| diff --git a/include/uc_priv.h b/include/uc_priv.h |
| index 22f494e..1aa7b3a 100644 |
| --- a/include/uc_priv.h |
| +++ b/include/uc_priv.h |
| @@ -245,6 +245,12 @@ struct uc_struct { |
| uint32_t target_page_align; |
| uint64_t next_pc; // save next PC for some special cases |
| bool hook_insert; // insert new hook at begin of the hook list (append by default) |
| + |
| +#ifdef UNICORN_AFL |
| + unsigned char *afl_area_ptr; |
| + int afl_compcov_level; |
| + unsigned int afl_inst_rms; |
| +#endif |
| }; |
| |
| // Metadata stub for the variable-size cpu context used with uc_context_*() |
| diff --git a/qemu/target-arm/translate.c b/qemu/target-arm/translate.c |
| index 4995eda..06c7e63 100644 |
| --- a/qemu/target-arm/translate.c |
| +++ b/qemu/target-arm/translate.c |
| @@ -63,6 +63,12 @@ static TCGv_i64 cpu_exclusive_test; |
| static TCGv_i32 cpu_exclusive_info; |
| #endif |
| |
| +#if defined(UNICORN_AFL) |
| +#include "../../afl-unicorn-cpu-translate-inl.h" |
| +#else |
| +#define afl_gen_compcov(a,b,c,d,e,f) do {} while (0) |
| +#endif |
| + |
| |
| static const char *regnames[] = |
| { "r0", "r1", "r2", "r3", "r4", "r5", "r6", "r7", |
| @@ -8214,6 +8220,7 @@ static void disas_arm_insn(DisasContext *s, unsigned int insn) // qq |
| } else { |
| if (set_cc) { |
| gen_sub_CC(s, tmp, tmp, tmp2); |
| + afl_gen_compcov(tcg_ctx, s->pc, tmp, tmp2, MO_32, insn & (1 << 25)); |
| } else { |
| tcg_gen_sub_i32(tcg_ctx, tmp, tmp, tmp2); |
| } |
| @@ -8223,6 +8230,7 @@ static void disas_arm_insn(DisasContext *s, unsigned int insn) // qq |
| case 0x03: |
| if (set_cc) { |
| gen_sub_CC(s, tmp, tmp2, tmp); |
| + afl_gen_compcov(tcg_ctx, s->pc, tmp, tmp2, MO_32, insn & (1 << 25)); |
| } else { |
| tcg_gen_sub_i32(tcg_ctx, tmp, tmp2, tmp); |
| } |
| @@ -8277,6 +8285,7 @@ static void disas_arm_insn(DisasContext *s, unsigned int insn) // qq |
| case 0x0a: |
| if (set_cc) { |
| gen_sub_CC(s, tmp, tmp, tmp2); |
| + afl_gen_compcov(tcg_ctx, s->pc, tmp, tmp2, MO_32, insn & (1 << 25)); |
| } |
| tcg_temp_free_i32(tcg_ctx, tmp); |
| break; |
| @@ -9148,7 +9157,7 @@ thumb2_logic_op(int op) |
| |
| static int |
| gen_thumb2_data_op(DisasContext *s, int op, int conds, uint32_t shifter_out, |
| - TCGv_i32 t0, TCGv_i32 t1) |
| + TCGv_i32 t0, TCGv_i32 t1, int has_imm) |
| { |
| TCGContext *tcg_ctx = s->uc->tcg_ctx; |
| int logic_cc; |
| @@ -9195,15 +9204,17 @@ gen_thumb2_data_op(DisasContext *s, int op, int conds, uint32_t shifter_out, |
| } |
| break; |
| case 13: /* sub */ |
| - if (conds) |
| + if (conds) { |
| gen_sub_CC(s, t0, t0, t1); |
| - else |
| + afl_gen_compcov(tcg_ctx, s->pc, t0, t1, MO_32, has_imm); |
| + } else |
| tcg_gen_sub_i32(tcg_ctx, t0, t0, t1); |
| break; |
| case 14: /* rsb */ |
| - if (conds) |
| + if (conds) { |
| gen_sub_CC(s, t0, t1, t0); |
| - else |
| + afl_gen_compcov(tcg_ctx, s->pc, t0, t1, MO_32, has_imm); |
| + } else |
| tcg_gen_sub_i32(tcg_ctx, t0, t1, t0); |
| break; |
| default: /* 5, 6, 7, 9, 12, 15. */ |
