DynamoRIO / DynamoRIO/dynamorio
D-filtered offline traces assign memrefs to the wrong instrs
- Dominant language
- C
- Stars
- 3.2k
- Forks
- 629
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 31
Description
D-filtered offline traces assign memrefs to the wrong instrs
While adding a test for i#4913 I was puzzling over why dfiltered traces
don't have to pass a PC entry per memref: memref_needs_full_info is only on
for ifiltered.
How does raw2trace it know which memref goes w/ which instr for D-filtered?
Looks like it's buggy: it blindly gives the memrefs to the first instrs:
```
$ ctest -V -R tool.drcacheoff.filter-d
$ rm -rf suite/tests/tool.drcacheoff.filter-d.simple_app.379533.8630.dir/trace; clients/bin64/drraw2trace -indir suite/tests/tool.drcacheoff.filter-d.simple_app.379533.8630.dir/raw -verbose 4 > OUT 2>&1
$ less OUT
[drmemtrace]: Created new block summary 0x7d81b8001600 for 0x7d8400a9e1d0 modidx=13 modoffs=201d0
0x000077678b1cd1d4 55 push %rbp %rsp -> %rsp 0xfffffff8(%rsp)[8byte]
[drmemtrace]: Appended memref type write (1) size 8 to 0x7fff00d38938
0x000077678b1cd1d5 48 8d 0d 24 fe fd ff lea 0x000077678b1ad000 -> %rcx
0x000077678b1cd1dc 48 8d 05 f5 90 01 00 lea 0x000077678b1e62d8 -> %rax
0x000077678b1cd1e3 66 48 0f 6e c9 movd %rcx -> %xmm1
0x000077678b1cd1e8 66 48 0f 6e d0 movd %rax -> %xmm2
0x000077678b1cd1ed 66 0f 6c ca punpcklqdq %xmm2 %xmm1 -> %xmm1
0x000077678b1cd1f1 48 89 e5 mov %rsp -> %rbp
0x000077678b1cd1f4 41 57 push %r15 %rsp -> %rsp 0xfffffff8(%rsp)[8byte]
[drmemtrace]: Appended memref type write (1) size 8 to 0x7fff00d388d8
0x000077678b1cd1f6 41 56 push %r14 %rsp -> %rsp 0xfffffff8(%rsp)[8byte]
[drmemtrace]: Appended memref type write (1) size 8 to 0x77678b1e5e06
0x000077678b1cd1f8 41 55 push %r13 %rsp -> %rsp 0xfffffff8(%rsp)[8byte]
[drmemtrace]: Appended memref type write (1) size 8 to 0x77678b1e5ab0
0x000077678b1cd1fa 41 54 push %r12 %rsp -> %rsp 0xfffffff8(%rsp)[8byte]
[drmemtrace]: Appended memref type write (1) size 8 to 0x77678b1e4a60
0x000077678b1cd1fc 53 push %rbx %rsp -> %rsp 0xfffffff8(%rsp)[8byte]
[drmemtrace]: Appended memref type write (1) size 8 to 0x77678b1e4e58
0x000077678b1cd1fd 48 81 ec 88 00 00 00 sub $0x0000000000000088 %rsp -> %rsp
0x000077678b1cd204 48 89 bd 78 ff ff ff mov %rdi -> 0xffffff78(%rbp)[8byte]
[drmemtrace]: Appended memref type write (1) size 8 to 0x77678b1e5ac0
0x000077678b1cd20b 0f 29 4d 80 movaps %xmm1 -> 0xffffff80(%rbp)[16byte]
[drmemtrace]: Missing memref from predication, 0-iter repstr, filter, or reached end of memrefs output by scatter/gather seq (next type is 0xa004001a00020277)
0x000077678b1cd20f 0f 31 rdtsc -> %edx %eax
0x000077678b1cd211 80 25 ee 8b 01 00 df and $0xdf 0x000077678b1e5e06[1byte] -> 0x000077678b1e5e06[1byte]
[drmemtrace]: Missing memref from predication, 0-iter repstr, filter, or reached end of memrefs output by scatter/gather seq (next type is 0xa004001a00020277)
[drmemtrace]: Missing memref from predication, 0-iter repstr, filter, or reached end of memrefs output by scatter/gather seq (next type is 0xa004001a00020277)
0x000077678b1cd218 48 8d 35 d1 88 01 00 lea 0x000077678b1e5af0 -> %rsi
0x000077678b1cd21f 41 b8 ff ff ff 6f mov $0x6fffffff -> %r8d
0x000077678b1cd225 41 b9 29 00 00 70 mov $0x70000029 -> %r9d
0x000077678b1cd22b 48 c1 e2 20 shl $0x0000000000000020 %rdx -> %rdx
0x000077678b1cd22f 48 89 0d 7a 88 01 00 mov %rcx -> 0x000077678b1e5ab0[8byte]
[drmemtrace]: Missing memref from predication, 0-iter repstr, filter, or reached end of memrefs output by scatter/gather seq (next type is 0xa004001a00020277)
0x000077678b1cd236 49 89 ce mov %rcx -> %r14
0x000077678b1cd239 48 09 d0 or %rdx %rax -> %rax
0x000077678b1cd23c 48 8d 15 15 7c 01 00 lea 0x000077678b1e4e58 -> %rdx
0x000077678b1cd243 48 89 05 16 78 01 00 mov %rax -> 0x000077678b1e4a60[8byte]
[drmemtrace]: Missing memref from predication, 0-iter repstr, filter, or reached end of memrefs output by scatter/gather seq (next type is 0xa004001a00020277)
```
Clearly the two rip-rels should have the addresses incorrectly assigned to
the pushes above: 0x000077678b1e5e06 and 0x000077678b1e5ab0.
And the pushes should all have similar addresses, yet they do not.
Contributor guide
Assessment
This issue has not been assessed yet.