[Qemu-devel] [RFC 16/19] fuzz: add general fuzzer entrypoints

[Oleinik, Alexander]

Defines LLVMFuzzerInitialize and LLVMFuzzerTestOneInput

Signed-off-by: Alexander Oleinik <address@hidden>
---
 tests/fuzz/fuzz.c | 262 ++++++++++++++++++++++++++++++++++++++++++++++
 tests/fuzz/fuzz.h |  96 +++++++++++++++++
 2 files changed, 358 insertions(+)
 create mode 100644 tests/fuzz/fuzz.c
 create mode 100644 tests/fuzz/fuzz.h

diff --git a/tests/fuzz/fuzz.c b/tests/fuzz/fuzz.c
new file mode 100644
index 0000000000..0421b9402c
--- /dev/null
+++ b/tests/fuzz/fuzz.c
@@ -0,0 +1,262 @@
+#include "tests/fuzz/ramfile.h"
+#include "migration/qemu-file.h"
+#include "migration/global_state.h"
+#include "migration/savevm.h"
+#include "tests/libqtest.h"
+#include "exec/memory.h"
+#include "migration/migration.h"
+#include "fuzz.h"
+#include "tests/libqos/qgraph.h"
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <linux/userfaultfd.h>
+#include <poll.h>
+#include <pthread.h>
+#include <sys/syscall.h>
+#include <sys/types.h>
+#include <sys/ioctl.h>
+
+QTestState *s;
+
+QEMUFile *ramfile;
+QEMUFile *writefile;
+ram_disk *rd; 
+typedef QSLIST_HEAD(, FuzzTarget) FuzzTargetList;
+
+FuzzTargetList* fuzz_target_list;
+
+uint64_t total_mr_size = 0;
+uint64_t mr_index = 0;
+
+const MemoryRegion* mrs[1000];
+
+
+// Save just the VMStateDescriptors
+void save_device_state(void)
+{
+    writefile = qemu_fopen_ram(&rd);
+    global_state_store();
+    qemu_save_device_state(writefile);
+    qemu_fflush(writefile);
+    ramfile = qemu_fopen_ro_ram(rd);
+}
+
+// Save the entire vm state including RAM
+void save_vm_state(void) 
+{
+    writefile = qemu_fopen_ram(&rd);
+    vm_stop(RUN_STATE_SAVE_VM);
+    global_state_store();
+    qemu_savevm_state(writefile, NULL);
+    qemu_fflush(writefile);
+    ramfile = qemu_fopen_ro_ram(rd);
+}
+
+/* Reset state by rebooting */
+void reboot()
+{
+    qemu_system_reset(SHUTDOWN_CAUSE_NONE);
+}
+
+/* Restore device state */
+void load_device_state()
+{
+    qemu_freopen_ro_ram(ramfile);
+
+    int ret = qemu_load_device_state(ramfile);
+    if (ret < 0){
+        printf("reset error\n");
+        exit(-1);
+    }
+}
+
+/* Restore full vm state */
+void load_vm_state()
+{
+    qemu_freopen_ro_ram(ramfile);
+
+    vm_stop(RUN_STATE_RESTORE_VM);
+    /* qemu_system_reset(SHUTDOWN_CAUSE_NONE); */
+
+    int ret = qemu_loadvm_state(ramfile);
+    if (ret < 0){
+        printf("reset error\n");
+        exit(-1);
+    }
+    migration_incoming_state_destroy();
+    vm_start();
+}
+
+void qtest_setup()
+{
+    s = qtest_init_fuzz(NULL, NULL);
+    global_qtest = s;
+}
+
+void fuzz_add_target(const char* name,
+        const char* description,
+        void(*init_pre_main)(void),
+        void(*init_pre_save)(void),
+        void(*save_state)(void),
+        void(*reset)(void),
+        void(*pre_fuzz)(void),
+        void(*fuzz)(const unsigned char*, size_t),
+        void(*post_fuzz)(void),
+        int* main_argc,
+        char*** main_argv)
+{
+
+    FuzzTarget *target;
+    FuzzTarget *tmp;
+    if(!fuzz_target_list)
+        fuzz_target_list = g_new0(FuzzTargetList, 1);
+
+    QSLIST_FOREACH(tmp, fuzz_target_list, target_list) {
+        if (g_strcmp0(tmp->name->str, name) == 0) {
