afl-qemu-speed.diff

--- ./afl-analyze.c	2018-03-04 12:24:45.413737400 +0100
+++ ./afl-analyze.c	2018-10-22 14:07:07.048608000 +0200
@@ -882,10 +882,6 @@
   char** new_argv = ck_alloc(sizeof(char*) * (argc + 4));
   u8 *tmp, *cp, *rsl, *own_copy;
 
-  /* Workaround for a QEMU stability glitch. */
-
-  setenv("QEMU_LOG", "nochain", 1);
-
   memcpy(new_argv + 3, argv + 1, sizeof(char*) * argc);
 
   /* Now we need to actually find qemu for argv[0]. */
--- ./afl-fuzz.c	2018-03-04 12:24:45.433737400 +0100
+++ ./afl-fuzz.c	2018-10-22 14:07:07.048608000 +0200
@@ -7605,10 +7605,6 @@
   char** new_argv = ck_alloc(sizeof(char*) * (argc + 4));
   u8 *tmp, *cp, *rsl, *own_copy;
 
-  /* Workaround for a QEMU stability glitch. */
-
-  setenv("QEMU_LOG", "nochain", 1);
-
   memcpy(new_argv + 3, argv + 1, sizeof(char*) * argc);
 
   new_argv[2] = target_path;
--- ./afl-showmap.c	2018-03-04 12:24:45.446237400 +0100
+++ ./afl-showmap.c	2018-10-22 14:07:07.048608000 +0200
@@ -559,10 +559,6 @@
   char** new_argv = ck_alloc(sizeof(char*) * (argc + 4));
   u8 *tmp, *cp, *rsl, *own_copy;
 
-  /* Workaround for a QEMU stability glitch. */
-
-  setenv("QEMU_LOG", "nochain", 1);
-
   memcpy(new_argv + 3, argv + 1, sizeof(char*) * argc);
 
   new_argv[2] = target_path;
--- ./afl-tmin.c	2018-03-04 12:24:45.451237400 +0100
+++ ./afl-tmin.c	2018-10-22 14:07:07.048608000 +0200
@@ -894,10 +894,6 @@
   char** new_argv = ck_alloc(sizeof(char*) * (argc + 4));
   u8 *tmp, *cp, *rsl, *own_copy;
 
-  /* Workaround for a QEMU stability glitch. */
-
-  setenv("QEMU_LOG", "nochain", 1);
-
   memcpy(new_argv + 3, argv + 1, sizeof(char*) * argc);
 
   /* Now we need to actually find qemu for argv[0]. */
--- ./llvm_mode/afl-clang-fast.c	2018-08-16 14:49:52.781345800 +0200
+++ ./llvm_mode/afl-clang-fast.c	2018-10-22 14:07:07.142208000 +0200
@@ -208,7 +208,7 @@
   if (!getenv("AFL_DONT_OPTIMIZE")) {
 
     cc_params[cc_par_cnt++] = "-g";
-    //cc_params[cc_par_cnt++] = "-O3";
+    cc_params[cc_par_cnt++] = "-O3";
     cc_params[cc_par_cnt++] = "-funroll-loops";
 
   }
--- ./llvm_mode/Makefile	2018-08-16 14:50:27.850146000 +0200
+++ ./llvm_mode/Makefile	2018-10-22 14:07:07.142208000 +0200
@@ -52,7 +51,7 @@
 
 ifeq "$(origin CC)" "default"
   CC         = clang
-  CXX        = g++
+  CXX        = clang++
 endif
 
 ifndef AFL_TRACE_PC
--- ./qemu_mode/build_qemu_support.sh	2018-03-04 12:24:46.013737400 +0100
+++ ./qemu_mode/build_qemu_support.sh	2018-10-22 14:07:07.142208000 +0200
@@ -131,6 +131,9 @@
 patch -p1 <../patches/elfload.diff || exit 1
 patch -p1 <../patches/cpu-exec.diff || exit 1
 patch -p1 <../patches/syscall.diff || exit 1
+patch -p1 <../patches/configure.diff || exit 1
+patch -p1 <../patches/memfd.diff || exit 1
+patch -p1 <../patches/translate-all.diff || exit 1
 
 echo "[+] Patching done."
 
