New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Research impact of tb_flush after init_forkserver #15
Comments
Very unsuccessfully tried index 94184a2..5f6e9d5 100755
--- a/qemu/cpu-exec.c
+++ b/qemu/cpu-exec.c
@@ -290,7 +299,13 @@ int cpu_exec(struct uc_struct *uc, CPUArchState *env) // qq
// Unicorn: flush JIT cache to because emulation might stop in
// the middle of translation, thus generate incomplete code.
// TODO: optimize this for better performance
+#if defined(UNICORN_AFL)
+ if (!env->uc->afl_area_ptr) {
+ tb_flush(env);
+ }
+#else
tb_flush(env);
+#endif -> The (normally working) testcase crashes with |
Found the root cause:
As fix, I've started to add a This will be upstreamed to AFL++, the trickle into this repo. |
Merged to master with 3ac3007 |
The current fork-server implementation on X64 might be negatively impacted by
tb-flush
in cpu-exec of unicorn:https://github.com/unicorn-engine/unicorn/blob/0551b56633f658ec760eac54c14712d712b746d7/qemu/cpu-exec.c#
Problem:
To start the fork-server, a single insn is executed.
Afterwards, we exit the cpu loop and translated blocks are flushed.
Since the parent will wait for translation requests at this first insn, all pre-jitted blocks on future children may simply be flushed and re-jitted after input from AFL is read.
The text was updated successfully, but these errors were encountered: