Commit graph

42 commits

Author SHA1 Message Date
Dylan Reid
60efe11939 OWNERS: Remove dgreid
denniskempin will inherit fuzzing or find someone to.

Change-Id: Icb4dc76949726c0d958dab41228ba848ec292c94
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2988148
Auto-Submit: Dylan Reid <dgreid@chromium.org>
Reviewed-by: Dennis Kempin <denniskempin@google.com>
Commit-Queue: Dennis Kempin <denniskempin@google.com>
Tested-by: Dennis Kempin <denniskempin@google.com>
2021-06-25 19:42:12 +00:00
Chirantan Ekbote
fa4bf10955 Add fuzz to crosvm's workspace
I don't really remember why the fuzz crate needed to be a separate
workspace and doing it that way seems to break our fuzzer builds so just
move it into crosvm's workspace.

BUG=none
TEST=USE="asan fuzzer" emerge-amd64-generic crosvm

Cq-Depend: chromium:2777911
Change-Id: Ibb0e2de14189683ee5af501392594230996accc3
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2772678
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Reviewed-by: Keiichi Watanabe <keiichiw@chromium.org>
Commit-Queue: Chirantan Ekbote <chirantan@chromium.org>
Tested-by: Chirantan Ekbote <chirantan@chromium.org>
2021-03-24 06:23:34 +00:00
Andrew Walbran
413f854564 Enable KVM_CAP_ARM_PROTECTED_VM when --protected-vm is passed.
- Add an address space region for the protected KVM firmware.
- Query firmware size, mmap something that size and create a memslot.

BUG=b:163789172
TEST=cargo test

Change-Id: I054cf5d763c980d073c17bce70e85a781816b64d
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2623942
Auto-Submit: Andrew Walbran <qwandor@google.com>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
Commit-Queue: Andrew Walbran <qwandor@google.com>
Tested-by: kokoro <noreply+kokoro@google.com>
2021-03-02 19:04:43 +00:00
Daniel Verkamp
4e1f99a68d devices: virtio: block: add VIRTIO_BLK_T_GET_ID
Allow the user to specify a serial number for each virtio block device
using the new id= parameter:

  crosvm run --disk disk.img,id=SERIALNO ...

These serial numbers show up in sysfs for each block device, which
allows them to be uniquely identified regardless of the number or order
of block devices added on the crosvm command line.  This can be used to
find a specific device by serial number for mounting at boot time.

BUG=b:157687637
BUG=chromium:775781
TEST=crosvm run -r vm_rootfs.img,id=root -p init=/bin/bash vm_kernel
TEST=cat /sys/block/vda/serial # see serial is set to "root"
TEST=cargo test -p devices

Change-Id: I108cdc47c367fb038d6acd55da60f9e1aae59e68
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2225559
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Chirantan Ekbote <chirantan@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
Commit-Queue: Daniel Verkamp <dverkamp@chromium.org>
2020-12-02 05:21:16 +00:00
Daniel Verkamp
6c987cf924 fuzz: block_fuzzer: remove use of AsRawFd
The Event API has changed so that it exposes only RawDescriptor, not
RawFd, so the block fuzzer's use of as_raw_fd() no longer worked.

The actual intent of the code using as_raw_fd() was to clone the Event,
so just use the existing Event::try_clone function which achieves the
same result without using platform-specific code.

BUG=chromium:1144535
TEST=`FEATURES=test USE='asan fuzzer' emerge-amd64-generic crosvm`

Change-Id: I64689dde1b1351997aa2f11ed440416e3d226815
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2514901
Reviewed-by: Manoj Gupta <manojgupta@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Tested-by: Daniel Verkamp <dverkamp@chromium.org>
2020-11-03 03:32:24 +00:00
Daniel Verkamp
0b0dd364ff fuzz: block_fuzzer: add new base_features arg
virtio::base_features() now takes an argument to indicate whether the
protected VM feature is enabled; update the block fuzzer to match.