--- ./qemu_mode/patches/afl-qemu-cpu-inl.h	2018-03-04 12:24:46.021237400 +0100
+++ ./qemu_mode/patches/afl-qemu-cpu-inl.h	2018-10-22 14:07:07.142208000 +0200
@@ -7,6 +7,9 @@
 
    Idea & design very much by Andrew Griffiths.
 
+   TCG instrumentation and block chaining support by Andrea Biondo
+                                      <andrea.biondo965@gmail.com>
+
    Copyright 2015, 2016, 2017 Google Inc. All rights reserved.
 
    Licensed under the Apache License, Version 2.0 (the "License");
@@ -33,15 +36,6 @@
  * VARIOUS AUXILIARY STUFF *
  ***************************/
 
-/* A snippet patched into tb_find_slow to inform the parent process that
-   we have hit a new block that hasn't been translated yet, and to tell
-   it to translate within its own context, too (this avoids translation
-   overhead in the next forked-off copy). */
-
-#define AFL_QEMU_CPU_SNIPPET1 do { \
-    afl_request_tsl(pc, cs_base, flags); \
-  } while (0)
-
 /* This snippet kicks in when the instruction pointer is positioned at
    _start and does the usual forkserver stuff, not very different from
    regular instrumentation injected via afl-as.h. */
@@ -51,7 +45,6 @@
       afl_setup(); \
       afl_forkserver(cpu); \
     } \
-    afl_maybe_log(itb->pc); \
   } while (0)
 
 /* We use one additional file descriptor to relay "needs translation"
@@ -61,7 +54,7 @@
 
 /* This is equivalent to afl-as.h: */
 
-static unsigned char *afl_area_ptr;
+unsigned char *afl_area_ptr; /* Exported for afl_gen_trace */
 
 /* Exported variables populated by the code patched into elfload.c: */
 
@@ -76,23 +69,32 @@
 
 /* Instrumentation ratio: */
 
-static unsigned int afl_inst_rms = MAP_SIZE;
+unsigned int afl_inst_rms = MAP_SIZE; /* Exported for afl_gen_trace */
 
 /* Function declarations. */
 
 static void afl_setup(void);
 static void afl_forkserver(CPUState*);
-static inline void afl_maybe_log(abi_ulong);
 
 static void afl_wait_tsl(CPUState*, int);
-static void afl_request_tsl(target_ulong, target_ulong, uint64_t);
+static void afl_request_tsl(target_ulong, target_ulong, uint32_t, TranslationBlock*, int);
 
-/* Data structure passed around by the translate handlers: */
+/* Data structures passed around by the translate handlers: */
 
-struct afl_tsl {
+struct afl_tb {
   target_ulong pc;
   target_ulong cs_base;
-  uint64_t flags;
+  uint32_t flags;
+};
+
+struct afl_tsl {
+  struct afl_tb tb;
+  char is_chain;
+};
+
+struct afl_chain {
+  struct afl_tb last_tb;
+  int tb_exit;
 };
 
