SYS-OSS/FRET-qemu
4
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

format

Browse Source
This commit is contained in:
Romain Malmain 2025-04-29 14:29:00 +02:00
parent 7633d5fce5
commit 9366380915
No known key found for this signature in database
GPG Key ID: 02E4A13F7415468A
4 changed files with 103 additions and 94 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
include/libafl/tcg-helper.h
View File

@ -1,4 +1,4 @@
DEF_HELPER_FLAGS_2(libafl_qemu_handle_breakpoint, TCG_CALL_NO_RWG,
void, env, i64)
DEF_HELPER_FLAGS_3(libafl_qemu_handle_custom_insn, TCG_CALL_NO_RWG,
void, env, i64, i32)
DEF_HELPER_FLAGS_2(libafl_qemu_handle_breakpoint, TCG_CALL_NO_RWG, void, env,
i64)
DEF_HELPER_FLAGS_3(libafl_qemu_handle_custom_insn, TCG_CALL_NO_RWG, void, env,
i64, i32)

1
include/libafl/tcg.h
View File

@ -5,4 +5,3 @@
void tcg_gen_callN(void* func, TCGHelperInfo* info, TCGTemp* ret,
TCGTemp** args);

6
libafl/tcg-helper.c
View File

@ -15,8 +15,10 @@ void HELPER(libafl_qemu_handle_breakpoint)(CPUArchState *env, uint64_t pc)
libafl_exit_request_breakpoint(cpu, (target_ulong)pc);
}
void HELPER(libafl_qemu_handle_custom_insn)(CPUArchState *env, uint64_t pc, uint32_t kind)
void HELPER(libafl_qemu_handle_custom_insn)(CPUArchState* env, uint64_t pc,
uint32_t kind)
{
CPUState* cpu = env_cpu(env);
libafl_exit_request_custom_insn(cpu, (target_ulong) pc, (enum libafl_custom_insn_kind) kind);
libafl_exit_request_custom_insn(cpu, (target_ulong)pc,
(enum libafl_custom_insn_kind)kind);
}

36
libafl/tcg.c
View File

@ -19,8 +19,7 @@ static target_ulong reverse_bits(target_ulong num)
target_ulong reverse_num = num;
num >>= 1;
while(num)
{
while (num) {
reverse_num <<= 1;
reverse_num |= num & 1;
num >>= 1;
@ -35,8 +34,8 @@ static target_ulong reverse_bits(target_ulong num)
* Return the size of the generated code, or negative on error.
*/
static int libafl_setjmp_gen_code(CPUArchState* env, TranslationBlock* tb,
vaddr pc, void *host_pc,
int *max_insns, int64_t *ti)
vaddr pc, void* host_pc, int* max_insns,
int64_t* ti)
{
int ret = sigsetjmp(tcg_ctx->jmp_trans, 0);
if (unlikely(ret != 0)) {
@ -48,7 +47,8 @@ static int libafl_setjmp_gen_code(CPUArchState *env, TranslationBlock *tb,
tcg_ctx->cpu = env_cpu(env);
// -- start gen_intermediate_code
const int num_insns = 1; // do "as-if" we were translating a single target instruction
const int num_insns =
1; // do "as-if" we were translating a single target instruction
#ifndef TARGET_INSN_START_EXTRA_WORDS
tcg_gen_insn_start(pc);
@ -66,10 +66,13 @@ static int libafl_setjmp_gen_code(CPUArchState *env, TranslationBlock *tb,
tcg_gen_goto_tb(0);
tcg_gen_exit_tb(tb, 0);
// This is obviously wrong, but it is required that the number / size of target instruction translated
// is at least 1. For now, we make it so that no problem occurs later on.
tb->icount = num_insns; // number of target instructions translated in the TB.
tb->size = num_insns; // size (in target bytes) of target instructions translated in the TB.
// This is obviously wrong, but it is required that the number / size of
// target instruction translated is at least 1. For now, we make it so that
// no problem occurs later on.
tb->icount =
num_insns; // number of target instructions translated in the TB.
tb->size = num_insns; // size (in target bytes) of target instructions
// translated in the TB.
// -- end gen_intermediate_code
assert(tb->size != 0);
@ -106,7 +109,8 @@ TranslationBlock *libafl_gen_edge(CPUState *cpu, target_ulong src_block,
assert_memory_lock();
qemu_thread_jit_write();
// TODO: this (get_page_addr_code_hostp) is a bottleneck in systemmode, investigate why
// TODO: this (get_page_addr_code_hostp) is a bottleneck in systemmode,
// investigate why
phys_pc = get_page_addr_code_hostp(env, src_block, &host_pc);
phys_pc ^= reverse_bits((tb_page_addr_t)exit_n);
@ -170,7 +174,8 @@ TranslationBlock *libafl_gen_edge(CPUState *cpu, target_ulong src_block,
restart_translate:
trace_translate_block(tb, pc, tb->tc.ptr);
gen_code_size = libafl_setjmp_gen_code(env, tb, pc, host_pc, &max_insns, &ti);
gen_code_size =
libafl_setjmp_gen_code(env, tb, pc, host_pc, &max_insns, &ti);
if (unlikely(gen_code_size < 0)) {
switch (gen_code_size) {
case -1:
@ -191,7 +196,9 @@ TranslationBlock *libafl_gen_edge(CPUState *cpu, target_ulong src_block,
goto buffer_overflow;
case -2:
assert(false && "This should never happen for edge code. There must be a bug.");
assert(
false &&
"This should never happen for edge code. There must be a bug.");
/*
* The code generated for the TranslationBlock is too large.
* The maximum size allowed by the unwind info is 64k.
@ -250,8 +257,9 @@ TranslationBlock *libafl_gen_edge(CPUState *cpu, target_ulong src_block,
*/
perf_report_code(pc, tb, tcg_splitwx_to_rx(gen_code_buf));
qatomic_set(&tcg_ctx->code_gen_ptr, (void *)
ROUND_UP((uintptr_t)gen_code_buf + gen_code_size + search_size,
qatomic_set(
&tcg_ctx->code_gen_ptr,
(void*)ROUND_UP((uintptr_t)gen_code_buf + gen_code_size + search_size,
CODE_GEN_ALIGN));
/* init jump list */