1 /* 2 * Generic Virtual-Device Fuzzing Target 3 * 4 * Copyright Red Hat Inc., 2020 5 * 6 * Authors: 7 * Alexander Bulekov <alxndr@bu.edu> 8 * 9 * This work is licensed under the terms of the GNU GPL, version 2 or later. 10 * See the COPYING file in the top-level directory. 11 */ 12 13 #include "qemu/osdep.h" 14 15 #include <wordexp.h> 16 17 #include "hw/core/cpu.h" 18 #include "tests/qtest/libqos/libqtest.h" 19 #include "fuzz.h" 20 #include "fork_fuzz.h" 21 #include "exec/address-spaces.h" 22 #include "string.h" 23 #include "exec/memory.h" 24 #include "exec/ramblock.h" 25 #include "exec/address-spaces.h" 26 #include "hw/qdev-core.h" 27 #include "hw/pci/pci.h" 28 #include "hw/boards.h" 29 #include "generic_fuzz_configs.h" 30 31 /* 32 * SEPARATOR is used to separate "operations" in the fuzz input 33 */ 34 #define SEPARATOR "FUZZ" 35 36 enum cmds { 37 OP_IN, 38 OP_OUT, 39 OP_READ, 40 OP_WRITE, 41 OP_PCI_READ, 42 OP_PCI_WRITE, 43 OP_DISABLE_PCI, 44 OP_ADD_DMA_PATTERN, 45 OP_CLEAR_DMA_PATTERNS, 46 OP_CLOCK_STEP, 47 }; 48 49 #define DEFAULT_TIMEOUT_US 100000 50 #define USEC_IN_SEC 1000000000 51 52 #define MAX_DMA_FILL_SIZE 0x10000 53 54 #define PCI_HOST_BRIDGE_CFG 0xcf8 55 #define PCI_HOST_BRIDGE_DATA 0xcfc 56 57 typedef struct { 58 ram_addr_t addr; 59 ram_addr_t size; /* The number of bytes until the end of the I/O region */ 60 } address_range; 61 62 static useconds_t timeout = DEFAULT_TIMEOUT_US; 63 64 static bool qtest_log_enabled; 65 66 /* 67 * A pattern used to populate a DMA region or perform a memwrite. This is 68 * useful for e.g. populating tables of unique addresses. 69 * Example {.index = 1; .stride = 2; .len = 3; .data = "\x00\x01\x02"} 70 * Renders as: 00 01 02 00 03 02 00 05 02 00 07 02 ... 71 */ 72 typedef struct { 73 uint8_t index; /* Index of a byte to increment by stride */ 74 uint8_t stride; /* Increment each index'th byte by this amount */ 75 size_t len; 76 const uint8_t *data; 77 } pattern; 78 79 /* Avoid filling the same DMA region between MMIO/PIO commands ? */ 80 static bool avoid_double_fetches; 81 82 static QTestState *qts_global; /* Need a global for the DMA callback */ 83 84 /* 85 * List of memory regions that are children of QOM objects specified by the 86 * user for fuzzing. 87 */ 88 static GHashTable *fuzzable_memoryregions; 89 static GPtrArray *fuzzable_pci_devices; 90 91 struct get_io_cb_info { 92 int index; 93 int found; 94 address_range result; 95 }; 96 97 static int get_io_address_cb(Int128 start, Int128 size, 98 const MemoryRegion *mr, void *opaque) { 99 struct get_io_cb_info *info = opaque; 100 if (g_hash_table_lookup(fuzzable_memoryregions, mr)) { 101 if (info->index == 0) { 102 info->result.addr = (ram_addr_t)start; 103 info->result.size = (ram_addr_t)size; 104 info->found = 1; 105 return 1; 106 } 107 info->index--; 108 } 109 return 0; 110 } 111 112 /* 113 * List of dma regions populated since the last fuzzing command. Used to ensure 114 * that we only write to each DMA address once, to avoid race conditions when 115 * building reproducers. 116 */ 117 static GArray *dma_regions; 118 119 static GArray *dma_patterns; 120 static int dma_pattern_index; 121 static bool pci_disabled; 122 123 /* 124 * Allocate a block of memory and populate it with a pattern. 