1b1db8c63SAlexander Bulekov /*
2b1db8c63SAlexander Bulekov * virtio-net Fuzzing Target
3b1db8c63SAlexander Bulekov *
4b1db8c63SAlexander Bulekov * Copyright Red Hat Inc., 2019
5b1db8c63SAlexander Bulekov *
6b1db8c63SAlexander Bulekov * Authors:
7b1db8c63SAlexander Bulekov * Alexander Bulekov <alxndr@bu.edu>
8b1db8c63SAlexander Bulekov *
9b1db8c63SAlexander Bulekov * This work is licensed under the terms of the GNU GPL, version 2 or later.
10b1db8c63SAlexander Bulekov * See the COPYING file in the top-level directory.
11b1db8c63SAlexander Bulekov */
12b1db8c63SAlexander Bulekov
13b1db8c63SAlexander Bulekov #include "qemu/osdep.h"
14b1db8c63SAlexander Bulekov
15b1db8c63SAlexander Bulekov #include "standard-headers/linux/virtio_config.h"
16907b5105SMarc-André Lureau #include "tests/qtest/libqtest.h"
17b1db8c63SAlexander Bulekov #include "tests/qtest/libqos/virtio-net.h"
18b1db8c63SAlexander Bulekov #include "fuzz.h"
19b1db8c63SAlexander Bulekov #include "qos_fuzz.h"
20b1db8c63SAlexander Bulekov
21b1db8c63SAlexander Bulekov
22b1db8c63SAlexander Bulekov #define QVIRTIO_NET_TIMEOUT_US (30 * 1000 * 1000)
23b1db8c63SAlexander Bulekov #define QVIRTIO_RX_VQ 0
24b1db8c63SAlexander Bulekov #define QVIRTIO_TX_VQ 1
25b1db8c63SAlexander Bulekov #define QVIRTIO_CTRL_VQ 2
26b1db8c63SAlexander Bulekov
27b1db8c63SAlexander Bulekov static int sockfds[2];
28b1db8c63SAlexander Bulekov static bool sockfds_initialized;
29b1db8c63SAlexander Bulekov
virtio_net_fuzz_multi(QTestState * s,const unsigned char * Data,size_t Size,bool check_used)30b1db8c63SAlexander Bulekov static void virtio_net_fuzz_multi(QTestState *s,
31b1db8c63SAlexander Bulekov const unsigned char *Data, size_t Size, bool check_used)
32b1db8c63SAlexander Bulekov {
33b1db8c63SAlexander Bulekov typedef struct vq_action {
34b1db8c63SAlexander Bulekov uint8_t queue;
35b1db8c63SAlexander Bulekov uint8_t length;
36b1db8c63SAlexander Bulekov uint8_t write;
37b1db8c63SAlexander Bulekov uint8_t next;
38b1db8c63SAlexander Bulekov uint8_t rx;
39b1db8c63SAlexander Bulekov } vq_action;
40b1db8c63SAlexander Bulekov
41b1db8c63SAlexander Bulekov uint32_t free_head = 0;
42b1db8c63SAlexander Bulekov
43b1db8c63SAlexander Bulekov QGuestAllocator *t_alloc = fuzz_qos_alloc;
44b1db8c63SAlexander Bulekov
45b1db8c63SAlexander Bulekov QVirtioNet *net_if = fuzz_qos_obj;
46b1db8c63SAlexander Bulekov QVirtioDevice *dev = net_if->vdev;
47b1db8c63SAlexander Bulekov QVirtQueue *q;
48b1db8c63SAlexander Bulekov vq_action vqa;
49b1db8c63SAlexander Bulekov while (Size >= sizeof(vqa)) {
50b1db8c63SAlexander Bulekov memcpy(&vqa, Data, sizeof(vqa));
51b1db8c63SAlexander Bulekov Data += sizeof(vqa);
52b1db8c63SAlexander Bulekov Size -= sizeof(vqa);
53b1db8c63SAlexander Bulekov
54b1db8c63SAlexander Bulekov q = net_if->queues[vqa.queue % 3];
55b1db8c63SAlexander Bulekov
56b1db8c63SAlexander Bulekov vqa.length = vqa.length >= Size ? Size : vqa.length;
57b1db8c63SAlexander Bulekov
58b1db8c63SAlexander Bulekov /*
59b1db8c63SAlexander Bulekov * Only attempt to write incoming packets, when using the socket
60b1db8c63SAlexander Bulekov * backend. Otherwise, always place the input on a virtqueue.
