xref: /openbmc/qemu/tests/qtest/fuzz/virtio_blk_fuzz.c (revision 4919d0c44afd58e16a8a369ca359de7f0114e04c)
1d4e27914SDima Stepanov /*
2d4e27914SDima Stepanov  * virtio-blk Fuzzing Target
3d4e27914SDima Stepanov  *
4d4e27914SDima Stepanov  * Copyright Red Hat Inc., 2020
5d4e27914SDima Stepanov  *
6d4e27914SDima Stepanov  * Based on virtio-scsi-fuzz target.
7d4e27914SDima Stepanov  *
8d4e27914SDima Stepanov  * This work is licensed under the terms of the GNU GPL, version 2 or later.
9d4e27914SDima Stepanov  * See the COPYING file in the top-level directory.
10d4e27914SDima Stepanov  */
11d4e27914SDima Stepanov 
12d4e27914SDima Stepanov #include "qemu/osdep.h"
13d4e27914SDima Stepanov 
14907b5105SMarc-André Lureau #include "tests/qtest/libqtest.h"
15d4e27914SDima Stepanov #include "tests/qtest/libqos/virtio-blk.h"
16d4e27914SDima Stepanov #include "tests/qtest/libqos/virtio.h"
17d4e27914SDima Stepanov #include "tests/qtest/libqos/virtio-pci.h"
18d4e27914SDima Stepanov #include "standard-headers/linux/virtio_ids.h"
19d4e27914SDima Stepanov #include "standard-headers/linux/virtio_pci.h"
20d4e27914SDima Stepanov #include "standard-headers/linux/virtio_blk.h"
21d4e27914SDima Stepanov #include "fuzz.h"
22d4e27914SDima Stepanov #include "qos_fuzz.h"
23d4e27914SDima Stepanov 
24d4e27914SDima Stepanov #define TEST_IMAGE_SIZE         (64 * 1024 * 1024)
25d4e27914SDima Stepanov #define PCI_SLOT                0x02
26d4e27914SDima Stepanov #define PCI_FN                  0x00
27d4e27914SDima Stepanov 
28d4e27914SDima Stepanov #define MAX_NUM_QUEUES 64
29d4e27914SDima Stepanov 
30d4e27914SDima Stepanov /* Based on tests/qtest/virtio-blk-test.c. */
31d4e27914SDima Stepanov typedef struct {
32d4e27914SDima Stepanov     int num_queues;
33d4e27914SDima Stepanov     QVirtQueue *vq[MAX_NUM_QUEUES + 2];
34d4e27914SDima Stepanov } QVirtioBlkQueues;
35d4e27914SDima Stepanov 
qvirtio_blk_init(QVirtioDevice * dev,uint64_t mask)36d4e27914SDima Stepanov static QVirtioBlkQueues *qvirtio_blk_init(QVirtioDevice *dev, uint64_t mask)
37d4e27914SDima Stepanov {
38d4e27914SDima Stepanov     QVirtioBlkQueues *vs;
39d4e27914SDima Stepanov     uint64_t features;
40d4e27914SDima Stepanov 
41d4e27914SDima Stepanov     vs = g_new0(QVirtioBlkQueues, 1);
42d4e27914SDima Stepanov 
43d4e27914SDima Stepanov     features = qvirtio_get_features(dev);
44d4e27914SDima Stepanov     if (!mask) {
45d4e27914SDima Stepanov         mask = ~((1u << VIRTIO_RING_F_INDIRECT_DESC) |
46d4e27914SDima Stepanov                 (1u << VIRTIO_RING_F_EVENT_IDX) |
47d4e27914SDima Stepanov                 (1u << VIRTIO_BLK_F_SCSI));
48d4e27914SDima Stepanov     }
49d4e27914SDima Stepanov     mask |= ~QVIRTIO_F_BAD_FEATURE;
50d4e27914SDima Stepanov     features &= mask;
51d4e27914SDima Stepanov     qvirtio_set_features(dev, features);
52d4e27914SDima Stepanov 
53d4e27914SDima Stepanov     vs->num_queues = 1;
54d4e27914SDima Stepanov     vs->vq[0] = qvirtqueue_setup(dev, fuzz_qos_alloc, 0);
55d4e27914SDima Stepanov 
56d4e27914SDima Stepanov     qvirtio_set_driver_ok(dev);
57d4e27914SDima Stepanov 
58d4e27914SDima Stepanov     return vs;
59d4e27914SDima Stepanov }
60d4e27914SDima Stepanov 
virtio_blk_fuzz(QTestState * s,QVirtioBlkQueues * queues,const unsigned char * Data,size_t Size)61d4e27914SDima Stepanov static void virtio_blk_fuzz(QTestState *s, QVirtioBlkQueues* queues,
62d4e27914SDima Stepanov         const unsigned char *Data, size_t Size)
63d4e27914SDima Stepanov {
64d4e27914SDima Stepanov     /*
65d4e27914SDima Stepanov      * Data is a sequence of random bytes. We split them up into "actions",
66d4e27914SDima Stepanov      * followed by data:
67d4e27914SDima Stepanov      * [vqa][dddddddd][vqa][dddd][vqa][dddddddddddd] ...