BUG=chromium:1142959
TEST=`FEATURES=test USE='asan fuzzer' emerge-amd64-generic crosvm`

Change-Id: I79de47d2bfff8705a4d35c6d978c1d08b36d0db7
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2508468
Reviewed-by: Dylan Reid <dgreid@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Dylan Reid <dgreid@chromium.org>
2020-10-30 20:15:47 +00:00
Victor Hsieh
bae88f4f65 fuse: extract FUSE as a crate from virtio/fs
The current crate still require some work to be really reusable as a
regular FUSE, i.e. with a new reader/writer against /dev/fuse. This
change intends to focus on creating the crate, without trying to find
the optimal interface, and still keep virtio/fs working.

BUG=b:168305155
TEST=./build_test
TEST=USE='asan fuzzer' emerge-hatch crosvm

Change-Id: I8b623c9262221113b720c10125a6770763f14dc8
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2466484
Tested-by: Victor Hsieh <victorhsieh@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Chirantan Ekbote <chirantan@chromium.org>
Commit-Queue: Victor Hsieh <victorhsieh@chromium.org>
2020-10-27 16:18:51 +00:00
Daniel Verkamp
298f1724a1 fuzz: adapt block_fuzzer for Block::new features param
The Block::new() function now requires the base virtio features to be
passed as the first parameter; add it to the block fuzzer to fix the
fuzzer build.

BUG=chromium:1139427
TEST=`FEATURES=test USE='asan fuzz' emerge-amd64-generic crosvm`

Change-Id: Ia8afd1e38b7bb2bf55dfc18805684e3c462e66a4
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2477250
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Tested-by: Daniel Verkamp <dverkamp@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
2020-10-18 03:27:28 +00:00
Zach Reizner
ab04758814 build_test: misc options, improvements, amd bug fixes
New option, --size-only, speeds up using build_test for getting release
binary size by skipping everything else. The lto flag is also added for
release builds to get a more realistic comparison.

The list of crates to test is built up automatically instead of
hard coded. To modify what gets included, empty .build_test_* files are
checked for existance. This is better than hard coding the list of
packages because it was frequently out of date.

For certain crate tests, a dynamic library that only exists in a sysroot
is required. This change includes a fix that adds the sysroot's lib
directory to the LD_LIBRARY_PATH env variable, similar to how
PKG_CONFIG_LIBDIR is modified.

TEST=build_test
BUG=None

Change-Id: I626cbcccf40035a0d29001cef7989a091848e4c9
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2444273
Tested-by: Zach Reizner <zachr@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Auto-Submit: Zach Reizner <zachr@chromium.org>
Reviewed-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Commit-Queue: Zach Reizner <zachr@chromium.org>
2020-10-15 13:40:32 +00:00
Daniel Verkamp
1eedd1bfb4 fuzz: replace SharedMemory with tempfile
The block, qcow, and zimage fuzzers all created a SharedMemory and then
converted it into a file; with the new base API changes, this is no
longer supported.  Replace the SharedMemory uses with tempfile to fix
the build (this also simplifies the code).

BUG=chromium:1136895
TEST=`FEATURES=test USE='asan fuzz' emerge-amd64-generic crosvm`

Change-Id: I50d4e8c57ed41419c79a3fac440654224696f80c
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2463895
Reviewed-by: Dylan Reid <dgreid@chromium.org>
Tested-by: Daniel Verkamp <dverkamp@chromium.org>
Commit-Queue: Daniel Verkamp <dverkamp@chromium.org>
2020-10-12 09:45:46 +00:00
Michael Hoyle
685316f0bd base: EventFd -> Event renaming
Note the CL size is large entirely due to the rename,
the changes are mostly negligible.

Also making a few small additional changes in sys_util
areas that don't need much attention in base. This includes
typedefing and adding specific imports for areas that don't
require significant interface changes.

BUG=b:162363783
TEST=./build_test

Change-Id: I4a2c9c4cdce7565806ed338e241c6b8c82c855c7
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2415180
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Michael Hoyle <mikehoyle@google.com>
2020-10-06 13:50:09 +00:00
George Burgess IV
61126c786c fuzz: fix build
A recent API change made `{Reader,Writer}::new` take `GuestMemory` by
value instead of reference. Since `GuestMemory` is just a pair o'
`Arc`s, this appears to be an easy fix.

