Simplifying the crash cases by opportunistically setting bits in
operands of
out/write to zero may help to debug, since usually bit one means turn on
or
trigger a function while zero is the default turn-off setting.
Tested Bug 1908062. Refined vs. Original result:
outl 0xcf8 0x8000081c outl 0xcf8 0x8000081c
outb 0xcfc 0xc3 outb 0xcfc 0xc3
outl 0xcf8 0x0 <-- outl 0xcf8 0x8000082f
outl 0xcf8 0x80000804 outl 0xcf8 0x80000804
outl 0xcfc 0x10000006 <-- outl 0xcfc 0x9b2765be
write 0xc300001024 0x2 0x10 <-- write 0xc300001024 0x2 0x0055
write 0xc300001028 0x1 0x5a write 0xc300001028 0x1 0x5a
write 0xc30000101c 0x1 0x01 write 0xc30000101c 0x1 0x01
writel 0xc30000100c 0x2a6f6c63 writel 0xc30000100c 0x2a6f6c63
write 0xc300001018 0x1 0x80 <-- write 0xc300001018 0x1 0xa4
write 0x5c 0x1 0x10 <-- write 0x5c 0x1 0x19
write 0xc300003002 0x1 0x0 <-- write 0xc300003002 0x1 0x8a
Signed-off-by: Qiuhao Li <Qiuhao.Li@outlook.com>
---
scripts/oss-fuzz/minimize_qtest_trace.py | 42 +++++++++++++++++++++++-
1 file changed, 41 insertions(+), 1 deletion(-)
diff --git a/scripts/oss-fuzz/minimize_qtest_trace.py b/scripts/oss-fuzz/minimize_qtest_trace.py
index 855c3bcb54..f3e88064c4 100755
--- a/scripts/oss-fuzz/minimize_qtest_trace.py
+++ b/scripts/oss-fuzz/minimize_qtest_trace.py
@@ -172,7 +172,47 @@ def minimize_trace(inpath, outpath):
newtrace[i] = prior
del newtrace[i+1]
i += 1
- check_if_trace_crashes(newtrace, outpath)
+
+ assert(check_if_trace_crashes(newtrace, outpath))
+
+ TIMEOUT = (end-start)*2 # input is short now
+
+ # try setting bits in operands of out/write to zero
+ i = 0
+ while i < len(newtrace):
+ if (not newtrace[i].startswith("write ") and not
+ newtrace[i].startswith("out")):
+ i += 1
+ continue
+ # write ADDR SIZE DATA
+ # outx ADDR VALUE
+ print("\nzero setting bits: {}".format(newtrace[i]))
+
+ prefix = " ".join(newtrace[i].split()[:-1])
+ data = newtrace[i].split()[-1]
+ data_bin = bin(int(data, 16))
+ data_bin_list = list(data_bin)
+
+ for j in range(2, len(data_bin_list)):
+ prior = newtrace[i]
+ if (data_bin_list[j] == '1'):
+ data_bin_list[j] = '0'
+ data_try = hex(int("".join(data_bin_list), 2))
+ # It seems qtest only accect hex with one byte zero padding
+ if len(data_try) % 2 == 1:
+ data_try = data_try[:2] + "0" + data_try[2:-1]
+
+ newtrace[i] = "{prefix} {data_try}\n".format(
+ prefix=prefix,
+ data_try=data_try)
+
+ if not check_if_trace_crashes(newtrace, outpath):
+ data_bin_list[j] = '1'
+ newtrace[i] = prior
+
+ i += 1
+
+ assert(check_if_trace_crashes(newtrace, outpath))
if __name__ == '__main__':
--
2.25.1
On 201220 0256, Qiuhao Li wrote:
> Simplifying the crash cases by opportunistically setting bits in
> operands of
> out/write to zero may help to debug, since usually bit one means turn on
> or
> trigger a function while zero is the default turn-off setting.
