da9bf53198
This is a generic fuzzer designed to fuzz a virtual device's MemoryRegions, as long as they exist within the Memory or Port IO (if it exists) AddressSpaces. The fuzzer's input is interpreted into a sequence of qtest commands (outb, readw, etc). The interpreted commands are separated by a magic seaparator, which should be easy for the fuzzer to guess. Without ASan, the separator can be specified as a "dictionary value" using the -dict argument (see libFuzzer documentation). Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20201023150746.107063-3-alxndr@bu.edu> Signed-off-by: Thomas Huth <thuth@redhat.com>
34 lines
1.3 KiB
Meson
34 lines
1.3 KiB
Meson
specific_fuzz_ss.add(files('fuzz.c', 'fork_fuzz.c', 'qos_fuzz.c',
|
|
'qtest_wrappers.c'), qos)
|
|
|
|
# Targets
|
|
specific_fuzz_ss.add(when: 'CONFIG_I440FX', if_true: files('i440fx_fuzz.c'))
|
|
specific_fuzz_ss.add(when: 'CONFIG_VIRTIO_NET', if_true: files('virtio_net_fuzz.c'))
|
|
specific_fuzz_ss.add(when: 'CONFIG_VIRTIO_SCSI', if_true: files('virtio_scsi_fuzz.c'))
|
|
specific_fuzz_ss.add(files('generic_fuzz.c'))
|
|
|
|
fork_fuzz = declare_dependency(
|
|
link_args: config_host['FUZZ_EXE_LDFLAGS'].split() +
|
|
['-Wl,-wrap,qtest_inb',
|
|
'-Wl,-wrap,qtest_inw',
|
|
'-Wl,-wrap,qtest_inl',
|
|
'-Wl,-wrap,qtest_outb',
|
|
'-Wl,-wrap,qtest_outw',
|
|
'-Wl,-wrap,qtest_outl',
|
|
'-Wl,-wrap,qtest_readb',
|
|
'-Wl,-wrap,qtest_readw',
|
|
'-Wl,-wrap,qtest_readl',
|
|
'-Wl,-wrap,qtest_readq',
|
|
'-Wl,-wrap,qtest_writeb',
|
|
'-Wl,-wrap,qtest_writew',
|
|
'-Wl,-wrap,qtest_writel',
|
|
'-Wl,-wrap,qtest_writeq',
|
|
'-Wl,-wrap,qtest_memread',
|
|
'-Wl,-wrap,qtest_bufread',
|
|
'-Wl,-wrap,qtest_memwrite',
|
|
'-Wl,-wrap,qtest_bufwrite',
|
|
'-Wl,-wrap,qtest_memset']
|
|
)
|
|
|
|
specific_fuzz_ss.add(fork_fuzz)
|