125 */ 126 static void *pattern_alloc(pattern p, size_t len) 127 { 128 int i; 129 uint8_t *buf = g_malloc(len); 130 uint8_t sum = 0; 131 132 for (i = 0; i < len; ++i) { 133 buf[i] = p.data[i % p.len]; 134 if ((i % p.len) == p.index) { 135 buf[i] += sum; 136 sum += p.stride; 137 } 138 } 139 return buf; 140 } 141 142 static int memory_access_size(MemoryRegion *mr, unsigned l, hwaddr addr) 143 { 144 unsigned access_size_max = mr->ops->valid.max_access_size; 145 146 /* 147 * Regions are assumed to support 1-4 byte accesses unless 148 * otherwise specified. 149 */ 150 if (access_size_max == 0) { 151 access_size_max = 4; 152 } 153 154 /* Bound the maximum access by the alignment of the address. */ 155 if (!mr->ops->impl.unaligned) { 156 unsigned align_size_max = addr & -addr; 157 if (align_size_max != 0 && align_size_max < access_size_max) { 158 access_size_max = align_size_max; 159 } 160 } 161 162 /* Don't attempt accesses larger than the maximum. */ 163 if (l > access_size_max) { 164 l = access_size_max; 165 } 166 l = pow2floor(l); 167 168 return l; 169 } 170 171 /* 172 * Call-back for functions that perform DMA reads from guest memory. Confirm 173 * that the region has not already been populated since the last loop in 174 * generic_fuzz(), avoiding potential race-conditions, which we don't have 175 * a good way for reproducing right now. 176 */ 177 void fuzz_dma_read_cb(size_t addr, size_t len, MemoryRegion *mr, bool is_write) 178 { 179 /* Are we in the generic-fuzzer or are we using another fuzz-target? */ 180 if (!qts_global) { 181 return; 182 } 183 184 /* 185 * Return immediately if: 186 * - We have no DMA patterns defined 187 * - The length of the DMA read request is zero 188 * - The DMA read is hitting an MR other than the machine's main RAM 189 * - The DMA request is not a read (what happens for a address_space_map 190 * with is_write=True? Can the device use the same pointer to do reads?) 191 * - The DMA request hits past the bounds of our RAM 192 */ 193 if (dma_patterns->len == 0 194 || len == 0 195 || mr != current_machine->ram 196 || is_write 197 || addr > current_machine->ram_size) { 198 return; 199 } 200 201 /* 202 * If we overlap with any existing dma_regions, split the range and only 203 * populate the non-overlapping parts. 204 */ 205 address_range region; 206 bool double_fetch = false; 207 for (int i = 0; 208 i < dma_regions->len && (avoid_double_fetches || qtest_log_enabled); 209 ++i) { 210 region = g_array_index(dma_regions, address_range, i); 211 if (addr < region.addr + region.size && addr + len > region.addr) { 212 double_fetch = true; 213 if (addr < region.addr 214 && avoid_double_fetches) { 215 fuzz_dma_read_cb(addr, region.addr - addr, mr, is_write); 216 } 217 if (addr + len > region.addr + region.size 218 && avoid_double_fetches) { 219 fuzz_dma_read_cb(region.addr + region.size, 220 addr + len - (region.addr + region.size), mr, is_write); 221 } 222 return; 223 } 224 } 225 226 /* Cap the length of the DMA access to something reasonable */ 227 len = MIN(len, MAX_DMA_FILL_SIZE); 228 229 address_range ar = {addr, len}; 230 g_array_append_val(dma_regions, ar); 231 pattern p = g_array_index(dma_patterns, pattern, dma_pattern_index); 232 void *buf_base = pattern_alloc(p, ar.size); 233 void *buf = buf_base; 234 hwaddr l, addr1; 235 MemoryRegion *mr1; 236 while (len > 0) { 237 l = len; 238 mr1 = address_space_translate(first_cpu->as, 239 addr, &addr1, &l, true, 240 MEMTXATTRS_UNSPECIFIED); 241 242 if (!