1 /*
2  * Generic Virtual-Device Fuzzing Target Configs
3  *
4  * Copyright Red Hat Inc., 2020
5  *
6  * Authors:
7  *  Alexander Bulekov   <alxndr@bu.edu>
8  *
9  * This work is licensed under the terms of the GNU GPL, version 2 or later.
10  * See the COPYING file in the top-level directory.
11  */
12 
13 #ifndef GENERIC_FUZZ_CONFIGS_H
14 #define GENERIC_FUZZ_CONFIGS_H
15 
16 
17 typedef struct generic_fuzz_config {
18     const char *name, *args, *objects;
19     gchar* (*argfunc)(void); /* Result must be freeable by g_free() */
20 } generic_fuzz_config;
21 
22 static inline gchar *generic_fuzzer_virtio_9p_args(void){
23     g_autofree char *tmpdir = g_dir_make_tmp("qemu-fuzz.XXXXXX", NULL);
24     g_assert_nonnull(tmpdir);
25 
26     return g_strdup_printf("-machine q35 -nodefaults "
27     "-device virtio-9p,fsdev=hshare,mount_tag=hshare "
28     "-fsdev local,id=hshare,path=%s,security_model=mapped-xattr,"
29     "writeout=immediate,fmode=0600,dmode=0700", tmpdir);
30 }
31 
32 const generic_fuzz_config predefined_configs[] = {
33     {
34         .name = "virtio-net-pci-slirp",
35         .args = "-M q35 -nodefaults "
36         "-device virtio-net,netdev=net0 -netdev user,id=net0",
37         .objects = "virtio*",
38     },{
39         .name = "virtio-blk",
40         .args = "-machine q35 -device virtio-blk,drive=disk0 "
41         "-drive file=null-co://,id=disk0,if=none,format=raw",
42         .objects = "virtio*",
43     },{
44         .name = "virtio-scsi",
45         .args = "-machine q35 -device virtio-scsi,num_queues=8 "
46         "-device scsi-hd,drive=disk0 "
47         "-drive file=null-co://,id=disk0,if=none,format=raw",
48         .objects = "scsi* virtio*",
49     },{
50         .name = "virtio-gpu",
51         .args = "-machine q35 -nodefaults -device virtio-gpu",
52         .objects = "virtio*",
53     },{
54         .name = "virtio-vga",
55         .args = "-machine q35 -nodefaults -device virtio-vga",
56         .objects = "virtio*",
57     },{
58         .name = "virtio-rng",
59         .args = "-machine q35 -nodefaults -device virtio-rng",
60         .objects = "virtio*",
61     },{
62         .name = "virtio-balloon",
63         .args = "-machine q35 -nodefaults -device virtio-balloon",
64         .objects = "virtio*",
65     },{
66         .name = "virtio-serial",
67         .args = "-machine q35 -nodefaults -device virtio-serial",
68         .objects = "virtio*",
69     },{
70         .name = "virtio-mouse",
71         .args = "-machine q35 -nodefaults -device virtio-mouse",
72         .objects = "virtio*",
73     },{
74         .name = "virtio-9p",
75         .argfunc = generic_fuzzer_virtio_9p_args,
76         .objects = "virtio*",
77     },{
78         .name = "virtio-9p-synth",
79         .args = "-machine q35 -nodefaults "
80         "-device virtio-9p,fsdev=hshare,mount_tag=hshare "
81         "-fsdev synth,id=hshare",
82         .objects = "virtio*",
83     },{
84         .name = "e1000",
85         .args = "-M q35 -nodefaults "
86         "-device e1000,netdev=net0 -netdev user,id=net0",
87         .objects = "e1000",
88     },{
89         .name = "e1000e",
90         .args = "-M q35 -nodefaults "
91         "-device e1000e,netdev=net0 -netdev user,id=net0",
92         .objects = "e1000e",
93     },{
94         .name = "igb",
95         .args = "-M q35 -nodefaults "
96         "-device igb,netdev=net0 -netdev user,id=net0",
97         .objects = "igb",
98     },{
99         .name = "cirrus-vga",
100         .args = "-machine q35 -nodefaults -device cirrus-vga",
101         .objects = "cirrus*",
102     },{
103         .name = "bochs-display",
104         .args = "-machine q35 -nodefaults -device bochs-display",
105         .objects = "bochs*",
106     },{
107         .name = "intel-hda",
108         .args = "-machine q35 -nodefaults -device intel-hda,id=hda0 "
109         "-audiodev driver=none,id=audio0",
110         "-device hda-output,bus=hda0.0,audiodev=audio0 "
111         "-device hda-micro,bus=hda0.0,audiodev=audio0 "
112         "-device hda-duplex,bus=hda0.0,audiodev=audio0",
113         .objects = "intel-hda",
114     },{
115         .name = "ide-hd",
116         .args = "-machine pc -nodefaults "
117         "-drive file=null-co://,if=none,format=raw,id=disk0 "
118         "-device ide-hd,drive=disk0",
119         .objects = "*ide*",
120     },{
121         .name = "ide-atapi",
122         .args = "-machine pc -nodefaults "
123         "-drive file=null-co://,if=none,format=raw,id=disk0 "
124         "-device ide-cd,drive=disk0",
125         .objects = "*ide*",
126     },{
127         .name = "ahci-hd",
128         .args = "-machine q35 -nodefaults "
129         "-drive file=null-co://,if=none,format=raw,id=disk0 "
130         "-device ide-hd,drive=disk0",
131         .objects = "*ahci*",
132     },{
133         .name = "ahci-atapi",
134         .args = "-machine q35 -nodefaults "
135         "-drive file=null-co://,if=none,format=raw,id=disk0 "
