xref: /qemu/tests/qtest/fuzz/generic_fuzz.c (revision 019fbfa4bcd2d3a835c241295e22ab2b5b56129b)
1da9bf531SAlexander Bulekov /*
2da9bf531SAlexander Bulekov  * Generic Virtual-Device Fuzzing Target
3da9bf531SAlexander Bulekov  *
4da9bf531SAlexander Bulekov  * Copyright Red Hat Inc., 2020
5da9bf531SAlexander Bulekov  *
6da9bf531SAlexander Bulekov  * Authors:
7da9bf531SAlexander Bulekov  *  Alexander Bulekov   <alxndr@bu.edu>
8da9bf531SAlexander Bulekov  *
9da9bf531SAlexander Bulekov  * This work is licensed under the terms of the GNU GPL, version 2 or later.
10da9bf531SAlexander Bulekov  * See the COPYING file in the top-level directory.
11da9bf531SAlexander Bulekov  */
12da9bf531SAlexander Bulekov 
13da9bf531SAlexander Bulekov #include "qemu/osdep.h"
14763719d2SYao Xingtao #include "qemu/range.h"
15da9bf531SAlexander Bulekov 
16da9bf531SAlexander Bulekov #include <wordexp.h>
17da9bf531SAlexander Bulekov 
18da9bf531SAlexander Bulekov #include "hw/core/cpu.h"
19907b5105SMarc-André Lureau #include "tests/qtest/libqtest.h"
20b677001dSAlexander Bulekov #include "tests/qtest/libqos/pci-pc.h"
21da9bf531SAlexander Bulekov #include "fuzz.h"
22da9bf531SAlexander Bulekov #include "string.h"
238be545baSRichard Henderson #include "system/memory.h"
24*548a0165SRichard Henderson #include "system/ramblock.h"
25da9bf531SAlexander Bulekov #include "hw/qdev-core.h"
2605efbf24SAlexander Bulekov #include "hw/pci/pci.h"
27edf5ca5dSMarkus Armbruster #include "hw/pci/pci_device.h"
2820f5a302SAlexander Bulekov #include "hw/boards.h"
297fdb5053SAlexander Bulekov #include "generic_fuzz_configs.h"
3025d309fbSAlexander Bulekov #include "hw/mem/sparse-mem.h"
31da9bf531SAlexander Bulekov 
3213751043SAlexander Bulekov static void pci_enum(gpointer pcidev, gpointer bus);
3313751043SAlexander Bulekov 
34da9bf531SAlexander Bulekov /*
35da9bf531SAlexander Bulekov  * SEPARATOR is used to separate "operations" in the fuzz input
36da9bf531SAlexander Bulekov  */
37da9bf531SAlexander Bulekov #define SEPARATOR "FUZZ"
38da9bf531SAlexander Bulekov 
39da9bf531SAlexander Bulekov enum cmds {
40da9bf531SAlexander Bulekov     OP_IN,
41da9bf531SAlexander Bulekov     OP_OUT,
42da9bf531SAlexander Bulekov     OP_READ,
43da9bf531SAlexander Bulekov     OP_WRITE,
4405efbf24SAlexander Bulekov     OP_PCI_READ,
4505efbf24SAlexander Bulekov     OP_PCI_WRITE,
46ccbd4bc8SAlexander Bulekov     OP_DISABLE_PCI,
4720f5a302SAlexander Bulekov     OP_ADD_DMA_PATTERN,
4820f5a302SAlexander Bulekov     OP_CLEAR_DMA_PATTERNS,
49da9bf531SAlexander Bulekov     OP_CLOCK_STEP,
50da9bf531SAlexander Bulekov };
51da9bf531SAlexander Bulekov 
52da9bf531SAlexander Bulekov #define USEC_IN_SEC 1000000000
53da9bf531SAlexander Bulekov 
5420f5a302SAlexander Bulekov #define MAX_DMA_FILL_SIZE 0x10000
55b8b52178SAlexander Bulekov #define MAX_TOTAL_DMA_SIZE 0x10000000
5620f5a302SAlexander Bulekov 
5705efbf24SAlexander Bulekov #define PCI_HOST_BRIDGE_CFG 0xcf8
5805efbf24SAlexander Bulekov #define PCI_HOST_BRIDGE_DATA 0xcfc
5905efbf24SAlexander Bulekov 
60da9bf531SAlexander Bulekov typedef struct {
61da9bf531SAlexander Bulekov     ram_addr_t addr;
62da9bf531SAlexander Bulekov     ram_addr_t size; /* The number of bytes until the end of the I/O region */
63da9bf531SAlexander Bulekov } address_range;
64da9bf531SAlexander Bulekov 
65da9bf531SAlexander Bulekov static bool qtest_log_enabled;
66b8b52178SAlexander Bulekov size_t dma_bytes_written;
67da9bf531SAlexander Bulekov 
6825d309fbSAlexander Bulekov MemoryRegion *sparse_mem_mr;
6925d309fbSAlexander Bulekov 
70da9bf531SAlexander Bulekov /*
7120f5a302SAlexander Bulekov  * A pattern used to populate a DMA region or perform a memwrite. This is
7220f5a302SAlexander Bulekov  * useful for e.g. populating tables of unique addresses.
7320f5a302SAlexander Bulekov  * Example {.index = 1; .stride = 2; .len = 3; .data = "\x00\x01\x02"}
7420f5a302SAlexander Bulekov  * Renders as: 00 01 02   00 03 02   00 05 02   00 07 02 ...
7520f5a302SAlexander Bulekov  */
7620f5a302SAlexander Bulekov typedef struct {
7720f5a302SAlexander Bulekov     uint8_t index;      /* Index of a byte to increment by stride */
7820f5a302SAlexander Bulekov     uint8_t stride;     /* Increment each index'th byte by this amount */
7920f5a302SAlexander Bulekov     size_t len;
8020f5a302SAlexander Bulekov     const uint8_t *data;
8120f5a302SAlexander Bulekov } pattern;
8220f5a302SAlexander Bulekov 
8320f5a302SAlexander Bulekov /* Avoid filling the same DMA region between MMIO/PIO commands ? */
8420f5a302SAlexander Bulekov static bool avoid_double_fetches;
8520f5a302SAlexander Bulekov 
8620f5a302SAlexander Bulekov static QTestState *qts_global; /* Need a global for the DMA callback */
8720f5a302SAlexander Bulekov 
8820f5a302SAlexander Bulekov /*
89da9bf531SAlexander Bulekov  * List of memory regions that are children of QOM objects specified by the
90da9bf531SAlexander Bulekov  * user for fuzzing.
91da9bf531SAlexander Bulekov  */
92da9bf531SAlexander Bulekov static GHashTable *fuzzable_memoryregions;
9305efbf24SAlexander Bulekov static GPtrArray *fuzzable_pci_devices;
94da9bf531SAlexander Bulekov 
95da9bf531SAlexander Bulekov struct get_io_cb_info {
96da9bf531SAlexander Bulekov     int index;
97da9bf531SAlexander Bulekov     int found;
98da9bf531SAlexander Bulekov     address_range result;
99da9bf531SAlexander Bulekov };
100da9bf531SAlexander Bulekov 
get_io_address_cb(Int128 start,Int128 size,const MemoryRegion * mr,hwaddr offset_in_region,void * opaque)101d1e8cf77SPeter Maydell static bool get_io_address_cb(Int128 start, Int128 size,
102b3566001SPeter Maydell                               const MemoryRegion *mr,
103b3566001SPeter Maydell                               hwaddr offset_in_region,
104b3566001SPeter Maydell                               void *opaque)
105b3566001SPeter Maydell {
106da9bf531SAlexander Bulekov     struct get_io_cb_info *info = opaque;
107da9bf531SAlexander Bulekov     if (g_hash_table_lookup(fuzzable_memoryregions, mr)) {
108da9bf531SAlexander Bulekov         if (info->index == 0) {
109da9bf531SAlexander Bulekov             info->result.addr = (ram_addr_t)start;
110da9bf531SAlexander Bulekov             info->result.size = (ram_addr_t)size;
111da9bf531SAlexander Bulekov             info->found = 1;
112d1e8cf77SPeter Maydell             return true;
113da9bf531SAlexander Bulekov         }
114da9bf531SAlexander Bulekov         info->index--;
115da9bf531SAlexander Bulekov     }
116d1e8cf77SPeter Maydell     return false;
117da9bf531SAlexander Bulekov }
118da9bf531SAlexander Bulekov 
119da9bf531SAlexander Bulekov /*
12020f5a302SAlexander Bulekov  * List of dma regions populated since the last fuzzing command. Used to ensure
12120f5a302SAlexander Bulekov  * that we only write to each DMA address once, to avoid race conditions when
12220f5a302SAlexander Bulekov  * building reproducers.
