Skip to content

Commit ace3646

Browse files
rmalmainrmalmain
authored
Nyx api support (#97)
* add nyx support * target independent helper call.
1 parent 06bf8fa commit ace3646

File tree

10 files changed

+58
-27
lines changed

10 files changed

+58
-27
lines changed

‎accel/tcg/tcg-runtime.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -45,10 +45,10 @@ void HELPER(libafl_qemu_handle_breakpoint)(CPUArchState *env, uint64_t pc)
4545
libafl_exit_request_breakpoint(cpu, (target_ulong) pc);
4646
}
4747

48-
void HELPER(libafl_qemu_handle_sync_backdoor)(CPUArchState *env, uint64_t pc)
48+
void HELPER(libafl_qemu_handle_custom_insn)(CPUArchState *env, uint64_t pc, uint32_t kind)
4949
{
5050
CPUState* cpu = env_cpu(env);
51-
libafl_exit_request_sync_backdoor(cpu, (target_ulong) pc);
51+
libafl_exit_request_custom_insn(cpu, (target_ulong) pc, (enum libafl_custom_insn_kind) kind);
5252
}
5353

5454
//// --- End LibAFL code ---

‎accel/tcg/tcg-runtime.h

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -329,7 +329,7 @@ DEF_HELPER_FLAGS_5(gvec_bitsel, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
329329
DEF_HELPER_FLAGS_2(libafl_qemu_handle_breakpoint, TCG_CALL_NO_RWG,
330330
void, env, i64)
331331

332-
DEF_HELPER_FLAGS_2(libafl_qemu_handle_sync_backdoor, TCG_CALL_NO_RWG,
333-
void, env, i64)
332+
DEF_HELPER_FLAGS_3(libafl_qemu_handle_custom_insn, TCG_CALL_NO_RWG,
333+
void, env, i64, i32)
334334

335335
//// --- End LibAFL code ---

‎accel/tcg/translator.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -200,7 +200,7 @@ void translator_loop(CPUState *cpu, TranslationBlock *tb, int *max_insns,
200200
db->pc_next += 4;
201201

202202
TCGv_i64 tmp0 = tcg_constant_i64((uint64_t)db->pc_next);
203-
gen_helper_libafl_qemu_handle_sync_backdoor(tcg_env, tmp0);
203+
gen_helper_libafl_qemu_handle_custom_insn(tcg_env, tmp0, tcg_constant_i32(LIBAFL_CUSTOM_INSN_LIBAFL));
204204
tcg_temp_free_i64(tmp0);
205205
}
206206
}

‎include/libafl/exit.h

Lines changed: 24 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -10,18 +10,19 @@ struct libafl_breakpoint {
1010
struct libafl_breakpoint* next;
1111
};
1212

13-
int libafl_qemu_set_breakpoint(target_ulong pc);
14-
int libafl_qemu_remove_breakpoint(target_ulong pc);
15-
void libafl_qemu_trigger_breakpoint(CPUState* cpu);
16-
void libafl_qemu_breakpoint_run(vaddr pc_next);
17-
1813
enum libafl_exit_reason_kind {
1914
INTERNAL = 0,
2015
BREAKPOINT = 1,
21-
SYNC_EXIT = 2,
16+
CUSTOM_INSN = 2,
2217
TIMEOUT = 3,
2318
};
2419

20+
enum libafl_custom_insn_kind {
21+
LIBAFL_CUSTOM_INSN_UNDEFINED = 0,
22+
LIBAFL_CUSTOM_INSN_LIBAFL = 1,
23+
LIBAFL_CUSTOM_INSN_NYX = 2,
24+
};
25+
2526
// QEMU exited on its own for some reason.
2627
struct libafl_exit_reason_internal {
2728
ShutdownCause cause;
@@ -34,23 +35,32 @@ struct libafl_exit_reason_breakpoint {
3435
};
3536

