Skip to content
Snippets Groups Projects
  1. Mar 31, 2017
  2. Mar 02, 2017
    • Alessandro Di Federico's avatar
      Compile `support.c` to LLVM IR · dae2f7e6
      Alessandro Di Federico authored
      `support.c` used to be compiled using the system compiler and then
      linked to the module generated by `revamb` as a separate translation
      unit. This commit introduces a change that lets `clang` compile
      `support.c`. This will allow us to make the CSV static, which should
      enable more aggressive optimizations.
      
      * Change the signature of the `root` function so that it accepts an
        argument: the initial value of the stack pointer, which the main is
        supposed to set up. QEMU now provides us with the offset of the stack
        pointer.
      * Let the build system compile `support.c` for each supported
        architecture, both in normal and "tracing" mode.
      * Remove the `--tracing` option, this is now handled by `support.c`, in
        particular depending on which version of `support.c` you link, you can
        have tracing enabled or not.
      * In `support.c` drop global variables representing the stack pointer,
        we no longer need them.
      * In `support.c` fix some warnings while handling the stack on 32-bit
        architectures.
      * Extende the `translate` script to handle the new way we link the final
        binary and the tracing mechanism.
      dae2f7e6
  3. Dec 08, 2016
    • Alessandro Di Federico's avatar
      Introduce the GCBI and FCI passes · 5c619ab0
      Alessandro Di Federico authored
      This commit introduces two new passes:
      
      * `GeneratedCodeBasicInfo`: recovers from the IR some basic information
        like the size of delay slots in the input architecture, the name of
        the program counter and so on. It can also identify the type of a
        basic block (e.g., dispatcher, jump target...).  *
      * `FunctionCallIdentification`: identifies function calls and injects a
        marker before the associated terminator instruction.
      
      The idea of these two passes is to try to progressively move information
      we used to keep in `JumpTargetManager` into the IR, so that it is more
      easily accessible and passes do not need a reference to `JTM`.
      
      In particular by having markers for function calls available during jump
      target discovery we don't have to have duplicated and suboptimal
      implementation of `isCall`.
      
      This commit also introduce some additional helper functions and an
      helper class to quickly.
      5c619ab0
  4. Dec 03, 2016
    • Alessandro Di Federico's avatar
      Introduce `revamb-dump` · e577f74b
      Alessandro Di Federico authored
      `revamb-dump` is a tool to extract various information from the LLVM IR
      generated by `revamb` and output them in a more human-friendly format,
      typically CSV. The main source of information are the various metadata.
      
      Currently `revamb-dump` can collect the CFG, function boundaries and
      `noreturn` functions.
      e577f74b
    • Alessandro Di Federico's avatar
      Isolate ELF code and remove architecture parameter · 83ea2caa
      Alessandro Di Federico authored
      This commit removes all the ELF-specific code from the `CodeGenerator`
      class by creating a new class, `BinaryFile` which contains all the
      information about the program that might be needed in an image format
      independent way. However, `BinaryFile` has some fields which are
      specific to ELF, we might want to address this when additional file
      formats are supported.
      
      A key benefit of isolating this code is that we can anticipate the
      parsing of the input file, so that we have its architecture available
      earlier than when `CodeGenerator` is instantiated, therefore we can drop
      the `--architecture` parameter.
      83ea2caa
  5. Sep 22, 2016
    • Alessandro Di Federico's avatar
      Improve installation · d4871549
      Alessandro Di Federico authored
      * Use "$ORIGIN/../lib/" as RPATH when linking the installed binary
      * Install also support material such as "support.c"
      * Import the `translate` script for easy end-to-end translation
      d4871549
    • Alessandro Di Federico's avatar
      Make revamb portable · 59c871af
      Alessandro Di Federico authored
      Add different search paths for QEMU components, in paritcular relative
      to the program's path.
      Also, install the revamb.
      59c871af
  6. Sep 21, 2016
  7. Sep 20, 2016
  8. Sep 17, 2016
    • Alessandro Di Federico's avatar
      adb45173
    • Alessandro Di Federico's avatar
      Introduce `NoreturnAnalysis` · cc87ad60
      Alessandro Di Federico authored
      This commit introduces the `noreturn` analysis, whose aim is to detect
      all the basic blocks the are doomed to lead to a `noreturn` syscall such
      as `execve` or `exit`.
      
