diff options
| author | Alexander Bulekov | 2020-10-23 17:07:35 +0200 |
|---|---|---|
| committer | Thomas Huth | 2020-10-26 09:53:53 +0100 |
| commit | a3c20e91dea6f7af64d886b05d678839b7b1a14c (patch) | |
| tree | 67c99697c70256521950b249800338e1da7b4bea /softmmu | |
| parent | fuzz: Declare DMA Read callback function (diff) | |
| download | qemu-a3c20e91dea6f7af64d886b05d678839b7b1a14c.tar.gz qemu-a3c20e91dea6f7af64d886b05d678839b7b1a14c.tar.xz qemu-a3c20e91dea6f7af64d886b05d678839b7b1a14c.zip | |
fuzz: Add fuzzer callbacks to DMA-read functions
We should be careful to not call any functions besides fuzz_dma_read_cb.
Without --enable-fuzzing, fuzz_dma_read_cb is an empty inlined function.
Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
Message-Id: <20201023150746.107063-7-alxndr@bu.edu>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Diffstat (limited to 'softmmu')
| -rw-r--r-- | softmmu/memory.c | 1 | ||||
| -rw-r--r-- | softmmu/physmem.c | 2 |
2 files changed, 3 insertions, 0 deletions
diff --git a/softmmu/memory.c b/softmmu/memory.c index cec0e0f743..ee4a6bc168 100644 --- a/softmmu/memory.c +++ b/softmmu/memory.c @@ -1433,6 +1433,7 @@ MemTxResult memory_region_dispatch_read(MemoryRegion *mr, unsigned size = memop_size(op); MemTxResult r; + fuzz_dma_read_cb(addr, size, mr, false); if (!memory_region_access_valid(mr, addr, size, false, attrs)) { *pval = unassigned_mem_read(mr, addr, size); return MEMTX_DECODE_ERROR; diff --git a/softmmu/physmem.c b/softmmu/physmem.c index e319fb2a1e..a9adedb9f8 100644 --- a/softmmu/physmem.c +++ b/softmmu/physmem.c @@ -2832,6 +2832,7 @@ MemTxResult flatview_read_continue(FlatView *fv, hwaddr addr, stn_he_p(buf, l, val); } else { /* RAM case */ + fuzz_dma_read_cb(addr, len, mr, false); ram_ptr = qemu_ram_ptr_length(mr->ram_block, addr1, &l, false); memcpy(buf, ram_ptr, l); } @@ -3192,6 +3193,7 @@ void *address_space_map(AddressSpace *as, memory_region_ref(mr); *plen = flatview_extend_translation(fv, addr, len, mr, xlat, l, is_write, attrs); + fuzz_dma_read_cb(addr, *plen, mr, is_write); ptr = qemu_ram_ptr_length(mr->ram_block, xlat, plen, true); return ptr; |