1da9bf531SAlexander Bulekov /*
2da9bf531SAlexander Bulekov * Generic Virtual-Device Fuzzing Target
3da9bf531SAlexander Bulekov *
4da9bf531SAlexander Bulekov * Copyright Red Hat Inc., 2020
5da9bf531SAlexander Bulekov *
6da9bf531SAlexander Bulekov * Authors:
7da9bf531SAlexander Bulekov * Alexander Bulekov <alxndr@bu.edu>
8da9bf531SAlexander Bulekov *
9da9bf531SAlexander Bulekov * This work is licensed under the terms of the GNU GPL, version 2 or later.
10da9bf531SAlexander Bulekov * See the COPYING file in the top-level directory.
11da9bf531SAlexander Bulekov */
12da9bf531SAlexander Bulekov
13da9bf531SAlexander Bulekov #include "qemu/osdep.h"
14763719d2SYao Xingtao #include "qemu/range.h"
15da9bf531SAlexander Bulekov
16da9bf531SAlexander Bulekov #include <wordexp.h>
17da9bf531SAlexander Bulekov
18da9bf531SAlexander Bulekov #include "hw/core/cpu.h"
19907b5105SMarc-André Lureau #include "tests/qtest/libqtest.h"
20b677001dSAlexander Bulekov #include "tests/qtest/libqos/pci-pc.h"
21da9bf531SAlexander Bulekov #include "fuzz.h"
22da9bf531SAlexander Bulekov #include "string.h"
238be545baSRichard Henderson #include "system/memory.h"
24*548a0165SRichard Henderson #include "system/ramblock.h"
25da9bf531SAlexander Bulekov #include "hw/qdev-core.h"
2605efbf24SAlexander Bulekov #include "hw/pci/pci.h"
27edf5ca5dSMarkus Armbruster #include "hw/pci/pci_device.h"
2820f5a302SAlexander Bulekov #include "hw/boards.h"
297fdb5053SAlexander Bulekov #include "generic_fuzz_configs.h"
3025d309fbSAlexander Bulekov #include "hw/mem/sparse-mem.h"
31da9bf531SAlexander Bulekov
3213751043SAlexander Bulekov static void pci_enum(gpointer pcidev, gpointer bus);
3313751043SAlexander Bulekov
34da9bf531SAlexander Bulekov /*
35da9bf531SAlexander Bulekov * SEPARATOR is used to separate "operations" in the fuzz input
36da9bf531SAlexander Bulekov */
37da9bf531SAlexander Bulekov #define SEPARATOR "FUZZ"
38da9bf531SAlexander Bulekov
39da9bf531SAlexander Bulekov enum cmds {
40da9bf531SAlexander Bulekov OP_IN,
41da9bf531SAlexander Bulekov OP_OUT,
42da9bf531SAlexander Bulekov OP_READ,
43da9bf531SAlexander Bulekov OP_WRITE,
4405efbf24SAlexander Bulekov OP_PCI_READ,
4505efbf24SAlexander Bulekov OP_PCI_WRITE,
46ccbd4bc8SAlexander Bulekov OP_DISABLE_PCI,
4720f5a302SAlexander Bulekov OP_ADD_DMA_PATTERN,
4820f5a302SAlexander Bulekov OP_CLEAR_DMA_PATTERNS,
49da9bf531SAlexander Bulekov OP_CLOCK_STEP,
50da9bf531SAlexander Bulekov };
51da9bf531SAlexander Bulekov
52da9bf531SAlexander Bulekov #define USEC_IN_SEC 1000000000
53da9bf531SAlexander Bulekov
5420f5a302SAlexander Bulekov #define MAX_DMA_FILL_SIZE 0x10000
55b8b52178SAlexander Bulekov #define MAX_TOTAL_DMA_SIZE 0x10000000
5620f5a302SAlexander Bulekov
5705efbf24SAlexander Bulekov #define PCI_HOST_BRIDGE_CFG 0xcf8
5805efbf24SAlexander Bulekov #define PCI_HOST_BRIDGE_DATA 0xcfc
5905efbf24SAlexander Bulekov
60da9bf531SAlexander Bulekov typedef struct {
61da9bf531SAlexander Bulekov ram_addr_t addr;
62da9bf531SAlexander Bulekov ram_addr_t size; /* The number of bytes until the end of the I/O region */
63da9bf531SAlexander Bulekov } address_range;
64da9bf531SAlexander Bulekov
65da9bf531SAlexander Bulekov static bool qtest_log_enabled;
66b8b52178SAlexander Bulekov size_t dma_bytes_written;
67da9bf531SAlexander Bulekov
6825d309fbSAlexander Bulekov MemoryRegion *sparse_mem_mr;
6925d309fbSAlexander Bulekov
70da9bf531SAlexander Bulekov /*
7120f5a302SAlexander Bulekov * A pattern used to populate a DMA region or perform a memwrite. This is
7220f5a302SAlexander Bulekov * useful for e.g. populating tables of unique addresses.
7320f5a302SAlexander Bulekov * Example {.index = 1; .stride = 2; .len = 3; .data = "\x00\x01\x02"}
7420f5a302SAlexander Bulekov * Renders as: 00 01 02 00 03 02 00 05 02 00 07 02 ...
7520f5a302SAlexander Bulekov */
7620f5a302SAlexander Bulekov typedef struct {
7720f5a302SAlexander Bulekov uint8_t index; /* Index of a byte to increment by stride */
7820f5a302SAlexander Bulekov uint8_t stride; /* Increment each index'th byte by this amount */
7920f5a302SAlexander Bulekov size_t len;
8020f5a302SAlexander Bulekov const uint8_t *data;
8120f5a302SAlexander Bulekov } pattern;
8220f5a302SAlexander Bulekov
8320f5a302SAlexander Bulekov /* Avoid filling the same DMA region between MMIO/PIO commands ? */
8420f5a302SAlexander Bulekov static bool avoid_double_fetches;
8520f5a302SAlexander Bulekov
8620f5a302SAlexander Bulekov static QTestState *qts_global; /* Need a global for the DMA callback */
8720f5a302SAlexander Bulekov
8820f5a302SAlexander Bulekov /*
89da9bf531SAlexander Bulekov * List of memory regions that are children of QOM objects specified by the
90da9bf531SAlexander Bulekov * user for fuzzing.
91da9bf531SAlexander Bulekov */
92da9bf531SAlexander Bulekov static GHashTable *fuzzable_memoryregions;
9305efbf24SAlexander Bulekov static GPtrArray *fuzzable_pci_devices;
94da9bf531SAlexander Bulekov
95da9bf531SAlexander Bulekov struct get_io_cb_info {
96da9bf531SAlexander Bulekov int index;
97da9bf531SAlexander Bulekov int found;
98da9bf531SAlexander Bulekov address_range result;
99da9bf531SAlexander Bulekov };
100da9bf531SAlexander Bulekov
get_io_address_cb(Int128 start,Int128 size,const MemoryRegion * mr,hwaddr offset_in_region,void * opaque)101d1e8cf77SPeter Maydell static bool get_io_address_cb(Int128 start, Int128 size,
102b3566001SPeter Maydell const MemoryRegion *mr,
103b3566001SPeter Maydell hwaddr offset_in_region,
104b3566001SPeter Maydell void *opaque)
105b3566001SPeter Maydell {
106da9bf531SAlexander Bulekov struct get_io_cb_info *info = opaque;
107da9bf531SAlexander Bulekov if (g_hash_table_lookup(fuzzable_memoryregions, mr)) {
108da9bf531SAlexander Bulekov if (info->index == 0) {
109da9bf531SAlexander Bulekov info->result.addr = (ram_addr_t)start;
110da9bf531SAlexander Bulekov info->result.size = (ram_addr_t)size;
111da9bf531SAlexander Bulekov info->found = 1;
112d1e8cf77SPeter Maydell return true;
113da9bf531SAlexander Bulekov }
114da9bf531SAlexander Bulekov info->index--;
115da9bf531SAlexander Bulekov }
116d1e8cf77SPeter Maydell return false;
117da9bf531SAlexander Bulekov }
118da9bf531SAlexander Bulekov
119da9bf531SAlexander Bulekov /*
12020f5a302SAlexander Bulekov * List of dma regions populated since the last fuzzing command. Used to ensure
12120f5a302SAlexander Bulekov * that we only write to each DMA address once, to avoid race conditions when
12220f5a302SAlexander Bulekov * building reproducers.
12320f5a302SAlexander Bulekov */
12420f5a302SAlexander Bulekov static GArray *dma_regions;
12520f5a302SAlexander Bulekov
12620f5a302SAlexander Bulekov static GArray *dma_patterns;
12720f5a302SAlexander Bulekov static int dma_pattern_index;
128ccbd4bc8SAlexander Bulekov static bool pci_disabled;
12920f5a302SAlexander Bulekov
13020f5a302SAlexander Bulekov /*
13120f5a302SAlexander Bulekov * Allocate a block of memory and populate it with a pattern.
