[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH v10 22/22] fuzz: add documentation to docs/devel/
[PATCH v10 22/22] fuzz: add documentation to docs/devel/
Wed, 19 Feb 2020 23:11:18 -0500
Signed-off-by: Alexander Bulekov <address@hidden>
Reviewed-by: Stefan Hajnoczi <address@hidden>
Reviewed-by: Darren Kenny <address@hidden>
docs/devel/fuzzing.txt | 116 +++++++++++++++++++++++++++++++++++++++++
1 file changed, 116 insertions(+)
create mode 100644 docs/devel/fuzzing.txt
diff --git a/docs/devel/fuzzing.txt b/docs/devel/fuzzing.txt
new file mode 100644
@@ -0,0 +1,116 @@
+= Fuzzing =
+== Introduction ==
+This document describes the virtual-device fuzzing infrastructure in QEMU and
+how to use it to implement additional fuzzers.
+== Basics ==
+Fuzzing operates by passing inputs to an entry point/target function. The
+fuzzer tracks the code coverage triggered by the input. Based on these
+findings, the fuzzer mutates the input and repeats the fuzzing.
+To fuzz QEMU, we rely on libfuzzer. Unlike other fuzzers such as AFL, libfuzzer
+is an _in-process_ fuzzer. For the developer, this means that it is their
+responsibility to ensure that state is reset between fuzzing-runs.
+== Building the fuzzers ==
+NOTE: If possible, build a 32-bit binary. When forking, the 32-bit fuzzer is
+much faster, since the page-map has a smaller size. This is due to the fact
+AddressSanitizer mmaps ~20TB of memory, as part of its detection. This results
+in a large page-map, and a much slower fork().
+To build the fuzzers, install a recent version of clang:
+Configure with (substitute the clang binaries with the version you installed):
+ CC=clang-8 CXX=clang++-8 /path/to/configure --enable-fuzzing
+Fuzz targets are built similarly to system/softmmu:
+ make i386-softmmu/fuzz
+This builds ./i386-softmmu/qemu-fuzz-i386
+The first option to this command is: --fuzz_taget=FUZZ_NAME
+To list all of the available fuzzers run qemu-fuzz-i386 with no arguments.
+ ./i386-softmmu/qemu-fuzz-i386 --fuzz-target=virtio-net-fork-fuzz
+Internally, libfuzzer parses all arguments that do not begin with "--".
+Information about these is available by passing -help=1
+Now the only thing left to do is wait for the fuzzer to trigger potential
+== Adding a new fuzzer ==
+Coverage over virtual devices can be improved by adding additional fuzzers.
+Fuzzers are kept in tests/qtest/fuzz/ and should be added to
+Fuzzers can rely on both qtest and libqos to communicate with virtual devices.
+1. Create a new source file. For example
+2. Write the fuzzing code using the libqtest/libqos API. See existing fuzzers
+3. Register the fuzzer in ``tests/fuzz/Makefile.include`` by appending the
+corresponding object to fuzz-obj-y
+Fuzzers can be more-or-less thought of as special qtest programs which can
+modify the qtest commands and/or qtest command arguments based on inputs
+provided by libfuzzer. Libfuzzer passes a byte array and length. Commonly the
+fuzzer loops over the byte-array interpreting it as a list of qtest commands,
+addresses, or values.
+= Implementation Details =
+== The Fuzzer's Lifecycle ==
+The fuzzer has two entrypoints that libfuzzer calls. libfuzzer provides it's
+own main(), which performs some setup, and calls the entrypoints:
+LLVMFuzzerInitialize: called prior to fuzzing. Used to initialize all of the
+LLVMFuzzerTestOneInput: called for each fuzzing run. Processes the input and
+resets the state at the end of each run.
+In more detail:
+LLVMFuzzerInitialize parses the arguments to the fuzzer (must start with two
+dashes, so they are ignored by libfuzzer main()). Currently, the arguments
+select the fuzz target. Then, the qtest client is initialized. If the target
+requires qos, qgraph is set up and the QOM/LIBQOS modules are initialized.
+Then the QGraph is walked and the QEMU cmd_line is determined and saved.
+After this, the vl.c:qemu__main is called to set up the guest. There are
+target-specific hooks that can be called before and after qemu_main, for
+additional setup(e.g. PCI setup, or VM snapshotting).
+LLVMFuzzerTestOneInput: Uses qtest/qos functions to act based on the fuzz
+input. It is also responsible for manually calling the main loop/main_loop_wait
+to ensure that bottom halves are executed and any cleanup required before the
+Since the same process is reused for many fuzzing runs, QEMU state needs to
+be reset at the end of each run. There are currently two implemented
+options for resetting state:
+1. Reboot the guest between runs.
+ Pros: Straightforward and fast for simple fuzz targets.
+ Cons: Depending on the device, does not reset all device state. If the
+ device requires some initialization prior to being ready for fuzzing
+ (common for QOS-based targets), this initialization needs to be done after
+ each reboot.
+ Example target: i440fx-qtest-reboot-fuzz
+2. Run each test case in a separate forked process and copy the coverage
+ information back to the parent. This is fairly similar to AFL's "deferred"
+ fork-server mode 
+ Pros: Relatively fast. Devices only need to be initialized once. No need
+ to do slow reboots or vmloads.
+ Cons: Not officially supported by libfuzzer. Does not work well for devices
+ that rely on dedicated threads.
+ Example target: virtio-net-fork-fuzz
- [PATCH v10 18/22] fuzz: add configure flag --enable-fuzzing, (continued)
- [PATCH v10 18/22] fuzz: add configure flag --enable-fuzzing, Alexander Bulekov, 2020/02/19
- [PATCH v10 16/22] fuzz: add support for qos-assisted fuzz targets, Alexander Bulekov, 2020/02/19
- [PATCH v10 17/22] fuzz: add target/fuzz makefile rules, Alexander Bulekov, 2020/02/19
- [PATCH v10 19/22] fuzz: add i440fx fuzz targets, Alexander Bulekov, 2020/02/19
- [PATCH v10 20/22] fuzz: add virtio-net fuzz target, Alexander Bulekov, 2020/02/19
- [PATCH v10 21/22] fuzz: add virtio-scsi fuzz target, Alexander Bulekov, 2020/02/19
- [PATCH v10 22/22] fuzz: add documentation to docs/devel/,
Alexander Bulekov <=
- Re: [PATCH v10 00/22] Add virtual device fuzzing support, Stefan Hajnoczi, 2020/02/21