Message ID | 20210313231859.941263-3-alxndr@bu.edu |
---|---|
State | New |
Headers | show |
Series | fuzz: Add a sparse-memory device to accelerate fuzzing | expand |
On Saturday, 2021-03-13 at 18:18:58 -05, Alexander Bulekov wrote: > The generic-fuzzer often provides randomized DMA addresses to > virtual-devices. For a 64-bit address-space, the chance of these > randomized addresses coinciding with RAM regions, is fairly small. Even > though the fuzzer's instrumentation eventually finds valid addresses, > this can take some-time, and slows-down fuzzing progress (especially, > when multiple DMA buffers are involved). To work around this, create > "fake" sparse-memory that spans all of the 64-bit address-space. Adjust > the DMA call-back to populate this sparse memory, correspondingly > > Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> > --- > tests/qtest/fuzz/generic_fuzz.c | 14 +++++++++++--- > 1 file changed, 11 insertions(+), 3 deletions(-) > > diff --git a/tests/qtest/fuzz/generic_fuzz.c b/tests/qtest/fuzz/generic_fuzz.c > index 387ae2020a..b5fe27aae1 100644 > --- a/tests/qtest/fuzz/generic_fuzz.c > +++ b/tests/qtest/fuzz/generic_fuzz.c > @@ -28,6 +28,7 @@ > #include "hw/pci/pci.h" > #include "hw/boards.h" > #include "generic_fuzz_configs.h" > +#include "hw/mem/sparse-mem.h" > > /* > * SEPARATOR is used to separate "operations" in the fuzz input > @@ -64,6 +65,8 @@ static useconds_t timeout = DEFAULT_TIMEOUT_US; > > static bool qtest_log_enabled; > > +MemoryRegion *sparse_mem_mr; > + > /* > * A pattern used to populate a DMA region or perform a memwrite. This is > * useful for e.g. populating tables of unique addresses. > @@ -191,8 +194,7 @@ void fuzz_dma_read_cb(size_t addr, size_t len, MemoryRegion *mr) > */ > if (dma_patterns->len == 0 > || len == 0 > - || mr != current_machine->ram > - || addr > current_machine->ram_size) { > + || (mr != current_machine->ram && mr != sparse_mem_mr)) { > return; > } > > @@ -238,7 +240,7 @@ void fuzz_dma_read_cb(size_t addr, size_t len, MemoryRegion *mr) > MEMTXATTRS_UNSPECIFIED); > > if (!(memory_region_is_ram(mr1) || > - memory_region_is_romd(mr1))) { > + memory_region_is_romd(mr1)) && mr1 != sparse_mem_mr) { > l = memory_access_size(mr1, l, addr1); > } else { > /* ROM/RAM case */ > @@ -814,6 +816,12 @@ static void generic_pre_fuzz(QTestState *s) > } > qts_global = s; > > + /* > + * Create a special device that we can use to back DMA buffers at very > + * high memory addresses > + */ > + sparse_mem_mr = sparse_mem_init(0, UINT64_MAX); > + > dma_regions = g_array_new(false, false, sizeof(address_range)); > dma_patterns = g_array_new(false, false, sizeof(pattern)); > > -- > 2.28.0
diff --git a/tests/qtest/fuzz/generic_fuzz.c b/tests/qtest/fuzz/generic_fuzz.c index 387ae2020a..b5fe27aae1 100644 --- a/tests/qtest/fuzz/generic_fuzz.c +++ b/tests/qtest/fuzz/generic_fuzz.c @@ -28,6 +28,7 @@ #include "hw/pci/pci.h" #include "hw/boards.h" #include "generic_fuzz_configs.h" +#include "hw/mem/sparse-mem.h" /* * SEPARATOR is used to separate "operations" in the fuzz input @@ -64,6 +65,8 @@ static useconds_t timeout = DEFAULT_TIMEOUT_US; static bool qtest_log_enabled; +MemoryRegion *sparse_mem_mr; + /* * A pattern used to populate a DMA region or perform a memwrite. This is * useful for e.g. populating tables of unique addresses. @@ -191,8 +194,7 @@ void fuzz_dma_read_cb(size_t addr, size_t len, MemoryRegion *mr) */ if (dma_patterns->len == 0 || len == 0 - || mr != current_machine->ram - || addr > current_machine->ram_size) { + || (mr != current_machine->ram && mr != sparse_mem_mr)) { return; } @@ -238,7 +240,7 @@ void fuzz_dma_read_cb(size_t addr, size_t len, MemoryRegion *mr) MEMTXATTRS_UNSPECIFIED); if (!(memory_region_is_ram(mr1) || - memory_region_is_romd(mr1))) { + memory_region_is_romd(mr1)) && mr1 != sparse_mem_mr) { l = memory_access_size(mr1, l, addr1); } else { /* ROM/RAM case */ @@ -814,6 +816,12 @@ static void generic_pre_fuzz(QTestState *s) } qts_global = s; + /* + * Create a special device that we can use to back DMA buffers at very + * high memory addresses + */ + sparse_mem_mr = sparse_mem_init(0, UINT64_MAX); + dma_regions = g_array_new(false, false, sizeof(address_range)); dma_patterns = g_array_new(false, false, sizeof(pattern));
The generic-fuzzer often provides randomized DMA addresses to virtual-devices. For a 64-bit address-space, the chance of these randomized addresses coinciding with RAM regions, is fairly small. Even though the fuzzer's instrumentation eventually finds valid addresses, this can take some-time, and slows-down fuzzing progress (especially, when multiple DMA buffers are involved). To work around this, create "fake" sparse-memory that spans all of the 64-bit address-space. Adjust the DMA call-back to populate this sparse memory, correspondingly Signed-off-by: Alexander Bulekov <alxndr@bu.edu> --- tests/qtest/fuzz/generic_fuzz.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)