From e8ff45b205dc1e06d3f66975be2535e3bad954b7 Mon Sep 17 00:00:00 2001
From: Alwin Berger <alwin.berger@tu-dortmund.de>
Date: Sun, 10 Jul 2022 16:21:50 +0200
Subject: [PATCH] update evaluation scripts

---
 fuzzers/wcet_qemu_sys/Makefile                 | 14 ++++++++------
 fuzzers/wcet_qemu_sys/src/bin/showmap.rs       |  2 +-
 fuzzers/wcet_qemu_sys/tmr_inputs/.gitignore    |  1 +
 fuzzers/wcet_qemu_sys/tmr_inputs/inputs.sh     |  4 ++++
 fuzzers/wcet_qemu_sys/tmrint_inputs/.gitignore |  1 +
 fuzzers/wcet_qemu_sys/tmrint_inputs/inputs.sh  |  6 ++++++
 6 files changed, 21 insertions(+), 7 deletions(-)
 create mode 100644 fuzzers/wcet_qemu_sys/tmr_inputs/.gitignore
 create mode 100644 fuzzers/wcet_qemu_sys/tmr_inputs/inputs.sh
 create mode 100644 fuzzers/wcet_qemu_sys/tmrint_inputs/.gitignore
 create mode 100644 fuzzers/wcet_qemu_sys/tmrint_inputs/inputs.sh

diff --git a/fuzzers/wcet_qemu_sys/Makefile b/fuzzers/wcet_qemu_sys/Makefile
index bcae7c69b5..2dc44488b5 100644
--- a/fuzzers/wcet_qemu_sys/Makefile
+++ b/fuzzers/wcet_qemu_sys/Makefile
@@ -5,7 +5,7 @@ TARGET_TRACE = $(BENCHDIR)/traces/$(TNAME)_worst.ron
 TARGET_EDGES = $(BENCHDIR)/edges/$(TNAME)_worst.ron
 RUNTIME = 3600
 INT_FLAG = ,fuzz_interrupt
-COMMON_FLAGS = benchmark,dump_infos$(INT_FLAG)
+COMMON_FLAGS = benchmark,dump_infos#,$(INT_FLAG)
 NUM_JOB = 3
 NUM_ITERATIONS = 10
 LOCKFILE = /tmp/bench_sem
@@ -16,7 +16,7 @@ $(BENCHDIR)/bin:
 	mkdir -p $@
 
 $(BENCHDIR)/target_random:
-	cargo build --bin fuzzer --target-dir $@ --features $(COMMON_FLAGS),sched_queue,fuzz_random
+	cargo build --target-dir $@ --features $(COMMON_FLAGS),sched_queue,fuzz_random
 
 $(BENCHDIR)/target_known_edges:
 	cargo build --bin fuzzer --target-dir $@ --features $(COMMON_FLAGS),feed_known_edges,sched_queue
@@ -70,13 +70,13 @@ $(BENCHDIR)/bench_%.log: $(BENCHDIR)/target_% $(TARGET_TRACE)
 		$(RELEASE) & \
 		done
 		wait
-		for i in $@_*; do tail -n 1 $$i >> $@; done
+		for i in $@_*; do grep Stats $$i | tail -n 1 >> $@; done
 
 benchmarks_noint: target/bench/bench_known_edges.log target/bench/bench_afl_queue.log target/bench/bench_afl_mapmax.log target/bench/bench_state.log target/bench/bench_state_afl.log  \
 	target/bench/bench_graph.log target/bench/bench_graph_muta.log target/bench/bench_graph_afl.log target/bench/bench_graph_muta_afl.log 
 # target/bench/bench_graph_all.log target/bench/bench_state_afl_int.log
 
-benchmarks_int: target/bench/bench_graph_muta_afl.log target/bench/bench_graph_muta_afl_int.log target/bench/bench_state_afl.log target/bench/bench_state_afl_int.log target/bench/bench_afl_mapmax.log
+benchmarks_int: target/bench/bench_graph_muta_afl.log target/bench/bench_graph_muta_afl_int.log target/bench/bench_state_afl.log target/bench/bench_state_afl_int.log target/bench/bench_afl_mapmax.log target/bench/bench_afl_queue.log
 
 benchmark_random: target/bench/bench_random.log
 
@@ -97,12 +97,14 @@ reset_sem:
 	echo $(NUM_JOB)	> $(LOCKFILE)
 	rm -rf $(LOCKFILE)_lockdir
 	
