179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov//===-- msandr.cc ---------------------------------------------------------===// 279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov// 379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov// The LLVM Compiler Infrastructure 479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov// 579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov// This file is distributed under the University of Illinois Open Source 679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov// License. See LICENSE.TXT for details. 779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov// 879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov//===----------------------------------------------------------------------===// 979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov// 1079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov// This file is a part of MemorySanitizer. 1179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov// 1279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov// DynamoRio client for MemorySanitizer. 1379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov// 1479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov// MemorySanitizer requires that all program code is instrumented. Any memory 1579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov// store that can turn an uninitialized value into an initialized value must be 1679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov// observed by the tool, otherwise we risk reporting a false UMR. 1779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov// 1879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov// This also includes any libraries that the program depends on. 1979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov// 2079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov// In the case when rebuilding all program dependencies with MemorySanitizer is 2179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov// problematic, an experimental MSanDR tool (the code you are currently looking 2279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov// at) can be used. It is a DynamoRio-based tool that uses dynamic 2379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov// instrumentation to 2479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov// * Unpoison all memory stores. 2579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov// * Unpoison TLS slots used by MemorySanitizer to pass function arguments and 2679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov// return value shadow on anything that looks like a function call or a return 2779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov// from a function. 2879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov// 2979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov// This tool does not detect the use of uninitialized values in uninstrumented 3079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov// libraries. It merely gets rid of false positives by marking all data that 3179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov// passes through uninstrumented code as fully initialized. 3279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov//===----------------------------------------------------------------------===// 3379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 3479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov#include <dr_api.h> 3579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov#include <drutil.h> 3679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov#include <drmgr.h> 3779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov#include <drsyscall.h> 3879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 3979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov#include <sys/mman.h> 400f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner#include <sys/syscall.h> /* for SYS_mmap */ 4179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 4279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov#include <algorithm> 4379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov#include <string> 4479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov#include <set> 4579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov#include <vector> 4679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov#include <string.h> 4779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 4879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov#define TESTALL(mask, var) (((mask) & (var)) == (mask)) 4979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov#define TESTANY(mask, var) (((mask) & (var)) != 0) 5079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 5179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov#define CHECK_IMPL(condition, file, line) \ 5279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov do { \ 5379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov if (!(condition)) { \ 5479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov dr_printf("Check failed: `%s`\nat %s:%d\n", #condition, file, line); \ 5579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov dr_abort(); \ 5679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov } \ 5779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov } while (0) // TODO: stacktrace 5879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 5979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov#define CHECK(condition) CHECK_IMPL(condition, __FILE__, __LINE__) 6079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 6179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov#define VERBOSITY 0 6279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 6379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanovnamespace { 6479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 6579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanovclass ModuleData { 6679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanovpublic: 6779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov ModuleData(); 6879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov ModuleData(const module_data_t *info); 6979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // Yes, we want default copy, assign, and dtor semantics. 7079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 7179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanovpublic: 7279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov app_pc start_; 7379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov app_pc end_; 7479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // Full path to the module. 752ecccf8aca0f3f67d43e6395699aab0bb19ee277Evgeniy Stepanov std::string path_; 7679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov module_handle_t handle_; 7779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov bool should_instrument_; 7879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov bool executed_; 7979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov}; 8079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 812ecccf8aca0f3f67d43e6395699aab0bb19ee277Evgeniy Stepanovstd::string g_app_path; 8279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 8379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanovint msan_retval_tls_offset; 8479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanovint msan_param_tls_offset; 8579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 8679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov// A vector of loaded modules sorted by module bounds. We lookup the current PC 8779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov// in here from the bb event. This is better than an rb tree because the lookup 8879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov// is faster and the bb event occurs far more than the module load event. 