Refactor read/write hooks (#99)

* Refactor read/write hooks
* add PC to the callbacks
* simplify code, merge common code
* remove useless tcg frees
* use tcg_constant_tl as much as possible, removing most #if in libafl code.

include/libafl/hook.h

@@ -53,7 +53,7 @@
     }
 
 // TODO: cleanup this
-extern target_ulong libafl_gen_cur_pc;
+extern tcg_target_ulong libafl_gen_cur_pc;
 extern size_t libafl_qemu_hooks_num;
 
 void libafl_tcg_gen_asan(TCGTemp* addr, size_t size);

include/libafl/hooks/tcg/instruction.h

@@ -14,6 +14,8 @@
 #define LIBAFL_TABLES_HASH(p)                                                  \
     (((13 * ((size_t)(p))) ^ (((size_t)(p)) >> 15)) % LIBAFL_TABLES_SIZE)
 
+typedef void (*libafl_instruction_cb)(uint64_t data, target_ulong pc);
+
 struct libafl_instruction_hook {
     // data
     uint64_t data;
@@ -28,8 +30,7 @@ struct libafl_instruction_hook {
 };
 
 size_t libafl_qemu_add_instruction_hooks(target_ulong pc,
-                                         void (*callback)(uint64_t data,
+                                         libafl_instruction_cb callback,
-                                                          target_ulong pc),
                                          uint64_t data, int invalidate);
 
 int libafl_qemu_remove_instruction_hook(size_t num, int invalidate);

include/libafl/hooks/tcg/read_write.h

@@ -2,11 +2,6 @@
 
 #include "qemu/osdep.h"
 
-#include "qapi/error.h"
-
-#include "exec/exec-all.h"
-#include "exec/tb-flush.h"
-
 #include "libafl/exit.h"
 #include "libafl/hook.h"
 
@@ -17,9 +12,16 @@
 #define LIBAFL_TABLES_HASH(p)                                                  \
     (((13 * ((size_t)(p))) ^ (((size_t)(p)) >> 15)) % LIBAFL_TABLES_SIZE)
 
+typedef uint64_t (*libafl_rw_gen_cb)(uint64_t data, target_ulong pc,
+                                     TCGTemp* addr, MemOpIdx oi);
+typedef void (*libafl_rw_exec_cb)(uint64_t data, uint64_t id, target_ulong pc,
+                                  target_ulong addr);
+typedef void (*libafl_rw_execN_cb)(uint64_t data, uint64_t id, target_ulong pc,
+                                   target_ulong addr, size_t size);
+
 struct libafl_rw_hook {
     // functions
-    uint64_t (*gen)(uint64_t data, target_ulong pc, TCGTemp* addr, MemOpIdx oi);
+    libafl_rw_gen_cb gen;
 
     // data
     uint64_t data;
@@ -36,25 +38,18 @@ struct libafl_rw_hook {
     struct libafl_rw_hook* next;
 };
 
-void libafl_gen_read(TCGTemp* addr, MemOpIdx oi);
+void libafl_gen_read(TCGTemp* pc, TCGTemp* addr, MemOpIdx oi);
-void libafl_gen_write(TCGTemp* addr, MemOpIdx oi);
+void libafl_gen_write(TCGTemp* pc, TCGTemp* addr, MemOpIdx oi);
 
-size_t libafl_add_read_hook(
+size_t libafl_add_read_hook(libafl_rw_gen_cb gen, libafl_rw_exec_cb exec1,
-    uint64_t (*gen)(uint64_t data, target_ulong pc, TCGTemp* addr, MemOpIdx oi),
+                            libafl_rw_exec_cb exec2, libafl_rw_exec_cb exec4,
-    void (*exec1)(uint64_t data, uint64_t id, target_ulong addr),
+                            libafl_rw_exec_cb exec8, libafl_rw_execN_cb execN,
-    void (*exec2)(uint64_t data, uint64_t id, target_ulong addr),
+                            uint64_t data);
-    void (*exec4)(uint64_t data, uint64_t id, target_ulong addr),
+
-    void (*exec8)(uint64_t data, uint64_t id, target_ulong addr),
+size_t libafl_add_write_hook(libafl_rw_gen_cb gen, libafl_rw_exec_cb exec1,
-    void (*execN)(uint64_t data, uint64_t id, target_ulong addr, size_t size),
+                             libafl_rw_exec_cb exec2, libafl_rw_exec_cb exec4,
-    uint64_t data);
+                             libafl_rw_exec_cb exec8, libafl_rw_execN_cb execN,
-size_t libafl_add_write_hook(
+                             uint64_t data);
-    uint64_t (*gen)(uint64_t data, target_ulong pc, TCGTemp* addr, MemOpIdx oi),
-    void (*exec1)(uint64_t data, uint64_t id, target_ulong addr),
-    void (*exec2)(uint64_t data, uint64_t id, target_ulong addr),
-    void (*exec4)(uint64_t data, uint64_t id, target_ulong addr),
-    void (*exec8)(uint64_t data, uint64_t id, target_ulong addr),
-    void (*execN)(uint64_t data, uint64_t id, target_ulong addr, size_t size),
-    uint64_t data);
 
