split up __afl_manual_init, added internal AFL_DISABLE_LLVM_INSTRUMENTATION, skipping ctor+ifunc functions for all llvm, code-format

13 files changed, 203 insertions, 203 deletions

diff --git a/TODO.md b/TODO.md
index e81b82a3..f8ef0e0f 100644
--- a/TODO.md
+++ b/TODO.md
@@ -4,6 +4,8 @@
 
  - AFL_MAP_SIZE for qemu_mode and unicorn_mode
  - CPU affinity for many cores? There seems to be an issue > 96 cores
+ - feature for afl-showmap to generate the coverage for all queue entries
+ - afl-plot to support multiple plot_data
 
 ## Further down the road
 
diff --git a/docs/Changelog.md b/docs/Changelog.md
index edcdac58..1c5b3f4a 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -29,9 +29,9 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
      - added neverzero counting to trace-pc/pcgard
      - fixes for laf-intel float splitting (thanks to mark-griffin for
        reporting)
+     - skipping ctors and ifuncs for instrumentation
      - LTO: switch default to the dynamic memory map, set AFL_LLVM_MAP_ADDR
             for a fixed map address (eg. 0x10000)
-     - LTO: skipping ctors and ifuncs in fix map address instrumentation
      - LTO: autodictionary mode is a default
      - LTO: instrim instrumentation disabled, only classic support used
             as it is always better
diff --git a/examples/aflpp_driver/aflpp_driver.c b/examples/aflpp_driver/aflpp_driver.c
index 7d388799..b764338e 100644
--- a/examples/aflpp_driver/aflpp_driver.c
+++ b/examples/aflpp_driver/aflpp_driver.c
@@ -109,7 +109,6 @@ If 1, close stdout at startup. If 2 close stderr; if 3 close both.
 int                   __afl_sharedmem_fuzzing = 1;
 extern unsigned int * __afl_fuzz_len;
 extern unsigned char *__afl_fuzz_ptr;
-extern unsigned char *__afl_area_ptr;
 // extern struct cmp_map *__afl_cmp_map;
 
 // libFuzzer interface is thin, so we don't include any libFuzzer headers.
@@ -248,28 +247,8 @@ static int ExecuteFilesOnyByOne(int argc, char **argv) {
 
 }
 
-__attribute__((constructor(1))) void __afl_protect(void) {
-
-  setenv("__AFL_DEFER_FORKSRV", "1", 1);
-  __afl_area_ptr = (unsigned char *)mmap(
-      (void *)0x10000, MAX_DUMMY_SIZE, PROT_READ | PROT_WRITE,
-      MAP_FIXED_NOREPLACE | MAP_SHARED | MAP_ANONYMOUS, -1, 0);
-  if ((uint64_t)__afl_area_ptr == -1)
-    __afl_area_ptr = (unsigned char *)mmap((void *)0x10000, MAX_DUMMY_SIZE,
-                                           PROT_READ | PROT_WRITE,
-                                           MAP_SHARED | MAP_ANONYMOUS, -1, 0);
-  if ((uint64_t)__afl_area_ptr == -1)
-    __afl_area_ptr =
-        (unsigned char *)mmap(NULL, MAX_DUMMY_SIZE, PROT_READ | PROT_WRITE,
-                              MAP_SHARED | MAP_ANONYMOUS, -1, 0);
-  // __afl_cmp_map = (struct cmp_map *)__afl_area_ptr;
-
-}
-
 int main(int argc, char **argv) {
 
-  fprintf(stderr, "dummy map is at %p\n", __afl_area_ptr);
-
   printf(
       "======================= INFO =========================\n"
       "This binary is built for afl++.\n"
@@ -307,8 +286,6 @@ int main(int argc, char **argv) {
   else if (argc > 1) {
 
     __afl_sharedmem_fuzzing = 0;
-    munmap(__afl_area_ptr, MAX_DUMMY_SIZE);  // we need to free 0x10000
-    __afl_area_ptr = NULL;
     __afl_manual_init();
     return ExecuteFilesOnyByOne(argc, argv);
 
