Re: [Valgrind-users] Question about Valgrind tool implementation

[Philippe W. <phi...@sk...>]

On Thu, 2013-09-05 at 16:01 +0900, Chang-Jae Lee wrote:
> Hi,
> 
> 
>  I am a grad-student in KAIST, and I'm working on a project for
> finding bugs or errors.
> Currently I'm following a routine from the paper "Execution
> Suppression: An Automated Iterative Technique for Locating Memory
> Errors." 
> It is about finding the root cause of memory error(s) when a program
> shows a crash, 
> by suppressing the code statement which defines that memory location 
> and subsequent statements using the location and restart the program,
> until no crash happens.
> So what I need here is,
> 
> 
> - How can I handle target application's segmentation fault in my tool?
> First I ran my target with Lackey and it gets SIGSEGV, alerts to me,
> and returns 0, but the last thing it does is saying that it was
> terminated with segmentation fault. here I attached the log of Lackey.

>From what I can see, you will have to modify Valgrind "core" to let
the tool "intercept" the guest signals.
At first sight, your tool might install a fault_catcher
using VG_(set_fault_catcher).
However, currently, such a fault catcher can only run in non generated
code (see sync_signalhandler_from_kernel). You might have to change
that.

Maybe some other changes will be needed (such as allowing the fault
catcher to indiate that the signal is not to be propagated.

You will find a current use of such a fault catcher in memcheck
(mc_leakcheck.c), but however not in generated code.



> 
> - I need to suppress instructions which stands for a single code
> statement, like defining pointers or accessing particular memory
> addresses.
> Looks like the core connects debug information if there is one. Then,
> how does the tool recognize it (like memcheck does)? Is VEX IR
> superblock contains about it?
Not too sure about what you mean with the above. Valgrind works
at binary level, it does not really have a notion of "statement".
For example, if in the code you have:
f()
{
   char *ptr1;
   char *ptr2;

these two "statements" will just be part of the stack setup
(e.g. change the stack pointer) and so there is no way to
"remove" the instruction corresponding to
e.g. only the first "ptr definition".


As I do not understand the tool you have to write, I have no idea
how to best do what you need.


Philippe