 int libafl_qemu_remove_read_hook(size_t num, int invalidate);
 int libafl_qemu_remove_write_hook(size_t num, int invalidate);

libafl/cpu.c

@@ -140,7 +140,8 @@ int libafl_qemu_num_regs(CPUState* cpu)
         if (cc->gdb_num_core_regs) {
             num_regs = cc->gdb_num_core_regs;
         } else {
-            const GDBFeature *feature = gdb_find_static_feature(cc->gdb_core_xml_file);
+            const GDBFeature* feature =
+                gdb_find_static_feature(cc->gdb_core_xml_file);
 
             g_assert(feature);
             g_assert(feature->num_regs > 0);

libafl/exit.c

@@ -165,7 +165,6 @@ void libafl_qemu_breakpoint_run(vaddr pc_next)
         if (bp->addr == pc_next) {
             TCGv_i64 tmp0 = tcg_constant_i64((uint64_t)pc_next);
             gen_helper_libafl_qemu_handle_breakpoint(tcg_env, tmp0);
-            tcg_temp_free_i64(tmp0);
         }
         bp = bp->next;
     }

libafl/hooks/tcg/cmp.c

@@ -116,14 +116,8 @@ void libafl_gen_cmp(target_ulong pc, TCGv op0, TCGv op1, MemOp ot)
             TCGv_i64 tmp0 = tcg_constant_i64(hook->data);
             TCGv_i64 tmp1 = tcg_constant_i64(cur_id);
             TCGTemp* tmp2[4] = {tcgv_i64_temp(tmp0), tcgv_i64_temp(tmp1),
-#if TARGET_LONG_BITS == 32
+                                tcgv_tl_temp(op0), tcgv_tl_temp(op1)};
-                                tcgv_i32_temp(op0), tcgv_i32_temp(op1)};
-#else
-                                tcgv_i64_temp(op0), tcgv_i64_temp(op1)};
-#endif
             tcg_gen_callN(info->func, info, NULL, tmp2);
-            tcg_temp_free_i64(tmp0);
-            tcg_temp_free_i64(tmp1);
         }
         hook = hook->next;
     }

libafl/hooks/tcg/instruction.c

@@ -3,18 +3,21 @@
 
 #include "libafl/cpu.h"
 
-target_ulong libafl_gen_cur_pc;
+static TCGHelperInfo libafl_instruction_info = {
+    .func = NULL,
+    .name = "libafl_instruction_hook",
+    .flags = dh_callflag(void),
+    .typemask = dh_typemask(void, 0) | dh_typemask(i64, 1) | dh_typemask(tl, 2),
+};
+
+tcg_target_ulong libafl_gen_cur_pc;
 struct libafl_instruction_hook*
     libafl_qemu_instruction_hooks[LIBAFL_TABLES_SIZE];
 size_t libafl_qemu_hooks_num = 0;
 
 size_t libafl_qemu_add_instruction_hooks(target_ulong pc,
-                                         void (*callback)(uint64_t data,
+                                         libafl_instruction_cb callback,
-                                                          target_ulong pc),
+                                         uint64_t data, int invalidate)
-                                         uint64_t
-
-                                             data,
-                                         int invalidate)
 {
     CPUState* cpu;
 