(memory_region_is_ram(mr1) || 243 memory_region_is_romd(mr1))) { 244 l = memory_access_size(mr1, l, addr1); 245 } else { 246 /* ROM/RAM case */ 247 if (qtest_log_enabled) { 248 /* 249 * With QTEST_LOG, use a normal, slow QTest memwrite. Prefix the log 250 * that will be written by qtest.c with a DMA tag, so we can reorder 251 * the resulting QTest trace so the DMA fills precede the last PIO/MMIO 252 * command. 253 */ 254 fprintf(stderr, "[DMA] "); 255 if (double_fetch) { 256 fprintf(stderr, "[DOUBLE-FETCH] "); 257 } 258 fflush(stderr); 259 } 260 qtest_memwrite(qts_global, addr, buf, l); 261 } 262 len -= l; 263 buf += l; 264 addr += l; 265 266 } 267 g_free(buf_base); 268 269 /* Increment the index of the pattern for the next DMA access */ 270 dma_pattern_index = (dma_pattern_index + 1) % dma_patterns->len; 271 } 272 273 /* 274 * Here we want to convert a fuzzer-provided [io-region-index, offset] to 275 * a physical address. To do this, we iterate over all of the matched 276 * MemoryRegions. Check whether each region exists within the particular io 277 * space. Return the absolute address of the offset within the index'th region 278 * that is a subregion of the io_space and the distance until the end of the 279 * memory region. 280 */ 281 static bool get_io_address(address_range *result, AddressSpace *as, 282 uint8_t index, 283 uint32_t offset) { 284 FlatView *view; 285 view = as->current_map; 286 g_assert(view); 287 struct get_io_cb_info cb_info = {}; 288 289 cb_info.index = index; 290 291 /* 292 * Loop around the FlatView until we match "index" number of 293 * fuzzable_memoryregions, or until we know that there are no matching 294 * memory_regions. 295 */ 296 do { 297 flatview_for_each_range(view, get_io_address_cb , &cb_info); 298 } while (cb_info.index != index && !cb_info.found); 299 300 *result = cb_info.result; 301 if (result->size) { 302 offset = offset % result->size; 303 result->addr += offset; 304 result->size -= offset; 305 } 306 return cb_info.found; 307 } 308 309 static bool get_pio_address(address_range *result, 310 uint8_t index, uint16_t offset) 311 { 312 /* 313 * PIO BARs can be set past the maximum port address (0xFFFF). Thus, result 314 * can contain an addr that extends past the PIO space. When we pass this 315 * address to qtest_in/qtest_out, it is cast to a uint16_t, so we might end 316 * up fuzzing a completely different MemoryRegion/Device. Therefore, check 317 * that the address here is within the PIO space limits. 318 */ 319 bool found = get_io_address(result, &address_space_io, index, offset); 320 return result->addr <= 0xFFFF ? found : false; 321 } 322 323 static bool get_mmio_address(address_range *result, 324 uint8_t index, uint32_t offset) 325 { 326 return get_io_address(result, &address_space_memory, index, offset); 327 } 328 329 static void op_in(QTestState *s, const unsigned char * data, size_t len) 330 { 331 enum Sizes {Byte, Word, Long, end_sizes}; 332 struct { 333 uint8_t size; 334 uint8_t base; 335 uint16_t offset; 336 } a; 337 address_range abs; 338 339 if (len < sizeof(a)) { 340 return; 341 } 342 memcpy(&a, data, sizeof(a)); 343 if (get_pio_address(&abs, a.base, a.offset) == 0) { 344 return; 345 } 346 347 switch (a.size %= end_sizes) { 348 case Byte: 349 qtest_inb(s, abs.addr); 350 break; 351 case Word: 352 if (abs.size >= 2) { 353 qtest_inw(s, abs.addr); 354 } 355 break; 356 case Long: 357 if (abs.size >= 4) { 358 qtest_inl(s, abs.addr); 359 } 360 break; 361 } 362 } 363 364 static void op_out(QTestState *s, const unsigned char * data, size_t len) 365 { 366 enum Sizes {Byte, Word, Long, end_sizes}; 