13220f5a302SAlexander Bulekov */
pattern_alloc(pattern p,size_t len)13320f5a302SAlexander Bulekov static void *pattern_alloc(pattern p, size_t len)
13420f5a302SAlexander Bulekov {
13520f5a302SAlexander Bulekov int i;
13620f5a302SAlexander Bulekov uint8_t *buf = g_malloc(len);
13720f5a302SAlexander Bulekov uint8_t sum = 0;
13820f5a302SAlexander Bulekov
13920f5a302SAlexander Bulekov for (i = 0; i < len; ++i) {
14020f5a302SAlexander Bulekov buf[i] = p.data[i % p.len];
14120f5a302SAlexander Bulekov if ((i % p.len) == p.index) {
14220f5a302SAlexander Bulekov buf[i] += sum;
14320f5a302SAlexander Bulekov sum += p.stride;
14420f5a302SAlexander Bulekov }
14520f5a302SAlexander Bulekov }
14620f5a302SAlexander Bulekov return buf;
14720f5a302SAlexander Bulekov }
14820f5a302SAlexander Bulekov
fuzz_memory_access_size(MemoryRegion * mr,unsigned l,hwaddr addr)1493123f93dSJagannathan Raman static int fuzz_memory_access_size(MemoryRegion *mr, unsigned l, hwaddr addr)
15020f5a302SAlexander Bulekov {
15120f5a302SAlexander Bulekov unsigned access_size_max = mr->ops->valid.max_access_size;
15220f5a302SAlexander Bulekov
15320f5a302SAlexander Bulekov /*
15420f5a302SAlexander Bulekov * Regions are assumed to support 1-4 byte accesses unless
15520f5a302SAlexander Bulekov * otherwise specified.
15620f5a302SAlexander Bulekov */
15720f5a302SAlexander Bulekov if (access_size_max == 0) {
15820f5a302SAlexander Bulekov access_size_max = 4;
15920f5a302SAlexander Bulekov }
16020f5a302SAlexander Bulekov
16120f5a302SAlexander Bulekov /* Bound the maximum access by the alignment of the address. */
16220f5a302SAlexander Bulekov if (!mr->ops->impl.unaligned) {
16320f5a302SAlexander Bulekov unsigned align_size_max = addr & -addr;
16420f5a302SAlexander Bulekov if (align_size_max != 0 && align_size_max < access_size_max) {
16520f5a302SAlexander Bulekov access_size_max = align_size_max;
16620f5a302SAlexander Bulekov }
16720f5a302SAlexander Bulekov }
16820f5a302SAlexander Bulekov
16920f5a302SAlexander Bulekov /* Don't attempt accesses larger than the maximum. */
17020f5a302SAlexander Bulekov if (l > access_size_max) {
17120f5a302SAlexander Bulekov l = access_size_max;
17220f5a302SAlexander Bulekov }
17320f5a302SAlexander Bulekov l = pow2floor(l);
17420f5a302SAlexander Bulekov
17520f5a302SAlexander Bulekov return l;
17620f5a302SAlexander Bulekov }
17720f5a302SAlexander Bulekov
17820f5a302SAlexander Bulekov /*
17920f5a302SAlexander Bulekov * Call-back for functions that perform DMA reads from guest memory. Confirm
18020f5a302SAlexander Bulekov * that the region has not already been populated since the last loop in
18120f5a302SAlexander Bulekov * generic_fuzz(), avoiding potential race-conditions, which we don't have
18220f5a302SAlexander Bulekov * a good way for reproducing right now.
18320f5a302SAlexander Bulekov */
fuzz_dma_read_cb(size_t addr,size_t len,MemoryRegion * mr)184fc1c8344SAlexander Bulekov void fuzz_dma_read_cb(size_t addr, size_t len, MemoryRegion *mr)
18520f5a302SAlexander Bulekov {
18620f5a302SAlexander Bulekov /* Are we in the generic-fuzzer or are we using another fuzz-target? */
18720f5a302SAlexander Bulekov if (!qts_global) {
18820f5a302SAlexander Bulekov return;
18920f5a302SAlexander Bulekov }
19020f5a302SAlexander Bulekov
19120f5a302SAlexander Bulekov /*
19220f5a302SAlexander Bulekov * Return immediately if:
19320f5a302SAlexander Bulekov * - We have no DMA patterns defined
19420f5a302SAlexander Bulekov * - The length of the DMA read request is zero
19520f5a302SAlexander Bulekov * - The DMA read is hitting an MR other than the machine's main RAM
19620f5a302SAlexander Bulekov * - The DMA request hits past the bounds of our RAM
19720f5a302SAlexander Bulekov */
19820f5a302SAlexander Bulekov if (dma_patterns->len == 0
19920f5a302SAlexander Bulekov || len == 0
200b8b52178SAlexander Bulekov || dma_bytes_written + len > MAX_TOTAL_DMA_SIZE
20125d309fbSAlexander Bulekov || (mr != current_machine->ram && mr != sparse_mem_mr)) {
20220f5a302SAlexander Bulekov return;
20320f5a302SAlexander Bulekov }
20420f5a302SAlexander Bulekov
20520f5a302SAlexander Bulekov /*
20620f5a302SAlexander Bulekov * If we overlap with any existing dma_regions, split the range and only
20720f5a302SAlexander Bulekov * populate the non-overlapping parts.
20820f5a302SAlexander Bulekov */
20920f5a302SAlexander Bulekov address_range region;
21020f5a302SAlexander Bulekov bool double_fetch = false;
21120f5a302SAlexander Bulekov for (int i = 0;
21220f5a302SAlexander Bulekov i < dma_regions->len && (avoid_double_fetches || qtest_log_enabled);
21320f5a302SAlexander Bulekov ++i) {
21420f5a302SAlexander Bulekov region = g_array_index(dma_regions, address_range, i);
215763719d2SYao Xingtao if (ranges_overlap(addr, len, region.addr, region.size)) {
21620f5a302SAlexander Bulekov double_fetch = true;
21720f5a302SAlexander Bulekov if (addr < region.addr
21820f5a302SAlexander Bulekov && avoid_double_fetches) {
219fc1c8344SAlexander Bulekov fuzz_dma_read_cb(addr, region.addr - addr, mr);
22020f5a302SAlexander Bulekov }
22120f5a302SAlexander Bulekov if (addr + len > region.addr + region.size
22220f5a302SAlexander Bulekov && avoid_double_fetches) {
22320f5a302SAlexander Bulekov fuzz_dma_read_cb(region.addr + region.size,
224fc1c8344SAlexander Bulekov addr + len - (region.addr + region.size), mr);
22520f5a302SAlexander Bulekov }
22620f5a302SAlexander Bulekov return;
22720f5a302SAlexander Bulekov }
22820f5a302SAlexander Bulekov }
22920f5a302SAlexander Bulekov
23020f5a302SAlexander Bulekov /* Cap the length of the DMA access to something reasonable */
23120f5a302SAlexander Bulekov len = MIN(len, MAX_DMA_FILL_SIZE);
23220f5a302SAlexander Bulekov
23320f5a302SAlexander Bulekov address_range ar = {addr, len};
23420f5a302SAlexander Bulekov g_array_append_val(dma_regions, ar);
23520f5a302SAlexander Bulekov pattern p = g_array_index(dma_patterns, pattern, dma_pattern_index);
236a9f67c1dSAlexander Bulekov void *buf_base = pattern_alloc(p, ar.size);
237a9f67c1dSAlexander Bulekov void *buf = buf_base;
23820f5a302SAlexander Bulekov hwaddr l, addr1;
23920f5a302SAlexander Bulekov MemoryRegion *mr1;
24020f5a302SAlexander Bulekov while (len > 0) {
24120f5a302SAlexander Bulekov l = len;
24220f5a302SAlexander Bulekov mr1 = address_space_translate(first_cpu->as,
24320f5a302SAlexander Bulekov addr, &addr1, &l, true,
24420f5a302SAlexander Bulekov MEMTXATTRS_UNSPECIFIED);
24520f5a302SAlexander Bulekov
246af16990aSAlexander Bulekov /*
247af16990aSAlexander Bulekov * If mr1 isn't RAM, address_space_translate doesn't update l. Use
2483123f93dSJagannathan Raman * fuzz_memory_access_size to identify the number of bytes that it
2493123f93dSJagannathan Raman * is safe to write without accidentally writing to another
2503123f93dSJagannathan Raman * MemoryRegion.
