From: "Bulekov, Alexander" <alxndr@bu.edu>
To: "qemu-devel@nongnu.org" <qemu-devel@nongnu.org>
Cc: Laurent Vivier <lvivier@redhat.com>,
Thomas Huth <thuth@redhat.com>,
"Bulekov, Alexander" <alxndr@bu.edu>,
"bsd@redhat.com" <bsd@redhat.com>,
"stefanha@redhat.com" <stefanha@redhat.com>,
"pbonzini@redhat.com" <pbonzini@redhat.com>
Subject: [PATCH v7 20/20] fuzz: add virtio-scsi fuzz target
Date: Mon, 20 Jan 2020 05:55:13 +0000 [thread overview]
Message-ID: <20200120055410.22322-30-alxndr@bu.edu> (raw)
In-Reply-To: <20200120055410.22322-1-alxndr@bu.edu>
The virtio-scsi fuzz target sets up and fuzzes the available virtio-scsi
queues. After an element is placed on a queue, the fuzzer can select
whether to perform a kick, or continue adding elements.
Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
---
tests/qtest/fuzz/Makefile.include | 1 +
tests/qtest/fuzz/virtio_scsi_fuzz.c | 200 ++++++++++++++++++++++++++++
2 files changed, 201 insertions(+)
create mode 100644 tests/qtest/fuzz/virtio_scsi_fuzz.c
diff --git a/tests/qtest/fuzz/Makefile.include b/tests/qtest/fuzz/Makefile.include
index 77385777ef..cde3e9636c 100644
--- a/tests/qtest/fuzz/Makefile.include
+++ b/tests/qtest/fuzz/Makefile.include
@@ -9,6 +9,7 @@ fuzz-obj-y += tests/qtest/fuzz/qos_fuzz.o
# Targets
fuzz-obj-y += tests/qtest/fuzz/i440fx_fuzz.o
fuzz-obj-y += tests/qtest/fuzz/virtio_net_fuzz.o
+fuzz-obj-y += tests/qtest/fuzz/virtio_scsi_fuzz.o
FUZZ_CFLAGS += -I$(SRC_PATH)/tests -I$(SRC_PATH)/tests/qtest
diff --git a/tests/qtest/fuzz/virtio_scsi_fuzz.c b/tests/qtest/fuzz/virtio_scsi_fuzz.c
new file mode 100644
index 0000000000..ee7ca5448c
--- /dev/null
+++ b/tests/qtest/fuzz/virtio_scsi_fuzz.c
@@ -0,0 +1,200 @@
+/*
+ * virtio-serial Fuzzing Target
+ *
+ * Copyright Red Hat Inc., 2019
+ *
+ * Authors:
+ * Alexander Bulekov <alxndr@bu.edu>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+
+#include "tests/qtest/libqtest.h"
+#include "tests/qtest/libqos/virtio-net.h"
+#include "libqos/virtio-scsi.h"
+#include "libqos/virtio.h"
+#include "libqos/virtio-pci.h"
+#include "standard-headers/linux/virtio_ids.h"
+#include "standard-headers/linux/virtio_pci.h"
+#include "standard-headers/linux/virtio_scsi.h"
+#include "fuzz.h"
+#include "fork_fuzz.h"
+#include "qos_fuzz.h"
+
+#define PCI_SLOT 0x02
+#define PCI_FN 0x00
+#define QVIRTIO_SCSI_TIMEOUT_US (1 * 1000 * 1000)
+
+#define MAX_NUM_QUEUES 64
+
+/* Based on tests/virtio-scsi-test.c */
+typedef struct {
+ int num_queues;
+ QVirtQueue *vq[MAX_NUM_QUEUES + 2];
+} QVirtioSCSIQueues;
+
+static QVirtioSCSIQueues *qvirtio_scsi_init(QVirtioDevice *dev, uint64_t mask)
+{
+ QVirtioSCSIQueues *vs;
+ uint64_t feat;
+ int i;
+
+ vs = g_new0(QVirtioSCSIQueues, 1);
+
+ feat = qvirtio_get_features(dev);
+ if (mask) {
+ feat &= ~QVIRTIO_F_BAD_FEATURE | mask;
+ } else {
+ feat &= ~(QVIRTIO_F_BAD_FEATURE | (1ull << VIRTIO_RING_F_EVENT_IDX));
+ }
+ qvirtio_set_features(dev, feat);
+
+ vs->num_queues = qvirtio_config_readl(dev, 0);
+
+ for (i = 0; i < vs->num_queues + 2; i++) {
+ vs->vq[i] = qvirtqueue_setup(dev, fuzz_qos_alloc, i);
+ }
+
+ qvirtio_set_driver_ok(dev);
+
+ return vs;
+}
+
+static void virtio_scsi_fuzz(QTestState *s, QVirtioSCSIQueues* queues,
+ const unsigned char *Data, size_t Size)
+{
+ typedef struct vq_action {
+ uint8_t queue;
+ uint8_t length;
+ uint8_t write;
