@samitouri / QOSamiQemu
Code Commits Issues Pulls Sessions CI/CD
master
master
py 102 lines 3.63 KB
Raw
1 #!/usr/bin/env python3
2
3 """
4 Use this to convert qtest log info from a generic fuzzer input into a qtest
5 trace that you can feed into a standard qemu-system process. Example usage:
6
7 QEMU_FUZZ_ARGS="-machine q35,accel=qtest" QEMU_FUZZ_OBJECTS="*" \
8 ./i386-softmmu/qemu-fuzz-i386 --fuzz-target=generic-pci-fuzz
9 # .. Finds some crash
10 QTEST_LOG=1 FUZZ_SERIALIZE_QTEST=1 \
11 QEMU_FUZZ_ARGS="-machine q35,accel=qtest" QEMU_FUZZ_OBJECTS="*" \
12 ./i386-softmmu/qemu-fuzz-i386 --fuzz-target=generic-pci-fuzz
13 /path/to/crash 2> qtest_log_output
14 scripts/oss-fuzz/reorder_fuzzer_qtest_trace.py qtest_log_output > qtest_trace
15 ./i386-softmmu/qemu-fuzz-i386 -machine q35,accel=qtest \
16 -qtest stdio < qtest_trace
17
18 ### Details ###
19
20 Some fuzzer make use of hooks that allow us to populate some memory range, just
21 before a DMA read from that range. This means that the fuzzer can produce
22 activity that looks like:
23 [start] read from mmio addr
24 [end] read from mmio addr
25 [start] write to pio addr
26 [start] fill a DMA buffer just in time
27 [end] fill a DMA buffer just in time
28 [start] fill a DMA buffer just in time
29 [end] fill a DMA buffer just in time
30 [end] write to pio addr
31 [start] read from mmio addr
32 [end] read from mmio addr
33
34 We annotate these "nested" DMA writes, so with QTEST_LOG=1 the QTest trace
35 might look something like:
36 [R +0.028431] readw 0x10000
37 [R +0.028434] outl 0xc000 0xbeef # Triggers a DMA read from 0xbeef and 0xbf00
38 [DMA][R +0.034639] write 0xbeef 0x2 0xAAAA
39 [DMA][R +0.034639] write 0xbf00 0x2 0xBBBB
40 [R +0.028431] readw 0xfc000
41
42 This script would reorder the above trace so it becomes:
43 readw 0x10000
44 write 0xbeef 0x2 0xAAAA
45 write 0xbf00 0x2 0xBBBB
46 outl 0xc000 0xbeef
47 readw 0xfc000
48
49 I.e. by the time, 0xc000 tries to read from DMA, those DMA buffers have already
50 been set up, removing the need for the DMA hooks. We can simply provide this
51 reordered trace via -qtest stdio to reproduce the input
52
53 Note: this won't work for traces where the device tries to read from the same
54 DMA region twice in between MMIO/PIO commands. E.g:
55 [R +0.028434] outl 0xc000 0xbeef
56 [DMA][R +0.034639] write 0xbeef 0x2 0xAAAA
57 [DMA][R +0.034639] write 0xbeef 0x2 0xBBBB
58
59 The fuzzer will annotate suspected double-fetches with [DOUBLE-FETCH]. This
60 script looks for these tags and warns the users that the resulting trace might
61 not reproduce the bug.
62 """
63
64 import sys
65
66 __author__ = "Alexander Bulekov <alxndr@bu.edu>"
67 __copyright__ = "Copyright (C) 2020, Red Hat, Inc."
68 __license__ = "GPL version 2 or (at your option) any later version"
69
70 __maintainer__ = "Alexander Bulekov"
71 __email__ = "alxndr@bu.edu"
72
73
74 def usage():
75 sys.exit("Usage: {} /path/to/qtest_log_output".format((sys.argv[0])))
76
77
78 def main(filename):
79 with open(filename, "r") as f:
80 trace = f.readlines()
81
82 # Leave only lines that look like logged qtest commands
83 trace[:] = [x.strip() for x in trace if "[R +" in x
84 or "[S +" in x and "CLOSED" not in x]
85
86 for i in range(len(trace)):
87 if i+1 < len(trace):
88 if "[DMA]" in trace[i+1]:
89 if "[DOUBLE-FETCH]" in trace[i+1]:
90 sys.stderr.write("Warning: Likely double fetch on line"
91 "{}.\n There will likely be problems "
92 "reproducing behavior with the "
93 "resulting qtest trace\n\n".format(i+1))
94 trace[i], trace[i+1] = trace[i+1], trace[i]
95 for line in trace:
96 print(line.split("]")[-1].strip())
97
98
99 if __name__ == '__main__':
100 if len(sys.argv) == 1:
101 usage()
102 main(sys.argv[1])