367 struct { 368 uint8_t size; 369 uint8_t base; 370 uint16_t offset; 371 uint32_t value; 372 } a; 373 address_range abs; 374 375 if (len < sizeof(a)) { 376 return; 377 } 378 memcpy(&a, data, sizeof(a)); 379 380 if (get_pio_address(&abs, a.base, a.offset) == 0) { 381 return; 382 } 383 384 switch (a.size %= end_sizes) { 385 case Byte: 386 qtest_outb(s, abs.addr, a.value & 0xFF); 387 break; 388 case Word: 389 if (abs.size >= 2) { 390 qtest_outw(s, abs.addr, a.value & 0xFFFF); 391 } 392 break; 393 case Long: 394 if (abs.size >= 4) { 395 qtest_outl(s, abs.addr, a.value); 396 } 397 break; 398 } 399 } 400 401 static void op_read(QTestState *s, const unsigned char * data, size_t len) 402 { 403 enum Sizes {Byte, Word, Long, Quad, end_sizes}; 404 struct { 405 uint8_t size; 406 uint8_t base; 407 uint32_t offset; 408 } a; 409 address_range abs; 410 411 if (len < sizeof(a)) { 412 return; 413 } 414 memcpy(&a, data, sizeof(a)); 415 416 if (get_mmio_address(&abs, a.base, a.offset) == 0) { 417 return; 418 } 419 420 switch (a.size %= end_sizes) { 421 case Byte: 422 qtest_readb(s, abs.addr); 423 break; 424 case Word: 425 if (abs.size >= 2) { 426 qtest_readw(s, abs.addr); 427 } 428 break; 429 case Long: 430 if (abs.size >= 4) { 431 qtest_readl(s, abs.addr); 432 } 433 break; 434 case Quad: 435 if (abs.size >= 8) { 436 qtest_readq(s, abs.addr); 437 } 438 break; 439 } 440 } 441 442 static void op_write(QTestState *s, const unsigned char * data, size_t len) 443 { 444 enum Sizes {Byte, Word, Long, Quad, end_sizes}; 445 struct { 446 uint8_t size; 447 uint8_t base; 448 uint32_t offset; 449 uint64_t value; 450 } a; 451 address_range abs; 452 453 if (len < sizeof(a)) { 454 return; 455 } 456 memcpy(&a, data, sizeof(a)); 457 458 if (get_mmio_address(&abs, a.base, a.offset) == 0) { 459 return; 460 } 461 462 switch (a.size %= end_sizes) { 463 case Byte: 464 qtest_writeb(s, abs.addr, a.value & 0xFF); 465 break; 466 case Word: 467 if (abs.size >= 2) { 468 qtest_writew(s, abs.addr, a.value & 0xFFFF); 469 } 470 break; 471 case Long: 472 if (abs.size >= 4) { 473 qtest_writel(s, abs.addr, a.value & 0xFFFFFFFF); 474 } 475 break; 476 case Quad: 477 if (abs.size >= 8) { 478 qtest_writeq(s, abs.addr, a.value); 479 } 480 break; 481 } 482 } 483 484 static void op_pci_read(QTestState *s, const unsigned char * data, size_t len) 485 { 486 enum Sizes {Byte, Word, Long, end_sizes}; 487 struct { 488 uint8_t size; 489 uint8_t base; 490 uint8_t offset; 491 } a; 492 if (len < sizeof(a) || fuzzable_pci_devices->len == 0 || pci_disabled) { 493 return; 494 } 495 memcpy(&a, data, sizeof(a)); 496 PCIDevice *dev = g_ptr_array_index(fuzzable_pci_devices, 497 a.base % fuzzable_pci_devices->len); 498 int devfn = dev->devfn; 499 qtest_outl(s, PCI_HOST_BRIDGE_CFG, (1U << 31) | (devfn << 8) | a.offset); 500 switch (a.size %= end_sizes) { 501 case Byte: 502 qtest_inb(s, PCI_HOST_BRIDGE_DATA); 503 break; 504 case Word: 505 qtest_inw(s, PCI_HOST_BRIDGE_DATA); 506 break; 507 case Long: 508 qtest_inl(s, PCI_HOST_BRIDGE_DATA); 509 break; 510 } 511 } 512 513 static void op_pci_write(QTestState *s, const unsigned char * data, size_t len) 514 { 515 enum Sizes {Byte, Word, Long, end_sizes}; 516 struct { 517 uint8_t size; 518 uint8_t base; 519 uint8_t offset; 520 uint32_t value; 521 } a; 522 if (len < sizeof(a) || fuzzable_pci_devices->len == 0 || pci_disabled) { 523 return; 524 } 525 memcpy(&a, data, sizeof(a)); 526 PCIDevice *dev = g_ptr_array_index(fuzzable_pci_devices, 527 a.base % fuzzable_pci_devices->len); 528 int devfn = dev->devfn; 529 qtest_outl(s, PCI_HOST_BRIDGE_CFG, (1U << 31) | (devfn << 8) | a.offset); 530 switch (a.size %= end_sizes) { 531 case Byte: 532 qtest_outb(s, PCI_HOST_BRIDGE_DATA, a.value & 0xFF); 533 break; 534 case Word: 535 qtest_outw(s, PCI_HOST_BRIDGE_DATA, a.value & 0xFFFF); 536 break; 537 case Long: 538 qtest_outl(s, PCI_HOST_BRIDGE_DATA, a.value & 0xFFFFFFFF); 539 break; 540 } 541 } 542 543 static void op_add_dma_pattern(QTestState *s, 544 const unsigned char *data, size_t len) 545 { 546 struct { 547 /* 548 * index and stride can be used to increment the index-th byte of the 549 * pattern by the value stride, for each loop of the pattern. 550 */ 551 uint8_t index; 552 uint8_t stride; 553 } a; 554 555 if (len < sizeof(a) + 1) { 556 return; 557 } 558 memcpy(&a, data, sizeof(a)); 559 pattern p = {a.index, a.stride, len - sizeof(a), data + sizeof(a)}; 560 p.index = a.index % p.len; 561 g_array_append_val(dma_patterns, p); 562 return; 563 } 564 565 static void op_clear_dma_patterns(QTestState *s, 566 const unsigned char *data, size_t len) 567 { 568 g_array_set_size(dma_patterns, 0); 569 dma_pattern_index = 0; 570 } 571 572 static void op_clock_step(QTestState *s, const unsigned char *data, size_t len) 573 { 574 qtest_clock_step_next(s); 575 } 576 577 static void op_disable_pci(QTestState *s, const unsigned char *data, size_t len) 578 { 579 pci_disabled = true; 580 } 581 582 static void handle_timeout(int sig) 583 { 584 if (qtest_log_enabled) { 585 fprintf(stderr, "[Timeout]\n"); 586 fflush(stderr); 587 } 588 _Exit(0); 589 } 590 591 /* 592 * Here, we interpret random bytes from the fuzzer, as a sequence of commands. 593 * Some commands can be variable-width, so we use a separator, SEPARATOR, to 594 * specify the boundaries between commands. SEPARATOR is used to separate 595 * "operations" in the fuzz input. Why use a separator, instead of just using 596 * the operations' length to identify operation boundaries? 597 * 1. This is a simple way to support variable-length operations 598 * 2. This adds "stability" to the input. 599 * For example take the input "AbBcgDefg", where there is no separator and 600 * Opcodes are capitalized. 601 * Simply, by removing the first byte, we end up with a very different 602 * sequence: 603 * BbcGdefg... 604 * By adding a separator, we avoid this problem: 605 * Ab SEP Bcg SEP Defg -> B SEP Bcg SEP Defg 606 * Since B uses two additional bytes as operands, the first "B" will be 607 * ignored. The fuzzer actively tries to reduce inputs, so such unused 608 * bytes are likely to be pruned, eventually. 609 * 610 * SEPARATOR is trivial for the fuzzer to discover when using ASan. Optionally, 611 * SEPARATOR can be manually specified as a dictionary value (see libfuzzer's 612 * -dict), though this should not be necessary. 613 * 614 * As a result, the stream of bytes is converted into a sequence of commands. 615 * In a simplified example where SEPARATOR is 0xFF: 616 * 00 01 02 FF 03 04 05 06 FF 01 FF ... 617 * becomes this sequence of commands: 618 * 00 01 02 -> op00 (0102) -> in (0102, 2) 619 * 03 04 05 06 -> op03 (040506) -> write (040506, 3) 620 * 01 -> op01 (-,0) -> out (-,0) 621 * ... 622 * 623 * Note here that it is the job of the individual opcode functions to check 624 * that enough data was provided. I.e. in the last command out (,0), out needs 625 * to check that there is not enough data provided to select an address/value 626 * for the operation. 