LXR qemu/tests/qtest/fuzz/fuzz.h

   1/*
   2 * fuzzing driver
   3 *
   4 * Copyright Red Hat Inc., 2019
   5 *
   6 * Authors:
   7 *  Alexander Bulekov   <alxndr@bu.edu>
   8 *
   9 * This work is licensed under the terms of the GNU GPL, version 2 or later.
  10 * See the COPYING file in the top-level directory.
  11 *
  12 */
  13
  14#ifndef FUZZER_H_
  15#define FUZZER_H_
  16
  17#include "qemu/units.h"
  18#include "qapi/error.h"
  19
  20#include "tests/qtest/libqos/libqtest.h"
  21
  22/**
  23 * A libfuzzer fuzzing target
  24 *
  25 * The QEMU fuzzing binary is built with all available targets, each
  26 * with a unique @name that can be specified on the command-line to
  27 * select which target should run.
  28 *
  29 * A target must implement ->fuzz() to process a random input.  If QEMU
  30 * crashes in ->fuzz() then libfuzzer will record a failure.
  31 *
  32 * Fuzzing targets are registered with fuzz_add_target():
  33 *
  34 *   static const FuzzTarget fuzz_target = {
  35 *       .name = "my-device-fifo",
  36 *       .description = "Fuzz the FIFO buffer registers of my-device",
  37 *       ...
  38 *   };
  39 *
  40 *   static void register_fuzz_target(void)
  41 *   {
  42 *       fuzz_add_target(&fuzz_target);
  43 *   }
  44 *   fuzz_target_init(register_fuzz_target);
  45 */
  46typedef struct FuzzTarget {
  47    const char *name;         /* target identifier (passed to --fuzz-target=)*/
  48    const char *description;  /* help text */
  49
  50
  51    /*
  52     * Returns the arguments that are passed to qemu/softmmu init(). Freed by
  53     * the caller.
  54     */
  55    GString *(*get_init_cmdline)(struct FuzzTarget *);
  56
  57    /*
  58     * will run once, prior to running qemu/softmmu init.
  59     * eg: set up shared-memory for communication with the child-process
  60     * Can be NULL
  61     */
  62    void(*pre_vm_init)(void);
  63
  64    /*
  65     * will run once, after QEMU has been initialized, prior to the fuzz-loop.
  66     * eg: detect the memory map
  67     * Can be NULL
  68     */
  69    void(*pre_fuzz)(QTestState *);
  70
  71    /*
  72     * accepts and executes an input from libfuzzer. this is repeatedly
  73     * executed during the fuzzing loop. Its should handle setup, input
  74     * execution and cleanup.
  75     * Cannot be NULL
  76     */
  77    void(*fuzz)(QTestState *, const unsigned char *, size_t);
  78
  79    /*
  80     * The fuzzer can specify a "Custom Crossover" function for combining two
  81     * inputs from the corpus. This function is sometimes called by libfuzzer
  82     * when mutating inputs.
  83     *
  84     * data1: location of first input
  85     * size1: length of first input
  86     * data1: location of second input
  87     * size1: length of second input
  88     * out: where to place the resulting, mutated input
  89     * max_out_size: the maximum length of the input that can be placed in out
  90     * seed: the seed that should be used to make mutations deterministic, when
  91     *       needed
  92     *
  93     * See libfuzzer's LLVMFuzzerCustomCrossOver API for more info.
  94     *
  95     * Can be NULL
  96     */
  97    size_t(*crossover)(const uint8_t *data1, size_t size1,
  98                       const uint8_t *data2, size_t size2,
  99                       uint8_t *out, size_t max_out_size,
 100                       unsigned int seed);
 101
 102    void *opaque;
 103} FuzzTarget;
 104
 105void flush_events(QTestState *);
 106void reboot(QTestState *);
 107
 108/* Use the QTest ASCII protocol or call address_space API directly?*/
 109void fuzz_qtest_set_serialize(bool option);
 110
 111/*
 112 * makes a copy of *target and adds it to the target-list.
 113 * i.e. fine to set up target on the caller's stack
 114 */
 115void fuzz_add_target(const FuzzTarget *target);
 116
 117size_t LLVMFuzzerCustomCrossOver(const uint8_t *data1, size_t size1,
 118                                 const uint8_t *data2, size_t size2,
 119                                 uint8_t *out, size_t max_out_size,
 120                                 unsigned int seed);
 121int LLVMFuzzerTestOneInput(const unsigned char *Data, size_t Size);
 122int LLVMFuzzerInitialize(int *argc, char ***argv, char ***envp);
 123
 124#endif
 125
 126