This series adds a framework for coverage-guided fuzzing of virtual-devices. Fuzzing targets are based on qtest and can make use of the libqos abstractions.
Build instructions in docs/devel/fuzzing.txt V3: * Rebased onto v4.1.0+ * Add the fuzzer as a new build-target type in the build-system * Add indirection to qtest client/server communication functions * Remove ramfile and snapshot-based fuzzing support * Add i440fx fuzz-target as a reference for developers. * Add linker-script to assist with fork-based fuzzer V2: * Split off changes to qos virtio-net and qtest server to other patches * Move vl:main initialization into new func: qemu_init * Moved useful functions from qos-test.c to a separate object * Use struct of function pointers for add_fuzz_target(), instead of arguments * Move ramfile to migration/qemu-file * Rewrite fork-based fuzzer pending patch to libfuzzer * Pass check-patch Alexander Oleinik (22): softmmu: split off vl.c:main() into main.c libqos: Rename i2c_send and i2c_recv fuzz: Add FUZZ_TARGET module type qtest: add qtest_server_send abstraction libqtest: Add a layer of abstraciton to send/recv fuzz: add configure flag --enable-fuzzing fuzz: Add target/fuzz makefile rules module: check module wasn't already initialized qtest: add in-process incoming command handler tests: provide test variables to other targets libqos: split qos-test and libqos makefile vars libqos: move useful qos-test funcs to qos_external libqtest: make qtest_bufwrite send "atomic" libqtest: add in-process qtest.c tx/rx handlers fuzz: Add target/fuzz makefile rules fuzz: add fuzzer skeleton fuzz: add support for fork-based fuzzing. fuzz: expose fuzz target name fuzz: add support for qos-assisted fuzz targets fuzz: add i440fx fuzz targets fuzz: add virtio-net fuzz target fuzz: add documentation to docs/devel/ Makefile | 26 ++++- Makefile.objs | 6 + Makefile.target | 17 +++ configure | 13 +++ docs/devel/fuzzing.txt | 107 ++++++++++++++++++ exec.c | 2 + include/qemu/module.h | 4 +- include/sysemu/qtest.h | 4 + include/sysemu/sysemu.h | 4 + main.c | 29 +++++ qtest.c | 24 +++- tests/Makefile.include | 74 ++++++------ tests/fuzz/Makefile.include | 11 ++ tests/fuzz/fork_fuzz.c | 27 +++++ tests/fuzz/fork_fuzz.h | 12 ++ tests/fuzz/fork_fuzz.ld | 46 ++++++++ tests/fuzz/fuzz.c | 182 ++++++++++++++++++++++++++++++ tests/fuzz/fuzz.h | 31 +++++ tests/fuzz/i440fx_fuzz.c | 158 ++++++++++++++++++++++++++ tests/fuzz/qos_fuzz.c | 212 +++++++++++++++++++++++++++++++++++ tests/fuzz/qos_fuzz.h | 19 ++++ tests/fuzz/virtio_net_fuzz.c | 120 ++++++++++++++++++++ tests/libqos/i2c-imx.c | 8 +- tests/libqos/i2c-omap.c | 8 +- tests/libqos/i2c.c | 10 +- tests/libqos/i2c.h | 4 +- tests/libqos/qos_external.c | 151 +++++++++++++++++++++++++ tests/libqos/qos_external.h | 10 ++ tests/libqtest.c | 114 ++++++++++++++++--- tests/libqtest.h | 4 + tests/pca9552-test.c | 10 +- tests/qos-test.c | 140 +---------------------- util/module.c | 7 ++ vl.c | 25 ++--- 34 files changed, 1393 insertions(+), 226 deletions(-) create mode 100644 docs/devel/fuzzing.txt create mode 100644 main.c create mode 100644 tests/fuzz/Makefile.include create mode 100644 tests/fuzz/fork_fuzz.c create mode 100644 tests/fuzz/fork_fuzz.h create mode 100644 tests/fuzz/fork_fuzz.ld create mode 100644 tests/fuzz/fuzz.c create mode 100644 tests/fuzz/fuzz.h create mode 100644 tests/fuzz/i440fx_fuzz.c create mode 100644 tests/fuzz/qos_fuzz.c create mode 100644 tests/fuzz/qos_fuzz.h create mode 100644 tests/fuzz/virtio_net_fuzz.c create mode 100644 tests/libqos/qos_external.c create mode 100644 tests/libqos/qos_external.h -- 2.23.0