SYS-OSS/FRET-LibAFL
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

remove states from nodes

Browse Source
This commit is contained in:
Alwin Berger 2025-07-23 06:38:16 +00:00
parent f63f8d11ff
commit aaffb3606c
2 changed files with 28 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
fuzzers/FRET/src/fuzzer.rs
View File

@ -123,7 +123,7 @@ macro_rules! do_dump_stg {
let dump_path = $cli.dump_name.clone().unwrap().with_extension(if $c=="" {"dot"} else {$c});
println!("Dumping graph to {:?}", &dump_path);
if let Some(md) = $state.named_metadata_map_mut().get_mut::<STGFeedbackState<FreeRTOSSystem>>("stgfeedbackstate") {
let out = md.graph.map(|_i,x| x.color_print(), |_i,x| x.color_print());
let out = md.graph.map(|_i,x| x.color_print(&md.systemstate_index), |_i,x| x.color_print());
let outs = Dot::with_config(&out, &[]).to_string();
let outs = outs.replace("\\\"","\"");
let outs = outs.replace(';',"\\n");

42
fuzzers/FRET/src/systemstate/stg.rs
View File

@ -61,15 +61,17 @@ where
SYS: TargetSystem,
for<'de2> SYS: Deserialize<'de2>,
{
base: SYS::State,
//base: SYS::State,
state: u64,
abb: AtomicBasicBlock,
_phantom: PhantomData<SYS>
}
impl<SYS> STGNode<SYS>
where SYS: TargetSystem {
pub fn _pretty_print(&self) -> String {
format!("{}\nl{} {:x}-{:x}\n{}", self.base.current_task().task_name(), self.abb.level, self.abb.start, self.abb.ends.iter().next().unwrap_or_else(||&0xFFFF), self.base.print_lists())
pub fn _pretty_print(&self, map: &HashMap<u64, SYS::State>) -> String {
format!("{}\nl{} {:x}-{:x}\n{}", map[&self.state].current_task().task_name(), self.abb.level, self.abb.start, self.abb.ends.iter().next().unwrap_or_else(||&0xFFFF), map[&self.state].print_lists())
}
pub fn color_print(&self) -> String {
pub fn color_print(&self, map: &HashMap<u64, SYS::State>) -> String {
let color = match self.abb.level {
1 => "\", shape=box, style=filled, fillcolor=\"lightblue",
2 => "\", shape=box, style=filled, fillcolor=\"yellow",
@ -79,16 +81,16 @@ where SYS: TargetSystem {
let message = match self.abb.level {
1 => format!("API Call"),
2 => format!("ISR"),
0 => format!("Task: {}",self.base.current_task().task_name()),
0 => format!("Task: {}",map[&self.state].current_task().task_name()),
_ => format!(""),
};
let mut label = format!("{}\nABB: {:x}-{:x}\nHash:{:X}\n{}", message, self.abb.start, self.abb.ends.iter().next().unwrap_or_else(||&0xFFFF), compute_hash(&self.base)>>48, self.base.print_lists());
let mut label = format!("{}\nABB: {:x}-{:x}\nHash:{:X}\n{}", message, self.abb.start, self.abb.ends.iter().next().unwrap_or_else(||&0xFFFF), self.state>>48, map[&self.state].print_lists());
label.push_str(color);
label
}
fn get_hash(&self) -> u64 {
let mut s = DefaultHasher::new();
self.base.hash(&mut s);
self.state.hash(&mut s);
self.abb.hash(&mut s);
s.finish()
}
@ -98,7 +100,7 @@ where
SYS: TargetSystem,
{
fn eq(&self, other: &STGNode<SYS>) -> bool {
self.base==other.base
self.state==other.state
}
}
@ -161,7 +163,7 @@ where
name: Cow<'static, str>,
// aggregated traces as a graph
pub graph: DiGraph<STGNode<SYS>, STGEdge>,
systemstate_index: HashMap<u64, SYS::State>,
pub systemstate_index: HashMap<u64, SYS::State>,
pub state_abb_hash_index: HashMap<(u64, u64), NodeIndex>,
stgnode_index: HashMap<u64, NodeIndex>,
entrypoint: NodeIndex,
@ -185,12 +187,17 @@ where
{
fn default() -> STGFeedbackState<SYS> {
let mut graph = DiGraph::new();
let mut entry_state = SYS::State::default();
let mut exit_state = SYS::State::default();
*(entry_state.current_task_mut().task_name_mut())="Start".to_string();
*(exit_state.current_task_mut().task_name_mut())="End".to_string();
let mut entry : STGNode<SYS> = STGNode::default();
*(entry.base.current_task_mut().task_name_mut())="Start".to_string();
let mut exit : STGNode<SYS> = STGNode::default();
*(exit.base.current_task_mut().task_name_mut())="End".to_string();
entry.state=compute_hash(&entry_state);
exit.state=compute_hash(&exit_state);
let systemstate_index = HashMap::from([(compute_hash(&entry.base), entry.base.clone()), (compute_hash(&exit.base), exit.base.clone())]);
let systemstate_index = HashMap::from([(entry.state, entry_state), (exit.state, exit_state)]);
let h_entry = entry.get_hash();
let h_exit = exit.get_hash();
@ -198,7 +205,7 @@ where
let entrypoint = graph.add_node(entry.clone());
let exitpoint = graph.add_node(exit.clone());
let state_abb_hash_index = HashMap::from([((compute_hash(&entry.base), entry.abb.get_hash()), entrypoint), ((compute_hash(&exit.base), exit.abb.get_hash()), exitpoint)]);
let state_abb_hash_index = HashMap::from([((entry.state, entry.abb.get_hash()), entrypoint), ((exit.state, exit.abb.get_hash()), exitpoint)]);
let index = HashMap::from([(h_entry, entrypoint), (h_exit, exitpoint)]);
@ -502,14 +509,19 @@ where
let mut instance_time = execinterval_to_abb_instances(trace, read_trace);
// add all missing state+abb combinations to the graph
for (_i,interval) in trace.iter().enumerate() { // Iterate intervals
let node : STGNode<SYS> = STGNode {base: table[&interval.start_state].clone(), abb: interval.abb.as_ref().unwrap().clone()};
let start_s = table[&interval.start_state].clone();
let start_h = compute_hash(&start_s);
fbs.systemstate_index.insert(start_h, start_s);
let node : STGNode<SYS> = STGNode {state: start_h, abb: interval.abb.as_ref().unwrap().clone(), _phantom: PhantomData};
let h_node = node.get_hash();
let next_idx = if let Some(idx) = fbs.stgnode_index.get(&h_node) {
// already present
*idx
} else {
// not present
let h = (compute_hash(&node.base), node.abb.get_hash());
let h = (start_h, node.abb.get_hash());
let idx = fbs.graph.add_node(node);
fbs.stgnode_index.insert(h_node, idx);
fbs.state_abb_hash_index.insert(h, idx);