Skip to content

Commit f122e3c

Browse files
MarcondiroMarcondiro
committed
Merge remote-tracking branch 'upstream/main'
2 parents f53a020 + ace3646 commit f122e3c

File tree

12 files changed

+61
-27
lines changed

12 files changed

+61
-27
lines changed

‎accel/tcg/tcg-runtime.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -45,10 +45,10 @@ void HELPER(libafl_qemu_handle_breakpoint)(CPUArchState *env, uint64_t pc)
4545
libafl_exit_request_breakpoint(cpu, (target_ulong) pc);
4646
}
4747

48-
void HELPER(libafl_qemu_handle_sync_backdoor)(CPUArchState *env, uint64_t pc)
48+
void HELPER(libafl_qemu_handle_custom_insn)(CPUArchState *env, uint64_t pc, uint32_t kind)
4949
{
5050
CPUState* cpu = env_cpu(env);
51-
libafl_exit_request_sync_backdoor(cpu, (target_ulong) pc);
51+
libafl_exit_request_custom_insn(cpu, (target_ulong) pc, (enum libafl_custom_insn_kind) kind);
5252
}
5353

5454
//// --- End LibAFL code ---

‎accel/tcg/tcg-runtime.h‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -329,7 +329,7 @@ DEF_HELPER_FLAGS_5(gvec_bitsel, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
329329
DEF_HELPER_FLAGS_2(libafl_qemu_handle_breakpoint, TCG_CALL_NO_RWG,
330330
void, env, i64)
331331

332-
DEF_HELPER_FLAGS_2(libafl_qemu_handle_sync_backdoor, TCG_CALL_NO_RWG,
333-
void, env, i64)
332+
DEF_HELPER_FLAGS_3(libafl_qemu_handle_custom_insn, TCG_CALL_NO_RWG,
333+
void, env, i64, i32)
334334

335335
//// --- End LibAFL code ---

‎accel/tcg/translator.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -200,7 +200,7 @@ void translator_loop(CPUState *cpu, TranslationBlock *tb, int *max_insns,
200200
db->pc_next += 4;
201201

202202
TCGv_i64 tmp0 = tcg_constant_i64((uint64_t)db->pc_next);
203-
gen_helper_libafl_qemu_handle_sync_backdoor(tcg_env, tmp0);
203+
gen_helper_libafl_qemu_handle_custom_insn(tcg_env, tmp0, tcg_constant_i32(LIBAFL_CUSTOM_INSN_LIBAFL));
204204
tcg_temp_free_i64(tmp0);
205205
}
206206
}

‎include/libafl/exit.h‎

Lines changed: 24 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -10,18 +10,19 @@ struct libafl_breakpoint {
1010
struct libafl_breakpoint* next;
1111
};
1212

13-
int libafl_qemu_set_breakpoint(target_ulong pc);
14-
int libafl_qemu_remove_breakpoint(target_ulong pc);
15-
void libafl_qemu_trigger_breakpoint(CPUState* cpu);
16-
void libafl_qemu_breakpoint_run(vaddr pc_next);
17-
1813
enum libafl_exit_reason_kind {
1914
INTERNAL = 0,
2015
BREAKPOINT = 1,
21-
SYNC_EXIT = 2,
16+
CUSTOM_INSN = 2,
2217
TIMEOUT = 3,
2318
};
2419

20+
enum libafl_custom_insn_kind {
21+
LIBAFL_CUSTOM_INSN_UNDEFINED = 0,
22+
LIBAFL_CUSTOM_INSN_LIBAFL = 1,
23+
LIBAFL_CUSTOM_INSN_NYX = 2,
24+
};
25+
2526
// QEMU exited on its own for some reason.
2627
struct libafl_exit_reason_internal {
2728
ShutdownCause cause;
@@ -34,23 +35,32 @@ struct libafl_exit_reason_breakpoint {
3435
};
3536

3637
// A synchronous exit has been triggered.
37-
struct libafl_exit_reason_sync_exit {};
38+
struct libafl_exit_reason_custom_insn {
39+
enum libafl_custom_insn_kind kind;
40+
};
3841

3942
// A timeout occured and we were asked to exit on timeout
40-
struct libafl_exit_reason_timeout {};
43+
struct libafl_exit_reason_timeout {
44+
};
4145

4246
struct libafl_exit_reason {
4347
enum libafl_exit_reason_kind kind;
4448
CPUState* cpu; // CPU that triggered an exit.
4549
vaddr next_pc; // The PC that should be stored in the CPU when re-entering.
4650
union {
47-
struct libafl_exit_reason_internal internal; // kind == INTERNAL
48-
struct libafl_exit_reason_breakpoint breakpoint; // kind == BREAKPOINT
49-
struct libafl_exit_reason_sync_exit sync_exit; // kind == SYNC_EXIT
50-
struct libafl_exit_reason_timeout timeout; // kind == TIMEOUT
51+
struct libafl_exit_reason_internal internal; // kind == INTERNAL
52+
struct libafl_exit_reason_breakpoint breakpoint; // kind == BREAKPOINT
53+
struct libafl_exit_reason_custom_insn
54+
custom_insn; // kind == CUSTOM_INSN
55+
struct libafl_exit_reason_timeout timeout; // kind == TIMEOUT
5156
} data;
5257
};
5358

