aboutsummaryrefslogtreecommitdiff
path: root/softmmu
diff options
context:
space:
mode:
authorAlexander Bulekov <alxndr@bu.edu>2021-03-15 10:05:12 -0400
committerPaolo Bonzini <pbonzini@redhat.com>2021-03-16 14:30:30 -0400
commit7cac7fea708a1ca46f16c4e816d88b40da755de1 (patch)
treee4ab1fa4ce4e02f73491c4b0c1757138277e8918 /softmmu
parent25d309fb0d6c07e49c3d9250cdbacc16941d988e (diff)
downloadqemu-7cac7fea708a1ca46f16c4e816d88b40da755de1.zip
qemu-7cac7fea708a1ca46f16c4e816d88b40da755de1.tar.gz
qemu-7cac7fea708a1ca46f16c4e816d88b40da755de1.tar.bz2
fuzz: move some DMA hooks
For the sparse-mem device, we want the fuzzer to populate entire DMA reads from sparse-mem, rather than hooking into the individual MMIO memory_region_dispatch_read operations. Otherwise, the fuzzer will treat each sequential read separately (and populate it with a separate pattern). Work around this by rearranging some DMA hooks. Since the fuzzer has it's own logic to skip accidentally writing to MMIO regions, we can call the DMA cb, outside the flatview_translate loop. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'softmmu')
-rw-r--r--softmmu/memory.c1
-rw-r--r--softmmu/physmem.c2
2 files changed, 1 insertions, 2 deletions
diff --git a/softmmu/memory.c b/softmmu/memory.c
index 9db47b7..c4730ec 100644
--- a/softmmu/memory.c
+++ b/softmmu/memory.c
@@ -1440,7 +1440,6 @@ MemTxResult memory_region_dispatch_read(MemoryRegion *mr,
unsigned size = memop_size(op);
MemTxResult r;
- fuzz_dma_read_cb(addr, size, mr);
if (!memory_region_access_valid(mr, addr, size, false, attrs)) {
*pval = unassigned_mem_read(mr, addr, size);
return MEMTX_DECODE_ERROR;
diff --git a/softmmu/physmem.c b/softmmu/physmem.c
index 7e8b0fa..6a58c86 100644
--- a/softmmu/physmem.c
+++ b/softmmu/physmem.c
@@ -2831,6 +2831,7 @@ MemTxResult flatview_read_continue(FlatView *fv, hwaddr addr,
bool release_lock = false;
uint8_t *buf = ptr;
+ fuzz_dma_read_cb(addr, len, mr);
for (;;) {
if (!memory_access_is_direct(mr, false)) {
/* I/O case */
@@ -2841,7 +2842,6 @@ MemTxResult flatview_read_continue(FlatView *fv, hwaddr addr,
stn_he_p(buf, l, val);
} else {
/* RAM case */
- fuzz_dma_read_cb(addr, len, mr);
ram_ptr = qemu_ram_ptr_length(mr->ram_block, addr1, &l, false);
memcpy(buf, ram_ptr, l);
}