Skip to content

Commit f78db2c

Browse files
Rot127Rot127
authored
Merge pull request #41 from Rot127/bap-tcg-plugin
TCG trace plugin
2 parents ff3419c + 6de3cfe commit f78db2c

32 files changed

+1939
-31
lines changed

‎.github/workflows/build.yaml

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
name: Build
2+
3+
on: [pull_request, workflow_dispatch]
4+
5+
jobs:
6+
build:
7+
runs-on: ubuntu-latest
8+
steps:
9+
- uses: actions/checkout@v4
10+
- name: Set up Python 3.x
11+
uses: actions/setup-python@v4
12+
with:
13+
python-version: '3.x'
14+
- name: Install deps
15+
run: |
16+
sudo apt-get -y update
17+
sudo apt-get install -y git libglib2.0-dev libfdt-dev libpixman-1-dev zlib1g-dev ninja-build autoconf libtool protobuf-c-compiler libprotobuf-c-dev
18+
- name: Install piqi
19+
run: |
20+
curl -OL https://raw.github.com/alavrik/piqi-binary/master/Linux-x86_64/piqi
21+
chmod +x piqi
22+
sudo mv piqi /usr/local/bin
23+
piqi --version
24+
- name: Checkout qemu
25+
uses: actions/checkout@v4
26+
with:
27+
repository: BinaryAnalysisPlatform/qemu
28+
path: qemu
29+
submodules: true
30+
- name: Build for Targets
31+
run: |
32+
cd qemu
33+
mkdir build
34+
cd build
35+
../configure --enable-plugins --target-list=sparc-linux-user,sparc64-linux-user
36+
ninja

‎.github/workflows/lockdown.yml

Lines changed: 0 additions & 30 deletions
This file was deleted.

‎.gitmodules

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,3 +43,6 @@
4343
[submodule "tests/lcitool/libvirt-ci"]
4444
path = tests/lcitool/libvirt-ci
4545
url = https://gitlab.com/libvirt/libvirt-ci.git
46+
[submodule "contrib/plugins/bap-tracing/bap-frames"]
47+
path = contrib/plugins/bap-tracing/bap-frames
48+
url = [email protected]:BinaryAnalysisPlatform/bap-frames.git

‎README.md

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
# BAP emulation trace generator
2+
3+
This QEMU fork implements the TCG plugin to generate execution traces in the
4+
[bap-frame](https://github.com/BinaryAnalysisPlatform/bap-frames) format.
5+
6+
This plugin does not yet support all targets.
7+
If not listed below it is untested.
8+
9+
Known to work:
10+
11+
- Sparc
12+
- Hexagon
13+
- PPC
14+
15+
Needs fixes:
16+
17+
- ARM (cannot get current mode of VCPU if target can switch between ARM/Thumb).
18+
19+
Previous traces were generated with a patched QEMU.
20+
You can find these in tracewrap-* branches.
21+
22+
## Dependencies
23+
24+
1. Install [piqi](https://piqi.org/downloads/) so you have the `piqi` binary in `PATH`.
25+
2. Install the developer package of `protobuf-c`. E.g. `protobuf-c-devel` (Fedora), `libprotobuf-c-dev` (Debian).
26+
3. QEMU dependencies (see [QEMU docs](https://www.qemu.org/docs/master/devel/build-environment.html)).
27+
28+
## Building
29+
30+
```bash
31+
mkdir build
32+
cd build
33+
# See `../configure --help` for a list of targets.
34+
../configure --enable-plugins --target-list=<target>
35+
make
36+
```
37+
38+
## Tracing a binary
39+
40+
The plugin takes two required arguments:
41+
42+
`bin_path`: The path to the binary emulated. Due to a [QEMU bug](https://gitlab.com/qemu-project/qemu/-/issues/3014) this cannot be inferred.
43+
`out`: The output file to save the trace into.
44+
`endianness`: The architecture endanness.
45+
46+
```bash
47+
./qemu-sparc64 -plugin file=buil/contrib/plugins/bap-tracing/libbap_tracing.so,bin_path=<bin_path>,out=<output-file>,endianness=[b/l] -d plugin <bin_path>
48+
ls <output-file>
49+
```
50+
51+
You can also use the helper shell script:
52+
53+
```bash
54+
./gen-trace.sh ./build/ sparc64 b <path_to_bin>
55+
```
56+
57+
> [!NOTE]
58+
> The trace plugin currently only generates standard frames.
59+
> This is due to the limitations of the QEMU plugin API.
60+
>
61+
> If the traced binary exits due to an exception it can only indirectly be observed.
62+
> It will produce a standard frame without any logged post register state.
63+
> Any completed memory read/write might still be logged.
64+
>
65+
> If you suspect this, execute the binary with the `execlog` plugin (see `gen-trace.sh` or `gen-execlog.sh`)
66+
> to check of the execution stops earlier than expected.
67+
68+
69+
## Trace format
70+
71+
The generated trace consists of three parts: the header,
72+
a table of contents (TOC) holding the frame entries, and an index into the TOC.
73+
74+
Each frame entry starts with the size of the frame, followed by the actual frame data.
75+
A fixed number of frame entries are considered one _entry_ in the TOC.
76+
77+
The TOC index is stored at the end.
78+
79+
For specifics about the frame contents, please refer
80+
to the [definitions](https://github.com/BinaryAnalysisPlatform/bap-frames/tree/master/piqi) in
81+
the BAP-frames repository.
82+
83+
**Format**
84+
85+
| Offset | Type | Field | Trace section |
86+
|--------|------|-------|------|
87+
| 0x0 | uint64_t | magic number (7456879624156307493LL) | Header begin |
88+
| 0x8 | uint64_t | trace version number | |
89+
| 0x10 | uint64_t | frame_architecture | |
90+
| 0x18 | uint64_t | frame_machine, 0 for unspecified. | |
91+
| 0x20 | uint64_t | n = total number of frames in trace. | |
92+
| 0x28 | uint64_t | T = offset to TOC index. | |
93+
| 0x30 | uint64_t | sizeof(frame_0) | TOC begin |
94+
| 0x38 | meta_frame | frame_0 | |
95+
| 0x40 | uint64_t | sizeof(frame_1) | |
96+
| 0x48 | type(frame_1) | frame_1 | |
97+
| ... | ... | ... | |
98+
| T-0x10 | uint64_t | sizeof(frame_n-1) | |
99+
| T-0x8 | type(frame_n-1) | frame_n-1 | |
100+
| T+0 | uint64_t | m = number of frames per TOC entry | TOC index begin |
101+
| T+0x8 | uint64_t | offset toc_entry(0) | |
102+
| T+0x10 | uint64_t | offset toc_entry(1) | |
103+
| ... | ... | ... | |
104+
| T+0x8+(0x8*ceil(n/m)) | uint64_t | offset toc_entry(ceil(n/m)) | |

