From: Alexander Oleinik <alxndr@bu.edu>
To: Stefan Hajnoczi <stefanha@gmail.com>
Cc: "qemu-devel@nongnu.org" <qemu-devel@nongnu.org>
Subject: Re: [PATCH v4 20/20] fuzz: add documentation to docs/devel/
Date: Thu, 7 Nov 2019 10:02:01 -0500 [thread overview]
Message-ID: <cafdaecb-3572-e3ef-e283-6b836abef908@bu.edu> (raw)
In-Reply-To: <20191107134036.GF365089@stefanha-x1.localdomain>
On 11/7/19 8:40 AM, Stefan Hajnoczi wrote:
> On Wed, Oct 30, 2019 at 02:50:04PM +0000, Oleinik, Alexander wrote:
>> +== Building the fuzzers ==
>> +
>> +NOTE: If possible, build a 32-bit binary. When forking, the 32-bit fuzzer is
>> +much faster, since the page-map has a smaller size. This is due to the fact that
>> +AddressSanitizer mmaps ~20TB of memory, as part of its detection. This results
>> +in a large page-map, and a much slower fork(). O
>> +
>> +To build the fuzzers, install a recent version of clang:
>> +Configure with (substitute the clang binaries with the version you installed):
>> +
>> + CC=clang-8 CXX=clang++-8 /path/to/configure --enable-fuzzing
>> +
>> +Fuzz targets are built similarly to system/softmmu:
>> +
>> + make i386-softmmu/fuzz
>> +
>> +This builds ./i386-softmmu/qemu-fuzz-i386
>
> I'm surprised that "make i386-softmmu/fuzz" builds
> i386-softmmu/qemu-fuzz-i386. Should that be "make
> i386-softmmu/qemu-fuzz-i386"
I tried to make the rule match the names for regular targets.
Ie:
make i386-softmmu/clean
make i386-softmmu/all
make i386-softmmu/install
Now there is an i386-softmmu/fuzz
>> += Implmentation Details =
>
> s/Implmentation/Implementation/
>
>> +
>> +== The Fuzzer's Lifecycle ==
>> +
>> +The fuzzer has two entrypoints that libfuzzer calls. libfuzzer provides it's
>> +own main(), which performs some setup, and calls the entrypoints:
>> +
>> +LLVMFuzzerInitialize: called prior to fuzzing. Used to initialize all of the
>> +necessary state
>> +
>> +LLVMFuzzerTestOneInput: called for each fuzzing run. Processes the input and
>> +resets the state at the end of each run.
>> +
>> +In more detail:
>> +
>> +LLVMFuzzerInitialize parses the arguments to the fuzzer (must start with two
>> +dashes, so they are ignored by libfuzzer main()). Currently, the arguments
>> +select the fuzz target. Then, the qtest client is initialized. If the target
>> +requires qos, qgraph is set up and the QOM/LIBQOS modules are initailized.
