diff options
Diffstat (limited to 'qemu_mode')
| -rwxr-xr-x | qemu_mode/build_qemu_support.sh | 30 | ||||
| -rw-r--r-- | qemu_mode/patches/__init__.py.diff | 17 | ||||
| -rw-r--r-- | qemu_mode/patches/afl-qemu-cpu-inl.h | 14 | ||||
| -rw-r--r-- | qemu_mode/patches/afl-qemu-tcg-inl.h | 1 | ||||
| -rw-r--r-- | qemu_mode/patches/afl-qemu-tcg-runtime-inl.h | 4 | ||||
| -rw-r--r-- | qemu_mode/patches/make_strncpy_safe.diff | 31 | ||||
| -rw-r--r-- | qemu_mode/unsigaction/Makefile | 24 |
7 files changed, 97 insertions, 24 deletions
diff --git a/qemu_mode/build_qemu_support.sh b/qemu_mode/build_qemu_support.sh index 09c04e7f..118f6ebd 100755 --- a/qemu_mode/build_qemu_support.sh +++ b/qemu_mode/build_qemu_support.sh @@ -62,15 +62,15 @@ if [ ! -f "../afl-showmap" ]; then fi +PREREQ_NOTFOUND= +for i in libtool wget python automake autoconf sha384sum bison flex iconv patch pkg-config; do -for i in libtool wget python automake autoconf sha384sum bison iconv; do - - T=`which "$i" 2>/dev/null` + T=`command -v "$i" 2>/dev/null` if [ "$T" = "" ]; then echo "[-] Error: '$i' not found, please install first." - exit 1 + PREREQ_NOTFOUND=1 fi @@ -79,17 +79,21 @@ done if [ ! -d "/usr/include/glib-2.0/" -a ! -d "/usr/local/include/glib-2.0/" ]; then echo "[-] Error: devel version of 'glib2' not found, please install first." - exit 1 + PREREQ_NOTFOUND=1 fi if echo "$CC" | grep -qF /afl-; then echo "[-] Error: do not use afl-gcc or afl-clang to compile this tool." - exit 1 + PREREQ_NOTFOUND=1 fi +if [ "$PREREQ_NOTFOUND" = "1" ]; then + exit 1 +fi + echo "[+] All checks passed!" ARCHIVE="`basename -- "$QEMU_URL"`" @@ -139,8 +143,16 @@ echo "[*] Configuring QEMU for $CPU_TARGET..." ORIG_CPU_TARGET="$CPU_TARGET" -test "$CPU_TARGET" = "" && CPU_TARGET="`uname -m`" -test "$CPU_TARGET" = "i686" && CPU_TARGET="i386" +if [ "$ORIG_CPU_TARGET" = "" ]; then + CPU_TARGET="`uname -m`" + test "$CPU_TARGET" = "i686" && CPU_TARGET="i386" + test "$CPU_TARGET" = "arm64v8" && CPU_TARGET="aarch64" + case "$CPU_TARGET" in + *arm*) + CPU_TARGET="arm" + ;; + esac +fi cd qemu-$VERSION || exit 1 @@ -162,6 +174,8 @@ patch -p1 <../patches/configure.diff || exit 1 patch -p1 <../patches/tcg-runtime.diff || exit 1 patch -p1 <../patches/tcg-runtime-head.diff || exit 1 patch -p1 <../patches/translator.diff || exit 1 +patch -p1 <../patches/__init__.py.diff || exit 1 +patch -p1 <../patches/make_strncpy_safe.diff || exit 1 echo "[+] Patching done." diff --git a/qemu_mode/patches/__init__.py.diff b/qemu_mode/patches/__init__.py.diff new file mode 100644 index 00000000..7e189b99 --- /dev/null +++ b/qemu_mode/patches/__init__.py.diff @@ -0,0 +1,17 @@ +--- a/scripts/tracetool/__init__.py 2020-03-28 13:42:21.937700726 +0100 ++++ b/scripts/tracetool/__init__.py 2020-03-28 13:41:50.991034257 +0100 +@@ -447,12 +447,12 @@ + import tracetool + + format = str(format) +- if len(format) is 0: ++ if len(format) == 0: + raise TracetoolError("format not set") + if not tracetool.format.exists(format): + raise TracetoolError("unknown format: %s" % format) + +- if len(backends) is 0: ++ if len(backends) == 0: + raise TracetoolError("no backends specified") + for backend in backends: + if not tracetool.backend.exists(backend): diff --git a/qemu_mode/patches/afl-qemu-cpu-inl.h b/qemu_mode/patches/afl-qemu-cpu-inl.h index 9fdc23ea..ee3ec44e 100644 --- a/qemu_mode/patches/afl-qemu-cpu-inl.h +++ b/qemu_mode/patches/afl-qemu-cpu-inl.h @@ -293,7 +293,8 @@ static void print_mappings(void) { void afl_forkserver(CPUState *cpu) { - static unsigned char tmp[4]; + u32 map_size = 0; + static unsigned char tmp[4] = {0, 0, 0, 0}; if (forkserver_installed == 1) return; forkserver_installed = 1; @@ -306,6 +307,15 @@ void afl_forkserver(CPUState *cpu) { int t_fd[2]; u8 child_stopped = 0; + // if in the future qemu has non-collding coverage then switch MAP_SIZE + // with the max ID value + if (MAP_SIZE <= 