From 02a7745410bfd40246c72fb693e9c2f3bcf2e3ad Mon Sep 17 00:00:00 2001 From: George Dunlap Date: Wed, 11 Oct 2017 18:49:41 +0100 Subject: [PATCH] fuzz/x86_emulate: Add 'afl-cov' target ...to generate a "normal" coverage-instrumented binary, suitable for use with gcov or afl-cov. This is slightly annoying because: - Every object file needs to have been instrumented to work effectively - You generally want to have both an afl-instrumented binary and a gcov-instrumented binary at the same time, but - gcov instrumentation and afl instrumentation are mutually exclusive So when making the `afl-cov` target, generate a second set of object files and a second binary with the `-cov` suffix. While we're here, remove the redundant x86-emulate.c dependency for x86-emulate.o. Signed-off-by: George Dunlap Acked-by: Andrew Cooper --- .gitignore | 1 + tools/fuzz/README.afl | 14 ++++++++++++++ tools/fuzz/x86_instruction_emulator/Makefile | 17 ++++++++++++++--- 3 files changed, 29 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index b3587f3809..d64b03d06c 100644 --- a/.gitignore +++ b/.gitignore @@ -166,6 +166,7 @@ tools/fuzz/x86_instruction_emulator/asm tools/fuzz/x86_instruction_emulator/x86_emulate tools/fuzz/x86_instruction_emulator/x86-emulate.[ch] tools/fuzz/x86_instruction_emulator/afl-harness +tools/fuzz/x86_instruction_emulator/afl-harness-cov tools/helpers/_paths.h tools/helpers/init-xenstore-domain tools/helpers/xen-init-dom0 diff --git a/tools/fuzz/README.afl b/tools/fuzz/README.afl index 4758de2490..8b58b8cdea 100644 --- a/tools/fuzz/README.afl +++ b/tools/fuzz/README.afl @@ -41,3 +41,17 @@ Use the x86 instruction emulator fuzzer as an example. $ $AFLPATH/afl-fuzz -t 1000 -i testcase_dir -o findings_dir -- ./afl-harness Please see AFL documentation for more information. + +# GENERATING COVERAGE INFORMATION + +To use afl-cov or gcov, you need a separate binary instrumented to +generate coverage data. To do this, use the target `afl-cov`: + + $ make afl-cov #produces afl-harness-cov + +NOTE: Please also note that the coverage instrumentation hard-codes +the absolute path for the instrumentation read and write files in the +binary; so coverage data will always show up in the build directory no +matter where you run the binary from. + +Please see afl-cov and/or gcov documentation for more information. diff --git a/tools/fuzz/x86_instruction_emulator/Makefile b/tools/fuzz/x86_instruction_emulator/Makefile index 107bf62a21..cb561aec3f 100644 --- a/tools/fuzz/x86_instruction_emulator/Makefile +++ b/tools/fuzz/x86_instruction_emulator/Makefile @@ -23,12 +23,17 @@ x86-emulate.c x86-emulate.h: %: CFLAGS += $(CFLAGS_xeninclude) -D__XEN_TOOLS__ -I. +GCOV_FLAGS := --coverage +%-cov.o: %.c + $(CC) -c $(CFLAGS) $(GCOV_FLAGS) $< -o $@ + x86.h := asm/x86-vendors.h asm/x86-defns.h asm/msr-index.h x86_emulate.h := x86-emulate.h x86_emulate/x86_emulate.h $(x86.h) -x86-emulate.o: x86-emulate.c x86_emulate/x86_emulate.c $(x86_emulate.h) +# x86-emulate.c will be implicit for both +x86-emulate.o x86-emulate-cov.o: x86_emulate/x86_emulate.c $(x86_emulate.h) -fuzz-emul.o: $(x86_emulate.h) +fuzz-emul.o fuzz-emulate-cov.o: $(x86_emulate.h) x86-insn-fuzzer.a: fuzz-emul.o x86-emulate.o $(AR) rc $@ $^ @@ -36,6 +41,9 @@ x86-insn-fuzzer.a: fuzz-emul.o x86-emulate.o afl-harness: afl-harness.o fuzz-emul.o x86-emulate.o $(CC) $(CFLAGS) $^ -o $@ +afl-harness-cov: afl-harness-cov.o fuzz-emul-cov.o x86-emulate-cov.o + $(CC) $(CFLAGS) $(GCOV_FLAGS) $^ -o $@ + # Common targets .PHONY: all all: x86-insn-fuzz-all @@ -46,7 +54,7 @@ distclean: clean .PHONY: clean clean: - rm -f *.a *.o .*.d afl-harness + rm -f *.a *.o .*.d afl-harness afl-harness-cov *.gcda *.gcno *.gcov .PHONY: install install: all @@ -55,3 +63,6 @@ install: all .PHONY: afl afl: afl-harness + +.PHONY: afl-cov +afl-cov: afl-harness-cov -- 2.30.2