627 */ 628 static void generic_fuzz(QTestState *s, const unsigned char *Data, size_t Size) 629 { 630 void (*ops[]) (QTestState *s, const unsigned char* , size_t) = { 631 [OP_IN] = op_in, 632 [OP_OUT] = op_out, 633 [OP_READ] = op_read, 634 [OP_WRITE] = op_write, 635 [OP_PCI_READ] = op_pci_read, 636 [OP_PCI_WRITE] = op_pci_write, 637 [OP_DISABLE_PCI] = op_disable_pci, 638 [OP_ADD_DMA_PATTERN] = op_add_dma_pattern, 639 [OP_CLEAR_DMA_PATTERNS] = op_clear_dma_patterns, 640 [OP_CLOCK_STEP] = op_clock_step, 641 }; 642 const unsigned char *cmd = Data; 643 const unsigned char *nextcmd; 644 size_t cmd_len; 645 uint8_t op; 646 647 if (fork() == 0) { 648 /* 649 * Sometimes the fuzzer will find inputs that take quite a long time to 650 * process. Often times, these inputs do not result in new coverage. 651 * Even if these inputs might be interesting, they can slow down the 652 * fuzzer, overall. Set a timeout to avoid hurting performance, too much 653 */ 654 if (timeout) { 655 struct sigaction sact; 656 struct itimerval timer; 657 658 sigemptyset(&sact.sa_mask); 659 sact.sa_flags = SA_NODEFER; 660 sact.sa_handler = handle_timeout; 661 sigaction(SIGALRM, &sact, NULL); 662 663 memset(&timer, 0, sizeof(timer)); 664 timer.it_value.tv_sec = timeout / USEC_IN_SEC; 665 timer.it_value.tv_usec = timeout % USEC_IN_SEC; 666 setitimer(ITIMER_VIRTUAL, &timer, NULL); 667 } 668 669 op_clear_dma_patterns(s, NULL, 0); 670 pci_disabled = false; 671 672 while (cmd && Size) { 673 /* Get the length until the next command or end of input */ 674 nextcmd = memmem(cmd, Size, SEPARATOR, strlen(SEPARATOR)); 675 cmd_len = nextcmd ? nextcmd - cmd : Size; 676 677 if (cmd_len > 0) { 678 /* Interpret the first byte of the command as an opcode */ 679 op = *cmd % (sizeof(ops) / sizeof((ops)[0])); 680 ops[op](s, cmd + 1, cmd_len - 1); 681 682 /* Run the main loop */ 683 flush_events(s); 684 } 685 /* Advance to the next command */ 686 cmd = nextcmd ? nextcmd + sizeof(SEPARATOR) - 1 : nextcmd; 687 Size = Size - (cmd_len + sizeof(SEPARATOR) - 1); 688 g_array_set_size(dma_regions, 0); 689 } 690 _Exit(0); 691 } else { 692 flush_events(s); 693 wait(0); 694 } 695 } 696 697 static void usage(void) 698 { 699 printf("Please specify the following environment variables:\n"); 700 printf("QEMU_FUZZ_ARGS= the command line arguments passed to qemu\n"); 701 printf("QEMU_FUZZ_OBJECTS= " 702 "a space separated list of QOM type names for objects to fuzz\n"); 703 printf("Optionally: QEMU_AVOID_DOUBLE_FETCH= " 704 "Try to avoid racy DMA double fetch bugs? %d by default\n", 705 avoid_double_fetches); 706 printf("Optionally: QEMU_FUZZ_TIMEOUT= Specify a custom timeout (us). " 707 "0 to disable. %d by default\n", timeout); 708 exit(0); 709 } 710 711 static int locate_fuzz_memory_regions(Object *child, void *opaque) 712 { 713 const char *name; 714 MemoryRegion *mr; 715 if (object_dynamic_cast(child, TYPE_MEMORY_REGION)) { 716 mr = MEMORY_REGION(child); 717 if ((memory_region_is_ram(mr) || 718 memory_region_is_ram_device(mr) || 719 memory_region_is_rom(mr)) == false) { 720 name = object_get_canonical_path_component(child); 721 /* 722 * We don't want duplicate pointers to the same MemoryRegion, so 723 * try to remove copies of the pointer, before adding it. 724 */ 725 g_hash_table_insert(fuzzable_memoryregions, mr, (gpointer)true); 726 } 727 } 728 return 0; 729 } 730 731 static int locate_fuzz_objects(Object *child, void *opaque) 732 { 733 char *pattern = opaque; 734 if (g_pattern_match_simple(pattern, object_get_typename(child))) { 735 /* Find and save ptrs to any child MemoryRegions */ 736 object_child_foreach_recursive(child, locate_fuzz_memory_regions, NULL); 737 738 /* 739 * We matched an object. If its a PCI device, store a pointer to it so 740 * we can map BARs and fuzz its config space. 