BUG=chromium:1125394
TEST=`emerge-amd64-generic crosvm` with a `--profile=fuzzer`'ed board

Change-Id: I964f284134241f958456f87912334a387dfcf61e
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2394756
Tested-by: kokoro <noreply+kokoro@google.com>
Tested-by: George Burgess <gbiv@chromium.org>
Reviewed-by: Chirantan Ekbote <chirantan@chromium.org>
Commit-Queue: George Burgess <gbiv@chromium.org>
2020-09-07 13:15:32 +00:00
Michael Hoyle
6b19695c81 Add "base" crate and transition crosvm usages to it from sys_util
For now, this crate simply re-exports all of sys_util, but it will
be updated to provide new interfaces when needed. This is the
first step to making crosvm not directly depend on sys_util, so
that we can make the interface changes we need without fear of
negatively affecting (i.e. completely breaking) other usages
within chromeos.

BUG=b:162363783
TEST=./build_test

Change-Id: I7d0aa3d8a1f66af1c7fee8fd649723ef17027150
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2325168
Tested-by: Michael Hoyle <mikehoyle@google.com>
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Michael Hoyle <mikehoyle@google.com>
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Reviewed-by: Zach Reizner <zachr@chromium.org>
2020-08-06 18:19:44 +00:00
Tiancong Wang
61724a4ce0 fuzzer: Add vm_memory to fuzzer Cargo
After vm_memory was added, the dependency wasn't added. So it
caused crosvm-fuzz fail to build. This patch adds the dependency.

BUG=chromium:1110970
TEST=USE="asan fuzzer" emerge-amd64-generic crosvm

Change-Id: Ic71243365ed8603928ba30bce7b7361ca368bf1c
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2327870
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Reviewed-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
Tested-by: Daniel Verkamp <dverkamp@chromium.org>
Commit-Queue: Tiancong Wang <tcwang@google.com>
2020-07-30 20:11:52 +00:00
Dylan Reid
ec058d6c46 vm_memory: A crate to hold vm-specific memory objects
Move GuestAddress and GuestMemory to a new crate for VM memory. This
will make separating sys_util and crosvm independent making it easier
to use sys_util functions outside of crosvm.

Change-Id: I12e14948ea85754dfa6267b3a3fb32b77ef6796e
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2311251
Auto-Submit: Dylan Reid <dgreid@chromium.org>
Commit-Queue: Dylan Reid <dgreid@chromium.org>
Tested-by: Dylan Reid <dgreid@chromium.org>
Reviewed-by: Zach Reizner <zachr@chromium.org>
2020-07-24 21:42:34 +00:00
Daniel Verkamp
ec9a99146e fuzz: update virtqueue fuzzer for new VolatileSlice API
BUG=chromium:1087578
TEST=emerge-amd64-generic crosvm

Change-Id: Ia206abf03f95ca92f5944fb8efc23d3f8355e292
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2220731
Tested-by: Daniel Verkamp <dverkamp@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Auto-Submit: Daniel Verkamp <dverkamp@chromium.org>
Reviewed-by: Manoj Gupta <manojgupta@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
Commit-Queue: Manoj Gupta <manojgupta@chromium.org>
Commit-Queue: Dylan Reid <dgreid@chromium.org>
2020-05-29 22:55:12 +00:00
Daniel Verkamp
0d2f3d276d fuzz: ensure sys_util path dependency is used
When compiling a new-enough crosvm for fuzzing (after
https://crrev.com/c/1749950), the build would fail with an error about
importing two different version of sys_util:

expected struct `sys_util::shm::SharedMemory`, found a different struct
`sys_util::shm::SharedMemory`
expected reference `sys_util::shm::SharedMemory (struct
`sys_util::shm::SharedMemory`)
found reference sys_util::shm::SharedMemory (struct
`sys_util::shm::SharedMemory`)
perhaps two different versions of crate `sys_util` are being used?

Fix this by patching the version of sys_util used by audio_streams
so that it also uses the path dependency instead of the sys_util from
the dev-rust/sys_util ebuild in the fuzz-specific Cargo.toml.

