| Message ID | 20190725032321.12721-17-alxndr@bu.edu (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | Add virtual device fuzzing support | expand |
Hi Aleksander, On 7/25/19 5:23 AM, Oleinik, Alexander wrote: > Defines LLVMFuzzerInitialize and LLVMFuzzerTestOneInput > > Signed-off-by: Alexander Oleinik <alxndr@bu.edu> > --- > tests/fuzz/fuzz.c | 262 ++++++++++++++++++++++++++++++++++++++++++++++ > tests/fuzz/fuzz.h | 96 +++++++++++++++++ > 2 files changed, 358 insertions(+) > create mode 100644 tests/fuzz/fuzz.c > create mode 100644 tests/fuzz/fuzz.h > > diff --git a/tests/fuzz/fuzz.c b/tests/fuzz/fuzz.c > new file mode 100644 > index 0000000000..0421b9402c > --- /dev/null > +++ b/tests/fuzz/fuzz.c > @@ -0,0 +1,262 @@ > +#include "tests/fuzz/ramfile.h" > +#include "migration/qemu-file.h" > +#include "migration/global_state.h" > +#include "migration/savevm.h" > +#include "tests/libqtest.h" > +#include "exec/memory.h" > +#include "migration/migration.h" > +#include "fuzz.h" > +#include "tests/libqos/qgraph.h" > + > +#include <stdio.h> > +#include <stdlib.h> > +#include <linux/userfaultfd.h> > +#include <poll.h> > +#include <pthread.h> > +#include <sys/syscall.h> > +#include <sys/types.h> > +#include <sys/ioctl.h> > + > +QTestState *s; > + > +QEMUFile *ramfile; > +QEMUFile *writefile; > +ram_disk *rd; > +typedef QSLIST_HEAD(, FuzzTarget) FuzzTargetList; > + > +FuzzTargetList* fuzz_target_list; > + > +uint64_t total_mr_size = 0; > +uint64_t mr_index = 0; > + > +const MemoryRegion* mrs[1000]; > + > + > +// Save just the VMStateDescriptors > +void save_device_state(void) > +{ > + writefile = qemu_fopen_ram(&rd); > + global_state_store(); > + qemu_save_device_state(writefile); > + qemu_fflush(writefile); > + ramfile = qemu_fopen_ro_ram(rd); > +} > + > +// Save the entire vm state including RAM > +void save_vm_state(void) > +{ > + writefile = qemu_fopen_ram(&rd); > + vm_stop(RUN_STATE_SAVE_VM); > + global_state_store(); > + qemu_savevm_state(writefile, NULL); > + qemu_fflush(writefile); > + ramfile = qemu_fopen_ro_ram(rd); > +} > + > +/* Reset state by rebooting */ > +void reboot() > +{ > + qemu_system_reset(SHUTDOWN_CAUSE_NONE); > +} > + > +/* Restore device state */ > +void load_device_state() > +{ > + qemu_freopen_ro_ram(ramfile); > + > + int ret = qemu_load_device_state(ramfile); > + if (ret < 0){ > + printf("reset error\n"); > + exit(-1); > + } > +} > + > +/* Restore full vm state */ > +void load_vm_state() > +{ > + qemu_freopen_ro_ram(ramfile); > + > + vm_stop(RUN_STATE_RESTORE_VM); > + /* qemu_system_reset(SHUTDOWN_CAUSE_NONE); */ > + > + int ret = qemu_loadvm_state(ramfile); > + if (ret < 0){ > + printf("reset error\n"); > + exit(-1); > + } > + migration_incoming_state_destroy(); > + vm_start(); > +} > + > +void qtest_setup() > +{ > + s = qtest_init_fuzz(NULL, NULL); > + global_qtest = s; > +} > + > +void fuzz_add_target(const char* name, > + const char* description, > + void(*init_pre_main)(void), > + void(*init_pre_save)(void), > + void(*save_state)(void), > + void(*reset)(void), > + void(*pre_fuzz)(void), > + void(*fuzz)(const unsigned char*, size_t), > + void(*post_fuzz)(void), > + int* main_argc, > + char*** main_argv) > +{ > + > + FuzzTarget *target; > + FuzzTarget *tmp; > + if(!fuzz_target_list) > + fuzz_target_list = g_new0(FuzzTargetList, 1); > + > + QSLIST_FOREACH(tmp, fuzz_target_list, target_list) { > + if (g_strcmp0(tmp->name->str, name) == 0) { > + fprintf(stderr, "Error: Fuzz target name %s already in use\n", name); > + abort(); > + } > + } > + target = g_new0(FuzzTarget, 1); > + target->name = g_string_new(name); > + target->description = g_string_new(description); > + target->init_pre_main = init_pre_main; > + target->init_pre_save = init_pre_save; > + target->save_state = save_state; > + target->reset = reset; > + target->pre_fuzz = pre_fuzz; > + target->fuzz = fuzz; > + target->post_fuzz = post_fuzz; > + target->main_argc = main_argc; > + target->main_argv = main_argv; > + QSLIST_INSERT_HEAD(fuzz_target_list, target, target_list); > +} > + > + > +FuzzTarget* fuzz_get_target(char* name) > +{ > + FuzzTarget* tmp; > + if(!fuzz_target_list){ > + fprintf(stderr, "Fuzz target list not initialized"); > + abort(); > + } > + > + QSLIST_FOREACH(tmp, fuzz_target_list, target_list) { > + if (g_strcmp0(tmp->name->str, name) == 0) { > + break; > + } > + } > + return tmp; > +} > + > +FuzzTarget* fuzz_target; > + > + > + > +static void usage(void) > +{ > + printf("Usage: ./fuzz --FUZZ_TARGET [LIBFUZZER ARGUMENTS]\n"); > + printf("where --FUZZ_TARGET is one of:\n"); > + FuzzTarget* tmp; > + if(!fuzz_target_list){ > + fprintf(stderr, "Fuzz target list not initialized"); > + abort(); > + } > + QSLIST_FOREACH(tmp, fuzz_target_list, target_list) { > + QSLIST_FOREACH(tmp, fuzz_target_list, target_list) { > + printf(" --%s : %s\n", tmp->name->str, tmp->description->str); > + } > + exit(0); > + } > +} > + > +// TODO: Replace this with QEMU's built-in linked list > +static void enum_memory(void) > +{ > + mtree_info(true, true, true); > + fuzz_memory_region *fmr = g_new0(fuzz_memory_region, 1); > + > + fmr->io = false; > + fmr->start = 0x100000; > + fmr->length = 0x10000; > + fmr->next = fuzz_memory_region_head; > + fuzz_memory_region_tail->next = fmr; > + fuzz_memory_region_tail = fmr; > + fmr = fuzz_memory_region_head; > + > + while(true){ > + fmr = fmr->next; > + if(fmr == fuzz_memory_region_head) > + break; > + } > +} > + > +/* Executed for each fuzzing-input */ > +int LLVMFuzzerTestOneInput(const unsigned char *Data, size_t Size) > +{ > + /* e.g. Device bootstrapping */ > + if(fuzz_target->pre_fuzz) > + fuzz_target->pre_fuzz(); > + > + if(fuzz_target->fuzz) > + fuzz_target->fuzz(Data, Size); > + > + /* e.g. Copy counter bitmap to shm*/ > + if(fuzz_target->post_fuzz) > + fuzz_target->post_fuzz(); > + > + /* e.g. Reboot the machine or vmload */ > + if(fuzz_target->reset) > + fuzz_target->reset(); > + > + return 0; > +} > + > +/* Executed once, prior to fuzzing */ > +int LLVMFuzzerInitialize(int *argc, char ***argv, char ***envp) > +{ > + > + char *target_name; > + > + // Initialize qgraph and modules > + qos_graph_init(); > + module_call_init(MODULE_INIT_FUZZ_TARGET); > + module_call_init(MODULE_INIT_QOM); > + module_call_init(MODULE_INIT_LIBQOS); > + > + if(*argc <= 1) > + usage(); > + > + > + /* Identify the fuzz target */ > + target_name = (*argv)[1]; > + target_name+=2; > + fuzz_target = fuzz_get_target(target_name); > + > + if(!fuzz_target) > + { > + fprintf(stderr, "Error: Fuzz fuzz_target name %s not found\n", target_name); > + usage(); > + } > + > + if(fuzz_target->init_pre_main) > + fuzz_target->init_pre_main(); > + > + /* Run QEMU's regular vl.c:main */ > + real_main(*(fuzz_target->main_argc), *(fuzz_target->main_argv), NULL); > + > + > + /* Enumerate memory to identify mapped MMIO and I/O regions */ > + enum_memory(); > + > + /* Good place to do any one-time device initialization (such as QOS init) */ > + if(fuzz_target->init_pre_save) > + fuzz_target->init_pre_save(); > + > + /* If configured, this is where we save vm or device state to ramdisk */ > + if(fuzz_target->save_state) > + fuzz_target->save_state(); > + > + return 0; > +} > diff --git a/tests/fuzz/fuzz.h b/tests/fuzz/fuzz.h > new file mode 100644 > index 0000000000..02f26752eb > --- /dev/null > +++ b/tests/fuzz/fuzz.h > @@ -0,0 +1,96 @@ > +#ifndef FUZZER_H_ > +#define FUZZER_H_ > + > +#include "qemu/osdep.h" > +#include "qemu/units.h" > +#include "qapi/error.h" > +#include "exec/memory.h" > +#include "tests/libqtest.h" > +#include "migration/qemu-file.h" > +#include "ramfile.h" > + > +#include <linux/userfaultfd.h> > + > + > +extern QTestState *s; > +extern QEMUFile *writefile; > +extern QEMUFile *ramfile; > +extern ram_disk *rd; > + > +typedef struct FuzzTarget { > + GString* name; > + GString* description; > + void(*init_pre_main)(void); > + void(*init_pre_save)(void); > + void(*save_state)(void); > + void(*reset)(void); > + void(*pre_fuzz)(void); > + void(*fuzz)(const unsigned char*, size_t); > + void(*post_fuzz)(void); > + int* main_argc; > + char*** main_argv; > + QSLIST_ENTRY(FuzzTarget) target_list; > + > +} FuzzTarget; > + > +extern void* _ZN6fuzzer3TPCE; > +/* extern uint8_t __sancov_trace_pc_guard_8bit_counters; */ > +/* extern uint8_t __sancov_trace_pc_pcs; */ > +extern void* __prof_nms_sect_data; > +extern void* __prof_vnodes_sect_data; > + > +#define TPC_SIZE 0x0443c00 > +#define PROFILE_SIZE ( &__prof_vnodes_sect_data - &__prof_nms_sect_data) > + > +#define NUMPCS (1 << 21) > +/* #define TPC_SIZE 0x33c00 */ > + > +extern uint8_t *TPCCopy; > +extern uint8_t *ARGCopy; > + > +void save_device_state(void); > +void save_vm_state(void); > +void reboot(void); > + > +void load_device_state(void); > +void load_vm_state(void); > + > + > +void save_device_state(void); > +void qtest_setup(void); > +void fuzz_register_mr(const MemoryRegion *mr); > + > +FuzzTarget* fuzz_get_target(char* name); > + > +extern FuzzTarget* fuzz_target; > + > +typedef struct fuzz_memory_region { > + bool io; > + uint64_t start; > + uint64_t length; > + struct fuzz_memory_region* next; > +} fuzz_memory_region; > + > +extern fuzz_memory_region *fuzz_memory_region_head; > +extern fuzz_memory_region *fuzz_memory_region_tail; > + > +extern uint64_t total_io_mem; > +extern uint64_t total_ram_mem; > + > +void fuzz_add_target(const char* name, > + const char* description, > + void(*init_pre_main)(void), > + void(*init_pre_save)(void), > + void(*save_state)(void), > + void(*reset)(void), > + void(*pre_fuzz)(void), > + void(*fuzz)(const unsigned