1 /* 2 * virtio-serial Fuzzing Target 3 * 4 * Copyright Red Hat Inc., 2019 5 * 6 * Authors: 7 * Alexander Bulekov <alxndr@bu.edu> 8 * 9 * This work is licensed under the terms of the GNU GPL, version 2 or later. 10 * See the COPYING file in the top-level directory. 11 */ 12 13 #include "qemu/osdep.h" 14 15 #include "tests/qtest/libqtest.h" 16 #include "libqos/virtio-scsi.h" 17 #include "libqos/virtio.h" 18 #include "libqos/virtio-pci.h" 19 #include "standard-headers/linux/virtio_ids.h" 20 #include "standard-headers/linux/virtio_pci.h" 21 #include "standard-headers/linux/virtio_scsi.h" 22 #include "fuzz.h" 23 #include "fork_fuzz.h" 24 #include "qos_fuzz.h" 25 26 #define PCI_SLOT 0x02 27 #define PCI_FN 0x00 28 #define QVIRTIO_SCSI_TIMEOUT_US (1 * 1000 * 1000) 29 30 #define MAX_NUM_QUEUES 64 31 32 /* Based on tests/virtio-scsi-test.c */ 33 typedef struct { 34 int num_queues; 35 QVirtQueue *vq[MAX_NUM_QUEUES + 2]; 36 } QVirtioSCSIQueues; 37 38 static QVirtioSCSIQueues *qvirtio_scsi_init(QVirtioDevice *dev, uint64_t mask) 39 { 40 QVirtioSCSIQueues *vs; 41 uint64_t feat; 42 int i; 43 44 vs = g_new0(QVirtioSCSIQueues, 1); 45 46 feat = qvirtio_get_features(dev); 47 if (mask) { 48 feat &= ~QVIRTIO_F_BAD_FEATURE | mask; 49 } else { 50 feat &= ~(QVIRTIO_F_BAD_FEATURE | (1ull << VIRTIO_RING_F_EVENT_IDX)); 51 } 52 qvirtio_set_features(dev, feat); 53 54 vs->num_queues = qvirtio_config_readl(dev, 0); 55 56 for (i = 0; i < vs->num_queues + 2; i++) { 57 vs->vq[i] = qvirtqueue_setup(dev, fuzz_qos_alloc, i); 58 } 59 60 qvirtio_set_driver_ok(dev); 61 62 return vs; 63 } 64 65 static void virtio_scsi_fuzz(QTestState *s, QVirtioSCSIQueues* queues, 66 const unsigned char *Data, size_t Size) 67 { 68 /* 69 * Data is a sequence of random bytes. We split them up into "actions", 70 * followed by data: 71 * [vqa][dddddddd][vqa][dddd][vqa][dddddddddddd] ... 72 * The length of the data is specified by the preceding vqa.length 73 */ 74 typedef struct vq_action { 75 uint8_t queue; 76 uint8_t length; 77 uint8_t write; 78 uint8_t next; 79 uint8_t kick; 80 } vq_action; 81 82 /* Keep track of the free head for each queue we interact with */ 83 bool vq_touched[MAX_NUM_QUEUES + 2] = {0}; 84 uint32_t free_head[MAX_NUM_QUEUES + 2]; 85 86 QGuestAllocator *t_alloc = fuzz_qos_alloc; 87 88 QVirtioSCSI *scsi = fuzz_qos_obj; 89 QVirtioDevice *dev = scsi->vdev; 90 QVirtQueue *q; 91 vq_action vqa; 92 while (Size >= sizeof(vqa)) { 93 /* Copy the action, so we can normalize length, queue and flags */ 94 memcpy(&vqa, Data, sizeof(vqa)); 95 96 Data += sizeof(vqa); 97 Size -= sizeof(vqa); 98 99 vqa.queue = vqa.queue % queues->num_queues; 100 /* Cap length at the number of remaining bytes in data */ 101 vqa.length = vqa.length >= Size ? Size : vqa.length; 102 vqa.write = vqa.write & 1; 103 vqa.next = vqa.next & 1; 104 vqa.kick = vqa.kick & 1; 105 106 107 q = queues->vq[vqa.queue]; 108 109 /* Copy the data into ram, and place it on the virtqueue */ 110 