i#2297: AARCH64: Implement mbr & cbr instrumentation #7005

jiegec · 2024-09-25T17:10:16Z

Implement mbr & cbr instrumentation for AARCH64, previously only available for X86. For cbr instrumentation, there are three types of conditional branches on AARCH64:

conditional branch if (non) zero: generate code to compare the register against zero to compute the direction
test bit and branch if (non) zero: generate code to extract the bit out of the register (using ubfm) and then compare the bit against zero to compute the direction
conditional branch according to NZCV: generate code to compute the direction using csinc instruction

Special care is implemented if the stolen register x28 is used as the operand, to avoid generating incorrect results.

For mbr instrumentation, the target address is placed in the register, which is later passed to the clean call from the user.

Additional instruction creation macros are added for ubfm and csinc instructions. Support for immediate operand is added to the INSTR_CREATE_eor macro. XINST_CREATE_slr_s is updated to use the new INSTR_CREATE_ubfm macro.

Count-ctis test is now enabled due to cbr & mbr instrumentation available on AARCH64. It has been enhanced to validate the direction and target address of conditional branches to validate the instrumentation.

The instrcalls and cbrtrace example clients are enabled as well. They are tested on real AARCH64 hardware. Additionally, a manually crafted dynamorio client can successfully capture the whole control flow transfer history with this pull reuqest.

Fixes: #2297 (only for AARCH64, ARM not yet) and #2919.

core/ir/aarch64/instr_create_api.h

derekbruening

Thank you for the contribution. The main missing piece is testing: see the comments.

core/ir/aarch64/instr_create_api.h

core/lib/instrument.c

jiegec · 2024-10-28T05:49:09Z

Help is wanted to fix mbr instrumentation: it sometimes receives small integers instead of actual target address, possibly some indices into the basic box cache?

derekbruening · 2024-10-28T15:41:40Z

Help is wanted to fix mbr instrumentation: it sometimes receives small integers instead of actual target address, possibly some indices into the basic box cache?

I assume it has the wrong register or something. There are no such "indices" in in-fragment code. Use the logs https://dynamorio.org/page_logging.html to see where the app's register values goes and which one is passed to the clean call.

Implement cbr instrumentation for AARCH64, supporting cbz/cbnz/tbz/tbnz/bcond opcodes. Issue: DynamoRIO#2297

Document newly added instruction creation macros for EOR, CSINC and UBFM. Refactor XINST_CREATE_slr_s to use the new macro to create ubfm instruction. Fixes DynamoRIO#2297

Issue: DynamoRIO#2919

jiegec · 2025-05-10T08:04:37Z

Newly enabled count-ctis test is passed. Manually written dynamorio client to leverage cbr/mbr instrumentation also works correctly.

jiegec · 2025-05-10T08:23:15Z

A bug has been found: when x28 is used for cbnz conditional branch, the branch direction is wrongly computed. It is possibly due to x28 being used by dynamorio. dr_insert_get_stolen_reg_value() is required to fix this.

jiegec · 2025-05-10T08:40:59Z

A bug has been found: when x28 is used for cbnz conditional branch, the branch direction is wrongly computed. It is possibly due to x28 being used by dynamorio. dr_insert_get_stolen_reg_value() is required to fix this.

Fixed in commit e9980ab. With this pull request, we are able to record the control flow transfer (regarding each branch) of a program on AARCH64 correctly.

derekbruening · 2025-05-13T01:14:32Z

Please click the re-request review in the upper right when ready (comments resolved and tests green).

derekbruening · 2025-05-13T17:45:34Z

@jiegec jiegec force-pushed the i2297-cbr-aarch64 branch from f02728e to d9222e1
3 days ago

Please do not force-push shared branches. This destroys the history and makes it a lot harder for reviewers! This is documented in several places: https://dynamorio.org/page_contributing.html, https://dynamorio.org/page_code_reviews.html#autotoc_md118. There is now no way to easily see the changes since the last round of reviews. You're forcing the reviewer to start from scratch; throwing away the anchors to all the prior comments; etc.

jiegec · 2025-05-14T00:57:48Z

@jiegec jiegec force-pushed the i2297-cbr-aarch64 branch from f02728e to d9222e1
3 days ago

Please do not force-push shared branches. This destroys the history and makes it a lot harder for reviewers! This is documented in several places: https://dynamorio.org/page_contributing.html, https://dynamorio.org/page_code_reviews.html#autotoc_md118. There is now no way to easily see the changes since the last round of reviews. You're forcing the reviewer to start from scratch; throwing away the anchors to all the prior comments; etc.

