diff options
author | Alexander Bulekov <alxndr@bu.edu> | 2021-01-17 18:09:23 -0500 |
---|---|---|
committer | Paolo Bonzini <pbonzini@redhat.com> | 2021-02-08 14:43:54 +0100 |
commit | 3ca45fb4d26ba92e55f1dda651829fe46ab8f863 (patch) | |
tree | a9b37a5788126edf8d6c4ca0db080aa92c0be269 /docs | |
parent | 8630b43f115d9736cbe9782f453a300ac3ba5af5 (diff) | |
download | qemu-3ca45fb4d26ba92e55f1dda651829fe46ab8f863.zip qemu-3ca45fb4d26ba92e55f1dda651829fe46ab8f863.tar.gz qemu-3ca45fb4d26ba92e55f1dda651829fe46ab8f863.tar.bz2 |
docs/fuzz: add some information about OSS-Fuzz
Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
Message-Id: <20210117230924.449676-3-alxndr@bu.edu>
Diffstat (limited to 'docs')
-rw-r--r-- | docs/devel/fuzzing.rst | 30 |
1 files changed, 30 insertions, 0 deletions
diff --git a/docs/devel/fuzzing.rst b/docs/devel/fuzzing.rst index 5f5200c..97797c4 100644 --- a/docs/devel/fuzzing.rst +++ b/docs/devel/fuzzing.rst @@ -180,6 +180,36 @@ To ensure that these env variables have been configured correctly, we can use:: The output should contain a complete list of matched MemoryRegions. +OSS-Fuzz +-------- +QEMU is continuously fuzzed on `OSS-Fuzz` __(https://github.com/google/oss-fuzz). +By default, the OSS-Fuzz build will try to fuzz every fuzz-target. Since the +generic-fuzz target requires additional information provided in environment +variables, we pre-define some generic-fuzz configs in +``tests/qtest/fuzz/generic_fuzz_configs.h``. Each config must specify: + +- ``.name``: To identify the fuzzer config + +- ``.args`` OR ``.argfunc``: A string or pointer to a function returning a + string. These strings are used to specify the ``QEMU_FUZZ_ARGS`` + environment variable. ``argfunc`` is useful when the config relies on e.g. + a dynamically created temp directory, or a free tcp/udp port. + +- ``.objects``: A string that specifies the ``QEMU_FUZZ_OBJECTS`` environment + variable. + +To fuzz additional devices/device configuration on OSS-Fuzz, send patches for +either a new device-specific fuzzer or a new generic-fuzz config. + +Build details: + +- The Dockerfile that sets up the environment for building QEMU's + fuzzers on OSS-Fuzz can be fund in the OSS-Fuzz repository + __(https://github.com/google/oss-fuzz/blob/master/projects/qemu/Dockerfile) + +- The script responsible for building the fuzzers can be found in the + QEMU source tree at ``scripts/oss-fuzz/build.sh`` + Implementation Details / Fuzzer Lifecycle ----------------------------------------- |