@@ -317,8 +294,6 @@ int main(int argc, char **argv) {
   assert(N > 0);
 
   //  if (!getenv("AFL_DRIVER_DONT_DEFER"))
-  munmap(__afl_area_ptr, MAX_DUMMY_SIZE);
-  __afl_area_ptr = NULL;
   __afl_manual_init();
 
   // Call LLVMFuzzerTestOneInput here so that coverage caused by initialization
diff --git a/examples/aflpp_driver/aflpp_driver_test.c b/examples/aflpp_driver/aflpp_driver_test.c
index e4567bbf..ddc3effb 100644
--- a/examples/aflpp_driver/aflpp_driver_test.c
+++ b/examples/aflpp_driver/aflpp_driver_test.c
@@ -4,6 +4,16 @@
 
 #include "hash.h"
 
+void __attribute__((noinline)) crashme(const uint8_t *Data, size_t Size) {
+
+  if (Data[0] == 'F')
+    if (Data[1] == 'A')
+      if (Data[2] == '$')
+        if (Data[3] == '$')
+          if (Data[4] == '$') abort();
+
+}
+
 int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
 
   fprintf(stderr, "FUNC crc: %016llx len: %lu\n",
@@ -13,11 +23,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
 
   if (Size < 5) return 0;
 
-  if (Data[0] == 'F')
-    if (Data[1] == 'A')
-      if (Data[2] == '$')
-        if (Data[3] == '$')
-          if (Data[4] == '$') abort();
+  crashme(Data, Size);
 
   return 0;
 
diff --git a/llvm_mode/LLVMInsTrim.so.cc b/llvm_mode/LLVMInsTrim.so.cc
index 4d8c4719..2ad7f171 100644
--- a/llvm_mode/LLVMInsTrim.so.cc
+++ b/llvm_mode/LLVMInsTrim.so.cc
@@ -256,6 +256,8 @@ struct InsTrim : public ModulePass {
     u64 total_rs = 0;
     u64 total_hs = 0;
 
+    scanForDangerousFunctions(&M);
+
     for (Function &F : M) {
 
       if (debug) {
diff --git a/llvm_mode/afl-llvm-common.cc b/llvm_mode/afl-llvm-common.cc
index 0b50c547..f12bbe31 100644
--- a/llvm_mode/afl-llvm-common.cc
+++ b/llvm_mode/afl-llvm-common.cc
@@ -67,8 +67,11 @@ bool isIgnoreFunction(const llvm::Function *F) {
       "__libc_csu",
       "__asan",
       "__msan",
+      "__cmplog",
+      "__sancov",
       "msan.",
       "LLVMFuzzer",
+      "__decide_deferred",
       "maybe_duplicate_stderr",
       "discard_output",
       "close_stdout",
@@ -253,21 +256,93 @@ void initInstrumentList() {
 
