mirror of https://github.com/xemu-project/xemu.git
fuzz: configure a sparse-mem device, by default
The generic-fuzzer often provides randomized DMA addresses to virtual-devices. For a 64-bit address-space, the chance of these randomized addresses coinciding with RAM regions, is fairly small. Even though the fuzzer's instrumentation eventually finds valid addresses, this can take some-time, and slows-down fuzzing progress (especially, when multiple DMA buffers are involved). To work around this, create "fake" sparse-memory that spans all of the 64-bit address-space. Adjust the DMA call-back to populate this sparse memory, correspondingly Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
This commit is contained in:
parent
230376d285
commit
25d309fb0d
|
@ -28,6 +28,7 @@
|
||||||
#include "hw/pci/pci.h"
|
#include "hw/pci/pci.h"
|
||||||
#include "hw/boards.h"
|
#include "hw/boards.h"
|
||||||
#include "generic_fuzz_configs.h"
|
#include "generic_fuzz_configs.h"
|
||||||
|
#include "hw/mem/sparse-mem.h"
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* SEPARATOR is used to separate "operations" in the fuzz input
|
* SEPARATOR is used to separate "operations" in the fuzz input
|
||||||
|
@ -64,6 +65,8 @@ static useconds_t timeout = DEFAULT_TIMEOUT_US;
|
||||||
|
|
||||||
static bool qtest_log_enabled;
|
static bool qtest_log_enabled;
|
||||||
|
|
||||||
|
MemoryRegion *sparse_mem_mr;
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* A pattern used to populate a DMA region or perform a memwrite. This is
|
* A pattern used to populate a DMA region or perform a memwrite. This is
|
||||||
* useful for e.g. populating tables of unique addresses.
|
* useful for e.g. populating tables of unique addresses.
|
||||||
|
@ -191,8 +194,7 @@ void fuzz_dma_read_cb(size_t addr, size_t len, MemoryRegion *mr)
|
||||||
*/
|
*/
|
||||||
if (dma_patterns->len == 0
|
if (dma_patterns->len == 0
|
||||||
|| len == 0
|
|| len == 0
|
||||||
|| mr != current_machine->ram
|
|| (mr != current_machine->ram && mr != sparse_mem_mr)) {
|
||||||
|| addr > current_machine->ram_size) {
|
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -238,7 +240,7 @@ void fuzz_dma_read_cb(size_t addr, size_t len, MemoryRegion *mr)
|
||||||
MEMTXATTRS_UNSPECIFIED);
|
MEMTXATTRS_UNSPECIFIED);
|
||||||
|
|
||||||
if (!(memory_region_is_ram(mr1) ||
|
if (!(memory_region_is_ram(mr1) ||
|
||||||
memory_region_is_romd(mr1))) {
|
memory_region_is_romd(mr1)) && mr1 != sparse_mem_mr) {
|
||||||
l = memory_access_size(mr1, l, addr1);
|
l = memory_access_size(mr1, l, addr1);
|
||||||
} else {
|
} else {
|
||||||
/* ROM/RAM case */
|
/* ROM/RAM case */
|
||||||
|
@ -814,6 +816,12 @@ static void generic_pre_fuzz(QTestState *s)
|
||||||
}
|
}
|
||||||
qts_global = s;
|
qts_global = s;
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Create a special device that we can use to back DMA buffers at very
|
||||||
|
* high memory addresses
|
||||||
|
*/
|
||||||
|
sparse_mem_mr = sparse_mem_init(0, UINT64_MAX);
|
||||||
|
|
||||||
dma_regions = g_array_new(false, false, sizeof(address_range));
|
dma_regions = g_array_new(false, false, sizeof(address_range));
|
||||||
dma_patterns = g_array_new(false, false, sizeof(pattern));
|
dma_patterns = g_array_new(false, false, sizeof(pattern));
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue