700201 if (func_msg->name() == "#Open") {
202 cout << __func__ << ":" << __LINE__ << endl;
203 if (func_msg->arg().size() > 0) {
204 cout << __func__ << " " << func_msg->arg(0).primitive_value(0).bytes().c_str() << endl;
205 func_fuzzer->OpenConventionalHal(
206 func_msg->arg(0).primitive_value(0).bytes().c_str());
207 } else {
208 cout << __func__ << " no arg" << endl;
209 func_fuzzer->OpenConventionalHal();
210 }
211 cout << __func__ << " opened" << endl;
212 // return the return value from open;
213 if (func_msg->return_type().primitive_type().size() > 0) {
Keun Soo Yim91d634a2016-06-02 11:38:00 -0700214 cout << __func__ << " return_type exists" << endl;
Keun Soo Yim6d944952016-05-31 16:30:56 -0700215 // TODO handle when the size > 1.
216 if (!strcmp(func_msg->return_type().primitive_type(0).c_str(), "int32_t")) {
Keun Soo Yim91d634a2016-06-02 11:38:00 -0700217 cout << __func__ << " return_type is int32_t" << endl;
Keun Soo Yim6d944952016-05-31 16:30:56 -0700218 func_msg->mutable_return_type()->mutable_primitive_value()->Add()->set_int32_t(0);
219 cout << "result " << endl;
220 // todo handle more types;
221 string* output = new string();
222 google::protobuf::TextFormat::PrintToString(*func_msg, output);
223 return *output;
224 }
225 }
Keun Soo Yim91d634a2016-06-02 11:38:00 -0700226 cerr << __func__ << " return_type unknown" << endl;
227 string* output = new string();
228 google::protobuf::TextFormat::PrintToString(*func_msg, output);
229 return *output;
Keun Soo Yim6d944952016-05-31 16:30:56 -0700230 }
231 cout << __func__ << ":" << __LINE__ << endl;
232
Keun Soo Yim52f51662016-05-12 17:23:24 -0700233 void* result;
Keun Soo Yim04431a92016-05-24 16:26:42 -0700234 func_fuzzer->FunctionCallBegin();
Keun Soo Yim6d944952016-05-31 16:30:56 -0700235 cout << __func__ << " Call Function " << func_msg->name() << endl;
Keun Soo Yima4a6d532016-06-08 09:11:40 -0700236 if (!func_fuzzer->Fuzz(func_msg, &result, agent_port_)) {
Keun Soo Yim6d944952016-05-31 16:30:56 -0700237 cout << __func__ << " function not found - todo handle more explicitly" << endl;
238 return *(new string("error"));
239 }
240 cout << __func__ << ": called" << endl;
Keun Soo Yim04431a92016-05-24 16:26:42 -0700241
242 // set coverage data.
243 vector<unsigned>* coverage = func_fuzzer->FunctionCallEnd();
244 if (coverage && coverage->size() > 0) {
245 for (unsigned int index = 0; index < coverage->size(); index++) {
246 func_msg->mutable_coverage_data()->Add(coverage->at(index));
247 }
248 }
249
Keun Soo Yima8cf69a2016-05-18 18:11:37 -0700250 if (func_msg->return_type().aggregate_type().size() > 0) {
251 // TODO: actually handle this case.
Keun Soo Yim52f51662016-05-12 17:23:24 -0700252 if (result != NULL) {
253 // loads that interface spec and enqueues all functions.
Keun Soo Yim6d944952016-05-31 16:30:56 -0700254 cout << __func__ << " return type: "
Keun Soo Yima8cf69a2016-05-18 18:11:37 -0700255 << func_msg->return_type().aggregate_type(0) << endl;
Keun Soo Yim52f51662016-05-12 17:23:24 -0700256 } else {
Keun Soo Yim6d944952016-05-31 16:30:56 -0700257 cout << __func__ << " return value = NULL" << endl;
Keun Soo Yim52f51662016-05-12 17:23:24 -0700258 }
Keun Soo Yim6d944952016-05-31 16:30:56 -0700259 cerr << __func__ << " todo: support aggregate" << endl;
Keun Soo Yim04431a92016-05-24 16:26:42 -0700260 string* output = new string();
261 google::protobuf::TextFormat::PrintToString(*func_msg, output);
262 return *output;
Keun Soo Yima8cf69a2016-05-18 18:11:37 -0700263 } else if (func_msg->return_type().primitive_type().size() > 0) {
264 // TODO handle when the size > 1.