 }
 
+void scanForDangerousFunctions(llvm::Module *M) {
+
+  if (!M) return;
+
+  for (GlobalIFunc &IF : M->ifuncs()) {
+
+    StringRef ifunc_name = IF.getName();
+    Constant *r = IF.getResolver();
+    StringRef r_name = cast<Function>(r->getOperand(0))->getName();
+    if (!be_quiet)
+      fprintf(stderr,
+              "Info: Found an ifunc with name %s that points to resolver "
+              "function %s, we will not instrument this, putting it into the "
+              "block list.\n",
+              ifunc_name.str().c_str(), r_name.str().c_str());
+    denyListFunctions.push_back(r_name.str());
+
+  }
+
+  GlobalVariable *GV = M->getNamedGlobal("llvm.global_ctors");
+  if (GV && !GV->isDeclaration() && !GV->hasLocalLinkage()) {
+
+    ConstantArray *InitList = dyn_cast<ConstantArray>(GV->getInitializer());
+
+    if (InitList) {
+
+      for (unsigned i = 0, e = InitList->getNumOperands(); i != e; ++i) {
+
+        if (ConstantStruct *CS =
+                dyn_cast<ConstantStruct>(InitList->getOperand(i))) {
+
+          if (CS->getNumOperands() >= 2) {
+
+            if (CS->getOperand(1)->isNullValue())
+              break;  // Found a null terminator, stop here.
+
+            ConstantInt *CI = dyn_cast<ConstantInt>(CS->getOperand(0));
+            int          Priority = CI ? CI->getSExtValue() : 0;
+
+            Constant *FP = CS->getOperand(1);
+            if (ConstantExpr *CE = dyn_cast<ConstantExpr>(FP))
+              if (CE->isCast()) FP = CE->getOperand(0);
+            if (Function *F = dyn_cast<Function>(FP)) {
+
+              if (!F->isDeclaration() &&
+                  strncmp(F->getName().str().c_str(), "__afl", 5) != 0) {
+
+                if (!be_quiet)
+                  fprintf(stderr,
+                          "Info: Found constructor function %s with prio "
+                          "%u, we will not instrument this, putting it into a "
+                          "block list.\n",
+                          F->getName().str().c_str(), Priority);
+                denyListFunctions.push_back(F->getName().str());
+
+              }
+
+            }
+
+          }
+
+        }
+
+      }
+
+    }
+
+  }
+
+}
+
 bool isInInstrumentList(llvm::Function *F) {
 
+  bool return_default = true;
+
   // is this a function with code? If it is external we dont instrument it
   // anyway and cant be in the the instrument file list. Or if it is ignored.
   if (!F->size() || isIgnoreFunction(F)) return false;
 
-  // if we do not have a the instrument file list return true
-  if (!allowListFiles.empty() || !allowListFunctions.empty()) {
+  if (!denyListFiles.empty() || !denyListFunctions.empty()) {
 
-    if (!allowListFunctions.empty()) {
+    if (!denyListFunctions.empty()) {
 
       std::string instFunction = F->getName().str();
 
-      for (std::list<std::string>::iterator it = allowListFunctions.begin();
-           it != allowListFunctions.end(); ++it) {
+      for (std::list<std::string>::iterator it = denyListFunctions.begin();
+           it != denyListFunctions.end(); ++it) {
 
         /* We don't check for filename equality here because
          * filenames might actually be full paths. Instead we
@@ -281,10 +356,10 @@ bool isInInstrumentList(llvm::Function *F) {
 
             if (debug)
               SAYF(cMGN "[D] " cRST
-                        "Function %s is in the allow function list, "
-                        "instrumenting ... \n",
+                        "Function %s is in the deny function list, "
+                        "not instrumenting ... \n",
                    instFunction.c_str());
-            return true;
+            return false;
 
           }
 
@@ -294,7 +369,7 @@ bool isInInstrumentList(llvm::Function *F) {
 
     }
 
-    if (!allowListFiles.empty()) {
+    if (!denyListFiles.empty()) {
 
       // let's try to get the filename for the function
       auto                 bb = &F->getEntryBlock();
@@ -328,8 +403,8 @@ bool isInInstrumentList(llvm::Function *F) {
         /* Continue only if we know where we actually are */
         if (!instFilename.str().empty()) {
 
-          for (std::list<std::string>::iterator it = allowListFiles.begin();
-               it != allowListFiles.end(); ++it) {
+          for (std::list<std::string>::iterator it = denyListFiles.begin();
+               it != denyListFiles.end(); ++it) {
 
             /* We don't check for filename equality here because
              * filenames might actually be full paths. Instead we
@@ -344,10 +419,10 @@ bool isInInstrumentList(llvm::Function *F) {
 
                 if (debug)
                   SAYF(cMGN "[D] " cRST
-                            "Function %s is in the allowlist (%s), "
+                            "Function %s is in the denylist (%s), not "
                             "instrumenting ... \n",
                        F->getName().str().c_str(), instFilename.str().c_str());
-                return true;
+                return false;
 
