Skip to content

Commit eb1d011

Browse files
rmalmainrmalmain
committed
Refactor read/write hooks:
* add PC to the callbacks * simplify code, merge common code * use macros * remove useless tcg frees
1 parent 30ad91f commit eb1d011

File tree

11 files changed

+169
-197
lines changed

11 files changed

+169
-197
lines changed

‎include/libafl/hook.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@
5353
}
5454

5555
// TODO: cleanup this
56-
extern target_ulong libafl_gen_cur_pc;
56+
extern tcg_target_ulong libafl_gen_cur_pc;
5757
extern size_t libafl_qemu_hooks_num;
5858

5959
void libafl_tcg_gen_asan(TCGTemp* addr, size_t size);

‎include/libafl/hooks/tcg/instruction.h‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,8 @@
1414
#define LIBAFL_TABLES_HASH(p) \
1515
(((13 * ((size_t)(p))) ^ (((size_t)(p)) >> 15)) % LIBAFL_TABLES_SIZE)
1616

17+
typedef void (*libafl_instruction_cb)(uint64_t data, target_ulong pc);
18+
1719
struct libafl_instruction_hook {
1820
// data
1921
uint64_t data;
@@ -28,8 +30,7 @@ struct libafl_instruction_hook {
2830
};
2931

3032
size_t libafl_qemu_add_instruction_hooks(target_ulong pc,
31-
void (*callback)(uint64_t data,
32-
target_ulong pc),
33+
libafl_instruction_cb callback,
3334
uint64_t data, int invalidate);
3435

3536
int libafl_qemu_remove_instruction_hook(size_t num, int invalidate);

‎include/libafl/hooks/tcg/read_write.h‎

Lines changed: 20 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,6 @@
22

33
#include "qemu/osdep.h"
44

5-
#include "qapi/error.h"
6-
7-
#include "exec/exec-all.h"
8-
#include "exec/tb-flush.h"
9-
105
#include "libafl/exit.h"
116
#include "libafl/hook.h"
127

@@ -17,9 +12,16 @@
1712
#define LIBAFL_TABLES_HASH(p) \
1813
(((13 * ((size_t)(p))) ^ (((size_t)(p)) >> 15)) % LIBAFL_TABLES_SIZE)
1914

15+
typedef uint64_t (*libafl_rw_gen_cb)(uint64_t data, target_ulong pc,
16+
TCGTemp* addr, MemOpIdx oi);
17+
typedef void (*libafl_rw_exec_cb)(uint64_t data, uint64_t id, target_ulong pc,
18+
target_ulong addr);
19+
typedef void (*libafl_rw_execN_cb)(uint64_t data, uint64_t id, target_ulong pc,
20+
target_ulong addr, size_t size);
21+
2022
struct libafl_rw_hook {
2123
// functions
22-
uint64_t (*gen)(uint64_t data, target_ulong pc, TCGTemp* addr, MemOpIdx oi);
24+
libafl_rw_gen_cb gen;
2325

2426
// data
2527
uint64_t data;
@@ -36,25 +38,18 @@ struct libafl_rw_hook {
3638
struct libafl_rw_hook* next;
3739
};
3840

39-
void libafl_gen_read(TCGTemp* addr, MemOpIdx oi);
40-
void libafl_gen_write(TCGTemp* addr, MemOpIdx oi);
41-
42-
size_t libafl_add_read_hook(
43-
uint64_t (*gen)(uint64_t data, target_ulong pc, TCGTemp* addr, MemOpIdx oi),
44-
void (*exec1)(uint64_t data, uint64_t id, target_ulong addr),
45-
void (*exec2)(uint64_t data, uint64_t id, target_ulong addr),
46-
void (*exec4)(uint64_t data, uint64_t id, target_ulong addr),
47-
void (*exec8)(uint64_t data, uint64_t id, target_ulong addr),
48-
void (*execN)(uint64_t data, uint64_t id, target_ulong addr, size_t size),
49-
uint64_t data);
50-
size_t libafl_add_write_hook(
51-
uint64_t (*gen)(uint64_t data, target_ulong pc, TCGTemp* addr, MemOpIdx oi),
52-
void (*exec1)(uint64_t data, uint64_t id, target_ulong addr),
53-
void (*exec2)(uint64_t data, uint64_t id, target_ulong addr),
54-
void (*exec4)(uint64_t data, uint64_t id, target_ulong addr),
55-
void (*exec8)(uint64_t data, uint64_t id, target_ulong addr),
56-
void (*execN)(uint64_t data, uint64_t id, target_ulong addr, size_t size),
57-
uint64_t data);
41+
void libafl_gen_read(TCGTemp* pc, TCGTemp* addr, MemOpIdx oi);
42+
void libafl_gen_write(TCGTemp* pc, TCGTemp* addr, MemOpIdx oi);
43+
44+
size_t libafl_add_read_hook(libafl_rw_gen_cb gen, libafl_rw_exec_cb exec1,
45+
libafl_rw_exec_cb exec2, libafl_rw_exec_cb exec4,
46+
libafl_rw_exec_cb exec8, libafl_rw_execN_cb execN,
47+
uint64_t data);
48+
49+
size_t libafl_add_write_hook(libafl_rw_gen_cb gen, libafl_rw_exec_cb exec1,
50+
libafl_rw_exec_cb exec2, libafl_rw_exec_cb exec4,
51+
libafl_rw_exec_cb exec8, libafl_rw_execN_cb execN,
52+
uint64_t data);
5853

