- Mar 31, 2017
-
-
Alessandro Di Federico authored
To compare strings, `STREQUAL` should be used, not `EQUAL`. This prevented some inaccurate GCC warnings to be considered as non-errors.
-
- Mar 02, 2017
-
-
Alessandro Di Federico authored
`support.c` used to be compiled using the system compiler and then linked to the module generated by `revamb` as a separate translation unit. This commit introduces a change that lets `clang` compile `support.c`. This will allow us to make the CSV static, which should enable more aggressive optimizations. * Change the signature of the `root` function so that it accepts an argument: the initial value of the stack pointer, which the main is supposed to set up. QEMU now provides us with the offset of the stack pointer. * Let the build system compile `support.c` for each supported architecture, both in normal and "tracing" mode. * Remove the `--tracing` option, this is now handled by `support.c`, in particular depending on which version of `support.c` you link, you can have tracing enabled or not. * In `support.c` drop global variables representing the stack pointer, we no longer need them. * In `support.c` fix some warnings while handling the stack on 32-bit architectures. * Extende the `translate` script to handle the new way we link the final binary and the tracing mechanism.
-
- Dec 08, 2016
-
-
Alessandro Di Federico authored
This commit introduces two new passes: * `GeneratedCodeBasicInfo`: recovers from the IR some basic information like the size of delay slots in the input architecture, the name of the program counter and so on. It can also identify the type of a basic block (e.g., dispatcher, jump target...). * * `FunctionCallIdentification`: identifies function calls and injects a marker before the associated terminator instruction. The idea of these two passes is to try to progressively move information we used to keep in `JumpTargetManager` into the IR, so that it is more easily accessible and passes do not need a reference to `JTM`. In particular by having markers for function calls available during jump target discovery we don't have to have duplicated and suboptimal implementation of `isCall`. This commit also introduce some additional helper functions and an helper class to quickly.
-
- Dec 03, 2016
-
-
Alessandro Di Federico authored
`revamb-dump` is a tool to extract various information from the LLVM IR generated by `revamb` and output them in a more human-friendly format, typically CSV. The main source of information are the various metadata. Currently `revamb-dump` can collect the CFG, function boundaries and `noreturn` functions.
-
Alessandro Di Federico authored
This commit removes all the ELF-specific code from the `CodeGenerator` class by creating a new class, `BinaryFile` which contains all the information about the program that might be needed in an image format independent way. However, `BinaryFile` has some fields which are specific to ELF, we might want to address this when additional file formats are supported. A key benefit of isolating this code is that we can anticipate the parsing of the input file, so that we have its architecture available earlier than when `CodeGenerator` is instantiated, therefore we can drop the `--architecture` parameter.
-
- Sep 22, 2016
-
-
Alessandro Di Federico authored
* Use "$ORIGIN/../lib/" as RPATH when linking the installed binary * Install also support material such as "support.c" * Import the `translate` script for easy end-to-end translation
-
Alessandro Di Federico authored
Add different search paths for QEMU components, in paritcular relative to the program's path. Also, install the revamb.
-
- Sep 21, 2016
-
-
Alessandro Di Federico authored
-
- Sep 20, 2016
-
-
Alessandro Di Federico authored
-
Alessandro Di Federico authored
-
Alessandro Di Federico authored
* Disable PIE if enabled by default * Link librt.so to compiled binaries (sometimes the QEMU runtime needs it) * Replace `strtonum` with `int` in `awk` script * Specify the compiler, not the triple
-
- Sep 17, 2016
-
-
Alessandro Di Federico authored
-
Alessandro Di Federico authored
This commit introduces the `noreturn` analysis, whose aim is to detect all the basic blocks the are doomed to lead to a `noreturn` syscall such as `execve` or `exit`. * Implement `NoreturnAnalysis`. * Include and initialize in the `Architecture` data structure all the necessary information to detect `noreturn` syscalls. Specifically, the name of the QEMU helper for syscalls, the name of the register holding the syscall number and the syscall numbers representing `noreturn` syscalls. * `ReachingDefinitionsPass`: make reaching definitions available both in reaching definitions mode and reached loads mode. This part needs further cleanup. We also might be willing to implement this with a `Boost.Bimap`. * Use `SET` to collect information useful for the `NoreturnAnalysis`. Also restructure how the `OperationsStack` works to be more streamlined and keep track of multiple information about the instruction currently being tracked.
-
Alessandro Di Federico authored
`FunctionBoundariesDetectionPass` implements our function detection system.
-
Alessandro Di Federico authored
* Add an "s" in the name * Transform the pass in analysis and let OSRA use it
-
Alessandro Di Federico authored
Three new passes have been introduced: * `ReachingDefinitionsPass`: classical reaching definitions analysis working on load/stores with the main difference that a load without a definition behaves similarly to a definition and that we ignore certain basic blocks (i.e., the dispatcher). * `ConditionNumberingPass`: goes through all the branch instructions to check if some of them use an equivalent condition, this is particularly useful to understand that consecutive ARM instructions using the same predicate are working on the same condition. * `ConditionalReachingDefinitionsPass`: identical to `ReachingDefinitionsPass` but uses information from `ConditionNumberingPass` to stop certain definitions from reaching certain loads. The first and the last analyses have `Reached*` variants which expose information from the point of view of the definintion instead of from the point of view of the load.