               }
 
@@ -359,8 +434,6 @@ bool isInInstrumentList(llvm::Function *F) {
 
       }
 
-    }
-
 #else
       if (!Loc.isUnknown()) {
 
@@ -373,8 +446,8 @@ bool isInInstrumentList(llvm::Function *F) {
         /* Continue only if we know where we actually are */
         if (!instFilename.str().empty()) {
 
-          for (std::list<std::string>::iterator it = allowListFiles.begin();
-               it != allowListFiles.end(); ++it) {
+          for (std::list<std::string>::iterator it = denyListFiles.begin();
+               it != denyListFiles.end(); ++it) {
 
             /* We don't check for filename equality here because
              * filenames might actually be full paths. Instead we
@@ -387,7 +460,7 @@ bool isInInstrumentList(llvm::Function *F) {
               if (fnmatch(("*" + *it).c_str(), instFilename.str().c_str(), 0) ==
                   0) {
 
-                return true;
+                return false;
 
               }
 
@@ -399,34 +472,34 @@ bool isInInstrumentList(llvm::Function *F) {
 
       }
 
-    }
-
 #endif
-    else {
+      else {
 
-      // we could not find out the location. in this case we say it is not
-      // in the the instrument file list
-      if (!be_quiet)
-        WARNF(
-            "No debug information found for function %s, will not be "
-            "instrumented (recompile with -g -O[1-3]).",
-            F->getName().str().c_str());
-      return false;
+        // we could not find out the location. in this case we say it is not
+        // in the the instrument file list
+        if (!be_quiet)
+          WARNF(
+              "No debug information found for function %s, will be "
+              "instrumented (recompile with -g -O[1-3]).",
+              F->getName().str().c_str());
 
-    }
+      }
 
-    return false;
+    }
 
   }
 
-  if (!denyListFiles.empty() || !denyListFunctions.empty()) {
+  // if we do not have a the instrument file list return true
+  if (!allowListFiles.empty() || !allowListFunctions.empty()) {
 
-    if (!denyListFunctions.empty()) {
+    return_default = false;
+
+    if (!allowListFunctions.empty()) {
 
       std::string instFunction = F->getName().str();
 
-      for (std::list<std::string>::iterator it = denyListFunctions.begin();
-           it != denyListFunctions.end(); ++it) {
+      for (std::list<std::string>::iterator it = allowListFunctions.begin();
+           it != allowListFunctions.end(); ++it) {
 
         /* We don't check for filename equality here because
          * filenames might actually be full paths. Instead we
@@ -440,10 +513,10 @@ bool isInInstrumentList(llvm::Function *F) {
 
             if (debug)
               SAYF(cMGN "[D] " cRST
-                        "Function %s is in the deny function list, "
-                        "not instrumenting ... \n",
+                        "Function %s is in the allow function list, "
+                        "instrumenting ... \n",
                    instFunction.c_str());
-            return false;
+            return true;
 
           }
 
@@ -453,7 +526,7 @@ bool isInInstrumentList(llvm::Function *F) {
 
     }
 
-    if (!denyListFiles.empty()) {
+    if (!allowListFiles.empty()) {
 
       // let's try to get the filename for the function
       auto                 bb = &F->getEntryBlock();
@@ -487,8 +560,8 @@ bool isInInstrumentList(llvm::Function *F) {
         /* Continue only if we know where we actually are */
         if (!instFilename.str().empty()) {
 
-          for (std::list<std::string>::iterator it = denyListFiles.begin();
-               it != denyListFiles.end(); ++it) {
+          for (std::list<std::string>::iterator it = allowListFiles.begin();
+               it != allowListFiles.end(); ++it) {
 
             /* We don't check for filename equality here because
              * filenames might actually be full paths. Instead we
@@ -503,10 +576,10 @@ bool isInInstrumentList(llvm::Function *F) {
 
                 if (debug)
                   SAYF(cMGN "[D] " cRST
-                            "Function %s is in the denylist (%s), not "
+                            "Function %s is in the allowlist (%s), "
                             "instrumenting ... \n",
                        F->getName().str().c_str(), instFilename.str().c_str());
-                return false;
+                return true;
 
