1d4e27914SDima Stepanov /*
2d4e27914SDima Stepanov * virtio-blk Fuzzing Target
3d4e27914SDima Stepanov *
4d4e27914SDima Stepanov * Copyright Red Hat Inc., 2020
5d4e27914SDima Stepanov *
6d4e27914SDima Stepanov * Based on virtio-scsi-fuzz target.
7d4e27914SDima Stepanov *
8d4e27914SDima Stepanov * This work is licensed under the terms of the GNU GPL, version 2 or later.
9d4e27914SDima Stepanov * See the COPYING file in the top-level directory.
10d4e27914SDima Stepanov */
11d4e27914SDima Stepanov
12d4e27914SDima Stepanov #include "qemu/osdep.h"
13d4e27914SDima Stepanov
14907b5105SMarc-André Lureau #include "tests/qtest/libqtest.h"
15d4e27914SDima Stepanov #include "tests/qtest/libqos/virtio-blk.h"
16d4e27914SDima Stepanov #include "tests/qtest/libqos/virtio.h"
17d4e27914SDima Stepanov #include "tests/qtest/libqos/virtio-pci.h"
18d4e27914SDima Stepanov #include "standard-headers/linux/virtio_ids.h"
19d4e27914SDima Stepanov #include "standard-headers/linux/virtio_pci.h"
20d4e27914SDima Stepanov #include "standard-headers/linux/virtio_blk.h"
21d4e27914SDima Stepanov #include "fuzz.h"
22d4e27914SDima Stepanov #include "qos_fuzz.h"
23d4e27914SDima Stepanov
24d4e27914SDima Stepanov #define TEST_IMAGE_SIZE (64 * 1024 * 1024)
25d4e27914SDima Stepanov #define PCI_SLOT 0x02
26d4e27914SDima Stepanov #define PCI_FN 0x00
27d4e27914SDima Stepanov
28d4e27914SDima Stepanov #define MAX_NUM_QUEUES 64
29d4e27914SDima Stepanov
30d4e27914SDima Stepanov /* Based on tests/qtest/virtio-blk-test.c. */
31d4e27914SDima Stepanov typedef struct {
32d4e27914SDima Stepanov int num_queues;
33d4e27914SDima Stepanov QVirtQueue *vq[MAX_NUM_QUEUES + 2];
34d4e27914SDima Stepanov } QVirtioBlkQueues;
35d4e27914SDima Stepanov
qvirtio_blk_init(QVirtioDevice * dev,uint64_t mask)36d4e27914SDima Stepanov static QVirtioBlkQueues *qvirtio_blk_init(QVirtioDevice *dev, uint64_t mask)
37d4e27914SDima Stepanov {
38d4e27914SDima Stepanov QVirtioBlkQueues *vs;
39d4e27914SDima Stepanov uint64_t features;
40d4e27914SDima Stepanov
41d4e27914SDima Stepanov vs = g_new0(QVirtioBlkQueues, 1);
42d4e27914SDima Stepanov
43d4e27914SDima Stepanov features = qvirtio_get_features(dev);
44d4e27914SDima Stepanov if (!mask) {
45d4e27914SDima Stepanov mask = ~((1u << VIRTIO_RING_F_INDIRECT_DESC) |
46d4e27914SDima Stepanov (1u << VIRTIO_RING_F_EVENT_IDX) |
47d4e27914SDima Stepanov (1u << VIRTIO_BLK_F_SCSI));
48d4e27914SDima Stepanov }
49d4e27914SDima Stepanov mask |= ~QVIRTIO_F_BAD_FEATURE;
50d4e27914SDima Stepanov features &= mask;
51d4e27914SDima Stepanov qvirtio_set_features(dev, features);
52d4e27914SDima Stepanov
53d4e27914SDima Stepanov vs->num_queues = 1;
54d4e27914SDima Stepanov vs->vq[0] = qvirtqueue_setup(dev, fuzz_qos_alloc, 0);
55d4e27914SDima Stepanov
56d4e27914SDima Stepanov qvirtio_set_driver_ok(dev);
57d4e27914SDima Stepanov
58d4e27914SDima Stepanov return vs;
59d4e27914SDima Stepanov }
60d4e27914SDima Stepanov
virtio_blk_fuzz(QTestState * s,QVirtioBlkQueues * queues,const unsigned char * Data,size_t Size)61d4e27914SDima Stepanov static void virtio_blk_fuzz(QTestState *s, QVirtioBlkQueues* queues,
62d4e27914SDima Stepanov const unsigned char *Data, size_t Size)
63d4e27914SDima Stepanov {
64d4e27914SDima Stepanov /*
65d4e27914SDima Stepanov * Data is a sequence of random bytes. We split them up into "actions",
66d4e27914SDima Stepanov * followed by data:
67d4e27914SDima Stepanov * [vqa][dddddddd][vqa][dddd][vqa][dddddddddddd] ...
