On 23/10/2020 17.07, Alexander Bulekov wrote: > When a virtual-device tries to access some buffer in memory over DMA, we > add call-backs into the fuzzer(next commit). The fuzzer checks verifies > that the DMA request maps to a physical RAM address and fills the memory > with fuzzer-provided data. The patterns that we use to fill this memory > are specified using add_dma_pattern and clear_dma_patterns operations. > > Signed-off-by: Alexander Bulekov <alx...@bu.edu> > Reviewed-by: Darren Kenny <darren.ke...@oracle.com> > --- > include/exec/memory.h | 7 + > tests/qtest/fuzz/generic_fuzz.c | 228 ++++++++++++++++++++++++++++++++ > 2 files changed, 235 insertions(+) > > diff --git a/include/exec/memory.h b/include/exec/memory.h > index 042918dd16..93d27bff26 100644 > --- a/include/exec/memory.h > +++ b/include/exec/memory.h > @@ -42,6 +42,13 @@ typedef struct IOMMUMemoryRegionClass > IOMMUMemoryRegionClass; > DECLARE_OBJ_CHECKERS(IOMMUMemoryRegion, IOMMUMemoryRegionClass, > IOMMU_MEMORY_REGION, TYPE_IOMMU_MEMORY_REGION) > > +#ifdef CONFIG_FUZZ > +void fuzz_dma_read_cb(size_t addr, > + size_t len, > + MemoryRegion *mr, > + bool is_write); > +#endif > + > extern bool global_dirty_log; > > typedef struct MemoryRegionOps MemoryRegionOps; > diff --git a/tests/qtest/fuzz/generic_fuzz.c b/tests/qtest/fuzz/generic_fuzz.c > index 483d41fb2c..e6b18e4276 100644 > --- a/tests/qtest/fuzz/generic_fuzz.c > +++ b/tests/qtest/fuzz/generic_fuzz.c [...] > +static int memory_access_size(MemoryRegion *mr, unsigned l, hwaddr addr) > +{ > + unsigned access_size_max = mr->ops->valid.max_access_size; > + > + /* Regions are assumed to support 1-4 byte accesses unless > + otherwise specified. */
Just FYI, I'll change this to use the QEMU multi-line comment style to avoid a warning from checkpatch.pl. > + if (access_size_max == 0) { > + access_size_max = 4; > + } > + > + /* Bound the maximum access by the alignment of the address. */ > + if (!mr->ops->impl.unaligned) { > + unsigned align_size_max = addr & -addr; > + if (align_size_max != 0 && align_size_max < access_size_max) { > + access_size_max = align_size_max; > + } > + } Thomas