+            fprintf(stderr, "Error: Fuzz target name %s already in use\n", 
name);
+            abort();
+        }
+    }
+    target = g_new0(FuzzTarget, 1);
+    target->name = g_string_new(name);
+    target->description = g_string_new(description);
+    target->init_pre_main = init_pre_main;
+    target->init_pre_save = init_pre_save;
+    target->save_state = save_state;
+    target->reset = reset;
+    target->pre_fuzz = pre_fuzz;
+    target->fuzz = fuzz;
+    target->post_fuzz = post_fuzz;
+    target->main_argc = main_argc;
+    target->main_argv = main_argv;
+    QSLIST_INSERT_HEAD(fuzz_target_list, target, target_list);
+}
+
+
+FuzzTarget* fuzz_get_target(char* name)
+{
+    FuzzTarget* tmp;
+    if(!fuzz_target_list){
+        fprintf(stderr, "Fuzz target list not initialized");
+        abort();
+    }
+
+    QSLIST_FOREACH(tmp, fuzz_target_list, target_list) {
+        if (g_strcmp0(tmp->name->str, name) == 0) {
+            break;
+        }
+    }
+    return tmp;
+}
+
+FuzzTarget* fuzz_target;
+
+
+
+static void usage(void)
+{
+    printf("Usage: ./fuzz --FUZZ_TARGET [LIBFUZZER ARGUMENTS]\n");
+    printf("where --FUZZ_TARGET is one of:\n");
+    FuzzTarget* tmp;
+    if(!fuzz_target_list){
+        fprintf(stderr, "Fuzz target list not initialized");
+        abort();
+    }
+    QSLIST_FOREACH(tmp, fuzz_target_list, target_list) {
+        QSLIST_FOREACH(tmp, fuzz_target_list, target_list) {
+            printf(" --%s  : %s\n", tmp->name->str, tmp->description->str);
+        }
+        exit(0);
+    }
+}
+
+// TODO: Replace this with QEMU's built-in linked list
+static void enum_memory(void)
+{
+    mtree_info(true, true, true);
+    fuzz_memory_region *fmr = g_new0(fuzz_memory_region, 1);
+
+    fmr->io = false;
+    fmr->start = 0x100000;
+    fmr->length = 0x10000;
+    fmr->next = fuzz_memory_region_head;
+    fuzz_memory_region_tail->next = fmr;
+    fuzz_memory_region_tail = fmr;
+    fmr = fuzz_memory_region_head;
+
+    while(true){
+        fmr = fmr->next;
+        if(fmr == fuzz_memory_region_head)
+            break;
+    }
+}
+
+/* Executed for each fuzzing-input */
+int LLVMFuzzerTestOneInput(const unsigned char *Data, size_t Size)
+{
+    /* e.g. Device bootstrapping */
+    if(fuzz_target->pre_fuzz)
+        fuzz_target->pre_fuzz();
+
+    if(fuzz_target->fuzz)
+        fuzz_target->fuzz(Data, Size);
+
+    /* e.g. Copy counter bitmap to shm*/
+    if(fuzz_target->post_fuzz)
+        fuzz_target->post_fuzz();
+
+    /* e.g. Reboot the machine or vmload */
+    if(fuzz_target->reset)
+        fuzz_target->reset();
+
+    return 0;
+}
+
+/* Executed once, prior to fuzzing */
+int LLVMFuzzerInitialize(int *argc, char ***argv, char ***envp)
+{
+
+    char *target_name;
+
+    // Initialize qgraph and modules
+    qos_graph_init();
+    module_call_init(MODULE_INIT_FUZZ_TARGET);
+    module_call_init(MODULE_INIT_QOM);
+    module_call_init(MODULE_INIT_LIBQOS);
+
+    if(*argc <= 1)
+        usage();
+
+
+    /* Identify the fuzz target */
+    target_name = (*argv)[1];
+    target_name+=2;
+    fuzz_target = fuzz_get_target(target_name);
+
+    if(!fuzz_target)
+    {
+        fprintf(stderr, "Error: Fuzz fuzz_target name %s not found\n", 
target_name);
