qemu/docs/image-fuzzer.txt

23 -----------
25 The goal of the image fuzzer is to catch crashes of qemu-io/qemu-img
32 -----------
40 keyboard interruption. But if a test seed is specified via the '--seed' runner
41 parameter, then only one test with this seed will be executed, after its finish
54 Paths to binaries under test (SUTs) ``qemu-img`` and ``qemu-io`` are retrieved
57 ``qemu-img`` is required for creation of backing files, so it's mandatory to set
59 For details about environment variables see qemu-iotests/check.
62 '--config' argument, e.g.
71 the '--command' argument. Each command is a list containing a SUT and all its
74        runner.py -c '[["qemu-io", "$test_img", "-c", "write $off $len"]]'
78     - $test_img for a fuzzed img
79     - $off for an offset in the fuzzed image
80     - $len for a data size
86     - qemu-img check
87     - qemu-img info
88     - qemu-img convert
89     - qemu-io -c read
90     - qemu-io -c write
91     - qemu-io -c aio_read
92     - qemu-io -c aio_write
93     - qemu-io -c flush
94     - qemu-io -c discard
95     - qemu-io -c truncate
99 ---------------------
111 of bits are set to ones. All fuzzed values are checked on non-equality to the
132 -----------------
154 Random seed is set by the runner at every test execution for the regression
162 ----------
164  - image template (generator)
165  - work directory
166  - action vector (optional)
167  - seed (optional)
168  - SUT and its arguments (optional)
172 -------------------
185 7.  Should accept a seed as an argument (for regression purpose)
186 8.  Should generate a seed if it is not specified as an input parameter.
187 9.  The same seed should generate the same image for the same action vector,
200 15. Seed should be logged (for regression purpose)
203 17. Should be compatible with python version 2.4-2.7
208 -------------
215 -------------
217 The fuzzer can be controlled via template, seed and action vector;
224 functionality can be varied from simple model-independent fuzzing to smart
225 model-based one.
229 --------
238 Test image is an output image of the fuzzer defined by the current seed and