feat(virtq): add virtio-villain inspired packed virtq coverage

Map applicable packed ring cases into deterministic in process virtq
tests, add high-level producer/consumer safety coverage, and add a
packed-ring fuzz target with binary seed inputs.

See: https://github.com/weltling/virtio-villain/tree/main/tests/vring

Signed-off-by: Tomasz Andrzejak <andreiltd@gmail.com>

Author: andreiltd

.github/workflows/Fuzzing.yml

@@ -22,7 +22,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        target: ['fuzz_host_print', 'fuzz_guest_call', 'fuzz_host_call', 'fuzz_guest_estimate_trace_event', 'fuzz_guest_trace']
+        target: ['fuzz_host_print', 'fuzz_guest_call', 'fuzz_host_call', 'fuzz_guest_estimate_trace_event', 'fuzz_guest_trace', 'fuzz_virtq_packed_ring']
     uses: ./.github/workflows/dep_fuzzing.yml
     with:
       target: ${{ matrix.target }}

.github/workflows/ValidatePullRequest.yml

@@ -214,7 +214,7 @@ jobs:
     if: ${{ !cancelled() && !failure() }}
     strategy:
       matrix:
-        target: ['fuzz_host_print', 'fuzz_guest_call', 'fuzz_host_call', 'fuzz_guest_estimate_trace_event', 'fuzz_guest_trace']
+        target: ['fuzz_host_print', 'fuzz_guest_call', 'fuzz_host_call', 'fuzz_guest_estimate_trace_event', 'fuzz_guest_trace', 'fuzz_virtq_packed_ring']
         arch:
           - X64
         # arm64 fuzzing runs on the daily schedule (DailyArm64.yml) instead of on

Justfile

@@ -218,6 +218,7 @@ like-ci config=default-target hypervisor="kvm":
     just fuzz-like-ci fuzz_host_call {{config}} {{hypervisor}}
     just fuzz-like-ci fuzz_guest_estimate_trace_event {{config}} {{hypervisor}}
     just fuzz-like-ci fuzz_guest_trace {{config}} {{hypervisor}}
+    just fuzz-like-ci fuzz_virtq_packed_ring {{config}} {{hypervisor}}
 
     @# spelling
     typos

fuzz/.gitignore

@@ -1,4 +1,7 @@
 target
-corpus
+corpus/*
+!corpus/fuzz_virtq_packed_ring/
+corpus/fuzz_virtq_packed_ring/*
+!corpus/fuzz_virtq_packed_ring/*.bin
 artifacts
 coverage

fuzz/Cargo.toml

@@ -48,6 +48,13 @@ test = false
 doc = false
 bench = false
 
+[[bin]]
+name = "fuzz_virtq_packed_ring"
+path = "fuzz_targets/virtq_packed_ring.rs"
+test = false
+doc = false
+bench = false
+
 [features]
 default = []
 trace = ["hyperlight-host/trace_guest", "hyperlight-common/trace_guest"]

fuzz/README.md

@@ -10,7 +10,7 @@ which evaluates to the following command `cargo +nightly fuzz run fuzz_host_prin
 
 As per Microsoft's Offensive Research & Security Engineering (MORSE) team, all host exposed functions that receive or interact with guest data must be continuously fuzzed for, at least, 500 million fuzz test cases without any crashes. Because `cargo-fuzz` doesn't support setting a maximum number of iterations; instead, we use the `--max_total_time` flag to set a maximum time to run the fuzzer. We have a GitHub action (acting like a CRON job) that runs the fuzzers for 24 hours every week.
 
-Currently, we fuzz the parameters and return type to a hardcoded `PrintOutput` guest function, and the `HostPrint` host function. We plan to add more fuzzers in the future.
+Currently, we fuzz the parameters and return type to a hardcoded `PrintOutput` guest function, the `HostPrint` host function, and the packed virtqueue ring parser. We plan to add more fuzzers in the future.
 
 ## On Failure