I'm sorry for that. It spans too long time for this pull request for me to remember the rules..

derekbruening

Looks good if additional sanity test cases are added which should be straightforward.

core/ir/aarch64/instr_create_api.h

core/lib/instrument.c

suite/tests/client-interface/count-ctis.c

…gister

suite/tests/client-interface/count-ctis.c

To test the new cbr instrumentation of AARCH64, add additional branch pc check: dst == src + 0x8, and direction check to count-ctis. Region of interest is marked via nop; nop; add; nop sequence. The triple nops pattern does not work, because it also appears in other places.

derekbruening

LGTM: Thank you for improving the test, this gives more confidence the API works and gives us a good regression test to detect unforeseen issues with future code changes.

derekbruening · 2025-05-19T16:48:01Z

I've sent you an invite to gain commit access. You can then merge here (need to resolve all the conversations by clicking Resolve first). You can then use branches on this DynamoRIO/dynamorio repository directly rather than a clone.

AssadHashmi reviewed Sep 25, 2024

View reviewed changes

core/ir/aarch64/instr_create_api.h Show resolved Hide resolved

core/ir/aarch64/instr_create_api.h Outdated Show resolved Hide resolved

AssadHashmi requested a review from derekbruening September 25, 2024 21:35

derekbruening reviewed Sep 26, 2024

View reviewed changes

jiegec added 7 commits May 10, 2025 15:20

i#2297: AARCH64: Implement cbr instrumentation

94d4480

Implement cbr instrumentation for AARCH64, supporting cbz/cbnz/tbz/tbnz/bcond opcodes. Issue: DynamoRIO#2297

i#2297: Document and refactor new instr_create_api for AARCH64

a0d3d8d

Document newly added instruction creation macros for EOR, CSINC and UBFM. Refactor XINST_CREATE_slr_s to use the new macro to create ubfm instruction. Fixes DynamoRIO#2297

i#2297: Enable cbr tests on AARCH64

24bfbc1

i#2297: Refactor code and conform to code style

166cfb6

i#2297: Add AARCH64 support to count-ctis test

1302d4c

i#2919: AARCH64: Implement mbr instrumentation

a8737de

Issue: DynamoRIO#2919

i#2297: Add XXX comments to note different impls

d9222e1

jiegec force-pushed the i2297-cbr-aarch64 branch from f02728e to d9222e1 Compare May 10, 2025 07:33

jiegec changed the title ~~i#2297: AARCH64: Implement cbr instrumentation~~ i#2297: AARCH64: Implement mbr & cbr instrumentation May 10, 2025

i#2297: Fix cbr instrumentation when reg is stolen

e9980ab

jiegec requested a review from derekbruening May 13, 2025 05:53

derekbruening approved these changes May 15, 2025

View reviewed changes

core/ir/aarch64/instr_create_api.h Show resolved Hide resolved

core/lib/instrument.c Outdated Show resolved Hide resolved

suite/tests/client-interface/count-ctis.c Outdated Show resolved Hide resolved

suite/tests/client-interface/count-ctis.c Outdated Show resolved Hide resolved

jiegec added 3 commits May 15, 2025 16:03

i#2297: Use instr_get_target to simplify code to get target address

ed7cfd0

i#2297: Drop unnecessary includes brought in by IDE

e8cfde7

i#2297: Add different types of cbr to count-ctis, w/ or w/o stolen re…

4122afb

…gister

jiegec requested a review from derekbruening May 15, 2025 09:14

derekbruening approved these changes May 15, 2025

View reviewed changes

suite/tests/client-interface/count-ctis.c Outdated Show resolved Hide resolved

jiegec requested a review from derekbruening May 18, 2025 12:06

jiegec added 2 commits May 18, 2025 20:08

i#2297: Fix code format

0fbd5f9

i#2297: Fix compilation on non-aarch64 platform

9109f4b

derekbruening approved these changes May 19, 2025

View reviewed changes

jiegec merged commit 58cb327 into DynamoRIO:master May 19, 2025
24 checks passed

This was referenced May 19, 2025

AARCHXX: Implement dr_insert_mbr_instrumentation #2919

Open

Implement dr_insert_cbr_instrumentation on ARM & AArch64 #2297

Open

i#2297: AARCH64: Implement mbr & cbr instrumentation #7005

i#2297: AARCH64: Implement mbr & cbr instrumentation #7005

Uh oh!

Conversation

jiegec commented Sep 25, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

derekbruening left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jiegec commented Oct 28, 2024

Uh oh!

derekbruening commented Oct 28, 2024

Uh oh!

jiegec commented May 10, 2025

Uh oh!

jiegec commented May 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jiegec commented May 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

derekbruening commented May 13, 2025

Uh oh!

derekbruening commented May 13, 2025

Uh oh!

jiegec commented May 14, 2025

Uh oh!

derekbruening left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

derekbruening left a comment

Choose a reason for hiding this comment

Uh oh!

derekbruening commented May 19, 2025

Uh oh!

Uh oh!

Uh oh!

jiegec commented Sep 25, 2024 •

edited

Loading

jiegec commented May 10, 2025 •

edited

Loading

jiegec commented May 10, 2025 •

edited

Loading