Add American Fuzzy Lop (afl) to third_party/afl/

third_party/afl/src/qemu_mode/patches/cpu-exec.diff

+--- qemu-2.3.0/cpu-exec.c.orig     2014-12-09 14:45:40.000000000 +0000
++++ qemu-2.3.0/cpu-exec.c  2015-02-20 22:07:02.966000000 +0000
+@@ -28,6 +28,8 @@
+ #include "exec/memory-internal.h"
+ #include "qemu/rcu.h"
+
++#include "../patches/afl-qemu-cpu-inl.h"
++
+ /* -icount align implementation. */
+
+ typedef struct SyncClocks {
+@@ -296,8 +298,11 @@
+     }
+  not_found:
+    /* if no translated code available, then translate it now */
++
+     tb = tb_gen_code(cpu, pc, cs_base, flags, 0);
+
++    AFL_QEMU_CPU_SNIPPET1;
++
+  found:
+     /* Move the last found TB to the head of the list */
+     if (likely(*ptb1)) {
+@@ -492,6 +497,9 @@
+                     next_tb = 0;
+                     tcg_ctx.tb_ctx.tb_invalidated_flag = 0;
+                 }
++
++                AFL_QEMU_CPU_SNIPPET2;
++
+                 if (qemu_loglevel_mask(CPU_LOG_EXEC)) {
+                     qemu_log("Trace %p [" TARGET_FMT_lx "] %s\n",
+                              tb->tc_ptr, tb->pc, lookup_symbol(tb->pc));