xlcore.c

二进制翻译的一个软件

    if(this_bb_entry != M->curr_bb_entry) {
      this_bb_entry->trace_next = M->curr_bb_entry;
      this_bb_entry = M->curr_bb_entry;
    }
#endif
 
    if (isEndOfBB)
      break;
  } /* Grand Translation Loop */
  
  if (!isEndOfBB) {
    if(M->curr_bb_entry->trans_bb_eip == (unsigned long)M->bbOut)
      M->curr_bb_entry->trans_bb_eip = NOT_YET_TRANSLATED;
    bb_emit_jump(M, 0);
    M->patch_array[M->patch_count].at = M->bbOut - 4;
    M->patch_array[M->patch_count].to = (unsigned char *)M->next_eip;
    M->patch_array[M->patch_count].proc_addr = M->curr_bb_entry->proc_entry;
    M->patch_count ++;
  }
#ifdef PROFILE_BB_STATS
  else {
    M->curr_bb_entry->flags |= IS_END_OF_TRACE;
    M->curr_bb_entry->trace_next = NULL;
  }
#endif

#ifdef STATIC_PASS
  /* I need not emit Patch blocks when statically translating. The
     driver will next add these items to the worklist, and will
     arrange for back-patching
     
     However, If I am going out of the current binary, 
     I must emit a patch block. hence the following ...   */

  if(goingOutofElf) {
    bb_entry *entry = lookup_bb_eip (M, M->next_eip);
    bb_emit_byte (M, 0xE8u);	/* CALL rel32 */
    bb_emit_w32 (M, (unsigned long) (M->backpatch_and_dispatch_bb - (unsigned long)(M->bbOut + 4)));
    bb_emit_w32 (M, M->next_eip);
    bb_emit_w32 (M, (unsigned long)M->bbOut - 4);
    if(entry == NULL) {
      temp_entry = make_bb_entry(M, M->next_eip, NOT_YET_TRANSLATED, M->curr_bb_entry->proc_entry);
    }
  }
#else
  /* Lastly, emit the Patch Blocks */
  for (i = 0 ; i < M->patch_count ; i ++) {
    bb_entry *entry = NULL; 
    unsigned long addr;
    unsigned long to = (unsigned long)M->patch_array[i].to;
    unsigned long at = (unsigned long)M->patch_array[i].at;

    entry = lookup_bb_eip (M, to);
    if ((entry != NULL) && (entry->trans_bb_eip != NOT_YET_TRANSLATED)) {
      //		if (entry != NULL)
      DEBUG(xlate_pb) {
	fprintf(DBG, "1. Patch Block: BB Already found\n");
	fflush(DBG);
      }
      addr = entry->trans_bb_eip;
      /* If found to be translated already, patch the jump destination right now to implement chaining */
      tmp = M->bbOut;
      M->bbOut = (unsigned char *)at;
      bb_emit_w32(M, addr - (at + 4));
      M->bbOut = tmp;
    }
    else {
      /* If not, patch the jump destination so that it jumps to its corresponding patch block */
      tmp = M->bbOut;
      M->bbOut = (unsigned char *)at;
      bb_emit_w32(M, tmp - (M->bbOut + 4));
      M->bbOut = tmp;
      
      /* Then, build the patch block */
      bb_emit_byte (M, 0xE8u);	/* CALL rel32 */
      bb_emit_w32 (M, (unsigned long) (M->backpatch_and_dispatch_bb - (unsigned long)(M->bbOut + 4)));
      bb_emit_w32 (M, to);
      bb_emit_w32 (M, at);
      if(entry == NULL) {
	temp_entry = make_bb_entry(M, to, NOT_YET_TRANSLATED, M->patch_array[i].proc_addr);
      }
    }
  }
#endif

#ifdef PROFILE_TRANSLATION
  end_time = read_timer();
  M->ptState->trans_time += (end_time - start_time);
#endif

  return(curr_bb_entry);;   
}

machine_t *MM;

void 
handle_sigsegv(int param, struct sigcontext ctx)
{
  struct sigcontext *context = &ctx;
  bb_entry *curr;
  int i;
  machine_t *M = MM;

  fprintf(DBG, "\nVDebug is handling SIGSEGV...\n");
 	
  fprintf(DBG, "eip: %lx\n", context->eip);
  fprintf(DBG, "Fault code = %ld\n", context->trapno); 
  fprintf(DBG, "If(Pagefault), cr2 = %lx\n", context->cr2); 
  
  fflush(DBG);
  
