diff options
| author | Alexander Bulekov <alxndr@bu.edu> | 2023-02-04 23:29:51 -0500 |
|---|---|---|
| committer | Alexander Bulekov <alxndr@bu.edu> | 2023-02-16 23:02:46 -0500 |
| commit | 7d9e5f18a94792ed875a1caed2bfcd1e68a49481 (patch) | |
| tree | a2d40aeb07c637ff96a8eee1cf91f0bb0fa09101 /docs | |
| parent | d2e6f9272d337d1b23b588e7ead8500d40cbf4e9 (diff) | |
| download | qemu-7d9e5f18a94792ed875a1caed2bfcd1e68a49481.zip qemu-7d9e5f18a94792ed875a1caed2bfcd1e68a49481.tar.gz qemu-7d9e5f18a94792ed875a1caed2bfcd1e68a49481.tar.bz2 | |
docs/fuzz: remove mentions of fork-based fuzzing
Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/devel/fuzzing.rst | 22 |
1 files changed, 2 insertions, 20 deletions
diff --git a/docs/devel/fuzzing.rst b/docs/devel/fuzzing.rst index 715330c..3bfcb33 100644 --- a/docs/devel/fuzzing.rst +++ b/docs/devel/fuzzing.rst @@ -19,11 +19,6 @@ responsibility to ensure that state is reset between fuzzing-runs. Building the fuzzers -------------------- -*NOTE*: If possible, build a 32-bit binary. When forking, the 32-bit fuzzer is -much faster, since the page-map has a smaller size. This is due to the fact that -AddressSanitizer maps ~20TB of memory, as part of its detection. This results -in a large page-map, and a much slower ``fork()``. - To build the fuzzers, install a recent version of clang: Configure with (substitute the clang binaries with the version you installed). Here, enable-sanitizers, is optional but it allows us to reliably detect bugs @@ -296,10 +291,9 @@ input. It is also responsible for manually calling ``main_loop_wait`` to ensure that bottom halves are executed and any cleanup required before the next input. Since the same process is reused for many fuzzing runs, QEMU state needs to -be reset at the end of each run. There are currently two implemented -options for resetting state: +be reset at the end of each run. For example, this can be done by rebooting the +VM, after each run. -- Reboot the guest between runs. - *Pros*: Straightforward and fast for simple fuzz targets. - *Cons*: Depending on the device, does not reset all device state. If the @@ -308,15 +302,3 @@ options for resetting state: reboot. - *Example target*: ``i440fx-qtest-reboot-fuzz`` - -- Run each test case in a separate forked process and copy the coverage - information back to the parent. This is fairly similar to AFL's "deferred" - fork-server mode [3] - - - *Pros*: Relatively fast. Devices only need to be initialized once. No need to - do slow reboots or vmloads. - - - *Cons*: Not officially supported by libfuzzer. Does not work well for - devices that rely on dedicated threads. - - - *Example target*: ``virtio-net-fork-fuzz`` |