12320f5a302SAlexander Bulekov  */
12420f5a302SAlexander Bulekov static GArray *dma_regions;
12520f5a302SAlexander Bulekov 
12620f5a302SAlexander Bulekov static GArray *dma_patterns;
12720f5a302SAlexander Bulekov static int dma_pattern_index;
128ccbd4bc8SAlexander Bulekov static bool pci_disabled;
12920f5a302SAlexander Bulekov 
13020f5a302SAlexander Bulekov /*
13120f5a302SAlexander Bulekov  * Allocate a block of memory and populate it with a pattern.
13220f5a302SAlexander Bulekov  */
pattern_alloc(pattern p,size_t len)13320f5a302SAlexander Bulekov static void *pattern_alloc(pattern p, size_t len)
13420f5a302SAlexander Bulekov {
13520f5a302SAlexander Bulekov     int i;
13620f5a302SAlexander Bulekov     uint8_t *buf = g_malloc(len);
13720f5a302SAlexander Bulekov     uint8_t sum = 0;
13820f5a302SAlexander Bulekov 
13920f5a302SAlexander Bulekov     for (i = 0; i < len; ++i) {
14020f5a302SAlexander Bulekov         buf[i] = p.data[i % p.len];
14120f5a302SAlexander Bulekov         if ((i % p.len) == p.index) {
14220f5a302SAlexander Bulekov             buf[i] += sum;
14320f5a302SAlexander Bulekov             sum += p.stride;
14420f5a302SAlexander Bulekov         }
14520f5a302SAlexander Bulekov     }
14620f5a302SAlexander Bulekov     return buf;
14720f5a302SAlexander Bulekov }
14820f5a302SAlexander Bulekov 
fuzz_memory_access_size(MemoryRegion * mr,unsigned l,hwaddr addr)1493123f93dSJagannathan Raman static int fuzz_memory_access_size(MemoryRegion *mr, unsigned l, hwaddr addr)
15020f5a302SAlexander Bulekov {
15120f5a302SAlexander Bulekov     unsigned access_size_max = mr->ops->valid.max_access_size;
15220f5a302SAlexander Bulekov 
15320f5a302SAlexander Bulekov     /*
15420f5a302SAlexander Bulekov      * Regions are assumed to support 1-4 byte accesses unless
15520f5a302SAlexander Bulekov      * otherwise specified.
15620f5a302SAlexander Bulekov      */
15720f5a302SAlexander Bulekov     if (access_size_max == 0) {
15820f5a302SAlexander Bulekov         access_size_max = 4;
15920f5a302SAlexander Bulekov     }
16020f5a302SAlexander Bulekov 
16120f5a302SAlexander Bulekov     /* Bound the maximum access by the alignment of the address.  */
16220f5a302SAlexander Bulekov     if (!mr->ops->impl.unaligned) {
16320f5a302SAlexander Bulekov         unsigned align_size_max = addr & -addr;
16420f5a302SAlexander Bulekov         if (align_size_max != 0 && align_size_max < access_size_max) {
16520f5a302SAlexander Bulekov             access_size_max = align_size_max;
16620f5a302SAlexander Bulekov         }
16720f5a302SAlexander Bulekov     }
16820f5a302SAlexander Bulekov 
16920f5a302SAlexander Bulekov     /* Don't attempt accesses larger than the maximum.  */
17020f5a302SAlexander Bulekov     if (l > access_size_max) {
17120f5a302SAlexander Bulekov         l = access_size_max;
17220f5a302SAlexander Bulekov     }
17320f5a302SAlexander Bulekov     l = pow2floor(l);
17420f5a302SAlexander Bulekov 
17520f5a302SAlexander Bulekov     return l;
17620f5a302SAlexander Bulekov }
17720f5a302SAlexander Bulekov 
17820f5a302SAlexander Bulekov /*
17920f5a302SAlexander Bulekov  * Call-back for functions that perform DMA reads from guest memory. Confirm
18020f5a302SAlexander Bulekov  * that the region has not already been populated since the last loop in
18120f5a302SAlexander Bulekov  * generic_fuzz(), avoiding potential race-conditions, which we don't have
18220f5a302SAlexander Bulekov  * a good way for reproducing right now.
18320f5a302SAlexander Bulekov  */
fuzz_dma_read_cb(size_t addr,size_t len,MemoryRegion * mr)184fc1c8344SAlexander Bulekov void fuzz_dma_read_cb(size_t addr, size_t len, MemoryRegion *mr)
18520f5a302SAlexander Bulekov {
18620f5a302SAlexander Bulekov     /* Are we in the generic-fuzzer or are we using another fuzz-target? */
18720f5a302SAlexander Bulekov     if (!qts_global) {
18820f5a302SAlexander Bulekov         return;
18920f5a302SAlexander Bulekov     }
19020f5a302SAlexander Bulekov 
19120f5a302SAlexander Bulekov     /*
19220f5a302SAlexander Bulekov      * Return immediately if:
19320f5a302SAlexander Bulekov      * - We have no DMA patterns defined
19420f5a302SAlexander Bulekov      * - The length of the DMA read request is zero
19520f5a302SAlexander Bulekov      * - The DMA read is hitting an MR other than the machine's main RAM
19620f5a302SAlexander Bulekov      * - The DMA request hits past the bounds of our RAM
19720f5a302SAlexander Bulekov      */
19820f5a302SAlexander Bulekov     if (dma_patterns->len == 0
19920f5a302SAlexander Bulekov         || len == 0
200b8b52178SAlexander Bulekov         || dma_bytes_written + len > MAX_TOTAL_DMA_SIZE
20125d309fbSAlexander Bulekov         || (mr != current_machine->ram && mr != sparse_mem_mr)) {
20220f5a302SAlexander Bulekov         return;
20320f5a302SAlexander Bulekov     }
20420f5a302SAlexander Bulekov 
20520f5a302SAlexander Bulekov     /*
20620f5a302SAlexander Bulekov      * If we overlap with any existing dma_regions, split the range and only
20720f5a302SAlexander Bulekov      * populate the non-overlapping parts.
20820f5a302SAlexander Bulekov      */
20920f5a302SAlexander Bulekov     address_range region;
21020f5a302SAlexander Bulekov     bool double_fetch = false;
21120f5a302SAlexander Bulekov     for (int i = 0;
21220f5a302SAlexander Bulekov          i < dma_regions->len && (avoid_double_fetches || qtest_log_enabled);
21320f5a302SAlexander Bulekov          ++i) {
21420f5a302SAlexander Bulekov         region = g_array_index(dma_regions, address_range, i);
215763719d2SYao Xingtao         if (ranges_overlap(addr, len, region.addr, region.size)) {
21620f5a302SAlexander Bulekov             double_fetch = true;
21720f5a302SAlexander Bulekov             if (addr < region.addr
21820f5a302SAlexander Bulekov                 && avoid_double_fetches) {
219fc1c8344SAlexander Bulekov                 fuzz_dma_read_cb(addr, region.addr - addr, mr);
22020f5a302SAlexander Bulekov             }
22120f5a302SAlexander Bulekov             if (addr + len > region.addr + region.size
22220f5a302SAlexander Bulekov                 && avoid_double_fetches) {
22320f5a302SAlexander Bulekov                 fuzz_dma_read_cb(region.addr + region.size,
224fc1c8344SAlexander Bulekov                         addr + len - (region.addr + region.size), mr);
22520f5a302SAlexander Bulekov             }
22620f5a302SAlexander Bulekov             return;
22720f5a302SAlexander Bulekov         }
22820f5a302SAlexander Bulekov     }
22920f5a302SAlexander Bulekov 
23020f5a302SAlexander Bulekov     /* Cap the length of the DMA access to something reasonable */
23120f5a302SAlexander Bulekov     len = MIN(len, MAX_DMA_FILL_SIZE);
23220f5a302SAlexander Bulekov 
23320f5a302SAlexander Bulekov     address_range ar = {addr, len};
23420f5a302SAlexander Bulekov     g_array_append_val(dma_regions, ar);
23520f5a302SAlexander Bulekov     pattern p = g_array_index(dma_patterns, pattern, dma_pattern_index);
236a9f67c1dSAlexander Bulekov     void *buf_base = pattern_alloc(p, ar.size);
237a9f67c1dSAlexander Bulekov     void *buf = buf_base;
23820f5a302SAlexander Bulekov     hwaddr l, addr1;
23920f5a302SAlexander Bulekov     MemoryRegion *mr1;
24020f5a302SAlexander Bulekov     while (len > 0) {
24120f5a302SAlexander Bulekov         l = len;
24220f5a302SAlexander Bulekov         mr1 = address_space_translate(first_cpu->as,
24320f5a302SAlexander Bulekov                                       addr, &addr1, &l, true,
24420f5a302SAlexander Bulekov                                       MEMTXATTRS_UNSPECIFIED);
24520f5a302SAlexander Bulekov 
246af16990aSAlexander Bulekov         /*
247af16990aSAlexander Bulekov          *  If mr1 isn't RAM, address_space_translate doesn't update l. Use
2483123f93dSJagannathan Raman          *  fuzz_memory_access_size to identify the number of bytes that it
2493123f93dSJagannathan Raman          *  is safe to write without accidentally writing to another
2503123f93dSJagannathan Raman          *  MemoryRegion.
