Skip to content

add usermode multithreading halt for breakpoints not on main thread #3836

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rliebig wants to merge 14 commits into
base: main
Choose a base branch
from
Open

add usermode multithreading halt for breakpoints not on main thread #3836

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
8e15942
feat(qemu): add usermode multithreading support
rliebig Apr 13, 2026
ced570a
Merge branch 'AFLplusplus:main' into usermode-multithreading-support
rliebig Jun 3, 2026
d56f601
fix: pass CPUState pointer to single CPU runner
rliebig Jun 8, 2026
fbba289
Merge branch 'AFLplusplus:main' into usermode-multithreading-support
rliebig Jun 8, 2026
44ca8d1
refactor: Use CPUState* instead of cpu_index for run_single_cpu
rliebig Jun 8, 2026
bf32b26
Technical commit to remove unwanted changes
rliebig Jun 8, 2026
b0e2cef
Merge branch 'main' into usermode-multithreading-support
domenukk Jun 22, 2026
718619d
Merge branch 'main' into usermode-multithreading-support
domenukk Jul 12, 2026
1cf3b2b
Set QEMU_IS_RUNNING variable to handle signals correctly
rliebig Jul 21, 2026
a48058d
Bump qemu-libafl-bridge rev to qemu-libafl-bridge#129
rliebig Jul 21, 2026
cc5ea43
cargo fmt
rliebig Jul 21, 2026
7e404c1
libafl_qemu: adapt pre-syscall hook ABI to pointer-based args
rliebig Jul 21, 2026
45b569b
Bump qemu-libafl-bridge rev to qemu-libafl-bridge#129
rliebig Jul 22, 2026
23dd986
libafl_qemu: fix remaining pre-syscall hook ABI gaps (docs stub, python)
rliebig Jul 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion crates/libafl_qemu/libafl_qemu_build/src/build.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ use crate::cargo_add_rpath;

pub const LIBAFL_QEMU_GIT_URL: &str = "https://github.com/AFLplusplus/qemu-libafl-bridge";
pub const LIBAFL_QEMU_DIRNAME: &str = "qemu-libafl-bridge";
pub const LIBAFL_QEMU_GIT_REV: &str = "d7a6067ffc94fbb4caad409d390e099630b71941";
pub const LIBAFL_QEMU_GIT_REV: &str = "f620bd6c1a7f244125fa16000788fa7919d8e454";

pub struct BuildResult {
pub qemu_path: PathBuf,
Expand Down
21 changes: 12 additions & 9 deletions crates/libafl_qemu/libafl_qemu_sys/src/bindings/x86_64_stub_bindings.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8237,6 +8237,9 @@ unsafe extern "C" {
unsafe extern "C" {
pub fn libafl_qemu_run() -> ::std::os::raw::c_int;
}
unsafe extern "C" {
pub fn libafl_qemu_run_single_cpu(cpu_index: *mut CPUState) -> ::std::os::raw::c_int;
}
unsafe extern "C" {
pub fn libafl_set_qemu_env(env: *mut CPUArchState);
}
Expand Down Expand Up @@ -9221,15 +9224,15 @@ impl ::std::fmt::Debug for libafl_syshook_ret {
pub type libafl_pre_syscall_cb = ::std::option::Option<
unsafe extern "C" fn(
data: u64,
sys_num: ::std::os::raw::c_int,
arg0: target_ulong,
arg1: target_ulong,
arg2: target_ulong,
arg3: target_ulong,
arg4: target_ulong,
arg5: target_ulong,
arg6: target_ulong,
arg7: target_ulong,
sys_num: *mut ::std::os::raw::c_int,
arg0: *mut target_ulong,
arg1: *mut target_ulong,
arg2: *mut target_ulong,
arg3: *mut target_ulong,
arg4: *mut target_ulong,
arg5: *mut target_ulong,
arg6: *mut target_ulong,
arg7: *mut target_ulong,
) -> libafl_syshook_ret,
>;
pub type libafl_post_syscall_cb = ::std::option::Option<
Expand Down
19 changes: 10 additions & 9 deletions crates/libafl_qemu/src/modules/usermode/asan_host.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -536,16 +536,17 @@ impl AsanGiovese {
#[allow(dead_code)]
extern "C" fn fake_syscall(
mut self: Pin<&mut Self>,
sys_num: i32,
a0: GuestUlong,
a1: GuestUlong,
a2: GuestUlong,
a3: GuestUlong,
_a4: GuestUlong,
_a5: GuestUlong,
_a6: GuestUlong,
_a7: GuestUlong,
sys_num: *mut i32,
a0: *mut GuestUlong,
a1: *mut GuestUlong,
a2: *mut GuestUlong,
a3: *mut GuestUlong,
_a4: *mut GuestUlong,
_a5: *mut GuestUlong,
_a6: *mut GuestUlong,
_a7: *mut GuestUlong,
) -> SyscallHookResult {
let (sys_num, a0, a1, a2, a3) = unsafe { (*sys_num, *a0, *a1, *a2, *a3) };
if sys_num == QASAN_FAKESYS_NR {
let mut r = 0;
let qemu = Qemu::get().unwrap();
Expand Down
191 changes: 147 additions & 44 deletions crates/libafl_qemu/src/qemu/hooks.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -494,35 +494,138 @@ create_hook_types!(
>,
extern "C" fn(
*const (),
i32,
GuestUlong,
GuestUlong,
GuestUlong,
GuestUlong,
GuestUlong,
GuestUlong,
GuestUlong,
GuestUlong,
*mut i32,
*mut GuestUlong,
*mut GuestUlong,
*mut GuestUlong,
*mut GuestUlong,
*mut GuestUlong,
*mut GuestUlong,
*mut GuestUlong,
*mut GuestUlong,
) -> SyscallHookResult
);
#[cfg(feature = "usermode")]
create_hook_id!(PreSyscall, libafl_qemu_remove_pre_syscall_hook, false);
#[cfg(feature = "usermode")]
create_wrapper!(
pre_syscall,
(
sys_num: i32,
a0: GuestUlong,
a1: GuestUlong,
a2: GuestUlong,
a3: GuestUlong,
a4: GuestUlong,
a5: GuestUlong,
a6: GuestUlong,
a7: GuestUlong
),
SyscallHookResult
);
pub(crate) unsafe extern "C" fn func_pre_syscall_hook_wrapper<ET, I, S>(
hook: &mut (),
sys_num: *mut i32,
a0: *mut GuestUlong,
a1: *mut GuestUlong,
a2: *mut GuestUlong,
a3: *mut GuestUlong,
a4: *mut GuestUlong,
a5: *mut GuestUlong,
a6: *mut GuestUlong,
a7: *mut GuestUlong,
) -> SyscallHookResult
where
I: Unpin,
S: Unpin,
{
unsafe {
let qemu = Qemu::get_unchecked();
let modules = EmulatorModules::<ET, I, S>::emulator_modules_mut_unchecked();
let func: fn(
Qemu,
&mut EmulatorModules<ET, I, S>,
Option<&mut S>,
i32,
GuestUlong,
GuestUlong,
GuestUlong,
GuestUlong,
GuestUlong,
GuestUlong,
GuestUlong,
GuestUlong,
) -> SyscallHookResult = transmute(ptr::from_mut::<()>(hook));
func(
qemu,
modules,
inprocess_get_state::<S>(),
*sys_num,
*a0,
*a1,
*a2,
*a3,
*a4,
*a5,
*a6,
*a7,
)
}
}