#if 0   
  for (i=0 ; i<LOOKUP_TABLE_SIZE ; i++) {
    curr =  M->lookup_table[i];
    while ((curr != NULL) && 
	   ((context->eip < curr->trans_bb_eip) || (context->eip >= curr->trans_bb_eip + curr->trans_bb_size)))
      curr = curr->next;
    if (curr != NULL) {
      int j;
      printf ("\nFound src_bb_start_eip to be: %08X\n", curr->src_bb_eip);
      printf ("\ntrans_bb_start_eip is: %08X\n", curr->trans_bb_eip);
      printf ("\nAnd, the Basic Block is as follows: \n");
      for (j=0 ; j<curr->trans_bb_size ; j++)
	printf ("%02X  ", *((unsigned char *)curr->trans_bb_eip + j));
      printf ("\n");
    }
  }
  fflush(DBG);
#endif
  
  fprintf(DBG, "BBCache is:\n");
  fflush(DBG);

  M->next_eip = (unsigned long)M->slow_dispatch_bb;
  while(M->next_eip < (unsigned long)M->backpatch_and_dispatch_bb) {
    decode_t dd;
    do_decode(M, &dd);
    do_disasm(&dd, stderr);
    fflush(stderr);
  }
  
  
  
  M->next_eip = (unsigned long)M->fast_dispatch_bb;
  while(M->next_eip < (unsigned long)M->bbCache_main) {
    decode_t dd;
    do_decode(M, &dd);
    do_disasm(&dd, DBG);
    fflush(DBG);
  }
  fprintf(DBG, "\n");
  exit(1);
}


#ifndef USE_STATIC_DUMP
machine_t theMachine;
pt_state thePtState;

#endif

#ifdef TOUCH_RELOADED_BBCACHE_PAGES
static void
touch_pages(machine_t *M)
{
  size_t n;
  for(n=0; n<450; n++) {
    size_t ndx = n*PAGE_SIZE + 1;
    volatile val;
    val = ((unsigned long *)M->bbCache)[ndx];
    ((unsigned long *)M->bbCache)[ndx] = val;
  }
}
#endif /* TOUCH_RELOADED_BBCACHE_PAGES */



machine_t * 
init_translator(unsigned long program_start)
{
  machine_t *M;
  int i;
  bb_entry *temp_entry;
  unsigned long long start_time;
  unsigned long long end_time;
  
#ifdef PROFILE_TRANSLATION
  start_time = read_timer();
#endif

#ifdef SIGNALS
  sigfillset(&allSignals);
  sigset_t oldSet;
  sigprocmask(SIG_SETMASK, &allSignals, &oldSet);  
#endif  

  if(debug_flags) {
    DBG = stderr;
    //DBG = fopen("vdbg.dbg", "w");
  }

  DEBUG(startup) {
    printf("VDebug rules!... \n");
    printf("Initial eip   = %lx\n", program_start);
  }

#ifndef USE_STATIC_DUMP
  M = &theMachine;
  M->ismmaped = false;
  M->ptState = &thePtState;

  bb_cache_init(M);
  temp_entry = make_bb_entry(M, program_start, NOT_YET_TRANSLATED, 
			     CALL_HASH_BUCKET(M->call_hash_table, program_start));
#ifdef PROFILE_BB_STATS
  temp_entry->flags = 0;
#endif

#else /* USE_STATIC_DUMP */

  char str[300];
  char arg[300];
  sprintf(arg, "/proc/%d/exe", getpid());
  i = readlink(arg,str,sizeof(str));
  str[i] = '\0';
  for(i--; i>=0 ; i--)
    if(str[i] == '/')
      str[i] = '_';
  
  sprintf(arg, "/tmp/vdebug-dump/%s-dump",str);
  int fd1 = open(arg, O_RDONLY, S_IRWXU);

  sprintf(arg, "/tmp/vdebug-dump/%s-addr",str);
  int fd2 = open(arg, O_RDONLY, S_IRWXU);

  size_t mapSize = sizeof(machine_t) + sizeof(pt_state);
  mapSize = mapSize + (mapSize % PAGE_SIZE);    
  if(fd1 == -1 || fd2 == -1) {
    M = (machine_t *) mmap(0, mapSize, 
			   PROT_READ | PROT_WRITE | PROT_EXEC,
			   MAP_ANONYMOUS | MAP_PRIVATE | MAP_NORESERVE, 0, 0);
    M->ismmaped = true;
    M->ptState = (pt_state *)(((unsigned char *)M) + sizeof(machine_t));

    if(M == MAP_FAILED)
      panic("Allocation of M failed err = %s", strerror(errno));
 
    bb_cache_init(M);
    temp_entry = make_bb_entry(M, program_start, NOT_YET_TRANSLATED, 
			       CALL_HASH_BUCKET(M->call_hash_table, program_start));
#ifdef PROFILE_BB_STATS
    temp_entry->flags = 0;
#endif
    M->dump = true;
  }
  else {
    machine_t *maddr;
    read(fd2, &maddr, sizeof(unsigned char *));
    close(fd2);

    DEBUG(dump_load)
      fprintf(DBG, "Came to File-open area of initializer\n");
    
    M = (machine_t *) mmap(maddr, mapSize, 
			   PROT_READ | PROT_WRITE | PROT_EXEC,
			   MAP_FIXED | MAP_PRIVATE | MAP_NORESERVE, fd1, 0);
    if(M == MAP_FAILED)
      panic("Allocation of M at %lx failed err = %s", maddr, strerror(errno));
    close(fd1);
    M->dump = false;
    M->ismmaped = true;
    M->ptState = (pt_state *)(((unsigned char *)M) + sizeof(machine_t));

#ifdef TOUCH_RELOADED_BBCACHE_PAGES
    fprintf(DBG, "%lu, %lu\n", (M->bbOut - M->bbCache)/PAGE_SIZE, BBCACHE_SIZE/PAGE_SIZE);
    fflush(DBG);
    touch_pages(M);
#endif /* TOUCH_RELOADED_BBCACHE_PAGES */
  }
#endif /* USE_STATIC_DUMP main */
  
#ifdef SIGNALS
  M->ptState->Mnode.pid = getpid();
  M->ptState->Mnode.M = M;
  M->ptState->Mnode.next = NULL;
  addToMlist(&M->ptState->Mnode);
  //M->sigQfront = 0;
#endif /* SIGNALS */
  
  M->fixregs.eip = program_start;
  M->guest_start_eip = program_start;
  M->comming_from_call_indirect = false;

#ifdef DEBUG_ON
  M->nTrInstr = 0;
#endif

  //M->trigger = false;

#ifdef PROFILE
  M->ptState->total_cnt = 0;
  M->ptState->normal_cnt = 0; 
  M->ptState->ret_cnt = 0;
  M->ptState->ret_Iw_cnt = 0;
  M->ptState->call_dir_cnt = 0;
  M->ptState->call_indr_cnt = 0;
  M->ptState->jmp_indr_cnt = 0;
  M->ptState->jmp_dir_cnt = 0;
  M->ptState->jmp_cond_cnt = 0;

  M->ptState->s_total_cnt = 0;
  M->ptState->s_normal_cnt = 0; 
  M->ptState->s_ret_cnt = 0;
  M->ptState->s_ret_Iw_cnt = 0;
  M->ptState->s_call_dir_cnt = 0;
  M->ptState->s_call_indr_cnt = 0;
  M->ptState->s_jmp_indr_cnt = 0;
  M->ptState->s_jmp_dir_cnt = 0;
  M->ptState->s_jmp_cond_cnt = 0;

  M->ptState->hash_nodes_cnt = 0;
  M->ptState->max_nodes_trav_cnt = 0;
#endif 
 
#ifdef PROFILE_RET_MISS  
  M->ptState->ret_miss_cnt = 0;
  M->ptState->ret_ret_miss_cnt = 0;
  M->ptState->cold_cnt = 0;
#endif