265 if (!strcmp(func_msg->return_type().primitive_type(0).c_str(), "int32_t")) {
266 func_msg->mutable_return_type()->mutable_primitive_value()->Add()->set_int32_t(
Keun Soo Yim34067de2016-05-17 09:46:37 -0700267 *((int*)(&result)));
268 cout << "result " << endl;
269 // todo handle more types;
270 string* output = new string();
Keun Soo Yim04431a92016-05-24 16:26:42 -0700271 google::protobuf::TextFormat::PrintToString(*func_msg, output);
Keun Soo Yim34067de2016-05-17 09:46:37 -0700272 return *output;
273 }
Keun Soo Yim52f51662016-05-12 17:23:24 -0700274 }
Keun Soo Yim34067de2016-05-17 09:46:37 -0700275 return *(new string("void"));
Keun Soo Yim52f51662016-05-12 17:23:24 -0700276}
277
278
Keun Soo Yim08400372016-03-03 13:28:51 -0800279bool SpecificationBuilder::Process(
280 const char* dll_file_name,
281 const char* spec_lib_file_path,
282 int target_class,
283 int target_type,
284 float target_version) {
285 vts::InterfaceSpecificationMessage* interface_specification_message =
286 FindInterfaceSpecification(target_class, target_type, target_version);
Keun Soo Yimfeceb4d2016-05-11 20:01:00 -0700287 cout << "ifspec addr " << interface_specification_message << endl;
288
Keun Soo Yim08400372016-03-03 13:28:51 -0800289 if (!interface_specification_message) {
290 cerr << __FUNCTION__ <<
291 ": no interface specification file found for "
292 << "class " << target_class
293 << " type " << target_type
294 << " version " << target_version << endl;
295 return false;
296 }
Keun Soo Yim08400372016-03-03 13:28:51 -0800297
Keun Soo Yim2ee90792016-04-27 14:53:54 -0700298 if (!wrapper_.LoadInterfaceSpecificationLibrary(spec_lib_file_path)) {
Keun Soo Yim08400372016-03-03 13:28:51 -0800299 return false;
300 }
Keun Soo Yim2ee90792016-04-27 14:53:54 -0700301
302 if (!GetFuzzerBaseAndAddAllFunctionsToQueue(
303 *interface_specification_message, dll_file_name)) return false;
304
Keun Soo Yim8103c912016-04-22 20:07:13 -0700305 for (int i = 0; i < epoch_count_; i++) {
Keun Soo Yim2ee90792016-04-27 14:53:54 -0700306 // by default, breath-first-searching is used.
307 if (job_queue_.empty()) {
308 cout << "no more job to process; stopping after epoch " << i << endl;
309 break;
310 }
311
312 pair<vts::FunctionSpecificationMessage*, FuzzerBase*> curr_job =
313 job_queue_.front();
314 job_queue_.pop();
315
316 vts::FunctionSpecificationMessage* func_msg = curr_job.first;
317 FuzzerBase* func_fuzzer = curr_job.second;
318
Keun Soo Yimc5d092a2016-04-28 16:51:56 +0000319 void* result;
Keun Soo Yim2ee90792016-04-27 14:53:54 -0700320 cout << "Iteration " << (i + 1) << " Function " << func_msg->name() << endl;
Keun Soo Yima4a6d532016-06-08 09:11:40 -0700321 func_fuzzer->Fuzz(func_msg, &result, agent_port_);
Keun Soo Yima8cf69a2016-05-18 18:11:37 -0700322 if (func_msg->return_type().aggregate_type().size() > 0) {
Keun Soo Yim2ee90792016-04-27 14:53:54 -0700323 if (result != NULL) {
324 // loads that interface spec and enqueues all functions.
325 cout << __FUNCTION__ << " return type: "
Keun Soo Yima8cf69a2016-05-18 18:11:37 -0700326 << func_msg->return_type().aggregate_type(0) << endl;
327 // TODO: handle the case when size > 1
328 string submodule_name = func_msg->return_type().aggregate_type(0);
Keun Soo Yim2ee90792016-04-27 14:53:54 -0700329 while (!submodule_name.empty()
330 && (std::isspace(submodule_name.back())
Keun Soo Yima8cf69a2016-05-18 18:11:37 -0700331 || submodule_name.back() == '*')) {
Keun Soo Yim2ee90792016-04-27 14:53:54 -0700332 submodule_name.pop_back();
333 }
334 vts::InterfaceSpecificationMessage* iface_spec_msg =
335 FindInterfaceSpecification(
336 target_class, target_type, target_version, submodule_name);
337 if (iface_spec_msg) {
338 cout << __FUNCTION__ << " submodule found - " << submodule_name << endl;
339 if (!GetFuzzerBaseAndAddAllFunctionsToQueue(
340 *iface_spec_msg, dll_file_name)) {
341 return false;
342 }
343 } else {
344 cout << __FUNCTION__ << " submodule not found - " << submodule_name << endl;
345 }
346 } else {
347 cout << __FUNCTION__ << " return value = NULL" << endl;
348 }
349 }
Keun Soo Yim08400372016-03-03 13:28:51 -0800350 }
Keun Soo Yim2ee90792016-04-27 14:53:54 -0700351
Keun Soo Yim08400372016-03-03 13:28:51 -0800352 return true;
353}
354
Keun Soo Yimfeceb4d2016-05-11 20:01:00 -0700355
356vts::InterfaceSpecificationMessage*
357SpecificationBuilder::GetInterfaceSpecification() const {
358 cout << "ifspec addr get " << if_spec_msg_ << endl;
359 return if_spec_msg_;
360}
361
Keun Soo Yim08400372016-03-03 13:28:51 -0800362} // namespace vts
363} // namespace android