#[cfg(feature = "usermode")]
pub(crate) unsafe extern "C" fn closure_pre_syscall_hook_wrapper<ET, I, S>(
hook: &mut FatPtr,
sys_num: *mut i32,
a0: *mut GuestUlong,
a1: *mut GuestUlong,
a2: *mut GuestUlong,
a3: *mut GuestUlong,
a4: *mut GuestUlong,
a5: *mut GuestUlong,
a6: *mut GuestUlong,
a7: *mut GuestUlong,
) -> SyscallHookResult
where
I: Unpin,
S: Unpin,
{
unsafe {
let qemu = Qemu::get_unchecked();
let modules = EmulatorModules::<ET, I, S>::emulator_modules_mut_unchecked();
let func: &mut Box<
dyn FnMut(
Qemu,
&mut EmulatorModules<ET, I, S>,
Option<&mut S>,
i32,
GuestUlong,
GuestUlong,
GuestUlong,
GuestUlong,
GuestUlong,
GuestUlong,
GuestUlong,
GuestUlong,
) -> SyscallHookResult,
> = &mut *(ptr::from_mut::<FatPtr>(hook)
as *mut Box<
dyn FnMut(
Qemu,
&mut EmulatorModules<ET, I, S>,
Option<&mut S>,
i32,
GuestUlong,
GuestUlong,
GuestUlong,
GuestUlong,
GuestUlong,
GuestUlong,
GuestUlong,
GuestUlong,
) -> SyscallHookResult,
>);
func(
qemu,
modules,
inprocess_get_state::<S>(),
*sys_num,
*a0,
*a1,
*a2,
*a3,
*a4,
*a5,
*a6,
*a7,
)
}
}

// Post-syscall hook wrappers
#[cfg(feature = "usermode")]
Expand Down Expand Up @@ -1267,32 +1370,32 @@ impl QemuHooks {
pub fn add_pre_syscall_hook<T: Into<HookData>>(
&self,
data: T,
callback: extern "C" fn(
callback: unsafe extern "C" fn(
T,
i32,
GuestUlong,
GuestUlong,
GuestUlong,
GuestUlong,
GuestUlong,
GuestUlong,
GuestUlong,
GuestUlong,
*mut i32,
*mut GuestUlong,
*mut GuestUlong,
*mut GuestUlong,
*mut GuestUlong,
*mut GuestUlong,
*mut GuestUlong,
*mut GuestUlong,
*mut GuestUlong,
) -> SyscallHookResult,
) -> PreSyscallHookId {
unsafe {
let data: u64 = data.into().0;
let callback: extern "C" fn(
let callback: unsafe extern "C" fn(
u64,
i32,
GuestUlong,
GuestUlong,
GuestUlong,
GuestUlong,
GuestUlong,
GuestUlong,
GuestUlong,
GuestUlong,
*mut i32,
*mut GuestUlong,
*mut GuestUlong,
*mut GuestUlong,
*mut GuestUlong,
*mut GuestUlong,
*mut GuestUlong,
*mut GuestUlong,
*mut GuestUlong,
) -> libafl_qemu_sys::libafl_syshook_ret = transmute(callback);
let num = libafl_qemu_sys::libafl_add_pre_syscall_hook(Some(callback), data);
PreSyscallHookId(num)
Expand Down
Loading
Loading