251af16990aSAlexander Bulekov          */
252af16990aSAlexander Bulekov         if (!memory_region_is_ram(mr1)) {
2533123f93dSJagannathan Raman             l = fuzz_memory_access_size(mr1, l, addr1);
254af16990aSAlexander Bulekov         }
255af16990aSAlexander Bulekov         if (memory_region_is_ram(mr1) ||
256af16990aSAlexander Bulekov             memory_region_is_romd(mr1) ||
257af16990aSAlexander Bulekov             mr1 == sparse_mem_mr) {
25820f5a302SAlexander Bulekov             /* ROM/RAM case */
25920f5a302SAlexander Bulekov             if (qtest_log_enabled) {
26020f5a302SAlexander Bulekov                 /*
26120f5a302SAlexander Bulekov                 * With QTEST_LOG, use a normal, slow QTest memwrite. Prefix the log
26220f5a302SAlexander Bulekov                 * that will be written by qtest.c with a DMA tag, so we can reorder
26320f5a302SAlexander Bulekov                 * the resulting QTest trace so the DMA fills precede the last PIO/MMIO
26420f5a302SAlexander Bulekov                 * command.
26520f5a302SAlexander Bulekov                 */
26620f5a302SAlexander Bulekov                 fprintf(stderr, "[DMA] ");
26720f5a302SAlexander Bulekov                 if (double_fetch) {
26820f5a302SAlexander Bulekov                     fprintf(stderr, "[DOUBLE-FETCH] ");
26920f5a302SAlexander Bulekov                 }
27020f5a302SAlexander Bulekov                 fflush(stderr);
27120f5a302SAlexander Bulekov             }
272a9f67c1dSAlexander Bulekov             qtest_memwrite(qts_global, addr, buf, l);
273b8b52178SAlexander Bulekov             dma_bytes_written += l;
274a9f67c1dSAlexander Bulekov         }
275a9f67c1dSAlexander Bulekov         len -= l;
276a9f67c1dSAlexander Bulekov         buf += l;
277a9f67c1dSAlexander Bulekov         addr += l;
278a9f67c1dSAlexander Bulekov 
279a9f67c1dSAlexander Bulekov     }
280a9f67c1dSAlexander Bulekov     g_free(buf_base);
28120f5a302SAlexander Bulekov 
28220f5a302SAlexander Bulekov     /* Increment the index of the pattern for the next DMA access */
28320f5a302SAlexander Bulekov     dma_pattern_index = (dma_pattern_index + 1) % dma_patterns->len;
28420f5a302SAlexander Bulekov }
28520f5a302SAlexander Bulekov 
28620f5a302SAlexander Bulekov /*
287da9bf531SAlexander Bulekov  * Here we want to convert a fuzzer-provided [io-region-index, offset] to
288da9bf531SAlexander Bulekov  * a physical address. To do this, we iterate over all of the matched
289da9bf531SAlexander Bulekov  * MemoryRegions. Check whether each region exists within the particular io
290da9bf531SAlexander Bulekov  * space. Return the absolute address of the offset within the index'th region
291da9bf531SAlexander Bulekov  * that is a subregion of the io_space and the distance until the end of the
292da9bf531SAlexander Bulekov  * memory region.
293da9bf531SAlexander Bulekov  */
get_io_address(address_range * result,AddressSpace * as,uint8_t index,uint32_t offset)294da9bf531SAlexander Bulekov static bool get_io_address(address_range *result, AddressSpace *as,
295da9bf531SAlexander Bulekov                             uint8_t index,
296da9bf531SAlexander Bulekov                             uint32_t offset) {
297da9bf531SAlexander Bulekov     FlatView *view;
298da9bf531SAlexander Bulekov     view = as->current_map;
299da9bf531SAlexander Bulekov     g_assert(view);
300da9bf531SAlexander Bulekov     struct get_io_cb_info cb_info = {};
301da9bf531SAlexander Bulekov 
302da9bf531SAlexander Bulekov     cb_info.index = index;
303da9bf531SAlexander Bulekov 
304da9bf531SAlexander Bulekov     /*
305da9bf531SAlexander Bulekov      * Loop around the FlatView until we match "index" number of
306da9bf531SAlexander Bulekov      * fuzzable_memoryregions, or until we know that there are no matching
307da9bf531SAlexander Bulekov      * memory_regions.
308da9bf531SAlexander Bulekov      */
309da9bf531SAlexander Bulekov     do {
310da9bf531SAlexander Bulekov         flatview_for_each_range(view, get_io_address_cb , &cb_info);
311da9bf531SAlexander Bulekov     } while (cb_info.index != index && !cb_info.found);
312da9bf531SAlexander Bulekov 
313da9bf531SAlexander Bulekov     *result = cb_info.result;
314953e6d7cSAlexander Bulekov     if (result->size) {
315953e6d7cSAlexander Bulekov         offset = offset % result->size;
316953e6d7cSAlexander Bulekov         result->addr += offset;
317953e6d7cSAlexander Bulekov         result->size -= offset;
318953e6d7cSAlexander Bulekov     }
319da9bf531SAlexander Bulekov     return cb_info.found;
320da9bf531SAlexander Bulekov }
321da9bf531SAlexander Bulekov 
get_pio_address(address_range * result,uint8_t index,uint16_t offset)322da9bf531SAlexander Bulekov static bool get_pio_address(address_range *result,
323da9bf531SAlexander Bulekov                             uint8_t index, uint16_t offset)
324da9bf531SAlexander Bulekov {
325da9bf531SAlexander Bulekov     /*
326da9bf531SAlexander Bulekov      * PIO BARs can be set past the maximum port address (0xFFFF). Thus, result
327da9bf531SAlexander Bulekov      * can contain an addr that extends past the PIO space. When we pass this
328da9bf531SAlexander Bulekov      * address to qtest_in/qtest_out, it is cast to a uint16_t, so we might end
329da9bf531SAlexander Bulekov      * up fuzzing a completely different MemoryRegion/Device. Therefore, check
330da9bf531SAlexander Bulekov      * that the address here is within the PIO space limits.
331da9bf531SAlexander Bulekov      */
332da9bf531SAlexander Bulekov     bool found = get_io_address(result, &address_space_io, index, offset);
333da9bf531SAlexander Bulekov     return result->addr <= 0xFFFF ? found : false;
334da9bf531SAlexander Bulekov }
335da9bf531SAlexander Bulekov 
get_mmio_address(address_range * result,uint8_t index,uint32_t offset)336da9bf531SAlexander Bulekov static bool get_mmio_address(address_range *result,
337da9bf531SAlexander Bulekov                              uint8_t index, uint32_t offset)
338da9bf531SAlexander Bulekov {
339da9bf531SAlexander Bulekov     return get_io_address(result, &address_space_memory, index, offset);
340da9bf531SAlexander Bulekov }
341da9bf531SAlexander Bulekov 
op_in(QTestState * s,const unsigned char * data,size_t len)342da9bf531SAlexander Bulekov static void op_in(QTestState *s, const unsigned char * data, size_t len)
343da9bf531SAlexander Bulekov {
344da9bf531SAlexander Bulekov     enum Sizes {Byte, Word, Long, end_sizes};
345da9bf531SAlexander Bulekov     struct {
346da9bf531SAlexander Bulekov         uint8_t size;
347da9bf531SAlexander Bulekov         uint8_t base;
348da9bf531SAlexander Bulekov         uint16_t offset;
349da9bf531SAlexander Bulekov     } a;
350da9bf531SAlexander Bulekov     address_range abs;
351da9bf531SAlexander Bulekov 
352da9bf531SAlexander Bulekov     if (len < sizeof(a)) {
353da9bf531SAlexander Bulekov         return;
354da9bf531SAlexander Bulekov     }
355da9bf531SAlexander Bulekov     memcpy(&a, data, sizeof(a));
356da9bf531SAlexander Bulekov     if (get_pio_address(&abs, a.base, a.offset) == 0) {
357da9bf531SAlexander Bulekov         return;
358da9bf531SAlexander Bulekov     }
359da9bf531SAlexander Bulekov 
360da9bf531SAlexander Bulekov     switch (a.size %= end_sizes) {
361da9bf531SAlexander Bulekov     case Byte:
362da9bf531SAlexander Bulekov         qtest_inb(s, abs.addr);
363da9bf531SAlexander Bulekov         break;
364da9bf531SAlexander Bulekov     case Word:
365da9bf531SAlexander Bulekov         if (abs.size >= 2) {
366da9bf531SAlexander Bulekov             qtest_inw(s, abs.addr);
367da9bf531SAlexander Bulekov         }
368da9bf531SAlexander Bulekov         break;
369da9bf531SAlexander Bulekov     case Long:
370da9bf531SAlexander Bulekov         if (abs.size >= 4) {
371da9bf531SAlexander Bulekov             qtest_inl(s, abs.addr);
372da9bf531SAlexander Bulekov         }
373da9bf531SAlexander Bulekov         break;
374da9bf531SAlexander Bulekov     }
375da9bf531SAlexander Bulekov }
376da9bf531SAlexander Bulekov 
op_out(QTestState * s,const unsigned char * data,size_t len)377da9bf531SAlexander Bulekov static void op_out(QTestState *s, const unsigned char * data, size_t len)
378da9bf531SAlexander Bulekov {
379da9bf531SAlexander Bulekov     enum Sizes {Byte, Word, Long, end_sizes};
380da9bf531SAlexander Bulekov     struct {
381da9bf531SAlexander Bulekov         uint8_t size;
382da9bf531SAlexander Bulekov         uint8_t base;
383da9bf531SAlexander Bulekov         uint16_t offset;
384da9bf531SAlexander Bulekov         uint32_t value;
385da9bf531SAlexander Bulekov     } a;
386da9bf531SAlexander Bulekov     address_range abs;
387da9bf531SAlexander Bulekov 
388da9bf531SAlexander Bulekov     if (len < sizeof(a)) {
389da9bf531SAlexander Bulekov         return;
390da9bf531SAlexander Bulekov     }
391da9bf531SAlexander Bulekov     memcpy(&a, data, sizeof(a));
392da9bf531SAlexander Bulekov 
393da9bf531SAlexander Bulekov     if (get_pio_address(&abs, a.base, a.offset) == 0) {
394da9bf531SAlexander Bulekov         return;
395da9bf531SAlexander Bulekov     }
396da9bf531SAlexander Bulekov 
397da9bf531SAlexander Bulekov     switch (a.size %= end_sizes) {
398da9bf531SAlexander Bulekov     case Byte:
399da9bf531SAlexander Bulekov         qtest_outb(s, abs.addr, a.value & 0xFF);
400da9bf531SAlexander Bulekov         break;
401da9bf531SAlexander Bulekov     case Word:
402da9bf531SAlexander Bulekov         if (abs.size >= 2) {
403da9bf531SAlexander Bulekov             qtest_outw(s, abs.addr, a.value & 0xFFFF);
404da9bf531SAlexander Bulekov         }
405da9bf531SAlexander Bulekov         break;
406da9bf531SAlexander Bulekov     case Long:
407da9bf531SAlexander Bulekov         if (abs.size >= 4) {
408da9bf531SAlexander Bulekov             qtest_outl(s, abs.addr, a.value);
409da9bf531SAlexander Bulekov         }
410da9bf531SAlexander Bulekov         break;
411da9bf531SAlexander Bulekov     }
412da9bf531SAlexander Bulekov }
413da9bf531SAlexander Bulekov 
op_read(QTestState * s,const unsigned char * data,size_t len)414da9bf531SAlexander Bulekov static void op_read(QTestState *s, const unsigned char * data, size_t len)
415da9bf531SAlexander Bulekov {
416da9bf531SAlexander Bulekov     enum Sizes {Byte, Word, Long, Quad, end_sizes};
417da9bf531SAlexander Bulekov     struct {
418da9bf531SAlexander Bulekov         uint8_t size;
419da9bf531SAlexander Bulekov         uint8_t base;
420da9bf531SAlexander Bulekov         uint32_t offset;
421da9bf531SAlexander Bulekov     } a;
422da9bf531SAlexander Bulekov     address_range abs;
423da9bf531SAlexander Bulekov 
424da9bf531SAlexander Bulekov     if (len < sizeof(a)) {
425da9bf531SAlexander Bulekov         return;
426da9bf531SAlexander Bulekov     }
427da9bf531SAlexander Bulekov     memcpy(&a, data, sizeof(a));
428da9bf531SAlexander Bulekov 
429da9bf531SAlexander Bulekov     if (get_mmio_address(&abs, a.base, a.offset) == 0) {
430da9bf531SAlexander Bulekov         return;
431da9bf531SAlexander Bulekov     }
432da9bf531SAlexander Bulekov 
433da9bf531SAlexander Bulekov     switch (a.size %= end_sizes) {
434da9bf531SAlexander Bulekov     case Byte:
435da9bf531SAlexander Bulekov         qtest_readb(s, abs.addr);
436da9bf531SAlexander Bulekov         break;
437da9bf531SAlexander Bulekov     case Word:
438da9bf531SAlexander Bulekov         if (abs.size >= 2) {
439da9bf531SAlexander Bulekov             qtest_readw(s, abs.addr);
440da9bf531SAlexander Bulekov         }
441da9bf531SAlexander Bulekov         break;
442da9bf531SAlexander Bulekov     case Long:
443da9bf531SAlexander Bulekov         if (abs.size >= 4) {
444da9bf531SAlexander Bulekov             qtest_readl(s, abs.addr);
445da9bf531SAlexander Bulekov         }
446da9bf531SAlexander Bulekov         break;
447da9bf531SAlexander Bulekov     case Quad:
448da9bf531SAlexander Bulekov         if (abs.size >= 8) {
449da9bf531SAlexander Bulekov             qtest_readq(s, abs.addr);
450da9bf531SAlexander Bulekov         }
451da9bf531SAlexander Bulekov         break;
452da9bf531SAlexander Bulekov     }
453da9bf531SAlexander Bulekov }
454da9bf531SAlexander Bulekov 
op_write(QTestState * s,const unsigned char * data,size_t len)455da9bf531SAlexander Bulekov static void op_write(QTestState *s, const unsigned char * data, size_t len)
456da9bf531SAlexander Bulekov {
457da9bf531SAlexander Bulekov     enum Sizes {Byte, Word, Long, Quad, end_sizes};
458da9bf531SAlexander Bulekov     struct {
459da9bf531SAlexander Bulekov         uint8_t size;
460da9bf531SAlexander Bulekov         uint8_t base;
461da9bf531SAlexander Bulekov         uint32_t offset;
462da9bf531SAlexander Bulekov         uint64_t value;
463da9bf531SAlexander Bulekov     } a;
464da9bf531SAlexander Bulekov     address_range abs;
465da9bf531SAlexander Bulekov 
466da9bf531SAlexander Bulekov     if (len < sizeof(a)) {
467da9bf531SAlexander Bulekov         return;
468da9bf531SAlexander Bulekov     }
469da9bf531SAlexander Bulekov     memcpy(&a, data, sizeof(a));
470da9bf531SAlexander Bulekov 
471da9bf531SAlexander Bulekov     if (get_mmio_address(&abs, a.base, a.offset) == 0) {
472da9bf531SAlexander Bulekov         return;
473da9bf531SAlexander Bulekov     }
474da9bf531SAlexander Bulekov 
475da9bf531SAlexander Bulekov     switch (a.size %= end_sizes) {
476da9bf531SAlexander Bulekov     case Byte:
477da9bf531SAlexander Bulekov             qtest_writeb(s, abs.addr, a.value & 0xFF);
478da9bf531SAlexander Bulekov         break;
479da9bf531SAlexander Bulekov     case Word:
480da9bf531SAlexander Bulekov         if (abs.size >= 2) {
481da9bf531SAlexander Bulekov             qtest_writew(s, abs.addr, a.value & 0xFFFF);
482da9bf531SAlexander Bulekov         }
483da9bf531SAlexander Bulekov         break;
484da9bf531SAlexander Bulekov     case Long:
485da9bf531SAlexander Bulekov         if (abs.size >= 4) {
486da9bf531SAlexander Bulekov             qtest_writel(s, abs.addr, a.value & 0xFFFFFFFF);
487da9bf531SAlexander Bulekov         }
488da9bf531SAlexander Bulekov         break;
489da9bf531SAlexander Bulekov     case Quad:
490da9bf531SAlexander Bulekov         if (abs.size >= 8) {
491da9bf531SAlexander Bulekov             qtest_writeq(s, abs.addr, a.value);
492da9bf531SAlexander Bulekov         }
493da9bf531SAlexander Bulekov         break;
494da9bf531SAlexander Bulekov     }
495da9bf531SAlexander Bulekov }
496da9bf531SAlexander Bulekov 
op_pci_read(QTestState * s,const unsigned char * data,size_t len)49705efbf24SAlexander Bulekov static void op_pci_read(QTestState *s, const unsigned char * data, size_t len)
49805efbf24SAlexander Bulekov {
49905efbf24SAlexander Bulekov     enum Sizes {Byte, Word, Long, end_sizes};
50005efbf24SAlexander Bulekov     struct {
50105efbf24SAlexander Bulekov         uint8_t size;
50205efbf24SAlexander Bulekov         uint8_t base;
50305efbf24SAlexander Bulekov         uint8_t offset;
50405efbf24SAlexander Bulekov     } a;
505ccbd4bc8SAlexander Bulekov     if (len < sizeof(a) || fuzzable_pci_devices->len == 0 || pci_disabled) {
50605efbf24SAlexander Bulekov         return;
50705efbf24SAlexander Bulekov     }
50805efbf24SAlexander Bulekov     memcpy(&a, data, sizeof(a));
50905efbf24SAlexander Bulekov     PCIDevice *dev = g_ptr_array_index(fuzzable_pci_devices,
51005efbf24SAlexander Bulekov                                   a.base % fuzzable_pci_devices->len);
51105efbf24SAlexander Bulekov     int devfn = dev->devfn;
