mcontext layout not preserved for regular clean call

_From [rnk@google.com](https://code.google.com/u/rnk@google.com/) on August 21, 2012 13:15:57_

B.R. has problems with getting an mcontext from a clean call. I think the only way to generate the code he sent to the list is to:
1. do a regular clean call, no optimizations.
2. preserve_xmm_caller_saved() must return false.

I think the bug is in 1, but I haven't reprod it yet (my Windows machine is not set up yet). cci->preserve_mcontext is memset to 0 and never set to true, unless the user passes DR_CLEANCALL_NOSAVE_*. Our standard approach so far has been to default to conservative, and let each analysis set flags to indicate that an optimization is safe.

In insert_push_all_registers we have:
if (cci->preserve_mcontext || cci->num_xmms_skip != NUM_XMM_REGS) {
int offs = XMM_SLOTS_SIZE + PRE_XMM_PADDING;
if (cci->preserve_mcontext && cci->skip_save_aflags) {
offs_beyond_xmm = 2_XSP_SZ; /_ pc and flags _/
offs += offs_beyond_xmm;
}
PRE(ilist, instr, INSTR_CREATE_lea
(dcontext, opnd_create_reg(REG_XSP),
OPND_CREATE_MEM_lea(REG_XSP, REG_NULL, 0, -offs)));
dstack_offs += offs;
}
if (preserve_xmm_caller_saved()) {
/_ xmm saves */

So the lea never happens.

2 is interesting, but probably not a bug. Maybe he has an old machine. Or maybe there's something wrong with the way he built DR so that proc_init() failed to initialize the SSE feature flags.

Here is the annotated assembly of the

TAG 0x010011d7
+0 m4 @0x250412e4 67 64 89 1e ec 0e mov %ebx -> %fs:0x00000eec # spill
+6 m4 @0x250412a4 67 64 89 0e e8 0e mov %ecx -> %fs:0x00000ee8 # spill
+12 m4 @0x25041370 8d 5c 24 fc lea 0xfffffffc(%esp) -> %ebx # drutil_get_mem_addr

# switch stacks
+16 m4 @0x25041ab0 67 64 a3 e4 0e mov %eax -> %fs:0x00000ee4
+21 m4 @0x250438cc 67 64 a1 f4 0e mov %fs:0x00000ef4 -> %eax
# spill esp
+26 m4 @0x25042774 89 60 0c mov %esp -> 0x0c(%eax)
# swap peb using xsp as scratch
+29 m4 @0x250419a4 bc 24 10 fb 24 mov $0x24fb1024 -> %esp
+34 m4 @0x250417dc 67 64 89 26 30 00 mov %esp -> %fs:0x30
+40 m4 @0x250419e4 67 64 8b 26 34 00 mov %fs:0x34 -> %esp
+46 m4 @0x250413fc 89 a0 70 01 00 00 mov %esp -> 0x00000170(%eax)
+52 m4 @0x2504157c 67 64 8b 26 b4 0f mov %fs:0x00000fb4 -> %esp
+58 m4 @0x25041710 89 a0 74 01 00 00 mov %esp -> 0x00000174(%eax)
+64 m4 @0x2504102c 8b a0 78 01 00 00 mov 0x00000178(%eax) -> %esp
+70 m4 @0x250415c8 67 64 89 26 b4 0f mov %esp -> %fs:0x00000fb4
+76 m4 @0x250416d0 67 64 8b 26 1c 0f mov %fs:0x00000f1c -> %esp
+82 m4 @0x2504185c 89 a0 7c 01 00 00 mov %esp -> 0x0000017c(%eax)
+88 m4 @0x2504106c 8b a0 80 01 00 00 mov 0x00000180(%eax) -> %esp
+94 m4 @0x25041614 67 64 89 26 1c 0f mov %esp -> %fs:0x00000f1c
# switch to dstack
+100 m4 @0x250413bc 8b a0 60 01 00 00 mov 0x00000160(%eax) -> %esp
# restore eax
+106 m4 @0x25041190 67 64 a1 e4 0e mov %fs:0x00000ee4 -> %eax