      * Implement `NoreturnAnalysis`.
      * Include and initialize in the `Architecture` data structure all the
        necessary information to detect `noreturn` syscalls. Specifically, the
        name of the QEMU helper for syscalls, the name of the register holding
        the syscall number and the syscall numbers representing `noreturn`
        syscalls.
      * `ReachingDefinitionsPass`: make reaching definitions available both in
        reaching definitions mode and reached loads mode. This part needs
        further cleanup. We also might be willing to implement this with a
        `Boost.Bimap`.
      * Use `SET` to collect information useful for the
        `NoreturnAnalysis`. Also restructure how the `OperationsStack` works
        to be more streamlined and keep track of multiple information about
        the instruction currently being tracked.
      cc87ad60
    • Alessandro Di Federico's avatar
      Introduce `FunctionBoundariesDetectionPass` · 37de0a00
      Alessandro Di Federico authored
      `FunctionBoundariesDetectionPass` implements our function detection
      system.
      37de0a00
    • Alessandro Di Federico's avatar
      SimplifyComparisonsPass: transform in analysis · deae1f84
      Alessandro Di Federico authored
      * Add an "s" in the name
      * Transform the pass in analysis and let OSRA use it
      deae1f84
    • Alessandro Di Federico's avatar
      Introduce ConditionalReachingDefinitionsPass · 475ed239
      Alessandro Di Federico authored
      Three new passes have been introduced:
      
      * `ReachingDefinitionsPass`: classical reaching definitions analysis
        working on load/stores with the main difference that a load without a
        definition behaves similarly to a definition and that we ignore
        certain basic blocks (i.e., the dispatcher).
      * `ConditionNumberingPass`: goes through all the branch instructions to
        check if some of them use an equivalent condition, this is
        particularly useful to understand that consecutive ARM instructions
        using the same predicate are working on the same condition.
      * `ConditionalReachingDefinitionsPass`: identical to
        `ReachingDefinitionsPass` but uses information from
        `ConditionNumberingPass` to stop certain definitions from reaching
        certain loads.
      
      The first and the last analyses have `Reached*` variants which expose
      information from the point of view of the definintion instead of from
      the point of view of the load.
      475ed239
  9. Aug 20, 2016
    • Alessandro Di Federico's avatar
      Introduce SimplifyComparisonPass · 430a7261
      Alessandro Di Federico authored
      This pass helps us handling instructions like ARM's `blt` which compute
      the result of the comparison by bit-fiddling with the bit sign of the
      operands of a subtraction.
      
      The idea is to have a series of known boolean expressions using `a`, `b'
      and `c` as variables (e.g. the boolean expression corresponding to
      "signed greater than") and compare their truth table against the one
      being analyzed. In case of match, the comparison can be simplified.
      430a7261
    • Alessandro Di Federico's avatar
      Downgrade to CMake 2.8 · db030d67
      Alessandro Di Federico authored
      db030d67
    • Alessandro Di Federico's avatar
      0d035a93
    • Alessandro Di Federico's avatar
      Isolate SET · 57721ff8
      Alessandro Di Federico authored
      * Rename `JumpTargetsFromConstantsPass` to `SET`
      * Move `SET` to set.{cpp,h}
      * Remove some useless includes
      57721ff8
    • Alessandro Di Federico's avatar
      Import OSRA and update SET · fbca5bba
      Alessandro Di Federico authored
      * Import OSRA
      * Improve the SET (aka `JumpTargetFromConstants`) by introducing the
        `OperationsStack` class.
      * Review `harvest` logic
      * Allow to disable OSRA (along with the sumjump heuristic)
      * Take the core of `getNextPC` out of it and move it to `getPC`, a
        function returning both the current and the next PC. Also, fix a bug
        when reaching the beginning of a basic block.
      * Detect "reliable" jump targets: a "reliable" jump target is a jump
        target obtained from a store to a PC but it's not a fallthrough jump.
      fbca5bba
  10. Jan 30, 2016
    • Alessandro Di Federico's avatar
      Improve code pointer harvesting using GVN · e59edd41
      Alessandro Di Federico authored
      If EarlyCSE didn't produce any new code pointer, we use
      GlobalValueNumbering which usually leads to better results, in
      particular if we remove `newpc` markers and if it can make use of alias
      information, which we introduce to let the compiler know that
      loads/stores to the CPU state will never alias loads/stores to normal
      memory.
      
