SYS-OSS/FRET-LibAFL
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix jobs with response==release

Browse Source
This commit is contained in:
Alwin Berger 2024-08-26 15:14:10 +02:00
parent f14d486ccf
commit c785e0db86
2 changed files with 45 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

49
fuzzers/FRET/benchmark/target_symbols.csv
View File

@ -1,20 +1,20 @@
kernel,main_function,input_symbol,input_size,return_function,target_task_name
mpeg2,mpeg2_main,mpeg2_oldorgframe,90112,mpeg2_return,
audiobeam,audiobeam_main,audiobeam_input,11520,audiobeam_return,
epic,epic_main,epic_image,4096,epic_return,
dijkstra,dijkstra_main,dijkstra_AdjMatrix,10000,dijkstra_return,
fft,fft_main,fft_twidtable,2046,fft_return,
bsort,bsort_main,bsort_Array,400,bsort_return,
insertsort,insertsort_main,insertsort_a,400,insertsort_return,
g723_enc,g723_enc_main,g723_enc_INPUT,1024,g723_enc_return,
rijndael_dec,rijndael_dec_main,rijndael_dec_data,32768,rijndael_dec_return,
rijndael_enc,rijndael_enc_main,rijndael_enc_data,31369,rijndael_enc_return,
huff_dec,huff_dec_main,huff_dec_encoded,419,huff_dec_return,
huff_enc,huff_enc_main,huff_enc_plaintext,600,huff_enc_return,
gsm_enc,gsm_enc_main,gsm_enc_pcmdata,6400,gsm_enc_return,
tmr,main,FUZZ_INPUT,32,trigger_Qemu_break,
tacle_rtos,prvStage0,FUZZ_INPUT,604,trigger_Qemu_break,
lift,main_lift,FUZZ_INPUT,100,trigger_Qemu_break,
kernel,main_function,input_symbol,input_size,return_function,select_task
mpeg2,mpeg2_main,mpeg2_oldorgframe,90112,mpeg2_return,NONE
audiobeam,audiobeam_main,audiobeam_input,11520,audiobeam_return,NONE
epic,epic_main,epic_image,4096,epic_return,NONE
dijkstra,dijkstra_main,dijkstra_AdjMatrix,10000,dijkstra_return,NONE
fft,fft_main,fft_twidtable,2046,fft_return,NONE
bsort,bsort_main,bsort_Array,400,bsort_return,NONE
insertsort,insertsort_main,insertsort_a,400,insertsort_return,NONE
g723_enc,g723_enc_main,g723_enc_INPUT,1024,g723_enc_return,NONE
rijndael_dec,rijndael_dec_main,rijndael_dec_data,32768,rijndael_dec_return,NONE
rijndael_enc,rijndael_enc_main,rijndael_enc_data,31369,rijndael_enc_return,NONE
huff_dec,huff_dec_main,huff_dec_encoded,419,huff_dec_return,NONE
huff_enc,huff_enc_main,huff_enc_plaintext,600,huff_enc_return,NONE
gsm_enc,gsm_enc_main,gsm_enc_pcmdata,6400,gsm_enc_return,NONE
tmr,main,FUZZ_INPUT,32,trigger_Qemu_break,NONE
tacle_rtos,prvStage0,FUZZ_INPUT,604,trigger_Qemu_break,NONE
lift,main_lift,FUZZ_INPUT,100,trigger_Qemu_break,NONE
waters,main_waters,FUZZ_INPUT,4096,trigger_Qemu_break,1129
watersv2,main_waters,FUZZ_INPUT,4096,trigger_Qemu_break,1129
waterspart,main_waters,FUZZ_INPUT,4096,trigger_Qemu_break,1129
@ -23,11 +23,10 @@ waters_int,main_waters,FUZZ_INPUT,4096,trigger_Qemu_break,1129
watersv2_int,main_waters,FUZZ_INPUT,4096,trigger_Qemu_break,1129
waterspart_int,main_waters,FUZZ_INPUT,4096,trigger_Qemu_break,1129
waterspartv2_int,main_waters,FUZZ_INPUT,4096,trigger_Qemu_break,1129
micro_branchless,main_branchless,FUZZ_INPUT,4,trigger_Qemu_break,
micro_int,main_int,FUZZ_INPUT,16,trigger_Qemu_break,
micro_longint,main_micro_longint,FUZZ_INPUT,16,trigger_Qemu_break,
minimal,main_minimal,FUZZ_INPUT,4096,trigger_Qemu_break,
gen3,main_minimal,FUZZ_INPUT,4096,trigger_Qemu_break,
interact,main_interact,FUZZ_INPUT,4096,trigger_Qemu_break,
interact_int,main_interact,FUZZ_INPUT,4096,trigger_Qemu_break,
micro_branchless,main_branchless,FUZZ_INPUT,4,trigger_Qemu_break,NONE
micro_int,main_int,FUZZ_INPUT,16,trigger_Qemu_break,NONE
micro_longint,main_micro_longint,FUZZ_INPUT,16,trigger_Qemu_break,NONE
minimal,main_minimal,FUZZ_INPUT,4096,trigger_Qemu_break,NONE
gen3,main_minimal,FUZZ_INPUT,4096,trigger_Qemu_break,NONE
interact,main_interact,FUZZ_INPUT,4096,trigger_Qemu_break,NONE
interact_int,main_interact,FUZZ_INPUT,4096,trigger_Qemu_break,NONE