68d4e27914SDima Stepanov * The length of the data is specified by the preceding vqa.length
69d4e27914SDima Stepanov */
70d4e27914SDima Stepanov typedef struct vq_action {
71d4e27914SDima Stepanov uint8_t queue;
72d4e27914SDima Stepanov uint8_t length;
73d4e27914SDima Stepanov uint8_t write;
74d4e27914SDima Stepanov uint8_t next;
75d4e27914SDima Stepanov uint8_t kick;
76d4e27914SDima Stepanov } vq_action;
77d4e27914SDima Stepanov
78d4e27914SDima Stepanov /* Keep track of the free head for each queue we interact with */
79d4e27914SDima Stepanov bool vq_touched[MAX_NUM_QUEUES + 2] = {0};
80d4e27914SDima Stepanov uint32_t free_head[MAX_NUM_QUEUES + 2];
81d4e27914SDima Stepanov
82d4e27914SDima Stepanov QGuestAllocator *t_alloc = fuzz_qos_alloc;
83d4e27914SDima Stepanov
84d4e27914SDima Stepanov QVirtioBlk *blk = fuzz_qos_obj;
85d4e27914SDima Stepanov QVirtioDevice *dev = blk->vdev;
86d4e27914SDima Stepanov QVirtQueue *q;
87d4e27914SDima Stepanov vq_action vqa;
88d4e27914SDima Stepanov while (Size >= sizeof(vqa)) {
89d4e27914SDima Stepanov /* Copy the action, so we can normalize length, queue and flags */
90d4e27914SDima Stepanov memcpy(&vqa, Data, sizeof(vqa));
91d4e27914SDima Stepanov
92d4e27914SDima Stepanov Data += sizeof(vqa);
93d4e27914SDima Stepanov Size -= sizeof(vqa);
94d4e27914SDima Stepanov
95d4e27914SDima Stepanov vqa.queue = vqa.queue % queues->num_queues;
96d4e27914SDima Stepanov /* Cap length at the number of remaining bytes in data */
97d4e27914SDima Stepanov vqa.length = vqa.length >= Size ? Size : vqa.length;
98d4e27914SDima Stepanov vqa.write = vqa.write & 1;
99d4e27914SDima Stepanov vqa.next = vqa.next & 1;
100d4e27914SDima Stepanov vqa.kick = vqa.kick & 1;
101d4e27914SDima Stepanov
102d4e27914SDima Stepanov q = queues->vq[vqa.queue];
103d4e27914SDima Stepanov
104d4e27914SDima Stepanov /* Copy the data into ram, and place it on the virtqueue */
105d4e27914SDima Stepanov uint64_t req_addr = guest_alloc(t_alloc, vqa.length);
106d4e27914SDima Stepanov qtest_memwrite(s, req_addr, Data, vqa.length);
107d4e27914SDima Stepanov if (vq_touched[vqa.queue] == 0) {
108d4e27914SDima Stepanov vq_touched[vqa.queue] = 1;
109d4e27914SDima Stepanov free_head[vqa.queue] = qvirtqueue_add(s, q, req_addr, vqa.length,
110d4e27914SDima Stepanov vqa.write, vqa.next);
111d4e27914SDima Stepanov } else {
112d4e27914SDima Stepanov qvirtqueue_add(s, q, req_addr, vqa.length, vqa.write , vqa.next);
113d4e27914SDima Stepanov }
114d4e27914SDima Stepanov
115d4e27914SDima Stepanov if (vqa.kick) {
116d4e27914SDima Stepanov qvirtqueue_kick(s, dev, q, free_head[vqa.queue]);
117d4e27914SDima Stepanov free_head[vqa.queue] = 0;
118d4e27914SDima Stepanov }
119d4e27914SDima Stepanov Data += vqa.length;
120d4e27914SDima Stepanov Size -= vqa.length;
121d4e27914SDima Stepanov }
122d4e27914SDima Stepanov /* In the end, kick each queue we interacted with */
123d4e27914SDima Stepanov for (int i = 0; i < MAX_NUM_QUEUES + 2; i++) {
124d4e27914SDima Stepanov if (vq_touched[i]) {
125d4e27914SDima Stepanov qvirtqueue_kick(s, dev, queues->vq[i], free_head[i]);
126d4e27914SDima Stepanov }
127d4e27914SDima Stepanov }
128d4e27914SDima Stepanov }
129d4e27914SDima Stepanov
virtio_blk_with_flag_fuzz(QTestState * s,const unsigned char * Data,size_t Size)130d4e27914SDima Stepanov static void virtio_blk_with_flag_fuzz(QTestState *s,