 /* Some forward decls: */
@@ -224,54 +226,37 @@
 }
 
 
-/* The equivalent of the tuple logging routine from afl-as.h. */
-
-static inline void afl_maybe_log(abi_ulong cur_loc) {
-
-  static __thread abi_ulong prev_loc;
-
-  /* Optimize for cur_loc > afl_end_code, which is the most likely case on
-     Linux systems. */
-
-  if (cur_loc > afl_end_code || cur_loc < afl_start_code || !afl_area_ptr)
-    return;
-
-  /* Looks like QEMU always maps to fixed locations, so ASAN is not a
-     concern. Phew. But instruction addresses may be aligned. Let's mangle
-     the value to get something quasi-uniform. */
-
-  cur_loc  = (cur_loc >> 4) ^ (cur_loc << 8);
-  cur_loc &= MAP_SIZE - 1;
-
-  /* Implement probabilistic instrumentation by looking at scrambled block
-     address. This keeps the instrumented locations stable across runs. */
-
-  if (cur_loc >= afl_inst_rms) return;
-
-  afl_area_ptr[cur_loc ^ prev_loc]++;
-  prev_loc = cur_loc >> 1;
-
-}
-
-
 /* This code is invoked whenever QEMU decides that it doesn't have a
-   translation of a particular block and needs to compute it. When this happens,
-   we tell the parent to mirror the operation, so that the next fork() has a
-   cached copy. */
+   translation of a particular block and needs to compute it, or when it
+   decides to chain two TBs together. When this happens, we tell the parent to
+   mirror the operation, so that the next fork() has a cached copy. */
 
-static void afl_request_tsl(target_ulong pc, target_ulong cb, uint64_t flags) {
+static void afl_request_tsl(target_ulong pc, target_ulong cb, uint32_t flags,
+                            TranslationBlock *last_tb, int tb_exit) {
 
   struct afl_tsl t;
+  struct afl_chain c;
 
   if (!afl_fork_child) return;
 
-  t.pc      = pc;
-  t.cs_base = cb;
-  t.flags   = flags;
+  t.tb.pc      = pc;
+  t.tb.cs_base = cb;
+  t.tb.flags   = flags;
+  t.is_chain   = (last_tb != NULL);
 
   if (write(TSL_FD, &t, sizeof(struct afl_tsl)) != sizeof(struct afl_tsl))
     return;
 
+  if (t.is_chain) {
+    c.last_tb.pc      = last_tb->pc;
+    c.last_tb.cs_base = last_tb->cs_base;
+    c.last_tb.flags   = last_tb->flags;
+    c.tb_exit         = tb_exit;
+
+    if (write(TSL_FD, &c, sizeof(struct afl_chain)) != sizeof(struct afl_chain))
+      return;
+  }
+
 }
 
 /* This is the other side of the same channel. Since timeouts are handled by
@@ -280,7 +265,8 @@
 static void afl_wait_tsl(CPUState *cpu, int fd) {
 
   struct afl_tsl t;
-  TranslationBlock *tb;
+  struct afl_chain c;
+  TranslationBlock *tb, *last_tb;
 
   while (1) {
 
@@ -289,16 +275,31 @@
     if (read(fd, &t, sizeof(struct afl_tsl)) != sizeof(struct afl_tsl))
       break;
 
-    tb = tb_htable_lookup(cpu, t.pc, t.cs_base, t.flags);
+    tb = tb_htable_lookup(cpu, t.tb.pc, t.tb.cs_base, t.tb.flags);
 
     if(!tb) {
       mmap_lock();
       tb_lock();
-      tb_gen_code(cpu, t.pc, t.cs_base, t.flags, 0);
+      tb = tb_gen_code(cpu, t.tb.pc, t.tb.cs_base, t.tb.flags, 0);
       mmap_unlock();
       tb_unlock();
     }
 
+    if (t.is_chain) {
+      if (read(fd, &c, sizeof(struct afl_chain)) != sizeof(struct afl_chain))
+        break;
+
+      last_tb = tb_htable_lookup(cpu, c.last_tb.pc, c.last_tb.cs_base,
+                                 c.last_tb.flags);
+      if (last_tb) {
+        tb_lock();
+        if (!tb->invalid) {
+          tb_add_jump(last_tb, c.tb_exit, tb);
+        }
+        tb_unlock();
+      }
+    }
+
   }
 