61b1db8c63SAlexander Bulekov */
62b1db8c63SAlexander Bulekov if (vqa.rx && sockfds_initialized) {
6364ed6f92SPaolo Bonzini int ignored = write(sockfds[0], Data, vqa.length);
6464ed6f92SPaolo Bonzini (void) ignored;
65b1db8c63SAlexander Bulekov } else {
66b1db8c63SAlexander Bulekov vqa.rx = 0;
67b1db8c63SAlexander Bulekov uint64_t req_addr = guest_alloc(t_alloc, vqa.length);
68b1db8c63SAlexander Bulekov /*
69b1db8c63SAlexander Bulekov * If checking used ring, ensure that the fuzzer doesn't trigger
70b1db8c63SAlexander Bulekov * trivial asserion failure on zero-zied buffer
71b1db8c63SAlexander Bulekov */
72b1db8c63SAlexander Bulekov qtest_memwrite(s, req_addr, Data, vqa.length);
73b1db8c63SAlexander Bulekov
74b1db8c63SAlexander Bulekov
75b1db8c63SAlexander Bulekov free_head = qvirtqueue_add(s, q, req_addr, vqa.length,
76b1db8c63SAlexander Bulekov vqa.write, vqa.next);
77b1db8c63SAlexander Bulekov qvirtqueue_add(s, q, req_addr, vqa.length, vqa.write , vqa.next);
78b1db8c63SAlexander Bulekov qvirtqueue_kick(s, dev, q, free_head);
79b1db8c63SAlexander Bulekov }
80b1db8c63SAlexander Bulekov
81b1db8c63SAlexander Bulekov /* Run the main loop */
82b1db8c63SAlexander Bulekov qtest_clock_step(s, 100);
83b1db8c63SAlexander Bulekov flush_events(s);
84b1db8c63SAlexander Bulekov
85b1db8c63SAlexander Bulekov /* Wait on used descriptors */
86b1db8c63SAlexander Bulekov if (check_used && !vqa.rx) {
87b1db8c63SAlexander Bulekov gint64 start_time = g_get_monotonic_time();
88b1db8c63SAlexander Bulekov /*
89b1db8c63SAlexander Bulekov * normally, we could just use qvirtio_wait_used_elem, but since we
90b1db8c63SAlexander Bulekov * must manually run the main-loop for all the bhs to run, we use
91b1db8c63SAlexander Bulekov * this hack with flush_events(), to run the main_loop
92b1db8c63SAlexander Bulekov */
93b1db8c63SAlexander Bulekov while (!vqa.rx && q != net_if->queues[QVIRTIO_RX_VQ]) {
94b1db8c63SAlexander Bulekov uint32_t got_desc_idx;
95b1db8c63SAlexander Bulekov /* Input led to a virtio_error */
96b1db8c63SAlexander Bulekov if (dev->bus->get_status(dev) & VIRTIO_CONFIG_S_NEEDS_RESET) {
97b1db8c63SAlexander Bulekov break;
98b1db8c63SAlexander Bulekov }
99b1db8c63SAlexander Bulekov if (dev->bus->get_queue_isr_status(dev, q) &&
100b1db8c63SAlexander Bulekov qvirtqueue_get_buf(s, q, &got_desc_idx, NULL)) {
101b1db8c63SAlexander Bulekov g_assert_cmpint(got_desc_idx, ==, free_head);
102b1db8c63SAlexander Bulekov break;
103b1db8c63SAlexander Bulekov }
104b1db8c63SAlexander Bulekov g_assert(g_get_monotonic_time() - start_time
105b1db8c63SAlexander Bulekov <= QVIRTIO_NET_TIMEOUT_US);
106b1db8c63SAlexander Bulekov
107b1db8c63SAlexander Bulekov /* Run the main loop */
108b1db8c63SAlexander Bulekov qtest_clock_step(s, 100);
109b1db8c63SAlexander Bulekov flush_events(s);