BUG=chromium:1057532
TEST=`USE='asan fuzzer' emerge-nami crosvm`

Change-Id: I38252465a1111a9a8f643a59e36733016c5db99d
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2086401
Reviewed-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Chirantan Ekbote <chirantan@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Manoj Gupta <manojgupta@chromium.org>
2020-03-06 05:26:00 +00:00
Daniel Verkamp
f2eecc4152 disk: move qcow into disk crate
Move qcow from being its own crate into a module of the disk crate,
similar to the composite disk module.

This will allow use of qcow from disk and vice versa without introducing
a circular crate dependency.

BUG=None
TEST=./build_test.py
TEST=USE='asan fuzzer' emerge-nami crosvm

Change-Id: I77512bbe4b94faff1b5460f9796ee56505135580
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1972477
Reviewed-by: Cody Schuffelen <schuffelen@google.com>
Reviewed-by: Zach Reizner <zachr@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Daniel Verkamp <dverkamp@chromium.org>
2020-01-06 21:26:38 +00:00
Daniel Verkamp
5118381f2a fuzz: add block_size to block_fuzzer constructor
Fix the build of block_fuzzer after "devices: block: add block_size
option for disks".

It might be nice to generate the block size from the random fuzz data,
but that would complicate things (we'd have to handle failure of
Block::new due to invalid sizes), so let's leave that as a future
improvement for now and just use a block_size of 512 to match previous
behavior.

BUG=chromium:942700
TEST=`USE='asan fuzzer' emerge-nami crosvm`

Change-Id: Ia16ef6a57fc8ce4407f8ec9dda0e708302916c4c
Signed-off-by: Daniel Verkamp <dverkamp@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1962535
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
2019-12-12 19:44:07 +00:00
Daniel Verkamp
9093c002fe fuzz: block_fuzzer: add sparse param to Block::new
Fix the block_fuzzer build after CL:1906750, which added a new parameter
to the Block::new() function without updating the fuzzer.

This change passes `true` for sparse in order to keep previous behavior
and maximize the available commands for fuzzing.

BUG=chromium:1025757
TEST=`USE='asan fuzzer' emerge-nami crosvm`

Change-Id: I29ed9945077936aee9636ddee20b59729eb78c85
Signed-off-by: Daniel Verkamp <dverkamp@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1922065
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
Reviewed-by: Stephen Barber <smbarber@chromium.org>
2019-11-19 03:10:12 +00:00
Daniel Verkamp
5eca937941 devices: virtio: use signal helper for config changes
Add handling of the virtio device MSI-X configuration change vector by
using the signal function that was previously factored out.

BUG=chromium:854765
TEST=./build_test
TEST=trigger disk config change with `crosvm disk resize ...`

Change-Id: I462c23e10d152f896586bb70b95634a53088d480
Signed-off-by: Daniel Verkamp <dverkamp@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1898269
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Zide Chen <zide.chen@intel.corp-partner.google.com>
Reviewed-by: Zach Reizner <zachr@chromium.org>
2019-11-18 07:43:04 +00:00
Daniel Verkamp
24eeed2b6f devices: virtio: pass Interrupt to activate()
Factor out the common creation of struct Interrupt.

No functional change.

BUG=chromium:854765
TEST=./build_test

Change-Id: Idf8804771ba1af5181818f643e15e1b42918258a
Signed-off-by: Daniel Verkamp <dverkamp@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1898268
Tested-by: kokoro <noreply+kokoro@google.com>
2019-11-18 07:43:03 +00:00
Chirantan Ekbote
cfabb882f1 fuzz: Add virtio-fs server fuzzer
Add a fuzzer for the virtio-fs server, which is responsible for decoding
a byte stream into FUSE messages.

BUG=none
TEST=run it with cros_fuzz

Change-Id: Ic7695f2106d3f81e6cf09b98ffedc51831238f1e
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1865272
Tested-by: Chirantan Ekbote <chirantan@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Chirantan Ekbote <chirantan@chromium.org>
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Reviewed-by: Stephen Barber <smbarber@chromium.org>
2019-11-08 03:06:15 +00:00
Chirantan Ekbote
efda10cc64 fuzz: Refactor and improve virtqueue_fuzzer performance
Improve the virtqueue_fuzzer's performance by reducing the maximum queue
size as well as the size of the guest memory.  Zeroing out 256MB of
memory on every iteration was slowing things down quite a bit and we
don't actually need that much memory to fuzz the virtqueue code.