@@ -27,13 +30,9 @@ size_t libafl_qemu_add_instruction_hooks(target_ulong pc,
     struct libafl_instruction_hook* hk =
         calloc(sizeof(struct libafl_instruction_hook), 1);
     hk->addr = pc;
-    // hk->callback = callback;
     hk->data = data;
+    hk->helper_info = libafl_instruction_info;
     hk->helper_info.func = callback;
-    hk->helper_info.name = "libafl_instruction_hook";
-    hk->helper_info.flags = dh_callflag(void);
-    hk->helper_info.typemask =
-        dh_typemask(void, 0) | dh_typemask(i64, 1) | dh_typemask(tl, 2);
     // TODO check for overflow
     hk->num = libafl_qemu_hooks_num++;
     hk->next = libafl_qemu_instruction_hooks[idx];
@@ -117,20 +116,8 @@ void libafl_qemu_hook_instruction_run(vaddr pc_next)
         libafl_search_instruction_hook(pc_next);
     if (hk) {
         TCGv_i64 tmp0 = tcg_constant_i64(hk->data);
-#if TARGET_LONG_BITS == 32
+        TCGv tmp1 = tcg_constant_tl(pc_next);
-        TCGv_i32 tmp1 = tcg_constant_i32(pc_next);
+        TCGTemp* tmp2[2] = {tcgv_i64_temp(tmp0), tcgv_tl_temp(tmp1)};
-        TCGTemp* tmp2[2] = {tcgv_i64_temp(tmp0), tcgv_i32_temp(tmp1)};
-#else
-        TCGv_i64 tmp1 = tcg_constant_i64(pc_next);
-        TCGTemp* tmp2[2] = {tcgv_i64_temp(tmp0), tcgv_i64_temp(tmp1)};
-#endif
-        // tcg_gen_callN(hk->callback, NULL, 2, tmp2);
         tcg_gen_callN(hk->helper_info.func, &hk->helper_info, NULL, tmp2);
-#if TARGET_LONG_BITS == 32
-        tcg_temp_free_i32(tmp1);
-#else
-        tcg_temp_free_i64(tmp1);
-#endif
-        tcg_temp_free_i64(tmp0);
     }
 }

libafl/hooks/tcg/read_write.c

@@ -1,5 +1,10 @@
-#include "libafl/tcg.h"
 #include "libafl/hooks/tcg/read_write.h"
+#include "cpu.h"
+#include "exec/tb-flush.h"
+
+#include "libafl/tcg.h"
+#include "libafl/cpu.h"
+#include "libafl/hook.h"
 
 struct libafl_rw_hook* libafl_read_hooks;
 size_t libafl_read_hooks_num = 0;
@@ -7,186 +12,166 @@ size_t libafl_read_hooks_num = 0;
 struct libafl_rw_hook* libafl_write_hooks;
 size_t libafl_write_hooks_num = 0;
 
+#define TYPEMASK_RW_SIZED                                                      \
+    (dh_typemask(void, 0) | dh_typemask(i64, 1) | dh_typemask(i64, 2) |        \
+     dh_typemask(i64, 3) | dh_typemask(tl, 4))
+
+#define TYPEMASK_RW_UNSIZED (TYPEMASK_RW_SIZED | dh_typemask(i64, 5))
+
 static TCGHelperInfo libafl_exec_read_hook1_info = {
     .func = NULL,
     .name = "libafl_exec_read_hook1",
     .flags = dh_callflag(void),
-    .typemask = dh_typemask(void, 0) | dh_typemask(i64, 1) |
+    .typemask = TYPEMASK_RW_SIZED,
-                dh_typemask(i64, 2) | dh_typemask(tl, 3)};
+};
+
 static TCGHelperInfo libafl_exec_read_hook2_info = {
     .func = NULL,
     .name = "libafl_exec_read_hook2",
     .flags = dh_callflag(void),
-    .typemask = dh_typemask(void, 0) | dh_typemask(i64, 1) |
+    .typemask = TYPEMASK_RW_SIZED,
-                dh_typemask(i64, 2) | dh_typemask(tl, 3)};
+};
+
 static TCGHelperInfo libafl_exec_read_hook4_info = {
     .func = NULL,
     .name = "libafl_exec_read_hook4",
     .flags = dh_callflag(void),
-    .typemask = dh_typemask(void, 0) | dh_typemask(i64, 1) |
+    .typemask = TYPEMASK_RW_SIZED,
-                dh_typemask(i64, 2) | dh_typemask(tl, 3)};
+};
+
 static TCGHelperInfo libafl_exec_read_hook8_info = {
     .func = NULL,
     .name = "libafl_exec_read_hook8",
     .flags = dh_callflag(void),
-    .typemask = dh_typemask(void, 0) | dh_typemask(i64, 1) |
+    .typemask = TYPEMASK_RW_SIZED,
-                dh_typemask(i64, 2) | dh_typemask(tl, 3)};
+};
+
 static TCGHelperInfo libafl_exec_read_hookN_info = {
     .func = NULL,
     .name = "libafl_exec_read_hookN",
     .flags = dh_callflag(void),
-    .typemask = dh_typemask(void, 0) | dh_typemask(i64, 1) |
+    .typemask = TYPEMASK_RW_UNSIZED,
-                dh_typemask(i64, 2) | dh_typemask(tl, 3) | dh_typemask(i64, 4)};
+};
+
 static TCGHelperInfo libafl_exec_write_hook1_info = {
     .func = NULL,
     .name = "libafl_exec_write_hook1",
     .flags = dh_callflag(void),
-    .typemask = dh_typemask(void, 0) | dh_typemask(i64, 1) |
+    .typemask = TYPEMASK_RW_SIZED,
-                dh_typemask(i64, 2) | dh_typemask(tl, 3)};
+};
+
 static TCGHelperInfo libafl_exec_write_hook2_info = {
     .func = NULL,
     .name = "libafl_exec_write_hook2",
     .flags = dh_callflag(void),
-    .typemask = dh_typemask(void, 0) | dh_typemask(i64, 1) |
+    .typemask = TYPEMASK_RW_SIZED,
-                dh_typemask(i64, 2) | dh_typemask(tl, 3)};
+};
+
 static TCGHelperInfo libafl_exec_write_hook4_info = {
     .func = NULL,
     .name = "libafl_exec_write_hook4",
     .flags = dh_callflag(void),
-    .typemask = dh_typemask(void, 0) | dh_typemask(i64, 1) |
+    .typemask = TYPEMASK_RW_SIZED,
-                dh_typemask(i64, 2) | dh_typemask(tl, 3)};
+};
+
 static TCGHelperInfo libafl_exec_write_hook8_info = {
     .func = NULL,
     .name = "libafl_exec_write_hook8",
     .flags = dh_callflag(void),
-    .typemask = dh_typemask(void, 0) | dh_typemask(i64, 1) |
+    .typemask = TYPEMASK_RW_SIZED,
-                dh_typemask(i64, 2) | dh_typemask(tl, 3)};
+};
+
 static TCGHelperInfo libafl_exec_write_hookN_info = {
     .func = NULL,
     .name = "libafl_exec_write_hookN",
     .flags = dh_callflag(void),
-    .typemask = dh_typemask(void, 0) | dh_typemask(i64, 1) |
+    .typemask = TYPEMASK_RW_UNSIZED,
-                dh_typemask(i64, 2) | dh_typemask(tl, 3) | dh_typemask(i64, 4)};
+};
 
