DynamoRIO / DynamoRIO/dynamorio

Support drmemtraces derived from hardware execution view

Open
#7,854 1 comment 0 reactions 0 assignees View on GitHub
Component-DrMemtrace Type-Feature
Dominant language
C
Stars
3.2k
Forks
629
Avg merge
2d 15h
Merged PRs (30d)
31

Description

Certain tracing techniques output the hardware execution view, e.g., Intel-PT, ETM, and QEMU-TCG. Such hardware execution view is different than the regular drmemtraces in various ways:
- it is core-sharded naturally, so each trace corresponds to one hardware vcpu, unlike the regular drmemtraces which are thread-sharded.
- it may have kernel execution included by default, so some markers like kernel_xfer (that denotes a control altering syscall) make less sense since we'll have the full syscall trace too.
- it may not have the same events that we generally support in drmemtraces, like kernel_event and kernel_xfer for user signal handlers, or the various function markers.

To allow conversion to the drmemtrace format, we need to add some new notions. Particularly:
- a new offline_type_t to denote such hardware vcpu centric traces
- a new pair of markers similar to kernel_event and kernel_xfer, to denote similar events on the vcpu, such as hardware interrupts (some of these may lead to a user signal handler invoked eventually) and hardware context return (which may change exception/ring level; such as eret and iret).
- adaptations to the invariant checker to relax existing checks and perform some additional ones
- may be more...

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.