support AFL++ fuzzing (#623)

To support fuzzing with AFL++, add a "pipe" transport that reads from stdin and
outputs to stdout: this is the most convenient way of doing fuzzing.

Add some docs on how to run a fuzzing session.

Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Swapnil Ingle <swapnil.ingle@nutanix.com>
Reviewed-by: Thanos Makatos <thanos.makatos@nutanix.com>

1 files changed, 1 insertions, 25 deletions

diff --git a/lib/private.h b/lib/private.h
index 1d19e6f..4c483f2 100644
--- a/lib/private.h
+++ b/lib/private.h
@@ -65,7 +65,7 @@
  * Outgoing requests are either stored in out.iov.iov_base, or out_iovecs. In
  * the latter case, the iovecs refer to data that should not be freed.
  */
-typedef struct {
+typedef struct vfu_msg {
     /* in/out */
     struct vfio_user_header hdr;
 
@@ -81,30 +81,6 @@ typedef struct {
     size_t nr_out_iovecs;
 } vfu_msg_t;
 
-struct transport_ops {
-    int (*init)(vfu_ctx_t *vfu_ctx);
-
-    int (*get_poll_fd)(vfu_ctx_t *vfu_ctx);
-
-    int (*attach)(vfu_ctx_t *vfu_ctx);
-
-    int (*get_request_header)(vfu_ctx_t *vfu_ctx, struct vfio_user_header *hdr,
-                              int *fds, size_t *nr_fds);
-
-    int (*recv_body)(vfu_ctx_t *vfu_ctx, vfu_msg_t *msg);
-
-    int (*reply)(vfu_ctx_t *vfu_ctx, vfu_msg_t *msg, int err);
-
-    int (*send_msg)(vfu_ctx_t *vfu_ctx, uint16_t msg_id,
-                    enum vfio_user_command cmd,
-                    void *send_data, size_t send_len,
-                    struct vfio_user_header *hdr,
-                    void *recv_data, size_t recv_len);
-
-    void (*detach)(vfu_ctx_t *vfu_ctx);
-    void (*fini)(vfu_ctx_t *vfu_ctx);
-};
-
 typedef struct {
     int         err_efd;    /* eventfd for irq err */
     int         req_efd;    /* eventfd for irq req */