251af16990aSAlexander Bulekov */
252af16990aSAlexander Bulekov if (!memory_region_is_ram(mr1)) {
2533123f93dSJagannathan Raman l = fuzz_memory_access_size(mr1, l, addr1);
254af16990aSAlexander Bulekov }
255af16990aSAlexander Bulekov if (memory_region_is_ram(mr1) ||
256af16990aSAlexander Bulekov memory_region_is_romd(mr1) ||
257af16990aSAlexander Bulekov mr1 == sparse_mem_mr) {
25820f5a302SAlexander Bulekov /* ROM/RAM case */
25920f5a302SAlexander Bulekov if (qtest_log_enabled) {
26020f5a302SAlexander Bulekov /*
26120f5a302SAlexander Bulekov * With QTEST_LOG, use a normal, slow QTest memwrite. Prefix the log
26220f5a302SAlexander Bulekov * that will be written by qtest.c with a DMA tag, so we can reorder
26320f5a302SAlexander Bulekov * the resulting QTest trace so the DMA fills precede the last PIO/MMIO
26420f5a302SAlexander Bulekov * command.
26520f5a302SAlexander Bulekov */
26620f5a302SAlexander Bulekov fprintf(stderr, "[DMA] ");
26720f5a302SAlexander Bulekov if (double_fetch) {
26820f5a302SAlexander Bulekov fprintf(stderr, "[DOUBLE-FETCH] ");
26920f5a302SAlexander Bulekov }
27020f5a302SAlexander Bulekov fflush(stderr);
27120f5a302SAlexander Bulekov }
272a9f67c1dSAlexander Bulekov qtest_memwrite(qts_global, addr, buf, l);
273b8b52178SAlexander Bulekov dma_bytes_written += l;
274a9f67c1dSAlexander Bulekov }
275a9f67c1dSAlexander Bulekov len -= l;
276a9f67c1dSAlexander Bulekov buf += l;
277a9f67c1dSAlexander Bulekov addr += l;
278a9f67c1dSAlexander Bulekov
279a9f67c1dSAlexander Bulekov }
280a9f67c1dSAlexander Bulekov g_free(buf_base);
28120f5a302SAlexander Bulekov
28220f5a302SAlexander Bulekov /* Increment the index of the pattern for the next DMA access */
28320f5a302SAlexander Bulekov dma_pattern_index = (dma_pattern_index + 1) % dma_patterns->len;
28420f5a302SAlexander Bulekov }
28520f5a302SAlexander Bulekov
28620f5a302SAlexander Bulekov /*
287da9bf531SAlexander Bulekov * Here we want to convert a fuzzer-provided [io-region-index, offset] to
288da9bf531SAlexander Bulekov * a physical address. To do this, we iterate over all of the matched
289da9bf531SAlexander Bulekov * MemoryRegions. Check whether each region exists within the particular io
290da9bf531SAlexander Bulekov * space. Return the absolute address of the offset within the index'th region
291da9bf531SAlexander Bulekov * that is a subregion of the io_space and the distance until the end of the
292da9bf531SAlexander Bulekov * memory region.
293da9bf531SAlexander Bulekov */
get_io_address(address_range * result,AddressSpace * as,uint8_t index,uint32_t offset)294da9bf531SAlexander Bulekov static bool get_io_address(address_range *result, AddressSpace *as,
295da9bf531SAlexander Bulekov uint8_t index,
296da9bf531SAlexander Bulekov uint32_t offset) {
297da9bf531SAlexander Bulekov FlatView *view;
298da9bf531SAlexander Bulekov view = as->current_map;
299da9bf531SAlexander Bulekov g_assert(view);
300da9bf531SAlexander Bulekov struct get_io_cb_info cb_info = {};
301da9bf531SAlexander Bulekov
302da9bf531SAlexander Bulekov cb_info.index = index;
303da9bf531SAlexander Bulekov
304da9bf531SAlexander Bulekov /*
305da9bf531SAlexander Bulekov * Loop around the FlatView until we match "index" number of
306da9bf531SAlexander Bulekov * fuzzable_memoryregions, or until we know that there are no matching
307da9bf531SAlexander Bulekov * memory_regions.
308da9bf531SAlexander Bulekov */
309da9bf531SAlexander Bulekov do {
310da9bf531SAlexander Bulekov flatview_for_each_range(view, get_io_address_cb , &cb_info);
311da9bf531SAlexander Bulekov } while (cb_info.index != index && !cb_info.found);
312da9bf531SAlexander Bulekov
313da9bf531SAlexander Bulekov *result = cb_info.result;
314953e6d7cSAlexander Bulekov if (result->size) {
315953e6d7cSAlexander Bulekov offset = offset % result->size;
316953e6d7cSAlexander Bulekov result->addr += offset;
317953e6d7cSAlexander Bulekov result->size -= offset;
318953e6d7cSAlexander Bulekov }
319da9bf531SAlexander Bulekov return cb_info.found;
320da9bf531SAlexander Bulekov }
321da9bf531SAlexander Bulekov
get_pio_address(address_range * result,uint8_t index,uint16_t offset)322da9bf531SAlexander Bulekov static bool get_pio_address(address_range *result,
323da9bf531SAlexander Bulekov uint8_t index, uint16_t offset)
324da9bf531SAlexander Bulekov {
325da9bf531SAlexander Bulekov /*
326da9bf531SAlexander Bulekov * PIO BARs can be set past the maximum port address (0xFFFF). Thus, result
327da9bf531SAlexander Bulekov * can contain an addr that extends past the PIO space. When we pass this
328da9bf531SAlexander Bulekov * address to qtest_in/qtest_out, it is cast to a uint16_t, so we might end
329da9bf531SAlexander Bulekov * up fuzzing a completely different MemoryRegion/Device. Therefore, check
330da9bf531SAlexander Bulekov * that the address here is within the PIO space limits.
331da9bf531SAlexander Bulekov */
332da9bf531SAlexander Bulekov bool found = get_io_address(result, &address_space_io, index, offset);
333da9bf531SAlexander Bulekov return result->addr <= 0xFFFF ? found : false;
334da9bf531SAlexander Bulekov }
335da9bf531SAlexander Bulekov
get_mmio_address(address_range * result,uint8_t index,uint32_t offset)336da9bf531SAlexander Bulekov static bool get_mmio_address(address_range *result,
337da9bf531SAlexander Bulekov uint8_t index, uint32_t offset)
338da9bf531SAlexander Bulekov {
339da9bf531SAlexander Bulekov return get_io_address(result, &address_space_memory, index, offset);
340da9bf531SAlexander Bulekov }
341da9bf531SAlexander Bulekov
op_in(QTestState * s,const unsigned char * data,size_t len)342da9bf531SAlexander Bulekov static void op_in(QTestState *s, const unsigned char * data, size_t len)
343da9bf531SAlexander Bulekov {
344da9bf531SAlexander Bulekov enum Sizes {Byte, Word, Long, end_sizes};
345da9bf531SAlexander Bulekov struct {
346da9bf531SAlexander Bulekov uint8_t size;
347da9bf531SAlexander Bulekov uint8_t base;
348da9bf531SAlexander Bulekov uint16_t offset;
349da9bf531SAlexander Bulekov } a;
350da9bf531SAlexander Bulekov address_range abs;
351da9bf531SAlexander Bulekov
352da9bf531SAlexander Bulekov if (len < sizeof(a)) {
353da9bf531SAlexander Bulekov return;
354da9bf531SAlexander Bulekov }
355da9bf531SAlexander Bulekov memcpy(&a, data, sizeof(a));
356da9bf531SAlexander Bulekov if (get_pio_address(&abs, a.base, a.offset) == 0) {
357da9bf531SAlexander Bulekov return;
358da9bf531SAlexander Bulekov }
359da9bf531SAlexander Bulekov
360da9bf531SAlexander Bulekov switch (a.size %= end_sizes) {
361da9bf531SAlexander Bulekov case Byte:
362da9bf531SAlexander Bulekov qtest_inb(s, abs.addr);
363da9bf531SAlexander Bulekov break;
364da9bf531SAlexander Bulekov case Word:
365da9bf531SAlexander Bulekov if (abs.size >= 2) {
366da9bf531SAlexander Bulekov qtest_inw(s, abs.addr);
367da9bf531SAlexander Bulekov }
368da9bf531SAlexander Bulekov break;
369da9bf531SAlexander Bulekov case Long:
370da9bf531SAlexander Bulekov if (abs.size >= 4) {
