[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Xen-devel] [PATCH v2 07/13] fuzz/x86_emulate: Add 'afl-cov' target

...to generate a "normal" coverage-instrumented binary, suitable for
use with gcov or afl-cov.

This is slightly annoying because:

 - Every object file needs to have been instrumented to work

 - You generally want to have both an afl-instrumented binary and a
   gcov-instrumented binary at the same time, but

 - gcov instrumentation and afl instrumentation are mutually exclusive

So when making the `afl-cov` target, generate a second set of object
files and a second binary with the `-cov` suffix.

Signed-off-by: George Dunlap <george.dunlap@xxxxxxxxxx>
Changes in v2:
- Pull 'inputs' to x86_emulate_user* into a make variable to avoid duplication

CC: Ian Jackson <ian.jackson@xxxxxxxxxx>
CC: Wei Liu <wei.liu2@xxxxxxxxxx>
CC: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CC: Jan Beulich <jbeulich@xxxxxxxx>
 .gitignore                                   |  1 +
 tools/fuzz/README.afl                        | 14 ++++++++++++++
 tools/fuzz/x86_instruction_emulator/Makefile | 22 ++++++++++++++++++++--
 3 files changed, 35 insertions(+), 2 deletions(-)

diff --git a/.gitignore b/.gitignore
index cc16649457..5c8ed26b87 100644
--- a/.gitignore
+++ b/.gitignore
@@ -162,6 +162,7 @@ tools/fuzz/libelf/afl-libelf-fuzzer
diff --git a/tools/fuzz/README.afl b/tools/fuzz/README.afl
index 4758de2490..0d955b2687 100644
--- a/tools/fuzz/README.afl
+++ b/tools/fuzz/README.afl
@@ -41,3 +41,17 @@ Use the x86 instruction emulator fuzzer as an example.
    $ $AFLPATH/afl-fuzz -t 1000 -i testcase_dir -o findings_dir -- ./afl-harness
 Please see AFL documentation for more information.
+To use afl-cov or gcov, you need a separate binary instrumented to
+generate coverage data.  To do this, use the target `afl-cov`:
+    $ make afl-cov #produces afl-harness-cov
+NOTE: Please also note that the coverage instrumentation hard-codes
+the absolute path for the instrumentation read and write files in the
+binary; so coverage data will always show up in the build directory no
+matter where you run the binary from.
+Please see afl-cov and/or gcov documentation for more information.
\ No newline at end of file
diff --git a/tools/fuzz/x86_instruction_emulator/Makefile 
index 10009dc08f..4e829dfcbc 100644
--- a/tools/fuzz/x86_instruction_emulator/Makefile
+++ b/tools/fuzz/x86_instruction_emulator/Makefile
@@ -23,19 +23,34 @@ x86_emulate_user.c x86_emulate_user.h: %:
 CFLAGS += $(CFLAGS_xeninclude) -D__XEN_TOOLS__ -I.
 x86.h := asm/x86-vendors.h asm/x86-defns.h asm/msr-index.h
 x86_emulate.h := x86_emulate_user.h x86_emulate/x86_emulate.h $(x86.h)
-x86_emulate_user.o: x86_emulate_user.c x86_emulate/x86_emulate.c 
+X86_EMULATE_INPUTS = x86_emulate_user.c x86_emulate/x86_emulate.c 
+x86_emulate_user.o: $(X86_EMULATE_INPUTS)
+x86_emulate_user-cov.o: $(X86_EMULATE_INPUTS)
+       $(CC) -c $(CFLAGS) $(GCOV_FLAGS) -o $@ x86_emulate_user.c
 fuzz-emul.o: $(x86_emulate.h)
+fuzz-emul-cov.o: fuzz-emul.c $(x86_emulate.h)
+       $(CC) -c $(CFLAGS) $(GCOV_FLAGS) -o $@ fuzz-emul.c
+afl-harness-cov.o: afl-harness.c
+       $(CC) -c $(CFLAGS) $(GCOV_FLAGS) $^ -o $@
 x86-insn-fuzzer.a: fuzz-emul.o x86_emulate_user.o
        $(AR) rc $@ $^
 afl-harness: afl-harness.o fuzz-emul.o x86_emulate_user.o
        $(CC) $(CFLAGS) $^ -o $@
+afl-harness-cov: afl-harness-cov.o fuzz-emul-cov.o x86_emulate_user-cov.o
+       $(CC) $(CFLAGS) $(GCOV_FLAGS) $^ -o $@
 # Common targets
 .PHONY: all
 all: x86-insn-fuzz-all
@@ -46,7 +61,7 @@ distclean: clean
 .PHONY: clean
-       rm -f *.a *.o .*.d afl-harness
+       rm -f *.a *.o .*.d afl-harness afl-harness-cov *.gcda *.gcno *.gcov
 .PHONY: install
 install: all
@@ -55,3 +70,6 @@ install: all
 .PHONY: afl
 afl: afl-harness
+.PHONY: afl-cov
+afl-cov: afl-harness-cov

Xen-devel mailing list



Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.