8979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanovstd::vector<ModuleData> g_module_list; 9079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 9179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy StepanovModuleData::ModuleData() 9279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov : start_(NULL), end_(NULL), path_(""), handle_(NULL), 9379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov should_instrument_(false), executed_(false) { 9479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov} 9579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 9679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy StepanovModuleData::ModuleData(const module_data_t *info) 9779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov : start_(info->start), end_(info->end), path_(info->full_path), 9879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov handle_(info->handle), 9979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // We'll check the black/white lists later and adjust this. 10079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov should_instrument_(true), executed_(false) { 10179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov} 10279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 10379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanovint(*__msan_get_retval_tls_offset)(); 10479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanovint(*__msan_get_param_tls_offset)(); 1050f92deb81207c80481ff0257fbaba640fe669633Reid Klecknervoid (*__msan_unpoison)(void *base, size_t size); 1060f92deb81207c80481ff0257fbaba640fe669633Reid Klecknerbool (*__msan_is_in_loader)(); 1070f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner 1080f92deb81207c80481ff0257fbaba640fe669633Reid Klecknerstatic generic_func_t LookupCallback(module_data_t *app, const char *name) { 1090f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner generic_func_t callback = dr_get_proc_address(app->handle, name); 1100f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner if (callback == NULL) { 1110f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner dr_printf("Couldn't find `%s` in %s\n", name, app->full_path); 1120f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner CHECK(callback); 1130f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner } 1140f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner return callback; 1150f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner} 11679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 11779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanovvoid InitializeMSanCallbacks() { 11879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov module_data_t *app = dr_lookup_module_by_name(dr_get_application_name()); 11979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov if (!app) { 12079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov dr_printf("%s - oops, dr_lookup_module_by_name failed!\n", 12179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov dr_get_application_name()); 12279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov CHECK(app); 12379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov } 12479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov g_app_path = app->full_path; 12579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 1260f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner __msan_get_retval_tls_offset = (int (*)()) 1270f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner LookupCallback(app, "__msan_get_retval_tls_offset"); 1280f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner __msan_get_param_tls_offset = (int (*)()) 1290f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner LookupCallback(app, "__msan_get_param_tls_offset"); 1300f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner __msan_unpoison = (void(*)(void *, size_t)) 1310f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner LookupCallback(app, "__msan_unpoison"); 1320f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner __msan_is_in_loader = (bool (*)()) 1330f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner LookupCallback(app, "__msan_is_in_loader"); 13479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 1350f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner dr_free_module_data(app); 13679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov} 13779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 13879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov// FIXME: Handle absolute addresses and PC-relative addresses. 13979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov// FIXME: Handle TLS accesses via FS or GS. DR assumes all other segments have 14079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov// a zero base anyway. 14179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanovbool OperandIsInteresting(opnd_t opnd) { 14279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov return (opnd_is_base_disp(opnd) && opnd_get_segment(opnd) != DR_SEG_FS && 14379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov opnd_get_segment(opnd) != DR_SEG_GS); 14479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov} 14579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 14679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanovbool WantToInstrument(instr_t *instr) { 14779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // TODO: skip push instructions? 14879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov switch (instr_get_opcode(instr)) { 14979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // FIXME: support the instructions excluded below: 15079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov case OP_rep_cmps: 15179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // f3 a6 rep cmps %ds:(%rsi) %es:(%rdi) %rsi %rdi %rcx -> %rsi %rdi %rcx 15279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov return false; 15379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov } 15479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 15579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // Labels appear due to drutil_expand_rep_string() 15679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov if (instr_is_label(instr)) 15779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov return false; 15879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 15979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov CHECK(instr_ok_to_mangle(instr) == true); 16079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 16179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov if (instr_writes_memory(instr)) { 16279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov for (int d = 0; d < instr_num_dsts(instr); d++) { 16379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov opnd_t op = instr_get_dst(instr, d); 16479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov if (OperandIsInteresting(op)) 16579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov return true; 16679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov } 16779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov } 16879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 16979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov return false; 17079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov} 17179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 17279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov#define PRE(at, what) instrlist_meta_preinsert(bb, at, INSTR_CREATE_##what); 17379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov#define PREF(at, what) instrlist_meta_preinsert(bb, at, what); 17479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 17579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanovvoid InstrumentMops(void *drcontext, instrlist_t *bb, instr_t *instr, opnd_t op, 17679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov bool is_write) { 17779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov bool need_to_restore_eflags = false; 17879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov uint flags = instr_get_arith_flags(instr); 17979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // TODO: do something smarter with flags and spills in general? 18079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // For example, spill them only once for a sequence of instrumented 18179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // instructions that don't change/read flags. 18279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 18379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov if (!TESTALL(EFLAGS_WRITE_6, flags) || TESTANY(EFLAGS_READ_6, flags)) { 18479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov if (VERBOSITY > 1) 18579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov dr_printf("Spilling eflags...