Skip to content

Commit 5e5b9d7

Browse files
SkryptonyteSkryptonyte
committed
rmm: Add more RMI fuzzing harnesses
Signed-off-by: Rayhan Faizel <rayhan.faizel@gmail.com>
1 parent 1ff2932 commit 5e5b9d7

20 files changed

+887
-11
lines changed

‎rmm/fuzz/Cargo.toml

+98
Original file line numberDiff line numberDiff line change
@@ -24,3 +24,101 @@ path = "fuzz_targets/rmi_features_fuzz.rs"
2424
test = false
2525
doc = false
2626
bench = false
27+
28+
[[bin]]
29+
name = "rmi_granule_delegate_fuzz"
30+
path = "fuzz_targets/rmi_granule_delegate_fuzz.rs"
31+
test = false
32+
doc = false
33+
bench = false
34+
35+
[[bin]]
36+
name = "rmi_granule_undelegate_fuzz"
37+
path = "fuzz_targets/rmi_granule_undelegate_fuzz.rs"
38+
test = false
39+
doc = false
40+
bench = false
41+
42+
[[bin]]
43+
name = "rmi_realm_create_fuzz"
44+
path = "fuzz_targets/rmi_realm_create_fuzz.rs"
45+
test = false
46+
doc = false
47+
bench = false
48+
49+
[[bin]]
50+
name = "rmi_rec_create_fuzz"
51+
path = "fuzz_targets/rmi_rec_create_fuzz.rs"
52+
test = false
53+
doc = false
54+
bench = false
55+
56+
[[bin]]
57+
name = "rmi_rtt_create_fuzz"
58+
path = "fuzz_targets/rmi_rtt_create_fuzz.rs"
59+
test = false
60+
doc = false
61+
bench = false
62+
63+
[[bin]]
64+
name = "rmi_rtt_read_entry_fuzz"
65+
path = "fuzz_targets/rmi_rtt_read_entry_fuzz.rs"
66+
test = false
67+
doc = false
68+
bench = false
69+
70+
[[bin]]
71+
name = "rmi_data_create_fuzz"
72+
path = "fuzz_targets/rmi_data_create_fuzz.rs"
73+
test = false
74+
doc = false
75+
bench = false
76+
77+
[[bin]]
78+
name = "rmi_data_create_unknown_fuzz"
79+
path = "fuzz_targets/rmi_data_create_unknown_fuzz.rs"
80+
test = false
81+
doc = false
82+
bench = false
83+
84+
[[bin]]
85+
name = "rmi_rtt_map_unprotected_fuzz"
86+
path = "fuzz_targets/rmi_rtt_map_unprotected_fuzz.rs"
87+
test = false
88+
doc = false
89+
bench = false
90+
91+
[[bin]]
92+
name = "rmi_rtt_init_ripas_fuzz"
93+
path = "fuzz_targets/rmi_rtt_init_ripas_fuzz.rs"
94+
test = false
95+
doc = false
96+
bench = false
97+
98+
[[bin]]
99+
name = "rmi_rtt_set_ripas_fuzz"
100+
path = "fuzz_targets/rmi_rtt_set_ripas_fuzz.rs"
101+
test = false
102+
doc = false
103+
bench = false
104+
105+
[[bin]]
106+
name = "rmi_rec_enter_fuzz"
107+
path = "fuzz_targets/rmi_rec_enter_fuzz.rs"
108+
test = false
109+
doc = false
110+
bench = false
111+
112+
[[bin]]
113+
name = "rmi_psci_complete_fuzz"
114+
path = "fuzz_targets/rmi_psci_complete_fuzz.rs"
115+
test = false
116+
doc = false
117+
bench = false
118+
119+
[[bin]]
120+
name = "rmi_rtt_fold_fuzz"
121+
path = "fuzz_targets/rmi_rtt_fold_fuzz.rs"
122+
test = false
123+
doc = false
124+
bench = false