51205efbf24SAlexander Bulekov     qtest_outl(s, PCI_HOST_BRIDGE_CFG, (1U << 31) | (devfn << 8) | a.offset);
51305efbf24SAlexander Bulekov     switch (a.size %= end_sizes) {
51405efbf24SAlexander Bulekov     case Byte:
51505efbf24SAlexander Bulekov         qtest_inb(s, PCI_HOST_BRIDGE_DATA);
51605efbf24SAlexander Bulekov         break;
51705efbf24SAlexander Bulekov     case Word:
51805efbf24SAlexander Bulekov         qtest_inw(s, PCI_HOST_BRIDGE_DATA);
51905efbf24SAlexander Bulekov         break;
52005efbf24SAlexander Bulekov     case Long:
52105efbf24SAlexander Bulekov         qtest_inl(s, PCI_HOST_BRIDGE_DATA);
52205efbf24SAlexander Bulekov         break;
52305efbf24SAlexander Bulekov     }
52405efbf24SAlexander Bulekov }
52505efbf24SAlexander Bulekov 
op_pci_write(QTestState * s,const unsigned char * data,size_t len)52605efbf24SAlexander Bulekov static void op_pci_write(QTestState *s, const unsigned char * data, size_t len)
52705efbf24SAlexander Bulekov {
52805efbf24SAlexander Bulekov     enum Sizes {Byte, Word, Long, end_sizes};
52905efbf24SAlexander Bulekov     struct {
53005efbf24SAlexander Bulekov         uint8_t size;
53105efbf24SAlexander Bulekov         uint8_t base;
53205efbf24SAlexander Bulekov         uint8_t offset;
53305efbf24SAlexander Bulekov         uint32_t value;
53405efbf24SAlexander Bulekov     } a;
535ccbd4bc8SAlexander Bulekov     if (len < sizeof(a) || fuzzable_pci_devices->len == 0 || pci_disabled) {
53605efbf24SAlexander Bulekov         return;
53705efbf24SAlexander Bulekov     }
53805efbf24SAlexander Bulekov     memcpy(&a, data, sizeof(a));
53905efbf24SAlexander Bulekov     PCIDevice *dev = g_ptr_array_index(fuzzable_pci_devices,
54005efbf24SAlexander Bulekov                                   a.base % fuzzable_pci_devices->len);
54105efbf24SAlexander Bulekov     int devfn = dev->devfn;
54205efbf24SAlexander Bulekov     qtest_outl(s, PCI_HOST_BRIDGE_CFG, (1U << 31) | (devfn << 8) | a.offset);
54305efbf24SAlexander Bulekov     switch (a.size %= end_sizes) {
54405efbf24SAlexander Bulekov     case Byte:
54505efbf24SAlexander Bulekov         qtest_outb(s, PCI_HOST_BRIDGE_DATA, a.value & 0xFF);
54605efbf24SAlexander Bulekov         break;
54705efbf24SAlexander Bulekov     case Word:
54805efbf24SAlexander Bulekov         qtest_outw(s, PCI_HOST_BRIDGE_DATA, a.value & 0xFFFF);
54905efbf24SAlexander Bulekov         break;
55005efbf24SAlexander Bulekov     case Long:
55105efbf24SAlexander Bulekov         qtest_outl(s, PCI_HOST_BRIDGE_DATA, a.value & 0xFFFFFFFF);
55205efbf24SAlexander Bulekov         break;
55305efbf24SAlexander Bulekov     }
55405efbf24SAlexander Bulekov }
55505efbf24SAlexander Bulekov 
op_add_dma_pattern(QTestState * s,const unsigned char * data,size_t len)55620f5a302SAlexander Bulekov static void op_add_dma_pattern(QTestState *s,
55720f5a302SAlexander Bulekov                                const unsigned char *data, size_t len)
55820f5a302SAlexander Bulekov {
55920f5a302SAlexander Bulekov     struct {
56020f5a302SAlexander Bulekov         /*
56120f5a302SAlexander Bulekov          * index and stride can be used to increment the index-th byte of the
56220f5a302SAlexander Bulekov          * pattern by the value stride, for each loop of the pattern.
56320f5a302SAlexander Bulekov          */
56420f5a302SAlexander Bulekov         uint8_t index;
56520f5a302SAlexander Bulekov         uint8_t stride;
56620f5a302SAlexander Bulekov     } a;
56720f5a302SAlexander Bulekov 
56820f5a302SAlexander Bulekov     if (len < sizeof(a) + 1) {
56920f5a302SAlexander Bulekov         return;
57020f5a302SAlexander Bulekov     }
57120f5a302SAlexander Bulekov     memcpy(&a, data, sizeof(a));
57220f5a302SAlexander Bulekov     pattern p = {a.index, a.stride, len - sizeof(a), data + sizeof(a)};
57320f5a302SAlexander Bulekov     p.index = a.index % p.len;
57420f5a302SAlexander Bulekov     g_array_append_val(dma_patterns, p);
57520f5a302SAlexander Bulekov }
57620f5a302SAlexander Bulekov 
op_clear_dma_patterns(QTestState * s,const unsigned char * data,size_t len)57720f5a302SAlexander Bulekov static void op_clear_dma_patterns(QTestState *s,
57820f5a302SAlexander Bulekov                                   const unsigned char *data, size_t len)
57920f5a302SAlexander Bulekov {
58020f5a302SAlexander Bulekov     g_array_set_size(dma_patterns, 0);
58120f5a302SAlexander Bulekov     dma_pattern_index = 0;
58220f5a302SAlexander Bulekov }
58320f5a302SAlexander Bulekov 
op_clock_step(QTestState * s,const unsigned char * data,size_t len)584da9bf531SAlexander Bulekov static void op_clock_step(QTestState *s, const unsigned char *data, size_t len)
585da9bf531SAlexander Bulekov {
586da9bf531SAlexander Bulekov     qtest_clock_step_next(s);
587da9bf531SAlexander Bulekov }
588da9bf531SAlexander Bulekov 
op_disable_pci(QTestState * s,const unsigned char * data,size_t len)589ccbd4bc8SAlexander Bulekov static void op_disable_pci(QTestState *s, const unsigned char *data, size_t len)
590ccbd4bc8SAlexander Bulekov {
591ccbd4bc8SAlexander Bulekov     pci_disabled = true;
592ccbd4bc8SAlexander Bulekov }
593ccbd4bc8SAlexander Bulekov 
594da9bf531SAlexander Bulekov /*
595da9bf531SAlexander Bulekov  * Here, we interpret random bytes from the fuzzer, as a sequence of commands.
596da9bf531SAlexander Bulekov  * Some commands can be variable-width, so we use a separator, SEPARATOR, to
597da9bf531SAlexander Bulekov  * specify the boundaries between commands. SEPARATOR is used to separate
598da9bf531SAlexander Bulekov  * "operations" in the fuzz input. Why use a separator, instead of just using
599da9bf531SAlexander Bulekov  * the operations' length to identify operation boundaries?
600da9bf531SAlexander Bulekov  *   1. This is a simple way to support variable-length operations
601da9bf531SAlexander Bulekov  *   2. This adds "stability" to the input.
602da9bf531SAlexander Bulekov  *      For example take the input "AbBcgDefg", where there is no separator and
603da9bf531SAlexander Bulekov  *      Opcodes are capitalized.
604da9bf531SAlexander Bulekov  *      Simply, by removing the first byte, we end up with a very different
605da9bf531SAlexander Bulekov  *      sequence:
606da9bf531SAlexander Bulekov  *      BbcGdefg...
607da9bf531SAlexander Bulekov  *      By adding a separator, we avoid this problem:
608da9bf531SAlexander Bulekov  *      Ab SEP Bcg SEP Defg -> B SEP Bcg SEP Defg
609da9bf531SAlexander Bulekov  *      Since B uses two additional bytes as operands, the first "B" will be
610da9bf531SAlexander Bulekov  *      ignored. The fuzzer actively tries to reduce inputs, so such unused
611da9bf531SAlexander Bulekov  *      bytes are likely to be pruned, eventually.
612da9bf531SAlexander Bulekov  *
613da9bf531SAlexander Bulekov  *  SEPARATOR is trivial for the fuzzer to discover when using ASan. Optionally,
614da9bf531SAlexander Bulekov  *  SEPARATOR can be manually specified as a dictionary value (see libfuzzer's
615da9bf531SAlexander Bulekov  *  -dict), though this should not be necessary.
616da9bf531SAlexander Bulekov  *
617da9bf531SAlexander Bulekov  * As a result, the stream of bytes is converted into a sequence of commands.
618da9bf531SAlexander Bulekov  * In a simplified example where SEPARATOR is 0xFF:
619da9bf531SAlexander Bulekov  * 00 01 02 FF 03 04 05 06 FF 01 FF ...
620da9bf531SAlexander Bulekov  * becomes this sequence of commands:
621da9bf531SAlexander Bulekov  * 00 01 02    -> op00 (0102)   -> in (0102, 2)
622da9bf531SAlexander Bulekov  * 03 04 05 06 -> op03 (040506) -> write (040506, 3)
623da9bf531SAlexander Bulekov  * 01          -> op01 (-,0)    -> out (-,0)
624da9bf531SAlexander Bulekov  * ...