68d4e27914SDima Stepanov      * The length of the data is specified by the preceding vqa.length
69d4e27914SDima Stepanov      */
70d4e27914SDima Stepanov     typedef struct vq_action {
71d4e27914SDima Stepanov         uint8_t queue;
72d4e27914SDima Stepanov         uint8_t length;
73d4e27914SDima Stepanov         uint8_t write;
74d4e27914SDima Stepanov         uint8_t next;
75d4e27914SDima Stepanov         uint8_t kick;
76d4e27914SDima Stepanov     } vq_action;
77d4e27914SDima Stepanov 
78d4e27914SDima Stepanov     /* Keep track of the free head for each queue we interact with */
79d4e27914SDima Stepanov     bool vq_touched[MAX_NUM_QUEUES + 2] = {0};
80d4e27914SDima Stepanov     uint32_t free_head[MAX_NUM_QUEUES + 2];
81d4e27914SDima Stepanov 
82d4e27914SDima Stepanov     QGuestAllocator *t_alloc = fuzz_qos_alloc;
83d4e27914SDima Stepanov 
84d4e27914SDima Stepanov     QVirtioBlk *blk = fuzz_qos_obj;
85d4e27914SDima Stepanov     QVirtioDevice *dev = blk->vdev;
86d4e27914SDima Stepanov     QVirtQueue *q;
87d4e27914SDima Stepanov     vq_action vqa;
88d4e27914SDima Stepanov     while (Size >= sizeof(vqa)) {
89d4e27914SDima Stepanov         /* Copy the action, so we can normalize length, queue and flags */
90d4e27914SDima Stepanov         memcpy(&vqa, Data, sizeof(vqa));
91d4e27914SDima Stepanov 
92d4e27914SDima Stepanov         Data += sizeof(vqa);
93d4e27914SDima Stepanov         Size -= sizeof(vqa);
94d4e27914SDima Stepanov 
95d4e27914SDima Stepanov         vqa.queue = vqa.queue % queues->num_queues;
96d4e27914SDima Stepanov         /* Cap length at the number of remaining bytes in data */
97d4e27914SDima Stepanov         vqa.length = vqa.length >= Size ? Size : vqa.length;
98d4e27914SDima Stepanov         vqa.write = vqa.write & 1;
99d4e27914SDima Stepanov         vqa.next = vqa.next & 1;
100d4e27914SDima Stepanov         vqa.kick = vqa.kick & 1;
101d4e27914SDima Stepanov 
102d4e27914SDima Stepanov         q = queues->vq[vqa.queue];
103d4e27914SDima Stepanov 
104d4e27914SDima Stepanov         /* Copy the data into ram, and place it on the virtqueue */
105d4e27914SDima Stepanov         uint64_t req_addr = guest_alloc(t_alloc, vqa.length);
106d4e27914SDima Stepanov         qtest_memwrite(s, req_addr, Data, vqa.length);
107d4e27914SDima Stepanov         if (vq_touched[vqa.queue] == 0) {
108d4e27914SDima Stepanov             vq_touched[vqa.queue] = 1;
109d4e27914SDima Stepanov             free_head[vqa.queue] = qvirtqueue_add(s, q, req_addr, vqa.length,
110d4e27914SDima Stepanov                     vqa.write, vqa.next);
111d4e27914SDima Stepanov         } else {
112d4e27914SDima Stepanov             qvirtqueue_add(s, q, req_addr, vqa.length, vqa.write , vqa.next);
113d4e27914SDima Stepanov         }
114d4e27914SDima Stepanov 
115d4e27914SDima Stepanov         if (vqa.kick) {
116d4e27914SDima Stepanov             qvirtqueue_kick(s, dev, q, free_head[vqa.queue]);
117d4e27914SDima Stepanov             free_head[vqa.queue] = 0;
118d4e27914SDima Stepanov         }
119d4e27914SDima Stepanov         Data += vqa.length;
120d4e27914SDima Stepanov         Size -= vqa.length;
121d4e27914SDima Stepanov     }
122d4e27914SDima Stepanov     /* In the end, kick each queue we interacted with */
123d4e27914SDima Stepanov     for (int i = 0; i < MAX_NUM_QUEUES + 2; i++) {
124d4e27914SDima Stepanov         if (vq_touched[i]) {
125d4e27914SDima Stepanov             qvirtqueue_kick(s, dev, queues->vq[i], free_head[i]);
126d4e27914SDima Stepanov         }
127d4e27914SDima Stepanov     }
128d4e27914SDima Stepanov }
129d4e27914SDima Stepanov 
virtio_blk_with_flag_fuzz(QTestState * s,const unsigned char * Data,size_t Size)130d4e27914SDima Stepanov static void virtio_blk_with_flag_fuzz(QTestState *s,
