[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH v7 04/17] fuzz: Add DMA support to the generic-fuzzer
From: |
Thomas Huth |
Subject: |
Re: [PATCH v7 04/17] fuzz: Add DMA support to the generic-fuzzer |
Date: |
Mon, 26 Oct 2020 09:48:11 +0100 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.6.0 |
On 23/10/2020 17.07, Alexander Bulekov wrote:
> When a virtual-device tries to access some buffer in memory over DMA, we
> add call-backs into the fuzzer(next commit). The fuzzer checks verifies
> that the DMA request maps to a physical RAM address and fills the memory
> with fuzzer-provided data. The patterns that we use to fill this memory
> are specified using add_dma_pattern and clear_dma_patterns operations.
>
> Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
> Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
> ---
> include/exec/memory.h | 7 +
> tests/qtest/fuzz/generic_fuzz.c | 228 ++++++++++++++++++++++++++++++++
> 2 files changed, 235 insertions(+)
>
> diff --git a/include/exec/memory.h b/include/exec/memory.h
> index 042918dd16..93d27bff26 100644
> --- a/include/exec/memory.h
> +++ b/include/exec/memory.h
> @@ -42,6 +42,13 @@ typedef struct IOMMUMemoryRegionClass
> IOMMUMemoryRegionClass;
> DECLARE_OBJ_CHECKERS(IOMMUMemoryRegion, IOMMUMemoryRegionClass,
> IOMMU_MEMORY_REGION, TYPE_IOMMU_MEMORY_REGION)
>
> +#ifdef CONFIG_FUZZ
> +void fuzz_dma_read_cb(size_t addr,
> + size_t len,
> + MemoryRegion *mr,
> + bool is_write);
> +#endif
> +
> extern bool global_dirty_log;
>
> typedef struct MemoryRegionOps MemoryRegionOps;
> diff --git a/tests/qtest/fuzz/generic_fuzz.c b/tests/qtest/fuzz/generic_fuzz.c
> index 483d41fb2c..e6b18e4276 100644
> --- a/tests/qtest/fuzz/generic_fuzz.c
> +++ b/tests/qtest/fuzz/generic_fuzz.c
[...]
> +static int memory_access_size(MemoryRegion *mr, unsigned l, hwaddr addr)
> +{
> + unsigned access_size_max = mr->ops->valid.max_access_size;
> +
> + /* Regions are assumed to support 1-4 byte accesses unless
> + otherwise specified. */
Just FYI, I'll change this to use the QEMU multi-line comment style to avoid
a warning from checkpatch.pl.
> + if (access_size_max == 0) {
> + access_size_max = 4;
> + }
> +
> + /* Bound the maximum access by the alignment of the address. */
> + if (!mr->ops->impl.unaligned) {
> + unsigned align_size_max = addr & -addr;
> + if (align_size_max != 0 && align_size_max < access_size_max) {
> + access_size_max = align_size_max;
> + }
> + }
Thomas
- [PATCH v7 00/17] Add a Generic Virtual Device Fuzzer, Alexander Bulekov, 2020/10/23
- [PATCH v7 06/17] fuzz: Add fuzzer callbacks to DMA-read functions, Alexander Bulekov, 2020/10/23
- [PATCH v7 07/17] fuzz: Add support for custom crossover functions, Alexander Bulekov, 2020/10/23
- [PATCH v7 08/17] fuzz: add a DISABLE_PCI op to generic-fuzzer, Alexander Bulekov, 2020/10/23
- [PATCH v7 01/17] memory: Add FlatView foreach function, Alexander Bulekov, 2020/10/23
- [PATCH v7 02/17] fuzz: Add generic virtual-device fuzzer, Alexander Bulekov, 2020/10/23
- [PATCH v7 09/17] fuzz: add a crossover function to generic-fuzzer, Alexander Bulekov, 2020/10/23
- [PATCH v7 03/17] fuzz: Add PCI features to the generic fuzzer, Alexander Bulekov, 2020/10/23
- [PATCH v7 10/17] scripts/oss-fuzz: Add script to reorder a generic-fuzzer trace, Alexander Bulekov, 2020/10/23
- [PATCH v7 04/17] fuzz: Add DMA support to the generic-fuzzer, Alexander Bulekov, 2020/10/23
- Re: [PATCH v7 04/17] fuzz: Add DMA support to the generic-fuzzer,
Thomas Huth <=
- [PATCH v7 11/17] scripts/oss-fuzz: Add crash trace minimization script, Alexander Bulekov, 2020/10/23
- [PATCH v7 05/17] fuzz: Declare DMA Read callback function, Alexander Bulekov, 2020/10/23
- [PATCH v7 13/17] fuzz: add an "opaque" to the FuzzTarget struct, Alexander Bulekov, 2020/10/23
- [PATCH v7 12/17] fuzz: Add instructions for using generic-fuzz, Alexander Bulekov, 2020/10/23
- [PATCH v7 14/17] fuzz: add generic-fuzz configs for oss-fuzz, Alexander Bulekov, 2020/10/23
- [PATCH v7 15/17] fuzz: register predefined generic-fuzz configs, Alexander Bulekov, 2020/10/23
- [PATCH v7 16/17] scripts/oss-fuzz: use hardlinks instead of copying, Alexander Bulekov, 2020/10/23
- [PATCH v7 17/17] scripts/oss-fuzz: ignore the generic-fuzz target, Alexander Bulekov, 2020/10/23