# push mcontext
# BUG: no lea adjust for xmm space!
+111 m4 @0x25041228 68 00 00 00 00 push $0x00000000 %esp -> %esp 0xfffffffc(%esp)
+116 m4 @0x250428bc 9c pushf %esp -> %esp 0xfffffffc(%esp)
+117 m4 @0x25041a64 60 pusha %esp %eax %ebx %ecx %edx %ebp %esi %edi -> %esp 0xffffffe0(%esp)
+118 m4 @0x25041c64
+118 m4 @0x25041af0 68 00 00 00 00 push $0x00000000 %esp -> %esp 0xfffffffc(%esp)
+123 m4 @0x25041a24 68 14 00 00 00 push $0x00000014 %esp -> %esp 0xfffffffc(%esp)
+128 m4 @0x25041918 68 00 00 00 00 push $0x00000000 %esp -> %esp 0xfffffffc(%esp)
+133 m4 @0x25041494 68 a0 8b fd 24 push $0x24fd8ba0 %esp -> %esp 0xfffffffc(%esp)
+138 m4 @0x25041144 68 01 00 00 00 push $0x00000001 %esp -> %esp 0xfffffffc(%esp)
+143 m4 @0x25042800 e8 ff 4e fc ea call $0x10003660 %esp -> %esp 0xfffffffc(%esp)
+148 m4 @0x250410ac 8d 64 24 14 lea 0x14(%esp) -> %esp
+152 m4 @0x25041750 61 popa %esp (%esp) -> %esp %eax %ebx %ecx %edx %ebp %esi %edi
+153 m4 @0x250411dc 9d popf %esp (%esp) -> %esp
# lea adjust to pop xmm regs is here, but doesn't matter since we overwrite esp soon
+154 m4 @0x2504181c 8d a4 24 1c 01 00 00 lea 0x0000011c(%esp) -> %esp

# peb swap
+161 m4 @0x25041684 67 64 a3 e4 0e mov %eax -> %fs:0x00000ee4
+166 m4 @0x25041790 67 64 a1 f4 0e mov %fs:0x00000ef4 -> %eax
+171 m4 @0x25041448 bc 00 50 fd 7f mov $0x7ffd5000 -> %esp
+176 m4 @0x25041530 67 64 89 26 30 00 mov %esp -> %fs:0x30
+182 m4 @0x250429bc 8b a0 70 01 00 00 mov 0x00000170(%eax) -> %esp
+188 m4 @0x2504377c 67 64 89 26 34 00 mov %esp -> %fs:0x34
+194 m4 @0x25041958 67 64 8b 26 b4 0f mov %fs:0x00000fb4 -> %esp
+200 m4 @0x250427b4 89 a0 78 01 00 00 mov %esp -> 0x00000178(%eax)
+206 m4 @0x250428fc 8b a0 74 01 00 00 mov 0x00000174(%eax) -> %esp
+212 m4 @0x250418c0 67 64 89 26 b4 0f mov %esp -> %fs:0x00000fb4
+218 m4 @0x2504297c 67 64 8b 26 1c 0f mov %fs:0x00000f1c -> %esp
+224 m4 @0x25042a3c 89 a0 80 01 00 00 mov %esp -> 0x00000180(%eax)
+230 m4 @0x25042a7c 8b a0 7c 01 00 00 mov 0x0000017c(%eax) -> %esp
+236 m4 @0x250436a4 67 64 89 26 1c 0f mov %esp -> %fs:0x00000f1c
+242 m4 @0x25042abc 8b 60 0c mov 0x0c(%eax) -> %esp
+245 m4 @0x25042afc 67 64 a1 e4 0e mov %fs:0x00000ee4 -> %eax
# app instr
+250 L3 6a 28 push $0x00000028 %esp -> %esp 0xfffffffc(%esp)

_Original issue: http://code.google.com/p/dynamorio/issues/detail?id=874_