0x800000) { + + map_size = (FS_OPT_ENABLED | FS_OPT_MAPSIZE | FS_OPT_SET_MAPSIZE(MAP_SIZE)); + memcpy(tmp, &map_size, 4); + + } + /* Tell the parent that we're alive. If the parent doesn't want to talk, assume that we're not running in forkserver mode. */ @@ -413,7 +423,7 @@ void afl_forkserver(CPUState *cpu) { void afl_persistent_loop(void) { static u32 cycle_cnt; - static struct afl_tsl exit_cmd_tsl = {{-1, 0, 0, 0}, NULL}; + static struct afl_tsl exit_cmd_tsl = {{-1, 0, 0, 0}, '\0'}; if (!afl_fork_child) return; diff --git a/qemu_mode/patches/afl-qemu-tcg-inl.h b/qemu_mode/patches/afl-qemu-tcg-inl.h index 430574e5..f7c662db 100644 --- a/qemu_mode/patches/afl-qemu-tcg-inl.h +++ b/qemu_mode/patches/afl-qemu-tcg-inl.h @@ -30,6 +30,7 @@ have a look at afl-showmap.c. */ +void afl_gen_tcg_plain_call(void *func); void afl_gen_tcg_plain_call(void *func) { diff --git a/qemu_mode/patches/afl-qemu-tcg-runtime-inl.h b/qemu_mode/patches/afl-qemu-tcg-runtime-inl.h index b7cd71bb..1526f09c 100644 --- a/qemu_mode/patches/afl-qemu-tcg-runtime-inl.h +++ b/qemu_mode/patches/afl-qemu-tcg-runtime-inl.h @@ -185,8 +185,8 @@ void HELPER(afl_cmplog_rtn)(CPUArchState *env) { if (!area_is_mapped(stack, sizeof(target_ulong) * 2)) return; // when this hook is executed, the retaddr is not on stack yet - void *ptr1 = g2h(stack[0]); - void *ptr2 = g2h(stack[1]); + void * ptr1 = g2h(stack[0]); + void * ptr2 = g2h(stack[1]); #else diff --git a/qemu_mode/patches/make_strncpy_safe.diff b/qemu_mode/patches/make_strncpy_safe.diff new file mode 100644 index 00000000..38c7d248 --- /dev/null +++ b/qemu_mode/patches/make_strncpy_safe.diff @@ -0,0 +1,31 @@ +--- a/util/qemu-sockets.c 2020-03-28 13:55:09.511029429 +0100 ++++ b/util/qemu-sockets.c 2020-03-28 14:01:12.147693937 +0100 +@@ -877,7 +877,7 @@ + + memset(&un, 0, sizeof(un)); + un.sun_family = AF_UNIX; +- strncpy(un.sun_path, path, sizeof(un.sun_path)); ++ strncpy(un.sun_path, path, sizeof(un.sun_path) - 1); + + if (bind(sock, (struct sockaddr*) &un, sizeof(un)) < 0) { + error_setg_errno(errp, errno, "Failed to bind socket to %s", path); +@@ -922,7 +922,7 @@ + + memset(&un, 0, sizeof(un)); + un.sun_family = AF_UNIX; +- strncpy(un.sun_path, saddr->path, sizeof(un.sun_path)); ++ strncpy(un.sun_path, saddr->path, sizeof(un.sun_path) - 1); + + /* connect to peer */ + do { +--- a/block/sheepdog.c 2020-03-28 14:01:57.164360270 +0100 ++++ b/block/sheepdog.c 2020-03-28 14:02:52.781026597 +0100 +@@ -1236,7 +1236,7 @@ + * don't want the send_req to read uninitialized data. + */ + strncpy(buf, filename, SD_MAX_VDI_LEN); +- strncpy(buf + SD_MAX_VDI_LEN, tag, SD_MAX_VDI_TAG_LEN); ++ strncpy(buf + SD_MAX_VDI_LEN, tag, SD_MAX_VDI_TAG_LEN - 1); + + memset(&hdr, 0, sizeof(hdr)); + if (lock) { diff --git a/qemu_mode/unsigaction/Makefile b/qemu_mode/unsigaction/Makefile index 31fa8c55..d5063dab 100644 --- a/qemu_mode/unsigaction/Makefile +++ b/qemu_mode/unsigaction/Makefile @@ -12,23 +12,23 @@ # # http://www.apache.org/licenses/LICENSE-2.0 # +.POSIX: -ifndef AFL_NO_X86 +_UNIQ=_QINU_ -all: lib_i386 lib_amd64 +TARGETCANDIDATES=unsigaction32.so unsigaction64.so +_TARGETS=$(_UNIQ)$(AFL_NO_X86)$(_UNIQ) +__TARGETS=$(_TARGETS:$(_UNIQ)1$(_UNIQ)=) +TARGETS=$(__TARGETS:$(_UNIQ)$(_UNIQ)=$(TARGETCANDIDATES)) -lib_i386: +all: $(TARGETS) + @if [ "$(AFL_NO_X86)" != "" ]; then echo "[!] Note: skipping compilation of unsigaction (AFL_NO_X86 set)."; fi + +unsigaction32.so: @$(CC) -m32 -fPIC -shared unsigaction.c -o unsigaction32.so 2>/dev/null ; if [ "$$?" = "0" ]; then echo "unsigaction32 build success"; else echo "unsigaction32 build failure (that's fine)"; fi -lib_amd64: - $(CC) -fPIC -shared unsigaction.c -o unsigaction64.so +unsigaction64.so: + $(CC) -m64 -fPIC -shared unsigaction.c -o unsigaction64.so clean: rm -f unsigaction32.so unsigaction64.so - -else - -all: - @echo "[!] Note: skipping compilation of unsigaction (AFL_NO_X86 set)." - -endif |