Re: [Qemu-devel] [RFC 16/19] fuzz: add general fuzzer entrypoints

[Philippe Mathieu-Daudé]

Hi Aleksander,

On 7/25/19 5:23 AM, Oleinik, Alexander wrote:
> Defines LLVMFuzzerInitialize and LLVMFuzzerTestOneInput
> 
> Signed-off-by: Alexander Oleinik <address@hidden>
> ---
>  tests/fuzz/fuzz.c | 262 ++++++++++++++++++++++++++++++++++++++++++++++
>  tests/fuzz/fuzz.h |  96 +++++++++++++++++
>  2 files changed, 358 insertions(+)
>  create mode 100644 tests/fuzz/fuzz.c
>  create mode 100644 tests/fuzz/fuzz.h
> 
> diff --git a/tests/fuzz/fuzz.c b/tests/fuzz/fuzz.c
> new file mode 100644
> index 0000000000..0421b9402c
> --- /dev/null
> +++ b/tests/fuzz/fuzz.c
> @@ -0,0 +1,262 @@
> +#include "tests/fuzz/ramfile.h"
> +#include "migration/qemu-file.h"
> +#include "migration/global_state.h"
> +#include "migration/savevm.h"
> +#include "tests/libqtest.h"
> +#include "exec/memory.h"
> +#include "migration/migration.h"
> +#include "fuzz.h"
> +#include "tests/libqos/qgraph.h"
> +
> +#include <stdio.h>
> +#include <stdlib.h>
> +#include <linux/userfaultfd.h>
> +#include <poll.h>
> +#include <pthread.h>
> +#include <sys/syscall.h>
> +#include <sys/types.h>
> +#include <sys/ioctl.h>
> +
> +QTestState *s;
> +
> +QEMUFile *ramfile;
> +QEMUFile *writefile;
> +ram_disk *rd; 
> +typedef QSLIST_HEAD(, FuzzTarget) FuzzTargetList;
> +
> +FuzzTargetList* fuzz_target_list;
> +
> +uint64_t total_mr_size = 0;
> +uint64_t mr_index = 0;
> +
> +const MemoryRegion* mrs[1000];
> +
> +
> +// Save just the VMStateDescriptors
> +void save_device_state(void)
> +{
> +    writefile = qemu_fopen_ram(&rd);
> +    global_state_store();
> +    qemu_save_device_state(writefile);
> +    qemu_fflush(writefile);
> +    ramfile = qemu_fopen_ro_ram(rd);
> +}
> +
> +// Save the entire vm state including RAM
> +void save_vm_state(void) 
> +{
> +    writefile = qemu_fopen_ram(&rd);
> +    vm_stop(RUN_STATE_SAVE_VM);
> +    global_state_store();
> +    qemu_savevm_state(writefile, NULL);
> +    qemu_fflush(writefile);
> +    ramfile = qemu_fopen_ro_ram(rd);
> +}
> +
> +/* Reset state by rebooting */
> +void reboot()
> +{
> +    qemu_system_reset(SHUTDOWN_CAUSE_NONE);
> +}
> +
> +/* Restore device state */
> +void load_device_state()
> +{
> +    qemu_freopen_ro_ram(ramfile);
> +
> +    int ret = qemu_load_device_state(ramfile);
> +    if (ret < 0){
> +        printf("reset error\n");
> +        exit(-1);
> +    }
> +}
> +
> +/* Restore full vm state */
> +void load_vm_state()
> +{
> +    qemu_freopen_ro_ram(ramfile);
> +
> +    vm_stop(RUN_STATE_RESTORE_VM);
> +    /* qemu_system_reset(SHUTDOWN_CAUSE_NONE); */
> +
> +    int ret = qemu_loadvm_state(ramfile);
> +    if (ret < 0){
> +        printf("reset error\n");
> +        exit(-1);
> +    }
> +    migration_incoming_state_destroy();
> +    vm_start();
> +}
> +
> +void qtest_setup()
> +{
> +    s = qtest_init_fuzz(NULL, NULL);
> +    global_qtest = s;
> +}
> +
> +void fuzz_add_target(const char* name,
> +        const char* description,
> +        void(*init_pre_main)(void),
> +        void(*init_pre_save)(void),
> +        void(*save_state)(void),
> +        void(*reset)(void),
> +        void(*pre_fuzz)(void),
> +        void(*fuzz)(const unsigned char*, size_t),
> +        void(*post_fuzz)(void),
> +        int* main_argc,
> +        char*** main_argv)
> +{
> +
> +    FuzzTarget *target;
> +    FuzzTarget *tmp;
> +    if(!fuzz_target_list)
> +        fuzz_target_list = g_new0(FuzzTargetList, 1);
> +
> +    QSLIST_FOREACH(tmp, fuzz_target_list, target_list) {
> +        if (g_strcmp0(tmp->name->str, name) == 0) {
> +            fprintf(stderr, "Error: Fuzz target name %s already in use\n", 
> name);
> +            abort();
> +        }
> +    }