‎configs/targets/sparc-linux-user.mak

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,5 @@ TARGET_ARCH=sparc
22
TARGET_SYSTBL_ABI=common,32
33
TARGET_SYSTBL=syscall.tbl
44
TARGET_BIG_ENDIAN=y
5+
TARGET_XML_FILES= gdb-xml/sparc32-core.xml gdb-xml/sparc32-cp0.xml gdb-xml/sparc32-cpu.xml gdb-xml/sparc32-fpu.xml
56
TARGET_LONG_BITS=32

‎configs/targets/sparc-softmmu.mak

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
TARGET_ARCH=sparc
22
TARGET_BIG_ENDIAN=y
33
TARGET_SUPPORTS_MTTCG=y
4+
TARGET_XML_FILES= gdb-xml/sparc32-core.xml gdb-xml/sparc32-cp0.xml gdb-xml/sparc32-cpu.xml gdb-xml/sparc32-fpu.xml
45
TARGET_LONG_BITS=32

‎configs/targets/sparc32plus-linux-user.mak

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,4 +5,5 @@ TARGET_ABI_DIR=sparc
55
TARGET_SYSTBL_ABI=common,32
66
TARGET_SYSTBL=syscall.tbl
77
TARGET_BIG_ENDIAN=y
8+
TARGET_XML_FILES= gdb-xml/sparc64-core.xml gdb-xml/sparc64-cp0.xml gdb-xml/sparc64-cpu.xml gdb-xml/sparc64-fpu.xml
89
TARGET_LONG_BITS=64

‎configs/targets/sparc64-linux-user.mak

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,4 +4,5 @@ TARGET_ABI_DIR=sparc
44
TARGET_SYSTBL_ABI=common,64
55
TARGET_SYSTBL=syscall.tbl
66
TARGET_BIG_ENDIAN=y
7+
TARGET_XML_FILES= gdb-xml/sparc64-core.xml gdb-xml/sparc64-cp0.xml gdb-xml/sparc64-cpu.xml gdb-xml/sparc64-fpu.xml
78
TARGET_LONG_BITS=64

‎configs/targets/sparc64-softmmu.mak

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,5 @@ TARGET_ARCH=sparc64
22
TARGET_BASE_ARCH=sparc
33
TARGET_BIG_ENDIAN=y
44
TARGET_SUPPORTS_MTTCG=y
5+
TARGET_XML_FILES= gdb-xml/sparc64-core.xml gdb-xml/sparc64-cp0.xml gdb-xml/sparc64-cpu.xml gdb-xml/sparc64-fpu.xml
56
TARGET_LONG_BITS=64

‎contrib/plugins/bap-tracing/bap-frames

Submodule bap-frames added at 7587868

0 commit comments

Comments
 (0)