\n"); 18679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov need_to_restore_eflags = true; 18779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // TODO: Maybe sometimes don't need to 'seto'. 18879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // TODO: Maybe sometimes don't want to spill XAX here? 18979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // TODO: No need to spill XAX here if XAX is not used in the BB. 19079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov dr_save_reg(drcontext, bb, instr, DR_REG_XAX, SPILL_SLOT_1); 19179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov dr_save_arith_flags_to_xax(drcontext, bb, instr); 19279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov dr_save_reg(drcontext, bb, instr, DR_REG_XAX, SPILL_SLOT_3); 19379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov dr_restore_reg(drcontext, bb, instr, DR_REG_XAX, SPILL_SLOT_1); 19479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov } 19579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 19679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov#if 0 19779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov dr_printf("==DRMSAN== DEBUG: %d %d %d %d %d %d\n", 19879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov opnd_is_memory_reference(op), opnd_is_base_disp(op), 19979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov opnd_is_base_disp(op) ? opnd_get_index(op) : -1, 20079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov opnd_is_far_memory_reference(op), opnd_is_reg_pointer_sized(op), 20179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov opnd_is_base_disp(op) ? opnd_get_disp(op) : -1); 20279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov#endif 20379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 20479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov reg_id_t R1; 20579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov bool address_in_R1 = false; 20679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov if (opnd_is_base_disp(op) && opnd_get_index(op) == DR_REG_NULL && 20779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov opnd_get_disp(op) == 0) { 20879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // If this is a simple access with no offset or index, we can just use the 20979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // base for R1. 21079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov address_in_R1 = true; 21179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov R1 = opnd_get_base(op); 21279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov } else { 21379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // Otherwise, we need to compute the addr into R1. 21479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // TODO: reuse some spare register? e.g. r15 on x64 21579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // TODO: might be used as a non-mem-ref register? 21679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov R1 = DR_REG_XAX; 21779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov } 21879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov CHECK(reg_is_pointer_sized(R1)); // otherwise R2 may be wrong. 21979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 22079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // Pick R2 that's not R1 or used by the operand. It's OK if the instr uses 22179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // R2 elsewhere, since we'll restore it before instr. 22279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov reg_id_t GPR_TO_USE_FOR_R2[] = { 22379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov DR_REG_XAX, DR_REG_XBX, DR_REG_XCX, DR_REG_XDX 22479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // Don't forget to update the +4 below if you add anything else! 22579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov }; 22679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov std::set<reg_id_t> unused_registers(GPR_TO_USE_FOR_R2, GPR_TO_USE_FOR_R2 + 4); 22779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov unused_registers.erase(R1); 22879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov for (int j = 0; j < opnd_num_regs_used(op); j++) { 22979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov unused_registers.erase(opnd_get_reg_used(op, j)); 23079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov } 23179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 23279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov CHECK(unused_registers.size() > 0); 23379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov reg_id_t R2 = *unused_registers.begin(); 23479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov CHECK(R1 != R2); 23579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 23679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // Save the current values of R1 and R2. 23779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov dr_save_reg(drcontext, bb, instr, R1, SPILL_SLOT_1); 23879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // TODO: Something smarter than spilling a "fixed" register R2? 23979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov dr_save_reg(drcontext, bb, instr, R2, SPILL_SLOT_2); 24079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 24179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov if (!address_in_R1) 24279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov CHECK(drutil_insert_get_mem_addr(drcontext, bb, instr, op, R1, R2)); 24379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov PRE(instr, mov_imm(drcontext, opnd_create_reg(R2), 24479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov OPND_CREATE_INT64(0xffffbfffffffffff))); 24579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov PRE(instr, and(drcontext, opnd_create_reg(R1), opnd_create_reg(R2))); 24679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // There is no mov_st of a 64-bit immediate, so... 24779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov opnd_size_t op_size = opnd_get_size(op); 24879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov CHECK(op_size != OPSZ_NA); 24979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov uint access_size = opnd_size_in_bytes(op_size); 25079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov if (access_size <= 4) { 25179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov PRE(instr, 25279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov mov_st(drcontext, opnd_create_base_disp(R1, DR_REG_NULL, 0, 0, op_size), 25379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov opnd_create_immed_int((ptr_int_t) 0, op_size))); 25479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov } else { 25579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // FIXME: tail? 25679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov for (uint ofs = 0; ofs < access_size; ofs += 4) { 25779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov PRE(instr, 25879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov mov_st(drcontext, OPND_CREATE_MEM32(R1, ofs), OPND_CREATE_INT32(0))); 25979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov } 26079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov } 26179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 26279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // Restore the registers and flags. 26379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov dr_restore_reg(drcontext, bb, instr, R1, SPILL_SLOT_1); 26479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov dr_restore_reg(drcontext, bb, instr, R2, SPILL_SLOT_2); 26579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 26679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov if (need_to_restore_eflags) { 26779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov if (VERBOSITY > 1) 26879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov dr_printf("Restoring eflags\n"); 26979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // TODO: Check if it's reverse to the dr_restore_reg above and optimize. 