 GEN_REMOVE_HOOK(read)
-
 GEN_REMOVE_HOOK(write)
 
-size_t libafl_add_read_hook(
+static size_t
-    uint64_t (*gen)(uint64_t data, target_ulong pc, TCGTemp* addr, MemOpIdx oi),
+libafl_add_rw_hook(struct libafl_rw_hook** hooks, size_t* hooks_num,
-    void (*exec1)(uint64_t data, uint64_t id, target_ulong addr),
+                   libafl_rw_gen_cb gen, libafl_rw_exec_cb exec1,
-    void (*exec2)(uint64_t data, uint64_t id, target_ulong addr),
+                   TCGHelperInfo* exec1_info, libafl_rw_exec_cb exec2,
-    void (*exec4)(uint64_t data, uint64_t id, target_ulong addr),
+                   TCGHelperInfo* exec2_info, libafl_rw_exec_cb exec4,
-    void (*exec8)(uint64_t data, uint64_t id, target_ulong addr),
+                   TCGHelperInfo* exec4_info, libafl_rw_exec_cb exec8,
-    void (*execN)(uint64_t data, uint64_t id, target_ulong addr, size_t size),
+                   TCGHelperInfo* exec8_info, libafl_rw_execN_cb execN,
-    uint64_t data)
+                   TCGHelperInfo* execN_info, uint64_t data)
 {
     CPUState* cpu;
     CPU_FOREACH(cpu) { tb_flush(cpu); }
 
     struct libafl_rw_hook* hook = calloc(sizeof(struct libafl_rw_hook), 1);
     hook->gen = gen;
-    /*hook->exec1 = exec1;
-    hook->exec2 = exec2;
-    hook->exec4 = exec4;
-    hook->exec8 = exec8;
-    hook->execN = execN;*/
     hook->data = data;
-    hook->num = libafl_read_hooks_num++;
+    hook->num = (*hooks_num)++;
-    hook->next = libafl_read_hooks;
+    hook->next = *hooks;
-    libafl_read_hooks = hook;
+    *hooks = hook;
 