               }
 
@@ -518,22 +591,20 @@ bool isInInstrumentList(llvm::Function *F) {
 
       }
 
-    }
-
 #else
       if (!Loc.isUnknown()) {
 
         DILocation cDILoc(Loc.getAsMDNode(F->getContext()));
 
         unsigned int instLine = cDILoc.getLineNumber();
-        StringRef instFilename = cDILoc.getFilename();
+        StringRef    instFilename = cDILoc.getFilename();
 
         (void)instLine;
         /* Continue only if we know where we actually are */
         if (!instFilename.str().empty()) {
 
-          for (std::list<std::string>::iterator it = denyListFiles.begin();
-               it != denyListFiles.end(); ++it) {
+          for (std::list<std::string>::iterator it = allowListFiles.begin();
+               it != allowListFiles.end(); ++it) {
 
             /* We don't check for filename equality here because
              * filenames might actually be full paths. Instead we
@@ -546,7 +617,7 @@ bool isInInstrumentList(llvm::Function *F) {
               if (fnmatch(("*" + *it).c_str(), instFilename.str().c_str(), 0) ==
                   0) {
 
-                return false;
+                return true;
 
               }
 
@@ -558,27 +629,25 @@ bool isInInstrumentList(llvm::Function *F) {
 
       }
 
-    }
-
 #endif
-    else {
+      else {
 
-      // we could not find out the location. in this case we say it is not
-      // in the the instrument file list
-      if (!be_quiet)
-        WARNF(
-            "No debug information found for function %s, will be "
-            "instrumented (recompile with -g -O[1-3]).",
-            F->getName().str().c_str());
-      return true;
+        // we could not find out the location. in this case we say it is not
+        // in the the instrument file list
+        if (!be_quiet)
+          WARNF(
+              "No debug information found for function %s, will not be "
+              "instrumented (recompile with -g -O[1-3]).",
+              F->getName().str().c_str());
+        return false;
 
-    }
+      }
 
-    return true;
+    }
 
   }
 
-  return true;  // not reached
+  return return_default;
 
 }
 
diff --git a/llvm_mode/afl-llvm-common.h b/llvm_mode/afl-llvm-common.h
index 5b96be43..a1561d9c 100644
--- a/llvm_mode/afl-llvm-common.h
+++ b/llvm_mode/afl-llvm-common.h
@@ -37,6 +37,7 @@ bool                   isIgnoreFunction(const llvm::Function *F);
 void                   initInstrumentList();
 bool                   isInInstrumentList(llvm::Function *F);
 unsigned long long int calculateCollisions(uint32_t edges);
+void                   scanForDangerousFunctions(llvm::Module *M);
 
 #ifndef IS_EXTERN
   #define IS_EXTERN
diff --git a/llvm_mode/afl-llvm-lto-instrumentation.so.cc b/llvm_mode/afl-llvm-lto-instrumentation.so.cc
index fd8e48a7..6bd232ab 100644
--- a/llvm_mode/afl-llvm-lto-instrumentation.so.cc
+++ b/llvm_mode/afl-llvm-lto-instrumentation.so.cc
@@ -217,79 +217,9 @@ bool AFLLTOPass::runOnModule(Module &M) {
 
