SYS-OSS/FRET-qemu
4
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

fuzz: add minimization options

Browse Source 
-M1: remove IO commands iteratively
-M2: try setting bits in operand of write/out to zero

Signed-off-by: Qiuhao Li <Qiuhao.Li@outlook.com>
Reviewed-by: Alexander Bulekov <alxndr@bu.edu>
Tested-by: Alexander Bulekov <alxndr@bu.edu>
Message-Id: <SYCPR01MB350204C52E7A39E6B0EEC870FCAB0@SYCPR01MB3502.ausprd01.prod.outlook.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
This commit is contained in:
Qiuhao Li 2021-01-11 14:11:51 +08:00 committed by Thomas Huth
parent 9d20f2af53
commit dd21ed0edf
1 changed files with 26 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
scripts/oss-fuzz/minimize_qtest_trace.py
View File

@ -16,6 +16,10 @@ QEMU_PATH = None
TIMEOUT = 5 TIMEOUT = 5
CRASH_TOKEN = None CRASH_TOKEN = None
# Minimization levels
M1 = False # try removing IO commands iteratively
M2 = False # try setting bits in operand of write/out to zero
write_suffix_lookup = {"b": (1, "B"), write_suffix_lookup = {"b": (1, "B"),
"w": (2, "H"), "w": (2, "H"),
"l": (4, "L"), "l": (4, "L"),
@ -23,10 +27,20 @@ write_suffix_lookup = {"b": (1, "B"),
def usage(): def usage():
sys.exit("""\ sys.exit("""\
Usage: QEMU_PATH="/path/to/qemu" QEMU_ARGS="args" {} input_trace output_trace Usage:
QEMU_PATH="/path/to/qemu" QEMU_ARGS="args" {} [Options] input_trace output_trace
By default, will try to use the second-to-last line in the output to identify By default, will try to use the second-to-last line in the output to identify
whether the crash occred. Optionally, manually set a string that idenitifes the whether the crash occred. Optionally, manually set a string that idenitifes the
crash by setting CRASH_TOKEN= crash by setting CRASH_TOKEN=
Options:
-M1: enable a loop around the remove minimizer, which may help decrease some
timing dependant instructions. Off by default.
-M2: try setting bits in operand of write/out to zero. Off by default.
""".format((sys.argv[0]))) """.format((sys.argv[0])))
deduplication_note = """\n\ deduplication_note = """\n\
@ -216,16 +230,21 @@ def minimize_trace(inpath, outpath):
print("Setting the timeout for {} seconds".format(TIMEOUT)) print("Setting the timeout for {} seconds".format(TIMEOUT))
newtrace = trace[:] newtrace = trace[:]
global M1, M2
# remove lines # remove lines
old_len = len(newtrace) + 1 old_len = len(newtrace) + 1
while(old_len > len(newtrace)): while(old_len > len(newtrace)):
old_len = len(newtrace) old_len = len(newtrace)
print("trace lenth = ", old_len)
remove_lines(newtrace, outpath) remove_lines(newtrace, outpath)
if not M1 and not M2:
break
newtrace = list(filter(lambda s: s != "", newtrace)) newtrace = list(filter(lambda s: s != "", newtrace))
assert(check_if_trace_crashes(newtrace, outpath)) assert(check_if_trace_crashes(newtrace, outpath))
# set bits to zero # set bits to zero
if M2:
clear_bits(newtrace, outpath) clear_bits(newtrace, outpath)
assert(check_if_trace_crashes(newtrace, outpath)) assert(check_if_trace_crashes(newtrace, outpath))
@ -233,7 +252,10 @@ def minimize_trace(inpath, outpath):
if __name__ == '__main__': if __name__ == '__main__':
if len(sys.argv) < 3: if len(sys.argv) < 3:
usage() usage()
if "-M1" in sys.argv:
M1 = True
if "-M2" in sys.argv:
M2 = True
QEMU_PATH = os.getenv("QEMU_PATH") QEMU_PATH = os.getenv("QEMU_PATH")
QEMU_ARGS = os.getenv("QEMU_ARGS") QEMU_ARGS = os.getenv("QEMU_ARGS")
if QEMU_PATH is None or QEMU_ARGS is None: if QEMU_PATH is None or QEMU_ARGS is None:
@ -242,4 +264,4 @@ if __name__ == '__main__':
# QEMU_ARGS += " -accel qtest" # QEMU_ARGS += " -accel qtest"
CRASH_TOKEN = os.getenv("CRASH_TOKEN") CRASH_TOKEN = os.getenv("CRASH_TOKEN")
QEMU_ARGS += " -qtest stdio -monitor none -serial none " QEMU_ARGS += " -qtest stdio -monitor none -serial none "
minimize_trace(sys.argv[1], sys.argv[2]) minimize_trace(sys.argv[-2], sys.argv[-1])