OpenE2K/qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity

fuzz: Add instructions for using generic-fuzz

Browse Source 
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
Message-Id: <20201023150746.107063-13-alxndr@bu.edu>
Signed-off-by: Thomas Huth <thuth@redhat.com>
This commit is contained in:
Alexander Bulekov 2020-10-23 11:07:41 -04:00 committed by Thomas Huth
parent cd3f0686dd
commit 2f2e036ca6
1 changed files with 39 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
docs/devel/fuzzing.txt
View File

@ -125,6 +125,45 @@ provided by libfuzzer. Libfuzzer passes a byte array and length. Commonly the
fuzzer loops over the byte-array interpreting it as a list of qtest commands,
addresses, or values.
== The Generic Fuzzer ==
Writing a fuzz target can be a lot of effort (especially if a device driver has
not be built-out within libqos). Many devices can be fuzzed to some degree,
without any device-specific code, using the generic-fuzz target.
The generic-fuzz target is capable of fuzzing devices over their PIO, MMIO,
and DMA input-spaces. To apply the generic-fuzz to a device, we need to define
two env-variables, at minimum:
QEMU_FUZZ_ARGS= is the set of QEMU arguments used to configure a machine, with
the device attached. For example, if we want to fuzz the virtio-net device
attached to a pc-i440fx machine, we can specify:
QEMU_FUZZ_ARGS="-M pc -nodefaults -netdev user,id=user0 \
-device virtio-net,netdev=user0"
QEMU_FUZZ_OBJECTS= is a set of space-delimited strings used to identify the
MemoryRegions that will be fuzzed. These strings are compared against
MemoryRegion names and MemoryRegion owner names, to decide whether each
MemoryRegion should be fuzzed. These strings support globbing. For the
virtio-net example, we could use QEMU_FUZZ_OBJECTS=
* 'virtio-net'
* 'virtio*'
* 'virtio* pcspk' (Fuzz the virtio devices and the PC speaker...)
* '*' (Fuzz the whole machine)
The "info mtree" and "info qom-tree" monitor commands can be especially useful
for identifying the MemoryRegion and Object names used for matching.
As a generic rule-of-thumb, the more MemoryRegions/Devices we match, the greater
the input-space, and the smaller the probability of finding crashing inputs for
individual devices. As such, it is usually a good idea to limit the fuzzer to
only a few MemoryRegions.
To ensure that these env variables have been configured correctly, we can use:
./qemu-fuzz-i386 --fuzz-target=generic-fuzz -runs=0
The output should contain a complete list of matched MemoryRegions.
= Implementation Details =
== The Fuzzer's Lifecycle ==