1 kernel main_function input_symbol input_size return_function target_task_name select_task
2 mpeg2 mpeg2_main mpeg2_oldorgframe 90112 mpeg2_return NONE
3 audiobeam audiobeam_main audiobeam_input 11520 audiobeam_return NONE
4 epic epic_main epic_image 4096 epic_return NONE
5 dijkstra dijkstra_main dijkstra_AdjMatrix 10000 dijkstra_return NONE
6 fft fft_main fft_twidtable 2046 fft_return NONE
7 bsort bsort_main bsort_Array 400 bsort_return NONE
8 insertsort insertsort_main insertsort_a 400 insertsort_return NONE
9 g723_enc g723_enc_main g723_enc_INPUT 1024 g723_enc_return NONE
10 rijndael_dec rijndael_dec_main rijndael_dec_data 32768 rijndael_dec_return NONE
11 rijndael_enc rijndael_enc_main rijndael_enc_data 31369 rijndael_enc_return NONE
12 huff_dec huff_dec_main huff_dec_encoded 419 huff_dec_return NONE
13 huff_enc huff_enc_main huff_enc_plaintext 600 huff_enc_return NONE
14 gsm_enc gsm_enc_main gsm_enc_pcmdata 6400 gsm_enc_return NONE
15 tmr main FUZZ_INPUT 32 trigger_Qemu_break NONE
16 tacle_rtos prvStage0 FUZZ_INPUT 604 trigger_Qemu_break NONE
17 lift main_lift FUZZ_INPUT 100 trigger_Qemu_break NONE
18 waters main_waters FUZZ_INPUT 4096 trigger_Qemu_break 1129 1129
19 watersv2 main_waters FUZZ_INPUT 4096 trigger_Qemu_break 1129 1129
20 waterspart main_waters FUZZ_INPUT 4096 trigger_Qemu_break 1129 1129
23 watersv2_int main_waters FUZZ_INPUT 4096 trigger_Qemu_break 1129 1129
24 waterspart_int main_waters FUZZ_INPUT 4096 trigger_Qemu_break 1129 1129
25 waterspartv2_int main_waters FUZZ_INPUT 4096 trigger_Qemu_break 1129 1129
26 micro_branchless main_branchless FUZZ_INPUT 4 trigger_Qemu_break NONE
27 micro_int main_int FUZZ_INPUT 16 trigger_Qemu_break NONE
28 micro_longint main_micro_longint FUZZ_INPUT 16 trigger_Qemu_break NONE
29 minimal main_minimal FUZZ_INPUT 4096 trigger_Qemu_break NONE
30 gen3 main_minimal FUZZ_INPUT 4096 trigger_Qemu_break NONE
31 interact main_interact FUZZ_INPUT 4096 trigger_Qemu_break NONE
32 interact_int main_interact FUZZ_INPUT 4096 trigger_Qemu_break NONE

25
fuzzers/FRET/src/systemstate/observers.rs
View File

@ -253,6 +253,7 @@ fn get_releases(tarce: &Vec<ExecInterval>, states: &HashMap<u64, ReducedFreeRTOS
fn get_release_response_pairs(rel: &Vec<(u64, String)>, resp: &Vec<(u64, String)>) -> Vec<(u64, u64, String)> {
let mut ret = Vec::new();
let mut ready : HashMap<&String, u64> = HashMap::new();
let mut last_response : HashMap<&String, u64> = HashMap::new();
let mut r = rel.iter().peekable();
let mut d = resp.iter().peekable();
loop {
@ -262,9 +263,10 @@ fn get_release_response_pairs(rel: &Vec<(u64, String)>, resp: &Vec<(u64, String)
r.next();
} else {
if let Some(peek_resp) = d.peek() {
if peek_resp.0 > peek_rel.0 { // multiple releases before response, only use the latest release
eprintln!("Task {} released multiple times before response", peek_rel.1);
ready.insert(&peek_rel.1, peek_rel.0);
if peek_resp.0 > peek_rel.0 { // multiple releases before response
// It is unclear which release is real
eprintln!("Task {} released multiple times before response ({}ms and {}ms)", peek_rel.1, crate::time::clock::tick_to_time(ready[&peek_rel.1]).as_millis(), crate::time::clock::tick_to_time(peek_rel.0).as_millis());
// ready.insert(&peek_rel.1, peek_rel.0);
r.next();
}
}
@ -274,14 +276,29 @@ fn get_release_response_pairs(rel: &Vec<(u64, String)>, resp: &Vec<(u64, String)
if let Some(next_resp) = d.next() {
if ready.contains_key(&next_resp.1) {
if ready[&next_resp.1] >= next_resp.0 {
if let Some(lr) = last_response.get(&next_resp.1) {
// Sometimes a task is released immediately after a response. This might not be detected.
// Assume that the release occured with the last response
ret.push((*lr, next_resp.0, next_resp.1.clone()));
last_response.insert(&next_resp.1, next_resp.0);
} else {
eprintln!("Task {} released after response", next_resp.1);
}
} else {
// assert!(peek_resp.0 >= ready[&peek_resp.1]);
last_response.insert(&next_resp.1, next_resp.0);
ret.push((ready[&next_resp.1], next_resp.0, next_resp.1.clone()));
ready.remove(&next_resp.1);
}
} else {
eprintln!("Task {} not found in ready list", next_resp.1);
if let Some(lr) = last_response.get(&next_resp.1) {
// Sometimes a task is released immediately after a response. This might not be detected.
// Assume that the release occured with the last response
ret.push((*lr, next_resp.0, next_resp.1.clone()));
last_response.insert(&next_resp.1, next_resp.0);
} else {
eprintln!("Task {} response at {}ms not found in ready list", next_resp.1, crate::time::clock::tick_to_time(next_resp.0).as_millis());
}
}
} else {
// TODO: should remaining released tasks be counted as finished?