From: "Oleinik, Alexander" <alxndr@bu.edu>
To: "qemu-devel@nongnu.org" <qemu-devel@nongnu.org>
Cc: "pbonzini@redhat.com" <pbonzini@redhat.com>,
"bsd@redhat.com" <bsd@redhat.com>,
"stefanha@redhat.com" <stefanha@redhat.com>,
"Oleinik, Alexander" <alxndr@bu.edu>
Subject: [Qemu-devel] [PATCH v3 00/22] Add virtual device fuzzing support
Date: Wed, 18 Sep 2019 23:19:27 +0000 [thread overview]
Message-ID: <20190918231846.22538-1-alxndr@bu.edu> (raw)
This series adds a framework for coverage-guided fuzzing of
virtual-devices. Fuzzing targets are based on qtest and can make use of
the libqos abstractions.
Build instructions in docs/devel/fuzzing.txt
V3:
* Rebased onto v4.1.0+
* Add the fuzzer as a new build-target type in the build-system
* Add indirection to qtest client/server communication functions
* Remove ramfile and snapshot-based fuzzing support
* Add i440fx fuzz-target as a reference for developers.
* Add linker-script to assist with fork-based fuzzer
V2:
* Split off changes to qos virtio-net and qtest server to other patches
* Move vl:main initialization into new func: qemu_init
* Moved useful functions from qos-test.c to a separate object
* Use struct of function pointers for add_fuzz_target(), instead of
arguments
* Move ramfile to migration/qemu-file
* Rewrite fork-based fuzzer pending patch to libfuzzer
* Pass check-patch
Alexander Oleinik (22):
softmmu: split off vl.c:main() into main.c
libqos: Rename i2c_send and i2c_recv
fuzz: Add FUZZ_TARGET module type
qtest: add qtest_server_send abstraction
libqtest: Add a layer of abstraciton to send/recv
fuzz: add configure flag --enable-fuzzing
fuzz: Add target/fuzz makefile rules
module: check module wasn't already initialized
qtest: add in-process incoming command handler
tests: provide test variables to other targets
libqos: split qos-test and libqos makefile vars
libqos: move useful qos-test funcs to qos_external
libqtest: make qtest_bufwrite send "atomic"
libqtest: add in-process qtest.c tx/rx handlers
fuzz: Add target/fuzz makefile rules
fuzz: add fuzzer skeleton
fuzz: add support for fork-based fuzzing.
fuzz: expose fuzz target name
fuzz: add support for qos-assisted fuzz targets
fuzz: add i440fx fuzz targets
fuzz: add virtio-net fuzz target
fuzz: add documentation to docs/devel/
Makefile | 26 ++++-
Makefile.objs | 6 +
Makefile.target | 17 +++
configure | 13 +++
docs/devel/fuzzing.txt | 107 ++++++++++++++++++
exec.c | 2 +
include/qemu/module.h | 4 +-
include/sysemu/qtest.h | 4 +
include/sysemu/sysemu.h | 4 +
main.c | 29 +++++
qtest.c | 24 +++-
tests/Makefile.include | 74 ++++++------
tests/fuzz/Makefile.include | 11 ++
tests/fuzz/fork_fuzz.c | 27 +++++
tests/fuzz/fork_fuzz.h | 12 ++
tests/fuzz/fork_fuzz.ld | 46 ++++++++
tests/fuzz/fuzz.c | 182 ++++++++++++++++++++++++++++++
