fastpath.c

/* **********************************************************
 * Copyright (c) 2015-2017 Google, Inc.  All rights reserved.
 * **********************************************************/

/* Dr. Memory: the memory debugger
 *
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation;
 * version 2.1 of the License, and no later version.

 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 * Library General Public License for more details.

 * You should have received a copy of the GNU Lesser General Public
 * License along with this library; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */

/***************************************************************************
 * fastpath.c: Dr. Memory cross-platform shadow instrumentation fastpath
 */

#include "dr_api.h"
#include "drmemory.h"
#include "slowpath.h"
#include "spill.h"
#include "fastpath.h"
#include "fastpath_arch.h"
#include "shadow.h"
#include "stack.h"
#ifdef TOOL_DR_MEMORY
# include "alloc_drmem.h"
# include "report.h"
#endif
#include "pattern.h"

#ifdef UNIX
# include <signal.h> /* for SIGSEGV */
#else
# include <stddef.h> /* for offsetof */
#endif

static uint share_xl8_num_flushes;

void
slow_path_xl8_sharing(app_loc_t *loc, size_t inst_sz, opnd_t memop, dr_mcontext_t *mc)
{
    /* PR 493257: share shadow translation across multiple instrs */
    uint xl8_sharing_cnt;
    app_pc pc;
    bool translated = true;
    ASSERT(loc != NULL && loc->type == APP_LOC_PC, "invalid param");
    pc = loc_to_pc(loc);
    xl8_sharing_cnt = (uint)(ptr_uint_t) hashtable_lookup(&xl8_sharing_table, pc);
    if (xl8_sharing_cnt > 0) {
        STATS_INC(xl8_shared_slowpath_count);
        ASSERT(!opnd_is_null(memop), "error in xl8 sharing");
        /* Since we can't share across 64K boundaries we exit to slowpath.
         * If this happens too often, abandon sharing.
         */
        if (xl8_sharing_cnt > options.share_xl8_max_slow &&
            /* 2* is signal to not flush again */
            xl8_sharing_cnt < 2*options.share_xl8_max_slow) {
            uint num_flushes;
            STATS_INC(xl8_not_shared_slowpaths);
            /* If this instr has other reasons to go to slowpath, don't flush
             * repeatedly: only flush if it's actually due to addr sharing
             */
            hashtable_add_replace(&xl8_sharing_table, pc,
                                  (void *)(ptr_uint_t)
                                  (2*options.share_xl8_max_slow));
            /* We don't need a synchronous flush: go w/ most performant.
             * dr_delay_flush_region() doesn't do any unlinking, so if in
             * a loop we'll repeatedly flush => performance problem!
             * So we go w/ dr_unlink_flush_region(): should be ok since
             * we'll never want -coarse_units.
             * XXX i#1426: actually we do have -coarse_units with -persist_code!
             * To support full mode persistence we'll have to change this flush!
             */

            /* Flushing can be expensive so we disable sharing
             * completely if we flush too many times.
             *
             * XXX DRi#373: really, DR should split vm areas up to
             * make these flushes more performant so each flush
             * doesn't throw out entire executable's worth!
             */
            num_flushes = atomic_add32_return_sum((int*)&share_xl8_num_flushes, 1);
            if (num_flushes >= options.share_xl8_max_flushes/2) {
                /* reduce the max diff to reduce # of 64K crossings.
                 * the flush will flush all in this module (at least
                 * until DRi#373) so this will affect other sharings.
                 */
                LOG(1, "reached %d flushes: shrinking -share_xl8_max_diff\n",
                    num_flushes);
                options.share_xl8_max_diff /= 8;
            } else if (num_flushes >= options.share_xl8_max_flushes) {
                LOG(1, "reached %d flushes: disabling xl8 sharing\n", num_flushes);
                options.share_xl8 = false;
            }

            LOG(3, "slow_path_xl8_sharing: flushing "PFX"\n", pc);
            if (!translated) {
                /* Now we have to xl8 */
                pc = loc_to_pc(loc);
                /* We've been incrementing the cache pc entry, but the
                 * hashtable_add_replace below will tell the
                 * instrumentation to not share this app pc again.
                 */
            }
            dr_unlink_flush_region(pc, 1);
        } else {
            xl8_sharing_cnt++;
            /* We don't care about races: threshold is low enough we won't overflow */
            hashtable_add_replace(&xl8_sharing_table, pc,
                                  (void *)(ptr_uint_t) xl8_sharing_cnt);
        }
    } else if (!translated && !opnd_is_null(memop)) {
        LOG(3, "slow_path_xl8_sharing: adding entry "PFX"\n", pc);
        hashtable_add(&xl8_sharing_table, pc, (void *)1);
        STATS_INC(xl8_shared_slowpath_instrs);
    }

