new snapshot api

2 files changed, 55 insertions, 10 deletions

diff --git a/include/snapshot-inl.h b/include/snapshot-inl.h
index b73a001e..55251db5 100644
--- a/include/snapshot-inl.h
+++ b/include/snapshot-inl.h
@@ -25,35 +25,80 @@
 // From AFL-Snapshot-LKM/include/afl_snapshot.h (must be kept synced)
 
 #include <sys/ioctl.h>
-#include <sys/types.h>
-#include <sys/stat.h>
+#include <stdlib.h>
 #include <fcntl.h>
 
 #define AFL_SNAPSHOT_FILE_NAME "/dev/afl_snapshot"
 
 #define AFL_SNAPSHOT_IOCTL_MAGIC 44313
 
-#define AFL_SNAPSHOT_IOCTL_DO _IO(AFL_SNAPSHOT_IOCTL_MAGIC, 1)
-#define AFL_SNAPSHOT_IOCTL_CLEAN _IO(AFL_SNAPSHOT_IOCTL_MAGIC, 2)
+#define AFL_SNAPSHOT_EXCLUDE_VMRANGE _IOR(AFL_SNAPSHOT_IOCTL_MAGIC, 1, struct afl_snapshot_vmrange_args*)
+#define AFL_SNAPSHOT_INCLUDE_VMRANGE _IOR(AFL_SNAPSHOT_IOCTL_MAGIC, 2, struct afl_snapshot_vmrange_args*)
+#define AFL_SNAPSHOT_IOCTL_TAKE      _IOR(AFL_SNAPSHOT_IOCTL_MAGIC, 3, int)
+#define AFL_SNAPSHOT_IOCTL_RESTORE   _IO(AFL_SNAPSHOT_IOCTL_MAGIC, 4)
+#define AFL_SNAPSHOT_IOCTL_CLEAN     _IO(AFL_SNAPSHOT_IOCTL_MAGIC, 5)
+
+// Trace new mmaped ares and unmap them on restore.
+#define AFL_SNAPSHOT_MMAP  1
+// Do not snapshot any page (by default all writeable not-shared pages
+// are shanpshotted.
+#define AFL_SNAPSHOT_BLOCK 2
+// Snapshot file descriptor state, close newly opened descriptors
+#define AFL_SNAPSHOT_FDS   4
+// Snapshot registers state
+#define AFL_SNAPSHOT_REGS  8
+// Perform a restore when exit_group is invoked
+#define AFL_SNAPSHOT_EXIT  16
+// TODO(andrea) allow not COW snapshots (high perf on small processes)
+// Disable COW, restore all the snapshotted pages
+#define AFL_SNAPSHOT_NOCOW 32
+// Do not snapshot Stack pages
+#define AFL_SNAPSHOT_NOSTACK 64
+
+struct afl_snapshot_vmrange_args {
+
+  unsigned long start, end;
+
+};
 
 static int afl_snapshot_dev_fd;
 
-static int afl_snapshot_init(void) {
+static int afl_snapshot_init() {
 
   afl_snapshot_dev_fd = open(AFL_SNAPSHOT_FILE_NAME, 0);
   return afl_snapshot_dev_fd;
 
 }
 
-static int afl_snapshot_do() {
+static void afl_snapshot_exclude_vmrange(void* start, void* end) {
 
-  return ioctl(afl_snapshot_dev_fd, AFL_SNAPSHOT_IOCTL_DO);
+  struct afl_snapshot_vmrange_args args = {(unsigned long)start, (unsigned long)end};
+  ioctl(afl_snapshot_dev_fd, AFL_SNAPSHOT_EXCLUDE_VMRANGE, &args);
 
 }
 
-static int afl_snapshot_clean(void) {
+static void afl_snapshot_include_vmrange(void* start, void* end) {
 
-  return ioctl(afl_snapshot_dev_fd, AFL_SNAPSHOT_IOCTL_CLEAN);
+  struct afl_snapshot_vmrange_args args = {(unsigned long)start, (unsigned long)end};
+  ioctl(afl_snapshot_dev_fd, AFL_SNAPSHOT_INCLUDE_VMRANGE, &args);
+
+}
+
+static int afl_snapshot_take(int config) {
+
+  return ioctl(afl_snapshot_dev_fd, AFL_SNAPSHOT_IOCTL_TAKE, config);
+
+}
+
+static void afl_snapshot_restore(void) {
+
+  ioctl(afl_snapshot_dev_fd, AFL_SNAPSHOT_IOCTL_RESTORE);
+
+}
+
+static void afl_snapshot_clean(void) {
+
+  ioctl(afl_snapshot_dev_fd, AFL_SNAPSHOT_IOCTL_CLEAN);
 
 }
 
diff --git a/llvm_mode/afl-llvm-rt.o.c b/llvm_mode/afl-llvm-rt.o.c
index a2038188..25be0d5a 100644
--- a/llvm_mode/afl-llvm-rt.o.c
+++ b/llvm_mode/afl-llvm-rt.o.c
@@ -521,7 +521,7 @@ static void __afl_start_snapshots(void) {
         close(FORKSRV_FD);
         close(FORKSRV_FD + 1);
 
-        if (!afl_snapshot_do()) { raise(SIGSTOP); }
+        if (!afl_snapshot_take(AFL_SNAPSHOT_MMAP | AFL_SNAPSHOT_FDS | AFL_SNAPSHOT_REGS | AFL_SNAPSHOT_EXIT)) { raise(SIGSTOP); }
 
         __afl_area_ptr[0] = 1;
         memset(__afl_prev_loc, 0, NGRAM_SIZE_MAX * sizeof(PREV_LOC_T));