From: George Dunlap <george.dunlap@citrix.com>
To: xen-devel@lists.xenproject.org
Cc: Ian Jackson <ian.jackson@citrix.com>,
Wei Liu <wei.liu2@citrix.com>,
George Dunlap <george.dunlap@citrix.com>,
Jan Beulich <jbeulich@suse.com>,
Andrew Cooper <andrew.cooper3@citrix.com>
Subject: [PATCH v2 07/13] fuzz/x86_emulate: Add 'afl-cov' target
Date: Mon, 25 Sep 2017 15:26:42 +0100 [thread overview]
Message-ID: <20170925142648.25959-7-george.dunlap@citrix.com> (raw)
In-Reply-To: <20170925142648.25959-1-george.dunlap@citrix.com>
...to generate a "normal" coverage-instrumented binary, suitable for
use with gcov or afl-cov.
This is slightly annoying because:
- Every object file needs to have been instrumented to work
effectively
- You generally want to have both an afl-instrumented binary and a
gcov-instrumented binary at the same time, but
- gcov instrumentation and afl instrumentation are mutually exclusive
So when making the `afl-cov` target, generate a second set of object
files and a second binary with the `-cov` suffix.
Signed-off-by: George Dunlap <george.dunlap@citrix.com>
---
Changes in v2:
- Pull 'inputs' to x86_emulate_user* into a make variable to avoid duplication
CC: Ian Jackson <ian.jackson@citrix.com>
CC: Wei Liu <wei.liu2@citrix.com>
CC: Andrew Cooper <andrew.cooper3@citrix.com>
CC: Jan Beulich <jbeulich@suse.com>
---
.gitignore | 1 +
tools/fuzz/README.afl | 14 ++++++++++++++
tools/fuzz/x86_instruction_emulator/Makefile | 22 ++++++++++++++++++++--
3 files changed, 35 insertions(+), 2 deletions(-)
diff --git a/.gitignore b/.gitignore
index cc16649457..5c8ed26b87 100644
--- a/.gitignore
+++ b/.gitignore
@@ -162,6 +162,7 @@ tools/fuzz/libelf/afl-libelf-fuzzer
tools/fuzz/x86_instruction_emulator/asm
tools/fuzz/x86_instruction_emulator/x86_emulate*
tools/fuzz/x86_instruction_emulator/afl-harness
+tools/fuzz/x86_instruction_emulator/afl-harness-cov
tools/helpers/_paths.h
tools/helpers/init-xenstore-domain
tools/helpers/xen-init-dom0
diff --git a/tools/fuzz/README.afl b/tools/fuzz/README.afl
index 4758de2490..0d955b2687 100644
--- a/tools/fuzz/README.afl
+++ b/tools/fuzz/README.afl
@@ -41,3 +41,17 @@ Use the x86 instruction emulator fuzzer as an example.
$ $AFLPATH/afl-fuzz -t 1000 -i testcase_dir -o findings_dir -- ./afl-harness
Please see AFL documentation for more information.
+
+# GENERATING COVERAGE INFORMATION
+
+To use afl-cov or gcov, you need a separate binary instrumented to
+generate coverage data. To do this, use the target `afl-cov`:
+
+ $ make afl-cov #produces afl-harness-cov
+
+NOTE: Please also note that the coverage instrumentation hard-codes
+the absolute path for the instrumentation read and write files in the
+binary; so coverage data will always show up in the build directory no
+matter where you run the binary from.
+
+Please see afl-cov and/or gcov documentation for more information.
\ No newline at end of file
diff --git a/tools/fuzz/x86_instruction_emulator/Makefile b/tools/fuzz/x86_instruction_emulator/Makefile
index 10009dc08f..4e829dfcbc 100644
--- a/tools/fuzz/x86_instruction_emulator/Makefile
+++ b/tools/fuzz/x86_instruction_emulator/Makefile
@@ -23,19 +23,34 @@ x86_emulate_user.c x86_emulate_user.h: %:
CFLAGS += $(CFLAGS_xeninclude) -D__XEN_TOOLS__ -I.