-%.case: %_inputs
+%.case: %_inputs $(BENCHDIR)/target_random
 	mkdir -p $(BENCHDIR)/traces $(BENCHDIR)/edges
 	for i in $</*.case; do \
 		CASE=$$(basename -s.case $$i); echo $$CASE; \
 		PROG=$$(basename -s.case $@); \
-		./showmap.sh $(TARGET) --libafl-single $$i \
+		LD_LIBRARY_PATH=$(BENCHDIR)/target_random/debug $(BENCHDIR)/target_random/debug/showmap --libafl-snapshot tmp/dummy.qcow2 \
+			--libafl-out tmp/test_out --libafl-in tmp/test_in --libafl-kernel $(TARGET) \
+			--libafl-single $$i \
 			--libafl-edges $(BENCHDIR)/edges/$$PROG\_$$CASE.ron \
 			--libafl-traces $(BENCHDIR)/traces/$$PROG\_$$CASE.ron | \
 			grep "Qemu Ticks:"; \
diff --git a/fuzzers/wcet_qemu_sys/src/bin/showmap.rs b/fuzzers/wcet_qemu_sys/src/bin/showmap.rs
index 39c7d6dd62..77e9d02712 100644
--- a/fuzzers/wcet_qemu_sys/src/bin/showmap.rs
+++ b/fuzzers/wcet_qemu_sys/src/bin/showmap.rs
@@ -342,7 +342,7 @@ fn fuzz(
         let mut buf = target.as_slice();
         let mut len = buf.len();
         let mut int_tick : Option<u32> = None;
-        if len > IRQ_INPUT_BYTES_NUMBER as usize {
+        if len > IRQ_INPUT_BYTES_NUMBER as usize && IRQ_INPUT_BYTES_NUMBER!=0{
             let mut t : [u8; 4] = [0,0,0,0];    // 4 extra bytes determine the tick to execute an interrupt
             for i in 0..min(4,IRQ_INPUT_BYTES_NUMBER) {
                 t[i as usize]=buf[i as usize];
diff --git a/fuzzers/wcet_qemu_sys/tmr_inputs/.gitignore b/fuzzers/wcet_qemu_sys/tmr_inputs/.gitignore
new file mode 100644
index 0000000000..f9f3041727
--- /dev/null
+++ b/fuzzers/wcet_qemu_sys/tmr_inputs/.gitignore
@@ -0,0 +1 @@
+*.case
diff --git a/fuzzers/wcet_qemu_sys/tmr_inputs/inputs.sh b/fuzzers/wcet_qemu_sys/tmr_inputs/inputs.sh
new file mode 100644
index 0000000000..da2decba55
--- /dev/null
+++ b/fuzzers/wcet_qemu_sys/tmr_inputs/inputs.sh
@@ -0,0 +1,4 @@
+echo "" > best.case
+echo "\x00\x00" > best_success.case
+echo "\x05\x29\x07\x1f\x0b\x17\x00\x17" > worst_trace.case
+echo "\xFF\xF6\xFC\xF8\xFD\xFD\xFF\xFD" > worst.case
diff --git a/fuzzers/wcet_qemu_sys/tmrint_inputs/.gitignore b/fuzzers/wcet_qemu_sys/tmrint_inputs/.gitignore
new file mode 100644
index 0000000000..f9f3041727
--- /dev/null
+++ b/fuzzers/wcet_qemu_sys/tmrint_inputs/.gitignore
@@ -0,0 +1 @@
+*.case
diff --git a/fuzzers/wcet_qemu_sys/tmrint_inputs/inputs.sh b/fuzzers/wcet_qemu_sys/tmrint_inputs/inputs.sh
new file mode 100644
index 0000000000..6d1a06f8a2
--- /dev/null
+++ b/fuzzers/wcet_qemu_sys/tmrint_inputs/inputs.sh
@@ -0,0 +1,6 @@
+echo "\xff\xff" > best.case
+echo "\xff\xff\x00\x00" > best_success.case
+echo "\xff\x05\x05\x29\x07\x1f\x0b\x17\x00\x17" > worst_trace.case
+echo "\xff\x05\xFF\xF6\xFC\xF8\xFD\xFD\xFF\xFD" > worst.case
+echo "\x3F\x05\xFF\xF6\xFC\xF8\xFD\xFD\xFF\xFD" > worst_preempt.case
+echo "\x93\x1F\xFF\xF6\xFC\xF8\xFD\xFD\xFF\xFD" > worst_preempt_adv.case