    /* We've clobbered the register holding the shared xl8 address, so we have to
     * either restore or clear for subsequent sharers.  We end up clearing in all
     * cases for simplicity (see the commit history for a big comment on how complex
     * it gets to try and restore instead of just clearing).  That clear used to be
     * done here, and it relied on writing to the spill slot xchg-ed back into the
     * reg by the 2-step return.  Moving to drreg, we do not want to rely on spill
     * slots being constant, and we want to eliminate the 2-step return, so we moved
     * the reg clear to the inlined code in instrument_slowpath() where the reg to
     * write to is known.
     */
}

/***************************************************************************
 * Fault handling
 */

#ifdef ARM
dr_isa_mode_t
get_isa_mode_from_fault_mc(dr_mcontext_t *mc)
{
    return TEST(EFLAGS_T, mc->xflags) ? DR_ISA_ARM_THUMB : DR_ISA_ARM_A32;
}
#endif

#ifdef TOOL_DR_MEMORY

/* PR 448701: handle fault on write to a special shadow block */
static byte *
compute_app_address_on_shadow_fault(void *drcontext, byte *target,
                                    dr_mcontext_t *raw_mc, dr_mcontext_t *mc,
                                    byte *pc_post_fault, bb_saved_info_t *save)
{
    app_pc addr;
    uint memopidx;
    bool write;
    instr_t *app_inst = restore_mcontext_on_shadow_fault(drcontext, raw_mc,
                                                         mc, pc_post_fault, save);
    for (memopidx = 0;
         instr_compute_address_ex(app_inst, mc, memopidx, &addr, &write);
         memopidx++) {
        LOG(3, "considering emulated target %s "PFX" => shadow "PFX" vs fault "PFX"\n",
            write ? "write" : "read", addr, shadow_translation_addr(addr), target);
        if (shadow_translation_addr(addr) == target)
            break;
    }
    ASSERT(shadow_translation_addr(addr) == target,
           "unable to compute original address on shadow fault");
    instr_destroy(drcontext, app_inst);

    return addr;
}

static void
handle_special_shadow_fault(void *drcontext, byte *target,
                            dr_mcontext_t *raw_mc, dr_mcontext_t *mc, void *tag)
{
    /* Re-execute the faulting instruction.  We have to shift the instruction's
     * base register from the special block to the new block.  An alternative is
     * to restore the app context and then re-direct execution to a new bb: but
     * that's more complex (have to decode forward and emulate all xchg +
     * restore-from-tls until next cti) and less efficient (new bb, and we'd
     * have to change two-part sub-dword dst write to get final value in reg
     * before committing).  Actually we do have to restore app state to get app
     * address -- but the other arguments still apply so sticking w/ re-execute.
     */
    app_pc pc;
    app_pc addr;
    instr_t fault_inst;
    byte *new_shadow;
    opnd_t shadowop;
    bb_saved_info_t *save;
#ifdef DEBUG
    tls_util_t *pt = PT_GET(drcontext);
#endif

    LOG(2, "write fault to special shadow @"PFX"\n", target);
    STATS_INC(num_faults);
#ifdef TOOL_DR_HEAPSTAT
    ASSERT(false, "should not get here");
#endif

    if (is_in_gencode(raw_mc->pc)) {
        /* PR 503778: the esp_adjust fastpath now touches more than just the 64K
         * region containing the app esp.  We could calculate its exact address
         * by locating the precise routine and then use the count from tls and
         * remaining count, and then below adjust the stored boundary, but
         * simpler to bail to slowpath.
         */
        byte *nxt_pc;
        instr_t inst;
        pc = raw_mc->pc;
        instr_init(drcontext, &inst);
        nxt_pc = decode(drcontext, pc, &inst);
        do {
            /* Look for the start of slowpath inside esp_adjust fastpath.
             * For simplicity we insert a nop there.
             */
            if (instr_get_opcode(&inst) == OP_nop) {
                LOG(3, "write fault in gencode "PFX" => xl8 to slowpath "PFX"\n",
                    raw_mc->pc, pc);
                raw_mc->pc = pc;
                instr_free(drcontext, &inst);
                return;
            }
            instr_reset(drcontext, &inst);
            pc = nxt_pc;
            nxt_pc = decode(drcontext, pc, &inst);
        } while (pc - raw_mc->pc < PAGE_SIZE);
        ASSERT(false, "cannot find slowpath sequence in esp fastpath!");
    }

    instr_init(drcontext, &fault_inst);
    pc = decode(drcontext, raw_mc->pc, &fault_inst);

    hashtable_lock(&bb_table);
    save = (bb_saved_info_t *) hashtable_lookup(&bb_table, tag);
    addr = compute_app_address_on_shadow_fault(drcontext, target, raw_mc, mc, pc,
                                               save);
    hashtable_unlock(&bb_table);