27079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov dr_save_reg(drcontext, bb, instr, DR_REG_XAX, SPILL_SLOT_1); 27179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov dr_restore_reg(drcontext, bb, instr, DR_REG_XAX, SPILL_SLOT_3); 27279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov dr_restore_arith_flags_from_xax(drcontext, bb, instr); 27379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov dr_restore_reg(drcontext, bb, instr, DR_REG_XAX, SPILL_SLOT_1); 27479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov } 27579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 27679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // The original instruction is left untouched. The above instrumentation is just 27779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // a prefix. 27879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov} 27979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 28079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanovvoid InstrumentReturn(void *drcontext, instrlist_t *bb, instr_t *instr) { 28179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov dr_save_reg(drcontext, bb, instr, DR_REG_XAX, SPILL_SLOT_1); 28279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 28379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // Clobbers nothing except xax. 28479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov bool res = 28579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov dr_insert_get_seg_base(drcontext, bb, instr, DR_SEG_FS, DR_REG_XAX); 28679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov CHECK(res); 28779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 28879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // TODO: unpoison more bytes? 28979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov PRE(instr, 29079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov mov_st(drcontext, OPND_CREATE_MEM64(DR_REG_XAX, msan_retval_tls_offset), 29179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov OPND_CREATE_INT32(0))); 29279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 29379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov dr_restore_reg(drcontext, bb, instr, DR_REG_XAX, SPILL_SLOT_1); 29479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 29579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // The original instruction is left untouched. The above instrumentation is just 29679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // a prefix. 29779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov} 29879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 29979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanovvoid InstrumentIndirectBranch(void *drcontext, instrlist_t *bb, 30079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov instr_t *instr) { 30179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov dr_save_reg(drcontext, bb, instr, DR_REG_XAX, SPILL_SLOT_1); 30279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 30379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // Clobbers nothing except xax. 30479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov bool res = 30579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov dr_insert_get_seg_base(drcontext, bb, instr, DR_SEG_FS, DR_REG_XAX); 30679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov CHECK(res); 30779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 30879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // TODO: unpoison more bytes? 30979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov for (int i = 0; i < 6; ++i) { 31079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov PRE(instr, 31179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov mov_st(drcontext, OPND_CREATE_MEMPTR(DR_REG_XAX, msan_param_tls_offset + 31279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov i * sizeof(void *)), 31379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov OPND_CREATE_INT32(0))); 31479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov } 31579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 31679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov dr_restore_reg(drcontext, bb, instr, DR_REG_XAX, SPILL_SLOT_1); 31779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 31879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // The original instruction is left untouched. The above instrumentation is just 31979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // a prefix. 32079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov} 32179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 32279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov// For use with binary search. Modules shouldn't overlap, so we shouldn't have 32379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov// to look at end_. If that can happen, we won't support such an application. 32479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanovbool ModuleDataCompareStart(const ModuleData &left, const ModuleData &right) { 32579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov return left.start_ < right.start_; 32679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov} 32779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 32879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov// Look up the module containing PC. Should be relatively fast, as its called 32979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov// for each bb instrumentation. 33079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy StepanovModuleData *LookupModuleByPC(app_pc pc) { 33179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov ModuleData fake_mod_data; 33279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov fake_mod_data.start_ = pc; 33379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov std::vector<ModuleData>::iterator it = 33479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov lower_bound(g_module_list.begin(), g_module_list.end(), fake_mod_data, 33579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov ModuleDataCompareStart); 33679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // if (it == g_module_list.end()) 33779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // return NULL; 33879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov if (it == g_module_list.end() || pc < it->start_) 33979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov --it; 34079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov CHECK(it->start_ <= pc); 34179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov if (pc >= it->end_) { 34279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // We're past the end of this module. We shouldn't be in the next module, 34379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // or lower_bound lied to us. 34479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov ++it; 34579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov CHECK(it == g_module_list.end() || pc < it->start_); 34679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov return NULL; 34779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov } 34879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 34979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // OK, we found the module. 35079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov return &*it; 35179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov} 35279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 35379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanovbool ShouldInstrumentNonModuleCode() { return true; } 35479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 35579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanovbool ShouldInstrumentModule(ModuleData *mod_data) { 35679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // TODO(rnk): Flags for blacklist would get wired in here. 35779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov generic_func_t p = 35879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov dr_get_proc_address(mod_data->handle_, "__msan_track_origins"); 35979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov return !p; 36079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov} 36179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 36279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanovbool ShouldInstrumentPc(app_pc pc, ModuleData **pmod_data) { 36379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov ModuleData *mod_data = LookupModuleByPC(pc); 36479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov if (pmod_data) 36579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov *pmod_data = mod_data; 36679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov if (mod_data != NULL) { 36779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // This module is on a blacklist. 