void write_child_eip(int tid, long int val)
{
struct user_regs_struct regs;
read_child_registers(tid, ®s);
regs.eip = val;
write_child_registers(tid, ®s);
}
static void replay_init_scratch_memory(struct context* ctx,
struct mmapped_file *file)
{
/* initialize the scratchpad as the recorder did, but
* make it PROT_NONE. The idea is just to reserve the
* address space so the replayed process address map
* looks like the recorded process, if it were to be
* probed by madvise or some other means. But we make
* it PROT_NONE so that rogue reads/writes to the
* scratch memory are caught.
*/
/* set up the mmap system call */
struct user_regs_struct orig_regs;
read_child_registers(ctx->child_tid, &orig_regs);
struct user_regs_struct mmap_call = orig_regs;
mmap_call.eax = SYS_mmap2;
mmap_call.ebx = (uintptr_t)file->start;
mmap_call.ecx = file->end - file->start;
mmap_call.edx = PROT_NONE;
mmap_call.esi = MAP_PRIVATE | MAP_ANONYMOUS;
mmap_call.edi = -1;
mmap_call.ebp = 0;
inject_and_execute_syscall(ctx,&mmap_call);
write_child_registers(ctx->child_tid,&orig_regs);
}
/**
* Step over the system call instruction to "exit" the emulated
* syscall.
*/
static void step_exit_syscall_emu(struct context *ctx)
{
pid_t tid = ctx->child_tid;
struct user_regs_struct regs;
read_child_registers(tid, ®s);
sys_ptrace_sysemu_singlestep(tid);
sys_waitpid(tid, &ctx->status);
write_child_registers(tid, ®s);
ctx->status = 0;
}
static void replay_one_trace_frame(struct dbg_context* dbg,
struct context* ctx)
{
struct dbg_request req;
struct rep_trace_step step;
int event = ctx->trace.stop_reason;
int stop_sig = 0;
debug("%d: replaying event %s, state %s",
ctx->rec_tid,
strevent(event), statename(ctx->trace.state));
if (ctx->syscallbuf_hdr) {
debug(" (syscllbufsz:%u, abrtcmt:%u)",
ctx->syscallbuf_hdr->num_rec_bytes,
ctx->syscallbuf_hdr->abort_commit);
}
/* Advance the trace until we've exec()'d the tracee before
* processing debugger requests. Otherwise the debugger host
* will be confused about the initial executable image,
* rr's. */
if (validate) {
req = process_debugger_requests(dbg, ctx);
assert(dbg_is_resume_request(&req));
}
/* print some kind of progress */
if (ctx->trace.global_time % 10000 == 0) {
fprintf(stderr, "time: %u\n",ctx->trace.global_time);
}
if (ctx->child_sig != 0) {
assert(event == -ctx->child_sig
|| event == -(ctx->child_sig | DET_SIGNAL_BIT));
ctx->child_sig = 0;
}
/* Ask the trace-interpretation code what to do next in order
* to retire the current frame. */
memset(&step, 0, sizeof(step));
switch (event) {
case USR_INIT_SCRATCH_MEM: {
/* for checksumming: make a note that this area is
* scratch and need not be validated. */
struct mmapped_file file;
read_next_mmapped_file_stats(&file);
replay_init_scratch_memory(ctx, &file);
add_scratch((void*)ctx->trace.recorded_regs.eax,
file.end - file.start);
step.action = TSTEP_RETIRE;
break;
}
case USR_EXIT:
rep_sched_deregister_thread(&ctx);
/* Early-return because |ctx| is gone now. */
return;
case USR_ARM_DESCHED:
case USR_DISARM_DESCHED:
rep_skip_desched_ioctl(ctx);
/* TODO */
step.action = TSTEP_RETIRE;
break;
case USR_SYSCALLBUF_ABORT_COMMIT:
ctx->syscallbuf_hdr->abort_commit = 1;
step.action = TSTEP_RETIRE;
break;
case USR_SYSCALLBUF_FLUSH:
rep_process_flush(ctx, rr_flags->redirect);