tests/fuzz/fuzz.h | 31 +++++
tests/fuzz/i440fx_fuzz.c | 158 ++++++++++++++++++++++++++
tests/fuzz/qos_fuzz.c | 212 +++++++++++++++++++++++++++++++++++
tests/fuzz/qos_fuzz.h | 19 ++++
tests/fuzz/virtio_net_fuzz.c | 120 ++++++++++++++++++++
tests/libqos/i2c-imx.c | 8 +-
tests/libqos/i2c-omap.c | 8 +-
tests/libqos/i2c.c | 10 +-
tests/libqos/i2c.h | 4 +-
tests/libqos/qos_external.c | 151 +++++++++++++++++++++++++
tests/libqos/qos_external.h | 10 ++
tests/libqtest.c | 114 ++++++++++++++++---
tests/libqtest.h | 4 +
tests/pca9552-test.c | 10 +-
tests/qos-test.c | 140 +----------------------
util/module.c | 7 ++
vl.c | 25 ++---
34 files changed, 1393 insertions(+), 226 deletions(-)
create mode 100644 docs/devel/fuzzing.txt
create mode 100644 main.c
create mode 100644 tests/fuzz/Makefile.include
create mode 100644 tests/fuzz/fork_fuzz.c
create mode 100644 tests/fuzz/fork_fuzz.h
create mode 100644 tests/fuzz/fork_fuzz.ld
create mode 100644 tests/fuzz/fuzz.c
create mode 100644 tests/fuzz/fuzz.h
create mode 100644 tests/fuzz/i440fx_fuzz.c
create mode 100644 tests/fuzz/qos_fuzz.c
create mode 100644 tests/fuzz/qos_fuzz.h
create mode 100644 tests/fuzz/virtio_net_fuzz.c
create mode 100644 tests/libqos/qos_external.c
create mode 100644 tests/libqos/qos_external.h
--
2.23.0
next reply other threads:[~2019-09-18 23:21 UTC|newest]
Thread overview: 65+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-09-18 23:19 Oleinik, Alexander [this message]
2019-09-18 23:19 ` [Qemu-devel] [PATCH v3 01/22] softmmu: split off vl.c:main() into main.c Oleinik, Alexander
2019-09-19 10:03 ` Stefan Hajnoczi
2019-09-19 13:01 ` Oleinik, Alexander
2019-09-18 23:19 ` [Qemu-devel] [PATCH v3 02/22] libqos: Rename i2c_send and i2c_recv Oleinik, Alexander
2019-09-19 6:01 ` Thomas Huth
2019-09-19 10:05 ` Stefan Hajnoczi
2019-09-19 11:15 ` Paolo Bonzini
2019-09-19 13:23 ` Oleinik, Alexander
2019-09-18 23:19 ` [Qemu-devel] [PATCH v3 03/22] fuzz: Add FUZZ_TARGET module type Oleinik, Alexander
2019-09-19 10:06 ` Stefan Hajnoczi
2019-09-18 23:19 ` [Qemu-devel] [PATCH v3 04/22] qtest: add qtest_server_send abstraction Oleinik, Alexander
2019-09-19 10:10 ` Stefan Hajnoczi
2019-09-18 23:19 ` [Qemu-devel] [PATCH v3 05/22] libqtest: Add a layer of abstraciton to send/recv Oleinik, Alexander
2019-09-19 10:24 ` Stefan Hajnoczi
2019-09-19 11:18 ` Paolo Bonzini
2019-09-19 13:27 ` Oleinik, Alexander
2019-09-19 14:27 ` Paolo Bonzini
2019-09-18 23:19 ` [Qemu-devel] [PATCH v3 06/22] fuzz: add configure flag --enable-fuzzing Oleinik, Alexander
2019-09-19 10:28 ` Stefan Hajnoczi
2019-09-19 13:07 ` Oleinik, Alexander
2019-09-18 23:19 ` [Qemu-devel] [PATCH v3 07/22] fuzz: Add target/fuzz makefile rules Oleinik, Alexander
2019-09-18 23:19 ` [Qemu-devel] [PATCH v3 08/22] module: check module wasn't already initialized Oleinik, Alexander