uint64_t req_addr = guest_alloc(t_alloc, vqa.length); 111 qtest_memwrite(s, req_addr, Data, vqa.length); 112 if (vq_touched[vqa.queue] == 0) { 113 vq_touched[vqa.queue] = 1; 114 free_head[vqa.queue] = qvirtqueue_add(s, q, req_addr, vqa.length, 115 vqa.write, vqa.next); 116 } else { 117 qvirtqueue_add(s, q, req_addr, vqa.length, vqa.write , vqa.next); 118 } 119 120 if (vqa.kick) { 121 qvirtqueue_kick(s, dev, q, free_head[vqa.queue]); 122 free_head[vqa.queue] = 0; 123 } 124 Data += vqa.length; 125 Size -= vqa.length; 126 } 127 /* In the end, kick each queue we interacted with */ 128 for (int i = 0; i < MAX_NUM_QUEUES + 2; i++) { 129 if (vq_touched[i]) { 130 qvirtqueue_kick(s, dev, queues->vq[i], free_head[i]); 131 } 132 } 133 } 134 135 static void virtio_scsi_fork_fuzz(QTestState *s, 136 const unsigned char *Data, size_t Size) 137 { 138 QVirtioSCSI *scsi = fuzz_qos_obj; 139 static QVirtioSCSIQueues *queues; 140 if (!queues) { 141 queues = qvirtio_scsi_init(scsi->vdev, 0); 142 } 143 if (fork() == 0) { 144 virtio_scsi_fuzz(s, queues, Data, Size); 145 flush_events(s); 146 _Exit(0); 147 } else { 148 wait(NULL); 149 } 150 } 151 152 static void virtio_scsi_with_flag_fuzz(QTestState *s, 153 const unsigned char *Data, size_t Size) 154 { 155 QVirtioSCSI *scsi = fuzz_qos_obj; 156 static QVirtioSCSIQueues *queues; 157 158 if (fork() == 0) { 159 if (Size >= sizeof(uint64_t)) { 160 queues = qvirtio_scsi_init(scsi->vdev, *(uint64_t *)Data); 161 virtio_scsi_fuzz(s, queues, 162 Data + sizeof(uint64_t), Size - sizeof(uint64_t)); 163 flush_events(s); 164 } 165 _Exit(0); 166 } else { 167 wait(NULL); 168 } 169 } 170 171 static void virtio_scsi_pre_fuzz(QTestState *s) 172 { 173 qos_init_path(s); 174 counter_shm_init(); 175 } 176 177 static void *virtio_scsi_test_setup(GString *cmd_line, void *arg) 178 { 179 g_string_append(cmd_line, 180 " -drive file=blkdebug::null-co://," 181 "file.image.read-zeroes=on," 182 "if=none,id=dr1,format=raw,file.align=4k " 183 "-device scsi-hd,drive=dr1,lun=0,scsi-id=1"); 184 return arg; 185 } 186 187 188 static void register_virtio_scsi_fuzz_targets(void) 189 { 190 fuzz_add_qos_target(&(FuzzTarget){ 191 .name = "virtio-scsi-fuzz", 192 .description = "Fuzz the virtio-scsi virtual queues, forking" 193 "for each fuzz run", 194 .pre_vm_init = &counter_shm_init, 195 .pre_fuzz = &virtio_scsi_pre_fuzz, 196 .fuzz = virtio_scsi_fork_fuzz,}, 197 "virtio-scsi", 198 &(QOSGraphTestOptions){.before = virtio_scsi_test_setup} 199 ); 200 201 fuzz_add_qos_target(&(FuzzTarget){ 202 .name = "virtio-scsi-flags-fuzz", 203 .description = "Fuzz the virtio-scsi virtual queues, forking" 204 "for each fuzz run (also fuzzes the virtio flags)", 205 .pre_vm_init = &counter_shm_init, 206 .pre_fuzz = &virtio_scsi_pre_fuzz, 207 .fuzz = virtio_scsi_with_flag_fuzz,}, 208 "virtio-scsi", 209 &(QOSGraphTestOptions){.before = virtio_scsi_test_setup} 210 ); 211 } 212 213 fuzz_target_init(register_virtio_scsi_fuzz_targets); 214