>
> Tested Bug 1908062. Refined vs. Original result:
>
> outl 0xcf8 0x8000081c outl 0xcf8 0x8000081c
> outb 0xcfc 0xc3 outb 0xcfc 0xc3
> outl 0xcf8 0x0 <-- outl 0xcf8 0x8000082f
> outl 0xcf8 0x80000804 outl 0xcf8 0x80000804
> outl 0xcfc 0x10000006 <-- outl 0xcfc 0x9b2765be
> write 0xc300001024 0x2 0x10 <-- write 0xc300001024 0x2 0x0055
> write 0xc300001028 0x1 0x5a write 0xc300001028 0x1 0x5a
> write 0xc30000101c 0x1 0x01 write 0xc30000101c 0x1 0x01
> writel 0xc30000100c 0x2a6f6c63 writel 0xc30000100c 0x2a6f6c63
> write 0xc300001018 0x1 0x80 <-- write 0xc300001018 0x1 0xa4
> write 0x5c 0x1 0x10 <-- write 0x5c 0x1 0x19
> write 0xc300003002 0x1 0x0 <-- write 0xc300003002 0x1 0x8a
>
> Signed-off-by: Qiuhao Li <Qiuhao.Li@outlook.com>
Looks good. One nit below.
Reviewed-by: Alexander Bulekov <alxndr@bu.edu>
> ---
> scripts/oss-fuzz/minimize_qtest_trace.py | 42 +++++++++++++++++++++++-
> 1 file changed, 41 insertions(+), 1 deletion(-)
>
> diff --git a/scripts/oss-fuzz/minimize_qtest_trace.py b/scripts/oss-fuzz/minimize_qtest_trace.py
> index 855c3bcb54..f3e88064c4 100755
> --- a/scripts/oss-fuzz/minimize_qtest_trace.py
> +++ b/scripts/oss-fuzz/minimize_qtest_trace.py
> @@ -172,7 +172,47 @@ def minimize_trace(inpath, outpath):
> newtrace[i] = prior
> del newtrace[i+1]
> i += 1
> - check_if_trace_crashes(newtrace, outpath)
> +
> + assert(check_if_trace_crashes(newtrace, outpath))
> +
> + TIMEOUT = (end-start)*2 # input is short now
> +
> + # try setting bits in operands of out/write to zero
> + i = 0
> + while i < len(newtrace):
> + if (not newtrace[i].startswith("write ") and not
> + newtrace[i].startswith("out")):
> + i += 1
> + continue
> + # write ADDR SIZE DATA
> + # outx ADDR VALUE
> + print("\nzero setting bits: {}".format(newtrace[i]))
> +
> + prefix = " ".join(newtrace[i].split()[:-1])
> + data = newtrace[i].split()[-1]
> + data_bin = bin(int(data, 16))
> + data_bin_list = list(data_bin)
> +
> + for j in range(2, len(data_bin_list)):
> + prior = newtrace[i]
> + if (data_bin_list[j] == '1'):
> + data_bin_list[j] = '0'
> + data_try = hex(int("".join(data_bin_list), 2))
> + # It seems qtest only accect hex with one byte zero padding
^^ "accepts padded hex-values."
> + if len(data_try) % 2 == 1:
> + data_try = data_try[:2] + "0" + data_try[2:-1]
> +
> + newtrace[i] = "{prefix} {data_try}\n".format(
> + prefix=prefix,
> + data_try=data_try)
> +
> + if not check_if_trace_crashes(newtrace, outpath):
> + data_bin_list[j] = '1'
> + newtrace[i] = prior
> +
> + i += 1
> +
> + assert(check_if_trace_crashes(newtrace, outpath))
>
>
> if __name__ == '__main__':
> --
> 2.25.1
>
On Mon, 2020-12-21 at 15:35 -0500, Alexander Bulekov wrote:
> On 201220 0256, Qiuhao Li wrote:
> > Simplifying the crash cases by opportunistically setting bits in
> > operands of
> > out/write to zero may help to debug, since usually bit one means
> > turn on
> > or
> > trigger a function while zero is the default turn-off setting.
