86d38fbfa7
* Add cpu_run pre/post exec hooks, to hook the cpu just before / after it runs target code. * Refactor hooks to separate them in different files * Remove most extern variables * Reduce the amount of extra code in QEMU * Add clang-format script
109 lines
3.2 KiB
C
109 lines
3.2 KiB
C
#include "qemu/osdep.h"
|
|
|
|
#include "qapi/error.h"
|
|
|
|
#include "exec/exec-all.h"
|
|
|
|
#include "libafl/jit.h"
|
|
|
|
#ifndef TARGET_LONG_BITS
|
|
#error "TARGET_LONG_BITS not defined"
|
|
#endif
|
|
|
|
/*
|
|
pub extern "C" fn trace_edge_hitcount(id: u64, _data: u64) {
|
|
unsafe {
|
|
EDGES_MAP[id as usize] = EDGES_MAP[id as usize].wrapping_add(1);
|
|
}
|
|
}
|
|
|
|
pub extern "C" fn trace_edge_single(id: u64, _data: u64) {
|
|
unsafe {
|
|
EDGES_MAP[id as usize] = 1;
|
|
}
|
|
}
|
|
*/
|
|
|
|
// from libafl_targets coverage.rs
|
|
// correct size doesn't matter here
|
|
uint8_t __afl_area_ptr_local[65536] __attribute__((weak));
|
|
size_t __afl_map_size __attribute__((weak));
|
|
|
|
size_t libafl_jit_trace_edge_hitcount(uint64_t data, uint64_t id)
|
|
{
|
|
TCGv_ptr map_ptr = tcg_constant_ptr(__afl_area_ptr_local);
|
|
TCGv_i32 counter = tcg_temp_new_i32();
|
|
tcg_gen_ld8u_i32(counter, map_ptr, (tcg_target_long)id);
|
|
tcg_gen_addi_i32(counter, counter, 1);
|
|
tcg_gen_st8_i32(counter, map_ptr, (tcg_target_long)id);
|
|
return 3; // # instructions
|
|
}
|
|
|
|
size_t libafl_jit_trace_edge_single(uint64_t data, uint64_t id)
|
|
{
|
|
TCGv_ptr map_ptr = tcg_constant_ptr(__afl_area_ptr_local);
|
|
TCGv_i32 counter = tcg_temp_new_i32();
|
|
tcg_gen_movi_i32(counter, 1);
|
|
tcg_gen_st8_i32(counter, map_ptr, (tcg_target_long)id);
|
|
return 2; // # instructions
|
|
}
|
|
|
|
uint64_t __prev_loc = 0;
|
|
|
|
size_t libafl_jit_trace_block_hitcount(uint64_t data, uint64_t id)
|
|
{
|
|
TCGv_ptr map_ptr = tcg_constant_ptr(__afl_area_ptr_local);
|
|
TCGv_ptr prev_loc_ptr = tcg_constant_ptr(&__prev_loc);
|
|
|
|
TCGv_i32 counter = tcg_temp_new_i32();
|
|
TCGv_i64 id_r = tcg_temp_new_i64();
|
|
TCGv_i64 prev_loc = tcg_temp_new_i64();
|
|
TCGv_ptr prev_loc2 = tcg_temp_new_ptr();
|
|
|
|
// Compute location => 5 insn
|
|
tcg_gen_ld_i64(prev_loc, prev_loc_ptr, 0);
|
|
tcg_gen_xori_i64(prev_loc, prev_loc, (int64_t)id);
|
|
tcg_gen_andi_i64(prev_loc, prev_loc, (int64_t)(__afl_map_size - 1));
|
|
tcg_gen_trunc_i64_ptr(prev_loc2, prev_loc);
|
|
tcg_gen_add_ptr(prev_loc2, map_ptr, prev_loc2);
|
|
|
|
// Update map => 3 insn
|
|
tcg_gen_ld8u_i32(counter, prev_loc2, 0);
|
|
tcg_gen_addi_i32(counter, counter, 1);
|
|
tcg_gen_st8_i32(counter, prev_loc2, 0);
|
|
|
|
// Update prev_loc => 3 insn
|
|
tcg_gen_movi_i64(id_r, (int64_t)id);
|
|
tcg_gen_shri_i64(id_r, id_r, 1);
|
|
tcg_gen_st_i64(id_r, prev_loc_ptr, 0);
|
|
return 11; // # instructions
|
|
}
|
|
|
|
size_t libafl_jit_trace_block_single(uint64_t data, uint64_t id)
|
|
{
|
|
TCGv_ptr map_ptr = tcg_constant_ptr(__afl_area_ptr_local);
|
|
TCGv_ptr prev_loc_ptr = tcg_constant_ptr(&__prev_loc);
|
|
|
|
TCGv_i32 counter = tcg_temp_new_i32();
|
|
TCGv_i64 id_r = tcg_temp_new_i64();
|
|
TCGv_i64 prev_loc = tcg_temp_new_i64();
|
|
TCGv_ptr prev_loc2 = tcg_temp_new_ptr();
|
|
|
|
// Compute location => 5 insn
|
|
tcg_gen_ld_i64(prev_loc, prev_loc_ptr, 0);
|
|
tcg_gen_xori_i64(prev_loc, prev_loc, (int64_t)id);
|
|
tcg_gen_andi_i64(prev_loc, prev_loc, (int64_t)(__afl_map_size - 1));
|
|
tcg_gen_trunc_i64_ptr(prev_loc2, prev_loc);
|
|
tcg_gen_add_ptr(map_ptr, map_ptr, prev_loc2);
|
|
|
|
// Update map => 2 insn
|
|
tcg_gen_movi_i32(counter, 1);
|
|
tcg_gen_st8_i32(counter, map_ptr, 0);
|
|
|
|
// Update prev_loc => 3 insn
|
|
tcg_gen_movi_i64(id_r, (int64_t)id);
|
|
tcg_gen_shri_i64(id_r, id_r, 1);
|
|
tcg_gen_st_i64(id_r, prev_loc_ptr, 0);
|
|
return 10; // # instructions
|
|
}
|