   close(fd);
--- ./qemu_mode/patches/afl-qemu-translate-inl.h	1970-01-01 01:00:00.000000000 +0100
+++ ./qemu_mode/patches/afl-qemu-translate-inl.h	2018-10-22 14:07:07.142208000 +0200
@@ -0,0 +1,82 @@
+/*
+   american fuzzy lop - high-performance binary-only instrumentation
+   -----------------------------------------------------------------
+
+   Written by Andrew Griffiths <agriffiths@google.com> and
+              Michal Zalewski <lcamtuf@google.com>
+
+   Idea & design very much by Andrew Griffiths.
+
+   TCG instrumentation and block chaining support by Andrea Biondo
+                                      <andrea.biondo965@gmail.com>
+
+   Copyright 2015, 2016, 2017 Google Inc. All rights reserved.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at:
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+   This code is a shim patched into the separately-distributed source
+   code of QEMU 2.10.0. It leverages the built-in QEMU tracing functionality
+   to implement AFL-style instrumentation and to take care of the remaining
+   parts of the AFL fork server logic.
+
+   The resulting QEMU binary is essentially a standalone instrumentation
+   tool; for an example of how to leverage it for other purposes, you can
+   have a look at afl-showmap.c.
+
+ */
+
+#include "../../config.h"
+#include "tcg-op.h"
+
+/* Declared in afl-qemu-cpu-inl.h */
+extern unsigned char *afl_area_ptr;
+extern unsigned int afl_inst_rms;
+extern abi_ulong afl_start_code, afl_end_code;
+
+/* Generates TCG code for AFL's tracing instrumentation. */
+static void afl_gen_trace(target_ulong cur_loc)
+{
+  static __thread target_ulong prev_loc;
+  TCGv index, count, new_prev_loc;
+  TCGv_ptr prev_loc_ptr, count_ptr;
+
+  /* Optimize for cur_loc > afl_end_code, which is the most likely case on
+     Linux systems. */
+
+  if (cur_loc > afl_end_code || cur_loc < afl_start_code || !afl_area_ptr)
+    return;
+
+  /* Looks like QEMU always maps to fixed locations, so ASAN is not a
+     concern. Phew. But instruction addresses may be aligned. Let's mangle
+     the value to get something quasi-uniform. */
+
+  cur_loc  = (cur_loc >> 4) ^ (cur_loc << 8);
+  cur_loc &= MAP_SIZE - 1;
+
+  /* Implement probabilistic instrumentation by looking at scrambled block
+     address. This keeps the instrumented locations stable across runs. */
+
+  if (cur_loc >= afl_inst_rms) return;
+
+  /* index = prev_loc ^ cur_loc */
+  prev_loc_ptr = tcg_const_ptr(&prev_loc);
+  index = tcg_temp_new();
+  tcg_gen_ld_tl(index, prev_loc_ptr, 0);
+  tcg_gen_xori_tl(index, index, cur_loc);
+
+  /* afl_area_ptr[index]++ */
+  count_ptr = tcg_const_ptr(afl_area_ptr);
+  tcg_gen_add_ptr(count_ptr, count_ptr, TCGV_NAT_TO_PTR(index));
+  count = tcg_temp_new();
+  tcg_gen_ld8u_tl(count, count_ptr, 0);
+  tcg_gen_addi_tl(count, count, 1);
+  tcg_gen_st8_tl(count, count_ptr, 0);
+
+  /* prev_loc = cur_loc >> 1 */
+  new_prev_loc = tcg_const_tl(cur_loc >> 1);
+  tcg_gen_st_tl(new_prev_loc, prev_loc_ptr, 0);
+}
--- ./qemu_mode/patches/configure.diff	1970-01-01 01:00:00.000000000 +0100
+++ ./qemu_mode/patches/configure.diff	2018-10-22 14:07:07.157808000 +0200
@@ -0,0 +1,11 @@
+--- a/configure
++++ b/configure
+@@ -3855,7 +3855,7 @@ fi
+ # check if memfd is supported
+ memfd=no
+ cat > $TMPC << EOF
+-#include <sys/memfd.h>
++#include <sys/mman.h>
+ 
+ int main(void)
+ {
--- ./qemu_mode/patches/cpu-exec.diff	2018-03-04 12:24:46.023737400 +0100
+++ ./qemu_mode/patches/cpu-exec.diff	2018-10-22 14:07:07.157808000 +0200
@@ -1,5 +1,5 @@
---- qemu-2.10.0-rc3-clean/accel/tcg/cpu-exec.c	2017-08-15 11:39:41.000000000 -0700
-+++ qemu-2.10.0-rc3/accel/tcg/cpu-exec.c	2017-08-22 14:34:55.868730680 -0700
+--- qemu-2.10.0-clean/accel/tcg/cpu-exec.c	2017-08-30 18:50:40.000000000 +0200
++++ qemu-2.10.0/accel/tcg/cpu-exec.c	2018-09-22 13:21:23.612068407 +0200
 @@ -36,6 +36,8 @@
  #include "sysemu/cpus.h"
  #include "sysemu/replay.h"
@@ -18,11 +18,37 @@
      qemu_log_mask_and_addr(CPU_LOG_EXEC, itb->pc,
                             "Trace %p [%d: " TARGET_FMT_lx "] %s\n",
                             itb->tc_ptr, cpu->cpu_index, itb->pc,
+@@ -337,7 +341,7 @@
+     TranslationBlock *tb;
+     target_ulong cs_base, pc;
+     uint32_t flags;
+-    bool have_tb_lock = false;
++    bool have_tb_lock = false, was_translated = false, was_chained = false;
+ 
+     /* we record a subset of the CPU state. It will
+        always be the same before a given translated block
 @@ -365,6 +369,7 @@
              if (!tb) {
                  /* if no translated code available, then translate it now */
                  tb = tb_gen_code(cpu, pc, cs_base, flags, 0);
-+                AFL_QEMU_CPU_SNIPPET1;
++                was_translated = true;
              }
  
