DynamoRIO / DynamoRIO/dynamorio
drcachesim online traces are missing instructions after sigreturns
- Dominant language
- C
- Stars
- 3.2k
- Forks
- 629
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 31
Description
In PR #3936 I added markers to the trace view tool. While testing them on
an app with signals I noticed some irregularities.
-test_mode's trace_invariants is not checking these things: we should add
such checks there.
I'm targeting a single thread file below using something of a hack where I
point at a thread shard file and the module file (because official usage
does not support this and doesn't know where to find the module file). I
plan to add better support for that separately.
Problem A: "ret" should be *before" the marker:
```
$ bin64/drrun -t drcachesim -simulator_type view -infile drmemtrace.threadsig.67978.9154.dir/trace/drmemtrace.threadsig.67980.1273.trace.gz -module_file drmemtrace.threadsig.67978.9154.dir/raw/modules.log -test_mode 2>&1 | less
0x00007f15978dd5bb 48 85 c0 test %rax, %rax
0x00007f15978dd5be 74 01 jz $0x00007f15978dd5c1
0x00007f15978dd5c0 c3 ret
0x00007f1594e47dba 55 push %rbp
0x00007f1594e47dbb 48 89 e5 mov %rsp, %rbp
0x00007f1594e47dbe 89 7d fc mov %edi, -0x04(%rbp)
0x00007f1594e47dc1 48 89 75 f0 mov %rsi, -0x10(%rbp)
0x00007f1594e47dc5 48 89 55 e8 mov %rdx, -0x18(%rbp)
0x00007f1594e47dc9 83 7d fc 1a cmp -0x04(%rbp), $0x1a
0x00007f1594e47dcd 75 0f jnz $0x00007f1594e47dde
0x00007f1594e47dcf 8b 05 7f 23 20 00 mov 0x00007f159504a154, %eax
0x00007f1594e47dd5 83 c0 01 add $0x01, %eax
0x00007f1594e47dd8 89 05 76 23 20 00 mov %eax, 0x00007f159504a154
0x00007f1594e47dde 90 nop
0x00007f1594e47ddf 5d pop %rbp
0x00007f1594e47de0 c3 ret
0x00007f15980dc3a0 48 c7 c0 0f 00 00 00 mov $0x0000000f, %rax
0x00007f15980dc3a7 0f 05 syscall
0x00007f15980d1cd0 49 8b 9e 90 06 00 00 mov 0x00000690(%r14), %rbx
```
(trace_invariants only checks the prior marker, not that it was
*immediately* prior.)
Problem B: sigreturn skips an instruction!
```
$ bin64/drrun -t drcachesim -simulator_type view -infile drmemtrace.threadsig.67978.9154.dir/trace/drmemtrace.threadsig.67978.3662.trace.gz -module_file drmemtrace.threadsig.67978.9154.dir/raw/modules.log -test_mode 2>&1 | less
0x00007f15980d2720 44 89 95 40 ff ff ff mov %r10d, -0xc0(%rbp)
0x00007f15980d2727 f0 ff 0d 5a 5c 21 00 lock decl 0x00007f15982e8388
0x00007f1594e47dba 55 push %rbp
0x00007f1594e47dbb 48 89 e5 mov %rsp, %rbp
0x00007f1594e47dbe 89 7d fc mov %edi, -0x04(%rbp)
0x00007f1594e47dc1 48 89 75 f0 mov %rsi, -0x10(%rbp)
0x00007f1594e47dc5 48 89 55 e8 mov %rdx, -0x18(%rbp)
0x00007f1594e47dc9 83 7d fc 1a cmp -0x04(%rbp), $0x1a
0x00007f1594e47dcd 75 0f jnz $0x00007f1594e47dde
0x00007f1594e47dcf 8b 05 7f 23 20 00 mov 0x00007f159504a154, %eax
0x00007f1594e47dd5 83 c0 01 add $0x01, %eax
0x00007f1594e47dd8 89 05 76 23 20 00 mov %eax, 0x00007f159504a154
0x00007f1594e47dde 90 nop
0x00007f1594e47ddf 5d pop %rbp
0x00007f1594e47de0 c3 ret
0x00007f15980dc3a0 48 c7 c0 0f 00 00 00 mov $0x0000000f, %rax
0x00007f15980dc3a7 0f 05 syscall
0x00007f15980d274a 4d 01 e1 add %r12, %r9
0x00007f15980d274d 66 45 85 e4 data16 test %r12w, %r12w
```
From a later sequence we see that it's missing a single instr:
```
0x00007f15980d2727 f0 ff 0d 5a 5c 21 00 lock decl 0x00007f15982e8388
0x00007f15980d272e 74 1a jz $0x00007f15980d274a
0x00007f15980d274a 4d 01 e1 add %r12, %r9
```
Once fixed, I want to add an example of a handler to drcachesim.dox.in for the view tool:
once we can get one that actually resumes at the subsequent instr from the
interruption!
Contributor guide
Assessment
This issue has not been assessed yet.