Additionally, refactor the fuzzer to use the virtqueue structs from the
virtio spec to fill out the guest memory.  This should give us more
targeted fuzzing compared to the previous implementation, while also
removing cases where the fuzzer would spin for thousands of iterations
without making any progress.

BUG=chromium:1018267
TEST=`cros_fuzz reproduce` and also run the fuzzer manually

Change-Id: Ibf71aa83c31f16b7f58b23045a0919f7f6824c77
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1886533
Tested-by: Chirantan Ekbote <chirantan@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Stephen Barber <smbarber@chromium.org>
Commit-Queue: Sean Abraham <seanabraham@chromium.org>
Auto-Submit: Chirantan Ekbote <chirantan@chromium.org>
2019-10-29 21:10:42 +00:00
Daniel Verkamp
ee723d5204 fuzz: convert fuzzers to cros_fuzz framework
This eliminates the boilerplate for catching panics and creating a Rust
slice from the fuzzer input data.

BUG=None
TEST=`USE='asan fuzzer' emerge-nami crosvm`

Change-Id: I49666a344b02e3333ad6823bfa7dace08b66b290
Signed-off-by: Daniel Verkamp <dverkamp@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1879495
Reviewed-by: Dylan Reid <dgreid@chromium.org>
2019-10-28 20:30:18 +00:00
Daniel Verkamp
67bdbc1a57 fuzz: block_fuzzer: add msix_config to activate
Fix fuzzer build after the VirtioDevice activate() API change requiring
the msix_config parameter.

BUG=chromium:1017954
TEST=`USE='asan fuzzer' emerge-nami crosvm`

Change-Id: I1bd63369e7d112ee55265747a88d64e6545e572a
Signed-off-by: Daniel Verkamp <dverkamp@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1880137
Reviewed-by: Manoj Gupta <manojgupta@chromium.org>
Commit-Queue: Manoj Gupta <manojgupta@chromium.org>
2019-10-25 05:18:59 +00:00
Chirantan Ekbote
1955fd1fb3 fuzz: Add virtqueue fuzzer
BUG=none
TEST=Run it with cros_fuzz

Cq-Depend: chromium:1863177, chromium:1863178
Change-Id: I1a989d7b90116e210a8aae63205c5e8cf6b70faa
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1863889
Reviewed-by: Chirantan Ekbote <chirantan@chromium.org>
Tested-by: Chirantan Ekbote <chirantan@chromium.org>
Legacy-Commit-Queue: Commit Bot <commit-bot@chromium.org>
Commit-Queue: Manoj Gupta <manojgupta@chromium.org>
2019-10-24 15:23:29 +00:00
Daniel Verkamp
7154c0f1e3 fuzz: remove misleading block fuzzer comment
This looks like it's copied from the qcow fuzzer, and it doesn't apply
to the block fuzzer.  The actual behavior of the block fuzzer is
correctly described by the comment later in the file.

BUG=None
TEST=`USE='asan fuzzer' emerge-nami crosvm`

Change-Id: I9ccd6deba44af8b8df471ee0078ace385696151f
Signed-off-by: Daniel Verkamp <dverkamp@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1853698
Reviewed-by: Dylan Reid <dgreid@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
2019-10-24 00:06:54 +00:00
Daniel Verkamp
cfb7db44eb fuzz: add USB descriptor parsing fuzzer
The new USB descriptor parsing code is a nice candidate for a fuzzer,
since it takes an arbitrary stream of bytes as input and parses it.

BUG=chromium:987833
TEST=`USE='asan fuzzer' emerge-nami crosvm`

Cq-Depend: chromium:1863465
Change-Id: I3bbdbf081e9a9dd590c781467f8bd44fa1dcab64
Signed-off-by: Daniel Verkamp <dverkamp@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1862117
Reviewed-by: Zach Reizner <zachr@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
2019-10-17 23:22:08 +00:00
Zach Reizner
506105dc0d use SharedMemory::{named, anon} to replace ::new
The new constructors are shorter and omit the bare `None` in the `anon`
call sites which gave no clues to the reader what the effect of that
`None` was. This should improve readability.