371da9bf531SAlexander Bulekov qtest_inl(s, abs.addr);
372da9bf531SAlexander Bulekov }
373da9bf531SAlexander Bulekov break;
374da9bf531SAlexander Bulekov }
375da9bf531SAlexander Bulekov }
376da9bf531SAlexander Bulekov
op_out(QTestState * s,const unsigned char * data,size_t len)377da9bf531SAlexander Bulekov static void op_out(QTestState *s, const unsigned char * data, size_t len)
378da9bf531SAlexander Bulekov {
379da9bf531SAlexander Bulekov enum Sizes {Byte, Word, Long, end_sizes};
380da9bf531SAlexander Bulekov struct {
381da9bf531SAlexander Bulekov uint8_t size;
382da9bf531SAlexander Bulekov uint8_t base;
383da9bf531SAlexander Bulekov uint16_t offset;
384da9bf531SAlexander Bulekov uint32_t value;
385da9bf531SAlexander Bulekov } a;
386da9bf531SAlexander Bulekov address_range abs;
387da9bf531SAlexander Bulekov
388da9bf531SAlexander Bulekov if (len < sizeof(a)) {
389da9bf531SAlexander Bulekov return;
390da9bf531SAlexander Bulekov }
391da9bf531SAlexander Bulekov memcpy(&a, data, sizeof(a));
392da9bf531SAlexander Bulekov
393da9bf531SAlexander Bulekov if (get_pio_address(&abs, a.base, a.offset) == 0) {
394da9bf531SAlexander Bulekov return;
395da9bf531SAlexander Bulekov }
396da9bf531SAlexander Bulekov
397da9bf531SAlexander Bulekov switch (a.size %= end_sizes) {
398da9bf531SAlexander Bulekov case Byte:
399da9bf531SAlexander Bulekov qtest_outb(s, abs.addr, a.value & 0xFF);
400da9bf531SAlexander Bulekov break;
401da9bf531SAlexander Bulekov case Word:
402da9bf531SAlexander Bulekov if (abs.size >= 2) {
403da9bf531SAlexander Bulekov qtest_outw(s, abs.addr, a.value & 0xFFFF);
404da9bf531SAlexander Bulekov }
405da9bf531SAlexander Bulekov break;
406da9bf531SAlexander Bulekov case Long:
407da9bf531SAlexander Bulekov if (abs.size >= 4) {
408da9bf531SAlexander Bulekov qtest_outl(s, abs.addr, a.value);
409da9bf531SAlexander Bulekov }
410da9bf531SAlexander Bulekov break;
411da9bf531SAlexander Bulekov }
412da9bf531SAlexander Bulekov }
413da9bf531SAlexander Bulekov
op_read(QTestState * s,const unsigned char * data,size_t len)414da9bf531SAlexander Bulekov static void op_read(QTestState *s, const unsigned char * data, size_t len)
415da9bf531SAlexander Bulekov {
416da9bf531SAlexander Bulekov enum Sizes {Byte, Word, Long, Quad, end_sizes};
417da9bf531SAlexander Bulekov struct {
418da9bf531SAlexander Bulekov uint8_t size;
419da9bf531SAlexander Bulekov uint8_t base;
420da9bf531SAlexander Bulekov uint32_t offset;
421da9bf531SAlexander Bulekov } a;
422da9bf531SAlexander Bulekov address_range abs;
423da9bf531SAlexander Bulekov
424da9bf531SAlexander Bulekov if (len < sizeof(a)) {
425da9bf531SAlexander Bulekov return;
426da9bf531SAlexander Bulekov }
427da9bf531SAlexander Bulekov memcpy(&a, data, sizeof(a));
428da9bf531SAlexander Bulekov
429da9bf531SAlexander Bulekov if (get_mmio_address(&abs, a.base, a.offset) == 0) {
430da9bf531SAlexander Bulekov return;
431da9bf531SAlexander Bulekov }
432da9bf531SAlexander Bulekov
433da9bf531SAlexander Bulekov switch (a.size %= end_sizes) {
434da9bf531SAlexander Bulekov case Byte:
435da9bf531SAlexander Bulekov qtest_readb(s, abs.addr);
436da9bf531SAlexander Bulekov break;
437da9bf531SAlexander Bulekov case Word:
438da9bf531SAlexander Bulekov if (abs.size >= 2) {
439da9bf531SAlexander Bulekov qtest_readw(s, abs.addr);
440da9bf531SAlexander Bulekov }
441da9bf531SAlexander Bulekov break;
442da9bf531SAlexander Bulekov case Long:
443da9bf531SAlexander Bulekov if (abs.size >= 4) {
444da9bf531SAlexander Bulekov qtest_readl(s, abs.addr);
445da9bf531SAlexander Bulekov }
446da9bf531SAlexander Bulekov break;
447da9bf531SAlexander Bulekov case Quad:
448da9bf531SAlexander Bulekov if (abs.size >= 8) {
449da9bf531SAlexander Bulekov qtest_readq(s, abs.addr);
450da9bf531SAlexander Bulekov }
451da9bf531SAlexander Bulekov break;
452da9bf531SAlexander Bulekov }
453da9bf531SAlexander Bulekov }
454da9bf531SAlexander Bulekov
op_write(QTestState * s,const unsigned char * data,size_t len)455da9bf531SAlexander Bulekov static void op_write(QTestState *s, const unsigned char * data, size_t len)
456da9bf531SAlexander Bulekov {
457da9bf531SAlexander Bulekov enum Sizes {Byte, Word, Long, Quad, end_sizes};
458da9bf531SAlexander Bulekov struct {
459da9bf531SAlexander Bulekov uint8_t size;
460da9bf531SAlexander Bulekov uint8_t base;
461da9bf531SAlexander Bulekov uint32_t offset;
462da9bf531SAlexander Bulekov uint64_t value;
463da9bf531SAlexander Bulekov } a;
464da9bf531SAlexander Bulekov address_range abs;
465da9bf531SAlexander Bulekov
466da9bf531SAlexander Bulekov if (len < sizeof(a)) {
467da9bf531SAlexander Bulekov return;
468da9bf531SAlexander Bulekov }
469da9bf531SAlexander Bulekov memcpy(&a, data, sizeof(a));
470da9bf531SAlexander Bulekov
471da9bf531SAlexander Bulekov if (get_mmio_address(&abs, a.base, a.offset) == 0) {
472da9bf531SAlexander Bulekov return;
473da9bf531SAlexander Bulekov }
474da9bf531SAlexander Bulekov
475da9bf531SAlexander Bulekov switch (a.size %= end_sizes) {
476da9bf531SAlexander Bulekov case Byte:
477da9bf531SAlexander Bulekov qtest_writeb(s, abs.addr, a.value & 0xFF);
478da9bf531SAlexander Bulekov break;
479da9bf531SAlexander Bulekov case Word:
480da9bf531SAlexander Bulekov if (abs.size >= 2) {
481da9bf531SAlexander Bulekov qtest_writew(s, abs.addr, a.value & 0xFFFF);
482da9bf531SAlexander Bulekov }
483da9bf531SAlexander Bulekov break;
484da9bf531SAlexander Bulekov case Long:
485da9bf531SAlexander Bulekov if (abs.size >= 4) {
486da9bf531SAlexander Bulekov qtest_writel(s, abs.addr, a.value & 0xFFFFFFFF);
487da9bf531SAlexander Bulekov }
488da9bf531SAlexander Bulekov break;
489da9bf531SAlexander Bulekov case Quad:
490da9bf531SAlexander Bulekov if (abs.size >= 8) {
491da9bf531SAlexander Bulekov qtest_writeq(s, abs.addr, a.value);
492da9bf531SAlexander Bulekov }
493da9bf531SAlexander Bulekov break;
494da9bf531SAlexander Bulekov }
495da9bf531SAlexander Bulekov }
496da9bf531SAlexander Bulekov
op_pci_read(QTestState * s,const unsigned char * data,size_t len)49705efbf24SAlexander Bulekov static void op_pci_read(QTestState *s, const unsigned char * data, size_t len)
49805efbf24SAlexander Bulekov {
49905efbf24SAlexander Bulekov enum Sizes {Byte, Word, Long, end_sizes};
50005efbf24SAlexander Bulekov struct {
50105efbf24SAlexander Bulekov uint8_t size;
50205efbf24SAlexander Bulekov uint8_t base;
50305efbf24SAlexander Bulekov uint8_t offset;
50405efbf24SAlexander Bulekov } a;
505ccbd4bc8SAlexander Bulekov if (len < sizeof(a) || fuzzable_pci_devices->len == 0 || pci_disabled) {
50605efbf24SAlexander Bulekov return;
50705efbf24SAlexander Bulekov }
50805efbf24SAlexander Bulekov memcpy(&a, data, sizeof(a));
50905efbf24SAlexander Bulekov PCIDevice *dev = g_ptr_array_index(fuzzable_pci_devices,
51005efbf24SAlexander Bulekov a.base % fuzzable_pci_devices->len);
51105efbf24SAlexander Bulekov int devfn = dev->devfn;
51205efbf24SAlexander Bulekov qtest_outl(s, PCI_HOST_BRIDGE_CFG, (1U << 31) | (devfn << 8) | a.offset);
51305efbf24SAlexander Bulekov switch (a.size %= end_sizes) {
