cloud-hypervisor/fuzz/fuzz_targets/x86emul.rs

// Copyright © 2025 Microsoft Corporation
//
// SPDX-License-Identifier: Apache-2.0

#![no_main]

use hypervisor::arch::emulator::{PlatformEmulator, PlatformError};
use hypervisor::arch::x86::emulator::{Emulator, EmulatorCpuState};
use hypervisor::arch::x86::{DescriptorTable, SegmentRegister, SpecialRegisters};
use hypervisor::StandardRegisters;
use libfuzzer_sys::{fuzz_target, Corpus};

#[derive(Debug)]
struct EmulatorContext {
    state: EmulatorCpuState,
    memory: [u8; 8],
}

impl PlatformEmulator for EmulatorContext {
    type CpuState = EmulatorCpuState;

    fn read_memory(&self, _gva: u64, data: &mut [u8]) -> Result<(), PlatformError> {
        data.copy_from_slice(&self.memory[..data.len()]);
        Ok(())
    }

    fn write_memory(&mut self, _gva: u64, _data: &[u8]) -> Result<(), PlatformError> {
        // Discard writes
        Ok(())
    }

    fn cpu_state(&self, _cpu_id: usize) -> Result<Self::CpuState, PlatformError> {
        Ok(self.state.clone())
    }

    fn set_cpu_state(&self, _cpu_id: usize, _state: Self::CpuState) -> Result<(), PlatformError> {
        // Ignore
        Ok(())
    }

    fn fetch(&self, _ip: u64, _data: &mut [u8]) -> Result<(), PlatformError> {
        // The fuzzer already provides 16 bytes of data, we don't need to fetch anything
        panic!("fetch should not be called");
    }
}

fuzz_target!(|bytes: &[u8]| -> Corpus {
    let (mut ctx, insn) = match generate_context_and_instruction(bytes) {
        Ok((ctx, insn)) => (ctx, insn),
        Err(_) => return Corpus::Reject,
    };

    let mut e = Emulator::new(&mut ctx);

    if e.emulate_first_insn(0, &insn).is_err() {
        return Corpus::Reject;
    }

    Corpus::Keep
});

// Helper functions to generate structures from fuzzer input below

fn generate_segment_register(
    u: &mut arbitrary::Unstructured<'_>,
) -> arbitrary::Result<SegmentRegister> {
    Ok(SegmentRegister {
        base: u.arbitrary()?,
        limit: u.arbitrary()?,
        selector: u.arbitrary()?,
        avl: u.arbitrary()?,
        dpl: u.arbitrary()?,
        db: u.arbitrary()?,
        g: u.arbitrary()?,
        l: u.arbitrary()?,
        present: u.arbitrary()?,
        s: u.arbitrary()?,
        type_: u.arbitrary()?,
        unusable: u.arbitrary()?,
    })
}

fn generate_descriptor_table(
    u: &mut arbitrary::Unstructured<'_>,
) -> arbitrary::Result<DescriptorTable> {
    Ok(DescriptorTable {
        base: u.arbitrary()?,
        limit: u.arbitrary()?,
    })
}

fn generate_context_and_instruction(
    bytes: &[u8],
) -> arbitrary::Result<(EmulatorContext, [u8; 16])> {
    let mut u = arbitrary::Unstructured::new(bytes);

    let mut regs = mshv_bindings::StandardRegisters {
        rax: u.arbitrary()?,
        rbx: u.arbitrary()?,
        rcx: u.arbitrary()?,
        rdx: u.arbitrary()?,
        rsi: u.arbitrary()?,
        rdi: u.arbitrary()?,
        rsp: u.arbitrary()?,
        rbp: u.arbitrary()?,
        r8: u.arbitrary()?,
        r9: u.arbitrary()?,
        r10: u.arbitrary()?,
        r11: u.arbitrary()?,
        r12: u.arbitrary()?,
        r13: u.arbitrary()?,
        r14: u.arbitrary()?,
        r15: u.arbitrary()?,
        rip: u.arbitrary()?,
        rflags: u.arbitrary()?,
    };

    // Cap RCX to avoid looping for too long for reps instructions.
    regs.rcx &= 0xFFFFu64;

    let regs = StandardRegisters::Mshv(regs);

    let sregs = SpecialRegisters {
        cs: generate_segment_register(&mut u)?,
        ds: generate_segment_register(&mut u)?,
        es: generate_segment_register(&mut u)?,
        fs: generate_segment_register(&mut u)?,
        gs: generate_segment_register(&mut u)?,
        ss: generate_segment_register(&mut u)?,
        tr: generate_segment_register(&mut u)?,
        ldt: generate_segment_register(&mut u)?,
        gdt: generate_descriptor_table(&mut u)?,
        idt: generate_descriptor_table(&mut u)?,
        cr0: u.arbitrary()?,
        cr2: u.arbitrary()?,
        cr3: u.arbitrary()?,
        cr4: u.arbitrary()?,
        cr8: u.arbitrary()?,
        efer: u.arbitrary()?,
        apic_base: u.arbitrary()?,
        interrupt_bitmap: u.arbitrary()?,
    };

    let memory = u.arbitrary::<[u8; 8]>()?;
    let insn = u.arbitrary::<[u8; 16]>()?;

    let ctx = EmulatorContext {
        state: EmulatorCpuState { regs, sregs },
        memory,
    };

    Ok((ctx, insn))
}