/* TODO */
step.action = TSTEP_RETIRE;
break;
case USR_SYSCALLBUF_RESET:
ctx->syscallbuf_hdr->num_rec_bytes = 0;
step.action = TSTEP_RETIRE;
break;
case USR_SCHED:
step.action = TSTEP_PROGRAM_ASYNC_SIGNAL_INTERRUPT;
step.target.rcb = ctx->trace.rbc;
step.target.regs = &ctx->trace.recorded_regs;
step.target.signo = 0;
break;
case SIG_SEGV_RDTSC:
step.action = TSTEP_DETERMINISTIC_SIGNAL;
step.signo = SIGSEGV;
break;
default:
/* Pseudosignals are handled above. */
assert(event > LAST_RR_PSEUDOSIGNAL);
if (FIRST_DET_SIGNAL <= event && event <= LAST_DET_SIGNAL) {
step.action = TSTEP_DETERMINISTIC_SIGNAL;
step.signo = (-event & ~DET_SIGNAL_BIT);
stop_sig = step.signo;
} else if (event < 0) {
assert(FIRST_ASYNC_SIGNAL <= event
&& event <= LAST_ASYNC_SIGNAL);
step.action = TSTEP_PROGRAM_ASYNC_SIGNAL_INTERRUPT;
step.target.rcb = ctx->trace.rbc;
step.target.regs = &ctx->trace.recorded_regs;
step.target.signo = -event;
stop_sig = step.target.signo;
} else {
assert(event > 0);
/* XXX not so pretty ... */
validate |= (ctx->trace.state == STATE_SYSCALL_EXIT
&& event == SYS_execve);
rep_process_syscall(ctx, rr_flags->redirect, &step);
}
}
/* See the comment below about *not* resetting the hpc for
* buffer flushes. Here, we're processing the *other* event,
* just after the buffer flush, where the rcb matters. To
* simplify the advance-to-target code that follows (namely,
* making debugger interrupts simpler), pretend like the
* execution in the BUFFER_FLUSH didn't happen by resetting
* the rbc and compensating down the target rcb. */
if (TSTEP_PROGRAM_ASYNC_SIGNAL_INTERRUPT == step.action) {
uint64_t rcb_now = read_rbc(ctx->hpc);
assert(step.target.rcb >= rcb_now);
step.target.rcb -= rcb_now;
reset_hpc(ctx, 0);
}
/* Advance until |step| has been fulfilled. */
while (try_one_trace_step(ctx, &step, &req)) {
struct user_regs_struct regs;
/* Currently we only understand software breakpoints
* and successful stepi's. */
assert(SIGTRAP == ctx->child_sig && "Unknown trap");
read_child_registers(ctx->child_tid, ®s);
if (ip_is_breakpoint((void*)regs.eip)) {
/* SW breakpoint: $ip is just past the
* breakpoint instruction. Move $ip back
* right before it. */
regs.eip -= sizeof(int_3_insn);
write_child_registers(ctx->child_tid, ®s);
} else {
/* Successful stepi. Nothing else to do. */
assert(DREQ_STEP == req.type
&& req.target == get_threadid(ctx));
}
/* Don't restart with SIGTRAP anywhere. */
ctx->child_sig = 0;
/* Notify the debugger and process any new requests
* that might have triggered before resuming. */
dbg_notify_stop(dbg, get_threadid(ctx), 0x05/*gdb mandate*/);
req = process_debugger_requests(dbg, ctx);
assert(dbg_is_resume_request(&req));
}
if (dbg && stop_sig) {
dbg_notify_stop(dbg, get_threadid(ctx), stop_sig);
}
/* We flush the syscallbuf in response to detecting *other*
* events, like signal delivery. Flushing the syscallbuf is a
* sort of side-effect of reaching the other event. But once
* we've flushed the syscallbuf during replay, we still must
* reach the execution point of the *other* event. For async
* signals, that requires us to have an "intact" rbc, with the
* same value as it was when the last buffered syscall was
* retired during replay. We'll be continuing from that rcb
* to reach the rcb we recorded at signal delivery. So don't