51405efbf24SAlexander Bulekov case Byte:
51505efbf24SAlexander Bulekov qtest_inb(s, PCI_HOST_BRIDGE_DATA);
51605efbf24SAlexander Bulekov break;
51705efbf24SAlexander Bulekov case Word:
51805efbf24SAlexander Bulekov qtest_inw(s, PCI_HOST_BRIDGE_DATA);
51905efbf24SAlexander Bulekov break;
52005efbf24SAlexander Bulekov case Long:
52105efbf24SAlexander Bulekov qtest_inl(s, PCI_HOST_BRIDGE_DATA);
52205efbf24SAlexander Bulekov break;
52305efbf24SAlexander Bulekov }
52405efbf24SAlexander Bulekov }
52505efbf24SAlexander Bulekov
op_pci_write(QTestState * s,const unsigned char * data,size_t len)52605efbf24SAlexander Bulekov static void op_pci_write(QTestState *s, const unsigned char * data, size_t len)
52705efbf24SAlexander Bulekov {
52805efbf24SAlexander Bulekov enum Sizes {Byte, Word, Long, end_sizes};
52905efbf24SAlexander Bulekov struct {
53005efbf24SAlexander Bulekov uint8_t size;
53105efbf24SAlexander Bulekov uint8_t base;
53205efbf24SAlexander Bulekov uint8_t offset;
53305efbf24SAlexander Bulekov uint32_t value;
53405efbf24SAlexander Bulekov } a;
535ccbd4bc8SAlexander Bulekov if (len < sizeof(a) || fuzzable_pci_devices->len == 0 || pci_disabled) {
53605efbf24SAlexander Bulekov return;
53705efbf24SAlexander Bulekov }
53805efbf24SAlexander Bulekov memcpy(&a, data, sizeof(a));
53905efbf24SAlexander Bulekov PCIDevice *dev = g_ptr_array_index(fuzzable_pci_devices,
54005efbf24SAlexander Bulekov a.base % fuzzable_pci_devices->len);
54105efbf24SAlexander Bulekov int devfn = dev->devfn;
54205efbf24SAlexander Bulekov qtest_outl(s, PCI_HOST_BRIDGE_CFG, (1U << 31) | (devfn << 8) | a.offset);
54305efbf24SAlexander Bulekov switch (a.size %= end_sizes) {
54405efbf24SAlexander Bulekov case Byte:
54505efbf24SAlexander Bulekov qtest_outb(s, PCI_HOST_BRIDGE_DATA, a.value & 0xFF);
54605efbf24SAlexander Bulekov break;
54705efbf24SAlexander Bulekov case Word:
54805efbf24SAlexander Bulekov qtest_outw(s, PCI_HOST_BRIDGE_DATA, a.value & 0xFFFF);
54905efbf24SAlexander Bulekov break;
55005efbf24SAlexander Bulekov case Long:
55105efbf24SAlexander Bulekov qtest_outl(s, PCI_HOST_BRIDGE_DATA, a.value & 0xFFFFFFFF);
55205efbf24SAlexander Bulekov break;
55305efbf24SAlexander Bulekov }
55405efbf24SAlexander Bulekov }
55505efbf24SAlexander Bulekov
op_add_dma_pattern(QTestState * s,const unsigned char * data,size_t len)55620f5a302SAlexander Bulekov static void op_add_dma_pattern(QTestState *s,
55720f5a302SAlexander Bulekov const unsigned char *data, size_t len)
55820f5a302SAlexander Bulekov {
55920f5a302SAlexander Bulekov struct {
56020f5a302SAlexander Bulekov /*
56120f5a302SAlexander Bulekov * index and stride can be used to increment the index-th byte of the
56220f5a302SAlexander Bulekov * pattern by the value stride, for each loop of the pattern.
56320f5a302SAlexander Bulekov */
56420f5a302SAlexander Bulekov uint8_t index;
56520f5a302SAlexander Bulekov uint8_t stride;
56620f5a302SAlexander Bulekov } a;
56720f5a302SAlexander Bulekov
56820f5a302SAlexander Bulekov if (len < sizeof(a) + 1) {
56920f5a302SAlexander Bulekov return;
57020f5a302SAlexander Bulekov }
57120f5a302SAlexander Bulekov memcpy(&a, data, sizeof(a));
57220f5a302SAlexander Bulekov pattern p = {a.index, a.stride, len - sizeof(a), data + sizeof(a)};
57320f5a302SAlexander Bulekov p.index = a.index % p.len;
57420f5a302SAlexander Bulekov g_array_append_val(dma_patterns, p);
57520f5a302SAlexander Bulekov }
57620f5a302SAlexander Bulekov
op_clear_dma_patterns(QTestState * s,const unsigned char * data,size_t len)57720f5a302SAlexander Bulekov static void op_clear_dma_patterns(QTestState *s,
57820f5a302SAlexander Bulekov const unsigned char *data, size_t len)
57920f5a302SAlexander Bulekov {
58020f5a302SAlexander Bulekov g_array_set_size(dma_patterns, 0);
58120f5a302SAlexander Bulekov dma_pattern_index = 0;
58220f5a302SAlexander Bulekov }
58320f5a302SAlexander Bulekov
op_clock_step(QTestState * s,const unsigned char * data,size_t len)584da9bf531SAlexander Bulekov static void op_clock_step(QTestState *s, const unsigned char *data, size_t len)
585da9bf531SAlexander Bulekov {
586da9bf531SAlexander Bulekov qtest_clock_step_next(s);
587da9bf531SAlexander Bulekov }
588da9bf531SAlexander Bulekov
op_disable_pci(QTestState * s,const unsigned char * data,size_t len)589ccbd4bc8SAlexander Bulekov static void op_disable_pci(QTestState *s, const unsigned char *data, size_t len)
590ccbd4bc8SAlexander Bulekov {
591ccbd4bc8SAlexander Bulekov pci_disabled = true;
592ccbd4bc8SAlexander Bulekov }
593ccbd4bc8SAlexander Bulekov
594da9bf531SAlexander Bulekov /*
595da9bf531SAlexander Bulekov * Here, we interpret random bytes from the fuzzer, as a sequence of commands.
596da9bf531SAlexander Bulekov * Some commands can be variable-width, so we use a separator, SEPARATOR, to
597da9bf531SAlexander Bulekov * specify the boundaries between commands. SEPARATOR is used to separate
598da9bf531SAlexander Bulekov * "operations" in the fuzz input. Why use a separator, instead of just using
599da9bf531SAlexander Bulekov * the operations' length to identify operation boundaries?
600da9bf531SAlexander Bulekov * 1. This is a simple way to support variable-length operations
601da9bf531SAlexander Bulekov * 2. This adds "stability" to the input.
602da9bf531SAlexander Bulekov * For example take the input "AbBcgDefg", where there is no separator and
603da9bf531SAlexander Bulekov * Opcodes are capitalized.
604da9bf531SAlexander Bulekov * Simply, by removing the first byte, we end up with a very different
605da9bf531SAlexander Bulekov * sequence:
606da9bf531SAlexander Bulekov * BbcGdefg...
607da9bf531SAlexander Bulekov * By adding a separator, we avoid this problem:
608da9bf531SAlexander Bulekov * Ab SEP Bcg SEP Defg -> B SEP Bcg SEP Defg
609da9bf531SAlexander Bulekov * Since B uses two additional bytes as operands, the first "B" will be
610da9bf531SAlexander Bulekov * ignored. The fuzzer actively tries to reduce inputs, so such unused
611da9bf531SAlexander Bulekov * bytes are likely to be pruned, eventually.
612da9bf531SAlexander Bulekov *
613da9bf531SAlexander Bulekov * SEPARATOR is trivial for the fuzzer to discover when using ASan. Optionally,
614da9bf531SAlexander Bulekov * SEPARATOR can be manually specified as a dictionary value (see libfuzzer's
615da9bf531SAlexander Bulekov * -dict), though this should not be necessary.
616da9bf531SAlexander Bulekov *
617da9bf531SAlexander Bulekov * As a result, the stream of bytes is converted into a sequence of commands.
618da9bf531SAlexander Bulekov * In a simplified example where SEPARATOR is 0xFF:
619da9bf531SAlexander Bulekov * 00 01 02 FF 03 04 05 06 FF 01 FF ...
620da9bf531SAlexander Bulekov * becomes this sequence of commands:
621da9bf531SAlexander Bulekov * 00 01 02 -> op00 (0102) -> in (0102, 2)
622da9bf531SAlexander Bulekov * 03 04 05 06 -> op03 (040506) -> write (040506, 3)
623da9bf531SAlexander Bulekov * 01 -> op01 (-,0) -> out (-,0)
624da9bf531SAlexander Bulekov * ...
