On 23/10/2020 17.07, Alexander Bulekov wrote:
> When a virtual-device tries to access some buffer in memory over DMA, we
> add call-backs into the fuzzer(next commit). The fuzzer checks verifies
> that the DMA request maps to a physical RAM address and fills the memory
> with fuzzer-provided data. The patterns that we use to fill this memory
> are specified using add_dma_pattern and clear_dma_patterns operations.
>
> Signed-off-by: Alexander Bulekov <[email protected]>
> Reviewed-by: Darren Kenny <[email protected]>
> ---
> include/exec/memory.h | 7 +
> tests/qtest/fuzz/generic_fuzz.c | 228 ++++++++++++++++++++++++++++++++
> 2 files changed, 235 insertions(+)
>
> diff --git a/include/exec/memory.h b/include/exec/memory.h
> index 042918dd16..93d27bff26 100644
> --- a/include/exec/memory.h
> +++ b/include/exec/memory.h
> @@ -42,6 +42,13 @@ typedef struct IOMMUMemoryRegionClass
> IOMMUMemoryRegionClass;
> DECLARE_OBJ_CHECKERS(IOMMUMemoryRegion, IOMMUMemoryRegionClass,
> IOMMU_MEMORY_REGION, TYPE_IOMMU_MEMORY_REGION)
>
> +#ifdef CONFIG_FUZZ
> +void fuzz_dma_read_cb(size_t addr,
> + size_t len,
> + MemoryRegion *mr,
> + bool is_write);
> +#endif
> +
> extern bool global_dirty_log;
>
> typedef struct MemoryRegionOps MemoryRegionOps;
> diff --git a/tests/qtest/fuzz/generic_fuzz.c b/tests/qtest/fuzz/generic_fuzz.c
> index 483d41fb2c..e6b18e4276 100644
> --- a/tests/qtest/fuzz/generic_fuzz.c
> +++ b/tests/qtest/fuzz/generic_fuzz.c
[...]
> +static int memory_access_size(MemoryRegion *mr, unsigned l, hwaddr addr)
> +{
> + unsigned access_size_max = mr->ops->valid.max_access_size;
> +
> + /* Regions are assumed to support 1-4 byte accesses unless
> + otherwise specified. */
Just FYI, I'll change this to use the QEMU multi-line comment style to avoid
a warning from checkpatch.pl.
> + if (access_size_max == 0) {
> + access_size_max = 4;
> + }
> +
> + /* Bound the maximum access by the alignment of the address. */
> + if (!mr->ops->impl.unaligned) {
> + unsigned align_size_max = addr & -addr;
> + if (align_size_max != 0 && align_size_max < access_size_max) {
> + access_size_max = align_size_max;
> + }
> + }
Thomas
