scripts/oss-fuzz/reorder_fuzzer_qtest_trace.py

2 # -*- coding: utf-8 -*-
6 trace that you can feed into a standard qemu-system process. Example usage:
8 QEMU_FUZZ_ARGS="-machine q35,accel=qtest" QEMU_FUZZ_OBJECTS="*" \
9         ./i386-softmmu/qemu-fuzz-i386 --fuzz-target=generic-pci-fuzz
12 QEMU_FUZZ_ARGS="-machine q35,accel=qtest" QEMU_FUZZ_OBJECTS="*" \
13         ./i386-softmmu/qemu-fuzz-i386 --fuzz-target=generic-pci-fuzz
15 scripts/oss-fuzz/reorder_fuzzer_qtest_trace.py qtest_log_output > qtest_trace
16 ./i386-softmmu/qemu-fuzz-i386 -machine q35,accel=qtest \
17         -qtest stdio < qtest_trace
21 Some fuzzer make use of hooks that allow us to populate some memory range, just
22 before a DMA read from that range. This means that the fuzzer can produce
52 reordered trace via -qtest stdio to reproduce the input
60 The fuzzer will annotate suspected double-fetches with [DOUBLE-FETCH]. This
87     for i in range(len(trace)):
90                 if "[DOUBLE-FETCH]" in trace[i+1]:
91                     sys.stderr.write("Warning: Likely double fetch on line"
97         print(line.split("]")[-1].strip())