‎rmm/fuzz/fuzz_targets/rmi_data_create_fuzz.rs

+70
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
#![no_main]
2+
3+
use islet_rmm::rmi::{DATA_CREATE, DATA_DESTROY, GRANULE_DELEGATE, GRANULE_UNDELEGATE,
4+
RTT_INIT_RIPAS, RTT_READ_ENTRY, SUCCESS};
5+
use islet_rmm::rmi::rtt_entry_state::{RMI_UNASSIGNED, RMI_ASSIGNED};
6+
use islet_rmm::test_utils::{mock, *};
7+
8+
use libfuzzer_sys::{arbitrary, fuzz_target, Corpus};
9+
10+
11+
#[derive(Debug, arbitrary::Arbitrary)]
12+
struct DataCreateFuzz {
13+
ipa: u64,
14+
flags: u64,
15+
}
16+
17+
fuzz_target!(|data: DataCreateFuzz| -> Corpus {
18+
let ipa = data.ipa as usize;
19+
let flags = data.flags as usize;
20+
let base = (ipa / L3_SIZE) * L3_SIZE;
21+
let data_granule = alloc_granule(IDX_DATA1);
22+
let src = alloc_granule(IDX_SRC1);
23+
24+
let top = match (base as usize).checked_add(L3_SIZE) {
25+
Some(x) => x,
26+
None => {
27+
return Corpus::Reject;
28+
}
29+
};
30+
31+
let rd = realm_create();
32+
33+
/* Reject IPAs which cannot be mapped */
34+
let ret = rmi::<RTT_READ_ENTRY>(&[rd, ipa, MAP_LEVEL]);
35+
if (ret[0] != SUCCESS) {
36+
realm_destroy(rd);
37+
return Corpus::Reject;
38+
}
39+
40+
mock::host::map(rd, ipa);
41+
42+
let ret = rmi::<RTT_INIT_RIPAS>(&[rd, base, top]);
43+
if ret[0] != SUCCESS {
44+
mock::host::unmap(rd, ipa, false);
45+
realm_destroy(rd);
46+
return Corpus::Reject;
47+
}
48+
49+
let _ret = rmi::<GRANULE_DELEGATE>(&[data_granule]);
50+
51+
let ret = rmi::<DATA_CREATE>(&[rd, data_granule, ipa, src, flags]);
52+
53+
if ret[0] == SUCCESS {
54+
let ret = rmi::<RTT_READ_ENTRY>(&[rd, ipa, MAP_LEVEL]);
55+
assert_eq!(ret[2], RMI_ASSIGNED);
56+
57+
let ret = rmi::<DATA_DESTROY>(&[rd, ipa]);
58+
assert_eq!(ret[0], SUCCESS);
59+
60+
let ret = rmi::<RTT_READ_ENTRY>(&[rd, ipa, MAP_LEVEL]);
61+
assert_eq!(ret[2], RMI_UNASSIGNED);
62+
}
63+
64+
let _ret = rmi::<GRANULE_UNDELEGATE>(&[data_granule]);
65+
66+
mock::host::unmap(rd, ipa, false);
67+
realm_destroy(rd);
68+
69+
Corpus::Keep
70+
});

‎rmm/fuzz/fuzz_targets/rmi_data_create_unknown_fuzz.rs

+50
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
#![no_main]
2+
3+
use islet_rmm::rmi::{DATA_CREATE_UNKNOWN, DATA_DESTROY, GRANULE_DELEGATE,
4+
GRANULE_UNDELEGATE, RTT_READ_ENTRY, SUCCESS};
5+
use islet_rmm::rmi::rtt_entry_state::{RMI_UNASSIGNED, RMI_ASSIGNED};
6+
use islet_rmm::test_utils::{mock, *};
7+
8+
use libfuzzer_sys::{arbitrary, fuzz_target, Corpus};
9+
10+
#[derive(Debug, arbitrary::Arbitrary)]
11+
struct DataCreateFuzz {
12+
ipa: u64,
13+
}
14+
15+
fuzz_target!(|data: DataCreateFuzz| -> Corpus {
16+
let rd = realm_create();
17+
let ipa = data.ipa as usize;
18+
let data_granule = alloc_granule(IDX_DATA1);
19+
20+
/* Reject IPAs which cannot be mapped */
21+
let ret = rmi::<RTT_READ_ENTRY>(&[rd, ipa, MAP_LEVEL]);
22+
if (ret[0] != SUCCESS) {
23+
realm_destroy(rd);
24+
return Corpus::Reject;
25+
}
26+
27+
mock::host::map(rd, ipa);
28+
29+
let _ret = rmi::<GRANULE_DELEGATE>(&[data_granule]);
30+
31+
let ret = rmi::<DATA_CREATE_UNKNOWN>(&[rd, data_granule, ipa]);
32+
33+
if ret[0] == SUCCESS {
34+
let ret = rmi::<RTT_READ_ENTRY>(&[rd, ipa, MAP_LEVEL]);
35+
assert_eq!(ret[2], RMI_ASSIGNED);
36+
37+
let ret = rmi::<DATA_DESTROY>(&[rd, ipa]);
38+
assert_eq!(ret[0], SUCCESS);
39+
40+
let ret = rmi::<RTT_READ_ENTRY>(&[rd, ipa, MAP_LEVEL]);
41+
assert_eq!(ret[2], RMI_UNASSIGNED);
42+
}
43+
44+
let _ret = rmi::<GRANULE_UNDELEGATE>(&[data_granule]);
45+
46+
mock::host::unmap(rd, ipa, false);
47+
realm_destroy(rd);
48+
49+
Corpus::Keep
50+
});