    /* Create a non-special shadow block */
    new_shadow = shadow_replace_special(addr);
    /* Change base register to point at it */
    shadowop = instr_get_dst(&fault_inst, 0);
    ASSERT(opnd_is_base_disp(shadowop) && opnd_get_index(shadowop) == REG_NULL,
           "emulation error");
    ASSERT(opnd_compute_address(shadowop, raw_mc) == target, "emulation error");
    reg_set_value(opnd_get_base(shadowop), raw_mc, (reg_t)new_shadow);
    DOLOG(3, {
        LOG(3, "changed base reg in ");
        opnd_disassemble(drcontext, shadowop, pt->f);
        LOG(3, " to new non-special translation "PFX"\n", new_shadow);
    });

    instr_free(drcontext, &fault_inst);
}

/* i#1015: report write-to-read-only as an unaddressable warning */
static bool
handle_possible_write_to_read_only(void *drcontext,
                                   dr_mcontext_t *raw_mc,
                                   dr_mcontext_t *mc)
{
    app_pc addr;
    bool is_write;
    uint pos;
    int  memopidx;
    app_loc_t loc;
    size_t size;
    dr_mem_info_t info;
    instr_t inst;
    bool res = false;

    /* XXX: we could try to merge some code w/ pattern_handle_segv_fault() */
    ASSERT(options.pattern == 0, "already handled in pattern_handle_segv_fault()");
    instr_init(drcontext, &inst);
    if (!safe_decode(drcontext, raw_mc->pc, &inst, NULL)) {
        instr_free(drcontext, &inst);
        return false;
    }
    /* someone could send a SIGSEGV signal, so we iterate instr opnds
     * to check possible write-to-read-only errors
     */
    for (memopidx = 0;
         instr_compute_address_ex_pos(&inst, mc, memopidx,
                                      &addr, &is_write, &pos);
         memopidx++) {
        if (!is_write)
            continue;
        if (!dr_query_memory_ex(addr, &info) ||
            info.type == DR_MEMTYPE_FREE ||
            TEST(DR_MEMPROT_WRITE, info.prot) ||
            TEST(info.prot, DR_MEMPROT_PRETEND_WRITE))
            continue;
        size = opnd_size_in_bytes(opnd_get_size(instr_get_dst(&inst, pos)));
        pc_to_loc(&loc, mc->pc);
        /* XXX: how to avoid double report on write-to-unaddressable,
         * as the shadow have been updated by the first report?
         * It should be ok since it is unlikely to have an unaddressable
         * read-only region.
         */
        report_unaddr_warning(&loc, mc, "writing to readonly memory", addr, size, true);
        res = true;
    }
    instr_free(drcontext, &inst);
    return res;
}