* reset the counter for buffer flushes. (It doesn't matter
* for non-async-signal types, which are deterministic.) */
switch (ctx->trace.stop_reason) {
case USR_SYSCALLBUF_ABORT_COMMIT:
case USR_SYSCALLBUF_FLUSH:
case USR_SYSCALLBUF_RESET:
break;
default:
reset_hpc(ctx, 0);
}
debug_memory(ctx);
}
void rep_process_signal(struct context *ctx)
{
struct trace* trace = &(ctx->trace);
int tid = ctx->child_tid;
int sig = -trace->stop_reason;
/* if the there is still a signal pending here, two signals in a row must be delivered?\n */
assert(ctx->child_sig == 0);
switch (sig) {
/* set the eax and edx register to the recorded values */
case -SIG_SEGV_RDTSC:
{
struct user_regs_struct regs;
int size;
/* goto the event */
goto_next_event(ctx);
/* make sure we are there */
assert(WSTOPSIG(ctx->status) == SIGSEGV);
char* inst = get_inst(tid, 0, &size);
assert(strncmp(inst,"rdtsc",5) == 0);
read_child_registers(tid, ®s);
regs.eax = trace->recorded_regs.eax;
regs.edx = trace->recorded_regs.edx;
regs.eip += size;
write_child_registers(tid, ®s);
sys_free((void**) &inst);
compare_register_files("rdtsv_now", ®s, "rdsc_rec", &ctx->trace.recorded_regs, 1, 1);
/* this signal should not be recognized by the application */
ctx->child_sig = 0;
break;
}
case -USR_SCHED:
{
assert(trace->rbc_up > 0);
/* if the current architecture over-counts the event in question,
* substract the overcount here */
reset_hpc(ctx, trace->rbc_up - SKID_SIZE);
goto_next_event(ctx);
/* make sure that the signal came from hpc */
if (fcntl(ctx->hpc->rbc_down.fd, F_GETOWN) == ctx->child_tid) {
/* this signal should not be recognized by the application */
ctx->child_sig = 0;
stop_hpc_down(ctx);
compensate_branch_count(ctx, sig);
stop_hpc(ctx);
} else {
fprintf(stderr, "internal error: next event should be: %d but it is: %d -- bailing out\n", -USR_SCHED, ctx->event);
sys_exit();
}
break;
}
case SIGIO:
case SIGCHLD:
{
/* synchronous signal (signal received in a system call) */
if (trace->rbc_up == 0) {
ctx->replay_sig = sig;
return;
}
// setup and start replay counters
reset_hpc(ctx, trace->rbc_up - SKID_SIZE);
/* single-step if the number of instructions to the next event is "small" */
if (trace->rbc_up <= 10000) {
stop_hpc_down(ctx);
compensate_branch_count(ctx, sig);
stop_hpc(ctx);
} else {
printf("large count\n");
sys_ptrace_syscall(tid);
sys_waitpid(tid, &ctx->status);
// make sure we ere interrupted by ptrace
assert(WSTOPSIG(ctx->status) == SIGIO);
/* reset the penig sig, since it did not occur in the original execution */
ctx->child_sig = 0;
ctx->status = 0;
//DO NOT FORGET TO STOP HPC!!!
compensate_branch_count(ctx, sig);
stop_hpc(ctx);
stop_hpc_down(ctx);
}
break;
}
case SIGSEGV:
{
/* synchronous signal (signal received in a system call) */
if (trace->rbc_up == 0 && trace->page_faults == 0) {
ctx->replay_sig = sig;
return;
}
sys_ptrace_syscall(ctx->child_tid);
sys_waitpid(ctx->child_tid, &ctx->status);
assert(WSTOPSIG(ctx->status) == SIGSEGV);
struct user_regs_struct regs;
read_child_registers(ctx->child_tid, ®s);
assert(compare_register_files("now", ®s, "rec", &ctx->trace.recorded_regs, 1, 1) == 0);
/* deliver the signal */
singlestep(ctx, SIGSEGV, 0x57f);
break;
}
default:
printf("unknown signal %d -- bailing out\n", sig);
sys_exit();
break;
}
}