625da9bf531SAlexander Bulekov  *
626da9bf531SAlexander Bulekov  * Note here that it is the job of the individual opcode functions to check
627da9bf531SAlexander Bulekov  * that enough data was provided. I.e. in the last command out (,0), out needs
628da9bf531SAlexander Bulekov  * to check that there is not enough data provided to select an address/value
629da9bf531SAlexander Bulekov  * for the operation.
630da9bf531SAlexander Bulekov  */
generic_fuzz(QTestState * s,const unsigned char * Data,size_t Size)631da9bf531SAlexander Bulekov static void generic_fuzz(QTestState *s, const unsigned char *Data, size_t Size)
632da9bf531SAlexander Bulekov {
633da9bf531SAlexander Bulekov     void (*ops[]) (QTestState *s, const unsigned char* , size_t) = {
634da9bf531SAlexander Bulekov         [OP_IN]                 = op_in,
635da9bf531SAlexander Bulekov         [OP_OUT]                = op_out,
636da9bf531SAlexander Bulekov         [OP_READ]               = op_read,
637da9bf531SAlexander Bulekov         [OP_WRITE]              = op_write,
63805efbf24SAlexander Bulekov         [OP_PCI_READ]           = op_pci_read,
63905efbf24SAlexander Bulekov         [OP_PCI_WRITE]          = op_pci_write,
640ccbd4bc8SAlexander Bulekov         [OP_DISABLE_PCI]        = op_disable_pci,
64120f5a302SAlexander Bulekov         [OP_ADD_DMA_PATTERN]    = op_add_dma_pattern,
64220f5a302SAlexander Bulekov         [OP_CLEAR_DMA_PATTERNS] = op_clear_dma_patterns,
643da9bf531SAlexander Bulekov         [OP_CLOCK_STEP]         = op_clock_step,
644da9bf531SAlexander Bulekov     };
645da9bf531SAlexander Bulekov     const unsigned char *cmd = Data;
646da9bf531SAlexander Bulekov     const unsigned char *nextcmd;
647da9bf531SAlexander Bulekov     size_t cmd_len;
648da9bf531SAlexander Bulekov     uint8_t op;
649da9bf531SAlexander Bulekov 
65020f5a302SAlexander Bulekov     op_clear_dma_patterns(s, NULL, 0);
651ccbd4bc8SAlexander Bulekov     pci_disabled = false;
652b8b52178SAlexander Bulekov     dma_bytes_written = 0;
65320f5a302SAlexander Bulekov 
65413751043SAlexander Bulekov     QPCIBus *pcibus = qpci_new_pc(s, NULL);
65513751043SAlexander Bulekov     g_ptr_array_foreach(fuzzable_pci_devices, pci_enum, pcibus);
65613751043SAlexander Bulekov     qpci_free_pc(pcibus);
657993f52f4SAlexander Bulekov 
65813751043SAlexander Bulekov     while (cmd && Size) {
659da9bf531SAlexander Bulekov         /* Get the length until the next command or end of input */
660da9bf531SAlexander Bulekov         nextcmd = memmem(cmd, Size, SEPARATOR, strlen(SEPARATOR));
661da9bf531SAlexander Bulekov         cmd_len = nextcmd ? nextcmd - cmd : Size;
662da9bf531SAlexander Bulekov 
663da9bf531SAlexander Bulekov         if (cmd_len > 0) {
664da9bf531SAlexander Bulekov             /* Interpret the first byte of the command as an opcode */
665da9bf531SAlexander Bulekov             op = *cmd % (sizeof(ops) / sizeof((ops)[0]));
666da9bf531SAlexander Bulekov             ops[op](s, cmd + 1, cmd_len - 1);
667da9bf531SAlexander Bulekov 
668da9bf531SAlexander Bulekov             /* Run the main loop */
669da9bf531SAlexander Bulekov             flush_events(s);
670da9bf531SAlexander Bulekov         }
671da9bf531SAlexander Bulekov         /* Advance to the next command */
672da9bf531SAlexander Bulekov         cmd = nextcmd ? nextcmd + sizeof(SEPARATOR) - 1 : nextcmd;
673da9bf531SAlexander Bulekov         Size = Size - (cmd_len + sizeof(SEPARATOR) - 1);
67420f5a302SAlexander Bulekov         g_array_set_size(dma_regions, 0);
675da9bf531SAlexander Bulekov     }
67613751043SAlexander Bulekov     fuzz_reset(s);
677da9bf531SAlexander Bulekov }
678da9bf531SAlexander Bulekov 
usage(void)679da9bf531SAlexander Bulekov static void usage(void)
680da9bf531SAlexander Bulekov {
681da9bf531SAlexander Bulekov     printf("Please specify the following environment variables:\n");
682da9bf531SAlexander Bulekov     printf("QEMU_FUZZ_ARGS= the command line arguments passed to qemu\n");
683da9bf531SAlexander Bulekov     printf("QEMU_FUZZ_OBJECTS= "
684da9bf531SAlexander Bulekov             "a space separated list of QOM type names for objects to fuzz\n");
68520f5a302SAlexander Bulekov     printf("Optionally: QEMU_AVOID_DOUBLE_FETCH= "
68620f5a302SAlexander Bulekov             "Try to avoid racy DMA double fetch bugs? %d by default\n",
68720f5a302SAlexander Bulekov             avoid_double_fetches);
688da9bf531SAlexander Bulekov     exit(0);
689da9bf531SAlexander Bulekov }
690da9bf531SAlexander Bulekov 
locate_fuzz_memory_regions(Object * child,void * opaque)691da9bf531SAlexander Bulekov static int locate_fuzz_memory_regions(Object *child, void *opaque)
692da9bf531SAlexander Bulekov {
693da9bf531SAlexander Bulekov     MemoryRegion *mr;
694da9bf531SAlexander Bulekov     if (object_dynamic_cast(child, TYPE_MEMORY_REGION)) {
695da9bf531SAlexander Bulekov         mr = MEMORY_REGION(child);
696da9bf531SAlexander Bulekov         if ((memory_region_is_ram(mr) ||
697da9bf531SAlexander Bulekov             memory_region_is_ram_device(mr) ||
698da9bf531SAlexander Bulekov             memory_region_is_rom(mr)) == false) {
699da9bf531SAlexander Bulekov             /*
700da9bf531SAlexander Bulekov              * We don't want duplicate pointers to the same MemoryRegion, so
701da9bf531SAlexander Bulekov              * try to remove copies of the pointer, before adding it.
702da9bf531SAlexander Bulekov              */
703da9bf531SAlexander Bulekov             g_hash_table_insert(fuzzable_memoryregions, mr, (gpointer)true);
704da9bf531SAlexander Bulekov         }
705da9bf531SAlexander Bulekov     }
706da9bf531SAlexander Bulekov     return 0;
707da9bf531SAlexander Bulekov }
708da9bf531SAlexander Bulekov 
locate_fuzz_objects(Object * child,void * opaque)709da9bf531SAlexander Bulekov static int locate_fuzz_objects(Object *child, void *opaque)
710da9bf531SAlexander Bulekov {
711f2e8b87aSAlexander Bulekov     GString *type_name;
712f2e8b87aSAlexander Bulekov     GString *path_name;
713da9bf531SAlexander Bulekov     char *pattern = opaque;
714f2e8b87aSAlexander Bulekov 
715f2e8b87aSAlexander Bulekov     type_name = g_string_new(object_get_typename(child));
716f2e8b87aSAlexander Bulekov     g_string_ascii_down(type_name);
717f2e8b87aSAlexander Bulekov     if (g_pattern_match_simple(pattern, type_name->str)) {
718da9bf531SAlexander Bulekov         /* Find and save ptrs to any child MemoryRegions */
719da9bf531SAlexander Bulekov         object_child_foreach_recursive(child, locate_fuzz_memory_regions, NULL);
720da9bf531SAlexander Bulekov 
72105efbf24SAlexander Bulekov         /*
72205efbf24SAlexander Bulekov          * We matched an object. If its a PCI device, store a pointer to it so
72305efbf24SAlexander Bulekov          * we can map BARs and fuzz its config space.
72405efbf24SAlexander Bulekov          */
72505efbf24SAlexander Bulekov         if (object_dynamic_cast(OBJECT(child), TYPE_PCI_DEVICE)) {
72605efbf24SAlexander Bulekov             /*
72705efbf24SAlexander Bulekov              * Don't want duplicate pointers to the same PCIDevice, so remove
72805efbf24SAlexander Bulekov              * copies of the pointer, before adding it.
