From b677001d70529df271a5d9314440bb201da40acf Mon Sep 17 00:00:00 2001 From: Alexander Bulekov Date: Mon, 21 Dec 2020 13:12:03 -0500 Subject: [PATCH] fuzz: map all BARs and enable PCI devices Prior to this patch, the fuzzer found inputs to map PCI device BARs and enable the device. While it is nice that the fuzzer can do this, it added significant overhead, since the fuzzer needs to map all the BARs (regenerating the memory topology), at the start of each input. With this patch, we do this once, before fuzzing, mitigating some of this overhead. Signed-off-by: Alexander Bulekov Reviewed-by: Darren Kenny Reviewed-by: Paolo Bonzini Message-Id: <20201221181203.1853-1-alxndr@bu.edu> Signed-off-by: Thomas Huth --- tests/qtest/fuzz/generic_fuzz.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/tests/qtest/fuzz/generic_fuzz.c b/tests/qtest/fuzz/generic_fuzz.c index 07ad690683..be76d47d2d 100644 --- a/tests/qtest/fuzz/generic_fuzz.c +++ b/tests/qtest/fuzz/generic_fuzz.c @@ -16,6 +16,7 @@ #include "hw/core/cpu.h" #include "tests/qtest/libqos/libqtest.h" +#include "tests/qtest/libqos/pci-pc.h" #include "fuzz.h" #include "fork_fuzz.h" #include "exec/address-spaces.h" @@ -762,10 +763,29 @@ static int locate_fuzz_objects(Object *child, void *opaque) return 0; } + +static void pci_enum(gpointer pcidev, gpointer bus) +{ + PCIDevice *dev = pcidev; + QPCIDevice *qdev; + int i; + + qdev = qpci_device_find(bus, dev->devfn); + g_assert(qdev != NULL); + for (i = 0; i < 6; i++) { + if (dev->io_regions[i].size) { + qpci_iomap(qdev, i, NULL); + } + } + qpci_device_enable(qdev); + g_free(qdev); +} + static void generic_pre_fuzz(QTestState *s) { GHashTableIter iter; MemoryRegion *mr; + QPCIBus *pcibus; char **result; if (!getenv("QEMU_FUZZ_OBJECTS")) { @@ -810,6 +830,10 @@ static void generic_pre_fuzz(QTestState *s) exit(1); } + pcibus = qpci_new_pc(s, NULL); + g_ptr_array_foreach(fuzzable_pci_devices, pci_enum, pcibus); + qpci_free_pc(pcibus); + counter_shm_init(); }