36879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov if (!mod_data->should_instrument_) { 36979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov return false; 37079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov } 37179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov } else if (!ShouldInstrumentNonModuleCode()) { 37279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov return false; 37379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov } 37479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov return true; 37579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov} 37679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 37779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov// TODO(rnk): Make sure we instrument after __msan_init. 37879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanovdr_emit_flags_t 37979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanovevent_basic_block_app2app(void *drcontext, void *tag, instrlist_t *bb, 38079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov bool for_trace, bool translating) { 38179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov app_pc pc = dr_fragment_app_pc(tag); 38279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 38379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov if (ShouldInstrumentPc(pc, NULL)) 38479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov CHECK(drutil_expand_rep_string(drcontext, bb)); 38579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 38679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov return DR_EMIT_PERSISTABLE; 38779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov} 38879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 38979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanovdr_emit_flags_t event_basic_block(void *drcontext, void *tag, instrlist_t *bb, 39079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov bool for_trace, bool translating) { 39179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov app_pc pc = dr_fragment_app_pc(tag); 39279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov ModuleData *mod_data; 39379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 39479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov if (!ShouldInstrumentPc(pc, &mod_data)) 39579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov return DR_EMIT_PERSISTABLE; 39679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 39779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov if (VERBOSITY > 1) 39879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov dr_printf("============================================================\n"); 39979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov if (VERBOSITY > 0) { 4002ecccf8aca0f3f67d43e6395699aab0bb19ee277Evgeniy Stepanov std::string mod_path = (mod_data ? mod_data->path_ : "<no module, JITed?>"); 40179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov if (mod_data && !mod_data->executed_) { 40279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov mod_data->executed_ = true; // Nevermind this race. 40379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov dr_printf("Executing from new module: %s\n", mod_path.c_str()); 40479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov } 40579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov dr_printf("BB to be instrumented: %p [from %s]; translating = %s\n", pc, 40679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov mod_path.c_str(), translating ? "true" : "false"); 40779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov if (mod_data) { 40879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // Match standard sanitizer trace format for free symbols. 40979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // #0 0x7f6e35cf2e45 (/blah/foo.so+0x11fe45) 41079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov dr_printf(" #0 %p (%s+%p)\n", pc, mod_data->path_.c_str(), 41179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov pc - mod_data->start_); 41279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov } 41379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov } 41479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov if (VERBOSITY > 1) { 41579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov instrlist_disassemble(drcontext, pc, bb, STDOUT); 41679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov instr_t *instr; 41779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov for (instr = instrlist_first(bb); instr; instr = instr_get_next(instr)) { 41879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov dr_printf("opcode: %d\n", instr_get_opcode(instr)); 41979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov } 42079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov } 42179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 42279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov for (instr_t *i = instrlist_first(bb); i != NULL; i = instr_get_next(i)) { 42379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov int opcode = instr_get_opcode(i); 42479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov if (opcode == OP_ret || opcode == OP_ret_far) { 42579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov InstrumentReturn(drcontext, bb, i); 42679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov continue; 42779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov } 42879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 42979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // These instructions hopefully cover all cases where control is transferred 43079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // to a function in a different module (we only care about calls into 43179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // compiler-instrumented modules). 43279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // * call_ind is used for normal indirect calls. 43379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // * jmp_ind is used for indirect tail calls, and calls through PLT (PLT 43479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // stub includes a jump to an address from GOT). 43579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov if (opcode == OP_call_ind || opcode == OP_call_far_ind || 43679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov opcode == OP_jmp_ind || opcode == OP_jmp_far_ind) { 43779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov InstrumentIndirectBranch(drcontext, bb, i); 43879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov continue; 43979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov } 44079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 44179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov if (!WantToInstrument(i)) 44279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov continue; 44379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 44479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov if (VERBOSITY > 1) { 44579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov app_pc orig_pc = dr_fragment_app_pc(tag); 44679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov uint flags = instr_get_arith_flags(i); 44779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov dr_printf("+%d -> to be instrumented! [opcode=%d, flags = 0x%08X]\n", 44879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov instr_get_app_pc(i) - orig_pc, instr_get_opcode(i), flags); 44979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov } 45079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 45179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov if (instr_writes_memory(i)) { 45279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // Instrument memory writes 45379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // bool instrumented_anything = false; 45479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov for (int d = 0; d < instr_num_dsts(i); d++) { 45579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov opnd_t op = instr_get_dst(i, d); 45679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov if (!OperandIsInteresting(op)) 45779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov continue; 45879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 45979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // CHECK(!instrumented_anything); 46079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // instrumented_anything = true; 46179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov InstrumentMops(drcontext, bb, i, op, true); 46279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov break; // only instrumenting the first dst 46379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov } 46479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov } 46579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov } 46679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 46779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov// TODO: optimize away redundant restore-spill pairs? 