Handles various invariant errors seen in system call trace templates collected on x86 QEMU.
Modifies syscall trace template file format to use the TRACE_MARKER_TYPE_SYSCALL_TRACE_START and TRACE_MARKER_TYPE_SYSCALL_TRACE_END markers to show start and end respectively of each syscall trace template, instead of separating them using a TRACE_MARKER_TYPE_SYSCALL marker. This makes it easier to write invariant checks that also work for the syscall trace template file (in addition to an actual trace file injected with trace templates).
Handles cases where there are a different number of read/write records than expected by the decoder; after iret, variants of xrstor, variants of xsaves, and prefetch instrs.
Relaxes the PC discontinuity check after hlt, and within two instrs of sti (which enables interrupts, so there may be an interrupt shortly after, as seen in some QEMU syscall trace templates).
Makes other misc changes to make sure the syscall trace template file passes the invariant checker: add thread exit (since we already have a thread start), relaxation of various invariant checks.
Adds and implements the instr_is_xrstor API that identifies variants of the xrstor opcode, and adds supervisor versions of xsave to instr_is_xsave.
Adds unit tests for these new scenarios. Added a TODO to handle other arch equivalent versions of these scenarios.
Adds a new flag -abort_on_invariant_error which is true by default, to allow the user to instruct the invariant checker to continue past invariant errors (using -no_abort_on_invariant_error). This is helpful since there are still a few instances of some invariant errors in the syscall trace template that are harder to generalize and fix/ignore.
Handles various invariant errors seen in system call trace templates collected on x86 QEMU.
Modifies syscall trace template file format to use the TRACE_MARKER_TYPE_SYSCALL_TRACE_START and TRACE_MARKER_TYPE_SYSCALL_TRACE_END markers to show start and end respectively of each syscall trace template, instead of separating them using a TRACE_MARKER_TYPE_SYSCALL marker. This makes it easier to write invariant checks that also work for the syscall trace template file (in addition to an actual trace file injected with trace templates).
Handles cases where there are a different number of read/write records than expected by the decoder; after iret, variants of xrstor, variants of xsaves, and prefetch instrs.
Relaxes the PC discontinuity check after hlt, and within two instrs of sti (which enables interrupts, so there may be an interrupt shortly after, as seen in some QEMU syscall trace templates).
Makes other misc changes to make sure the syscall trace template file passes the invariant checker: add thread exit (since we already have a thread start), relaxation of various invariant checks.
Adds and implements the instr_is_xrstor API that identifies variants of the xrstor opcode, and adds supervisor versions of xsave to instr_is_xsave.
Adds unit tests for these new scenarios. Added a TODO to handle other arch equivalent versions of these scenarios.
Adds a new flag
-abort_on_invariant_errorwhich is true by default, to allow the user to instruct the invariant checker to continue past invariant errors (using-no_abort_on_invariant_error). This is helpful since there are still a few instances of some invariant errors in the syscall trace template that are harder to generalize and fix/ignore.Issue: #6495