741 */ 742 if (object_dynamic_cast(OBJECT(child), TYPE_PCI_DEVICE)) { 743 /* 744 * Don't want duplicate pointers to the same PCIDevice, so remove 745 * copies of the pointer, before adding it. 746 */ 747 g_ptr_array_remove_fast(fuzzable_pci_devices, PCI_DEVICE(child)); 748 g_ptr_array_add(fuzzable_pci_devices, PCI_DEVICE(child)); 749 } 750 } else if (object_dynamic_cast(OBJECT(child), TYPE_MEMORY_REGION)) { 751 if (g_pattern_match_simple(pattern, 752 object_get_canonical_path_component(child))) { 753 MemoryRegion *mr; 754 mr = MEMORY_REGION(child); 755 if ((memory_region_is_ram(mr) || 756 memory_region_is_ram_device(mr) || 757 memory_region_is_rom(mr)) == false) { 758 g_hash_table_insert(fuzzable_memoryregions, mr, (gpointer)true); 759 } 760 } 761 } 762 return 0; 763 } 764 765 static void generic_pre_fuzz(QTestState *s) 766 { 767 GHashTableIter iter; 768 MemoryRegion *mr; 769 char **result; 770 771 if (!getenv("QEMU_FUZZ_OBJECTS")) { 772 usage(); 773 } 774 if (getenv("QTEST_LOG")) { 775 qtest_log_enabled = 1; 776 } 777 if (getenv("QEMU_AVOID_DOUBLE_FETCH")) { 778 avoid_double_fetches = 1; 779 } 780 if (getenv("QEMU_FUZZ_TIMEOUT")) { 781 timeout = g_ascii_strtoll(getenv("QEMU_FUZZ_TIMEOUT"), NULL, 0); 782 } 783 qts_global = s; 784 785 dma_regions = g_array_new(false, false, sizeof(address_range)); 786 dma_patterns = g_array_new(false, false, sizeof(pattern)); 787 788 fuzzable_memoryregions = g_hash_table_new(NULL, NULL); 789 fuzzable_pci_devices = g_ptr_array_new(); 790 791 result = g_strsplit(getenv("QEMU_FUZZ_OBJECTS"), " ", -1); 792 for (int i = 0; result[i] != NULL; i++) { 793 printf("Matching objects by name %s\n", result[i]); 794 object_child_foreach_recursive(qdev_get_machine(), 795 locate_fuzz_objects, 796 result[i]); 797 } 798 g_strfreev(result); 799 printf("This process will try to fuzz the following MemoryRegions:\n"); 800 801 g_hash_table_iter_init(&iter, fuzzable_memoryregions); 802 while (g_hash_table_iter_next(&iter, (gpointer)&mr, NULL)) { 803 printf(" * %s (size %lx)\n", 804 object_get_canonical_path_component(&(mr->parent_obj)), 805 (uint64_t)mr->size); 806 } 807 808 if (!g_hash_table_size(fuzzable_memoryregions)) { 809 printf("No fuzzable memory regions found...\n"); 810 exit(1); 811 } 812 813 counter_shm_init(); 814 } 815 816 /* 817 * When libfuzzer gives us two inputs to combine, return a new input with the 818 * following structure: 819 * 820 * Input 1 (data1) 821 * SEPARATOR 822 * Clear out the DMA Patterns 823 * SEPARATOR 824 * Disable the pci_read/write instructions 825 * SEPARATOR 826 * Input 2 (data2) 827 * 828 * The idea is to collate the core behaviors of the two inputs. 