     if (exec1) {
-        memcpy(&hook->helper_info1, &libafl_exec_read_hook1_info,
+        memcpy(&hook->helper_info1, exec1_info, sizeof(TCGHelperInfo));
-               sizeof(TCGHelperInfo));
         hook->helper_info1.func = exec1;
     }
     if (exec2) {
-        memcpy(&hook->helper_info2, &libafl_exec_read_hook2_info,
+        memcpy(&hook->helper_info2, exec2_info, sizeof(TCGHelperInfo));
-               sizeof(TCGHelperInfo));
         hook->helper_info2.func = exec2;
     }
     if (exec4) {
-        memcpy(&hook->helper_info4, &libafl_exec_read_hook4_info,
+        memcpy(&hook->helper_info4, exec4_info, sizeof(TCGHelperInfo));
-               sizeof(TCGHelperInfo));
         hook->helper_info4.func = exec4;
     }
     if (exec8) {
-        memcpy(&hook->helper_info8, &libafl_exec_read_hook8_info,
+        memcpy(&hook->helper_info8, exec8_info, sizeof(TCGHelperInfo));
-               sizeof(TCGHelperInfo));
         hook->helper_info8.func = exec8;
     }
     if (execN) {
-        memcpy(&hook->helper_infoN, &libafl_exec_read_hookN_info,
+        memcpy(&hook->helper_infoN, execN_info, sizeof(TCGHelperInfo));
-               sizeof(TCGHelperInfo));
         hook->helper_infoN.func = execN;
     }
 
     return hook->num;
 }
 
-size_t libafl_add_write_hook(
+size_t libafl_add_read_hook(libafl_rw_gen_cb gen, libafl_rw_exec_cb exec1,
-    uint64_t (*gen)(uint64_t data, target_ulong pc, TCGTemp* addr, MemOpIdx oi),
+                            libafl_rw_exec_cb exec2, libafl_rw_exec_cb exec4,
-    void (*exec1)(uint64_t data, uint64_t id, target_ulong addr),
+                            libafl_rw_exec_cb exec8, libafl_rw_execN_cb execN,
-    void (*exec2)(uint64_t data, uint64_t id, target_ulong addr),
+                            uint64_t data)
-    void (*exec4)(uint64_t data, uint64_t id, target_ulong addr),
-    void (*exec8)(uint64_t data, uint64_t id, target_ulong addr),
-    void (*execN)(uint64_t data, uint64_t id, target_ulong addr, size_t size),
-    uint64_t data)
 {
-    CPUState* cpu;
+    return libafl_add_rw_hook(&libafl_read_hooks, &libafl_read_hooks_num, gen,
-    CPU_FOREACH(cpu) { tb_flush(cpu); }
+                              exec1, &libafl_exec_read_hook1_info, exec2,
-
+                              &libafl_exec_read_hook2_info, exec4,
-    struct libafl_rw_hook* hook = calloc(sizeof(struct libafl_rw_hook), 1);
+                              &libafl_exec_read_hook4_info, exec8,
-    hook->gen = gen;
+                              &libafl_exec_read_hook8_info, execN,
-    /*hook->exec1 = exec1;
+                              &libafl_exec_read_hookN_info, data);
-    hook->exec2 = exec2;
-    hook->exec4 = exec4;
-    hook->exec8 = exec8;
-    hook->execN = execN;*/
-    hook->data = data;
-    hook->num = libafl_write_hooks_num++;
-    hook->next = libafl_write_hooks;
-    libafl_write_hooks = hook;
-
-    if (exec1) {
-        memcpy(&hook->helper_info1, &libafl_exec_write_hook1_info,
-               sizeof(TCGHelperInfo));
-        hook->helper_info1.func = exec1;
-    }
-    if (exec2) {
-        memcpy(&hook->helper_info2, &libafl_exec_write_hook2_info,
-               sizeof(TCGHelperInfo));
-        hook->helper_info2.func = exec2;
-    }
-    if (exec4) {
-        memcpy(&hook->helper_info4, &libafl_exec_write_hook4_info,
-               sizeof(TCGHelperInfo));
-        hook->helper_info4.func = exec4;
-    }
-    if (exec8) {
-        memcpy(&hook->helper_info8, &libafl_exec_write_hook8_info,
-               sizeof(TCGHelperInfo));
-        hook->helper_info8.func = exec8;
-    }
-    if (execN) {
-        memcpy(&hook->helper_infoN, &libafl_exec_write_hookN_info,
-               sizeof(TCGHelperInfo));
-        hook->helper_infoN.func = execN;
-    }
-
-    return hook->num;
 }
 
-static void libafl_gen_rw(TCGTemp* addr, MemOpIdx oi,
+size_t libafl_add_write_hook(libafl_rw_gen_cb gen, libafl_rw_exec_cb exec1,
+                             libafl_rw_exec_cb exec2, libafl_rw_exec_cb exec4,
+                             libafl_rw_exec_cb exec8, libafl_rw_execN_cb execN,
+                             uint64_t data)
+{
+    return libafl_add_rw_hook(&libafl_write_hooks, &libafl_write_hooks_num, gen,
+                              exec1, &libafl_exec_write_hook1_info, exec2,
+                              &libafl_exec_write_hook2_info, exec4,
+                              &libafl_exec_write_hook4_info, exec8,
+                              &libafl_exec_write_hook8_info, execN,
+                              &libafl_exec_write_hookN_info, data);
+}
+
+static void libafl_gen_rw(TCGTemp* pc, TCGTemp* addr, MemOpIdx oi,
                           struct libafl_rw_hook* hook)
 {
     size_t size = memop_size(get_memop(oi));
 