#ifdef PROFILE_BB_CNT  
  M->ptState->bb_cnt = 0;
#endif

  DEBUG(sigsegv) {
    MM = M;
    signal(SIGSEGV, (void *)handle_sigsegv);
  }
  
#ifdef SIGNALS
  sigprocmask(SIG_SETMASK, &oldSet, NULL);
#endif

#ifdef PROFILE_TRANSLATION
  end_time = read_timer();
  M->ptState->tot_time = start_time;
  M->ptState->trans_time = (end_time - start_time);  
#endif  
  return M;
}

 
#ifdef THREADED_XLATE 
machine_t *   
init_thread_trans(unsigned long program_start)
{
  machine_t *M;
  int i;
  bb_entry *temp_entry;

#ifdef SIGNALS
  sigset_t oldSet;
  sigprocmask(SIG_SETMASK, &allSignals, &oldSet);  
#endif

  DEBUG(thread_init) {
    fprintf(DBG, "Thread start eip   = %lx\n", program_start);
  }

  size_t mapSize = sizeof(machine_t) + sizeof(pt_state);
  mapSize = mapSize + (mapSize % PAGE_SIZE);    
  M = (machine_t *) mmap(0, mapSize, 
			 PROT_READ | PROT_WRITE | PROT_EXEC,
			 MAP_ANONYMOUS | MAP_PRIVATE | MAP_NORESERVE, 0, 0);
  if(M == MAP_FAILED)
    panic("Allocation of M for failed for a thread start = %lx err = %s", 
	  program_start,
	  strerror(errno));
  
  M->ismmaped = true;
  M->ptState = (pt_state *)(((unsigned char *)M) + sizeof(machine_t));
  
  DEBUG(thread_init) {
    fprintf(DBG, "M address = %lx\n", M);
  }

#ifdef SIGNALS
  M->ptState->Mnode.pid = getpid();
  M->ptState->Mnode.M = M;
  M->ptState->Mnode.next = NULL;
  addToMlist(&M->ptState->Mnode);
  //M->sigQfront = 0;
#endif /* SIGNALS */
  
  bb_cache_init(M);
  temp_entry = make_bb_entry(M, program_start, NOT_YET_TRANSLATED, 
			     CALL_HASH_BUCKET(M->call_hash_table, program_start));

#ifdef PROFILE_BB_STATS
  temp_entry->flags = 0;
#endif
  
  M->fixregs.eip = program_start;
  M->guest_start_eip = program_start;
  M->comming_from_call_indirect = false;

#ifdef DEBUG_ON
  M->nTrInstr = 0;
#endif

#ifdef PROFILE
  M->ptState->total_cnt = 0;
  M->ptState->normal_cnt = 0; 
  M->ptState->ret_cnt = 0;
  M->ptState->ret_Iw_cnt = 0;
  M->ptState->call_dir_cnt = 0;
  M->ptState->call_indr_cnt = 0;
  M->ptState->jmp_indr_cnt = 0;
  M->ptState->jmp_dir_cnt = 0;
  M->ptState->jmp_cond_cnt = 0;

  M->ptState->s_total_cnt = 0;
  M->ptState->s_normal_cnt = 0; 
  M->ptState->s_ret_cnt = 0;
  M->ptState->s_ret_Iw_cnt = 0;
  M->ptState->s_call_dir_cnt = 0;
  M->ptState->s_call_indr_cnt = 0;
  M->ptState->s_jmp_indr_cnt = 0;
  M->ptState->s_jmp_dir_cnt = 0;
  M->ptState->s_jmp_cond_cnt = 0;

  M->ptState->hash_nodes_cnt = 0;
  M->ptState->max_nodes_trav_cnt = 0;
#endif
 
#ifdef PROFILE_RET_MISS  
  M->ptState->ret_miss_cnt = 0;
  M->ptState->ret_ret_miss_cnt = 0;
  M->ptState->cold_cnt = 0;
#endif