> >
> > Tested Bug 1908062. Refined vs. Original result:
> >
> > outl 0xcf8 0x8000081c outl 0xcf8 0x8000081c
> > outb 0xcfc 0xc3 outb 0xcfc 0xc3
> > outl 0xcf8 0x0 <-- outl 0xcf8 0x8000082f
> > outl 0xcf8 0x80000804 outl 0xcf8 0x80000804
> > outl 0xcfc 0x10000006 <-- outl 0xcfc 0x9b2765be
> > write 0xc300001024 0x2 0x10 <-- write 0xc300001024 0x2 0x0055
> > write 0xc300001028 0x1 0x5a write 0xc300001028 0x1 0x5a
> > write 0xc30000101c 0x1 0x01 write 0xc30000101c 0x1 0x01
> > writel 0xc30000100c 0x2a6f6c63 writel 0xc30000100c 0x2a6f6c63
> > write 0xc300001018 0x1 0x80 <-- write 0xc300001018 0x1 0xa4
> > write 0x5c 0x1 0x10 <-- write 0x5c 0x1 0x19
> > write 0xc300003002 0x1 0x0 <-- write 0xc300003002 0x1 0x8a
> >
> > Signed-off-by: Qiuhao Li <Qiuhao.Li@outlook.com>
>
> Looks good. One nit below.
>
> Reviewed-by: Alexander Bulekov <alxndr@bu.edu>
>
>
> > ---
> > scripts/oss-fuzz/minimize_qtest_trace.py | 42
> > +++++++++++++++++++++++-
> > 1 file changed, 41 insertions(+), 1 deletion(-)
> >
> > diff --git a/scripts/oss-fuzz/minimize_qtest_trace.py
> > b/scripts/oss-fuzz/minimize_qtest_trace.py
> > index 855c3bcb54..f3e88064c4 100755
> > --- a/scripts/oss-fuzz/minimize_qtest_trace.py
> > +++ b/scripts/oss-fuzz/minimize_qtest_trace.py
> > @@ -172,7 +172,47 @@ def minimize_trace(inpath, outpath):
> > newtrace[i] = prior
> > del newtrace[i+1]
> > i += 1
> > - check_if_trace_crashes(newtrace, outpath)
> > +
> > + assert(check_if_trace_crashes(newtrace, outpath))
> > +
> > + TIMEOUT = (end-start)*2 # input is short now
> > +
> > + # try setting bits in operands of out/write to zero
> > + i = 0
> > + while i < len(newtrace):
> > + if (not newtrace[i].startswith("write ") and not
> > + newtrace[i].startswith("out")):
> > + i += 1
> > + continue
> > + # write ADDR SIZE DATA
> > + # outx ADDR VALUE
> > + print("\nzero setting bits: {}".format(newtrace[i]))
> > +
> > + prefix = " ".join(newtrace[i].split()[:-1])
> > + data = newtrace[i].split()[-1]
> > + data_bin = bin(int(data, 16))
> > + data_bin_list = list(data_bin)
> > +
> > + for j in range(2, len(data_bin_list)):
> > + prior = newtrace[i]
> > + if (data_bin_list[j] == '1'):
> > + data_bin_list[j] = '0'
> > + data_try = hex(int("".join(data_bin_list), 2))
> > + # It seems qtest only accect hex with one byte
> > zero padding
> ^^ "accepts padded hex-
> values."
Thanks.
>
> > + if len(data_try) % 2 == 1:
> > + data_try = data_try[:2] + "0" + data_try[2:-1]
> > +
> > + newtrace[i] = "{prefix} {data_try}\n".format(
> > + prefix=prefix,
> > + data_try=data_try)
> > +
> > + if not check_if_trace_crashes(newtrace, outpath):
> > + data_bin_list[j] = '1'
> > + newtrace[i] = prior
> > +
> > + i += 1
> > +
> > + assert(check_if_trace_crashes(newtrace, outpath))
> >
> >
> > if __name__ == '__main__':
> > --
> > 2.25.1
> >
© 2016 - 2025 Red Hat, Inc.