Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CallstackInstr: switch to SBE/EBE callbacks #1445

Merged
merged 1 commit into from
Feb 19, 2024
Merged

Conversation

AndrewFasano
Copy link
Member

@AndrewFasano AndrewFasano commented Feb 17, 2024

The old callstack instr logic would miss many calls if tb_chaining was enabled (which is is by default). Since this plugin did not disable tb_chaining, many calls would be missed if a user didn't disable chaining or load another plugin that disabled chaining.

This commit updates the plugin to use start_block_exec and end_block_exec which work even with tb_chaining enabled.

Thanks to @lacraig2 for suggesting this fix.

Hopefully fixes #1443.

One slight concern about this change is how the EBE callback works with interrupts - I know ABE is triggered when a block is interrupted and callbacks are infored of this through the exitCode arg which callstack_instr was checking. If EBE is just not called when this happens, this updated code will be correct. Otherwise, if it's still called on these weird "end" blocks, I'm not sure these changes will be correct.

The old logic would miss many calls if tb_chaining was enabled (which is
is by default). Since this plugin did not disable tb_chaining, many calls
would be missed if a user didn't disable chaining or load another plugin
that disabled chaining.

This commit updates the plugin to use start_block_exec and end_block_exec
which work even with tb_chaining enabled.
@AndrewFasano AndrewFasano merged commit c575951 into dev Feb 19, 2024
8 checks passed
@AndrewFasano AndrewFasano deleted the callstack_instr_sbe branch February 19, 2024 04:35
@@ -611,9 +593,9 @@ bool init_plugin(void *self) {

pcb.after_block_translate = after_block_translate;
panda_register_callback(self, PANDA_CB_AFTER_BLOCK_TRANSLATE, pcb);
pcb.after_block_exec = after_block_exec;
pcb.end_block_exec = end_block_exec;
panda_register_callback(self, PANDA_CB_AFTER_BLOCK_EXEC, pcb);
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is still AFTER_BLOCK_EXEC? Is that what you intended? Same with BEFORE_BLOCK_EXEC below. @LauraLMann spotted this.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think so - looks like before_block_exec -> start_block_exec and after_block_exec -> start_block_exec. They're conceptually similar, but the implementation is different (most relevant here is that SBE and EBE trigger for each block even with TB chaining enabled).

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I might be missing something super obvious though

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The second arg to panda_register_callback didn't change. pcb is just a big union - the field names in that structure can be interchanged - changing just the field name in pcb is essentially a no-op. Changing the field name implied that you wanted to change which callback was being invoked, but you are still registering the same callback.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah yes, I am missing something super obvious! Thanks, I'l fix

cpu_get_tb_cpu_state(env, &pc, &cs_base, &flags);
// erase nicely does nothing if key DNE
stoppedInfo.erase(curStackid);
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think I have a case where the removal of this logic is causing a regression. Basically running the same recording can result in callstack_instr generating different output. I think that's what this logic was preventing from happening. Working on verifying this is indeed the case.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If callstack_instr is firing more often after this change (including the correct callback types in #1447), I'd expect that - with the new callbacks it should be able to detect more calls.

If it's firing less, then that's an issue. I was thinking the end-block-exec callback would only trigger at the very end of a TB, and not if the block is jumped out of prematurely. But if the end-block-exec callbacks fires even if the block is interrupted, that would cause issues (particularly because that callback doesn't provide an "exitCode" arg to check for this behavior against). Hey @lacraig2 - do you know which of these behaviors we should expect from EBE?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(I'll move this discussion over to the new PR)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Callstack instr affected by panda_precise_pc & TB chaining
3 participants