#ifdef PROFILE_BB_CNT
  M->ptState->bb_cnt = 0;
#endif
  
  DEBUG(sigsegv) {
    MM = M;
    signal(SIGSEGV, (void *)handle_sigsegv);
  }
  
#ifdef SIGNALS
  sigprocmask(SIG_SETMASK, &oldSet, NULL);
#endif
  //fprintf(stderr, "[TH] M->ismmaped = %s\n", (M->ismmaped)?"true":"false");
  //fflush(stderr);
  return M;
}
#endif /* THREADED_XLATE */


#ifdef SIGNALS

/* Signals are MASKED when this function is called */
machine_t *   
init_signal_trans(unsigned long program_start, machine_t *parentM)
{
  machine_t *M;
  int i;
  bb_entry *temp_entry;

  DEBUG(sig_init_exit) {
    fprintf(DBG, "Signal start eip   = %lx\n", program_start);
  }

  size_t mapSize = sizeof(machine_t);
  mapSize = mapSize + (mapSize % PAGE_SIZE);    
  M = (machine_t *) mmap(0, mapSize, 
			 PROT_READ | PROT_WRITE | PROT_EXEC,
			 MAP_ANONYMOUS | MAP_PRIVATE | MAP_NORESERVE, 0, 0);
  if(M == MAP_FAILED)
    panic("Allocation of M for failed for a signal start = %lx, err = %s",
	  program_start, strerror(errno));
  
  M->ismmaped = true;
  M->prevM = parentM;
  M->ptState = parentM->ptState;
  DEBUG(sig_init_exit) {
    fprintf(DBG, "M address = %lx\n", M);
  }
  
  bb_cache_init(M);
  temp_entry = make_bb_entry(M, program_start, NOT_YET_TRANSLATED, 
			     CALL_HASH_BUCKET(M->call_hash_table, program_start));

#ifdef PROFILE_BB_STATS
  temp_entry->flags = 0;
#endif
  
  M->fixregs.eip = program_start;
  M->guest_start_eip = program_start;
  M->comming_from_call_indirect = false;

#ifdef DEBUG_ON
  M->nTrInstr = 0;
#endif
  
  //fprintf(stderr, "[TH] M->ismmaped = %s\n", (M->ismmaped)?"true":"false");
  //fflush(stderr);
  return M;
}

#endif /* SIGNALS */

#if 0
#ifdef PROFILE_BB_CNT      
    OpCode *p = (OpCode *) ds.pEntry;
    if(prev_bb_entry != M->curr_bb_entry) {
      // Deal with the previous entry
      if(pp_inc_addr && modifies_before_source) {
	unsigned char *temp_bbOut = M->bbOut;
	M->bbOut = (unsigned char *)pp_inc_addr;
	bb_emit_nop_inc(M, (unsigned long)&M->ptState->bb_cnt3);
	M->bbOut = temp_bbOut;
      }

      // New BB has started, emit an INC
      // SOURCES_FLAGS(p), MODIFIES_FLAGS(p)
      if((SOURCES_FLAGS(p) == 0) && (MODIFIES_FLAGS(p))) {
	pp_inc_addr = 0;
	bb_emit_lw_inc(M, (unsigned long)&M->ptState->bb_cnt2);
	modifies_before_source = true;	
      }
      else {
	pp_inc_addr = (unsigned long)M->bbOut;
	bb_emit_inc(M, (unsigned long)&M->ptState->bb_cnt1);
	sources = false;
	modifies_before_source = false;
      }      
      prev_bb_entry = M->curr_bb_entry;
    }

    if(SOURCES_FLAGS(p))
      sources = true;
    else if (MODIFIES_FLAGS(p)) {
      if(!sources)
	modifies_before_source = true;
    }
    
/*   unsigned long total = M->ptState->bb_cnt1 + M->ptState->bb_cnt2; */
/*   fprintf(f, "BB Count (ppf)    = %7lu (%0.2f%%)\n", M->ptState->bb_cnt1, */
/* 	 PERC(M->ptState->bb_cnt1, total)); */
/*   fprintf(f, "BB Count (no ppf) = %7lu (%0.2f%%)\n", M->ptState->bb_cnt2, */
/* 	 PERC(M->ptState->bb_cnt2, total)); */
/*   fprintf(f, "Total BB Count    = %7lu\n", total); */
/*   fprintf(f, "__________________________________\n\n"); */
/*   fclose(f); */
#endif
#endif