‎rmm/fuzz/fuzz_targets/rmi_granule_delegate_fuzz.rs

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
#![no_main]
2+
3+
use islet_rmm::rmi::{GRANULE_DELEGATE, GRANULE_UNDELEGATE, SUCCESS};
4+
use islet_rmm::granule::GRANULE_STATUS_TABLE_SIZE;
5+
use islet_rmm::test_utils::{mock, *};
6+
7+
use libfuzzer_sys::{arbitrary, fuzz_target};
8+
9+
#[derive(Debug, arbitrary::Arbitrary)]
10+
enum GranuleAddress {
11+
GranuleRegion(u16),
12+
RandomAddress(u64)
13+
}
14+
15+
fuzz_target!(|data: GranuleAddress| {
16+
let addr: usize = match data {
17+
GranuleAddress::GranuleRegion(idx) => alloc_granule((idx as usize) % GRANULE_STATUS_TABLE_SIZE),
18+
GranuleAddress::RandomAddress(addr) => addr as usize
19+
};
20+
21+
let ret = rmi::<GRANULE_DELEGATE>(&[addr]);
22+
23+
if ret[0] == SUCCESS {
24+
let _ret = rmi::<GRANULE_UNDELEGATE>(&[addr]);
25+
}
26+
});

‎rmm/fuzz/fuzz_targets/rmi_granule_undelegate_fuzz.rs

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
#![no_main]
2+
3+
use islet_rmm::rmi::{GRANULE_UNDELEGATE, SUCCESS};
4+
use islet_rmm::granule::GRANULE_STATUS_TABLE_SIZE;
5+
use islet_rmm::test_utils::{mock, *};
6+
7+
use libfuzzer_sys::{arbitrary, fuzz_target};
8+
9+
#[derive(Debug, arbitrary::Arbitrary)]
10+
enum GranuleAddress {
11+
GranuleRegion(u16),
12+
RandomAddress(u64)
13+
}
14+
15+
fuzz_target!(|data: GranuleAddress| {
16+
let addr: usize = match data {
17+
GranuleAddress::GranuleRegion(idx) => alloc_granule((idx as usize) % GRANULE_STATUS_TABLE_SIZE),
18+
GranuleAddress::RandomAddress(addr) => addr as usize
19+
};
20+
21+
let _ret = rmi::<GRANULE_UNDELEGATE>(&[addr]);
22+
});

