| 1 | /* |
| 2 | * I440FX Fuzzing Target |
| 3 | * |
| 4 | * Copyright Red Hat Inc., 2019 |
| 5 | * |
| 6 | * Authors: |
| 7 | * Alexander Bulekov <alxndr@bu.edu> |
| 8 | * |
| 9 | * This work is licensed under the terms of the GNU GPL, version 2 or later. |
| 10 | * See the COPYING file in the top-level directory. |
| 11 | */ |
| 12 | |
| 13 | #include "qemu/osdep.h" |
| 14 | |
| 15 | #include "qemu/main-loop.h" |
| 16 | #include "tests/qtest/libqtest.h" |
| 17 | #include "tests/qtest/libqos/pci.h" |
| 18 | #include "tests/qtest/libqos/pci-pc.h" |
| 19 | #include "fuzz.h" |
| 20 | #include "qos_fuzz.h" |
| 21 | |
| 22 | |
| 23 | #define I440FX_PCI_HOST_BRIDGE_CFG 0xcf8 |
| 24 | #define I440FX_PCI_HOST_BRIDGE_DATA 0xcfc |
| 25 | |
| 26 | /* |
| 27 | * the input to the fuzzing functions below is a buffer of random bytes. we |
| 28 | * want to convert these bytes into a sequence of qtest or qos calls. to do |
| 29 | * this we define some opcodes: |
| 30 | */ |
| 31 | enum action_id { |
| 32 | WRITEB, |
| 33 | WRITEW, |
| 34 | WRITEL, |
| 35 | READB, |
| 36 | READW, |
| 37 | READL, |
| 38 | ACTION_MAX |
| 39 | }; |
| 40 | |
| 41 | static void ioport_fuzz_qtest(QTestState *s, |
| 42 | const unsigned char *Data, size_t Size) { |
| 43 | /* |
| 44 | * loop over the Data, breaking it up into actions. each action has an |
| 45 | * opcode, address offset and value |
| 46 | */ |
| 47 | struct { |
| 48 | uint8_t opcode; |
| 49 | uint8_t addr; |
| 50 | uint32_t value; |
| 51 | } a; |
| 52 | |
| 53 | while (Size >= sizeof(a)) { |
| 54 | /* make a copy of the action so we can normalize the values in-place */ |
| 55 | memcpy(&a, Data, sizeof(a)); |
| 56 | /* select between two i440fx Port IO addresses */ |
| 57 | uint16_t addr = a.addr % 2 ? I440FX_PCI_HOST_BRIDGE_CFG : |
| 58 | I440FX_PCI_HOST_BRIDGE_DATA; |
| 59 | switch (a.opcode % ACTION_MAX) { |
| 60 | case WRITEB: |
| 61 | qtest_outb(s, addr, (uint8_t)a.value); |
| 62 | break; |
| 63 | case WRITEW: |
| 64 | qtest_outw(s, addr, (uint16_t)a.value); |
| 65 | break; |
| 66 | case WRITEL: |
| 67 | qtest_outl(s, addr, (uint32_t)a.value); |
| 68 | break; |
| 69 | case READB: |
| 70 | qtest_inb(s, addr); |
| 71 | break; |
| 72 | case READW: |
| 73 | qtest_inw(s, addr); |
| 74 | break; |
| 75 | case READL: |
| 76 | qtest_inl(s, addr); |
| 77 | break; |
| 78 | } |
| 79 | /* Move to the next operation */ |
| 80 | Size -= sizeof(a); |
| 81 | Data += sizeof(a); |
| 82 | } |
| 83 | flush_events(s); |
| 84 | } |
| 85 | |
| 86 | static void i440fx_fuzz_qtest(QTestState *s, |
| 87 | const unsigned char *Data, |
| 88 | size_t Size) |
| 89 | { |
| 90 | ioport_fuzz_qtest(s, Data, Size); |
| 91 | fuzz_reset(s); |
| 92 | } |
| 93 | |
| 94 | static void pciconfig_fuzz_qos(QTestState *s, QPCIBus *bus, |
| 95 | const unsigned char *Data, size_t Size) { |
