qemu/docs/image-fuzzer.txt

19 Image fuzzer
25 The goal of the image fuzzer is to catch crashes of qemu-io/qemu-img
38 generated test image.
44 The runner uses an external image fuzzer to generate test images. An image
66 Each sublist can have one or two strings defining image structure elements.
79     - $off for an offset in the fuzzed image
83 disk of the generated image.
98 Qcow2 image generator
102 a single public API. See details in 'Test runner/image fuzzer' chapter of
107 'fuzz.py' contains all fuzzing functions, one per image field. It's assumed
115 'layout.py' creates a random valid image, fuzzes a random subset of the image
116 fields by 'fuzz.py' module and writes a fuzzed image to the file specified.
119     1. If a list contains a parent image element only, then some random portion
121     The same behavior is applied for the entire image if no configuration is
134 * Test runner/image fuzzer
136 The runner calls an image generator specifying the path to a test image file,
138 An image generator is expected to provide a
143 method that creates a test image, writes it to the specified file and returns
147 or two elements: first element is a name of a parent image element, second one
155 purpose, so an image generator is not recommended to modify it internally.
164  - image template (generator)
177 3.  Image template should describe a general structure invariant for all
178     test images (image format description)
179 4.  Image template should be autonomous and other fuzzer parts should not
181 5.  Image template should contain reference rules (not only block+size
183 6.  Should generate the test image with the correct structure based on an image
187 9.  The same seed should generate the same image for the same action vector,
194 12. Pool of actions should be defined automatically based on an image template
201 16. All files related to a test result should be collected: a test image,
207 Image formats:
210 Main target image format is qcow2, but support of image templates should
211 provide an ability to add any other image format.
218 it makes the fuzzer itself invariant to an image format and test logic.
220 specified via an action vector. Otherwise, knowledge about an image structure
231 Action vector is a sequence of structure elements retrieved from an image
232 format, each of them will be fuzzed for the test image. It's a subset of
234 Action pool is all available elements of an image structure that generated
235 automatically from an image template.
236 Image template is a formal description of an image structure and relations
237 between image blocks.
238 Test image is an output image of the fuzzer defined by the current seed and