Re: How to fuzz devices that use timers?

[Paolo Bonzini]

On 28/05/20 11:52, Christophe de Dinechin wrote:
> 
> Since we run the fuzzer with the QTest accelerator, my first idea was to
> check for 'if (qtest_enabled())' in the timer code, and directly expire
> a timer instead of scheduling it. This way we can test reproducers.
> However various tests require/verify precise timing, so this would break
> various qtests.

There is a clock_step command that advance the QEMU_CLOCK_VIRTUAL clock
to the next deadline.  You just have to insert it into the fuzzing input.

Paolo