DynamoRIO / DynamoRIO/dynamorio

AMD LWP instrs read and write memory, but have no memory operands

Open
#1,311 0 comments 0 reactions 0 assignees View on GitHub
Component-API Migrated Priority-Medium
Dominant language
C
Stars
3.2k
Forks
629
Avg merge
2d 15h
Merged PRs (30d)
31

Description

_From [bruen...@google.com](https://code.google.com/u/109494838902877177630/) on November 05, 2013 12:55:28_

AMD's LWP instructions implicitly write memory and it's not easy to encode
that into our IR due to the location of the memory written.

OP_llwpcb and OP_slwpcb have a TYPE_R operand and mod=11 but really it's a
mem addr:

Parses the Lightweight Profiling Control Block at the address contained in
the specified register.

ModRM.reg augments the opcode and is assigned the value 0. ModRM.r/m
(augmented by XOP.R) specifies the register containing the effective
address of the LWPCB. ModRM.mod is 11b.

OP_slwpcb writes to memory and returns the linear address of the current
LPCB in the specified register -- returns 0 if LWP is not enabled.

Encoding-wise, TYPE_R is right, but not for instr analysis, which will
think these instrs do not touch memory.

So do we go to the trouble of making our own new operand type, "base
register pointing at memory but encoded as TYPE_R"? It's rather annoying
-- they should have used TYPE_M, but I guess the hardware can't handle an
index register or scale, so they made this new corner case for us.

Even worse, OP_lwpval writes to several fields in the LPCB.
OP_lwpins writes to the ring buffer, so somewhere in
[LWPCB.BufferBase, LWPCB.BufferBase + LWPCB.BufferSize).

So for the IR, what do we do? OP_lwpins takes in 3 args, all of which are
written into memory at a location determined by a pointer in the current
LWP control block. Do we bail on trying to have some memory operand, and
instead have "instr_writes_memory" have a special case for these opcodes?
All kinds of code is going to break. Let's say part of the buffer is
unwritable and you have a fault. A lot of our tools go try to figure out
what address the fault is at and match it up to the faulting instr, but the
faulting instr here has no (visible) memory operand.

We're bailing for now and we'll just have the IR use the (non-memory)
operand types in AMD's manual.

_Original issue: http://code.google.com/p/dynamorio/issues/detail?id=1311_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.