Predicated Instruction support in memval_simple
Created by: toshipiazza
Working on the ARM port for memval_simple
(XREF #1551 (closed)) and, at least on my machine I see consistent crashes before main
in the following basic block:
...
+77 L3 95032730 str.ls %r2 -> -0x0730(%r3)[4byte]
...
+84 m4 e5944000 ldr (%r4)[4byte] -> %r4
...
The crash is at (+84), when we're trying to dereference %r4
, which is computed via drutil_insert_get_mem_addr()
, i.e. %r3 - 0x730
. When I run through this in gdb without DR, it appears as though %r3 - 0x730
does not point to valid memory. The native app doesn't crash though, since the predicated instruction doesn't perform the store.
A (very temporary) fix would be the following patch, which I've confirmed works with no crash:
diff --git a/api/samples/memval_simple.c b/api/samples/memval_simple.c
index 20970f9..e8622cc 100644
--- a/api/samples/memval_simple.c
+++ b/api/samples/memval_simple.c
@@ -341,6 +341,8 @@ event_app_instruction(void *drcontext, void *tag, instrlist_t *bb,
return DR_EMIT_DEFAULT;
if (!instr_writes_memory(instr))
return DR_EMIT_DEFAULT;
+ if (instr_is_predicated(instr))
+ return DR_EMIT_DEFAULT;
/* XXX: See above, in handle_post_write(). To simplify the handling of registers, we
* assume no instruction has multiple distinct memory destination operands.
though I would prefer a solution which allows us to still instrument predicated instructions, say something like an app2app drmgr routine like drutil_expand_predicated
, analogous to the drutil_expand_rep_string
routine we use in many samples.
For the record, I've never seen a crash caused by predicated instructions on x86.