5954
int libafl_qemu_remove_read_hook(size_t num, int invalidate);
6055
int libafl_qemu_remove_write_hook(size_t num, int invalidate);

‎libafl/cpu.c‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -140,7 +140,8 @@ int libafl_qemu_num_regs(CPUState* cpu)
140140
if (cc->gdb_num_core_regs) {
141141
num_regs = cc->gdb_num_core_regs;
142142
} else {
143-
const GDBFeature *feature = gdb_find_static_feature(cc->gdb_core_xml_file);
143+
const GDBFeature* feature =
144+
gdb_find_static_feature(cc->gdb_core_xml_file);
144145

145146
g_assert(feature);
146147
g_assert(feature->num_regs > 0);

‎libafl/exit.c‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -165,7 +165,6 @@ void libafl_qemu_breakpoint_run(vaddr pc_next)
165165
if (bp->addr == pc_next) {
166166
TCGv_i64 tmp0 = tcg_constant_i64((uint64_t)pc_next);
167167
gen_helper_libafl_qemu_handle_breakpoint(tcg_env, tmp0);
168-
tcg_temp_free_i64(tmp0);
169168
}
170169
bp = bp->next;
171170
}

‎libafl/hooks/tcg/cmp.c‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -122,8 +122,6 @@ void libafl_gen_cmp(target_ulong pc, TCGv op0, TCGv op1, MemOp ot)
122122
tcgv_i64_temp(op0), tcgv_i64_temp(op1)};
123123
#endif
124124
tcg_gen_callN(info->func, info, NULL, tmp2);
125-
tcg_temp_free_i64(tmp0);
126-
tcg_temp_free_i64(tmp1);
127125
}
128126
hook = hook->next;
129127
}

‎libafl/hooks/tcg/instruction.c‎

Lines changed: 3 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -3,18 +3,14 @@
33

44
#include "libafl/cpu.h"
55

6-
target_ulong libafl_gen_cur_pc;
6+
tcg_target_ulong libafl_gen_cur_pc;
77
struct libafl_instruction_hook*
88
libafl_qemu_instruction_hooks[LIBAFL_TABLES_SIZE];
99
size_t libafl_qemu_hooks_num = 0;
1010

1111
size_t libafl_qemu_add_instruction_hooks(target_ulong pc,
12-
void (*callback)(uint64_t data,
13-
target_ulong pc),
14-
uint64_t
15-
16-
data,
17-
int invalidate)
12+
libafl_instruction_cb callback,
13+
uint64_t data, int invalidate)
1814
{
1915
CPUState* cpu;
2016

@@ -124,13 +120,6 @@ void libafl_qemu_hook_instruction_run(vaddr pc_next)
124120
TCGv_i64 tmp1 = tcg_constant_i64(pc_next);
125121
TCGTemp* tmp2[2] = {tcgv_i64_temp(tmp0), tcgv_i64_temp(tmp1)};
126122
#endif
127-
// tcg_gen_callN(hk->callback, NULL, 2, tmp2);
128123
tcg_gen_callN(hk->helper_info.func, &hk->helper_info, NULL, tmp2);
129-
#if TARGET_LONG_BITS == 32
130-
tcg_temp_free_i32(tmp1);
131-
#else
132-
tcg_temp_free_i64(tmp1);
133-
#endif
134-
tcg_temp_free_i64(tmp0);
135124
}
136125
}

0 commit comments

Comments
 (0)