TEST=./build_test
BUG=None

Change-Id: I2e34e7df9a4ccc5da50edf4e963a6a42e3d84b22
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1797188
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Commit-Queue: Zach Reizner <zachr@chromium.org>
Tested-by: Zach Reizner <zachr@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
2019-09-11 09:34:12 +00:00
Daniel Verkamp
f5a52516b1 fuzz: fix block fuzzer build after block API change
Block::new() now takes a Box of the underlying file; update the block
fuzzer accordingly.

BUG=chromium:1000065
TEST=`USE='asan fuzzer' emerge-nami crosvm`

Change-Id: Ib636e13da5dcd347dd33c40a11508e016ea73b70
Signed-off-by: Daniel Verkamp <dverkamp@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1780336
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
2019-09-03 21:08:38 +00:00
Daniel Verkamp
6b51bd334f fuzz: zimage: use a fixed guest memory size
GuestMemory::new returns an error if the requested size is not divisible
by the page size.  The zimage fuzzer was using a GuestMemory size based
on the size of the fuzzer input; however, it doesn't necessarily make
sense to limit the guest memory to the size of the input.  Pick an
arbitrary 256 MB (matching the block fuzzer), which is also a page size
multiple to resolve the original issue.

BUG=chromium:977883
TEST=/usr/libexec/fuzzers/crosvm_zimage_fuzzer in cros_fuzz shell

Change-Id: I08c6be9d920bede18d67f8a1c5c39b9d37fb839c
Signed-off-by: Daniel Verkamp <dverkamp@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1645040
Tested-by: kokoro <noreply+kokoro@google.com>
2019-06-25 17:12:05 +00:00
Dylan Reid
b38bde9bd1 fuzz: Comply with new guest memory requirement for page alignment
When the input's length is not page aligned, round it up. This allows
the fuzzer to provide more random inputs without causing the `unwrap`
call to trigger false positives when creating guest memory.

BUG=chromium:972172
TEST=run fuzz case from the bug

Change-Id: Iaf8f2ba943f38b90e168301dbb8c15dee5ee45c8
Signed-off-by: Dylan Reid <dgreid@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1659626
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
2019-06-21 21:12:39 +00:00
Daniel Verkamp
0e94e3c1ea fuzz: adapt zimage fuzzer to new kernel loader API
After CL:1636685, the kernel_loader API is different - we need to pass a
File instead of just a slice to load_kernel().

Borrow and adapt the make_elf_bin() function from the kernel_loader
tests to create a shared memory file from a slice of bytes to fix the
fuzzer.

BUG=chromium:970981
TEST=USE='asan fuzzer' emerge-nami crosvm

Change-Id: Ic17f6479fb355d45063ce6292552cb1e5664831a
Signed-off-by: Daniel Verkamp <dverkamp@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1645039
Reviewed-by: Zach Reizner <zachr@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
2019-06-06 16:38:24 +00:00
David Tolnay
aecf9a4dee edition: Remove extern crate lines
In Rust 2018 edition, `extern crate` is no longer required for importing
from other crates. Instead of writing:

    extern crate dep;
    use dep::Thing;

we write:

    use dep::Thing;

In this approach, macros are imported individually from the declaring
crate rather than through #[macro_use]. Before:

    #[macro_use]
    extern crate sys_util;

After:

    use sys_util::{debug, error};

The only place that `extern crate` continues to be required is in
importing the compiler's proc_macro API into a procedural macro crate.
This will hopefully be fixed in a future Rust release.

    extern crate proc_macro;

TEST=cargo check
TEST=cargo check --all-features
TEST=cargo check --target aarch64-unknown-linux-gnu
TEST=local kokoro

Change-Id: I0b43768c0d81f2a250b1959fb97ba35cbac56293
Reviewed-on: https://chromium-review.googlesource.com/1565302
Commit-Ready: David Tolnay <dtolnay@chromium.org>
Commit-Ready: ChromeOS CL Exonerator Bot <chromiumos-cl-exonerator@appspot.gserviceaccount.com>
Tested-by: David Tolnay <dtolnay@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: David Tolnay <dtolnay@chromium.org>
2019-04-15 02:06:08 -07:00
David Tolnay
48ff4165d2 cargo: Sort all dependency lists in Cargo.toml
This may help reduce cases of conflicts between independent CLs each
appending a dependency at the bottom of the list, of which I hit two
today rebasing some of my open CLs.