| @@ -9572,7 +9583,7 @@ static int disas_thumb2_insn(CPUARMState *env, DisasContext *s, uint16_t insn_hw |
| conds = (insn & (1 << 20)) != 0; |
| logic_cc = (conds && thumb2_logic_op(op)); |
| gen_arm_shift_im(s, tmp2, shiftop, shift, logic_cc); |
| - if (gen_thumb2_data_op(s, op, conds, 0, tmp, tmp2)) |
| + if (gen_thumb2_data_op(s, op, conds, 0, tmp, tmp2, insn & (1 << 10))) |
| goto illegal_op; |
| tcg_temp_free_i32(tcg_ctx, tmp2); |
| if (rd != 15) { |
| @@ -10215,7 +10226,7 @@ static int disas_thumb2_insn(CPUARMState *env, DisasContext *s, uint16_t insn_hw |
| } |
| op = (insn >> 21) & 0xf; |
| if (gen_thumb2_data_op(s, op, (insn & (1 << 20)) != 0, |
| - shifter_out, tmp, tmp2)) |
| + shifter_out, tmp, tmp2, insn & (1 << 10))) |
| goto illegal_op; |
| tcg_temp_free_i32(tcg_ctx, tmp2); |
| rd = (insn >> 8) & 0xf; |
| @@ -10471,8 +10482,10 @@ static void disas_thumb_insn(CPUARMState *env, DisasContext *s) // qq |
| if (insn & (1 << 9)) { |
| if (s->condexec_mask) |
| tcg_gen_sub_i32(tcg_ctx, tmp, tmp, tmp2); |
| - else |
| + else { |
| gen_sub_CC(s, tmp, tmp, tmp2); |
| + afl_gen_compcov(tcg_ctx, s->pc, tmp, tmp2, MO_32, insn & (1 << 10)); |
| + } |
| } else { |
| if (s->condexec_mask) |
| tcg_gen_add_i32(tcg_ctx, tmp, tmp, tmp2); |
| @@ -10509,6 +10522,7 @@ static void disas_thumb_insn(CPUARMState *env, DisasContext *s) // qq |
| switch (op) { |
| case 1: /* cmp */ |
| gen_sub_CC(s, tmp, tmp, tmp2); |
| + afl_gen_compcov(tcg_ctx, s->pc, tmp, tmp2, MO_32, 1); |
| tcg_temp_free_i32(tcg_ctx, tmp); |
| tcg_temp_free_i32(tcg_ctx, tmp2); |
| break; |
| @@ -10523,8 +10537,10 @@ static void disas_thumb_insn(CPUARMState *env, DisasContext *s) // qq |
| case 3: /* sub */ |
| if (s->condexec_mask) |
| tcg_gen_sub_i32(tcg_ctx, tmp, tmp, tmp2); |
| - else |
| + else { |
| gen_sub_CC(s, tmp, tmp, tmp2); |
| + afl_gen_compcov(tcg_ctx, s->pc, tmp, tmp2, MO_32, 1); |
| + } |
| tcg_temp_free_i32(tcg_ctx, tmp2); |
| store_reg(s, rd, tmp); |
| break; |
| @@ -10562,6 +10578,7 @@ static void disas_thumb_insn(CPUARMState *env, DisasContext *s) // qq |
| tmp = load_reg(s, rd); |
| tmp2 = load_reg(s, rm); |
| gen_sub_CC(s, tmp, tmp, tmp2); |
| + afl_gen_compcov(tcg_ctx, s->pc, tmp, tmp2, MO_32, 0); |
| tcg_temp_free_i32(tcg_ctx, tmp2); |
| tcg_temp_free_i32(tcg_ctx, tmp); |
| break; |
| @@ -10680,6 +10697,7 @@ static void disas_thumb_insn(CPUARMState *env, DisasContext *s) // qq |
| break; |
| case 0xa: /* cmp */ |
| gen_sub_CC(s, tmp, tmp, tmp2); |
| + afl_gen_compcov(tcg_ctx, s->pc, tmp, tmp2, MO_32, 0); |
| rd = 16; |
| break; |
| case 0xb: /* cmn */ |
| diff --git a/qemu/target-i386/translate.c b/qemu/target-i386/translate.c |
| index 36fae09..196d346 100644 |
| --- a/qemu/target-i386/translate.c |
| +++ b/qemu/target-i386/translate.c |
| @@ -33,6 +33,12 @@ |
| |
| #include "uc_priv.h" |
| |
| +#if defined(UNICORN_AFL) |
| +#include "../../afl-unicorn-cpu-translate-inl.h" |
| +#else |
| +#define afl_gen_compcov(a,b,c,d,e,f) do {} while (0) |
| +#endif |
| + |
| #define PREFIX_REPZ 0x01 |
| #define PREFIX_REPNZ 0x02 |
| #define PREFIX_LOCK 0x04 |
| @@ -1555,6 +1561,7 @@ static void gen_op(DisasContext *s, int op, TCGMemOp ot, int d) |
| case OP_SUBL: |
| tcg_gen_mov_tl(tcg_ctx, cpu_cc_srcT, *cpu_T[0]); |
| tcg_gen_sub_tl(tcg_ctx, *cpu_T[0], *cpu_T[0], *cpu_T[1]); |
| + afl_gen_compcov(tcg_ctx, s->pc, *cpu_T[0], *cpu_T[1], ot, d == OR_EAX); |
| gen_op_st_rm_T0_A0(s, ot, d); |
| gen_op_update2_cc(tcg_ctx); |
| set_cc_op(s, CC_OP_SUBB + ot); |
| @@ -1582,6 +1589,7 @@ static void gen_op(DisasContext *s, int op, TCGMemOp ot, int d) |
| tcg_gen_mov_tl(tcg_ctx, cpu_cc_src, *cpu_T[1]); |
| tcg_gen_mov_tl(tcg_ctx, cpu_cc_srcT, *cpu_T[0]); |
| tcg_gen_sub_tl(tcg_ctx, cpu_cc_dst, *cpu_T[0], *cpu_T[1]); |
| + afl_gen_compcov(tcg_ctx, s->pc, *cpu_T[0], *cpu_T[1], ot, d == OR_EAX); |
| set_cc_op(s, CC_OP_SUBB + ot); |
| break; |
| } |
| diff --git a/qemu/tcg-runtime.c b/qemu/tcg-runtime.c |
| index 21b022a..14d7891 100644 |
| --- a/qemu/tcg-runtime.c |
| +++ b/qemu/tcg-runtime.c |
| @@ -31,9 +31,14 @@ |
| |
| #define DEF_HELPER_FLAGS_2(name, flags, ret, t1, t2) \ |
| dh_ctype(ret) HELPER(name) (dh_ctype(t1), dh_ctype(t2)); |
| +#define DEF_HELPER_FLAGS_4(name, flags, ret, t1, t2, t3, t4) \ |
| + dh_ctype(ret) HELPER(name) (dh_ctype(t1), dh_ctype(t2), dh_ctype(t3), dh_ctype(t4)); |
| |
| #include "tcg-runtime.h" |
| |
| +#ifdef UNICORN_AFL |
| +#include "../afl-unicorn-tcg-runtime-inl.h" |
| +#endif |
| |
| /* 32-bit helpers */ |
| |
| diff --git a/qemu/tcg/tcg-op.h b/qemu/tcg/tcg-op.h |
| index 38b7dd9..c5a9af9 100644 |
| --- a/qemu/tcg/tcg-op.h |
| +++ b/qemu/tcg/tcg-op.h |
| @@ -27,6 +27,10 @@ |
| |
| int gen_new_label(TCGContext *); |
| |
| +#ifdef UNICORN_AFL |
| +#include "../../afl-unicorn-tcg-op-inl.h" |
| +#endif |
| + |
| static inline void gen_uc_tracecode(TCGContext *tcg_ctx, int32_t size, int32_t type, void *uc, uint64_t pc) |
| { |
| TCGv_i32 tsize = tcg_const_i32(tcg_ctx, size); |
| diff --git a/qemu/tcg/tcg-runtime.h b/qemu/tcg/tcg-runtime.h |
| index 23a0c37..90b993c 100644 |
| --- a/qemu/tcg/tcg-runtime.h |
| +++ b/qemu/tcg/tcg-runtime.h |
| @@ -14,3 +14,9 @@ DEF_HELPER_FLAGS_2(sar_i64, TCG_CALL_NO_RWG_SE, s64, s64, s64) |
| |
| DEF_HELPER_FLAGS_2(mulsh_i64, TCG_CALL_NO_RWG_SE, s64, s64, s64) |
| DEF_HELPER_FLAGS_2(muluh_i64, TCG_CALL_NO_RWG_SE, i64, i64, i64) |
| + |
| +#ifdef UNICORN_AFL |
| +DEF_HELPER_FLAGS_4(afl_compcov_log_16, 0, void, ptr, i64, i64, i64) |
| +DEF_HELPER_FLAGS_4(afl_compcov_log_32, 0, void, ptr, i64, i64, i64) |
| +DEF_HELPER_FLAGS_4(afl_compcov_log_64, 0, void, ptr, i64, i64, i64) |
| +#endif |
| diff --git a/qemu/unicorn_common.h b/qemu/unicorn_common.h |
| index 8dcbb3e..11e18b4 100644 |
| --- a/qemu/unicorn_common.h |
| +++ b/qemu/unicorn_common.h |
| @@ -84,6 +84,10 @@ static inline void uc_common_init(struct uc_struct* uc) |
| |
| if (!uc->release) |
| uc->release = release_common; |
| + |
| +#ifdef UNICORN_AFL |
| + uc->afl_area_ptr = 0; |
| +#endif |
| } |
| |
| #endif |