131d4e27914SDima Stepanov const unsigned char *Data, size_t Size)
132d4e27914SDima Stepanov {
133d4e27914SDima Stepanov QVirtioBlk *blk = fuzz_qos_obj;
134d4e27914SDima Stepanov static QVirtioBlkQueues *queues;
135d4e27914SDima Stepanov
136d4e27914SDima Stepanov if (Size >= sizeof(uint64_t)) {
137d4e27914SDima Stepanov queues = qvirtio_blk_init(blk->vdev, *(uint64_t *)Data);
138d4e27914SDima Stepanov virtio_blk_fuzz(s, queues,
139d4e27914SDima Stepanov Data + sizeof(uint64_t), Size - sizeof(uint64_t));
140d4e27914SDima Stepanov flush_events(s);
141d4e27914SDima Stepanov }
142*725767e9SAlexander Bulekov fuzz_reset(s);
143d4e27914SDima Stepanov }
144d4e27914SDima Stepanov
virtio_blk_pre_fuzz(QTestState * s)145d4e27914SDima Stepanov static void virtio_blk_pre_fuzz(QTestState *s)
146d4e27914SDima Stepanov {
147d4e27914SDima Stepanov qos_init_path(s);
148d4e27914SDima Stepanov }
149d4e27914SDima Stepanov
drive_destroy(void * path)150d4e27914SDima Stepanov static void drive_destroy(void *path)
151d4e27914SDima Stepanov {
152d4e27914SDima Stepanov unlink(path);
153d4e27914SDima Stepanov g_free(path);
154d4e27914SDima Stepanov }
155d4e27914SDima Stepanov
drive_create(void)156d4e27914SDima Stepanov static char *drive_create(void)
157d4e27914SDima Stepanov {
158d4e27914SDima Stepanov int fd, ret;
1593ff220a0SBin Meng char *t_path;
160d4e27914SDima Stepanov
161d4e27914SDima Stepanov /* Create a temporary raw image */
1623ff220a0SBin Meng fd = g_file_open_tmp("qtest.XXXXXX", &t_path, NULL);
163d4e27914SDima Stepanov g_assert_cmpint(fd, >=, 0);
164d4e27914SDima Stepanov ret = ftruncate(fd, TEST_IMAGE_SIZE);
165d4e27914SDima Stepanov g_assert_cmpint(ret, ==, 0);
166d4e27914SDima Stepanov close(fd);
167d4e27914SDima Stepanov
168d4e27914SDima Stepanov g_test_queue_destroy(drive_destroy, t_path);
169d4e27914SDima Stepanov return t_path;
170d4e27914SDima Stepanov }
171d4e27914SDima Stepanov
virtio_blk_test_setup(GString * cmd_line,void * arg)172d4e27914SDima Stepanov static void *virtio_blk_test_setup(GString *cmd_line, void *arg)
173d4e27914SDima Stepanov {
174d4e27914SDima Stepanov char *tmp_path = drive_create();
175d4e27914SDima Stepanov
176d4e27914SDima Stepanov g_string_append_printf(cmd_line,
177d4e27914SDima Stepanov " -drive if=none,id=drive0,file=%s,"
178d4e27914SDima Stepanov "format=raw,auto-read-only=off ",
179d4e27914SDima Stepanov tmp_path);
180d4e27914SDima Stepanov
181d4e27914SDima Stepanov return arg;
182d4e27914SDima Stepanov }
183d4e27914SDima Stepanov
register_virtio_blk_fuzz_targets(void)184d4e27914SDima Stepanov static void register_virtio_blk_fuzz_targets(void)
185d4e27914SDima Stepanov {
186d4e27914SDima Stepanov fuzz_add_qos_target(&(FuzzTarget){
187d4e27914SDima Stepanov .name = "virtio-blk-flags-fuzz",
188*725767e9SAlexander Bulekov .description = "Fuzz the virtio-blk virtual queues. "
189*725767e9SAlexander Bulekov "Also fuzzes the virtio flags)",
190d4e27914SDima Stepanov .pre_fuzz = &virtio_blk_pre_fuzz,
191d4e27914SDima Stepanov .fuzz = virtio_blk_with_flag_fuzz,},
192d4e27914SDima Stepanov "virtio-blk",
193d4e27914SDima Stepanov &(QOSGraphTestOptions){.before = virtio_blk_test_setup}
194d4e27914SDima Stepanov );
195d4e27914SDima Stepanov }
196d4e27914SDima Stepanov
197d4e27914SDima Stepanov fuzz_target_init(register_virtio_blk_fuzz_targets);
198