@samitouri / QOSamiQemu
Code Commits Issues Pulls Sessions CI/CD
master
master
c 178 lines 5.13 KB
Raw
1 /*
2 * virtio-serial Fuzzing Target
3 *
4 * Copyright Red Hat Inc., 2019
5 *
6 * Authors:
7 * Alexander Bulekov <alxndr@bu.edu>
8 *
9 * This work is licensed under the terms of the GNU GPL, version 2 or later.
10 * See the COPYING file in the top-level directory.
11 */
12
13 #include "qemu/osdep.h"
14
15 #include "tests/qtest/libqtest.h"
16 #include "tests/qtest/libqos/virtio-scsi.h"
17 #include "tests/qtest/libqos/virtio.h"
18 #include "tests/qtest/libqos/virtio-pci.h"
19 #include "standard-headers/linux/virtio_ids.h"
20 #include "standard-headers/linux/virtio_pci.h"
21 #include "standard-headers/linux/virtio_scsi.h"
22 #include "fuzz.h"
23 #include "qos_fuzz.h"
24
25 #define PCI_SLOT 0x02
26 #define PCI_FN 0x00
27 #define QVIRTIO_SCSI_TIMEOUT_US (1 * 1000 * 1000)
28
29 #define MAX_NUM_QUEUES 64
30
31 /* Based on tests/virtio-scsi-test.c */
32 typedef struct {
33 int num_queues;
34 QVirtQueue *vq[MAX_NUM_QUEUES + 2];
35 } QVirtioSCSIQueues;
36
37 static QVirtioSCSIQueues *qvirtio_scsi_init(QVirtioDevice *dev, uint64_t mask)
38 {
39 QVirtioSCSIQueues *vs;
40 uint64_t feat;
41 int i;
42
43 vs = g_new0(QVirtioSCSIQueues, 1);
44
45 feat = qvirtio_get_features(dev);
46 if (mask) {
47 feat &= ~QVIRTIO_F_BAD_FEATURE | mask;
48 } else {
49 feat &= ~(QVIRTIO_F_BAD_FEATURE | (1ull << VIRTIO_RING_F_EVENT_IDX));
50 }
51 qvirtio_set_features(dev, feat);
52
53 vs->num_queues = qvirtio_config_readl(dev, 0);
54
55 for (i = 0; i < vs->num_queues + 2; i++) {
56 vs->vq[i] = qvirtqueue_setup(dev, fuzz_qos_alloc, i);
57 }
58
59 qvirtio_set_driver_ok(dev);
60
61 return vs;
62 }
63
64 static void virtio_scsi_fuzz(QTestState *s, QVirtioSCSIQueues* queues,
65 const unsigned char *Data, size_t Size)
66 {
67 /*
68 * Data is a sequence of random bytes. We split them up into "actions",
69 * followed by data:
70 * [vqa][dddddddd][vqa][dddd][vqa][dddddddddddd] ...
71 * The length of the data is specified by the preceding vqa.length
72 */
73 typedef struct vq_action {
74 uint8_t queue;
75 uint8_t length;
76 uint8_t write;
77 uint8_t next;
78 uint8_t kick;
79 } vq_action;
80
81 /* Keep track of the free head for each queue we interact with */
82 bool vq_touched[MAX_NUM_QUEUES + 2] = {0};
83 uint32_t free_head[MAX_NUM_QUEUES + 2];
84
85 QGuestAllocator *t_alloc = fuzz_qos_alloc;
86
87 QVirtioSCSI *scsi = fuzz_qos_obj;
88 QVirtioDevice *dev = scsi->vdev;
89 QVirtQueue *q;
90 vq_action vqa;
91 while (Size >= sizeof(vqa)) {
92 /* Copy the action, so we can normalize length, queue and flags */
93 memcpy(&vqa, Data, sizeof(vqa));
94
95 Data += sizeof(vqa);
96 Size -= sizeof(vqa);
97
98 vqa.queue = vqa.queue % queues->num_queues;
99 /* Cap length at the number of remaining bytes in data */
100 vqa.length = vqa.length >= Size ? Size : vqa.length;
101 vqa.write = vqa.write & 1;
102 vqa.next = vqa.next & 1;
103 vqa.kick = vqa.kick & 1;
104
105
106 q = queues->vq[vqa.queue];
107
108 /* Copy the data into ram, and place it on the virtqueue */
109 uint64_t req_addr = guest_alloc(t_alloc, vqa.length);
110 qtest_memwrite(s, req_addr, Data, vqa.length);
111 if (vq_touched[vqa.queue] == 0) {
112 vq_touched[vqa.queue] = 1;
113 free_head[vqa.queue] = qvirtqueue_add(s, q, req_addr, vqa.length,
114 vqa.write, vqa.next);
115 } else {
116 qvirtqueue_add(s, q, req_addr, vqa.length, vqa.write , vqa.next);
117 }
118
119 if (vqa.kick) {
120 qvirtqueue_kick(s, dev, q, free_head[vqa.queue]);
121 free_head[vqa.queue] = 0;
122 }
123 Data += vqa.length;
124 Size -= vqa.length;
125 }
126 /* In the end, kick each queue we interacted with */
127 for (int i = 0; i < MAX_NUM_QUEUES + 2; i++) {
128 if (vq_touched[i]) {
129 qvirtqueue_kick(s, dev, queues->vq[i], free_head[i]);
130 }
131 }
132 }
133
134 static void virtio_scsi_with_flag_fuzz(QTestState *s,
135 const unsigned char *Data, size_t Size)
136 {
137 QVirtioSCSI *scsi = fuzz_qos_obj;
138 static QVirtioSCSIQueues *queues;
139
140 if (Size >= sizeof(uint64_t)) {
141 queues = qvirtio_scsi_init(scsi->vdev, *(uint64_t *)Data);
142 virtio_scsi_fuzz(s, queues,
143 Data + sizeof(uint64_t), Size - sizeof(uint64_t));
144 flush_events(s);
145 }
146 fuzz_reset(s);
147 }
148
149 static void virtio_scsi_pre_fuzz(QTestState *s)
150 {
151 qos_init_path(s);
152 }
153
154 static void *virtio_scsi_test_setup(GString *cmd_line, void *arg)
155 {
156 g_string_append(cmd_line,
157 " -drive file=blkdebug::null-co://,"
158 "file.image.read-zeroes=on,"
159 "if=none,id=dr1,format=raw,file.align=4k "
160 "-device scsi-hd,drive=dr1,lun=0,scsi-id=1");
161 return arg;
162 }
163
164
165 static void register_virtio_scsi_fuzz_targets(void)
166 {
167 fuzz_add_qos_target(&(FuzzTarget){
168 .name = "virtio-scsi-flags-fuzz",
169 .description = "Fuzz the virtio-scsi virtual queues. "
170 "Also fuzzes the virtio flags",
171 .pre_fuzz = &virtio_scsi_pre_fuzz,
172 .fuzz = virtio_scsi_with_flag_fuzz,},
173 "virtio-scsi",
174 &(QOSGraphTestOptions){.before = virtio_scsi_test_setup}
175 );
176 }
177
178 fuzz_target_init(register_virtio_scsi_fuzz_targets);