char*, size_t), > + void(*post_fuzz)(void), > + int* main_argc, > + char*** main_argv); What about having in tests/fuzz/fuzz.h: typedef struct FuzzTarget { GString* name; GString* description; void(*init_pre_main)(void); void(*init_pre_save)(void); void(*save_state)(void); void(*reset)(void); void(*pre_fuzz)(void); void(*fuzz)(const unsigned char*, size_t); void(*post_fuzz)(void); int* main_argc; char*** main_argv; } FuzzTarget; void fuzz_add_target(FuzzTarget *target); And in tests/fuzz/fuzz.c: typedef struct FuzzTargetState { FuzzTarget *target; QSLIST_ENTRY(FuzzTarget) target_list; } FuzzTargetState; > + > +int LLVMFuzzerTestOneInput(const unsigned char *Data, size_t Size); > +int LLVMFuzzerInitialize(int *argc, char ***argv, char ***envp); > + > +#endif > + >
diff --git a/tests/fuzz/fuzz.c b/tests/fuzz/fuzz.c new file mode 100644 index 0000000000..0421b9402c --- /dev/null +++ b/tests/fuzz/fuzz.c @@ -0,0 +1,262 @@ +#include "tests/fuzz/ramfile.h" +#include "migration/qemu-file.h" +#include "migration/global_state.h" +#include "migration/savevm.h" +#include "tests/libqtest.h" +#include "exec/memory.h" +#include "migration/migration.h" +#include "fuzz.h" +#include "tests/libqos/qgraph.h" + +#include <stdio.h> +#include <stdlib.h> +#include <linux/userfaultfd.h> +#include <poll.h> +#include <pthread.h> +#include <sys/syscall.h> +#include <sys/types.h> +#include <sys/ioctl.h> + +QTestState *s; + +QEMUFile *ramfile; +QEMUFile *writefile; +ram_disk *rd; +typedef QSLIST_HEAD(, FuzzTarget) FuzzTargetList; + +FuzzTargetList* fuzz_target_list; + +uint64_t total_mr_size = 0; +uint64_t mr_index = 0; + +const MemoryRegion* mrs[1000]; + + +// Save just the VMStateDescriptors +void save_device_state(void) +{ + writefile = qemu_fopen_ram(&rd); + global_state_store(); + qemu_save_device_state(writefile); + qemu_fflush(writefile); + ramfile = qemu_fopen_ro_ram(rd); +} + +// Save the entire vm state including RAM +void save_vm_state(void) +{ + writefile = qemu_fopen_ram(&rd); + vm_stop(RUN_STATE_SAVE_VM); + global_state_store(); + qemu_savevm_state(writefile, NULL); + qemu_fflush(writefile); + ramfile = qemu_fopen_ro_ram(rd); +} + +/* Reset state by rebooting */ +void reboot() +{ + qemu_system_reset(SHUTDOWN_CAUSE_NONE); +} + +/* Restore device state */ +void load_device_state() +{ + qemu_freopen_ro_ram(ramfile); + + int ret = qemu_load_device_state(ramfile); + if (ret < 0){ + printf("reset error\n"); + exit(-1); + } +} + +/* Restore full vm state */ +void load_vm_state() +{ + qemu_freopen_ro_ram(ramfile); + + vm_stop(RUN_STATE_RESTORE_VM); + /* qemu_system_reset(SHUTDOWN_CAUSE_NONE); */ + + int ret = qemu_loadvm_state(ramfile); + if (ret < 0){ + printf("reset error\n"); + exit(-1); + } + migration_incoming_state_destroy(); + vm_start(); +} + +void qtest_setup() +{ + s = qtest_init_fuzz(NULL, NULL); + global_qtest = s; +} + +void fuzz_add_target(const char* name, + const char* description, + void(*init_pre_main)(void), + void(*init_pre_save)(void), + void(*save_state)(void), + void(*reset)(void), + void(*pre_fuzz)(void), + void(*fuzz)(const unsigned char*, size_t), + void(*post_fuzz)(void), + int* main_argc, + char*** main_argv) +{ + + FuzzTarget *target; + FuzzTarget *tmp; + if(!fuzz_target_list) + fuzz_target_list = g_new0(FuzzTargetList, 1); + + QSLIST_FOREACH(tmp, fuzz_target_list, target_list) { + if (g_strcmp0(tmp->name->str, name) == 0) { + fprintf(stderr, "Error: Fuzz target name %s already in use\n", name); + abort(); + } + } + target = g_new0(FuzzTarget, 1); + target->name = g_string_new(name); + target->description = g_string_new(description); + target->init_pre_main = init_pre_main; + target->init_pre_save = init_pre_save; + target->save_state = save_state; + target->reset = reset; + target->pre_fuzz = pre_fuzz; + target->fuzz = fuzz; + target->post_fuzz = post_fuzz; + target->main_argc = main_argc; + target->main_argv = main_argv; + QSLIST_INSERT_HEAD(fuzz_target_list, target, target_list); +} + + +FuzzTarget* fuzz_get_target(char* name) +{ + FuzzTarget* tmp; + if(!fuzz_target_list){ + fprintf(stderr, "Fuzz target list not initialized"); + abort(); + } + + QSLIST_FOREACH(tmp, fuzz_target_list, target_list) { + if (g_strcmp0(tmp->name->str, name) == 0) { + break; + } + } + return tmp; +} + +FuzzTarget* fuzz_target; + + + +static void usage(void) +{ + printf("Usage: ./fuzz --FUZZ_TARGET [LIBFUZZER ARGUMENTS]\n"); + printf("where --FUZZ_TARGET is one of:\n"); + FuzzTarget* tmp; + if(!fuzz_target_list){ + fprintf(stderr, "Fuzz target list not initialized"); + abort(); + } + QSLIST_FOREACH(tmp, fuzz_target_list, target_list) { + QSLIST_FOREACH(tmp, fuzz_target_list, target_list) { + printf(" --%s : %s\n", tmp->name->str, tmp->description->str); + } + exit(0); + } +} + +// TODO: Replace this with QEMU's built-in linked list +static void enum_memory(void) +{ + mtree_info(true, true, true); + fuzz_memory_region *fmr = g_new0(fuzz_memory_region, 1); + + fmr->io = false; + fmr->start = 0x100000; + fmr->length = 0x10000; + fmr->next = fuzz_memory_region_head; + fuzz_memory_region_tail->next = fmr; + fuzz_memory_region_tail = fmr; + fmr = fuzz_memory_region_head; + + while(true){ + fmr = fmr->next; + if(fmr == fuzz_memory_region_head) + break; + } +} + +/* Executed for each fuzzing-input */ +int LLVMFuzzerTestOneInput(const unsigned char *Data, size_t Size) +{ + /* e.g. Device bootstrapping */ + if(fuzz_target->pre_fuzz) + fuzz_target->pre_fuzz(); + + if(fuzz_target->fuzz) + fuzz_target->fuzz(Data, Size); + + /* e.g. Copy counter bitmap to shm*/ + if(fuzz_target->post_fuzz) + fuzz_target->post_fuzz(); + + /* e.g. Reboot the machine or vmload */ + if(fuzz_target->reset) + fuzz_target->reset(); + + return 0; +} + +/* Executed once, prior to fuzzing */ +int LLVMFuzzerInitialize(int *argc, char ***argv, char ***envp) +{ + + char *target_name; + + // Initialize qgraph and modules + qos_graph_init(); + module_call_init(MODULE_INIT_FUZZ_TARGET); + module_call_init(MODULE_INIT_QOM); + module_call_init(MODULE_INIT_LIBQOS); + + if(*argc <= 1) + usage(); + + + /* Identify the fuzz target */ + target_name = (*argv)[1]; + target_name+=2; + fuzz_target = fuzz_get_target(target_name); + + if(!fuzz_target) + { + fprintf(stderr, "Error: Fuzz fuzz_target name %s not found\n", target_name); + usage(); + } + + if(fuzz_target->init_pre_main) + fuzz_target->init_pre_main(); + + /* Run QEMU's regular vl.c:main */ + real_main(*(fuzz_target->main_argc), *(fuzz_target->main_argv), NULL); + + + /* Enumerate memory to identify mapped MMIO and I/O regions */ + enum_memory(); + + /* Good place to do any one-time device initialization (such as QOS init) */ + if(fuzz_target->init_pre_save) + fuzz_target->init_pre_save(); + + /* If configured, this is where we save vm or device state to ramdisk */ + if(fuzz_target->save_state) + fuzz_target->save_state(); + + return 0; +} diff --git a/tests/fuzz/fuzz.h b/tests/fuzz/fuzz.h new file mode 100644 index 0000000000..02f26752eb --- /dev/null +++ b/tests/fuzz/fuzz.h @@ -0,0 +1,96 @@ +#ifndef FUZZER_H_ +#define FUZZER_H_ + +#include "qemu/osdep.h" +#include "qemu/units.h" +#include "qapi/error.h" +#include "exec/memory.h" +#include "tests/libqtest.h" +#include "migration/qemu-file.h" +#include "ramfile.h" + +#include <linux/userfaultfd.h> + + +extern QTestState *s; +extern QEMUFile *writefile; +extern QEMUFile *ramfile; +extern ram_disk *rd; + +typedef struct FuzzTarget { + GString* name; + GString* description; + void(*init_pre_main)(void); + void(*init_pre_save)(void); + void(*save_state)(void); + void(*reset)(void); + void(*pre_fuzz)(void); + void(*fuzz)(const unsigned char*, size_t); + void(*post_fuzz)(void); + int* main_argc; + char*** main_argv; + QSLIST_ENTRY(FuzzTarget) target_list; + +} FuzzTarget; + +extern void* _ZN6fuzzer3TPCE; +/* extern uint8_t __sancov_trace_pc_guard_8bit_counters; */ +/* extern uint8_t __sancov_trace_pc_pcs; */ +extern void* __prof_nms_sect_data; +extern void* __prof_vnodes_sect_data; + +#define TPC_SIZE 0x0443c00 +#define PROFILE_SIZE ( &__prof_vnodes_sect_data - &__prof_nms_sect_data) + +#define NUMPCS (1 << 21) +/* #define TPC_SIZE 0x33c00 */ + +extern uint8_t *TPCCopy; +extern uint8_t *ARGCopy; + +void save_device_state(void); +void save_vm_state(void); +void reboot(void); + +void load_device_state(void); +void load_vm_state(void); + + +void save_device_state(void); +void qtest_setup(void); +void fuzz_register_mr(const MemoryRegion *mr); + +FuzzTarget* fuzz_get_target(char* name); + +extern FuzzTarget* fuzz_target; + +typedef struct fuzz_memory_region { + bool io; + uint64_t start; + uint64_t length; + struct fuzz_memory_region* next; +} fuzz_memory_region; + +extern fuzz_memory_region *fuzz_memory_region_head; +extern fuzz_memory_region *fuzz_memory_region_tail; + +extern uint64_t total_io_mem; +extern uint64_t total_ram_mem; + +void fuzz_add_target(const char* name, + const char* description, + void(*init_pre_main)(void), + void(*init_pre_save)(void), + void(*save_state)(void), + void(*reset)(void), + void(*pre_fuzz)(void), + void(*fuzz)(const unsigned char*, size_t), + void(*post_fuzz)(void), + int* main_argc, + char*** main_argv); + +int LLVMFuzzerTestOneInput(const unsigned char *Data, size_t Size); +int LLVMFuzzerInitialize(int *argc, char ***argv, char ***envp); + +#endif +
Defines LLVMFuzzerInitialize and LLVMFuzzerTestOneInput Signed-off-by: Alexander Oleinik <alxndr@bu.edu> --- tests/fuzz/fuzz.c | 262 ++++++++++++++++++++++++++++++++++++++++++++++ tests/fuzz/fuzz.h | 96 +++++++++++++++++ 2 files changed, 358 insertions(+) create mode 100644 tests/fuzz/fuzz.c create mode 100644 tests/fuzz/fuzz.h