nixpkgs/pkgs/tools/security/afl/qemu-patches/cpu-exec.patch

--- qemu-2.3.0/cpu-exec.c.orig     2014-12-09 14:45:40.000000000 +0000
+++ qemu-2.3.0/cpu-exec.c  2015-02-20 22:07:02.966000000 +0000
@@ -28,6 +28,8 @@
 #include "exec/memory-internal.h"
 #include "qemu/rcu.h"

+#include "afl-qemu-cpu-inl.h"
+
 /* -icount align implementation. */

 typedef struct SyncClocks {
@@ -296,8 +298,11 @@
     }
  not_found:
    /* if no translated code available, then translate it now */
+
     tb = tb_gen_code(cpu, pc, cs_base, flags, 0);

+    AFL_QEMU_CPU_SNIPPET1;
+
  found:
     /* Move the last found TB to the head of the list */
     if (likely(*ptb1)) {
@@ -492,6 +497,9 @@
                     next_tb = 0;
                     tcg_ctx.tb_ctx.tb_invalidated_flag = 0;
                 }
+
+                AFL_QEMU_CPU_SNIPPET2;
+
                 if (qemu_loglevel_mask(CPU_LOG_EXEC)) {
                     qemu_log("Trace %p [" TARGET_FMT_lx "] %s\n",
                              tb->tc_ptr, tb->pc, lookup_symbol(tb->pc));