[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 06/36] docs/fuzz: add some information about OSS-Fuzz
From: |
Paolo Bonzini |
Subject: |
[PULL 06/36] docs/fuzz: add some information about OSS-Fuzz |
Date: |
Fri, 29 Jan 2021 12:17:44 +0100 |
From: Alexander Bulekov <alxndr@bu.edu>
Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
Message-Id: <20210117230924.449676-3-alxndr@bu.edu>
---
docs/devel/fuzzing.rst | 30 ++++++++++++++++++++++++++++++
1 file changed, 30 insertions(+)
diff --git a/docs/devel/fuzzing.rst b/docs/devel/fuzzing.rst
index 5f5200c843..97797c4f8c 100644
--- a/docs/devel/fuzzing.rst
+++ b/docs/devel/fuzzing.rst
@@ -180,6 +180,36 @@ To ensure that these env variables have been configured
correctly, we can use::
The output should contain a complete list of matched MemoryRegions.
+OSS-Fuzz
+--------
+QEMU is continuously fuzzed on `OSS-Fuzz`
__(https://github.com/google/oss-fuzz).
+By default, the OSS-Fuzz build will try to fuzz every fuzz-target. Since the
+generic-fuzz target requires additional information provided in environment
+variables, we pre-define some generic-fuzz configs in
+``tests/qtest/fuzz/generic_fuzz_configs.h``. Each config must specify:
+
+- ``.name``: To identify the fuzzer config
+
+- ``.args`` OR ``.argfunc``: A string or pointer to a function returning a
+ string. These strings are used to specify the ``QEMU_FUZZ_ARGS``
+ environment variable. ``argfunc`` is useful when the config relies on e.g.
+ a dynamically created temp directory, or a free tcp/udp port.
+
+- ``.objects``: A string that specifies the ``QEMU_FUZZ_OBJECTS`` environment
+ variable.
+
+To fuzz additional devices/device configuration on OSS-Fuzz, send patches for
+either a new device-specific fuzzer or a new generic-fuzz config.
+
+Build details:
+
+- The Dockerfile that sets up the environment for building QEMU's
+ fuzzers on OSS-Fuzz can be fund in the OSS-Fuzz repository
+ __(https://github.com/google/oss-fuzz/blob/master/projects/qemu/Dockerfile)
+
+- The script responsible for building the fuzzers can be found in the
+ QEMU source tree at ``scripts/oss-fuzz/build.sh``
+
Implementation Details / Fuzzer Lifecycle
-----------------------------------------
--
2.29.2
- [PULL 00/36] Misc patches (buildsys, i386, fuzzing) for 2021-01-29, Paolo Bonzini, 2021/01/29
- [PULL 01/36] fuzz: ignore address_space_map is_write flag, Paolo Bonzini, 2021/01/29
- [PULL 02/36] fuzz: refine the ide/ahci fuzzer configs, Paolo Bonzini, 2021/01/29
- [PULL 04/36] fuzz: log the arguments used to initialize QEMU, Paolo Bonzini, 2021/01/29
- [PULL 05/36] fuzz: enable dynamic args for generic-fuzz configs, Paolo Bonzini, 2021/01/29
- [PULL 08/36] target/i386: do not set LM for 32-bit emulation "-cpu host/max", Paolo Bonzini, 2021/01/29
- [PULL 09/36] machine: add missing doc for memory-backend option, Paolo Bonzini, 2021/01/29
- [PULL 03/36] docs/fuzz: fix pre-meson path, Paolo Bonzini, 2021/01/29
- [PULL 06/36] docs/fuzz: add some information about OSS-Fuzz,
Paolo Bonzini <=
- [PULL 07/36] fuzz: add virtio-9p configurations for fuzzing, Paolo Bonzini, 2021/01/29
- [PULL 10/36] meson: accept either shared or static libraries if --disable-static, Paolo Bonzini, 2021/01/29
- [PULL 12/36] x86/cpu: Populate SVM CPUID feature bits, Paolo Bonzini, 2021/01/29
- [PULL 16/36] event_notifier: handle initialization failure better, Paolo Bonzini, 2021/01/29
- [PULL 14/36] docs: don't install corresponding man page if guest agent is disabled, Paolo Bonzini, 2021/01/29
- [PULL 11/36] meson: honor --enable-rbd if cc.links test fails, Paolo Bonzini, 2021/01/29
- [PULL 17/36] target/i386: Fix decoding of certain BMI instructions, Paolo Bonzini, 2021/01/29
- [PULL 13/36] fuzz: fix wrong index in clear_bits, Paolo Bonzini, 2021/01/29
- [PULL 18/36] target/i86: implement PKS, Paolo Bonzini, 2021/01/29
- [PULL 15/36] virtio-scsi: don't uninitialize queues that we didn't initialize, Paolo Bonzini, 2021/01/29