   }
 
-    */
-
-  std::vector<std::string> module_block_list;
-
-  if (map_addr) {
-
-    for (GlobalIFunc &IF : M.ifuncs()) {
-
-      StringRef ifunc_name = IF.getName();
-      Constant *r = IF.getResolver();
-      StringRef r_name = cast<Function>(r->getOperand(0))->getName();
-      if (!be_quiet)
-        fprintf(stderr,
-                "Warning: Found an ifunc with name %s that points to resolver "
-                "function %s, we cannot instrument this, putting it into a "
-                "block list.\n",
-                ifunc_name.str().c_str(), r_name.str().c_str());
-      module_block_list.push_back(r_name.str());
-
-    }
-
-    GlobalVariable *GV = M.getNamedGlobal("llvm.global_ctors");
-    if (GV && !GV->isDeclaration() && !GV->hasLocalLinkage()) {
-
-      ConstantArray *InitList = dyn_cast<ConstantArray>(GV->getInitializer());
-
-      if (InitList) {
-
-        for (unsigned i = 0, e = InitList->getNumOperands(); i != e; ++i) {
-
-          if (ConstantStruct *CS =
-                  dyn_cast<ConstantStruct>(InitList->getOperand(i))) {
-
-            if (CS->getNumOperands() >= 2) {
-
-              if (CS->getOperand(1)->isNullValue())
-                break;  // Found a null terminator, stop here.
-
-              ConstantInt *CI = dyn_cast<ConstantInt>(CS->getOperand(0));
-              int          Priority = CI ? CI->getSExtValue() : 0;
-
-              Constant *FP = CS->getOperand(1);
-              if (ConstantExpr *CE = dyn_cast<ConstantExpr>(FP))
-                if (CE->isCast()) FP = CE->getOperand(0);
-              if (Function *F = dyn_cast<Function>(FP)) {
-
-                if (!F->isDeclaration() &&
-                    strncmp(F->getName().str().c_str(), "__afl", 5) != 0 &&
-                    Priority <= 5) {
-
-                  if (!be_quiet)
-                    fprintf(stderr,
-                            "Warning: Found constructor function %s with prio "
-                            "%u, we cannot instrument this, putting it into a "
-                            "block list.\n",
-                            F->getName().str().c_str(), Priority);
-                  module_block_list.push_back(F->getName().str());
-
-                }
-
-              }
-
-            }
-
-          }
-
-        }
-
-      }
+  */
 
-    }
-
-  }
+  scanForDangerousFunctions(&M);
 
   /* Instrument all the things! */
 
@@ -307,26 +237,6 @@ bool AFLLTOPass::runOnModule(Module &M) {
     if (F.size() < function_minimum_size) continue;
     if (isIgnoreFunction(&F)) continue;
 
-    if (module_block_list.size()) {
-
-      for (auto bname : module_block_list) {
-
-        std::string fname = F.getName().str();
-
-        if (fname.compare(bname) == 0) {
-
-          if (!be_quiet)
-            WARNF(
-                "Skipping instrumentation of dangerous early running function "
-                "%s",
-                fname.c_str());
-
-        }
-
-      }
-
-    }
-
     // the instrument file list check
     AttributeList Attrs = F.getAttributes();
     if (Attrs.hasAttribute(-1, StringRef("skipinstrument"))) {
diff --git a/llvm_mode/afl-llvm-pass.so.cc b/llvm_mode/afl-llvm-pass.so.cc
index 618abe48..2ea9fd84 100644
--- a/llvm_mode/afl-llvm-pass.so.cc
+++ b/llvm_mode/afl-llvm-pass.so.cc
@@ -297,6 +297,7 @@ bool AFLCoverage::runOnModule(Module &M) {
   /* Instrument all the things! */
 
   int inst_blocks = 0;
+  scanForDangerousFunctions(&M);
 
   for (auto &F : M) {
 
diff --git a/llvm_mode/afl-llvm-rt.o.c b/llvm_mode/afl-llvm-rt.o.c
index a567593e..dacc46a6 100644
--- a/llvm_mode/afl-llvm-rt.o.c
+++ b/llvm_mode/afl-llvm-rt.o.c
@@ -35,6 +35,8 @@
 #include <string.h>
 #include <assert.h>
 #include <stdint.h>
+#include <stddef.h>
+#include <limits.h>
 #include <errno.h>
 
 #include <sys/mman.h>
@@ -842,9 +844,22 @@ void __afl_manual_init(void) {
 
   static u8 init_done;
 