     while (hook) {
         uint64_t cur_id = 0;
-        if (hook->gen)
+
+        if (hook->gen) {
             cur_id = hook->gen(hook->data, libafl_gen_cur_pc, addr, oi);
+        }
+
         TCGHelperInfo* info = NULL;
         if (size == 1 && hook->helper_info1.func)
             info = &hook->helper_info1;
@@ -196,47 +181,32 @@ static void libafl_gen_rw(TCGTemp* addr, MemOpIdx oi,
             info = &hook->helper_info4;
         else if (size == 8 && hook->helper_info8.func)
             info = &hook->helper_info8;
+
         if (cur_id != (uint64_t)-1) {
+            TCGv_i64 tmp0 = tcg_constant_i64(hook->data);
+            TCGv_i64 tmp1 = tcg_constant_i64(cur_id);
+
             if (info) {
-                TCGv_i64 tmp0 = tcg_constant_i64(hook->data);
+                tcg_gen_call4(info->func, info, NULL, tcgv_i64_temp(tmp0),
-                TCGv_i64 tmp1 = tcg_constant_i64(cur_id);
+                              tcgv_i64_temp(tmp1), pc, addr);
-                TCGTemp* tmp2[3] = {tcgv_i64_temp(tmp0), tcgv_i64_temp(tmp1),
-                                    addr};
-                tcg_gen_callN(info->func, info, NULL, tmp2);
-                tcg_temp_free_i64(tmp0);
-                tcg_temp_free_i64(tmp1);
             } else if (hook->helper_infoN.func) {
-                TCGv_i64 tmp0 = tcg_constant_i64(hook->data);
+                TCGv tmp3 = tcg_constant_tl(size);
-                TCGv_i64 tmp1 = tcg_constant_i64(cur_id);
+
-                TCGv tmp2 = tcg_constant_tl(size);
+                tcg_gen_call5(hook->helper_infoN.func, &hook->helper_infoN,
-                TCGTemp* tmp3[4] = {tcgv_i64_temp(tmp0), tcgv_i64_temp(tmp1),
+                              NULL, tcgv_i64_temp(tmp0), tcgv_i64_temp(tmp1),
-                                    addr,
+                              pc, addr, tcgv_tl_temp(tmp3));
-#if TARGET_LONG_BITS == 32
-                                    tcgv_i32_temp(tmp2)};
-#else
-                                    tcgv_i64_temp(tmp2)};
-#endif
-                tcg_gen_callN(hook->helper_infoN.func, &hook->helper_infoN,
-                              NULL, tmp3);
-                tcg_temp_free_i64(tmp0);
-                tcg_temp_free_i64(tmp1);
-#if TARGET_LONG_BITS == 32
-                tcg_temp_free_i32(tmp2);
-#else
-                tcg_temp_free_i64(tmp2);
-#endif
             }
         }
         hook = hook->next;
     }
 }
 
-void libafl_gen_read(TCGTemp* addr, MemOpIdx oi)
+void libafl_gen_read(TCGTemp* pc, TCGTemp* addr, MemOpIdx oi)
 {
-    libafl_gen_rw(addr, oi, libafl_read_hooks);
+    libafl_gen_rw(pc, addr, oi, libafl_read_hooks);
 }
 
-void libafl_gen_write(TCGTemp* addr, MemOpIdx oi)
+void libafl_gen_write(TCGTemp* pc, TCGTemp* addr, MemOpIdx oi)
 {
-    libafl_gen_rw(addr, oi, libafl_write_hooks);
+    libafl_gen_rw(pc, addr, oi, libafl_write_hooks);
 }

libafl/system.c

@@ -17,12 +17,13 @@ int libafl_qemu_remove_hw_breakpoint(vaddr addr)
     return libafl_qemu_toggle_hw_breakpoint(addr, false);
 }
 
-int libafl_qemu_toggle_hw_breakpoint(vaddr addr, bool set) {
+int libafl_qemu_toggle_hw_breakpoint(vaddr addr, bool set)
+{
     const int type = GDB_BREAKPOINT_HW;
     const vaddr len = 1;
-    const AccelOpsClass *ops = cpus_get_accel();
+    const AccelOpsClass* ops = cpus_get_accel();
-    
+
-    CPUState *cs = first_cpu;
+    CPUState* cs = first_cpu;
     int ret = 0;
 
     if (!ops->insert_breakpoint) {

tcg/tcg-op-ldst.c

@@ -32,6 +32,10 @@
 #include "tcg-internal.h"
 