+ uint8_t next;
+ uint8_t kick;
+ } vq_action;
+
+ uint32_t free_head[MAX_NUM_QUEUES + 2] = {0};
+ QGuestAllocator *t_alloc = fuzz_qos_alloc;
+
+ QVirtioSCSI *scsi = fuzz_qos_obj;
+ QVirtioDevice *dev = scsi->vdev;
+ QVirtQueue *q;
+ vq_action vqa;
+ while (Size >= sizeof(vqa)) {
+ memcpy(&vqa, Data, sizeof(vqa));
+
+ Data += sizeof(vqa);
+ Size -= sizeof(vqa);
+
+ vqa.queue = vqa.queue % queues->num_queues;
+ vqa.length = vqa.length >= Size ? Size : vqa.length;
+ vqa.write = vqa.write & 1;
+ vqa.next = vqa.next & 1;
+ vqa.kick = vqa.kick & 1;
+
+
+ q = queues->vq[vqa.queue];
+
+ uint64_t req_addr = guest_alloc(t_alloc, vqa.length);
+ qtest_memwrite(s, req_addr, Data, vqa.length);
+ if (free_head[vqa.queue] == 0) {
+ free_head[vqa.queue] = qvirtqueue_add(s, q, req_addr, vqa.length,
+ vqa.write, vqa.next);
+ } else {
+ qvirtqueue_add(s, q, req_addr, vqa.length, vqa.write , vqa.next);
+ }
+
+ if (vqa.kick) {
+ qvirtqueue_kick(s, dev, q, free_head[vqa.queue]);
+ free_head[vqa.queue] = 0;
+ }
+ Data += vqa.length;
+ Size -= vqa.length;
+ }
+ for (int i = 0; i < MAX_NUM_QUEUES + 2; i++) {
+ if (free_head[i]) {
+ qvirtqueue_kick(s, dev, queues->vq[i], free_head[i]);
+ }
+ }
+}
+
+static void virtio_scsi_fork_fuzz(QTestState *s,
+ const unsigned char *Data, size_t Size)
+{
+ QVirtioSCSI *scsi = fuzz_qos_obj;
+ static QVirtioSCSIQueues *queues;
+ if (!queues) {
+ queues = qvirtio_scsi_init(scsi->vdev, 0);
+ }
+ if (fork() == 0) {
+ virtio_scsi_fuzz(s, queues, Data, Size);
+ flush_events(s);
+ _Exit(0);
+ } else {
+ wait(NULL);
+ }
+}
+
+static void virtio_scsi_with_flag_fuzz(QTestState *s,
+ const unsigned char *Data, size_t Size)
+{
+ QVirtioSCSI *scsi = fuzz_qos_obj;
+ static QVirtioSCSIQueues *queues;
+
+ if (fork() == 0) {
+ if (Size >= sizeof(uint64_t)) {
+ queues = qvirtio_scsi_init(scsi->vdev, *(uint64_t *)Data);
+ virtio_scsi_fuzz(s, queues,
+ Data + sizeof(uint64_t), Size - sizeof(uint64_t));
+ flush_events(s);
+ }
+ _Exit(0);
+ } else {
+ wait(NULL);
+ }
+}
+
+static void virtio_scsi_pre_fuzz(QTestState *s)
+{
+ qos_init_path(s);
+ counter_shm_init();
+}
+
+static void *virtio_scsi_test_setup(GString *cmd_line, void *arg)
+{
+ g_string_append(cmd_line,
+ " -drive file=blkdebug::null-co://,"
+ "file.image.read-zeroes=on,"
+ "if=none,id=dr1,format=raw,file.align=4k "
+ "-device scsi-hd,drive=dr1,lun=0,scsi-id=1");
+ return arg;
+}
+
+
+static void register_virtio_scsi_fuzz_targets(void)
+{
+ fuzz_add_qos_target(&(FuzzTarget){
+ .name = "virtio-scsi-fuzz",
+ .description = "Fuzz the virtio-net virtual queues, forking"
+ "for each fuzz run",
+ .pre_vm_init = &counter_shm_init,
+ .pre_fuzz = &virtio_scsi_pre_fuzz,
+ .fuzz = virtio_scsi_fork_fuzz,},
+ "virtio-scsi",
+ &(QOSGraphTestOptions){.before = virtio_scsi_test_setup}
+ );
+
+ fuzz_add_qos_target(&(FuzzTarget){
+ .name = "virtio-scsi-flags-fuzz",
+ .description = "Fuzz the virtio-net virtual queues, forking"
+ "for each fuzz run (also fuzzes the virtio flags)",
+ .pre_vm_init = &counter_shm_init,
+ .pre_fuzz = &virtio_scsi_pre_fuzz,
+ .fuzz = virtio_scsi_with_flag_fuzz,},
+ "virtio-scsi",
+ &(QOSGraphTestOptions){.before = virtio_scsi_test_setup}
+ );
+}
+
+fuzz_target_init(register_virtio_scsi_fuzz_targets);
--
2.23.0
next prev parent reply other threads:[~2020-01-20 6:21 UTC|newest]