-
- Aug 20, 2016
-
-
Alessandro Di Federico authored
This pass helps us handling instructions like ARM's `blt` which compute the result of the comparison by bit-fiddling with the bit sign of the operands of a subtraction. The idea is to have a series of known boolean expressions using `a`, `b' and `c` as variables (e.g. the boolean expression corresponding to "signed greater than") and compare their truth table against the one being analyzed. In case of match, the comparison can be simplified.
-
Alessandro Di Federico authored
-
Alessandro Di Federico authored
-
Alessandro Di Federico authored
* Rename `JumpTargetsFromConstantsPass` to `SET` * Move `SET` to set.{cpp,h} * Remove some useless includes
-
Alessandro Di Federico authored
* Import OSRA * Improve the SET (aka `JumpTargetFromConstants`) by introducing the `OperationsStack` class. * Review `harvest` logic * Allow to disable OSRA (along with the sumjump heuristic) * Take the core of `getNextPC` out of it and move it to `getPC`, a function returning both the current and the next PC. Also, fix a bug when reaching the beginning of a basic block. * Detect "reliable" jump targets: a "reliable" jump target is a jump target obtained from a store to a PC but it's not a fallthrough jump.
-
- Jan 30, 2016
-
-
Alessandro Di Federico authored
If EarlyCSE didn't produce any new code pointer, we use GlobalValueNumbering which usually leads to better results, in particular if we remove `newpc` markers and if it can make use of alias information, which we introduce to let the compiler know that loads/stores to the CPU state will never alias loads/stores to normal memory. * Before generating any load/store instruction mark it with the appropriate aliasing information. * Update `JumpTargetManager::harvest` to run GVN * Move the `Visited` set of `JumpTargetsFromConstantsPass` in `JumpTargetManager`, even if currently we clear it at each invocation of the pass
-
- Jan 12, 2016
-
-
Alessandro Di Federico authored
-
Alessandro Di Federico authored
-
- Jan 07, 2016
-
-
Alessandro Di Federico authored
* Use `llvm::object` framework to obtain useful information from the ELF binary such as pointer size and endianess. * Introduce `CodeGenerator::importGlobalData`: import global (read-only and writeable data) from the input binary directly into the generated module. * Introduce the `--linking-info` parameter: path to a CSV file where sections containing global data extracted from the input binary are listed with their name, start and end address. * Expand the `Architecture` class with constructors and support accessor methods.
-
- Jan 04, 2016
-
-
Alessandro Di Federico authored
`cpu_loop` is the main program loop used by QEMU during emulation. Here we are interested in transforming it in a simple handler of exceptions (e.g. signals and syscalls). * Introduce `CpuLoopFunctionPass`: remove the outermost backedge in `cpu_loop` and replace the call to cpu_*_exec with the exception index. * Implement the support function `find_unique` which returns the only element in a range satisfying a predicate, or, otherwise, asserts.
-
- Dec 04, 2015
-
-
Alessandro Di Federico authored
* Move initialization and management of the structure describing the CPU state (CPUStateType) into variablemanager.cpp. * Support parts of CPU state outside "env" (e.g. the MIPSCPU structure). Now "env" has an offset into the possibly larger CPU state which we have to take into account where appropriate (see VariableManager::envOffset). * Link the helpers module into the generated module, including only what is needed. * Create some "no-op" or "abort" function corresponding to QEMU functions not included in the helper module (e.g. logging and abort functions). * Implement the CorrectCPUStateUsagePass pass, which starts from the "env" global variable and looks for all its usages recursively, keeping track of where pointers are pointing into the CPU state data structure, and replaces all the load/stores with the global variable corresponding to that specific field of the CPU state. * After the linking phase, run SROA, the pass to adjust the CPU usage and DCE. * Let global variables have common linkage.
-
- Nov 24, 2015
-
-
Alessandro Di Federico authored
-
- Nov 07, 2015
-
-
Alessandro Di Federico authored
* Introduce PassManager running SROA * Import the ScalarOpts LLVM module
-
Alessandro Di Federico authored
* Implement an handler for PTC_INSTRUCTION_op_debug_insn_start * Implement an handler for calls to helpers * Implement an handler for all the remaining instructions * Discover automatically path of the helpers module * Import the IRReader module * Remove support for predefined global variables * Implement getByCPUStateOffset which returns or creates a global variable from an offset in the CPUState structure * Remove the VariableManager::createGlobal function * Implement getTypeAtOffset which searches for the data type at the specified offset, recursively exploring sub-structs * Autodetect the CPUState structure by election on the struct parameters of the helper functions * CodeGenerator::translate returns void * Multiplication should sign-extend, not zero-extend * Fix wrong update of alloca insertion point * Implement PTC_INSTRUCTION_op_mul{u,s}2_i{32,64} instructions
-
Alessandro Di Federico authored
-
- Oct 27, 2015
-
-
Alessandro Di Federico authored
-
Alessandro Di Federico authored
* Import single-function calculator * Create a puppet CMake project for cross-compiling * Create a CMake manager for the tests
-
Alessandro Di Federico authored
-
- Oct 17, 2015
-
-
Alessandro Di Federico authored
* Convert ptcdump.cpp to use streams and export more fine-grained functions * Add documentation to ptcdump.h * Create metadata for the original instruction when a PTC_INSTRUCTION_op_debug_insn_start instruction is met.
-
- Sep 26, 2015
-
-
Alessandro Di Federico authored
-