625da9bf531SAlexander Bulekov *
626da9bf531SAlexander Bulekov * Note here that it is the job of the individual opcode functions to check
627da9bf531SAlexander Bulekov * that enough data was provided. I.e. in the last command out (,0), out needs
628da9bf531SAlexander Bulekov * to check that there is not enough data provided to select an address/value
629da9bf531SAlexander Bulekov * for the operation.
630da9bf531SAlexander Bulekov */
generic_fuzz(QTestState * s,const unsigned char * Data,size_t Size)631da9bf531SAlexander Bulekov static void generic_fuzz(QTestState *s, const unsigned char *Data, size_t Size)
632da9bf531SAlexander Bulekov {
633da9bf531SAlexander Bulekov void (*ops[]) (QTestState *s, const unsigned char* , size_t) = {
634da9bf531SAlexander Bulekov [OP_IN] = op_in,
635da9bf531SAlexander Bulekov [OP_OUT] = op_out,
636da9bf531SAlexander Bulekov [OP_READ] = op_read,
637da9bf531SAlexander Bulekov [OP_WRITE] = op_write,
63805efbf24SAlexander Bulekov [OP_PCI_READ] = op_pci_read,
63905efbf24SAlexander Bulekov [OP_PCI_WRITE] = op_pci_write,
640ccbd4bc8SAlexander Bulekov [OP_DISABLE_PCI] = op_disable_pci,
64120f5a302SAlexander Bulekov [OP_ADD_DMA_PATTERN] = op_add_dma_pattern,
64220f5a302SAlexander Bulekov [OP_CLEAR_DMA_PATTERNS] = op_clear_dma_patterns,
643da9bf531SAlexander Bulekov [OP_CLOCK_STEP] = op_clock_step,
644da9bf531SAlexander Bulekov };
645da9bf531SAlexander Bulekov const unsigned char *cmd = Data;
646da9bf531SAlexander Bulekov const unsigned char *nextcmd;
647da9bf531SAlexander Bulekov size_t cmd_len;
648da9bf531SAlexander Bulekov uint8_t op;
649da9bf531SAlexander Bulekov
65020f5a302SAlexander Bulekov op_clear_dma_patterns(s, NULL, 0);
651ccbd4bc8SAlexander Bulekov pci_disabled = false;
652b8b52178SAlexander Bulekov dma_bytes_written = 0;
65320f5a302SAlexander Bulekov
65413751043SAlexander Bulekov QPCIBus *pcibus = qpci_new_pc(s, NULL);
65513751043SAlexander Bulekov g_ptr_array_foreach(fuzzable_pci_devices, pci_enum, pcibus);
65613751043SAlexander Bulekov qpci_free_pc(pcibus);
657993f52f4SAlexander Bulekov
65813751043SAlexander Bulekov while (cmd && Size) {
659da9bf531SAlexander Bulekov /* Get the length until the next command or end of input */
660da9bf531SAlexander Bulekov nextcmd = memmem(cmd, Size, SEPARATOR, strlen(SEPARATOR));
661da9bf531SAlexander Bulekov cmd_len = nextcmd ? nextcmd - cmd : Size;
662da9bf531SAlexander Bulekov
663da9bf531SAlexander Bulekov if (cmd_len > 0) {
664da9bf531SAlexander Bulekov /* Interpret the first byte of the command as an opcode */
665da9bf531SAlexander Bulekov op = *cmd % (sizeof(ops) / sizeof((ops)[0]));
666da9bf531SAlexander Bulekov ops[op](s, cmd + 1, cmd_len - 1);
667da9bf531SAlexander Bulekov
668da9bf531SAlexander Bulekov /* Run the main loop */
669da9bf531SAlexander Bulekov flush_events(s);
670da9bf531SAlexander Bulekov }
671da9bf531SAlexander Bulekov /* Advance to the next command */
672da9bf531SAlexander Bulekov cmd = nextcmd ? nextcmd + sizeof(SEPARATOR) - 1 : nextcmd;
673da9bf531SAlexander Bulekov Size = Size - (cmd_len + sizeof(SEPARATOR) - 1);
67420f5a302SAlexander Bulekov g_array_set_size(dma_regions, 0);
675da9bf531SAlexander Bulekov }
67613751043SAlexander Bulekov fuzz_reset(s);
677da9bf531SAlexander Bulekov }
678da9bf531SAlexander Bulekov
usage(void)679da9bf531SAlexander Bulekov static void usage(void)
680da9bf531SAlexander Bulekov {
681da9bf531SAlexander Bulekov printf("Please specify the following environment variables:\n");
682da9bf531SAlexander Bulekov printf("QEMU_FUZZ_ARGS= the command line arguments passed to qemu\n");
683da9bf531SAlexander Bulekov printf("QEMU_FUZZ_OBJECTS= "
684da9bf531SAlexander Bulekov "a space separated list of QOM type names for objects to fuzz\n");
68520f5a302SAlexander Bulekov printf("Optionally: QEMU_AVOID_DOUBLE_FETCH= "
68620f5a302SAlexander Bulekov "Try to avoid racy DMA double fetch bugs? %d by default\n",
68720f5a302SAlexander Bulekov avoid_double_fetches);
688da9bf531SAlexander Bulekov exit(0);
689da9bf531SAlexander Bulekov }
690da9bf531SAlexander Bulekov
locate_fuzz_memory_regions(Object * child,void * opaque)691da9bf531SAlexander Bulekov static int locate_fuzz_memory_regions(Object *child, void *opaque)
692da9bf531SAlexander Bulekov {
693da9bf531SAlexander Bulekov MemoryRegion *mr;
694da9bf531SAlexander Bulekov if (object_dynamic_cast(child, TYPE_MEMORY_REGION)) {
695da9bf531SAlexander Bulekov mr = MEMORY_REGION(child);
696da9bf531SAlexander Bulekov if ((memory_region_is_ram(mr) ||
697da9bf531SAlexander Bulekov memory_region_is_ram_device(mr) ||
698da9bf531SAlexander Bulekov memory_region_is_rom(mr)) == false) {
699da9bf531SAlexander Bulekov /*
700da9bf531SAlexander Bulekov * We don't want duplicate pointers to the same MemoryRegion, so
701da9bf531SAlexander Bulekov * try to remove copies of the pointer, before adding it.
702da9bf531SAlexander Bulekov */
703da9bf531SAlexander Bulekov g_hash_table_insert(fuzzable_memoryregions, mr, (gpointer)true);
704da9bf531SAlexander Bulekov }
705da9bf531SAlexander Bulekov }
706da9bf531SAlexander Bulekov return 0;
707da9bf531SAlexander Bulekov }
708da9bf531SAlexander Bulekov
locate_fuzz_objects(Object * child,void * opaque)709da9bf531SAlexander Bulekov static int locate_fuzz_objects(Object *child, void *opaque)
710da9bf531SAlexander Bulekov {
711f2e8b87aSAlexander Bulekov GString *type_name;
712f2e8b87aSAlexander Bulekov GString *path_name;
713da9bf531SAlexander Bulekov char *pattern = opaque;
714f2e8b87aSAlexander Bulekov
715f2e8b87aSAlexander Bulekov type_name = g_string_new(object_get_typename(child));
716f2e8b87aSAlexander Bulekov g_string_ascii_down(type_name);
717f2e8b87aSAlexander Bulekov if (g_pattern_match_simple(pattern, type_name->str)) {
718da9bf531SAlexander Bulekov /* Find and save ptrs to any child MemoryRegions */
719da9bf531SAlexander Bulekov object_child_foreach_recursive(child, locate_fuzz_memory_regions, NULL);
720da9bf531SAlexander Bulekov
72105efbf24SAlexander Bulekov /*
72205efbf24SAlexander Bulekov * We matched an object. If its a PCI device, store a pointer to it so
72305efbf24SAlexander Bulekov * we can map BARs and fuzz its config space.
72405efbf24SAlexander Bulekov */
72505efbf24SAlexander Bulekov if (object_dynamic_cast(OBJECT(child), TYPE_PCI_DEVICE)) {
72605efbf24SAlexander Bulekov /*
72705efbf24SAlexander Bulekov * Don't want duplicate pointers to the same PCIDevice, so remove
72805efbf24SAlexander Bulekov * copies of the pointer, before adding it.