2019-09-19 10:30 ` Stefan Hajnoczi
2019-09-18 23:19 ` [Qemu-devel] [PATCH v3 09/22] qtest: add in-process incoming command handler Oleinik, Alexander
2019-09-19 10:31 ` Stefan Hajnoczi
2019-09-18 23:19 ` [Qemu-devel] [PATCH v3 10/22] tests: provide test variables to other targets Oleinik, Alexander
2019-09-18 23:19 ` [Qemu-devel] [PATCH v3 11/22] libqos: split qos-test and libqos makefile vars Oleinik, Alexander
2019-09-26 12:04 ` Thomas Huth
2019-09-18 23:19 ` [Qemu-devel] [PATCH v3 12/22] libqos: move useful qos-test funcs to qos_external Oleinik, Alexander
2019-09-19 10:34 ` Stefan Hajnoczi
2019-09-18 23:19 ` [Qemu-devel] [PATCH v3 13/22] libqtest: make qtest_bufwrite send "atomic" Oleinik, Alexander
2019-09-19 10:37 ` Stefan Hajnoczi
2019-09-19 18:56 ` John Snow
2019-09-19 19:36 ` Oleinik, Alexander
2019-09-20 0:49 ` John Snow
2019-09-19 19:50 ` Alexander Oleinik
2019-09-18 23:19 ` [Qemu-devel] [PATCH v3 14/22] libqtest: add in-process qtest.c tx/rx handlers Oleinik, Alexander
2019-09-19 10:42 ` Stefan Hajnoczi
2019-09-19 13:22 ` Oleinik, Alexander
2019-09-18 23:19 ` [Qemu-devel] [PATCH v3 15/22] fuzz: Add target/fuzz makefile rules Oleinik, Alexander
2019-09-18 23:19 ` [Qemu-devel] [PATCH v3 16/22] fuzz: add fuzzer skeleton Oleinik, Alexander
2019-09-19 12:48 ` Stefan Hajnoczi
2019-09-19 13:49 ` Oleinik, Alexander
2019-09-20 9:30 ` Stefan Hajnoczi
2019-09-23 14:55 ` Darren Kenny
2019-09-18 23:19 ` [Qemu-devel] [PATCH v3 17/22] fuzz: add support for fork-based fuzzing Oleinik, Alexander
2019-09-19 12:54 ` Stefan Hajnoczi
2019-09-19 14:01 ` Oleinik, Alexander
2019-09-20 9:33 ` Stefan Hajnoczi
2019-09-30 15:17 ` Alexander Oleinik
2019-09-18 23:19 ` [Qemu-devel] [PATCH v3 18/22] fuzz: expose fuzz target name Oleinik, Alexander
2019-09-24 7:49 ` Darren Kenny
2019-09-18 23:19 ` [Qemu-devel] [PATCH v3 19/22] fuzz: add support for qos-assisted fuzz targets Oleinik, Alexander
2019-09-18 23:19 ` [Qemu-devel] [PATCH v3 20/22] fuzz: add i440fx " Oleinik, Alexander
2019-09-19 13:08 ` Stefan Hajnoczi
2019-09-18 23:19 ` [Qemu-devel] [PATCH v3 21/22] fuzz: add virtio-net fuzz target Oleinik, Alexander
2019-09-18 23:19 ` [Qemu-devel] [PATCH v3 22/22] fuzz: add documentation to docs/devel/ Oleinik, Alexander
2019-09-23 14:54 ` Darren Kenny
2019-09-19 10:33 ` [Qemu-devel] [PATCH v3 00/22] Add virtual device fuzzing support Stefan Hajnoczi
2019-09-19 13:10 ` Stefan Hajnoczi
2019-09-20 0:19 ` no-reply
2019-09-20 0:19 ` no-reply
2019-09-20 0:21 ` no-reply
2019-09-20 0:24 ` no-reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190918231846.22538-1-alxndr@bu.edu \
--to=alxndr@bu.edu \
--cc=bsd@redhat.com \
--cc=pbonzini@redhat.com \
--cc=qemu-devel@nongnu.org \
--cc=stefanha@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).