131d4e27914SDima Stepanov         const unsigned char *Data, size_t Size)
132d4e27914SDima Stepanov {
133d4e27914SDima Stepanov     QVirtioBlk *blk = fuzz_qos_obj;
134d4e27914SDima Stepanov     static QVirtioBlkQueues *queues;
135d4e27914SDima Stepanov 
136d4e27914SDima Stepanov     if (Size >= sizeof(uint64_t)) {
137d4e27914SDima Stepanov         queues = qvirtio_blk_init(blk->vdev, *(uint64_t *)Data);
138d4e27914SDima Stepanov         virtio_blk_fuzz(s, queues,
139d4e27914SDima Stepanov                 Data + sizeof(uint64_t), Size - sizeof(uint64_t));
140d4e27914SDima Stepanov         flush_events(s);
141d4e27914SDima Stepanov     }
142*725767e9SAlexander Bulekov     fuzz_reset(s);
143d4e27914SDima Stepanov }
144d4e27914SDima Stepanov 
virtio_blk_pre_fuzz(QTestState * s)145d4e27914SDima Stepanov static void virtio_blk_pre_fuzz(QTestState *s)
146d4e27914SDima Stepanov {
147d4e27914SDima Stepanov     qos_init_path(s);
148d4e27914SDima Stepanov }
149d4e27914SDima Stepanov 
drive_destroy(void * path)150d4e27914SDima Stepanov static void drive_destroy(void *path)
151d4e27914SDima Stepanov {
152d4e27914SDima Stepanov     unlink(path);
153d4e27914SDima Stepanov     g_free(path);
154d4e27914SDima Stepanov }
155d4e27914SDima Stepanov 
drive_create(void)156d4e27914SDima Stepanov static char *drive_create(void)
157d4e27914SDima Stepanov {
158d4e27914SDima Stepanov     int fd, ret;
1593ff220a0SBin Meng     char *t_path;
160d4e27914SDima Stepanov 
161d4e27914SDima Stepanov     /* Create a temporary raw image */
1623ff220a0SBin Meng     fd = g_file_open_tmp("qtest.XXXXXX", &t_path, NULL);
163d4e27914SDima Stepanov     g_assert_cmpint(fd, >=, 0);
164d4e27914SDima Stepanov     ret = ftruncate(fd, TEST_IMAGE_SIZE);
165d4e27914SDima Stepanov     g_assert_cmpint(ret, ==, 0);
166d4e27914SDima Stepanov     close(fd);
167d4e27914SDima Stepanov 
168d4e27914SDima Stepanov     g_test_queue_destroy(drive_destroy, t_path);
169d4e27914SDima Stepanov     return t_path;
170d4e27914SDima Stepanov }
171d4e27914SDima Stepanov 
virtio_blk_test_setup(GString * cmd_line,void * arg)172d4e27914SDima Stepanov static void *virtio_blk_test_setup(GString *cmd_line, void *arg)
173d4e27914SDima Stepanov {
174d4e27914SDima Stepanov     char *tmp_path = drive_create();
175d4e27914SDima Stepanov 
176d4e27914SDima Stepanov     g_string_append_printf(cmd_line,
177d4e27914SDima Stepanov                            " -drive if=none,id=drive0,file=%s,"
178d4e27914SDima Stepanov                            "format=raw,auto-read-only=off ",
179d4e27914SDima Stepanov                            tmp_path);
180d4e27914SDima Stepanov 
181d4e27914SDima Stepanov     return arg;
182d4e27914SDima Stepanov }
183d4e27914SDima Stepanov 
register_virtio_blk_fuzz_targets(void)184d4e27914SDima Stepanov static void register_virtio_blk_fuzz_targets(void)
185d4e27914SDima Stepanov {
186d4e27914SDima Stepanov     fuzz_add_qos_target(&(FuzzTarget){
187d4e27914SDima Stepanov                 .name = "virtio-blk-flags-fuzz",
188*725767e9SAlexander Bulekov                 .description = "Fuzz the virtio-blk virtual queues. "
189*725767e9SAlexander Bulekov                 "Also fuzzes the virtio flags)",
190d4e27914SDima Stepanov                 .pre_fuzz = &virtio_blk_pre_fuzz,
191d4e27914SDima Stepanov                 .fuzz = virtio_blk_with_flag_fuzz,},
192d4e27914SDima Stepanov                 "virtio-blk",
193d4e27914SDima Stepanov                 &(QOSGraphTestOptions){.before = virtio_blk_test_setup}
194d4e27914SDima Stepanov                 );
195d4e27914SDima Stepanov }
196d4e27914SDima Stepanov 
197d4e27914SDima Stepanov fuzz_target_init(register_virtio_blk_fuzz_targets);
198