From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.0 required=3.0 tests=BAYES_00,HK_RANDOM_FROM, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE, URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id BE265C07E95 for ; Thu, 8 Jul 2021 02:59:39 +0000 (UTC) Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 8639561C98 for ; Thu, 8 Jul 2021 02:59:39 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 8639561C98 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=bu.edu Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Received: from localhost ([::1]:56420 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1m1KGI-0007Hn-Oa for qemu-devel@archiver.kernel.org; Wed, 07 Jul 2021 22:59:38 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:57390) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1m1KFa-0005Sk-Bm for qemu-devel@nongnu.org; Wed, 07 Jul 2021 22:58:54 -0400 Received: from relay68.bu.edu ([128.197.228.73]:38965) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1m1KFY-0002Tk-40 for qemu-devel@nongnu.org; Wed, 07 Jul 2021 22:58:53 -0400 X-Envelope-From: alxndr@bu.edu X-BU-AUTH: mozz.bu.edu [128.197.127.33] Received: from BU-AUTH (localhost.localdomain [127.0.0.1]) (authenticated bits=0) by relay68.bu.edu (8.14.3/8.14.3) with ESMTP id 1682wLY5002592 (version=TLSv1/SSLv3 cipher=AES256-GCM-SHA384 bits=256 verify=NO); Wed, 7 Jul 2021 22:58:25 -0400 Date: Wed, 7 Jul 2021 22:58:21 -0400 From: Alexander Bulekov To: qemu-devel@nongnu.org Subject: Re: [PATCH v5 2/3] fuzz: add an instrumentation filter Message-ID: <20210708025821.aokkjfqxluv7mrjv@mozz.bu.edu> References: <20210630034124.222689-1-alxndr@bu.edu> <20210630034124.222689-3-alxndr@bu.edu> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20210630034124.222689-3-alxndr@bu.edu> Received-SPF: pass client-ip=128.197.228.73; envelope-from=alxndr@bu.edu; helo=relay68.bu.edu X-Spam_score_int: -15 X-Spam_score: -1.6 X-Spam_bar: - X-Spam_report: (-1.6 / 5.0 requ) BAYES_00=-1.9, HK_RANDOM_ENVFROM=0.001, HK_RANDOM_FROM=1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Thomas Huth , Philippe =?utf-8?Q?Mathieu-Daud=C3=A9?= , darren.kenny@oracle.com, Bandan Das , Stefan Hajnoczi , Paolo Bonzini Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: "Qemu-devel" On 210629 2341, Alexander Bulekov wrote: > By default, -fsanitize=fuzzer instruments all code with coverage > information. However, this means that libfuzzer will track coverage over > hundreds of source files that are unrelated to virtual-devices. This > means that libfuzzer will optimize inputs for coverage observed in timer > code, memory APIs etc. This slows down the fuzzer and stores many inputs > that are not relevant to the actual virtual-devices. > > With this change, clang versions that support the > "-fsanitize-coverage-allowlist" will only instrument a subset of the > compiled code, that is directly related to virtual-devices. > > Signed-off-by: Alexander Bulekov Ping? Are there any other device-related subdirectories we should add to the filter besides slirp? I'm considering net/ , since it do not seem to generate much coverage noise, and there might be some tricky codepaths there that benefit from the coverage guidance. -Alex > --- > configure | 13 +++++++++++++ > scripts/oss-fuzz/instrumentation-filter-template | 14 ++++++++++++++ > 2 files changed, 27 insertions(+) > create mode 100644 scripts/oss-fuzz/instrumentation-filter-template > > diff --git a/configure b/configure > index 38704b4e11..3b6ca054b9 100755 > --- a/configure > +++ b/configure > @@ -5189,6 +5189,11 @@ if test "$fuzzing" = "yes" && test -z "${LIB_FUZZING_ENGINE+xxx}"; then > error_exit "Your compiler doesn't support -fsanitize=fuzzer" > exit 1 > fi > + have_clang_coverage_filter=no > + echo > $TMPTXT > + if compile_prog "$CPU_CFLAGS -Werror -fsanitize=fuzzer -fsanitize-coverage-allowlist=$TMPTXT" ""; then > + have_clang_coverage_filter=yes > + fi > fi > > # Thread sanitizer is, for now, much noisier than the other sanitizers; > @@ -6120,6 +6125,14 @@ if test "$fuzzing" = "yes" ; then > # rule for the fuzzer adds these to the link_args. They need to be > # configurable, to support OSS-Fuzz > FUZZ_EXE_LDFLAGS="-fsanitize=fuzzer" > + > + # Specify a filter to only instrument code that is directly related to > + # virtual-devices. > + if test "$have_clang_coverage_filter" = "yes" ; then > + cp "$source_path/scripts/oss-fuzz/instrumentation-filter-template" \ > + instrumentation-filter > + QEMU_CFLAGS="$QEMU_CFLAGS -fsanitize-coverage-allowlist=instrumentation-filter" > + fi > else > FUZZ_EXE_LDFLAGS="$LIB_FUZZING_ENGINE" > fi > diff --git a/scripts/oss-fuzz/instrumentation-filter-template b/scripts/oss-fuzz/instrumentation-filter-template > new file mode 100644 > index 0000000000..44e853159c > --- /dev/null > +++ b/scripts/oss-fuzz/instrumentation-filter-template > @@ -0,0 +1,14 @@ > +# Code that we actually want the fuzzer to target > +# See: https://clang.llvm.org/docs/SanitizerCoverage.html#disabling-instrumentation-without-source-modification > +# > +src:*/hw/* > +src:*/include/hw/* > +src:*/slirp/* > + > +# We don't care about coverage over fuzzer-specific code, however we should > +# instrument the fuzzer entry-point so libFuzzer always sees at least some > +# coverage - otherwise it will exit after the first input > +src:*/tests/qtest/fuzz/fuzz.c > + > +# Enable instrumentation for all functions in those files > +fun:* > -- > 2.28.0 >