DynamoRIO / DynamoRIO/dynamorio

D-filtered offline traces assign memrefs to the wrong instrs

Open
#8,109 0 comments 0 reactions 1 assignee Claimed by @derekbruening View on GitHub
Component-DrMemtrace
Dominant language
C
Stars
3.2k
Forks
629
Avg merge
2d 15h
Merged PRs (30d)
31

Description

D-filtered offline traces assign memrefs to the wrong instrs

While adding a test for i#4913 I was puzzling over why dfiltered traces
don't have to pass a PC entry per memref: memref_needs_full_info is only on
for ifiltered.

How does raw2trace it know which memref goes w/ which instr for D-filtered?

Looks like it's buggy: it blindly gives the memrefs to the first instrs:
```
$ ctest -V -R tool.drcacheoff.filter-d
$ rm -rf suite/tests/tool.drcacheoff.filter-d.simple_app.379533.8630.dir/trace; clients/bin64/drraw2trace -indir suite/tests/tool.drcacheoff.filter-d.simple_app.379533.8630.dir/raw -verbose 4 > OUT 2>&1
$ less OUT

[drmemtrace]: Created new block summary 0x7d81b8001600 for 0x7d8400a9e1d0 modidx=13 modoffs=201d0
0x000077678b1cd1d4 55 push %rbp %rsp -> %rsp 0xfffffff8(%rsp)[8byte]
[drmemtrace]: Appended memref type write (1) size 8 to 0x7fff00d38938
0x000077678b1cd1d5 48 8d 0d 24 fe fd ff lea 0x000077678b1ad000 -> %rcx
0x000077678b1cd1dc 48 8d 05 f5 90 01 00 lea 0x000077678b1e62d8 -> %rax
0x000077678b1cd1e3 66 48 0f 6e c9 movd %rcx -> %xmm1
0x000077678b1cd1e8 66 48 0f 6e d0 movd %rax -> %xmm2
0x000077678b1cd1ed 66 0f 6c ca punpcklqdq %xmm2 %xmm1 -> %xmm1
0x000077678b1cd1f1 48 89 e5 mov %rsp -> %rbp
0x000077678b1cd1f4 41 57 push %r15 %rsp -> %rsp 0xfffffff8(%rsp)[8byte]
[drmemtrace]: Appended memref type write (1) size 8 to 0x7fff00d388d8
0x000077678b1cd1f6 41 56 push %r14 %rsp -> %rsp 0xfffffff8(%rsp)[8byte]
[drmemtrace]: Appended memref type write (1) size 8 to 0x77678b1e5e06
0x000077678b1cd1f8 41 55 push %r13 %rsp -> %rsp 0xfffffff8(%rsp)[8byte]
[drmemtrace]: Appended memref type write (1) size 8 to 0x77678b1e5ab0
0x000077678b1cd1fa 41 54 push %r12 %rsp -> %rsp 0xfffffff8(%rsp)[8byte]
[drmemtrace]: Appended memref type write (1) size 8 to 0x77678b1e4a60
0x000077678b1cd1fc 53 push %rbx %rsp -> %rsp 0xfffffff8(%rsp)[8byte]
[drmemtrace]: Appended memref type write (1) size 8 to 0x77678b1e4e58
0x000077678b1cd1fd 48 81 ec 88 00 00 00 sub $0x0000000000000088 %rsp -> %rsp
0x000077678b1cd204 48 89 bd 78 ff ff ff mov %rdi -> 0xffffff78(%rbp)[8byte]
[drmemtrace]: Appended memref type write (1) size 8 to 0x77678b1e5ac0
0x000077678b1cd20b 0f 29 4d 80 movaps %xmm1 -> 0xffffff80(%rbp)[16byte]
[drmemtrace]: Missing memref from predication, 0-iter repstr, filter, or reached end of memrefs output by scatter/gather seq (next type is 0xa004001a00020277)
0x000077678b1cd20f 0f 31 rdtsc -> %edx %eax
0x000077678b1cd211 80 25 ee 8b 01 00 df and $0xdf 0x000077678b1e5e06[1byte] -> 0x000077678b1e5e06[1byte]
[drmemtrace]: Missing memref from predication, 0-iter repstr, filter, or reached end of memrefs output by scatter/gather seq (next type is 0xa004001a00020277)
[drmemtrace]: Missing memref from predication, 0-iter repstr, filter, or reached end of memrefs output by scatter/gather seq (next type is 0xa004001a00020277)
0x000077678b1cd218 48 8d 35 d1 88 01 00 lea 0x000077678b1e5af0 -> %rsi
0x000077678b1cd21f 41 b8 ff ff ff 6f mov $0x6fffffff -> %r8d
0x000077678b1cd225 41 b9 29 00 00 70 mov $0x70000029 -> %r9d
0x000077678b1cd22b 48 c1 e2 20 shl $0x0000000000000020 %rdx -> %rdx
0x000077678b1cd22f 48 89 0d 7a 88 01 00 mov %rcx -> 0x000077678b1e5ab0[8byte]
[drmemtrace]: Missing memref from predication, 0-iter repstr, filter, or reached end of memrefs output by scatter/gather seq (next type is 0xa004001a00020277)
0x000077678b1cd236 49 89 ce mov %rcx -> %r14
0x000077678b1cd239 48 09 d0 or %rdx %rax -> %rax
0x000077678b1cd23c 48 8d 15 15 7c 01 00 lea 0x000077678b1e4e58 -> %rdx
0x000077678b1cd243 48 89 05 16 78 01 00 mov %rax -> 0x000077678b1e4a60[8byte]
[drmemtrace]: Missing memref from predication, 0-iter repstr, filter, or reached end of memrefs output by scatter/gather seq (next type is 0xa004001a00020277)
```

Clearly the two rip-rels should have the addresses incorrectly assigned to
the pushes above: 0x000077678b1e5e06 and 0x000077678b1e5ab0.
And the pushes should all have similar addresses, yet they do not.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.