46879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 46979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov if (VERBOSITY > 1) { 47079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov pc = dr_fragment_app_pc(tag); 47179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov dr_printf("\nFinished instrumenting dynamorio_basic_block(PC=" PFX ")\n", pc); 47279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov instrlist_disassemble(drcontext, pc, bb, STDOUT); 47379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov } 47479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov return DR_EMIT_PERSISTABLE; 47579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov} 47679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 47779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanovvoid event_module_load(void *drcontext, const module_data_t *info, 47879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov bool loaded) { 47979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // Insert the module into the list while maintaining the ordering. 48079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov ModuleData mod_data(info); 48179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov std::vector<ModuleData>::iterator it = 48279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov upper_bound(g_module_list.begin(), g_module_list.end(), mod_data, 48379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov ModuleDataCompareStart); 48479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov it = g_module_list.insert(it, mod_data); 48579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // Check if we should instrument this module. 48679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov it->should_instrument_ = ShouldInstrumentModule(&*it); 48779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov dr_module_set_should_instrument(info->handle, it->should_instrument_); 48879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 48979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov if (VERBOSITY > 0) 49079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov dr_printf("==DRMSAN== Loaded module: %s [%p...%p], instrumentation is %s\n", 49179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov info->full_path, info->start, info->end, 49279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov it->should_instrument_ ? "on" : "off"); 49379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov} 49479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 49579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanovvoid event_module_unload(void *drcontext, const module_data_t *info) { 49679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov if (VERBOSITY > 0) 49779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov dr_printf("==DRMSAN== Unloaded module: %s [%p...%p]\n", info->full_path, 49879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov info->start, info->end); 49979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 50079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // Remove the module from the list. 50179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov ModuleData mod_data(info); 50279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov std::vector<ModuleData>::iterator it = 50379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov lower_bound(g_module_list.begin(), g_module_list.end(), mod_data, 50479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov ModuleDataCompareStart); 50579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // It's a bug if we didn't actually find the module. 50679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov CHECK(it != g_module_list.end() && it->start_ == mod_data.start_ && 50779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov it->end_ == mod_data.end_ && it->path_ == mod_data.path_); 50879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov g_module_list.erase(it); 50979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov} 51079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 51179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanovvoid event_exit() { 5127a53bca1db2adfb22c9e830f3e91833214b12663Reid Kleckner // Clean up so DR doesn't tell us we're leaking memory. 5137a53bca1db2adfb22c9e830f3e91833214b12663Reid Kleckner drsys_exit(); 5147a53bca1db2adfb22c9e830f3e91833214b12663Reid Kleckner drutil_exit(); 5157a53bca1db2adfb22c9e830f3e91833214b12663Reid Kleckner drmgr_exit(); 5167a53bca1db2adfb22c9e830f3e91833214b12663Reid Kleckner 51779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov if (VERBOSITY > 0) 51879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov dr_printf("==DRMSAN== DONE\n"); 51979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov} 52079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 52179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanovbool event_filter_syscall(void *drcontext, int sysnum) { 52279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // FIXME: only intercept syscalls with memory effects. 52379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov return true; /* intercept everything */ 52479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov} 52579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 52679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanovbool drsys_iter_memarg_cb(drsys_arg_t *arg, void *user_data) { 52779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov CHECK(arg->valid); 52879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 52979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov if (arg->pre) 53079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov return true; 5310f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner if (!TESTANY(DRSYS_PARAM_OUT, arg->mode)) 53279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov return true; 53379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 53479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov size_t sz = arg->size; 53579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 53679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov if (sz > 0xFFFFFFFF) { 53779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov drmf_status_t res; 53879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov drsys_syscall_t *syscall = (drsys_syscall_t *)user_data; 53979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov const char *name; 54079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov res = drsys_syscall_name(syscall, &name); 54179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov CHECK(res == DRMF_SUCCESS); 54279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 54379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov dr_printf("SANITY: syscall '%s' arg %d writes %llu bytes memory?!" 54479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov " Clipping to %llu.