59+
int libafl_qemu_set_breakpoint(target_ulong pc);
60+
int libafl_qemu_remove_breakpoint(target_ulong pc);
61+
void libafl_qemu_trigger_breakpoint(CPUState* cpu);
62+
void libafl_qemu_breakpoint_run(vaddr pc_next);
63+
5464
// Only makes sense to call if an exit was expected
5565
// Will return NULL if there was no exit expected.
5666
CPUState* libafl_last_exit_cpu(void);
@@ -62,7 +72,8 @@ void libafl_sync_exit_cpu(void);
6272
void libafl_exit_request_internal(CPUState* cpu, uint64_t pc,
6373
ShutdownCause cause, int signal);
6474
void libafl_exit_request_breakpoint(CPUState* cpu, target_ulong pc);
65-
void libafl_exit_request_sync_backdoor(CPUState* cpu, target_ulong pc);
75+
void libafl_exit_request_custom_insn(CPUState* cpu, target_ulong pc,
76+
enum libafl_custom_insn_kind kind);
6677

6778
#ifndef CONFIG_USER_ONLY
6879
void libafl_exit_request_timeout(void);

‎include/libafl/tcg.h‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,5 +6,5 @@
66
#include "tcg/tcg.h"
77
#include "tcg/helper-info.h"
88

9-
void tcg_gen_callN(void *func, TCGHelperInfo *info,
10-
TCGTemp *ret, TCGTemp **args);
9+
void tcg_gen_callN(void* func, TCGHelperInfo* info, TCGTemp* ret,
10+
TCGTemp** args);

‎include/libafl/user.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ IntervalTreeNode* libafl_maps_next(IntervalTreeNode* pageflags_maps_node,
3131
uint64_t libafl_load_addr(void);
3232
struct image_info* libafl_get_image_info(void);
3333

34+
uint64_t libafl_get_initial_brk(void);
3435
uint64_t libafl_get_brk(void);
3536
uint64_t libafl_set_brk(uint64_t new_brk);
3637

‎libafl/exit.c‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -110,9 +110,10 @@ void libafl_exit_request_internal(CPUState* cpu, uint64_t pc,
110110
expected_exit = true;
111111
}
112112

113-
void libafl_exit_request_sync_backdoor(CPUState* cpu, target_ulong pc)
113+
void libafl_exit_request_custom_insn(CPUState* cpu, target_ulong pc,
114+
enum libafl_custom_insn_kind kind)
114115
{
115-
last_exit_reason.kind = SYNC_EXIT;
116+
last_exit_reason.kind = CUSTOM_INSN;
116117

117118
prepare_qemu_exit(cpu, pc);
118119
}

‎libafl/hooks/tcg/block.c‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,8 @@ void libafl_qemu_hook_block_run(target_ulong pc)
8181
TCGv_i64 tmp0 = tcg_constant_i64(hook->data);
8282
TCGv_i64 tmp1 = tcg_constant_i64(cur_id);
8383
TCGTemp* tmp2[2] = {tcgv_i64_temp(tmp0), tcgv_i64_temp(tmp1)};
84-
tcg_gen_callN(hook->helper_info.func, &hook->helper_info, NULL, tmp2);
84+
tcg_gen_callN(hook->helper_info.func, &hook->helper_info, NULL,
85+
tmp2);
8586
tcg_temp_free_i64(tmp0);
8687
tcg_temp_free_i64(tmp1);
8788
}

‎libafl/hooks/tcg/edge.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,7 @@ static TCGHelperInfo libafl_exec_edge_hook_info = {
99
.name = "libafl_exec_edge_hook",
1010
.flags = dh_callflag(void),
1111
.typemask =
12-
dh_typemask(void, 0) | dh_typemask(i64, 1) | dh_typemask(i64, 2)
13-
};
12+
dh_typemask(void, 0) | dh_typemask(i64, 1) | dh_typemask(i64, 2)};
1413

1514
GEN_REMOVE_HOOK(edge)
1615

@@ -86,7 +85,8 @@ void libafl_qemu_hook_edge_run(void)
8685
TCGv_i64 tmp0 = tcg_constant_i64(hook->data);
8786
TCGv_i64 tmp1 = tcg_constant_i64(hook->cur_id);
8887
TCGTemp* tmp2[2] = {tcgv_i64_temp(tmp0), tcgv_i64_temp(tmp1)};
89-
tcg_gen_callN(hook->helper_info.func, &hook->helper_info, NULL, tmp2);
88+
tcg_gen_callN(hook->helper_info.func, &hook->helper_info, NULL,
89+
tmp2);
9090
tcg_temp_free_i64(tmp0);
9191
tcg_temp_free_i64(tmp1);
9292
}

‎libafl/hooks/tcg/read_write.c‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -216,7 +216,8 @@ static void libafl_gen_rw(TCGTemp* addr, MemOpIdx oi,
216216
#else
217217
tcgv_i64_temp(tmp2)};
218218
#endif
219-
tcg_gen_callN(hook->helper_infoN.func, &hook->helper_infoN, NULL, tmp3);
219+
tcg_gen_callN(hook->helper_infoN.func, &hook->helper_infoN,
220+
NULL, tmp3);
220221
tcg_temp_free_i64(tmp0);
221222
tcg_temp_free_i64(tmp1);
222223
#if TARGET_LONG_BITS == 32

0 commit comments

Comments
 (0)