> +    target = g_new0(FuzzTarget, 1);
> +    target->name = g_string_new(name);
> +    target->description = g_string_new(description);
> +    target->init_pre_main = init_pre_main;
> +    target->init_pre_save = init_pre_save;
> +    target->save_state = save_state;
> +    target->reset = reset;
> +    target->pre_fuzz = pre_fuzz;
> +    target->fuzz = fuzz;
> +    target->post_fuzz = post_fuzz;
> +    target->main_argc = main_argc;
> +    target->main_argv = main_argv;
> +    QSLIST_INSERT_HEAD(fuzz_target_list, target, target_list);
> +}
> +
> +
> +FuzzTarget* fuzz_get_target(char* name)
> +{
> +    FuzzTarget* tmp;
> +    if(!fuzz_target_list){
> +        fprintf(stderr, "Fuzz target list not initialized");
> +        abort();
> +    }
> +
> +    QSLIST_FOREACH(tmp, fuzz_target_list, target_list) {
> +        if (g_strcmp0(tmp->name->str, name) == 0) {
> +            break;
> +        }
> +    }
> +    return tmp;
> +}
> +
> +FuzzTarget* fuzz_target;
> +
> +
> +
> +static void usage(void)
> +{
> +    printf("Usage: ./fuzz --FUZZ_TARGET [LIBFUZZER ARGUMENTS]\n");
> +    printf("where --FUZZ_TARGET is one of:\n");
> +    FuzzTarget* tmp;
> +    if(!fuzz_target_list){
> +        fprintf(stderr, "Fuzz target list not initialized");
> +        abort();
> +    }
> +    QSLIST_FOREACH(tmp, fuzz_target_list, target_list) {
> +        QSLIST_FOREACH(tmp, fuzz_target_list, target_list) {
> +            printf(" --%s  : %s\n", tmp->name->str, tmp->description->str);
> +        }
> +        exit(0);
> +    }
> +}
> +
> +// TODO: Replace this with QEMU's built-in linked list
> +static void enum_memory(void)
> +{
> +    mtree_info(true, true, true);
> +    fuzz_memory_region *fmr = g_new0(fuzz_memory_region, 1);
> +
> +    fmr->io = false;
> +    fmr->start = 0x100000;
> +    fmr->length = 0x10000;
> +    fmr->next = fuzz_memory_region_head;
> +    fuzz_memory_region_tail->next = fmr;
> +    fuzz_memory_region_tail = fmr;
> +    fmr = fuzz_memory_region_head;
> +
> +    while(true){
> +        fmr = fmr->next;
> +        if(fmr == fuzz_memory_region_head)
> +            break;
> +    }
> +}
> +
> +/* Executed for each fuzzing-input */
> +int LLVMFuzzerTestOneInput(const unsigned char *Data, size_t Size)
> +{
> +    /* e.g. Device bootstrapping */
> +    if(fuzz_target->pre_fuzz)
> +        fuzz_target->pre_fuzz();
> +
> +    if(fuzz_target->fuzz)
> +        fuzz_target->fuzz(Data, Size);
> +
> +    /* e.g. Copy counter bitmap to shm*/
> +    if(fuzz_target->post_fuzz)
> +        fuzz_target->post_fuzz();
> +
> +    /* e.g. Reboot the machine or vmload */
> +    if(fuzz_target->reset)
> +        fuzz_target->reset();
> +
> +    return 0;
> +}
> +
> +/* Executed once, prior to fuzzing */
> +int LLVMFuzzerInitialize(int *argc, char ***argv, char ***envp)
> +{
> +
> +    char *target_name;
> +
> +    // Initialize qgraph and modules
> +    qos_graph_init();
> +    module_call_init(MODULE_INIT_FUZZ_TARGET);
> +    module_call_init(MODULE_INIT_QOM);
> +    module_call_init(MODULE_INIT_LIBQOS);
> +
> +    if(*argc <= 1)
> +        usage();
> +
> +
> +    /* Identify the fuzz target */
> +    target_name = (*argv)[1];
> +    target_name+=2;
> +    fuzz_target = fuzz_get_target(target_name);
> +
> +    if(!fuzz_target)
> +    {
> +        fprintf(stderr, "Error: Fuzz fuzz_target name %s not found\n", 
> target_name);
> +        usage();
> +    }
> +
> +    if(fuzz_target->init_pre_main)
> +        fuzz_target->init_pre_main();
> +
> +    /* Run QEMU's regular vl.c:main */
> +    real_main(*(fuzz_target->main_argc), *(fuzz_target->main_argv), NULL);
> +
> +
> +    /* Enumerate memory to identify mapped MMIO and I/O regions */
> +    enum_memory();
> +
