commit 7cac7fea708a1ca46f16c4e816d88b40da755de1
author Alexander Bulekov <alxndr@bu.edu> Mon Mar 15 10:05:12 2021 -0400
committer Paolo Bonzini <pbonzini@redhat.com> Tue Mar 16 14:30:30 2021 -0400
tree e4ab1fa4ce4e02f73491c4b0c1757138277e8918
parent 25d309fb0d6c07e49c3d9250cdbacc16941d988e

fuzz: move some DMA hooks

For the sparse-mem device, we want the fuzzer to populate entire DMA
reads from sparse-mem, rather than hooking into the individual MMIO
memory_region_dispatch_read operations. Otherwise, the fuzzer will treat
each sequential read separately (and populate it with a separate
pattern). Work around this by rearranging some DMA hooks. Since the
fuzzer has it's own logic to skip accidentally writing to MMIO regions,
we can call the DMA cb, outside the flatview_translate loop.

Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

softmmu/physmem.c

diff --git a/softmmu/physmem.c b/softmmu/physmem.c
index 7e8b0fa..6a58c86 100644
--- a/softmmu/physmem.c
+++ b/softmmu/physmem.c
@@ -2831,6 +2831,7 @@
     bool release_lock = false;
     uint8_t *buf = ptr;
 
+    fuzz_dma_read_cb(addr, len, mr);
     for (;;) {
         if (!memory_access_is_direct(mr, false)) {
             /* I/O case */
@@ -2841,7 +2842,6 @@
             stn_he_p(buf, l, val);
         } else {
             /* RAM case */
-            fuzz_dma_read_cb(addr, len, mr);
             ram_ptr = qemu_ram_ptr_length(mr->ram_block, addr1, &l, false);
             memcpy(buf, ram_ptr, l);
         }