72905efbf24SAlexander Bulekov */
73005efbf24SAlexander Bulekov g_ptr_array_remove_fast(fuzzable_pci_devices, PCI_DEVICE(child));
73105efbf24SAlexander Bulekov g_ptr_array_add(fuzzable_pci_devices, PCI_DEVICE(child));
73205efbf24SAlexander Bulekov }
733da9bf531SAlexander Bulekov } else if (object_dynamic_cast(OBJECT(child), TYPE_MEMORY_REGION)) {
734f2e8b87aSAlexander Bulekov path_name = g_string_new(object_get_canonical_path_component(child));
735f2e8b87aSAlexander Bulekov g_string_ascii_down(path_name);
736f2e8b87aSAlexander Bulekov if (g_pattern_match_simple(pattern, path_name->str)) {
737da9bf531SAlexander Bulekov MemoryRegion *mr;
738da9bf531SAlexander Bulekov mr = MEMORY_REGION(child);
739da9bf531SAlexander Bulekov if ((memory_region_is_ram(mr) ||
740da9bf531SAlexander Bulekov memory_region_is_ram_device(mr) ||
741da9bf531SAlexander Bulekov memory_region_is_rom(mr)) == false) {
742da9bf531SAlexander Bulekov g_hash_table_insert(fuzzable_memoryregions, mr, (gpointer)true);
743da9bf531SAlexander Bulekov }
744da9bf531SAlexander Bulekov }
745f2e8b87aSAlexander Bulekov g_string_free(path_name, true);
746da9bf531SAlexander Bulekov }
747f2e8b87aSAlexander Bulekov g_string_free(type_name, true);
748da9bf531SAlexander Bulekov return 0;
749da9bf531SAlexander Bulekov }
750da9bf531SAlexander Bulekov
751b677001dSAlexander Bulekov
pci_enum(gpointer pcidev,gpointer bus)752b677001dSAlexander Bulekov static void pci_enum(gpointer pcidev, gpointer bus)
753b677001dSAlexander Bulekov {
754b677001dSAlexander Bulekov PCIDevice *dev = pcidev;
755b677001dSAlexander Bulekov QPCIDevice *qdev;
756b677001dSAlexander Bulekov int i;
757b677001dSAlexander Bulekov
758b677001dSAlexander Bulekov qdev = qpci_device_find(bus, dev->devfn);
759b677001dSAlexander Bulekov g_assert(qdev != NULL);
760b677001dSAlexander Bulekov for (i = 0; i < 6; i++) {
761b677001dSAlexander Bulekov if (dev->io_regions[i].size) {
762b677001dSAlexander Bulekov qpci_iomap(qdev, i, NULL);
763b677001dSAlexander Bulekov }
764b677001dSAlexander Bulekov }
765b677001dSAlexander Bulekov qpci_device_enable(qdev);
766b677001dSAlexander Bulekov g_free(qdev);
767b677001dSAlexander Bulekov }
768b677001dSAlexander Bulekov
generic_pre_fuzz(QTestState * s)769da9bf531SAlexander Bulekov static void generic_pre_fuzz(QTestState *s)
770da9bf531SAlexander Bulekov {
771da9bf531SAlexander Bulekov GHashTableIter iter;
772da9bf531SAlexander Bulekov MemoryRegion *mr;
773da9bf531SAlexander Bulekov char **result;
774f2e8b87aSAlexander Bulekov GString *name_pattern;
775da9bf531SAlexander Bulekov
776da9bf531SAlexander Bulekov if (!getenv("QEMU_FUZZ_OBJECTS")) {
777da9bf531SAlexander Bulekov usage();
778da9bf531SAlexander Bulekov }
779da9bf531SAlexander Bulekov if (getenv("QTEST_LOG")) {
780da9bf531SAlexander Bulekov qtest_log_enabled = 1;
781da9bf531SAlexander Bulekov }
78220f5a302SAlexander Bulekov if (getenv("QEMU_AVOID_DOUBLE_FETCH")) {
78320f5a302SAlexander Bulekov avoid_double_fetches = 1;
78420f5a302SAlexander Bulekov }
78520f5a302SAlexander Bulekov qts_global = s;
78620f5a302SAlexander Bulekov
78725d309fbSAlexander Bulekov /*
78825d309fbSAlexander Bulekov * Create a special device that we can use to back DMA buffers at very
78925d309fbSAlexander Bulekov * high memory addresses
79025d309fbSAlexander Bulekov */
79125d309fbSAlexander Bulekov sparse_mem_mr = sparse_mem_init(0, UINT64_MAX);
79225d309fbSAlexander Bulekov
79320f5a302SAlexander Bulekov dma_regions = g_array_new(false, false, sizeof(address_range));
79420f5a302SAlexander Bulekov dma_patterns = g_array_new(false, false, sizeof(pattern));
795da9bf531SAlexander Bulekov
796da9bf531SAlexander Bulekov fuzzable_memoryregions = g_hash_table_new(NULL, NULL);
79705efbf24SAlexander Bulekov fuzzable_pci_devices = g_ptr_array_new();
798da9bf531SAlexander Bulekov
799da9bf531SAlexander Bulekov result = g_strsplit(getenv("QEMU_FUZZ_OBJECTS"), " ", -1);
800da9bf531SAlexander Bulekov for (int i = 0; result[i] != NULL; i++) {
801f2e8b87aSAlexander Bulekov name_pattern = g_string_new(result[i]);
802f2e8b87aSAlexander Bulekov /*
803f2e8b87aSAlexander Bulekov * Make the pattern lowercase. We do the same for all the MemoryRegion
804f2e8b87aSAlexander Bulekov * and Type names so the configs are case-insensitive.
805f2e8b87aSAlexander Bulekov */
806f2e8b87aSAlexander Bulekov g_string_ascii_down(name_pattern);
807da9bf531SAlexander Bulekov printf("Matching objects by name %s\n", result[i]);
808da9bf531SAlexander Bulekov object_child_foreach_recursive(qdev_get_machine(),
809da9bf531SAlexander Bulekov locate_fuzz_objects,
810f2e8b87aSAlexander Bulekov name_pattern->str);
811f2e8b87aSAlexander Bulekov g_string_free(name_pattern, true);
812da9bf531SAlexander Bulekov }
813da9bf531SAlexander Bulekov g_strfreev(result);
814da9bf531SAlexander Bulekov printf("This process will try to fuzz the following MemoryRegions:\n");
815da9bf531SAlexander Bulekov
816da9bf531SAlexander Bulekov g_hash_table_iter_init(&iter, fuzzable_memoryregions);
817da9bf531SAlexander Bulekov while (g_hash_table_iter_next(&iter, (gpointer)&mr, NULL)) {
818a8fbec7eSPhilippe Mathieu-Daudé printf(" * %s (size 0x%" PRIx64 ")\n",
819da9bf531SAlexander Bulekov object_get_canonical_path_component(&(mr->parent_obj)),
820a8fbec7eSPhilippe Mathieu-Daudé memory_region_size(mr));
821da9bf531SAlexander Bulekov }
822da9bf531SAlexander Bulekov
823da9bf531SAlexander Bulekov if (!g_hash_table_size(fuzzable_memoryregions)) {
824da9bf531SAlexander Bulekov printf("No fuzzable memory regions found...\n");
825da9bf531SAlexander Bulekov exit(1);
826da9bf531SAlexander Bulekov }
827da9bf531SAlexander Bulekov }
828da9bf531SAlexander Bulekov
829a2539322SAlexander Bulekov /*
830a2539322SAlexander Bulekov * When libfuzzer gives us two inputs to combine, return a new input with the
831a2539322SAlexander Bulekov * following structure:
832a2539322SAlexander Bulekov *
833a2539322SAlexander Bulekov * Input 1 (data1)
834a2539322SAlexander Bulekov * SEPARATOR
835a2539322SAlexander Bulekov * Clear out the DMA Patterns
836a2539322SAlexander Bulekov * SEPARATOR
837a2539322SAlexander Bulekov * Disable the pci_read/write instructions
838a2539322SAlexander Bulekov * SEPARATOR
839a2539322SAlexander Bulekov * Input 2 (data2)
840a2539322SAlexander Bulekov *
841a2539322SAlexander Bulekov * The idea is to collate the core behaviors of the two inputs.
842a2539322SAlexander Bulekov * For example:
843a2539322SAlexander Bulekov * Input 1: maps a device's BARs, sets up three DMA patterns, and triggers
844a2539322SAlexander Bulekov * device functionality A
845a2539322SAlexander Bulekov * Input 2: maps a device's BARs, sets up one DMA pattern, and triggers device
846a2539322SAlexander Bulekov * functionality B
847a2539322SAlexander Bulekov *
848a2539322SAlexander Bulekov * This function attempts to produce an input that:
84996420a30SMichael Tokarev * Output: maps a device's BARs, set up three DMA patterns, triggers
85096420a30SMichael Tokarev * device functionality A, replaces the DMA patterns with a single
85196420a30SMichael Tokarev * pattern, and triggers device functionality B.
