Re: [PATCH v7 04/17] fuzz: Add DMA support to the generic-fuzzer

[Thomas Huth <thuth@redhat.com>]

On 23/10/2020 17.07, Alexander Bulekov wrote:
> When a virtual-device tries to access some buffer in memory over DMA, we
> add call-backs into the fuzzer(next commit). The fuzzer checks verifies
> that the DMA request maps to a physical RAM address and fills the memory
> with fuzzer-provided data. The patterns that we use to fill this memory
> are specified using add_dma_pattern and clear_dma_patterns operations.
> 
> Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
> Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
> ---
>  include/exec/memory.h           |   7 +
>  tests/qtest/fuzz/generic_fuzz.c | 228 ++++++++++++++++++++++++++++++++
>  2 files changed, 235 insertions(+)
> 
> diff --git a/include/exec/memory.h b/include/exec/memory.h
> index 042918dd16..93d27bff26 100644
> --- a/include/exec/memory.h
> +++ b/include/exec/memory.h
> @@ -42,6 +42,13 @@ typedef struct IOMMUMemoryRegionClass IOMMUMemoryRegionClass;
>  DECLARE_OBJ_CHECKERS(IOMMUMemoryRegion, IOMMUMemoryRegionClass,
>                       IOMMU_MEMORY_REGION, TYPE_IOMMU_MEMORY_REGION)
>  
> +#ifdef CONFIG_FUZZ
> +void fuzz_dma_read_cb(size_t addr,
> +                      size_t len,
> +                      MemoryRegion *mr,
> +                      bool is_write);
> +#endif
> +
>  extern bool global_dirty_log;
>  
>  typedef struct MemoryRegionOps MemoryRegionOps;
> diff --git a/tests/qtest/fuzz/generic_fuzz.c b/tests/qtest/fuzz/generic_fuzz.c
> index 483d41fb2c..e6b18e4276 100644
> --- a/tests/qtest/fuzz/generic_fuzz.c
> +++ b/tests/qtest/fuzz/generic_fuzz.c
[...]
> +static int memory_access_size(MemoryRegion *mr, unsigned l, hwaddr addr)
> +{
> +    unsigned access_size_max = mr->ops->valid.max_access_size;
> +
> +    /* Regions are assumed to support 1-4 byte accesses unless
> +       otherwise specified.  */

Just FYI, I'll change this to use the QEMU multi-line comment style to avoid
a warning from checkpatch.pl.

> +    if (access_size_max == 0) {
> +        access_size_max = 4;
> +    }
> +
> +    /* Bound the maximum access by the alignment of the address.  */
> +    if (!mr->ops->impl.unaligned) {
> +        unsigned align_size_max = addr & -addr;
> +        if (align_size_max != 0 && align_size_max < access_size_max) {
> +            access_size_max = align_size_max;
> +        }
> +    }

 Thomas