110b1db8c63SAlexander Bulekov }
111b1db8c63SAlexander Bulekov }
112b1db8c63SAlexander Bulekov Data += vqa.length;
113b1db8c63SAlexander Bulekov Size -= vqa.length;
114b1db8c63SAlexander Bulekov }
115b1db8c63SAlexander Bulekov }
116b1db8c63SAlexander Bulekov
117b1db8c63SAlexander Bulekov
virtio_net_fuzz_check_used(QTestState * s,const unsigned char * Data,size_t Size)118*5f47d07fSAlexander Bulekov static void virtio_net_fuzz_check_used(QTestState *s,
119b1db8c63SAlexander Bulekov const unsigned char *Data, size_t Size)
120b1db8c63SAlexander Bulekov {
121b1db8c63SAlexander Bulekov virtio_net_fuzz_multi(s, Data, Size, true);
122b1db8c63SAlexander Bulekov flush_events(s);
123*5f47d07fSAlexander Bulekov fuzz_reset(s);
124b1db8c63SAlexander Bulekov }
125b1db8c63SAlexander Bulekov
virtio_net_pre_fuzz(QTestState * s)126b1db8c63SAlexander Bulekov static void virtio_net_pre_fuzz(QTestState *s)
127b1db8c63SAlexander Bulekov {
128b1db8c63SAlexander Bulekov qos_init_path(s);
129b1db8c63SAlexander Bulekov }
130b1db8c63SAlexander Bulekov
virtio_net_test_setup_socket(GString * cmd_line,void * arg)131b1db8c63SAlexander Bulekov static void *virtio_net_test_setup_socket(GString *cmd_line, void *arg)
132b1db8c63SAlexander Bulekov {
133b1db8c63SAlexander Bulekov int ret = socketpair(PF_UNIX, SOCK_STREAM, 0, sockfds);
134b1db8c63SAlexander Bulekov g_assert_cmpint(ret, !=, -1);
13522e135fcSMarc-André Lureau g_unix_set_fd_nonblocking(sockfds[0], true, NULL);
136b1db8c63SAlexander Bulekov sockfds_initialized = true;
137b1db8c63SAlexander Bulekov g_string_append_printf(cmd_line, " -netdev socket,fd=%d,id=hs0 ",
138b1db8c63SAlexander Bulekov sockfds[1]);
139b1db8c63SAlexander Bulekov return arg;
140b1db8c63SAlexander Bulekov }
141b1db8c63SAlexander Bulekov
register_virtio_net_fuzz_targets(void)142b1db8c63SAlexander Bulekov static void register_virtio_net_fuzz_targets(void)
143b1db8c63SAlexander Bulekov {
144b1db8c63SAlexander Bulekov
145b1db8c63SAlexander Bulekov fuzz_add_qos_target(&(FuzzTarget){
146b1db8c63SAlexander Bulekov .name = "virtio-net-socket-check-used",
147b1db8c63SAlexander Bulekov .description = "Fuzz the virtio-net virtual queues. Wait for the "
148b1db8c63SAlexander Bulekov "descriptors to be used. Timeout may indicate improperly handled "
149b1db8c63SAlexander Bulekov "input",
150b1db8c63SAlexander Bulekov .pre_fuzz = &virtio_net_pre_fuzz,
151*5f47d07fSAlexander Bulekov .fuzz = virtio_net_fuzz_check_used,},
152b1db8c63SAlexander Bulekov "virtio-net",
153b1db8c63SAlexander Bulekov &(QOSGraphTestOptions){.before = virtio_net_test_setup_socket}
154b1db8c63SAlexander Bulekov );
155b1db8c63SAlexander Bulekov }
156b1db8c63SAlexander Bulekov
157b1db8c63SAlexander Bulekov fuzz_target_init(register_virtio_net_fuzz_targets);
158