 //// --- Begin LibAFL code ---
+extern tcg_target_ulong libafl_gen_cur_pc;
+
+void libafl_gen_read(TCGTemp* pc, TCGTemp* addr, MemOpIdx oi);
+void libafl_gen_write(TCGTemp* pc, TCGTemp* addr, MemOpIdx oi);
 
 /* Copied over from the plugin_maybe_preserve_addr function
  * The variable needs to be free'd after use
@@ -52,9 +56,6 @@ static TCGv_i64 libafl_gen_preserve_addr(TCGTemp *addr)
     return temp;
 }
 
-void libafl_gen_read(TCGTemp *addr, MemOpIdx oi);
-void libafl_gen_write(TCGTemp *addr, MemOpIdx oi);
-
 //// --- End LibAFL code ---
 
 static void check_max_alignment(unsigned a_bits)
@@ -239,7 +240,8 @@ static void tcg_gen_qemu_ld_i32_int(TCGv_i32 val, TCGTemp *addr,
 
 //// --- Begin LibAFL code ---
 
-    libafl_gen_read(tcgv_i64_temp(libafl_addr), orig_oi);
+    TCGv_i64 cur_pc = tcg_constant_i64(libafl_gen_cur_pc);
+    libafl_gen_read(tcgv_i64_temp(cur_pc), tcgv_i64_temp(libafl_addr), orig_oi);
     tcg_temp_free_i64(libafl_addr);
 
 //// --- End LibAFL code ---
@@ -314,7 +316,8 @@ static void tcg_gen_qemu_st_i32_int(TCGv_i32 val, TCGTemp *addr,
 
 //// --- Begin LibAFL code ---
 
-    libafl_gen_write(addr, oi);
+    TCGv_i64 cur_pc = tcg_constant_i64(libafl_gen_cur_pc);
+    libafl_gen_write(tcgv_i64_temp(cur_pc), addr, oi);
 
 //// --- End LibAFL code ---
 
@@ -380,7 +383,8 @@ static void tcg_gen_qemu_ld_i64_int(TCGv_i64 val, TCGTemp *addr,
 
 //// --- Begin LibAFL code ---
 
-    libafl_gen_read(tcgv_i64_temp(libafl_addr), orig_oi);
+    TCGv_i64 cur_pc = tcg_constant_i64(libafl_gen_cur_pc);
+    libafl_gen_read(tcgv_i64_temp(cur_pc), tcgv_i64_temp(libafl_addr), orig_oi);
     tcg_temp_free_i64(libafl_addr);
 
 //// --- End LibAFL code ---
@@ -459,7 +463,8 @@ static void tcg_gen_qemu_st_i64_int(TCGv_i64 val, TCGTemp *addr,
 
 //// --- Begin LibAFL code ---
 
-    libafl_gen_write(addr, oi);
+    TCGv_i64 cur_pc = tcg_constant_i64(libafl_gen_cur_pc);
+    libafl_gen_write(tcgv_i64_temp(cur_pc), addr, oi);
 
 //// --- End LibAFL code ---
 
@@ -673,7 +678,8 @@ static void tcg_gen_qemu_ld_i128_int(TCGv_i128 val, TCGTemp *addr,
 
 //// --- Begin LibAFL code ---
 
-    libafl_gen_read(addr, orig_oi);
+    TCGv_i64 cur_pc = tcg_constant_i64(libafl_gen_cur_pc);
+    libafl_gen_read(tcgv_i64_temp(cur_pc), addr, orig_oi);
 
 //// --- End LibAFL code ---
 
@@ -795,7 +801,8 @@ static void tcg_gen_qemu_st_i128_int(TCGv_i128 val, TCGTemp *addr,
 
 //// --- Begin LibAFL code ---
 
-    libafl_gen_write(addr, orig_oi);
+    TCGv_i64 cur_pc = tcg_constant_i64(libafl_gen_cur_pc);
+    libafl_gen_write(tcgv_i64_temp(cur_pc), addr, orig_oi);
 
