diff options
| author | Alexander Bulekov | 2020-10-23 17:07:35 +0200 |
|---|---|---|
| committer | Thomas Huth | 2020-10-26 09:53:53 +0100 |
| commit | a3c20e91dea6f7af64d886b05d678839b7b1a14c (patch) | |
| tree | 67c99697c70256521950b249800338e1da7b4bea /include/exec | |
| parent | fuzz: Declare DMA Read callback function (diff) | |
| download | qemu-a3c20e91dea6f7af64d886b05d678839b7b1a14c.tar.gz qemu-a3c20e91dea6f7af64d886b05d678839b7b1a14c.tar.xz qemu-a3c20e91dea6f7af64d886b05d678839b7b1a14c.zip | |
fuzz: Add fuzzer callbacks to DMA-read functions
We should be careful to not call any functions besides fuzz_dma_read_cb.
Without --enable-fuzzing, fuzz_dma_read_cb is an empty inlined function.
Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
Message-Id: <20201023150746.107063-7-alxndr@bu.edu>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Diffstat (limited to 'include/exec')
| -rw-r--r-- | include/exec/memory.h | 1 | ||||
| -rw-r--r-- | include/exec/memory_ldst_cached.h.inc | 3 |
2 files changed, 4 insertions, 0 deletions
diff --git a/include/exec/memory.h b/include/exec/memory.h index 4aaf578ce6..aff6ef7605 100644 --- a/include/exec/memory.h +++ b/include/exec/memory.h @@ -2462,6 +2462,7 @@ address_space_read_cached(MemoryRegionCache *cache, hwaddr addr, void *buf, hwaddr len) { assert(addr < cache->len && len <= cache->len - addr); + fuzz_dma_read_cb(cache->xlat + addr, len, cache->mrs.mr, false); if (likely(cache->ptr)) { memcpy(buf, cache->ptr + addr, len); return MEMTX_OK; diff --git a/include/exec/memory_ldst_cached.h.inc b/include/exec/memory_ldst_cached.h.inc index fd4bbb40e7..aff574039f 100644 --- a/include/exec/memory_ldst_cached.h.inc +++ b/include/exec/memory_ldst_cached.h.inc @@ -28,6 +28,7 @@ static inline uint32_t ADDRESS_SPACE_LD_CACHED(l)(MemoryRegionCache *cache, hwaddr addr, MemTxAttrs attrs, MemTxResult *result) { assert(addr < cache->len && 4 <= cache->len - addr); + fuzz_dma_read_cb(cache->xlat + addr, 4, cache->mrs.mr, false); if (likely(cache->ptr)) { return LD_P(l)(cache->ptr + addr); } else { @@ -39,6 +40,7 @@ static inline uint64_t ADDRESS_SPACE_LD_CACHED(q)(MemoryRegionCache *cache, hwaddr addr, MemTxAttrs attrs, MemTxResult *result) { assert(addr < cache->len && 8 <= cache->len - addr); + fuzz_dma_read_cb(cache->xlat + addr, 8, cache->mrs.mr, false); if (likely(cache->ptr)) { return LD_P(q)(cache->ptr + addr); } else { @@ -50,6 +52,7 @@ static inline uint32_t ADDRESS_SPACE_LD_CACHED(uw)(MemoryRegionCache *cache, hwaddr addr, MemTxAttrs attrs, MemTxResult *result) { assert(addr < cache->len && 2 <= cache->len - addr); + fuzz_dma_read_cb(cache->xlat + addr, 2, cache->mrs.mr, false); if (likely(cache->ptr)) { return LD_P(uw)(cache->ptr + addr); } else { |