+  if (getenv("AFL_DISABLE_LLVM_INSTRUMENTATION")) {
+
+    init_done = 1;
+    is_persistent = 0;
+    __afl_sharedmem_fuzzing = 0;
+    if (__afl_area_ptr == NULL) __afl_area_ptr = __afl_area_initial;
+
+    if (getenv("AFL_DEBUG"))
+      fprintf(stderr,
+              "DEBUG: disabled instrumenation because of "
+              "AFL_DISABLE_LLVM_INSTRUMENTATION\n");
+
+  }
+
   if (!init_done) {
 
-    __afl_map_shm();
     __afl_start_forkserver();
     init_done = 1;
 
@@ -852,11 +867,11 @@ void __afl_manual_init(void) {
 
 }
 
-/* Proper initialization routine. */
+/* Initialization of the forkserver - latest possible */
 
-__attribute__((constructor(CONST_PRIO))) void __afl_auto_init(void) {
+__attribute__((constructor())) void __afl_auto_init(void) {
 
-  is_persistent = !!getenv(PERSIST_ENV_VAR);
+  if (getenv("AFL_DISABLE_LLVM_INSTRUMENTATION")) return;
 
   if (getenv(DEFER_ENV_VAR)) return;
 
@@ -864,6 +879,18 @@ __attribute__((constructor(CONST_PRIO))) void __afl_auto_init(void) {
 
 }
 
+/* Initialization of the shmem - earliest possible because of LTO fixed mem. */
+
+__attribute__((constructor(0))) void __afl_auto_early(void) {
+
+  if (getenv("AFL_DISABLE_LLVM_INSTRUMENTATION")) return;
+
+  is_persistent = !!getenv(PERSIST_ENV_VAR);
+
+  __afl_map_shm();
+
+}
+
 /* The following stuff deals with supporting -fsanitize-coverage=trace-pc-guard.
    It remains non-operational in the traditional, plugin-backed LLVM mode.
    For more info about 'trace-pc-guard', see llvm_mode/README.md.
@@ -912,7 +939,8 @@ void __sanitizer_cov_trace_pc_guard(uint32_t *guard) {
 
 #else
 
-  __afl_area_ptr[*guard] = __afl_area_ptr[*guard] + 1 + (__afl_area_ptr[*guard] == 255 ? 1 : 0);
+  __afl_area_ptr[*guard] =
+      __afl_area_ptr[*guard] + 1 + (__afl_area_ptr[*guard] == 255 ? 1 : 0);
 
 #endif
 
diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c
index 6819fc8a..8684bcc0 100644
--- a/src/afl-forkserver.c
+++ b/src/afl-forkserver.c
@@ -58,6 +58,8 @@ static list_t fsrv_list = {.element_prealloc_count = 0};
 
 static void fsrv_exec_child(afl_forkserver_t *fsrv, char **argv) {
 
+  if (fsrv->qemu_mode) setenv("AFL_DISABLE_LLVM_INSTRUMENTATION", "1", 0);
+
   execv(fsrv->target_path, argv);
 
 }
@@ -122,8 +124,8 @@ void afl_fsrv_init_dup(afl_forkserver_t *fsrv_to, afl_forkserver_t *from) {
   Returns the time passed to read.
   If the wait times out, returns timeout_ms + 1;
   Returns 0 if an error occurred (fd closed, signal, ...); */
-static u32 __attribute__ ((hot)) read_s32_timed(s32 fd, s32 *buf, u32 timeout_ms,
-                          volatile u8 *stop_soon_p) {
+static u32 __attribute__((hot))
+read_s32_timed(s32 fd, s32 *buf, u32 timeout_ms, volatile u8 *stop_soon_p) {
 
   fd_set readfds;
   FD_ZERO(&readfds);
@@ -322,8 +324,9 @@ static void report_error_and_exit(int error) {
    cloning a stopped child. So, we just execute once, and then send commands
    through a pipe. The other part of this logic is in afl-as.h / llvm_mode */
 
