DynamoRIO / DynamoRIO/dynamorio

drcachesim online traces are missing instructions after sigreturns

Open
#3,937 3 comments 0 reactions 1 assignee Claimed by @derekbruening View on GitHub
Component-DrMemtrace
Dominant language
C
Stars
3.2k
Forks
629
Avg merge
2d 15h
Merged PRs (30d)
31

Description

In PR #3936 I added markers to the trace view tool. While testing them on
an app with signals I noticed some irregularities.

-test_mode's trace_invariants is not checking these things: we should add
such checks there.

I'm targeting a single thread file below using something of a hack where I
point at a thread shard file and the module file (because official usage
does not support this and doesn't know where to find the module file). I
plan to add better support for that separately.

Problem A: "ret" should be *before" the marker:
```
$ bin64/drrun -t drcachesim -simulator_type view -infile drmemtrace.threadsig.67978.9154.dir/trace/drmemtrace.threadsig.67980.1273.trace.gz -module_file drmemtrace.threadsig.67978.9154.dir/raw/modules.log -test_mode 2>&1 | less

0x00007f15978dd5bb 48 85 c0 test %rax, %rax
0x00007f15978dd5be 74 01 jz $0x00007f15978dd5c1

0x00007f15978dd5c0 c3 ret
0x00007f1594e47dba 55 push %rbp
0x00007f1594e47dbb 48 89 e5 mov %rsp, %rbp
0x00007f1594e47dbe 89 7d fc mov %edi, -0x04(%rbp)
0x00007f1594e47dc1 48 89 75 f0 mov %rsi, -0x10(%rbp)
0x00007f1594e47dc5 48 89 55 e8 mov %rdx, -0x18(%rbp)
0x00007f1594e47dc9 83 7d fc 1a cmp -0x04(%rbp), $0x1a
0x00007f1594e47dcd 75 0f jnz $0x00007f1594e47dde
0x00007f1594e47dcf 8b 05 7f 23 20 00 mov 0x00007f159504a154, %eax
0x00007f1594e47dd5 83 c0 01 add $0x01, %eax
0x00007f1594e47dd8 89 05 76 23 20 00 mov %eax, 0x00007f159504a154
0x00007f1594e47dde 90 nop
0x00007f1594e47ddf 5d pop %rbp
0x00007f1594e47de0 c3 ret
0x00007f15980dc3a0 48 c7 c0 0f 00 00 00 mov $0x0000000f, %rax
0x00007f15980dc3a7 0f 05 syscall

0x00007f15980d1cd0 49 8b 9e 90 06 00 00 mov 0x00000690(%r14), %rbx
```
(trace_invariants only checks the prior marker, not that it was
*immediately* prior.)

Problem B: sigreturn skips an instruction!
```
$ bin64/drrun -t drcachesim -simulator_type view -infile drmemtrace.threadsig.67978.9154.dir/trace/drmemtrace.threadsig.67978.3662.trace.gz -module_file drmemtrace.threadsig.67978.9154.dir/raw/modules.log -test_mode 2>&1 | less

0x00007f15980d2720 44 89 95 40 ff ff ff mov %r10d, -0xc0(%rbp)
0x00007f15980d2727 f0 ff 0d 5a 5c 21 00 lock decl 0x00007f15982e8388

0x00007f1594e47dba 55 push %rbp
0x00007f1594e47dbb 48 89 e5 mov %rsp, %rbp
0x00007f1594e47dbe 89 7d fc mov %edi, -0x04(%rbp)
0x00007f1594e47dc1 48 89 75 f0 mov %rsi, -0x10(%rbp)
0x00007f1594e47dc5 48 89 55 e8 mov %rdx, -0x18(%rbp)
0x00007f1594e47dc9 83 7d fc 1a cmp -0x04(%rbp), $0x1a
0x00007f1594e47dcd 75 0f jnz $0x00007f1594e47dde
0x00007f1594e47dcf 8b 05 7f 23 20 00 mov 0x00007f159504a154, %eax
0x00007f1594e47dd5 83 c0 01 add $0x01, %eax
0x00007f1594e47dd8 89 05 76 23 20 00 mov %eax, 0x00007f159504a154
0x00007f1594e47dde 90 nop
0x00007f1594e47ddf 5d pop %rbp
0x00007f1594e47de0 c3 ret
0x00007f15980dc3a0 48 c7 c0 0f 00 00 00 mov $0x0000000f, %rax
0x00007f15980dc3a7 0f 05 syscall

0x00007f15980d274a 4d 01 e1 add %r12, %r9
0x00007f15980d274d 66 45 85 e4 data16 test %r12w, %r12w
```

From a later sequence we see that it's missing a single instr:
```
0x00007f15980d2727 f0 ff 0d 5a 5c 21 00 lock decl 0x00007f15982e8388
0x00007f15980d272e 74 1a jz $0x00007f15980d274a
0x00007f15980d274a 4d 01 e1 add %r12, %r9
```

Once fixed, I want to add an example of a handler to drcachesim.dox.in for the view tool:
once we can get one that actually resumes at the subsequent instr from the
interruption!

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.