Thread overview: 35+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-01-20 5:54 [PATCH v7 00/20] Add virtual device fuzzing support Bulekov, Alexander
2020-01-20 5:54 ` [PATCH v7 01/20] softmmu: split off vl.c:main() into main.c Bulekov, Alexander
2020-01-21 16:26 ` Stefan Hajnoczi
2020-01-20 5:54 ` [PATCH v7 02/20] libqos: rename i2c_send and i2c_recv Bulekov, Alexander
2020-01-20 5:54 ` [PATCH v7 02/20] module: check module wasn't already initialized Bulekov, Alexander
2020-01-20 5:54 ` [PATCH v7 03/20] fuzz: add FUZZ_TARGET module type Bulekov, Alexander
2020-01-20 5:54 ` [PATCH v7 05/20] libqtest: add a layer of abstraction to send/recv Bulekov, Alexander
2020-01-20 5:54 ` [PATCH v7 04/20] qtest: add qtest_server_send abstraction Bulekov, Alexander
2020-01-20 5:54 ` [PATCH v7 06/20] libqtest: make bufwrite rely on the TransportOps Bulekov, Alexander
2020-01-20 5:54 ` [PATCH v7 06/20] module: check module wasn't already initialized Bulekov, Alexander
2020-01-20 5:54 ` [PATCH v7 07/20] qtest: add in-process incoming command handler Bulekov, Alexander
2020-01-20 5:54 ` [PATCH v7 08/20] libqos: rename i2c_send and i2c_recv Bulekov, Alexander
2020-01-20 5:54 ` [PATCH v7 08/20] libqos: split qos-test and libqos makefile vars Bulekov, Alexander
2020-01-20 5:54 ` [PATCH v7 09/20] libqos: move useful qos-test funcs to qos_external Bulekov, Alexander
2020-01-20 5:54 ` [PATCH v7 09/20] libqos: split qos-test and libqos makefile vars Bulekov, Alexander
2020-01-20 5:54 ` [PATCH v7 10/20] libqos: move useful qos-test funcs to qos_external Bulekov, Alexander
2020-01-20 5:54 ` [PATCH v7 10/20] libqtest: make bufwrite rely on the TransportOps Bulekov, Alexander
2020-01-20 5:54 ` [PATCH v7 11/20] fuzz: add fuzzer skeleton Bulekov, Alexander
2020-01-20 5:54 ` [PATCH v7 12/20] exec: keep ram block across fork when using qtest Bulekov, Alexander
2020-01-21 16:29 ` Stefan Hajnoczi
2020-01-20 5:55 ` [PATCH v7 13/20] fuzz: support for fork-based fuzzing Bulekov, Alexander
2020-01-20 5:55 ` [PATCH v7 14/20] fuzz: add support for qos-assisted fuzz targets Bulekov, Alexander
2020-01-20 5:55 ` [PATCH v7 15/20] fuzz: add target/fuzz makefile rules Bulekov, Alexander
2020-01-20 5:55 ` [PATCH v7 16/20] fuzz: add configure flag --enable-fuzzing Bulekov, Alexander
2020-01-20 17:22 ` Alexander Bulekov
2020-01-20 5:55 ` [PATCH v7 17/20] fuzz: add documentation to docs/devel/ Bulekov, Alexander
2020-01-20 5:55 ` [PATCH v7 17/20] fuzz: add i440fx fuzz targets Bulekov, Alexander
2020-01-20 5:55 ` [PATCH v7 18/20] " Bulekov, Alexander
2020-01-20 5:55 ` [PATCH v7 18/20] fuzz: add virtio-net fuzz target Bulekov, Alexander
2020-01-21 16:42 ` Stefan Hajnoczi
2020-01-20 5:55 ` [PATCH v7 19/20] " Bulekov, Alexander
2020-01-20 5:55 ` [PATCH v7 19/20] fuzz: add virtio-scsi " Bulekov, Alexander
2020-01-20 5:55 ` [PATCH v7 20/20] fuzz: add documentation to docs/devel/ Bulekov, Alexander
2020-01-20 5:55 ` Bulekov, Alexander [this message]
2020-01-21 16:44 ` [PATCH v7 00/20] Add virtual device fuzzing support Stefan Hajnoczi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200120055410.22322-30-alxndr@bu.edu \
--to=alxndr@bu.edu \
--cc=bsd@redhat.com \
--cc=lvivier@redhat.com \
--cc=pbonzini@redhat.com \
--cc=qemu-devel@nongnu.org \
--cc=stefanha@redhat.com \
--cc=thuth@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).