TEST=cargo check --all-features

Change-Id: Ief10bb004cc7b44b107dc3841ce36c6b23632aed
Reviewed-on: https://chromium-review.googlesource.com/1557172
Commit-Ready: David Tolnay <dtolnay@chromium.org>
Tested-by: David Tolnay <dtolnay@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
2019-04-09 01:55:14 -07:00
David Tolnay
c69ee11e1d edition: Update fuzz crate to 2018 edition
Separated out of CL:1513058 to make it possible to land parts
individually while the affected crate has no other significant CLs
pending. This avoids repeatedly introducing non-textual conflicts with
new code that adds `use` statements.

TEST=cargo check
TEST=cargo check --all-features
TEST=cargo check --target aarch64-unknown-linux-gnu

Change-Id: I355014ebd08bc2a655e1a1bbff56ecc90aa99ece
Reviewed-on: https://chromium-review.googlesource.com/1519695
Commit-Ready: David Tolnay <dtolnay@chromium.org>
Tested-by: David Tolnay <dtolnay@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: David Tolnay <dtolnay@chromium.org>
2019-04-07 23:24:27 -07:00
Dylan Reid
979c696ba6 fuzz: Add block device fuzzer
Add the block device fuzzer that interprets the fuzz data input as
follows:
starting index 8 bytes
command location 8 bytes
command 16 bytes
descriptors circular buffer 16 bytes * 3

Change-Id: I25b58e149bfb9a479fab7955c0ca25c67c590bf6
Signed-off-by: Dylan Reid <dgreid@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/900202
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Chirantan Ekbote <chirantan@chromium.org>
2019-03-25 21:51:15 -07:00
Dylan Reid
39028af02f fuzz: Add qcow fuzzing
Fuzz using the data as a qcow image with an offset and value to write to
the image.

Change-Id: Iff8f2971ba716c93d978e33338ad62b5d487c115
Signed-off-by: Dylan Reid <dgreid@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/871132
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Chirantan Ekbote <chirantan@chromium.org>
2019-03-25 21:51:14 -07:00
Dylan Reid
3a42190cc4 fuzz: update to use new cros fuzzing
There is now infrastructure for running fuzzers in cros, use it.

Change-Id: I53ec9e195b7062fdcc38b5186c1f3194031037f3
Signed-off-by: Dylan Reid <dgreid@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/1521667
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Chirantan Ekbote <chirantan@chromium.org>
2019-03-25 17:43:51 -07:00
David Tolnay
fc7427eb2b fmt: Format sys_util and fuzz crates using rustfmt
These are each their own workspace so I guess `cargo fmt` at the top
level of the repo does not hit them.

I checked that none of the other workspace roots currently need to be
reformatted.

TEST=cargo check

Change-Id: I734cbc0f909fd3c2138513d9539b917bce80c0a8
Reviewed-on: https://chromium-review.googlesource.com/1477496
Commit-Ready: David Tolnay <dtolnay@chromium.org>
Tested-by: David Tolnay <dtolnay@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
2019-02-21 06:29:42 -08:00
Dylan Reid
2b2a7d4d76 Add kernel_loader fuzzing
Add a top level fuzz directory. Other fuzz tests will be added here in
subsequent commits.

For now fuzzing must be run manually. Soon there will be a way to
extract the fuzz artifacts and upload them to cluster fuzz.

Change-Id: Iddfb55af78af6f412927b2221f22acb882069d36
Signed-off-by: Dylan Reid <dgreid@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/850851
Reviewed-by: Zach Reizner <zachr@chromium.org>
2018-01-12 22:37:48 -08:00