3637
// A synchronous exit has been triggered.
37-
struct libafl_exit_reason_sync_exit {};
38+
struct libafl_exit_reason_custom_insn {
39+
enum libafl_custom_insn_kind kind;
40+
};
3841

3942
// A timeout occured and we were asked to exit on timeout
40-
struct libafl_exit_reason_timeout {};
43+
struct libafl_exit_reason_timeout {
44+
};
4145

4246
struct libafl_exit_reason {
4347
enum libafl_exit_reason_kind kind;
4448
CPUState* cpu; // CPU that triggered an exit.
4549
vaddr next_pc; // The PC that should be stored in the CPU when re-entering.
4650
union {
47-
struct libafl_exit_reason_internal internal; // kind == INTERNAL
48-
struct libafl_exit_reason_breakpoint breakpoint; // kind == BREAKPOINT
49-
struct libafl_exit_reason_sync_exit sync_exit; // kind == SYNC_EXIT
50-
struct libafl_exit_reason_timeout timeout; // kind == TIMEOUT
51+
struct libafl_exit_reason_internal internal; // kind == INTERNAL
52+
struct libafl_exit_reason_breakpoint breakpoint; // kind == BREAKPOINT
53+
struct libafl_exit_reason_custom_insn
54+
custom_insn; // kind == CUSTOM_INSN
55+
struct libafl_exit_reason_timeout timeout; // kind == TIMEOUT
5156
} data;
5257
};
5358

59+
int libafl_qemu_set_breakpoint(target_ulong pc);
60+
int libafl_qemu_remove_breakpoint(target_ulong pc);
61+
void libafl_qemu_trigger_breakpoint(CPUState* cpu);
62+
void libafl_qemu_breakpoint_run(vaddr pc_next);
63+
5464
// Only makes sense to call if an exit was expected
5565
// Will return NULL if there was no exit expected.
5666
CPUState* libafl_last_exit_cpu(void);
@@ -62,7 +72,8 @@ void libafl_sync_exit_cpu(void);
6272
void libafl_exit_request_internal(CPUState* cpu, uint64_t pc,
6373
ShutdownCause cause, int signal);
6474
void libafl_exit_request_breakpoint(CPUState* cpu, target_ulong pc);
65-
void libafl_exit_request_sync_backdoor(CPUState* cpu, target_ulong pc);
75+
void libafl_exit_request_custom_insn(CPUState* cpu, target_ulong pc,
76+
enum libafl_custom_insn_kind kind);
6677

6778
#ifndef CONFIG_USER_ONLY
6879
void libafl_exit_request_timeout(void);

‎include/libafl/tcg.h

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,5 +6,5 @@
66
#include "tcg/tcg.h"
77
#include "tcg/helper-info.h"
88

9-
void tcg_gen_callN(void *func, TCGHelperInfo *info,
10-
TCGTemp *ret, TCGTemp **args);
9+
void tcg_gen_callN(void* func, TCGHelperInfo* info, TCGTemp* ret,
10+
TCGTemp** args);

‎libafl/exit.c

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -110,9 +110,10 @@ void libafl_exit_request_internal(CPUState* cpu, uint64_t pc,
110110
expected_exit = true;
111111
}
112112

113-
void libafl_exit_request_sync_backdoor(CPUState* cpu, target_ulong pc)
113+
void libafl_exit_request_custom_insn(CPUState* cpu, target_ulong pc,
114+
enum libafl_custom_insn_kind kind)
114115
{
115-
last_exit_reason.kind = SYNC_EXIT;
116+
last_exit_reason.kind = CUSTOM_INSN;
116117

