feat(virtq): add virtio-villain inspired packed virtq coverage#1634
Open
andreiltd wants to merge 1 commit into
Open
feat(virtq): add virtio-villain inspired packed virtq coverage#1634andreiltd wants to merge 1 commit into
andreiltd wants to merge 1 commit into
Conversation
andreiltd
requested review from
danbugs,
dblnz,
devigned,
jprendes,
jsturtevant,
ludfjig,
simongdavies,
squillace and
syntactically
as code owners
July 9, 2026 10:18
andreiltd
added
kind/enhancement
Contributor
There was a problem hiding this comment.
Pull request overview
This PR strengthens Hyperlight’s packed virtqueue (virtq) robustness by porting a set of deterministic packed-ring test cases (inspired by virtio-villain) into the in-process ring tests, and by adding a new fuzz target (with seed corpus support) for the packed-ring parser and notification/event-suppression logic.
Changes:
- Harden packed-ring parsing/consumption by rejecting descriptors that carry
INDIRECT, and by guardingDESC-event notification logic against out-of-range event indices. - Add a large suite of deterministic packed virtq tests covering malformed chains, phase/wrap edge cases, and notification suppression behavior.
- Add and wire up a new
fuzz_virtq_packed_ringtarget (Cargo/Just/CI), plus seed-corpus handling infuzz/.gitignoreand documentation updates.
Reviewed changes
Copilot reviewed 11 out of 17 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| src/hyperlight_common/src/virtq/ring.rs | Reject INDIRECT descriptors, add notification guard, and add extensive packed-ring tests (virtio-villain inspired). |
| src/hyperlight_common/src/virtq/producer.rs | Add regression tests for invalid used lengths/IDs and import ring consumer test helper. |
| src/hyperlight_common/src/virtq/desc.rs | Update documentation to reflect INDIRECT rejection behavior. |
| src/hyperlight_common/src/virtq/consumer.rs | Add regression tests ensuring bad chains don’t leak into higher-level inflight tracking. |
| fuzz/fuzz_targets/virtq_packed_ring.rs | New fuzz target to exercise packed-ring parsing/consumption paths with compact binary inputs. |
| fuzz/Cargo.toml | Register fuzz_virtq_packed_ring binary target. |
| fuzz/.gitignore | Keep .bin seed inputs for the new fuzz target while ignoring other corpus artifacts. |
| fuzz/README.md | Document that packed virtqueue ring parser is now fuzzed. |
| Justfile | Include the new fuzz target in like-CI fuzz runs. |
| .github/workflows/ValidatePullRequest.yml | Add new fuzz target to PR validation matrix. |
| .github/workflows/Fuzzing.yml | Add new fuzz target to scheduled fuzzing matrix. |
andreiltd
force-pushed
the
fuzz-virtq
branch
2 times, most recently
from
July 9, 2026 11:35
74a3b74 to
477abe8
Compare
ludfjig
previously approved these changes
Jul 9, 2026
Map applicable packed ring cases into deterministic in process virtq tests, add high-level producer/consumer safety coverage, and add a packed-ring fuzz target with binary seed inputs. See: https://github.com/weltling/virtio-villain/tree/main/tests/vring Signed-off-by: Tomasz Andrzejak <andreiltd@gmail.com>
ludfjig
approved these changes
Jul 10, 2026
jsturtevant
reviewed
Jul 10, 2026
Contributor
There was a problem hiding this comment.
do these bin's need to be checked in? looks like gitignore as added after?
Member
Author
There was a problem hiding this comment.
Yes, the intention was to have a valid queue as starting point for fuzzer and mutate memory from there. The seed is just binary form of the queue. I think it's more realistic than just starting from completely random mapping.
Contributor
There was a problem hiding this comment.
Is there another way to produce and maybe cache them without checking in binaries? Having binaries makes it hard to identify changes to the files.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Map applicable packed ring cases into deterministic in process virtq tests, and add a packed-ring fuzz target with binary seed inputs.
See: https://github.com/weltling/virtio-villain/tree/main/tests/packed