\n", 54579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov name, arg->ordinal, (unsigned long long) sz, 54679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov (unsigned long long)(sz & 0xFFFFFFFF)); 54779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov } 54879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 5490f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner if (VERBOSITY > 0) { 5500f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner drmf_status_t res; 5510f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner drsys_syscall_t *syscall = (drsys_syscall_t *)user_data; 5520f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner const char *name; 5530f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner res = drsys_syscall_name(syscall, &name); 5540f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner dr_printf("drsyscall: syscall '%s' arg %d wrote range [%p, %p)\n", 5550f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner name, arg->ordinal, arg->start_addr, 5560f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner (char *)arg->start_addr + sz); 5570f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner } 5580f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner 5590f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner // We don't switch to the app context because __msan_unpoison() doesn't need 5600f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner // TLS segments. 5610f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner __msan_unpoison(arg->start_addr, sz); 56279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 56379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov return true; /* keep going */ 56479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov} 56579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 56679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanovbool event_pre_syscall(void *drcontext, int sysnum) { 56779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov drsys_syscall_t *syscall; 56879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov drsys_sysnum_t sysnum_full; 56979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov bool known; 57079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov drsys_param_type_t ret_type; 57179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov drmf_status_t res; 57279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov const char *name; 57379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 57479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov res = drsys_cur_syscall(drcontext, &syscall); 57579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov CHECK(res == DRMF_SUCCESS); 57679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 57779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov res = drsys_syscall_number(syscall, &sysnum_full); 57879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov CHECK(res == DRMF_SUCCESS); 57979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov CHECK(sysnum == sysnum_full.number); 58079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 58179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov res = drsys_syscall_is_known(syscall, &known); 58279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov CHECK(res == DRMF_SUCCESS); 58379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 58479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov res = drsys_syscall_name(syscall, &name); 58579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov CHECK(res == DRMF_SUCCESS); 58679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 58779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov res = drsys_syscall_return_type(syscall, &ret_type); 58879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov CHECK(res == DRMF_SUCCESS); 58979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov CHECK(ret_type != DRSYS_TYPE_INVALID); 59079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov CHECK(!known || ret_type != DRSYS_TYPE_UNKNOWN); 59179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 59279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov res = drsys_iterate_memargs(drcontext, drsys_iter_memarg_cb, NULL); 59379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov CHECK(res == DRMF_SUCCESS); 59479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 59579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov return true; 59679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov} 59779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 5980f92deb81207c80481ff0257fbaba640fe669633Reid Klecknerstatic bool IsInLoader(void *drcontext) { 5990f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner // TODO: This segment swap is inefficient. DR should just let us query the 6000f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner // app segment base, which it has. Alternatively, if we disable 6010f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner // -mangle_app_seg, then we won't need the swap. 6020f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner bool need_swap = !dr_using_app_state(drcontext); 6030f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner if (need_swap) 6040f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner dr_switch_to_app_state(drcontext); 6050f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner bool is_in_loader = __msan_is_in_loader(); 6060f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner if (need_swap) 6070f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner dr_switch_to_dr_state(drcontext); 6080f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner return is_in_loader; 6090f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner} 6100f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner 61179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanovvoid event_post_syscall(void *drcontext, int sysnum) { 61279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov drsys_syscall_t *syscall; 61379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov drsys_sysnum_t sysnum_full; 61479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov bool success = false; 61579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov drmf_status_t res; 61679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 61779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov res = drsys_cur_syscall(drcontext, &syscall); 61879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov CHECK(res == DRMF_SUCCESS); 61979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 62079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov res = drsys_syscall_number(syscall, &sysnum_full); 62179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov CHECK(res == DRMF_SUCCESS); 62279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov CHECK(sysnum == sysnum_full.number); 62379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 62479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov res = drsys_syscall_succeeded(syscall, dr_syscall_get_result(drcontext), 62579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov &success); 62679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov CHECK(res == DRMF_SUCCESS); 62779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 62879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov if (success) { 62979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov res = 63079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov drsys_iterate_memargs(drcontext, drsys_iter_memarg_cb, (void *)syscall); 63179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov CHECK(res == DRMF_SUCCESS); 63279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov } 6330f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner 6340f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner // Our normal mmap interceptor can't intercept calls from the loader itself. 6350f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner // This means we don't clear the shadow for calls to dlopen. For now, we 6360f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner // solve this by intercepting mmap from ld.so here, but ideally we'd have a 6370f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner // solution that doesn't rely on msandr. 6380f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner // 6390f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner // Be careful not to intercept maps done by the msan rtl. Otherwise we end up 6400f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner // unpoisoning vast regions of memory and OOMing. 