 //// --- End LibAFL code ---
 
@@ -1293,11 +1300,14 @@ void tcg_gen_atomic_##NAME##_i32_chk(TCGv_i32 ret, TCGTemp *addr,       \
     tcg_debug_assert((memop & MO_SIZE) <= MO_32);                       \
     if (tcg_ctx->gen_tb->cflags & CF_PARALLEL) {                        \
 /*** --- Begin LibAFL code --- ***/                                     \
-        libafl_gen_read(addr, make_memop_idx(memop, 0));                \
+        TCGv_i64 cur_pc = tcg_constant_i64(libafl_gen_cur_pc);          \
+        libafl_gen_read(                                                \
+            tcgv_i64_temp(cur_pc), addr, make_memop_idx(memop, 0));     \
 /*** --- End LibAFL code --- ***/                                       \
         do_atomic_op_i32(ret, addr, val, idx, memop, table_##NAME);     \
 /*** --- Begin LibAFL code --- ***/                                     \
-        libafl_gen_write(addr, make_memop_idx(memop, 0));               \
+        libafl_gen_write(                                               \
+            tcgv_i64_temp(cur_pc), addr, make_memop_idx(memop, 0));     \
 /*** --- End LibAFL code --- ***/                                       \
     } else {                                                            \
         do_nonatomic_op_i32(ret, addr, val, idx, memop, NEW,            \
@@ -1312,11 +1322,14 @@ void tcg_gen_atomic_##NAME##_i64_chk(TCGv_i64 ret, TCGTemp *addr,       \
     tcg_debug_assert((memop & MO_SIZE) <= MO_64);                       \
     if (tcg_ctx->gen_tb->cflags & CF_PARALLEL) {                        \
 /*** --- Begin LibAFL code --- ***/                                     \
-        libafl_gen_read(addr, make_memop_idx(memop, 0));                \
+        TCGv_i64 cur_pc = tcg_constant_i64(libafl_gen_cur_pc);          \
+        libafl_gen_read(                                                \
+            tcgv_i64_temp(cur_pc), addr, make_memop_idx(memop, 0));     \
 /*** --- End LibAFL code --- ***/                                       \
         do_atomic_op_i64(ret, addr, val, idx, memop, table_##NAME);     \
 /*** --- Begin LibAFL code --- ***/                                     \
-        libafl_gen_write(addr, make_memop_idx(memop, 0));               \
+        libafl_gen_write(                                               \
+            tcgv_i64_temp(cur_pc), addr, make_memop_idx(memop, 0));     \
 /*** --- End LibAFL code --- ***/                                       \
     } else {                                                            \
         do_nonatomic_op_i64(ret, addr, val, idx, memop, NEW,            \

tcg/tcg-op-vec.c

@@ -25,9 +25,10 @@
 #include "tcg-internal.h"
 
 //// --- Begin LibAFL code ---
+extern tcg_target_ulong libafl_gen_cur_pc;
 
-void libafl_gen_read(TCGTemp *addr, MemOpIdx oi);
+void libafl_gen_read(TCGTemp* pc, TCGTemp* addr, MemOpIdx oi);
-void libafl_gen_write(TCGTemp *addr, MemOpIdx oi);
+void libafl_gen_write(TCGTemp* pc, TCGTemp* addr, MemOpIdx oi);
 
 //// --- End LibAFL code ---
 
@@ -293,7 +294,8 @@ void tcg_gen_ld_vec(TCGv_vec r, TCGv_ptr b, TCGArg o)
     vec_gen_ldst(INDEX_op_ld_vec, r, b, o);
 
 //// --- Begin LibAFL code ---
-    libafl_gen_read(tcgv_ptr_temp(b), oi);
+    TCGv_i64 cur_pc = tcg_constant_i64(libafl_gen_cur_pc);
+    libafl_gen_read(tcgv_i64_temp(cur_pc), tcgv_ptr_temp(b), oi);
 //// --- End LibAFL code ---
 }
 
@@ -309,7 +311,8 @@ void tcg_gen_st_vec(TCGv_vec r, TCGv_ptr b, TCGArg o)
     vec_gen_ldst(INDEX_op_st_vec, r, b, o);
 
 //// --- Begin LibAFL code ---
-    libafl_gen_write(tcgv_ptr_temp(b), oi);
+    TCGv_i64 cur_pc = tcg_constant_i64(libafl_gen_cur_pc);
+    libafl_gen_write(tcgv_i64_temp(cur_pc), tcgv_ptr_temp(b), oi);
 //// --- End LibAFL code ---
 }
 
@@ -328,7 +331,8 @@ void tcg_gen_stl_vec(TCGv_vec r, TCGv_ptr b, TCGArg o, TCGType low_type)
     vec_gen_3(INDEX_op_st_vec, low_type, 0, ri, bi, o);
 
 //// --- Begin LibAFL code ---
-    libafl_gen_write(tcgv_ptr_temp(b), oi);
+    TCGv_i64 cur_pc = tcg_constant_i64(libafl_gen_cur_pc);
+    libafl_gen_write(tcgv_i64_temp(cur_pc), tcgv_ptr_temp(b), oi);
 //// --- End LibAFL code ---
 }