| 96 | /* |
| 97 | * Same as ioport_fuzz_qtest, but using QOS. devfn is incorporated into the |
| 98 | * value written over Port IO |
| 99 | */ |
| 100 | struct { |
| 101 | uint8_t opcode; |
| 102 | uint8_t offset; |
| 103 | int devfn; |
| 104 | uint32_t value; |
| 105 | } a; |
| 106 | |
| 107 | while (Size >= sizeof(a)) { |
| 108 | memcpy(&a, Data, sizeof(a)); |
| 109 | switch (a.opcode % ACTION_MAX) { |
| 110 | case WRITEB: |
| 111 | bus->config_writeb(bus, a.devfn, a.offset, (uint8_t)a.value); |
| 112 | break; |
| 113 | case WRITEW: |
| 114 | bus->config_writew(bus, a.devfn, a.offset, (uint16_t)a.value); |
| 115 | break; |
| 116 | case WRITEL: |
| 117 | bus->config_writel(bus, a.devfn, a.offset, (uint32_t)a.value); |
| 118 | break; |
| 119 | case READB: |
| 120 | bus->config_readb(bus, a.devfn, a.offset); |
| 121 | break; |
| 122 | case READW: |
| 123 | bus->config_readw(bus, a.devfn, a.offset); |
| 124 | break; |
| 125 | case READL: |
| 126 | bus->config_readl(bus, a.devfn, a.offset); |
| 127 | break; |
| 128 | } |
| 129 | Size -= sizeof(a); |
| 130 | Data += sizeof(a); |
| 131 | } |
| 132 | flush_events(s); |
| 133 | } |
| 134 | |
| 135 | static void i440fx_fuzz_qos(QTestState *s, |
| 136 | const unsigned char *Data, |
| 137 | size_t Size) |
| 138 | { |
| 139 | static QPCIBus *bus; |
| 140 | |
| 141 | if (!bus) { |
| 142 | bus = qpci_new_pc(s, fuzz_qos_alloc); |
| 143 | } |
| 144 | |
| 145 | pciconfig_fuzz_qos(s, bus, Data, Size); |
| 146 | } |
| 147 | |
| 148 | static const char *i440fx_qtest_argv = TARGET_NAME " -machine accel=qtest" |
| 149 | " -m 0 -display none"; |
| 150 | static GString *i440fx_argv(FuzzTarget *t) |
| 151 | { |
| 152 | return g_string_new(i440fx_qtest_argv); |
| 153 | } |
| 154 | |
| 155 | |
| 156 | static void register_pci_fuzz_targets(void) |
| 157 | { |
| 158 | /* Uses simple qtest commands and reboots to reset state */ |
| 159 | fuzz_add_target(&(FuzzTarget){ |
| 160 | .name = "i440fx-qtest-reboot-fuzz", |
| 161 | .description = "Fuzz the i440fx using raw qtest commands and " |
| 162 | "rebooting after each run", |
| 163 | .get_init_cmdline = i440fx_argv, |
| 164 | .fuzz = i440fx_fuzz_qtest}); |
| 165 | |
| 166 | |
| 167 | /* |
| 168 | * Uses libqos. Doesn't do anything to reset state. Note that if we were to |
| 169 | * reboot after each run, we would also have to redo the qos-related |
| 170 | * initialization (qos_init_path) |
| 171 | */ |
| 172 | fuzz_add_qos_target(&(FuzzTarget){ |
| 173 | .name = "i440fx-qos-noreset-fuzz", |
| 174 | .description = "Fuzz the i440fx using raw qtest commands and " |
| 175 | "rebooting after each run", |
| 176 | .fuzz = i440fx_fuzz_qos,}, |
| 177 | "i440FX-pcihost", |
| 178 | &(QOSGraphTestOptions){} |
| 179 | ); |
| 180 | } |
| 181 | |
| 182 | fuzz_target_init(register_pci_fuzz_targets); |