117118
prepare_qemu_exit(cpu, pc);
118119
}

‎libafl/hooks/tcg/block.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,8 @@ void libafl_qemu_hook_block_run(target_ulong pc)
8181
TCGv_i64 tmp0 = tcg_constant_i64(hook->data);
8282
TCGv_i64 tmp1 = tcg_constant_i64(cur_id);
8383
TCGTemp* tmp2[2] = {tcgv_i64_temp(tmp0), tcgv_i64_temp(tmp1)};
84-
tcg_gen_callN(hook->helper_info.func, &hook->helper_info, NULL, tmp2);
84+
tcg_gen_callN(hook->helper_info.func, &hook->helper_info, NULL,
85+
tmp2);
8586
tcg_temp_free_i64(tmp0);
8687
tcg_temp_free_i64(tmp1);
8788
}

‎libafl/hooks/tcg/edge.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,7 @@ static TCGHelperInfo libafl_exec_edge_hook_info = {
99
.name = "libafl_exec_edge_hook",
1010
.flags = dh_callflag(void),
1111
.typemask =
12-
dh_typemask(void, 0) | dh_typemask(i64, 1) | dh_typemask(i64, 2)
13-
};
12+
dh_typemask(void, 0) | dh_typemask(i64, 1) | dh_typemask(i64, 2)};
1413

1514
GEN_REMOVE_HOOK(edge)
1615

@@ -86,7 +85,8 @@ void libafl_qemu_hook_edge_run(void)
8685
TCGv_i64 tmp0 = tcg_constant_i64(hook->data);
8786
TCGv_i64 tmp1 = tcg_constant_i64(hook->cur_id);
8887
TCGTemp* tmp2[2] = {tcgv_i64_temp(tmp0), tcgv_i64_temp(tmp1)};
89-
tcg_gen_callN(hook->helper_info.func, &hook->helper_info, NULL, tmp2);
88+
tcg_gen_callN(hook->helper_info.func, &hook->helper_info, NULL,
89+
tmp2);
9090
tcg_temp_free_i64(tmp0);
9191
tcg_temp_free_i64(tmp1);
9292
}

‎libafl/hooks/tcg/read_write.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -216,7 +216,8 @@ static void libafl_gen_rw(TCGTemp* addr, MemOpIdx oi,
216216
#else
217217
tcgv_i64_temp(tmp2)};
218218
#endif
219-
tcg_gen_callN(hook->helper_infoN.func, &hook->helper_infoN, NULL, tmp3);
219+
tcg_gen_callN(hook->helper_infoN.func, &hook->helper_infoN,
220+
NULL, tmp3);
220221
tcg_temp_free_i64(tmp0);
221222
tcg_temp_free_i64(tmp1);
222223
#if TARGET_LONG_BITS == 32

‎target/i386/tcg/translate.c

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3287,6 +3287,23 @@ static void disas_insn_old(DisasContext *s, CPUState *cpu, int b)
32873287
gen_op_st_v(s, CODE64(s) + MO_32, s->T0, s->A0);
32883288
break;
32893289

3290+
//// --- Begin LibAFL code ---
3291+
case 0xc1: /* vmcall */
3292+
// move pc to T0
3293+
tcg_gen_movi_tl(s->T0, s->pc - s->cs_base);
3294+
3295+
// gen jump to next insn
3296+
gen_op_jmp_v(s, s->T0);
3297+
gen_bnd_jmp(s);
3298+
s->base.is_jmp = DISAS_JUMP;
3299+
3300+
// gen helper to signal to get out
3301+
TCGv_i64 new_pc = tcg_temp_new_i64();
3302+
tcg_gen_extu_tl_i64(new_pc, s->T0);
3303+
gen_helper_libafl_qemu_handle_custom_insn(tcg_env, new_pc, tcg_constant_i32(LIBAFL_CUSTOM_INSN_NYX));
3304+
break;
3305+
//// --- End LibAFL code ---
3306+
32903307
case 0xc8: /* monitor */
32913308
if (!(s->cpuid_ext_features & CPUID_EXT_MONITOR) || CPL(s) != 0) {
32923309
goto illegal_op;

0 commit comments

Comments
 (0)