Paging filter

cpu-target.c

@@ -61,6 +61,14 @@ int libafl_qemu_write_reg(CPUState* cpu, int reg, uint8_t* val);
 int libafl_qemu_read_reg(CPUState* cpu, int reg, uint8_t* val);
 int libafl_qemu_num_regs(CPUState* cpu);
 
+//// --- Begin LibAFL code ---
+
+#ifndef CONFIG_USER_ONLY
+hwaddr libafl_qemu_current_paging_id(CPUState* cpu);
+#endif
+
+//// --- End LibAFL code ---
+
 void libafl_flush_jit(void);
 
 extern int libafl_restoring_devices;
@@ -153,6 +161,22 @@ int libafl_qemu_num_regs(CPUState* cpu)
     return cc->gdb_num_core_regs;
 }
 
+//// --- Begin LibAFL code ---
+
+#ifndef CONFIG_USER_ONLY
+hwaddr libafl_qemu_current_paging_id(CPUState* cpu)
+{
+    CPUClass* cc = CPU_GET_CLASS(cpu);
+    if (cc->sysemu_ops && cc->sysemu_ops->get_paging_id) {
+        return cc->sysemu_ops->get_paging_id(cpu);
+    } else {
+        return 0;
+    }
+}
+#endif
+
+//// --- End LibAFL code ---
+
 void libafl_flush_jit(void)
 {
     CPUState *cpu;

include/hw/core/sysemu-cpu-ops.h

@@ -25,6 +25,12 @@ typedef struct SysemuCPUOps {
      * @get_paging_enabled: Callback for inquiring whether paging is enabled.
      */
     bool (*get_paging_enabled)(const CPUState *cpu);
+//// --- Begin LibAFL code ---
+    /**
+     * @get_paging_id: Callback for inquiring paging ID (makes sense iif @get_paging_enabled is true).
+     */
+    hwaddr (*get_paging_id)(const CPUState* cpu);
+//// --- End LibAFL code ---
     /**
      * @get_phys_page_debug: Callback for obtaining a physical address.
      */

target/i386/cpu.c

@@ -7654,6 +7654,18 @@ static bool x86_cpu_get_paging_enabled(const CPUState *cs)
 
     return cpu->env.cr[0] & CR0_PG_MASK;
 }
+
+//// --- Begin LibAFL code ---
+
+static hwaddr x86_cpu_get_paging_id(const CPUState *cs)
+{
+    X86CPU *cpu = X86_CPU(cs);
+
+    return cpu->env.cr[3] & CR3_PD_BASE;
+}
+
+//// --- End LibAFL code ---
+
 #endif /* !CONFIG_USER_ONLY */
 
 static void x86_cpu_set_pc(CPUState *cs, vaddr value)
@@ -7922,6 +7934,9 @@ static Property x86_cpu_properties[] = {
 static const struct SysemuCPUOps i386_sysemu_ops = {
     .get_memory_mapping = x86_cpu_get_memory_mapping,
     .get_paging_enabled = x86_cpu_get_paging_enabled,
+//// --- Begin LibAFL code ---
+    .get_paging_id = x86_cpu_get_paging_id,
+//// --- End LibAFL code ---
     .get_phys_page_attrs_debug = x86_cpu_get_phys_page_attrs_debug,
     .asidx_from_attrs = x86_asidx_from_attrs,
     .get_crash_info = x86_cpu_get_crash_info,

target/i386/cpu.h

@@ -238,6 +238,12 @@ typedef enum X86Seg {
 #define CR0_CD_MASK  (1U << 30)
 #define CR0_PG_MASK  (1U << 31)
 
+//// --- Begin LibAFL code ---
+
+#define CR3_PD_BASE  (~(((((target_ulong) 1U) << 12) - 1)))
+
+//// --- End LibAFL code ---
+
 #define CR4_VME_MASK  (1U << 0)
 #define CR4_PVI_MASK  (1U << 1)
 #define CR4_TSD_MASK  (1U << 2)