+GCOV_FLAGS=--coverage
+
x86.h := asm/x86-vendors.h asm/x86-defns.h asm/msr-index.h
x86_emulate.h := x86_emulate_user.h x86_emulate/x86_emulate.h $(x86.h)
-x86_emulate_user.o: x86_emulate_user.c x86_emulate/x86_emulate.c $(x86_emulate.h)
+X86_EMULATE_INPUTS = x86_emulate_user.c x86_emulate/x86_emulate.c $(x86_emulate.h)
+x86_emulate_user.o: $(X86_EMULATE_INPUTS)
+
+x86_emulate_user-cov.o: $(X86_EMULATE_INPUTS)
+ $(CC) -c $(CFLAGS) $(GCOV_FLAGS) -o $@ x86_emulate_user.c
fuzz-emul.o: $(x86_emulate.h)
+fuzz-emul-cov.o: fuzz-emul.c $(x86_emulate.h)
+ $(CC) -c $(CFLAGS) $(GCOV_FLAGS) -o $@ fuzz-emul.c
+
+afl-harness-cov.o: afl-harness.c
+ $(CC) -c $(CFLAGS) $(GCOV_FLAGS) $^ -o $@
+
x86-insn-fuzzer.a: fuzz-emul.o x86_emulate_user.o
$(AR) rc $@ $^
afl-harness: afl-harness.o fuzz-emul.o x86_emulate_user.o
$(CC) $(CFLAGS) $^ -o $@
+afl-harness-cov: afl-harness-cov.o fuzz-emul-cov.o x86_emulate_user-cov.o
+ $(CC) $(CFLAGS) $(GCOV_FLAGS) $^ -o $@
+
# Common targets
.PHONY: all
all: x86-insn-fuzz-all
@@ -46,7 +61,7 @@ distclean: clean
.PHONY: clean
clean:
- rm -f *.a *.o .*.d afl-harness
+ rm -f *.a *.o .*.d afl-harness afl-harness-cov *.gcda *.gcno *.gcov
.PHONY: install
install: all
@@ -55,3 +70,6 @@ install: all
.PHONY: afl
afl: afl-harness
+
+.PHONY: afl-cov
+afl-cov: afl-harness-cov
--
2.14.1
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
next prev parent reply other threads:[~2017-09-25 14:27 UTC|newest]
Thread overview: 56+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-09-25 14:26 [PATCH v2 01/13] x86emul/fuzz: add rudimentary limit checking George Dunlap
2017-09-25 14:26 ` [PATCH v2 02/13] fuzz/x86_emulate: Actually use cpu_regs input George Dunlap
2017-10-04 8:21 ` Jan Beulich
2017-09-25 14:26 ` [PATCH v2 03/13] fuzz/x86_emulate: Clear errors after each iteration George Dunlap
2017-10-04 8:22 ` Jan Beulich
2017-09-25 14:26 ` [PATCH v2 04/13] fuzz/x86_emulate: Improve failure descriptions in x86_emulate harness George Dunlap
2017-10-04 8:22 ` Jan Beulich
2017-09-25 14:26 ` [PATCH v2 05/13] fuzz/x86_emulate: Implement input_read() and input_avail() George Dunlap
2017-10-04 8:22 ` Jan Beulich
2017-10-04 16:23 ` George Dunlap
2017-09-25 14:26 ` [PATCH v2 06/13] fuzz/x86_emulate: Rename the file containing the wrapper code George Dunlap
2017-10-04 8:23 ` Jan Beulich
2017-10-04 16:34 ` George Dunlap
2017-10-05 9:01 ` Jan Beulich
2017-10-05 13:50 ` George Dunlap
2017-09-25 14:26 ` George Dunlap [this message]
2017-10-04 8:23 ` [PATCH v2 07/13] fuzz/x86_emulate: Add 'afl-cov' target Jan Beulich
2017-10-04 16:48 ` George Dunlap
2017-10-05 9:06 ` Jan Beulich
2017-09-25 14:26 ` [PATCH v2 08/13] fuzz/x86_emulate: Take multiple test files for inputs George Dunlap
2017-10-04 8:24 ` Jan Beulich
2017-10-04 16:58 ` George Dunlap
2017-10-05 9:08 ` Jan Beulich
2017-09-25 14:26 ` [PATCH v2 09/13] fuzz/x86_emulate: Move all state into fuzz_state George Dunlap
2017-10-04 8:25 ` Jan Beulich
2017-10-04 16:51 ` George Dunlap
2017-09-25 14:26 ` [PATCH v2 10/13] fuzz/x86_emulate: Make input more compact George Dunlap
2017-10-04 8:26 ` Jan Beulich
2017-10-05 15:04 ` George Dunlap
2017-10-05 15:37 ` Jan Beulich
2017-09-25 14:26 ` [PATCH v2 11/13] fuzz/x86_emulate: Add --rerun option to try to track down instability George Dunlap
2017-10-04 8:27 ` Jan Beulich
2017-10-05 16:12 ` George Dunlap
2017-10-06 5:53 ` Jan Beulich
2017-09-25 14:26 ` [PATCH v2 12/13] fuzz/x86_emulate: Set and fuzz more CPU state George Dunlap
2017-10-04 8:28 ` Jan Beulich
2017-10-05 17:08 ` George Dunlap
2017-10-06 6:10 ` Jan Beulich
2017-10-06 10:53 ` George Dunlap
2017-10-06 9:57 ` Jan Beulich
2017-10-06 10:50 ` George Dunlap
2017-10-06 11:53 ` Jan Beulich
2017-10-06 11:56 ` Jan Beulich
2017-10-10 15:45 ` George Dunlap
2017-09-25 14:26 ` [PATCH v2 13/13] fuzz/x86_emulate: Add an option to limit the number of instructions executed George Dunlap
2017-10-04 8:28 ` Jan Beulich
2017-10-06 10:40 ` George Dunlap
2017-10-06 12:12 ` Jan Beulich
2017-10-06 13:02 ` George Dunlap
2017-10-06 15:21 ` [PATCH v2 01/13] x86emul/fuzz: add rudimentary limit checking George Dunlap
2017-10-06 15:54 ` Jan Beulich
2017-10-06 17:06 ` George Dunlap
2017-10-09 7:17 ` Jan Beulich
2017-10-09 12:54 ` Andrew Cooper
2017-10-09 13:26 ` Jan Beulich
2017-10-09 13:35 ` Andrew Cooper
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170925142648.25959-7-george.dunlap@citrix.com \
--to=george.dunlap@citrix.com \
--cc=andrew.cooper3@citrix.com \
--cc=ian.jackson@citrix.com \
--cc=jbeulich@suse.com \
--cc=wei.liu2@citrix.com \
--cc=xen-devel@lists.xenproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.