136         "-device ide-cd,drive=disk0",
137         .objects = "*ahci*",
138     },{
139         .name = "floppy",
140         .args = "-machine pc -nodefaults -device floppy,id=floppy0 "
141         "-drive id=disk0,file=null-co://,file.read-zeroes=on,if=none,format=raw "
142         "-device floppy,drive=disk0,drive-type=288",
143         .objects = "fd* floppy* i8257",
144     },{
145         .name = "xhci",
146         .args = "-machine q35 -nodefaults "
147         "-drive file=null-co://,if=none,format=raw,id=disk0 "
148         "-device qemu-xhci,id=xhci -device usb-tablet,bus=xhci.0 "
149         "-device usb-bot -device usb-storage,drive=disk0 "
150         "-chardev null,id=cd0 -chardev null,id=cd1 "
151         "-device usb-braille,chardev=cd0 -device usb-ccid -device usb-ccid "
152         "-device usb-kbd -device usb-mouse -device usb-serial,chardev=cd1 "
153         "-device usb-tablet -device usb-wacom-tablet "
154         "-device usb-audio,audiodev=snd0 -audiodev none,id=snd0",
155         .objects = "*usb* *uhci* *xhci*",
156     },{
157         .name = "pc-i440fx",
158         .args = "-machine pc",
159         .objects = "*",
160     },{
161         .name = "pc-q35",
162         .args = "-machine q35",
163         .objects = "*",
164     },{
165         .name = "vmxnet3",
166         .args = "-machine q35 -nodefaults "
167         "-device vmxnet3,netdev=net0 -netdev user,id=net0",
168         .objects = "vmxnet3"
169     },{
170         .name = "ne2k_pci",
171         .args = "-machine q35 -nodefaults "
172         "-device ne2k_pci,netdev=net0 -netdev user,id=net0",
173         .objects = "ne2k*"
174     },{
175         .name = "pcnet",
176         .args = "-machine q35 -nodefaults "
177         "-device pcnet,netdev=net0 -netdev user,id=net0",
178         .objects = "pcnet"
179     },{
180         .name = "rtl8139",
181         .args = "-machine q35 -nodefaults "
182         "-device rtl8139,netdev=net0 -netdev user,id=net0",
183         .objects = "rtl8139"
184     },{
185         .name = "i82550",
186         .args = "-machine q35 -nodefaults "
187         "-device i82550,netdev=net0 -netdev user,id=net0",
188         .objects = "i8255*"
189     },{
190         .name = "sdhci-v3",
191         .args = "-nodefaults -device sdhci-pci,sd-spec-version=3 "
192         "-device sd-card,drive=mydrive "
193         "-drive if=none,index=0,file=null-co://,format=raw,id=mydrive -nographic",
194         .objects = "sd*"
195     },{
196         .name = "ehci",
197         .args = "-machine q35 -nodefaults "
198         "-device ich9-usb-ehci1,bus=pcie.0,addr=1d.7,"
199         "multifunction=on,id=ich9-ehci-1 "
200         "-device ich9-usb-uhci1,bus=pcie.0,addr=1d.0,"
201         "multifunction=on,masterbus=ich9-ehci-1.0,firstport=0 "
202         "-device ich9-usb-uhci2,bus=pcie.0,addr=1d.1,"
203         "multifunction=on,masterbus=ich9-ehci-1.0,firstport=2 "
204         "-device ich9-usb-uhci3,bus=pcie.0,addr=1d.2,"
205         "multifunction=on,masterbus=ich9-ehci-1.0,firstport=4 "
206         "-drive if=none,id=usbcdrom,media=cdrom "
207         "-device usb-tablet,bus=ich9-ehci-1.0,port=1,usb_version=1 "
208         "-device usb-storage,bus=ich9-ehci-1.0,port=2,drive=usbcdrom",
209         .objects = "*usb* *hci*",
210     },{
211         .name = "ohci",
212         .args = "-machine q35 -nodefaults  -device pci-ohci -device usb-kbd",
213         .objects = "*usb* *ohci*",
214     },{
215         .name = "megaraid",
216         .args = "-machine q35 -nodefaults -device megasas -device scsi-cd,drive=null0 "
217         "-blockdev driver=null-co,read-zeroes=on,node-name=null0",
218         .objects = "megasas*",
219     },{
220         .name = "am53c974",
221         .args = "-device am53c974,id=scsi -device scsi-hd,drive=disk0 "
222                  "-drive id=disk0,if=none,file=null-co://,format=raw "
223                  "-nodefaults",
224         .objects = "*esp* *scsi* *am53c974*",
225     },{
226         .name = "ac97",
227         .args = "-machine q35 -nodefaults "
228         "-device ac97,audiodev=snd0 -audiodev none,id=snd0 -nodefaults",
229         .objects = "ac97*",
230     },{
231         .name = "cs4231a",
232         .args = "-machine q35 -nodefaults "
233         "-device cs4231a,audiodev=snd0 -audiodev none,id=snd0 -nodefaults",
234         .objects = "cs4231a* i8257*",
235     },{
236         .name = "es1370",
237         .args = "-machine q35 -nodefaults "
238         "-device es1370,audiodev=snd0 -audiodev none,id=snd0 -nodefaults",
239         .objects = "es1370*",
240     },{
241         .name = "sb16",
242         .args = "-machine q35 -nodefaults "
243         "-device sb16,audiodev=snd0 -audiodev none,id=snd0 -nodefaults",
244         .objects = "sb16* i8257*",
245     },{
246         .name = "parallel",
247         .args = "-machine q35 -nodefaults "
248         "-parallel file:/dev/null",
249         .objects = "parallel*",
250     }
251 };
252 
253 #endif
254