1 /* 2 * fuzzing driver 3 * 4 * Copyright Red Hat Inc., 2019 5 * 6 * Authors: 7 * Alexander Bulekov <alxndr@bu.edu> 8 * 9 * This work is licensed under the terms of the GNU GPL, version 2 or later. 10 * See the COPYING file in the top-level directory. 11 * 12 */ 13 14 #ifndef FUZZER_H_ 15 #define FUZZER_H_ 16 17 #include "qemu/osdep.h" 18 #include "qemu/units.h" 19 #include "qapi/error.h" 20 21 #include "tests/qtest/libqos/libqtest.h" 22 23 /** 24 * A libfuzzer fuzzing target 25 * 26 * The QEMU fuzzing binary is built with all available targets, each 27 * with a unique @name that can be specified on the command-line to 28 * select which target should run. 29 * 30 * A target must implement ->fuzz() to process a random input. If QEMU 31 * crashes in ->fuzz() then libfuzzer will record a failure. 32 * 33 * Fuzzing targets are registered with fuzz_add_target(): 34 * 35 * static const FuzzTarget fuzz_target = { 36 * .name = "my-device-fifo", 37 * .description = "Fuzz the FIFO buffer registers of my-device", 38 * ... 39 * }; 40 * 41 * static void register_fuzz_target(void) 42 * { 43 * fuzz_add_target(&fuzz_target); 44 * } 45 * fuzz_target_init(register_fuzz_target); 46 */ 47 typedef struct FuzzTarget { 48 const char *name; /* target identifier (passed to --fuzz-target=)*/ 49 const char *description; /* help text */ 50 51 52 /* 53 * Returns the arguments that are passed to qemu/softmmu init(). Freed by 54 * the caller. 55 */ 56 GString *(*get_init_cmdline)(struct FuzzTarget *); 57 58 /* 59 * will run once, prior to running qemu/softmmu init. 60 * eg: set up shared-memory for communication with the child-process 61 * Can be NULL 62 */ 63 void(*pre_vm_init)(void); 64 65 /* 66 * will run once, after QEMU has been initialized, prior to the fuzz-loop. 67 * eg: detect the memory map 68 * Can be NULL 69 */ 70 void(*pre_fuzz)(QTestState *); 71 72 /* 73 * accepts and executes an input from libfuzzer. this is repeatedly 74 * executed during the fuzzing loop. Its should handle setup, input 75 * execution and cleanup. 76 * Cannot be NULL 77 */ 78 void(*fuzz)(QTestState *, const unsigned char *, size_t); 79 80 /* 81 * The fuzzer can specify a "Custom Crossover" function for combining two 82 * inputs from the corpus. This function is sometimes called by libfuzzer 83 * when mutating inputs. 84 * 85 * data1: location of first input 86 * size1: length of first input 87 * data1: location of second input 88 * size1: length of second input 89 * out: where to place the resulting, mutated input 90 * max_out_size: the maximum length of the input that can be placed in out 91 * seed: the seed that should be used to make mutations deterministic, when 92 * needed 93 * 94 * See libfuzzer's LLVMFuzzerCustomCrossOver API for more info. 95 * 96 * Can be NULL 97 */ 98 size_t(*crossover)(const uint8_t *data1, size_t size1, 99 const uint8_t *data2, size_t size2, 100 uint8_t *out, size_t max_out_size, 101 unsigned int seed); 102 103 void *opaque; 104 } FuzzTarget; 105 106 void flush_events(QTestState *); 107 void reboot(QTestState *); 108 109 /* Use the QTest ASCII protocol or call address_space API directly?*/ 110 void fuzz_qtest_set_serialize(bool option); 111 112 /* 113 * makes a copy of *target and adds it to the target-list. 114 * i.e. fine to set up target on the caller's stack 115 */ 116 void fuzz_add_target(const FuzzTarget *target); 117 118 size_t LLVMFuzzerCustomCrossOver(const uint8_t *data1, size_t size1, 119 const uint8_t *data2, size_t size2, 120 uint8_t *out, size_t max_out_size, 121 unsigned int seed); 122 int LLVMFuzzerTestOneInput(const unsigned char *Data, size_t Size); 123 int LLVMFuzzerInitialize(int *argc, char ***argv, char ***envp); 124 125 #endif 126 127