Re: [Xen-devel] [PATCH v2 13/13] fuzz/x86_emulate: Add an option to limit the number of instructions executed

["Jan Beulich" <JBeulich@xxxxxxxx>]

>>> On 25.09.17 at 16:26, <george.dunlap@xxxxxxxxxx> wrote:
> AFL considers a testcase to be a useful addition not only if there are
> tuples exercised by that testcase which were not exercised otherwise,
> but also if the *number* of times an individual tuple is exercised
> changes significantly; in particular, if the number of the highes bit
> changes (i.e., if it is run 1, 2-3, 4-7, 8-15, &c).

Perhaps I simply don't know about AFL (yet) to understand how "highest
bit" matters here, or even whose highest bits there's talk of.

> Unfortunately, one simple way to increase these stats it to execute
> the same (or similar) instructions multiple times.

But the change here doesn't look at instruction similarity at all.

> --- a/tools/fuzz/x86_instruction_emulator/fuzz-emul.c
> +++ b/tools/fuzz/x86_instruction_emulator/fuzz-emul.c
> @@ -960,10 +960,13 @@ void setup_fuzz_state(struct fuzz_state *state, const 
> uint8_t *data_p, size_t si
>      state->data_num = size;
>  }
>  
> +int opt_instruction_limit = 0;

unsigned int (and formally no need for an initializer)

>  int runtest(struct fuzz_state *state) {
>      int rc;
>  
>      struct x86_emulate_ctxt *ctxt = &state->ctxt;
> +    int icount = 0;

unsigned int

> @@ -988,7 +991,9 @@ int runtest(struct fuzz_state *state) {
>  
>          rc = x86_emulate(ctxt, &state->ops);
>          printf("Emulation result: %d\n", rc);
> -    } while ( rc == X86EMUL_OKAY );
> +    } while ( rc == X86EMUL_OKAY &&
> +              (!opt_instruction_limit ||
> +               (++icount < opt_instruction_limit)) );

Hmm, if the initalizer of opt_instruction_limit was UINT_MAX, I think
this wouldn't severely impact results (running 4 billion emulations is
simply going to take too long) and this expression could be a simple
comparison.

Jan


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
https://lists.xen.org/xen-devel