‎rmm/fuzz/fuzz_targets/rmi_psci_complete_fuzz.rs

+52
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
#![no_main]
2+
3+
use islet_rmm::rmi::{REC_ENTER, PSCI_COMPLETE, SUCCESS};
4+
use islet_rmm::rec::Rec;
5+
use islet_rmm::rec::context::set_reg;
6+
use islet_rmm::rsi::{PSCI_CPU_ON, PSCI_AFFINITY_INFO};
7+
use islet_rmm::test_utils::{mock, *};
8+
9+
use libfuzzer_sys::{arbitrary, fuzz_target, Corpus};
10+
11+
#[derive(Debug, arbitrary::Arbitrary)]
12+
enum PSCICommandFuzz {
13+
PSCI_CPU_ON,
14+
PSCI_AFFINITY_INFO,
15+
}
16+
17+
#[derive(Debug, arbitrary::Arbitrary)]
18+
struct PSCICompleteFuzz {
19+
status: usize,
20+
psci_command: PSCICommandFuzz,
21+
target_runnable: bool,
22+
}
23+
24+
fuzz_target!(|data: PSCICompleteFuzz| {
25+
let rd = mock::host::realm_setup();
26+
let status = data.status;
27+
let psci_command = data.psci_command;
28+
let target_runnable = data.target_runnable as u64;
29+
30+
let (rec1, run1) = (alloc_granule(IDX_REC1), alloc_granule(IDX_REC1_RUN));
31+
32+
let _ret = rmi::<REC_ENTER>(&[rec1, run1]);
33+
34+
let rec2 = alloc_granule(IDX_REC2);
35+
36+
unsafe {
37+
let rec = &mut *(rec1 as *mut Rec<'_>);
38+
let target_rec = &mut *(rec2 as *mut Rec<'_>);
39+
40+
match psci_command {
41+
PSCICommandFuzz::PSCI_CPU_ON => { set_reg(rec, 0, PSCI_CPU_ON).unwrap() },
42+
PSCICommandFuzz::PSCI_AFFINITY_INFO => { set_reg(rec, 0, PSCI_AFFINITY_INFO).unwrap() },
43+
_ => { unreachable!() }
44+
}
45+
46+
target_rec.set_runnable(target_runnable);
47+
}
48+
49+
let _ret = rmi::<PSCI_COMPLETE>(&[rec1, rec2, status]);
50+
51+
mock::host::realm_teardown(rd);
52+
});

‎rmm/fuzz/fuzz_targets/rmi_realm_create_fuzz.rs

+62
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
#![no_main]
2+
3+
use islet_rmm::rmi::{REALM_CREATE, REALM_DESTROY, REALM_ACTIVATE, GRANULE_DELEGATE, GRANULE_UNDELEGATE, SUCCESS};
4+
use islet_rmm::granule::GRANULE_STATUS_TABLE_SIZE;
5+
use islet_rmm::rmi::realm::params::Params as RealmParams;
6+
use islet_rmm::test_utils::{mock, *};
7+
8+
use libfuzzer_sys::{arbitrary, fuzz_target};
9+
10+
#[derive(Debug, arbitrary::Arbitrary)]
11+
struct RealmParamsFuzz {
12+
flags: u64,
13+
s2sz: u8,
14+
sve_vl: u8,
15+
num_bps: u8,
16+
num_wps: u8,
17+
pmu_num_ctrs: u8,
18+
hash_algo: u8,
19+
rpv: [u8; 64],
20+
vmid: u16,
21+
rtt_level_start: i64,
22+
rtt_num_start: u32
23+
}
24+
25+
fuzz_target!(|data: RealmParamsFuzz| {
26+
let (rd, rtt, params_ptr) = (
27+
alloc_granule(IDX_RD),
28+
alloc_granule(IDX_RTT_LEVEL0),
29+
alloc_granule(IDX_REALM_PARAMS),
30+
);
31+
32+
let _ret = rmi::<GRANULE_DELEGATE>(&[rd]);
33+
let _ret = rmi::<GRANULE_DELEGATE>(&[rtt]);
34+
35+
unsafe {
36+
let params = &mut *(params_ptr as *mut RealmParams);
37+
38+
params.flags = data.flags;
39+
params.s2sz = data.s2sz;
40+
params.sve_vl = data.sve_vl;
41+
params.num_bps = data.num_bps;
42+
params.num_wps = data.num_wps;
43+
params.pmu_num_ctrs = data.pmu_num_ctrs;
44+
params.hash_algo = data.hash_algo;
45+
params.rpv = data.rpv;
46+
params.vmid = data.vmid;
47+
params.rtt_base = rtt as u64;
48+
params.rtt_level_start = data.rtt_level_start;
49+
params.rtt_num_start = data.rtt_num_start;
50+
}
51+
52+
let ret = rmi::<REALM_CREATE>(&[rd, params_ptr]);
53+
54+
if ret[0] == SUCCESS {
55+
let _ret = rmi::<REALM_ACTIVATE>(&[rd]);
56+
57+
let _ret = rmi::<REALM_DESTROY>(&[rd]);
58+
}
59+
60+
let _ret = rmi::<GRANULE_UNDELEGATE>(&[rd]);
61+
let _ret = rmi::<GRANULE_UNDELEGATE>(&[rtt]);
62+
});

0 commit comments

Comments
 (0)