[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH v8 6/7] fuzz: add minimization options
From: |
Qiuhao Li |
Subject: |
[PATCH v8 6/7] fuzz: add minimization options |
Date: |
Mon, 11 Jan 2021 14:11:51 +0800 |
-M1: remove IO commands iteratively
-M2: try setting bits in operand of write/out to zero
Signed-off-by: Qiuhao Li <Qiuhao.Li@outlook.com>
Reviewed-by: Alexander Bulekov <alxndr@bu.edu>
Tested-by: Alexander Bulekov <alxndr@bu.edu>
---
scripts/oss-fuzz/minimize_qtest_trace.py | 30 ++++++++++++++++++++----
1 file changed, 26 insertions(+), 4 deletions(-)
diff --git a/scripts/oss-fuzz/minimize_qtest_trace.py
b/scripts/oss-fuzz/minimize_qtest_trace.py
index 219858a9e3..0e59bdbb01 100755
--- a/scripts/oss-fuzz/minimize_qtest_trace.py
+++ b/scripts/oss-fuzz/minimize_qtest_trace.py
@@ -16,6 +16,10 @@ QEMU_PATH = None
TIMEOUT = 5
CRASH_TOKEN = None
+# Minimization levels
+M1 = False # try removing IO commands iteratively
+M2 = False # try setting bits in operand of write/out to zero
+
write_suffix_lookup = {"b": (1, "B"),
"w": (2, "H"),
"l": (4, "L"),
@@ -23,10 +27,20 @@ write_suffix_lookup = {"b": (1, "B"),
def usage():
sys.exit("""\
-Usage: QEMU_PATH="/path/to/qemu" QEMU_ARGS="args" {} input_trace output_trace
+Usage:
+
+QEMU_PATH="/path/to/qemu" QEMU_ARGS="args" {} [Options] input_trace
output_trace
+
By default, will try to use the second-to-last line in the output to identify
whether the crash occred. Optionally, manually set a string that idenitifes the
crash by setting CRASH_TOKEN=
+
+Options:
+
+-M1: enable a loop around the remove minimizer, which may help decrease some
+ timing dependant instructions. Off by default.
+-M2: try setting bits in operand of write/out to zero. Off by default.
+
""".format((sys.argv[0])))
deduplication_note = """\n\
@@ -216,24 +230,32 @@ def minimize_trace(inpath, outpath):
print("Setting the timeout for {} seconds".format(TIMEOUT))
newtrace = trace[:]
+ global M1, M2
# remove lines
old_len = len(newtrace) + 1
while(old_len > len(newtrace)):
old_len = len(newtrace)
+ print("trace lenth = ", old_len)
remove_lines(newtrace, outpath)
+ if not M1 and not M2:
+ break
newtrace = list(filter(lambda s: s != "", newtrace))
assert(check_if_trace_crashes(newtrace, outpath))
# set bits to zero
- clear_bits(newtrace, outpath)
+ if M2:
+ clear_bits(newtrace, outpath)
assert(check_if_trace_crashes(newtrace, outpath))
if __name__ == '__main__':
if len(sys.argv) < 3:
usage()
-
+ if "-M1" in sys.argv:
+ M1 = True
+ if "-M2" in sys.argv:
+ M2 = True
QEMU_PATH = os.getenv("QEMU_PATH")
QEMU_ARGS = os.getenv("QEMU_ARGS")
if QEMU_PATH is None or QEMU_ARGS is None:
@@ -242,4 +264,4 @@ if __name__ == '__main__':
# QEMU_ARGS += " -accel qtest"
CRASH_TOKEN = os.getenv("CRASH_TOKEN")
QEMU_ARGS += " -qtest stdio -monitor none -serial none "
- minimize_trace(sys.argv[1], sys.argv[2])
+ minimize_trace(sys.argv[-2], sys.argv[-1])
--
2.25.1
- [PATCH v8 0/7] fuzz: improve crash case minimization, Qiuhao Li, 2021/01/11
- [PATCH v8 1/7] fuzz: accelerate non-crash detection, Qiuhao Li, 2021/01/11
- [PATCH v8 2/7] fuzz: double the IOs to remove for every loop, Qiuhao Li, 2021/01/11
- [PATCH v8 3/7] fuzz: split write operand using binary approach, Qiuhao Li, 2021/01/11
- [PATCH v8 4/7] fuzz: remove IO commands iteratively, Qiuhao Li, 2021/01/11
- [PATCH v8 5/7] fuzz: set bits in operand of write/out to zero, Qiuhao Li, 2021/01/11
[PATCH v8 6/7] fuzz: add minimization options,
Qiuhao Li <=
[PATCH v8 7/7] fuzz: heuristic split write based on past IOs, Qiuhao Li, 2021/01/11