852a2539322SAlexander Bulekov */
generic_fuzz_crossover(const uint8_t * data1,size_t size1,const uint8_t * data2,size_t size2,uint8_t * out,size_t max_out_size,unsigned int seed)853a2539322SAlexander Bulekov static size_t generic_fuzz_crossover(const uint8_t *data1, size_t size1, const
854a2539322SAlexander Bulekov uint8_t *data2, size_t size2, uint8_t *out,
855a2539322SAlexander Bulekov size_t max_out_size, unsigned int seed)
856a2539322SAlexander Bulekov {
857a2539322SAlexander Bulekov size_t copy_len = 0, size = 0;
858a2539322SAlexander Bulekov
859a2539322SAlexander Bulekov /* Check that we have enough space for data1 and at least part of data2 */
860a2539322SAlexander Bulekov if (max_out_size <= size1 + strlen(SEPARATOR) * 3 + 2) {
861a2539322SAlexander Bulekov return 0;
862a2539322SAlexander Bulekov }
863a2539322SAlexander Bulekov
864a2539322SAlexander Bulekov /* Copy_Len in the first input */
865a2539322SAlexander Bulekov copy_len = size1;
866a2539322SAlexander Bulekov memcpy(out + size, data1, copy_len);
867a2539322SAlexander Bulekov size += copy_len;
868a2539322SAlexander Bulekov max_out_size -= copy_len;
869a2539322SAlexander Bulekov
870a2539322SAlexander Bulekov /* Append a separator */
871a2539322SAlexander Bulekov copy_len = strlen(SEPARATOR);
872a2539322SAlexander Bulekov memcpy(out + size, SEPARATOR, copy_len);
873a2539322SAlexander Bulekov size += copy_len;
874a2539322SAlexander Bulekov max_out_size -= copy_len;
875a2539322SAlexander Bulekov
876a2539322SAlexander Bulekov /* Clear out the DMA Patterns */
877a2539322SAlexander Bulekov copy_len = 1;
878a2539322SAlexander Bulekov if (copy_len) {
879a2539322SAlexander Bulekov out[size] = OP_CLEAR_DMA_PATTERNS;
880a2539322SAlexander Bulekov }
881a2539322SAlexander Bulekov size += copy_len;
882a2539322SAlexander Bulekov max_out_size -= copy_len;
883a2539322SAlexander Bulekov
884a2539322SAlexander Bulekov /* Append a separator */
885a2539322SAlexander Bulekov copy_len = strlen(SEPARATOR);
886a2539322SAlexander Bulekov memcpy(out + size, SEPARATOR, copy_len);
887a2539322SAlexander Bulekov size += copy_len;
888a2539322SAlexander Bulekov max_out_size -= copy_len;
889a2539322SAlexander Bulekov
890a2539322SAlexander Bulekov /* Disable PCI ops. Assume data1 took care of setting up PCI */
891a2539322SAlexander Bulekov copy_len = 1;
892a2539322SAlexander Bulekov if (copy_len) {
893a2539322SAlexander Bulekov out[size] = OP_DISABLE_PCI;
894a2539322SAlexander Bulekov }
895a2539322SAlexander Bulekov size += copy_len;
896a2539322SAlexander Bulekov max_out_size -= copy_len;
897a2539322SAlexander Bulekov
898a2539322SAlexander Bulekov /* Append a separator */
899a2539322SAlexander Bulekov copy_len = strlen(SEPARATOR);
900a2539322SAlexander Bulekov memcpy(out + size, SEPARATOR, copy_len);
901a2539322SAlexander Bulekov size += copy_len;
902a2539322SAlexander Bulekov max_out_size -= copy_len;
903a2539322SAlexander Bulekov
904a2539322SAlexander Bulekov /* Copy_Len over the second input */
905a2539322SAlexander Bulekov copy_len = MIN(size2, max_out_size);
906a2539322SAlexander Bulekov memcpy(out + size, data2, copy_len);
907a2539322SAlexander Bulekov size += copy_len;
908a2539322SAlexander Bulekov max_out_size -= copy_len;
909a2539322SAlexander Bulekov
910a2539322SAlexander Bulekov return size;
911a2539322SAlexander Bulekov }
912a2539322SAlexander Bulekov
913a2539322SAlexander Bulekov
generic_fuzz_cmdline(FuzzTarget * t)914da9bf531SAlexander Bulekov static GString *generic_fuzz_cmdline(FuzzTarget *t)
915da9bf531SAlexander Bulekov {
916da9bf531SAlexander Bulekov GString *cmd_line = g_string_new(TARGET_NAME);
917da9bf531SAlexander Bulekov if (!getenv("QEMU_FUZZ_ARGS")) {
918da9bf531SAlexander Bulekov usage();
919da9bf531SAlexander Bulekov }
920da9bf531SAlexander Bulekov g_string_append_printf(cmd_line, " -display none \
921da9bf531SAlexander Bulekov -machine accel=qtest, \
922da9bf531SAlexander Bulekov -m 512M %s ", getenv("QEMU_FUZZ_ARGS"));
923da9bf531SAlexander Bulekov return cmd_line;
924da9bf531SAlexander Bulekov }
925da9bf531SAlexander Bulekov
generic_fuzz_predefined_config_cmdline(FuzzTarget * t)9267fdb5053SAlexander Bulekov static GString *generic_fuzz_predefined_config_cmdline(FuzzTarget *t)
9277fdb5053SAlexander Bulekov {
9288630b43fSAlexander Bulekov gchar *args;
9297fdb5053SAlexander Bulekov const generic_fuzz_config *config;
9307fdb5053SAlexander Bulekov g_assert(t->opaque);
9317fdb5053SAlexander Bulekov
9327fdb5053SAlexander Bulekov config = t->opaque;
933a47ea61dSBin Meng g_setenv("QEMU_AVOID_DOUBLE_FETCH", "1", 1);
9348630b43fSAlexander Bulekov if (config->argfunc) {
9358630b43fSAlexander Bulekov args = config->argfunc();
936a47ea61dSBin Meng g_setenv("QEMU_FUZZ_ARGS", args, 1);
9378630b43fSAlexander Bulekov g_free(args);
9388630b43fSAlexander Bulekov } else {
9398630b43fSAlexander Bulekov g_assert_nonnull(config->args);
940a47ea61dSBin Meng g_setenv("QEMU_FUZZ_ARGS", config->args, 1);
9418630b43fSAlexander Bulekov }
942a47ea61dSBin Meng g_setenv("QEMU_FUZZ_OBJECTS", config->objects, 1);
9437fdb5053SAlexander Bulekov return generic_fuzz_cmdline(t);
9447fdb5053SAlexander Bulekov }
9457fdb5053SAlexander Bulekov
register_generic_fuzz_targets(void)946da9bf531SAlexander Bulekov static void register_generic_fuzz_targets(void)
947da9bf531SAlexander Bulekov {
948da9bf531SAlexander Bulekov fuzz_add_target(&(FuzzTarget){
949da9bf531SAlexander Bulekov .name = "generic-fuzz",
950da9bf531SAlexander Bulekov .description = "Fuzz based on any qemu command-line args. ",
951da9bf531SAlexander Bulekov .get_init_cmdline = generic_fuzz_cmdline,
952da9bf531SAlexander Bulekov .pre_fuzz = generic_pre_fuzz,
953da9bf531SAlexander Bulekov .fuzz = generic_fuzz,
954a2539322SAlexander Bulekov .crossover = generic_fuzz_crossover
955da9bf531SAlexander Bulekov });
9567fdb5053SAlexander Bulekov
9573176990fSAlex Bennée for (int i = 0; i < ARRAY_SIZE(predefined_configs); i++) {
9583176990fSAlex Bennée const generic_fuzz_config *config = predefined_configs + i;
9597fdb5053SAlexander Bulekov fuzz_add_target(&(FuzzTarget){
9603176990fSAlex Bennée .name = g_strconcat("generic-fuzz-", config->name, NULL),
9617fdb5053SAlexander Bulekov .description = "Predefined generic-fuzz config.",
9627fdb5053SAlexander Bulekov .get_init_cmdline = generic_fuzz_predefined_config_cmdline,
9637fdb5053SAlexander Bulekov .pre_fuzz = generic_pre_fuzz,
9647fdb5053SAlexander Bulekov .fuzz = generic_fuzz,
9657fdb5053SAlexander Bulekov .crossover = generic_fuzz_crossover,
9667fdb5053SAlexander Bulekov .opaque = (void *)config
9677fdb5053SAlexander Bulekov });
9687fdb5053SAlexander Bulekov }
969da9bf531SAlexander Bulekov }
970da9bf531SAlexander Bulekov
971da9bf531SAlexander Bulekov fuzz_target_init(register_generic_fuzz_targets);
972