summaryrefslogtreecommitdiffstats
path: root/tests/qtest/fuzz
Commit message (Collapse)AuthorAgeFilesLines
...
* tests/qtest/fuzz: Add missing spaces in descriptionThomas Huth2020-07-131-2/+2
| | | | | | | | | There should be a space between "forking" and "for". Message-Id: <20200709083719.22221-1-thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Thomas Huth <thuth@redhat.com>
* fuzz: add missing header for rcu_enable_atforkAlexander Bulekov2020-07-131-0/+1
| | | | | | | | | | | | | | In 45222b9a90, I fixed a broken check for rcu_enable_atfork introduced in d6919e4cb6. I added a call to rcu_enable_atfork after the call to qemu_init in fuzz.c, but forgot to include the corresponding header, breaking --enable-fuzzing --enable-werror builds. Fixes: 45222b9a90 ("fuzz: fix broken qtest check at rcu_disable_atfork") Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20200708200104.21978-3-alxndr@bu.edu> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
* fuzz: do not use POSIX shm for coverage bitmapAlexander Bulekov2020-07-061-27/+13Star
| | | | | | | | | | | | | We used shm_open with mmap to share libfuzzer's coverage bitmap with child (runner) processes. The same functionality can be achieved with MAP_SHARED | MAP_ANONYMOUS, since we do not care about naming or permissioning the shared memory object. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20200622165040.15121-1-alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
* fuzz: fix broken qtest check at rcu_disable_atforkAlexander Bulekov2020-07-061-0/+3
| | | | | | | | | | | | The qtest_enabled check introduced in d6919e4 always returns false, as it is called prior to configure_accelerators(). Instead of trying to skip rcu_disable_atfork in qemu_main, simply call rcu_enable_atfork in the fuzzer, after qemu_main returns. Reported-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20200618160516.2817-1-alxndr@bu.edu> Signed-off-by: Thomas Huth <thuth@redhat.com>
* tests/qtest: Fix LGPL information in the file headersThomas Huth2020-06-151-1/+1
| | | | | | | | | | | It's either "GNU *Library* General Public License version 2" or "GNU Lesser General Public License version *2.1*", but there was no "version 2.0" of the "Lesser" license. So assume that version 2.1 is meant here. Message-Id: <20200605100645.6506-1-thuth@redhat.com> Reviewed-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
* fuzz: Add support for logging QTest commandsAlexander Bulekov2020-06-151-1/+8
| | | | | | | Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20200529221450.26673-3-alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
* fuzz: skip QTest serializationAlexander Bulekov2020-06-154-1/+288
| | | | | | | | | | | | | The QTest server usually parses ASCII commands from clients. Since we fuzz within the QEMU process, skip the QTest serialization and server for most QTest commands. Leave the option to use the ASCII protocol, to generate readable traces for crash reproducers. Inspired-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20200529221450.26673-2-alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
* fuzz: run the main-loop in fork-server processAlexander Bulekov2020-06-053-0/+5
| | | | | | | | | | | | | Without this, the time since the last main-loop keeps increasing, as the fuzzer runs. The forked children need to handle all the "past-due" timers, slowing them down, over time. With this change, the parent/fork-server process runs the main-loop, while waiting on the child, ensuring that the timer events do not pile up, over time. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200512030133.29896-5-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* fuzz: add mangled object name to linker scriptAlexander Bulekov2020-06-051-0/+5
| | | | | | | | | | | | Previously, we relied on "FuzzerTracePC*(.bss*)" to place libfuzzer's fuzzer::TPC object into our contiguous shared-memory region. This does not work for some libfuzzer builds, so this addition identifies the region by its mangled name: *(.bss._ZN6fuzzer3TPCE); Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200512030133.29896-4-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* fuzz: fix typo in i440fx-qtest-reboot argumentsAlexander Bulekov2020-06-051-1/+1
| | | | | | | | Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20200512030133.29896-3-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* fuzz: add datadir for oss-fuzz compatabilityAlexander Bulekov2020-06-051-0/+15
| | | | | | | | | | | This allows us to keep pc-bios in executable_dir/pc-bios, rather than executable_dir/../pc-bios, which is incompatible with oss-fuzz' file structure. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200512030133.29896-2-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* tests/fuzz: Extract ioport_fuzz_qtest() methodPhilippe Mathieu-Daudé2020-05-151-2/+9
| | | | | | | | | | Extract generic ioport_fuzz_qtest() method from i440fx_fuzz_qtest(). This will help to write tests not specific to the i440FX controller. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20200514143433.18569-7-philmd@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* tests/fuzz: Extract pciconfig_fuzz_qos() methodPhilippe Mathieu-Daudé2020-05-151-6/+14
| | | | | | | | | | Extract the generic pciconfig_fuzz_qos() method from i440fx_fuzz_qos(). This will help to write tests not specific to the i440FX controller. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20200514143433.18569-6-philmd@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* tests/fuzz: Remove unuseful/unused typedefsPhilippe Mathieu-Daudé2020-05-151-6/+4Star
| | | | | | | | | These typedefs are not used. Use a simple structure, remote the typedefs. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20200514143433.18569-5-philmd@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* tests/fuzz: Add missing space in test descriptionPhilippe Mathieu-Daudé2020-05-151-3/+3
| | | | | | Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20200514143433.18569-4-philmd@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* tests/fuzz/Makefile: Do not link code using unavailable devicesPhilippe Mathieu-Daudé2020-05-151-3/+3
| | | | | | | | | | Some devices availability depends on CONFIG options. Use these options to only link tests when requested device is available. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20200514143433.18569-2-philmd@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* fuzz: select fuzz target using executable nameAlexander Bulekov2020-05-041-8/+11
| | | | | | | | | | | | | | | | | | The fuzzers are built into a binary (e.g. qemu-fuzz-i386). To select the device to fuzz/fuzz target, we usually use the --fuzz-target= argument. This commit allows the fuzz-target to be specified using the name of the executable. If the executable name ends with -target-FUZZ_TARGET, then we select the fuzz target based on this name, rather than the --fuzz-target argument. This is useful for systems such as oss-fuzz where we don't have control of the arguments passed to the fuzzer. [Fixed incorrect indentation. --Stefan] Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200421182230.6313-1-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* fuzz: Simplify how we compute available machines and typesMarkus Armbruster2020-04-291-25/+9Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | apply_to_qlist(), apply_to_node() work with QObjects. This is designed for use by tests/qtest/qos-test.c, which gets the data in that form via QMP. Goes back to commit fc281c8020 "tests: qgraph API for the qtest driver framework". Commit 275ab39d86 "fuzz: add support for qos-assisted fuzz targets" added another user: qtest/fuzz/qos_fuzz.c. To get the data as QObjects, it uses qmp_marshal_query_machines() and qmp_marshal_qom_list_types(). All this code is rather cumbersome. Switch to working with generated QAPI types instead: * Replace apply_to_qlist() & friends by machines_apply_to_node() and types_apply_to_node(). * Have qos_fuzz.c use qmp_query_machines() and qmp_qom_list_types() instead. * Have qos_test.c convert from QObject to the QAPI types. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200424071142.3525-3-armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Alexander Bulekov <alxndr@bu.edu>
* Use &error_abort instead of separate assert()Markus Armbruster2020-03-171-5/+2Star
| | | | | | | | | | Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200313170517.22480-2-armbru@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> [Unused Error *variable deleted]
* qtest: fix fuzzer-related 80-char limit violationsAlexander Bulekov2020-03-061-1/+4
| | | | | | | | Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200227031439.31386-3-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* fuzz: fix style/typos in linker-script commentsAlexander Bulekov2020-03-061-6/+10
| | | | | | | | Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200227031439.31386-2-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* fuzz: add virtio-scsi fuzz targetAlexander Bulekov2020-02-222-0/+214
| | | | | | | | | | | The virtio-scsi fuzz target sets up and fuzzes the available virtio-scsi queues. After an element is placed on a queue, the fuzzer can select whether to perform a kick, or continue adding elements. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200220041118.23264-22-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* fuzz: add virtio-net fuzz targetAlexander Bulekov2020-02-222-0/+199
| | | | | | | | | | | The virtio-net fuzz target feeds inputs to all three virtio-net virtqueues, and uses forking to avoid leaking state between fuzz runs. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200220041118.23264-21-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* fuzz: add i440fx fuzz targetsAlexander Bulekov2020-02-222-0/+196
| | | | | | | | | | | | | These three targets should simply fuzz reads/writes to a couple ioports, but they mostly serve as examples of different ways to write targets. They demonstrate using qtest and qos for fuzzing, as well as using rebooting and forking to reset state, or not resetting it at all. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200220041118.23264-20-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* fuzz: add support for qos-assisted fuzz targetsAlexander Bulekov2020-02-223-0/+269
| | | | | | | | Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200220041118.23264-17-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* fuzz: support for fork-based fuzzing.Alexander Bulekov2020-02-224-0/+120
| | | | | | | | | | | | | | | | | | | | | fork() is a simple way to ensure that state does not leak in between fuzzing runs. Unfortunately, the fuzzer mutation engine relies on bitmaps which contain coverage information for each fuzzing run, and these bitmaps should be copied from the child to the parent(where the mutation occurs). These bitmaps are created through compile-time instrumentation and they are not shared with fork()-ed processes, by default. To address this, we create a shared memory region, adjust its size and map it _over_ the counter region. Furthermore, libfuzzer doesn't generally expose the globals that specify the location of the counters/coverage bitmap. As a workaround, we rely on a custom linker script which forces all of the bitmaps we care about to be placed in a contiguous region, which is easy to locate and mmap over. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200220041118.23264-16-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* fuzz: add fuzzer skeletonAlexander Bulekov2020-02-223-0/+280
tests/fuzz/fuzz.c serves as the entry point for the virtual-device fuzzer. Namely, libfuzzer invokes the LLVMFuzzerInitialize and LLVMFuzzerTestOneInput functions, both of which are defined in this file. This change adds a "FuzzTarget" struct, along with the fuzz_add_target function, which should be used to define new fuzz targets. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200220041118.23264-13-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2024-12-12 08:42:18 +0100