-void __attribute__ ((hot)) afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
-                    volatile u8 *stop_soon_p, u8 debug_child_output) {
+void __attribute__((hot))
+afl_fsrv_start(afl_forkserver_t *fsrv, char **argv, volatile u8 *stop_soon_p,
+               u8 debug_child_output) {
 
   int st_pipe[2], ctl_pipe[2];
   s32 status;
diff --git a/src/afl-fuzz-bitmap.c b/src/afl-fuzz-bitmap.c
index f6389c06..1b9df624 100644
--- a/src/afl-fuzz-bitmap.c
+++ b/src/afl-fuzz-bitmap.c
@@ -57,7 +57,7 @@ void write_bitmap(afl_state_t *afl) {
    This function is called after every exec() on a fairly large buffer, so
    it needs to be fast. We do this in 32-bit and 64-bit flavors. */
 
-u8 __attribute__ ((hot)) has_new_bits(afl_state_t *afl, u8 *virgin_map) {
+u8 __attribute__((hot)) has_new_bits(afl_state_t *afl, u8 *virgin_map) {
 
 #ifdef WORD_SIZE_64
 
@@ -347,7 +347,7 @@ void init_count_class16(void) {
 
 #ifdef WORD_SIZE_64
 
-void __attribute__ ((hot)) classify_counts(afl_forkserver_t *fsrv) {
+void __attribute__((hot)) classify_counts(afl_forkserver_t *fsrv) {
 
   u64 *mem = (u64 *)fsrv->trace_bits;
 
@@ -376,7 +376,7 @@ void __attribute__ ((hot)) classify_counts(afl_forkserver_t *fsrv) {
 
 #else
 
-void __attribute__ ((hot)) classify_counts(afl_forkserver_t *fsrv) {
+void __attribute__((hot)) classify_counts(afl_forkserver_t *fsrv) {
 
   u32 *mem = (u32 *)fsrv->trace_bits;
 
@@ -534,7 +534,8 @@ static void write_crash_readme(afl_state_t *afl) {
    save or queue the input test case for further analysis if so. Returns 1 if
    entry is saved, 0 otherwise. */
 
-u8 __attribute__ ((hot)) save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
+u8 __attribute__((hot))
+save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
 
   if (unlikely(len == 0)) { return 0; }
 
diff --git a/src/afl-fuzz-run.c b/src/afl-fuzz-run.c
index 97fcb3c8..d3f823c9 100644
--- a/src/afl-fuzz-run.c
+++ b/src/afl-fuzz-run.c
@@ -38,8 +38,8 @@ u64 time_spent_working = 0;
 /* Execute target application, monitoring for timeouts. Return status
    information. The called program will update afl->fsrv->trace_bits. */
 
-fsrv_run_result_t __attribute__ ((hot)) fuzz_run_target(afl_state_t *afl, afl_forkserver_t *fsrv,
-                                  u32 timeout) {
+fsrv_run_result_t __attribute__((hot))
+fuzz_run_target(afl_state_t *afl, afl_forkserver_t *fsrv, u32 timeout) {
 
 #ifdef PROFILING
   static u64      time_spent_start = 0;
@@ -72,7 +72,8 @@ fsrv_run_result_t __attribute__ ((hot)) fuzz_run_target(afl_state_t *afl, afl_fo
    old file is unlinked and a new one is created. Otherwise, afl->fsrv.out_fd is
    rewound and truncated. */
 
-void __attribute__ ((hot)) write_to_testcase(afl_state_t *afl, void *mem, u32 len) {
+void __attribute__((hot))
+write_to_testcase(afl_state_t *afl, void *mem, u32 len) {
 
 #ifdef _AFL_DOCUMENT_MUTATIONS
   s32  doc_fd;
@@ -858,7 +859,8 @@ abort_trimming:
    error conditions, returning 1 if it's time to bail out. This is
    a helper function for fuzz_one(). */
 
-u8 __attribute__ ((hot)) common_fuzz_stuff(afl_state_t *afl, u8 *out_buf, u32 len) {
+u8 __attribute__((hot))
+common_fuzz_stuff(afl_state_t *afl, u8 *out_buf, u32 len) {
 
   u8 fault;