Block coverage

accel/tcg/cpu-exec.c

@@ -76,7 +76,9 @@ struct vmrange* afl_instr_code;
 abi_ulong    afl_persistent_addr, afl_persistent_ret_addr;
 unsigned int afl_persistent_cnt;
 
-u8 afl_compcov_level;
+unsigned int block_id = 5;
+
+u8 afl_compcov_level, block_cov;
 
 __thread abi_ulong afl_prev_loc;
 

accel/tcg/tcg-runtime.h

@@ -335,6 +335,7 @@ DEF_HELPER_FLAGS_5(gvec_bitsel, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_1(afl_entry_routine, TCG_CALL_NO_RWG, void, env)
 DEF_HELPER_FLAGS_1(afl_persistent_routine, TCG_CALL_NO_RWG, void, env)
 DEF_HELPER_FLAGS_1(afl_maybe_log, TCG_CALL_NO_RWG, void, tl)
+DEF_HELPER_FLAGS_1(afl_maybe_log2, TCG_CALL_NO_RWG, void, tl)
 DEF_HELPER_FLAGS_1(afl_maybe_log_trace, TCG_CALL_NO_RWG, void, tl)
 DEF_HELPER_FLAGS_3(afl_compcov_16, TCG_CALL_NO_RWG, void, tl, tl, tl)
 DEF_HELPER_FLAGS_3(afl_compcov_32, TCG_CALL_NO_RWG, void, tl, tl, tl)

accel/tcg/translate-all.c

@@ -95,6 +95,10 @@ void HELPER(afl_maybe_log)(target_ulong cur_loc) {
   afl_prev_loc = cur_loc >> 1;
 }
 
+void HELPER(afl_maybe_log2)(target_ulong cur_loc) {
+  INC_AFL_AREA(cur_loc);
+}
+
 void HELPER(afl_maybe_log_trace)(target_ulong cur_loc) {
   register uintptr_t afl_idx = cur_loc;
   INC_AFL_AREA(afl_idx);
@@ -122,23 +126,37 @@ static void afl_gen_trace(target_ulong cur_loc) {
      concern. Phew. But instruction addresses may be aligned. Let's mangle
      the value to get something quasi-uniform. */
 
-  // cur_loc = (cur_loc >> 4) ^ (cur_loc << 8);
-  // cur_loc &= MAP_SIZE - 1;
-  cur_loc = (uintptr_t)(afl_hash_ip((uint64_t)cur_loc));
-  cur_loc &= (MAP_SIZE - 1);
+  if (block_cov) {
 
-  /* Implement probabilistic instrumentation by looking at scrambled block
-     address. This keeps the instrumented locations stable across runs. */
+    cur_loc = block_id;
+    ++block_id;
+    if (block_id >= MAP_SIZE) block_id = 5;
 
-  if (cur_loc >= afl_inst_rms) return;
+    TCGv cur_loc_v = tcg_const_tl(cur_loc);
+    gen_helper_afl_maybe_log2(cur_loc_v);
+    tcg_temp_free(cur_loc_v);
 
-  TCGv cur_loc_v = tcg_const_tl(cur_loc);
-  if (unlikely(afl_track_unstable_log_fd() >= 0)) {
-    gen_helper_afl_maybe_log_trace(cur_loc_v);
   } else {
-    gen_helper_afl_maybe_log(cur_loc_v);
+
+    // cur_loc = (cur_loc >> 4) ^ (cur_loc << 8);
+    // cur_loc &= MAP_SIZE - 1;
+    cur_loc = (uintptr_t)(afl_hash_ip((uint64_t)cur_loc));
+    cur_loc &= (MAP_SIZE - 1);
+
+    /* Implement probabilistic instrumentation by looking at scrambled block
+       address. This keeps the instrumented locations stable across runs. */
+
+    if (cur_loc >= afl_inst_rms) return;
+
+    TCGv cur_loc_v = tcg_const_tl(cur_loc);
+    if (unlikely(afl_track_unstable_log_fd() >= 0)) {
+      gen_helper_afl_maybe_log_trace(cur_loc_v);
+    } else {
+      gen_helper_afl_maybe_log(cur_loc_v);
+    }
+    tcg_temp_free(cur_loc_v);
+
   }
-  tcg_temp_free(cur_loc_v);
 
 }
 
@@ -1955,7 +1973,10 @@ TranslationBlock *afl_gen_edge(CPUState *cpu, unsigned long afl_id)
     target_ulong afl_loc = afl_id & (MAP_SIZE -1);
     //*afl_dynamic_size = MAX(*afl_dynamic_size, afl_loc);
     TCGv tmp0 = tcg_const_tl(afl_loc);
-    gen_helper_afl_maybe_log(tmp0);
+    if (block_cov) 
+      gen_helper_afl_maybe_log2(tmp0);
+    else
+      gen_helper_afl_maybe_log(tmp0);
     tcg_temp_free(tmp0);
     tcg_gen_goto_tb(0);
     tcg_gen_exit_tb(tb, 0);

linux-user/elfload.c

@@ -2912,6 +2912,11 @@ static void load_elf_image(const char *image_name, int image_fd,
         load_symbols(ehdr, image_fd, load_bias);
     }
 
+    if (getenv("AFL_QEMU_BLOCK_COV")) {
+      block_cov = 1;
+      block_id = 5;
+    }
+
     if (!afl_exit_point) {
       char *ptr;
       if ((ptr = getenv("AFL_EXITPOINT")) != NULL) {

qemuafl/common.h

@@ -101,6 +101,8 @@ extern abi_ulong       afl_entry_point, afl_exit_point, afl_start_code, afl_end_
 extern abi_ulong       afl_persistent_addr;
 extern abi_ulong       afl_persistent_ret_addr;
 extern u8              afl_compcov_level;
+extern u8              block_cov;
+extern unsigned int    block_id;
 extern unsigned char   afl_fork_child;
 extern unsigned int    afl_forksrv_pid;
 extern unsigned char   is_persistent;