72905efbf24SAlexander Bulekov              */
73005efbf24SAlexander Bulekov             g_ptr_array_remove_fast(fuzzable_pci_devices, PCI_DEVICE(child));
73105efbf24SAlexander Bulekov             g_ptr_array_add(fuzzable_pci_devices, PCI_DEVICE(child));
73205efbf24SAlexander Bulekov         }
733da9bf531SAlexander Bulekov     } else if (object_dynamic_cast(OBJECT(child), TYPE_MEMORY_REGION)) {
734f2e8b87aSAlexander Bulekov         path_name = g_string_new(object_get_canonical_path_component(child));
735f2e8b87aSAlexander Bulekov         g_string_ascii_down(path_name);
736f2e8b87aSAlexander Bulekov         if (g_pattern_match_simple(pattern, path_name->str)) {
737da9bf531SAlexander Bulekov             MemoryRegion *mr;
738da9bf531SAlexander Bulekov             mr = MEMORY_REGION(child);
739da9bf531SAlexander Bulekov             if ((memory_region_is_ram(mr) ||
740da9bf531SAlexander Bulekov                  memory_region_is_ram_device(mr) ||
741da9bf531SAlexander Bulekov                  memory_region_is_rom(mr)) == false) {
742da9bf531SAlexander Bulekov                 g_hash_table_insert(fuzzable_memoryregions, mr, (gpointer)true);
743da9bf531SAlexander Bulekov             }
744da9bf531SAlexander Bulekov         }
745f2e8b87aSAlexander Bulekov         g_string_free(path_name, true);
746da9bf531SAlexander Bulekov     }
747f2e8b87aSAlexander Bulekov     g_string_free(type_name, true);
748da9bf531SAlexander Bulekov     return 0;
749da9bf531SAlexander Bulekov }
750da9bf531SAlexander Bulekov 
751b677001dSAlexander Bulekov 
pci_enum(gpointer pcidev,gpointer bus)752b677001dSAlexander Bulekov static void pci_enum(gpointer pcidev, gpointer bus)
753b677001dSAlexander Bulekov {
754b677001dSAlexander Bulekov     PCIDevice *dev = pcidev;
755b677001dSAlexander Bulekov     QPCIDevice *qdev;
756b677001dSAlexander Bulekov     int i;
757b677001dSAlexander Bulekov 
758b677001dSAlexander Bulekov     qdev = qpci_device_find(bus, dev->devfn);
759b677001dSAlexander Bulekov     g_assert(qdev != NULL);
760b677001dSAlexander Bulekov     for (i = 0; i < 6; i++) {
761b677001dSAlexander Bulekov         if (dev->io_regions[i].size) {
762b677001dSAlexander Bulekov             qpci_iomap(qdev, i, NULL);
763b677001dSAlexander Bulekov         }
764b677001dSAlexander Bulekov     }
765b677001dSAlexander Bulekov     qpci_device_enable(qdev);
766b677001dSAlexander Bulekov     g_free(qdev);
767b677001dSAlexander Bulekov }
768b677001dSAlexander Bulekov 
generic_pre_fuzz(QTestState * s)769da9bf531SAlexander Bulekov static void generic_pre_fuzz(QTestState *s)
770da9bf531SAlexander Bulekov {
771da9bf531SAlexander Bulekov     GHashTableIter iter;
772da9bf531SAlexander Bulekov     MemoryRegion *mr;
773da9bf531SAlexander Bulekov     char **result;
774f2e8b87aSAlexander Bulekov     GString *name_pattern;
775da9bf531SAlexander Bulekov 
776da9bf531SAlexander Bulekov     if (!getenv("QEMU_FUZZ_OBJECTS")) {
777da9bf531SAlexander Bulekov         usage();
778da9bf531SAlexander Bulekov     }
779da9bf531SAlexander Bulekov     if (getenv("QTEST_LOG")) {
780da9bf531SAlexander Bulekov         qtest_log_enabled = 1;
781da9bf531SAlexander Bulekov     }
78220f5a302SAlexander Bulekov     if (getenv("QEMU_AVOID_DOUBLE_FETCH")) {
78320f5a302SAlexander Bulekov         avoid_double_fetches = 1;
78420f5a302SAlexander Bulekov     }
78520f5a302SAlexander Bulekov     qts_global = s;
78620f5a302SAlexander Bulekov 
78725d309fbSAlexander Bulekov     /*
78825d309fbSAlexander Bulekov      * Create a special device that we can use to back DMA buffers at very
78925d309fbSAlexander Bulekov      * high memory addresses
79025d309fbSAlexander Bulekov      */
79125d309fbSAlexander Bulekov     sparse_mem_mr = sparse_mem_init(0, UINT64_MAX);
79225d309fbSAlexander Bulekov 
79320f5a302SAlexander Bulekov     dma_regions = g_array_new(false, false, sizeof(address_range));
79420f5a302SAlexander Bulekov     dma_patterns = g_array_new(false, false, sizeof(pattern));
795da9bf531SAlexander Bulekov 
796da9bf531SAlexander Bulekov     fuzzable_memoryregions = g_hash_table_new(NULL, NULL);
79705efbf24SAlexander Bulekov     fuzzable_pci_devices   = g_ptr_array_new();
798da9bf531SAlexander Bulekov 
799da9bf531SAlexander Bulekov     result = g_strsplit(getenv("QEMU_FUZZ_OBJECTS"), " ", -1);
800da9bf531SAlexander Bulekov     for (int i = 0; result[i] != NULL; i++) {
801f2e8b87aSAlexander Bulekov         name_pattern = g_string_new(result[i]);
802f2e8b87aSAlexander Bulekov         /*
803f2e8b87aSAlexander Bulekov          * Make the pattern lowercase. We do the same for all the MemoryRegion
804f2e8b87aSAlexander Bulekov          * and Type names so the configs are case-insensitive.
805f2e8b87aSAlexander Bulekov          */
806f2e8b87aSAlexander Bulekov         g_string_ascii_down(name_pattern);
807da9bf531SAlexander Bulekov         printf("Matching objects by name %s\n", result[i]);
808da9bf531SAlexander Bulekov         object_child_foreach_recursive(qdev_get_machine(),
809da9bf531SAlexander Bulekov                                     locate_fuzz_objects,
810f2e8b87aSAlexander Bulekov                                     name_pattern->str);
811f2e8b87aSAlexander Bulekov         g_string_free(name_pattern, true);
812da9bf531SAlexander Bulekov     }
813da9bf531SAlexander Bulekov     g_strfreev(result);
814da9bf531SAlexander Bulekov     printf("This process will try to fuzz the following MemoryRegions:\n");
815da9bf531SAlexander Bulekov 
816da9bf531SAlexander Bulekov     g_hash_table_iter_init(&iter, fuzzable_memoryregions);
817da9bf531SAlexander Bulekov     while (g_hash_table_iter_next(&iter, (gpointer)&mr, NULL)) {
818a8fbec7eSPhilippe Mathieu-Daudé         printf("  * %s (size 0x%" PRIx64 ")\n",
819da9bf531SAlexander Bulekov                object_get_canonical_path_component(&(mr->parent_obj)),
820a8fbec7eSPhilippe Mathieu-Daudé                memory_region_size(mr));
821da9bf531SAlexander Bulekov     }
822da9bf531SAlexander Bulekov 
823da9bf531SAlexander Bulekov     if (!g_hash_table_size(fuzzable_memoryregions)) {
824da9bf531SAlexander Bulekov         printf("No fuzzable memory regions found...\n");
825da9bf531SAlexander Bulekov         exit(1);
826da9bf531SAlexander Bulekov     }
827da9bf531SAlexander Bulekov }
828da9bf531SAlexander Bulekov 
829a2539322SAlexander Bulekov /*
830a2539322SAlexander Bulekov  * When libfuzzer gives us two inputs to combine, return a new input with the
831a2539322SAlexander Bulekov  * following structure:
832a2539322SAlexander Bulekov  *
833a2539322SAlexander Bulekov  * Input 1 (data1)
834a2539322SAlexander Bulekov  * SEPARATOR
835a2539322SAlexander Bulekov  * Clear out the DMA Patterns
836a2539322SAlexander Bulekov  * SEPARATOR
837a2539322SAlexander Bulekov  * Disable the pci_read/write instructions
838a2539322SAlexander Bulekov  * SEPARATOR
839a2539322SAlexander Bulekov  * Input 2 (data2)
840a2539322SAlexander Bulekov  *
841a2539322SAlexander Bulekov  * The idea is to collate the core behaviors of the two inputs.
842a2539322SAlexander Bulekov  * For example:
843a2539322SAlexander Bulekov  * Input 1: maps a device's BARs, sets up three DMA patterns, and triggers
844a2539322SAlexander Bulekov  *          device functionality A
845a2539322SAlexander Bulekov  * Input 2: maps a device's BARs, sets up one DMA pattern, and triggers device
846a2539322SAlexander Bulekov  *          functionality B
847a2539322SAlexander Bulekov  *
848a2539322SAlexander Bulekov  * This function attempts to produce an input that:
84996420a30SMichael Tokarev  * Output: maps a device's BARs, set up three DMA patterns, triggers
85096420a30SMichael Tokarev  *          device functionality A, replaces the DMA patterns with a single
85196420a30SMichael Tokarev  *          pattern, and triggers device functionality B.