              mmap_unlock();
+@@ -390,11 +395,16 @@
+         }
+         if (!tb->invalid) {
+             tb_add_jump(last_tb, tb_exit, tb);
++            was_chained = true;
+         }
+     }
+     if (have_tb_lock) {
+         tb_unlock();
+     }
++    if (was_translated || was_chained) {
++        afl_request_tsl(pc, cs_base, flags, was_chained ? last_tb : NULL,
++                        tb_exit);
++    }
+     return tb;
+ }
+ 
--- ./qemu_mode/patches/memfd.diff	1970-01-01 01:00:00.000000000 +0100
+++ ./qemu_mode/patches/memfd.diff	2018-10-22 14:07:07.157808000 +0200
@@ -0,0 +1,12 @@
+--- a/util/memfd.c
++++ b/util/memfd.c
+@@ -31,9 +31,7 @@
+ 
+ #include "qemu/memfd.h"
+ 
+-#ifdef CONFIG_MEMFD
+-#include <sys/memfd.h>
+-#elif defined CONFIG_LINUX
++#if defined CONFIG_LINUX && !defined CONFIG_MEMFD
+ #include <sys/syscall.h>
+ #include <asm/unistd.h>
--- ./qemu_mode/patches/translate-all.diff	1970-01-01 01:00:00.000000000 +0100
+++ ./qemu_mode/patches/translate-all.diff	2018-10-22 14:07:07.157808000 +0200
@@ -0,0 +1,19 @@
+--- a/accel/tcg/translate-all.c	2017-08-30 18:50:40.000000000 +0200
++++ b/accel/tcg/translate-all.c	2018-09-21 10:19:42.328766554 +0200
+@@ -60,6 +60,8 @@
+ #include "exec/log.h"
+ #include "sysemu/cpus.h"
+ 
++#include "../patches/afl-qemu-translate-inl.h"
++
+ /* #define DEBUG_TB_INVALIDATE */
+ /* #define DEBUG_TB_FLUSH */
+ /* make various TB consistency checks */
+@@ -1280,6 +1282,7 @@
+     tcg_func_start(&tcg_ctx);
+ 
+     tcg_ctx.cpu = ENV_GET_CPU(env);
++    afl_gen_trace(pc);
+     gen_intermediate_code(cpu, tb);
+     tcg_ctx.cpu = NULL;
+