diff options
| author | Alexander Bulekov <alxndr@bu.edu> | 2020-07-06 15:55:34 -0400 |
|---|---|---|
| committer | Thomas Huth <thuth@redhat.com> | 2020-07-21 07:29:18 +0200 |
| commit | 09a14f586c315b01411dc1ef1bfe99b034b302de (patch) | |
| tree | a6ce661f92ad7ef18857dd01bd7f1d7b383432a9 /docs | |
| parent | 19a91e4af86c578420e9fdfe2efdc3b3b3826222 (diff) | |
| download | qemu-09a14f586c315b01411dc1ef1bfe99b034b302de.zip qemu-09a14f586c315b01411dc1ef1bfe99b034b302de.tar.gz qemu-09a14f586c315b01411dc1ef1bfe99b034b302de.tar.bz2 | |
docs/fuzz: add instructions for generating a coverage report
Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
Message-Id: <20200706195534.14962-5-alxndr@bu.edu>
[thuth: Replaced --enable-sanitizers with --enable-fuzzing]
Signed-off-by: Thomas Huth <thuth@redhat.com>
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/devel/fuzzing.txt | 19 |
1 files changed, 19 insertions, 0 deletions
diff --git a/docs/devel/fuzzing.txt b/docs/devel/fuzzing.txt index 6d18115..96d71c9 100644 --- a/docs/devel/fuzzing.txt +++ b/docs/devel/fuzzing.txt @@ -85,6 +85,25 @@ better coverage performance, depending on the target. Note that libFuzzer's exact behavior will depend on the version of clang and libFuzzer used to build the device fuzzers. +== Generating Coverage Reports == +Code coverage is a crucial metric for evaluating a fuzzer's performance. +libFuzzer's output provides a "cov: " column that provides a total number of +unique blocks/edges covered. To examine coverage on a line-by-line basis we +can use Clang coverage: + + 1. Configure libFuzzer to store a corpus of all interesting inputs (see + CORPUS_DIR above) + 2. ./configure the QEMU build with: + --enable-fuzzing \ + --extra-cflags="-fprofile-instr-generate -fcoverage-mapping" + 3. Re-run the fuzzer. Specify $CORPUS_DIR/* as an argument, telling libfuzzer + to execute all of the inputs in $CORPUS_DIR and exit. Once the process + exits, you should find a file, "default.profraw" in the working directory. + 4. Execute these commands to generate a detailed HTML coverage-report: + llvm-profdata merge -output=default.profdata default.profraw + llvm-cov show ./path/to/qemu-fuzz-i386 -instr-profile=default.profdata \ + --format html -output-dir=/path/to/output/report + == Adding a new fuzzer == Coverage over virtual devices can be improved by adding additional fuzzers. Fuzzers are kept in tests/qtest/fuzz/ and should be added to |