> +    /* Good place to do any one-time device initialization (such as QOS 
> init) */
> +    if(fuzz_target->init_pre_save)
> +        fuzz_target->init_pre_save();
> +
> +    /* If configured, this is where we save vm or device state to ramdisk */
> +    if(fuzz_target->save_state)
> +        fuzz_target->save_state();
> +
> +    return 0;
> +}
> diff --git a/tests/fuzz/fuzz.h b/tests/fuzz/fuzz.h
> new file mode 100644
> index 0000000000..02f26752eb
> --- /dev/null
> +++ b/tests/fuzz/fuzz.h
> @@ -0,0 +1,96 @@
> +#ifndef FUZZER_H_
> +#define FUZZER_H_
> +
> +#include "qemu/osdep.h"
> +#include "qemu/units.h"
> +#include "qapi/error.h"
> +#include "exec/memory.h"
> +#include "tests/libqtest.h"
> +#include "migration/qemu-file.h"
> +#include "ramfile.h"
> +
> +#include <linux/userfaultfd.h>
> +
> +
> +extern QTestState *s;
> +extern QEMUFile *writefile;
> +extern QEMUFile *ramfile;
> +extern ram_disk *rd;
> +
> +typedef struct FuzzTarget {
> +     GString* name;
> +     GString* description;
> +     void(*init_pre_main)(void);
> +     void(*init_pre_save)(void);
> +     void(*save_state)(void);
> +     void(*reset)(void);
> +     void(*pre_fuzz)(void);
> +     void(*fuzz)(const unsigned char*, size_t);
> +     void(*post_fuzz)(void);
> +     int* main_argc;
> +     char*** main_argv;
> +     QSLIST_ENTRY(FuzzTarget) target_list;
> +
> +} FuzzTarget;
> +
> +extern void* _ZN6fuzzer3TPCE;
> +/* extern uint8_t __sancov_trace_pc_guard_8bit_counters; */
> +/* extern uint8_t __sancov_trace_pc_pcs; */
> +extern void* __prof_nms_sect_data;
> +extern void* __prof_vnodes_sect_data;
> +
> +#define TPC_SIZE 0x0443c00
> +#define PROFILE_SIZE ( &__prof_vnodes_sect_data - &__prof_nms_sect_data)
> +
> +#define NUMPCS (1 << 21)
> +/* #define TPC_SIZE 0x33c00 */
> +
> +extern uint8_t *TPCCopy;
> +extern uint8_t *ARGCopy;
> +
> +void save_device_state(void);
> +void save_vm_state(void);
> +void reboot(void);
> +
> +void load_device_state(void);
> +void load_vm_state(void);
> +
> +
> +void save_device_state(void);
> +void qtest_setup(void);
> +void fuzz_register_mr(const MemoryRegion *mr);
> +
> +FuzzTarget* fuzz_get_target(char* name);
> +
> +extern FuzzTarget* fuzz_target;
> +
> +typedef struct fuzz_memory_region {
> +     bool io;
> +     uint64_t start;
> +     uint64_t length;
> +     struct fuzz_memory_region* next;
> +} fuzz_memory_region;
> +
> +extern fuzz_memory_region *fuzz_memory_region_head;
> +extern fuzz_memory_region *fuzz_memory_region_tail;
> +
> +extern uint64_t total_io_mem;
> +extern uint64_t total_ram_mem;
> +
> +void fuzz_add_target(const char* name,
> +     const char* description,
> +     void(*init_pre_main)(void),
> +     void(*init_pre_save)(void),
> +     void(*save_state)(void),
> +     void(*reset)(void),
> +     void(*pre_fuzz)(void),
> +     void(*fuzz)(const unsigned char*, size_t),
> +     void(*post_fuzz)(void),
> +     int* main_argc,
> +     char*** main_argv);

What about having in tests/fuzz/fuzz.h:

typedef struct FuzzTarget {
        GString* name;
        GString* description;
        void(*init_pre_main)(void);
        void(*init_pre_save)(void);
        void(*save_state)(void);
        void(*reset)(void);
        void(*pre_fuzz)(void);
        void(*fuzz)(const unsigned char*, size_t);
        void(*post_fuzz)(void);
        int* main_argc;
        char*** main_argv;
} FuzzTarget;

void fuzz_add_target(FuzzTarget *target);

And in tests/fuzz/fuzz.c:

typedef struct FuzzTargetState {
        FuzzTarget *target;
        QSLIST_ENTRY(FuzzTarget) target_list;
} FuzzTargetState;

> +
> +int LLVMFuzzerTestOneInput(const unsigned char *Data, size_t Size);
> +int LLVMFuzzerInitialize(int *argc, char ***argv, char ***envp);
> +
> +#endif
> +
>