852a2539322SAlexander Bulekov  */
generic_fuzz_crossover(const uint8_t * data1,size_t size1,const uint8_t * data2,size_t size2,uint8_t * out,size_t max_out_size,unsigned int seed)853a2539322SAlexander Bulekov static size_t generic_fuzz_crossover(const uint8_t *data1, size_t size1, const
854a2539322SAlexander Bulekov                                      uint8_t *data2, size_t size2, uint8_t *out,
855a2539322SAlexander Bulekov                                      size_t max_out_size, unsigned int seed)
856a2539322SAlexander Bulekov {
857a2539322SAlexander Bulekov     size_t copy_len = 0, size = 0;
858a2539322SAlexander Bulekov 
859a2539322SAlexander Bulekov     /* Check that we have enough space for data1 and at least part of data2 */
860a2539322SAlexander Bulekov     if (max_out_size <= size1 + strlen(SEPARATOR) * 3 + 2) {
861a2539322SAlexander Bulekov         return 0;
862a2539322SAlexander Bulekov     }
863a2539322SAlexander Bulekov 
864a2539322SAlexander Bulekov     /* Copy_Len in the first input */
865a2539322SAlexander Bulekov     copy_len = size1;
866a2539322SAlexander Bulekov     memcpy(out + size, data1, copy_len);
867a2539322SAlexander Bulekov     size += copy_len;
868a2539322SAlexander Bulekov     max_out_size -= copy_len;
869a2539322SAlexander Bulekov 
870a2539322SAlexander Bulekov     /* Append a separator */
871a2539322SAlexander Bulekov     copy_len = strlen(SEPARATOR);
872a2539322SAlexander Bulekov     memcpy(out + size, SEPARATOR, copy_len);
873a2539322SAlexander Bulekov     size += copy_len;
874a2539322SAlexander Bulekov     max_out_size -= copy_len;
875a2539322SAlexander Bulekov 
876a2539322SAlexander Bulekov     /* Clear out the DMA Patterns */
877a2539322SAlexander Bulekov     copy_len = 1;
878a2539322SAlexander Bulekov     if (copy_len) {
879a2539322SAlexander Bulekov         out[size] = OP_CLEAR_DMA_PATTERNS;
880a2539322SAlexander Bulekov     }
881a2539322SAlexander Bulekov     size += copy_len;
882a2539322SAlexander Bulekov     max_out_size -= copy_len;
883a2539322SAlexander Bulekov 
884a2539322SAlexander Bulekov     /* Append a separator */
885a2539322SAlexander Bulekov     copy_len = strlen(SEPARATOR);
886a2539322SAlexander Bulekov     memcpy(out + size, SEPARATOR, copy_len);
887a2539322SAlexander Bulekov     size += copy_len;
888a2539322SAlexander Bulekov     max_out_size -= copy_len;
889a2539322SAlexander Bulekov 
890a2539322SAlexander Bulekov     /* Disable PCI ops. Assume data1 took care of setting up PCI */
891a2539322SAlexander Bulekov     copy_len = 1;
892a2539322SAlexander Bulekov     if (copy_len) {
893a2539322SAlexander Bulekov         out[size] = OP_DISABLE_PCI;
894a2539322SAlexander Bulekov     }
895a2539322SAlexander Bulekov     size += copy_len;
896a2539322SAlexander Bulekov     max_out_size -= copy_len;
897a2539322SAlexander Bulekov 
898a2539322SAlexander Bulekov     /* Append a separator */
899a2539322SAlexander Bulekov     copy_len = strlen(SEPARATOR);
900a2539322SAlexander Bulekov     memcpy(out + size, SEPARATOR, copy_len);
901a2539322SAlexander Bulekov     size += copy_len;
902a2539322SAlexander Bulekov     max_out_size -= copy_len;
903a2539322SAlexander Bulekov 
904a2539322SAlexander Bulekov     /* Copy_Len over the second input */
905a2539322SAlexander Bulekov     copy_len = MIN(size2, max_out_size);
906a2539322SAlexander Bulekov     memcpy(out + size, data2, copy_len);
907a2539322SAlexander Bulekov     size += copy_len;
908a2539322SAlexander Bulekov     max_out_size -= copy_len;
909a2539322SAlexander Bulekov 
910a2539322SAlexander Bulekov     return  size;
911a2539322SAlexander Bulekov }
912a2539322SAlexander Bulekov 
913a2539322SAlexander Bulekov 
generic_fuzz_cmdline(FuzzTarget * t)914da9bf531SAlexander Bulekov static GString *generic_fuzz_cmdline(FuzzTarget *t)
915da9bf531SAlexander Bulekov {
916da9bf531SAlexander Bulekov     GString *cmd_line = g_string_new(TARGET_NAME);
917da9bf531SAlexander Bulekov     if (!getenv("QEMU_FUZZ_ARGS")) {
918da9bf531SAlexander Bulekov         usage();
919da9bf531SAlexander Bulekov     }
920da9bf531SAlexander Bulekov     g_string_append_printf(cmd_line, " -display none \
921da9bf531SAlexander Bulekov                                       -machine accel=qtest, \
922da9bf531SAlexander Bulekov                                       -m 512M %s ", getenv("QEMU_FUZZ_ARGS"));
923da9bf531SAlexander Bulekov     return cmd_line;
924da9bf531SAlexander Bulekov }
925da9bf531SAlexander Bulekov 
generic_fuzz_predefined_config_cmdline(FuzzTarget * t)9267fdb5053SAlexander Bulekov static GString *generic_fuzz_predefined_config_cmdline(FuzzTarget *t)
9277fdb5053SAlexander Bulekov {
9288630b43fSAlexander Bulekov     gchar *args;
9297fdb5053SAlexander Bulekov     const generic_fuzz_config *config;
9307fdb5053SAlexander Bulekov     g_assert(t->opaque);
9317fdb5053SAlexander Bulekov 
9327fdb5053SAlexander Bulekov     config = t->opaque;
933a47ea61dSBin Meng     g_setenv("QEMU_AVOID_DOUBLE_FETCH", "1", 1);
9348630b43fSAlexander Bulekov     if (config->argfunc) {
9358630b43fSAlexander Bulekov         args = config->argfunc();
936a47ea61dSBin Meng         g_setenv("QEMU_FUZZ_ARGS", args, 1);
9378630b43fSAlexander Bulekov         g_free(args);
9388630b43fSAlexander Bulekov     } else {
9398630b43fSAlexander Bulekov         g_assert_nonnull(config->args);
940a47ea61dSBin Meng         g_setenv("QEMU_FUZZ_ARGS", config->args, 1);
9418630b43fSAlexander Bulekov     }
942a47ea61dSBin Meng     g_setenv("QEMU_FUZZ_OBJECTS", config->objects, 1);
9437fdb5053SAlexander Bulekov     return generic_fuzz_cmdline(t);
9447fdb5053SAlexander Bulekov }
9457fdb5053SAlexander Bulekov 
register_generic_fuzz_targets(void)946da9bf531SAlexander Bulekov static void register_generic_fuzz_targets(void)
947da9bf531SAlexander Bulekov {
948da9bf531SAlexander Bulekov     fuzz_add_target(&(FuzzTarget){
949da9bf531SAlexander Bulekov             .name = "generic-fuzz",
950da9bf531SAlexander Bulekov             .description = "Fuzz based on any qemu command-line args. ",
951da9bf531SAlexander Bulekov             .get_init_cmdline = generic_fuzz_cmdline,
952da9bf531SAlexander Bulekov             .pre_fuzz = generic_pre_fuzz,
953da9bf531SAlexander Bulekov             .fuzz = generic_fuzz,
954a2539322SAlexander Bulekov             .crossover = generic_fuzz_crossover
955da9bf531SAlexander Bulekov     });
9567fdb5053SAlexander Bulekov 
9573176990fSAlex Bennée     for (int i = 0; i < ARRAY_SIZE(predefined_configs); i++) {
9583176990fSAlex Bennée         const generic_fuzz_config *config = predefined_configs + i;
9597fdb5053SAlexander Bulekov         fuzz_add_target(&(FuzzTarget){
9603176990fSAlex Bennée                 .name = g_strconcat("generic-fuzz-", config->name, NULL),
9617fdb5053SAlexander Bulekov                 .description = "Predefined generic-fuzz config.",
9627fdb5053SAlexander Bulekov                 .get_init_cmdline = generic_fuzz_predefined_config_cmdline,
9637fdb5053SAlexander Bulekov                 .pre_fuzz = generic_pre_fuzz,
9647fdb5053SAlexander Bulekov                 .fuzz = generic_fuzz,
9657fdb5053SAlexander Bulekov                 .crossover = generic_fuzz_crossover,
9667fdb5053SAlexander Bulekov                 .opaque = (void *)config
9677fdb5053SAlexander Bulekov         });
9687fdb5053SAlexander Bulekov     }
969da9bf531SAlexander Bulekov }
970da9bf531SAlexander Bulekov 
971da9bf531SAlexander Bulekov fuzz_target_init(register_generic_fuzz_targets);
972