829 * For example: 830 * Input 1: maps a device's BARs, sets up three DMA patterns, and triggers 831 * device functionality A 832 * Input 2: maps a device's BARs, sets up one DMA pattern, and triggers device 833 * functionality B 834 * 835 * This function attempts to produce an input that: 836 * Ouptut: maps a device's BARs, set up three DMA patterns, triggers 837 * functionality A device, replaces the DMA patterns with a single 838 * patten, and triggers device functionality B. 839 */ 840 static size_t generic_fuzz_crossover(const uint8_t *data1, size_t size1, const 841 uint8_t *data2, size_t size2, uint8_t *out, 842 size_t max_out_size, unsigned int seed) 843 { 844 size_t copy_len = 0, size = 0; 845 846 /* Check that we have enough space for data1 and at least part of data2 */ 847 if (max_out_size <= size1 + strlen(SEPARATOR) * 3 + 2) { 848 return 0; 849 } 850 851 /* Copy_Len in the first input */ 852 copy_len = size1; 853 memcpy(out + size, data1, copy_len); 854 size += copy_len; 855 max_out_size -= copy_len; 856 857 /* Append a separator */ 858 copy_len = strlen(SEPARATOR); 859 memcpy(out + size, SEPARATOR, copy_len); 860 size += copy_len; 861 max_out_size -= copy_len; 862 863 /* Clear out the DMA Patterns */ 864 copy_len = 1; 865 if (copy_len) { 866 out[size] = OP_CLEAR_DMA_PATTERNS; 867 } 868 size += copy_len; 869 max_out_size -= copy_len; 870 871 /* Append a separator */ 872 copy_len = strlen(SEPARATOR); 873 memcpy(out + size, SEPARATOR, copy_len); 874 size += copy_len; 875 max_out_size -= copy_len; 876 877 /* Disable PCI ops. Assume data1 took care of setting up PCI */ 878 copy_len = 1; 879 if (copy_len) { 880 out[size] = OP_DISABLE_PCI; 881 } 882 size += copy_len; 883 max_out_size -= copy_len; 884 885 /* Append a separator */ 886 copy_len = strlen(SEPARATOR); 887 memcpy(out + size, SEPARATOR, copy_len); 888 size += copy_len; 889 max_out_size -= copy_len; 890 891 /* Copy_Len over the second input */ 892 copy_len = MIN(size2, max_out_size); 893 memcpy(out + size, data2, copy_len); 894 size += copy_len; 895 max_out_size -= copy_len; 896 897 return size; 898 } 899 900 901 static GString *generic_fuzz_cmdline(FuzzTarget *t) 902 { 903 GString *cmd_line = g_string_new(TARGET_NAME); 904 if (!getenv("QEMU_FUZZ_ARGS")) { 905 usage(); 906 } 907 g_string_append_printf(cmd_line, " -display none \ 908 -machine accel=qtest, \ 909 -m 512M %s ", getenv("QEMU_FUZZ_ARGS")); 910 return cmd_line; 911 } 912 913 static GString *generic_fuzz_predefined_config_cmdline(FuzzTarget *t) 914 { 915 const generic_fuzz_config *config; 916 g_assert(t->opaque); 917 918 config = t->opaque; 919 setenv("QEMU_FUZZ_ARGS", config->args, 1); 920 setenv("QEMU_FUZZ_OBJECTS", config->objects, 1); 921 return generic_fuzz_cmdline(t); 922 } 923 924 static void register_generic_fuzz_targets(void) 925 { 926 fuzz_add_target(&(FuzzTarget){ 927 .name = "generic-fuzz", 928 .description = "Fuzz based on any qemu command-line args. ", 929 .get_init_cmdline = generic_fuzz_cmdline, 930 .pre_fuzz = generic_pre_fuzz, 931 .fuzz = generic_fuzz, 932 .crossover = generic_fuzz_crossover 933 }); 934 935 GString *name; 936 const generic_fuzz_config *config; 937 938 for (int i = 0; 939 i < sizeof(predefined_configs) / sizeof(generic_fuzz_config); 940 i++) { 941 config = predefined_configs + i; 942 name = g_string_new("generic-fuzz"); 943 g_string_append_printf(name, "-%s", config->name); 944 fuzz_add_target(&(FuzzTarget){ 945 .name = name->str, 946 .description = "Predefined generic-fuzz config.", 947 .get_init_cmdline = generic_fuzz_predefined_config_cmdline, 948 .pre_fuzz = generic_pre_fuzz, 949 .fuzz = generic_fuzz, 950 .crossover = generic_fuzz_crossover, 951 .opaque = (void *)config 952 }); 953 } 954 } 955 956 fuzz_target_init(register_generic_fuzz_targets); 957