6410f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner // TODO: __msan_unpoison() could "flush" large regions of memory like tsan 6420f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner // does instead of doing a large memset. However, we need the memory to be 6430f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner // zeroed, where as tsan does not, so plain madvise is not enough. 6440f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner if (success && (sysnum == SYS_mmap IF_NOT_X64(|| sysnum == SYS_mmap2))) { 6450f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner if (IsInLoader(drcontext)) { 6460f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner app_pc base = (app_pc)dr_syscall_get_result(drcontext); 6470f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner ptr_uint_t size; 6480f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner drmf_status_t res = drsys_pre_syscall_arg(drcontext, 1, &size); 6490f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner CHECK(res == DRMF_SUCCESS); 6500f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner if (VERBOSITY > 0) 6510f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner dr_printf("unpoisoning for dlopen: [%p-%p]\n", base, base + size); 6520f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner // We don't switch to the app context because __msan_unpoison() doesn't 6530f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner // need TLS segments. 6540f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner __msan_unpoison(base, size); 6550f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner } 6560f92deb81207c80481ff0257fbaba640fe669633Reid Kleckner } 65779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov} 65879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 65979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov} // namespace 66079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 66179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy StepanovDR_EXPORT void dr_init(client_id_t id) { 66279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov drmf_status_t res; 66379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 66479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov drmgr_init(); 66579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov drutil_init(); 66679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 6672ecccf8aca0f3f67d43e6395699aab0bb19ee277Evgeniy Stepanov std::string app_name = dr_get_application_name(); 66879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // This blacklist will still run these apps through DR's code cache. On the 66979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // other hand, we are able to follow children of these apps. 67079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // FIXME: Once DR has detach, we could just detach here. Alternatively, 67179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // if DR had a fork or exec hook to let us decide there, that would be nice. 67279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // FIXME: make the blacklist cmd-adjustable. 67379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov if (app_name == "python" || app_name == "python2.7" || app_name == "bash" || 67479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov app_name == "sh" || app_name == "true" || app_name == "exit" || 67579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov app_name == "yes" || app_name == "echo") 67679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov return; 67779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 67879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov drsys_options_t ops; 67979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov memset(&ops, 0, sizeof(ops)); 68079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov ops.struct_size = sizeof(ops); 68179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov ops.analyze_unknown_syscalls = false; 68279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 68379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov res = drsys_init(id, &ops); 68479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov CHECK(res == DRMF_SUCCESS); 68579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 68679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov dr_register_filter_syscall_event(event_filter_syscall); 68779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov drmgr_register_pre_syscall_event(event_pre_syscall); 68879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov drmgr_register_post_syscall_event(event_post_syscall); 68979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov res = drsys_filter_all_syscalls(); 69079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov CHECK(res == DRMF_SUCCESS); 69179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 69279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov InitializeMSanCallbacks(); 69379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 69479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // FIXME: the shadow is initialized earlier when DR calls one of our wrapper 69579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // functions. This may change one day. 69679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // TODO: make this more robust. 69779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 69879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov void *drcontext = dr_get_current_drcontext(); 69979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 70079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov dr_switch_to_app_state(drcontext); 70179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov msan_retval_tls_offset = __msan_get_retval_tls_offset(); 70279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov msan_param_tls_offset = __msan_get_param_tls_offset(); 70379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov dr_switch_to_dr_state(drcontext); 70479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov if (VERBOSITY > 0) { 70579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov dr_printf("__msan_retval_tls offset: %d\n", msan_retval_tls_offset); 70679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov dr_printf("__msan_param_tls offset: %d\n", msan_param_tls_offset); 70779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov } 70879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 70979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov // Standard DR events. 71079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov dr_register_exit_event(event_exit); 71179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 71279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov drmgr_priority_t priority = { 71379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov sizeof(priority), /* size of struct */ 71479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov "msandr", /* name of our operation */ 71579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov NULL, /* optional name of operation we should precede */ 71679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov NULL, /* optional name of operation we should follow */ 71779b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 0 71879b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov }; /* numeric priority */ 71979b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov 72079b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov drmgr_register_bb_app2app_event(event_basic_block_app2app, &priority); 72179b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov drmgr_register_bb_instru2instru_event(event_basic_block, &priority); 72279b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov drmgr_register_module_load_event(event_module_load); 72379b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov drmgr_register_module_unload_event(event_module_unload); 72479b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov if (VERBOSITY > 0) 72579b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov dr_printf("==MSANDR== Starting!\n"); 72679b2d17fbaed2afa1a5a8f7bda42e45322709636Evgeniy Stepanov} 727