>
> s/initailized/initialized/
>
next prev parent reply other threads:[~2019-11-07 15:04 UTC|newest]
Thread overview: 57+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-10-30 14:49 [PATCH v4 00/20] Add virtual device fuzzing support Oleinik, Alexander
2019-10-30 14:49 ` [PATCH v4 01/20] softmmu: split off vl.c:main() into main.c Oleinik, Alexander
2019-11-05 16:41 ` Darren Kenny
2019-11-12 16:46 ` Alexander Bulekov
2019-11-06 15:01 ` Stefan Hajnoczi
2019-10-30 14:49 ` [PATCH v4 02/20] libqos: Rename i2c_send and i2c_recv Oleinik, Alexander
2019-11-06 15:17 ` Stefan Hajnoczi
2019-10-30 14:49 ` [PATCH v4 03/20] fuzz: Add FUZZ_TARGET module type Oleinik, Alexander
2019-11-06 13:17 ` Darren Kenny
2019-11-06 15:18 ` Stefan Hajnoczi
2019-10-30 14:49 ` [PATCH v4 04/20] qtest: add qtest_server_send abstraction Oleinik, Alexander
2019-11-06 13:29 ` Darren Kenny
2019-11-06 15:19 ` Stefan Hajnoczi
2019-10-30 14:49 ` [PATCH v4 06/20] module: check module wasn't already initialized Oleinik, Alexander
2019-11-06 15:26 ` Stefan Hajnoczi
2019-11-06 17:40 ` Darren Kenny
2019-10-30 14:49 ` [PATCH v4 05/20] libqtest: Add a layer of abstraciton to send/recv Oleinik, Alexander
2019-11-06 16:22 ` Stefan Hajnoczi
2019-10-30 14:49 ` [PATCH v4 07/20] qtest: add in-process incoming command handler Oleinik, Alexander
2019-11-06 16:33 ` Stefan Hajnoczi
2019-10-30 14:49 ` [PATCH v4 08/20] tests: provide test variables to other targets Oleinik, Alexander
2019-11-07 14:32 ` Darren Kenny
2019-10-30 14:49 ` [PATCH v4 09/20] libqos: split qos-test and libqos makefile vars Oleinik, Alexander
2019-11-07 14:03 ` Darren Kenny
2019-10-30 14:49 ` [PATCH v4 10/20] libqos: move useful qos-test funcs to qos_external Oleinik, Alexander
2019-11-06 16:41 ` Stefan Hajnoczi
2019-10-30 14:49 ` [PATCH v4 11/20] libqtest: make qtest_bufwrite send "atomic" Oleinik, Alexander
2019-11-06 16:44 ` Stefan Hajnoczi
2019-10-30 14:49 ` [PATCH v4 12/20] libqtest: add in-process qtest.c tx/rx handlers Oleinik, Alexander
2019-11-06 16:56 ` Stefan Hajnoczi
2019-11-12 17:38 ` Alexander Bulekov
2019-10-30 14:49 ` [PATCH v4 13/20] fuzz: add configure flag --enable-fuzzing Oleinik, Alexander
2019-11-06 16:57 ` Stefan Hajnoczi
2019-10-30 14:50 ` [PATCH v4 15/20] fuzz: add fuzzer skeleton Oleinik, Alexander
2019-11-07 12:55 ` Stefan Hajnoczi
2019-11-12 19:04 ` Alexander Bulekov
2019-10-30 14:50 ` [PATCH v4 14/20] fuzz: Add target/fuzz makefile rules Oleinik, Alexander
2019-11-07 14:31 ` Darren Kenny
2019-10-30 14:50 ` [PATCH v4 16/20] fuzz: add support for fork-based fuzzing Oleinik, Alexander
2019-11-07 13:17 ` Stefan Hajnoczi
2019-10-30 14:50 ` [PATCH v4 17/20] fuzz: add support for qos-assisted fuzz targets Oleinik, Alexander
2019-11-07 13:22 ` Stefan Hajnoczi
2019-10-30 14:50 ` [PATCH v4 18/20] fuzz: add i440fx " Oleinik, Alexander
2019-11-07 13:26 ` Stefan Hajnoczi
2019-10-30 14:50 ` [PATCH v4 19/20] fuzz: add virtio-net fuzz target Oleinik, Alexander
2019-11-07 13:36 ` Stefan Hajnoczi
2019-11-07 13:42 ` Jason Wang
2019-11-07 15:41 ` Stefan Hajnoczi
2019-10-30 14:50 ` [PATCH v4 20/20] fuzz: add documentation to docs/devel/ Oleinik, Alexander
2019-11-07 13:40 ` Stefan Hajnoczi
2019-11-07 15:02 ` Alexander Oleinik [this message]
2019-10-30 15:23 ` [PATCH v4 00/20] Add virtual device fuzzing support no-reply
2019-11-06 15:27 ` Stefan Hajnoczi
2019-11-05 13:57 ` Darren Kenny
2019-11-05 16:28 ` Alexander Oleinik
2019-11-05 16:47 ` Darren Kenny
2019-11-07 13:41 ` Stefan Hajnoczi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=cafdaecb-3572-e3ef-e283-6b836abef908@bu.edu \
--to=alxndr@bu.edu \
--cc=qemu-devel@nongnu.org \
--cc=stefanha@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).