#endif /* TOOL_DR_MEMORY */

/* PR 448701: we fault if we write to a special block */
#ifdef UNIX
dr_signal_action_t
event_signal_instrument(void *drcontext, dr_siginfo_t *info)
{
# ifdef TOOL_DR_MEMORY
    /* Handle faults from writes to special shadow blocks */
    /* i#1488: we sometimes get SIGBUS on Mac */
    if (info->sig == SIGSEGV || info->sig == SIGBUS) {
        byte *target = info->access_address;
        /* We don't know whether a write since DR isn't providing that info but
         * shouldn't matter enough to be worth our determining
         */
        LOG(2, "SIGSEGV @"PFX" (xl8=>"PFX") accessing "PFX"\n",
            info->raw_mcontext->pc, info->mcontext->pc, target);
        if (options.pattern != 0 &&
            pattern_handle_segv_fault(drcontext, info->raw_mcontext, info->mcontext)) {
            return DR_SIGNAL_SUPPRESS;
        } else if (ZERO_STACK() &&
                   handle_zeroing_fault(drcontext, target, info->raw_mcontext,
                                        info->mcontext)) {
            return DR_SIGNAL_SUPPRESS;
        } else if (options.shadowing &&
                   is_in_special_shadow_block(target)) {
            ASSERT(info->raw_mcontext_valid, "raw mc should always be valid for SEGV");
            handle_special_shadow_fault(drcontext, target, info->raw_mcontext,
                                        info->mcontext, info->fault_fragment_info.tag);
            /* Re-execute the faulting cache instr.  If we ever change to redirect
             * to a new bb at the app instr we must change our two-part shadow
             * write for sub-dword.
             */
            return DR_SIGNAL_SUPPRESS;
        } else if (options.report_write_to_read_only &&
                   options.pattern == 0 && /* vs pattern_handle_segv_fault() */
                   handle_possible_write_to_read_only(drcontext, info->raw_mcontext,
                                                      info->mcontext)) {
            /* fall through to DR_SIGNAL_DELIVER */
        } else if (options.check_pc &&
                   /* If the pc is the target, it's an exec fault */
                   info->mcontext->pc == target) {
            /* i#1412: raise an error on executing invalid memory */
            app_loc_t loc;
            pc_to_loc(&loc, target);
            report_unaddressable_access(&loc, target, 1, DR_MEMPROT_EXEC,
                                        target, target + 1, info->mcontext);
        }
    } else if (info->sig == SIGILL) {
        LOG(2, "SIGILL @"PFX" (xl8=>"PFX")\n",
            info->raw_mcontext->pc, info->mcontext->pc);
        if (options.pattern != 0) {
            if (pattern_handle_ill_fault(drcontext, info->raw_mcontext,
                                         info->mcontext))
                return DR_SIGNAL_SUPPRESS;
            return DR_SIGNAL_DELIVER;
        } else if (handle_slowpath_fault(drcontext, info->raw_mcontext,
                                         info->mcontext,
                                         info->fault_fragment_info.tag))
            return DR_SIGNAL_SUPPRESS;
    }
# endif
    return DR_SIGNAL_DELIVER;
}
#else
bool
event_exception_instrument(void *drcontext, dr_exception_t *excpt)
{
# ifdef TOOL_DR_MEMORY
    if (options.pattern != 0 &&
        (excpt->record->ExceptionCode == STATUS_ACCESS_VIOLATION ||
         excpt->record->ExceptionCode == STATUS_GUARD_PAGE_VIOLATION)) {
        bool guard;
        app_pc target = (app_pc) excpt->record->ExceptionInformation[1];
        /* i#1070: pattern mode inserted code may cause one-shot alarm
         * guard page violation, we need actual target for restoring
         * the guard page.
         */
        guard = excpt->record->ExceptionCode == STATUS_GUARD_PAGE_VIOLATION;
        if (pattern_handle_segv_fault(drcontext, excpt->raw_mcontext, excpt->mcontext
                                      _IF_WINDOWS(target) _IF_WINDOWS(guard)))
            return false;
    }
    if (excpt->record->ExceptionCode == STATUS_ACCESS_VIOLATION) {
        app_pc target = (app_pc) excpt->record->ExceptionInformation[1];
        if (ZERO_STACK() &&
            excpt->record->ExceptionInformation[0] == 1 /* write */ &&
            handle_zeroing_fault(drcontext, target, excpt->raw_mcontext,
                                 excpt->mcontext)) {
            return false;
        } else if (options.shadowing &&
                   excpt->record->ExceptionInformation[0] == 1 /* write */ &&
                   is_in_special_shadow_block(target)) {
            handle_special_shadow_fault(drcontext, target, excpt->raw_mcontext,
                                        excpt->mcontext, excpt->fault_fragment_info.tag);
            /* Re-execute the faulting cache instr.  If we ever change to redirect
             * to a new bb at the app instr we must change our two-part shadow
             * write for sub-dword.
             */
            return false;
        } else if (options.report_write_to_read_only &&
                   options.pattern == 0 && /* vs pattern_handle_segv_fault() */
                   excpt->record->ExceptionCode != STATUS_GUARD_PAGE_VIOLATION &&
                   handle_possible_write_to_read_only(drcontext, excpt->raw_mcontext,
                                                      excpt->mcontext)) {
            return false;
        } else if (options.check_pc &&
                   /* If the pc is the target, it's an exec fault */
                   excpt->mcontext->pc == target) {
            /* i#1412: raise an error on executing invalid memory */
            app_loc_t loc;
            pc_to_loc(&loc, target);
            report_unaddressable_access(&loc, target, 1, DR_MEMPROT_EXEC,
                                        target, target + 1, excpt->mcontext);
        }
    } else if (excpt->record->ExceptionCode == STATUS_ILLEGAL_INSTRUCTION) {
        if (options.pattern != 0) {
            return !pattern_handle_ill_fault(drcontext, excpt->raw_mcontext,
                                             excpt->mcontext);
        } else if (handle_slowpath_fault(drcontext, excpt->raw_mcontext,
                                         excpt->mcontext,
                                         excpt->fault_fragment_info.tag)) {
            return false;
        }
    }
# endif
    LOG(2, "application fault @"PFX" in module %s\n",
        excpt->mcontext->pc, module_lookup_preferred_name(excpt->mcontext->pc));
    return true;
}
#endif

/***************************************************************************
 * For PR 578892: fastpath heap routine unaddr accesses
 */

void
client_entering_heap_routine(void)
{
#ifdef TOOL_DR_MEMORY
    if (options.shadowing)
        set_shadow_inheap(1);
#endif
}

void
client_exiting_heap_routine(void)
{
#ifdef TOOL_DR_MEMORY
    if (options.shadowing)
        set_shadow_inheap(0);
#endif
}