Commit f2465433 authored by Peter Maydell's avatar Peter Maydell
Browse files

Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging 



Pull request

# gpg: Signature made Tue 19 May 2020 09:00:32 BST
# gpg:                using RSA key 8695A8BFD3F97CDAAC35775A9CA4ABB381AB73C8
# gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" [full]
# gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>" [full]
# Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35  775A 9CA4 ABB3 81AB 73C8

* remotes/stefanha/tags/block-pull-request:
  aio-posix: disable fdmon-io_uring when GSource is used
  aio-posix: don't duplicate fd handler deletion in fdmon_io_uring_destroy()
  tests/fuzz: Extract ioport_fuzz_qtest() method
  tests/fuzz: Extract pciconfig_fuzz_qos() method
  tests/fuzz: Remove unuseful/unused typedefs
  tests/fuzz: Add missing space in test description
  Makefile: List fuzz targets in 'make help'
  tests/fuzz/Makefile: Do not link code using unavailable devices

Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
parents bffe88d1 ba607ca8

Makefile

+5 −1
Original line number Diff line number Diff line
@@ -1252,7 +1252,11 @@ endif 
	@$(if $(TARGET_DIRS), \

		echo 'Architecture specific targets:'; \

		$(foreach t, $(TARGET_DIRS), \

		$(call print-help-run,$(t)/all,Build for $(t));) \

		$(call print-help-run,$(t)/all,Build for $(t)); \

		$(if $(CONFIG_FUZZ), \

			$(if $(findstring softmmu,$(t)), \

				$(call print-help-run,$(t)/fuzz,Build fuzzer for $(t)); \

		))) \

		echo '')

	@$(if $(TOOLS), \

		echo 'Tools targets:'; \

include/block/aio.h

+3 −0
Original line number Diff line number Diff line
@@ -701,6 +701,9 @@ void aio_context_setup(AioContext *ctx); 
 */

void aio_context_destroy(AioContext *ctx);



/* Used internally, do not call outside AioContext code */

void aio_context_use_g_source(AioContext *ctx);



/**

 * aio_context_set_poll_params:

 * @ctx: the aio context

tests/qtest/fuzz/Makefile.include

+3 −3
Original line number Diff line number Diff line
@@ -7,9 +7,9 @@ fuzz-obj-y += tests/qtest/fuzz/fork_fuzz.o 
fuzz-obj-y += tests/qtest/fuzz/qos_fuzz.o



# Targets

fuzz-obj-y += tests/qtest/fuzz/i440fx_fuzz.o

fuzz-obj-y += tests/qtest/fuzz/virtio_net_fuzz.o

fuzz-obj-y += tests/qtest/fuzz/virtio_scsi_fuzz.o

fuzz-obj-$(CONFIG_PCI_I440FX) += tests/qtest/fuzz/i440fx_fuzz.o

fuzz-obj-$(CONFIG_VIRTIO_NET) += tests/qtest/fuzz/virtio_net_fuzz.o

fuzz-obj-$(CONFIG_SCSI) += tests/qtest/fuzz/virtio_scsi_fuzz.o



FUZZ_CFLAGS += -I$(SRC_PATH)/tests -I$(SRC_PATH)/tests/qtest

tests/qtest/fuzz/i440fx_fuzz.c

+30 −17
Original line number Diff line number Diff line
@@ -39,18 +39,17 @@ enum action_id { 
    ACTION_MAX

};



static void i440fx_fuzz_qtest(QTestState *s,

static void ioport_fuzz_qtest(QTestState *s,

        const unsigned char *Data, size_t Size) {

    /*

     * loop over the Data, breaking it up into actions. each action has an

     * opcode, address offset and value

     */

    typedef struct QTestFuzzAction {

    struct {

        uint8_t opcode;

        uint8_t addr;

        uint32_t value;

    } QTestFuzzAction;

    QTestFuzzAction a;

    } a;



    while (Size >= sizeof(a)) {

        /* make a copy of the action so we can normalize the values in-place */
@@ -85,25 +84,26 @@ static void i440fx_fuzz_qtest(QTestState *s, 
    flush_events(s);

}



static void i440fx_fuzz_qos(QTestState *s,

static void i440fx_fuzz_qtest(QTestState *s,

                              const unsigned char *Data,

                              size_t Size)

{

    ioport_fuzz_qtest(s, Data, Size);

}



static void pciconfig_fuzz_qos(QTestState *s, QPCIBus *bus,

        const unsigned char *Data, size_t Size) {

    /*

     * Same as i440fx_fuzz_qtest, but using QOS. devfn is incorporated into the

     * Same as ioport_fuzz_qtest, but using QOS. devfn is incorporated into the

     * value written over Port IO

     */

    typedef struct QOSFuzzAction {

    struct {

        uint8_t opcode;

        uint8_t offset;

        int devfn;

        uint32_t value;

    } QOSFuzzAction;



    static QPCIBus *bus;

    if (!bus) {

        bus = qpci_new_pc(s, fuzz_qos_alloc);

    }

    } a;



    QOSFuzzAction a;

    while (Size >= sizeof(a)) {

        memcpy(&a, Data, sizeof(a));

        switch (a.opcode % ACTION_MAX) {
@@ -132,6 +132,19 @@ static void i440fx_fuzz_qos(QTestState *s, 
    flush_events(s);

}



static void i440fx_fuzz_qos(QTestState *s,

                            const unsigned char *Data,

                            size_t Size)

{

    static QPCIBus *bus;



    if (!bus) {

        bus = qpci_new_pc(s, fuzz_qos_alloc);

    }



    pciconfig_fuzz_qos(s, bus, Data, Size);

}



static void i440fx_fuzz_qos_fork(QTestState *s,

        const unsigned char *Data, size_t Size) {

    if (fork() == 0) {

util/aio-posix.c

+13 −0
Original line number Diff line number Diff line
@@ -679,6 +679,19 @@ void aio_context_destroy(AioContext *ctx) 
{

    fdmon_io_uring_destroy(ctx);

    fdmon_epoll_disable(ctx);

    aio_free_deleted_handlers(ctx);

}



void aio_context_use_g_source(AioContext *ctx)

{

    /*

     * Disable io_uring when the glib main loop is used because it doesn't

     * support mixed glib/aio_poll() usage. It relies on aio_poll() being

     * called regularly so that changes to the monitored file descriptors are

     * submitted, otherwise a list of pending fd handlers builds up.

     */

    fdmon_io_uring_destroy(ctx);

    aio_free_deleted_handlers(ctx);

}



void aio_context_set_poll_params(AioContext *ctx, int64_t max_ns,