DynamoRIO / DynamoRIO/dynamorio
rcx syscall return address not transparent when xl8 app state
- Dominant language
- C
- Stars
- 3.2k
- Forks
- 629
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 31
Description
I observed in burst_threadfilter test that when a thread is occasionally suspended at syscall, the xcx value is not getting restored.
Code cache:
0x00005633d5cf8c40 0f 05 syscall -> %rcx
Looping on synch with thread 14524
recreate_app_state -- translating from:
priv_mcontext_t @0x00007fcb68d12780
xax = 0x00000000000000ca
xbx = 0x00007fcb6ad17700
xcx = 0x00005633d5cf8c42
xdx = 0x00000000000038bd
xsi = 0x0000000000000000
xdi = 0x00007fcb6ad179d0
xbp = 0x0000000000000000
xsp = 0x00007ffeb3574190
r8 = 0x00000000000000ca
r9 = 0x00007fcb6ad179d0
r10 = 0x0000000000000000
r11 = 0x0000000000000246
r12 = 0x0000000000000000
r13 = 0x00007ffeb35741a0
r14 = 0x0000000000000000
r15 = 0x0000000000000000
ymm0= 0x0000000000000000000000000000000000000000000000000000000000000000
ymm1= 0x6b10456000007fcb6b107bc000007fcb00000000000000000000000000000000
ymm2= 0x66666f2d656e696c616d2d2072745f7800000000000000000000000000000000
ymm3= 0x6474732d5f7272656b73616d6378302000000000000000000000000000000000
ymm4= 0xb357539300007ffeb35753a900007ffe00000000000000000000000000000000
ymm5= 0xb3575f4700007ffeb3575f6700007ffe00000000000000000000000000000000
ymm6= 0xb3575e4900007ffeb3575e7600007ffe00000000000000000000000000000000
ymm7= 0xb3575dba00007ffeb3575dcb00007ffe00000000000000000000000000000000
ymm8= 0xb3575d6500007ffeb3575d7400007ffe00000000000000000000000000000000
ymm9= 0x0000000000000000000000000000000000000000000000000000000000000000
ymm10= 0x0000000000000000000000000000000000000000000000000000000000000000
ymm11= 0x0000000000000000000000000000000000000000000000000000000000000000
ymm12= 0x0000000000000000000000000000000000000000000000000000000000000000
ymm13= 0x0000000000000000000000000000000000000000000000000000000000000000
ymm14= 0x0000000000000000000000000000000000000000000000000000000000000000
ymm15= 0x0000000000000000000000000000000000000000000000000000000000000000
mxcsr=0x00001fa0
eflags = 0x0000000000000246
pc = 0x00005633d5cf8c40
recreate_app pc = after_syscall, translating
recreate_app_state -- translation is:
priv_mcontext_t @0x00007fcb68d12780
xax = 0x00000000000000ca
xbx = 0x00007fcb6ad17700
xcx = 0x00005633d5cf8c42
xdx = 0x00000000000038bd
xsi = 0x0000000000000000
xdi = 0x00007fcb6ad179d0
xbp = 0x0000000000000000
xsp = 0x00007ffeb3574190
r8 = 0x00000000000000ca
r9 = 0x00007fcb6ad179d0
r10 = 0x0000000000000000
r11 = 0x0000000000000246
r12 = 0x0000000000000000
r13 = 0x00007ffeb35741a0
r14 = 0x0000000000000000
r15 = 0x0000000000000000
ymm0= 0x0000000000000000000000000000000000000000000000000000000000000000
ymm1= 0x6b10456000007fcb6b107bc000007fcb00000000000000000000000000000000
ymm2= 0x66666f2d656e696c616d2d2072745f7800000000000000000000000000000000
ymm3= 0x6474732d5f7272656b73616d6378302000000000000000000000000000000000
ymm4= 0xb357539300007ffeb35753a900007ffe00000000000000000000000000000000
ymm5= 0xb3575f4700007ffeb3575f6700007ffe00000000000000000000000000000000
ymm6= 0xb3575e4900007ffeb3575e7600007ffe00000000000000000000000000000000
ymm7= 0xb3575dba00007ffeb3575dcb00007ffe00000000000000000000000000000000
ymm8= 0xb3575d6500007ffeb3575d7400007ffe00000000000000000000000000000000
ymm9= 0x0000000000000000000000000000000000000000000000000000000000000000
ymm10= 0x0000000000000000000000000000000000000000000000000000000000000000
ymm11= 0x0000000000000000000000000000000000000000000000000000000000000000
ymm12= 0x0000000000000000000000000000000000000000000000000000000000000000
ymm13= 0x0000000000000000000000000000000000000000000000000000000000000000
ymm14= 0x0000000000000000000000000000000000000000000000000000000000000000
ymm15= 0x0000000000000000000000000000000000000000000000000000000000000000
mxcsr=0x00001fa0
eflags = 0x0000000000000246
pc = 0x00007fcb6bc54d2b
xcx is still code cache return address. I have seen the same thread crashing but it is likely crashing because of some other issue.
Contributor guide
Assessment
This issue has not been assessed yet.