      * Before generating any load/store instruction mark it with the
        appropriate aliasing information.
      * Update `JumpTargetManager::harvest` to run GVN
      * Move the `Visited` set of `JumpTargetsFromConstantsPass` in
        `JumpTargetManager`, even if currently we clear it at each invocation
        of the pass
      e59edd41
  11. Jan 12, 2016
  12. Jan 07, 2016
    • Alessandro Di Federico's avatar
      Add support for ELF and import its global data · ac316cd7
      Alessandro Di Federico authored
      * Use `llvm::object` framework to obtain useful information from the ELF
        binary such as pointer size and endianess.
      * Introduce `CodeGenerator::importGlobalData`: import global (read-only
        and writeable data) from the input binary directly into the generated
        module.
      * Introduce the `--linking-info` parameter: path to a CSV file where
        sections containing global data extracted from the input binary are
        listed with their name, start and end address.
      * Expand the `Architecture` class with constructors and support accessor
        methods.
      ac316cd7
  13. Jan 04, 2016
    • Alessandro Di Federico's avatar
      Transform `cpu_loop` according to our requirements · dc23749e
      Alessandro Di Federico authored
      `cpu_loop` is the main program loop used by QEMU during emulation. Here
      we are interested in transforming it in a simple handler of exceptions
      (e.g. signals and syscalls).
      
      * Introduce `CpuLoopFunctionPass`: remove the outermost backedge in
        `cpu_loop` and replace the call to cpu_*_exec with the exception index.
      * Implement the support function `find_unique` which returns the only
        element in a range satisfying a predicate, or, otherwise, asserts.
      dc23749e
  14. Dec 04, 2015
    • Alessandro Di Federico's avatar
      Link with helpers and adjust their CPU state usage · 6338f3b0
      Alessandro Di Federico authored
      * Move initialization and management of the structure describing the CPU
        state (CPUStateType) into variablemanager.cpp.
      * Support parts of CPU state outside "env" (e.g. the MIPSCPU
        structure). Now "env" has an offset into the possibly larger CPU state
        which we have to take into account where appropriate (see
        VariableManager::envOffset).
      * Link the helpers module into the generated module, including only what
        is needed.
      * Create some "no-op" or "abort" function corresponding to QEMU functions
        not included in the helper module (e.g. logging and abort functions).
      * Implement the CorrectCPUStateUsagePass pass, which starts from the
        "env" global variable and looks for all its usages recursively, keeping
        track of where pointers are pointing into the CPU state data structure,
        and replaces all the load/stores with the global variable corresponding
        to that specific field of the CPU state.
      * After the linking phase, run SROA, the pass to adjust the CPU usage and
        DCE.
      * Let global variables have common linkage.
      6338f3b0
  15. Nov 24, 2015
  16. Nov 07, 2015
    • Alessandro Di Federico's avatar
      Make writes to PC explicit · 1d56c326
      Alessandro Di Federico authored
      * Introduce PassManager running SROA
      * Import the ScalarOpts LLVM module
      1d56c326
    • Alessandro Di Federico's avatar
      Split CodeGenerator::translate and use CPUState from the QEMU helpers · ba950d26
      Alessandro Di Federico authored
      * Implement an handler for PTC_INSTRUCTION_op_debug_insn_start
      * Implement an handler for calls to helpers
      * Implement an handler for all the remaining instructions
      * Discover automatically path of the helpers module
      * Import the IRReader module
      * Remove support for predefined global variables
      * Implement getByCPUStateOffset which returns or creates a global
        variable from an offset in the CPUState structure
      * Remove the VariableManager::createGlobal function
      * Implement getTypeAtOffset which searches for the data type at the
        specified offset, recursively exploring sub-structs
      * Autodetect the CPUState structure by election on the struct parameters
        of the helper functions
      * CodeGenerator::translate returns void
      * Multiplication should sign-extend, not zero-extend
      * Fix wrong update of alloca insertion point
      * Implement PTC_INSTRUCTION_op_mul{u,s}2_i{32,64} instructions
      ba950d26
    • Alessandro Di Federico's avatar
      Disable RTTI · fd1070b7
      Alessandro Di Federico authored
      fd1070b7
  17. Oct 27, 2015
  18. Oct 17, 2015
  19. Sep 26, 2015
Loading