+        usage();
+    }
+
+    if(fuzz_target->init_pre_main)
+        fuzz_target->init_pre_main();
+
+    /* Run QEMU's regular vl.c:main */
+    real_main(*(fuzz_target->main_argc), *(fuzz_target->main_argv), NULL);
+
+
+    /* Enumerate memory to identify mapped MMIO and I/O regions */
+    enum_memory();
+
+    /* Good place to do any one-time device initialization (such as QOS init) 
*/
+    if(fuzz_target->init_pre_save)
+        fuzz_target->init_pre_save();
+
+    /* If configured, this is where we save vm or device state to ramdisk */
+    if(fuzz_target->save_state)
+        fuzz_target->save_state();
+
+    return 0;
+}
diff --git a/tests/fuzz/fuzz.h b/tests/fuzz/fuzz.h
new file mode 100644
index 0000000000..02f26752eb
--- /dev/null
+++ b/tests/fuzz/fuzz.h
@@ -0,0 +1,96 @@
+#ifndef FUZZER_H_
+#define FUZZER_H_
+
+#include "qemu/osdep.h"
+#include "qemu/units.h"
+#include "qapi/error.h"
+#include "exec/memory.h"
+#include "tests/libqtest.h"
+#include "migration/qemu-file.h"
+#include "ramfile.h"
+
+#include <linux/userfaultfd.h>
+
+
+extern QTestState *s;
+extern QEMUFile *writefile;
+extern QEMUFile *ramfile;
+extern ram_disk *rd;
+
+typedef struct FuzzTarget {
+       GString* name;
+       GString* description;
+       void(*init_pre_main)(void);
+       void(*init_pre_save)(void);
+       void(*save_state)(void);
+       void(*reset)(void);
+       void(*pre_fuzz)(void);
+       void(*fuzz)(const unsigned char*, size_t);
+       void(*post_fuzz)(void);
+       int* main_argc;
+       char*** main_argv;
+       QSLIST_ENTRY(FuzzTarget) target_list;
+
+} FuzzTarget;
+
+extern void* _ZN6fuzzer3TPCE;
+/* extern uint8_t __sancov_trace_pc_guard_8bit_counters; */
+/* extern uint8_t __sancov_trace_pc_pcs; */
+extern void* __prof_nms_sect_data;
+extern void* __prof_vnodes_sect_data;
+
+#define TPC_SIZE 0x0443c00
+#define PROFILE_SIZE ( &__prof_vnodes_sect_data - &__prof_nms_sect_data)
+
+#define NUMPCS (1 << 21)
+/* #define TPC_SIZE 0x33c00 */
+
+extern uint8_t *TPCCopy;
+extern uint8_t *ARGCopy;
+
+void save_device_state(void);
+void save_vm_state(void);
+void reboot(void);
+
+void load_device_state(void);
+void load_vm_state(void);
+
+
+void save_device_state(void);
+void qtest_setup(void);
+void fuzz_register_mr(const MemoryRegion *mr);
+
+FuzzTarget* fuzz_get_target(char* name);
+
+extern FuzzTarget* fuzz_target;
+
+typedef struct fuzz_memory_region {
+       bool io;
+       uint64_t start;
+       uint64_t length;
+       struct fuzz_memory_region* next;
+} fuzz_memory_region;
+
+extern fuzz_memory_region *fuzz_memory_region_head;
+extern fuzz_memory_region *fuzz_memory_region_tail;
+
+extern uint64_t total_io_mem;
+extern uint64_t total_ram_mem;
+
+void fuzz_add_target(const char* name,
+       const char* description,
+       void(*init_pre_main)(void),
+       void(*init_pre_save)(void),
+       void(*save_state)(void),
+       void(*reset)(void),
+       void(*pre_fuzz)(void),
+       void(*fuzz)(const unsigned char*, size_t),
+       void(*post_fuzz)(void),
+       int* main_argc,
+       char*** main_argv);
+
+int LLVMFuzzerTestOneInput(const unsigned char *Data, size_t Size);
+int LLVMFuzzerInitialize(int *argc, char ***argv, char ***envp);
+
+#endif
+
-- 
2.20.1