* Copyright (c) 2010-2022 Google, Inc. All rights reserved.
* Copyright (c) 2011 Massachusetts Institute of Technology All rights reserved.
* Copyright (c) 2003-2010 VMware, Inc. All rights reserved.
* *******************************************************************************/
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
*
* * Redistributions of source code must retain the above copyright notice,
* this list of conditions and the following disclaimer.
*
* * Redistributions in binary form must reproduce the above copyright notice,
* this list of conditions and the following disclaimer in the documentation
* and/or other materials provided with the distribution.
*
* * Neither the name of VMware, Inc. nor the names of its contributors may be
* used to endorse or promote products derived from this software without
* specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL VMWARE, INC. OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
* DAMAGE.
*/
* optionsx.h
*
* Options and corresponding command line options
*
*/
- in globals.h once for structure definition,
- in options.c, four times: for initialization, option parsing and enumeration
- TODO: should also be included in the GUI
*/
#define OPTION_COMMAND(type, name, default_value, command_line_option, \
statement, description, dynamic_flag, pcache)
#include "optionsx.h"
#undef OPTION_COMMAND
dynamic_flag takes the values
DYNAMIC - option can be modified externally
STATIC - option cannot be modified externally and changes are ignored
pcache takes values from op_pcache_t
*/
* and write to the "options" struct. It can also change other state
* but only inside of a check for the bool "for_this_process".
*/
* appended to if multiple option instances are specified
*/
#define OPTION_DEFAULT(type, name, value, description) \
OPTION_COMMAND(type, name, value, #name, {}, description, STATIC, OP_PCACHE_NOP)
#define OPTION_NAME_DEFAULT(type, name, value, option_name, description) \
OPTION_COMMAND(type, name, value, option_name, {}, description, STATIC, OP_PCACHE_NOP)
#define OPTION_NAME(type, name, option_name, description) \
OPTION_NAME_DEFAULT(type, name, 0, option_name, description)
#define OPTION(type, name, description) OPTION_DEFAULT(type, name, 0, description)
#define PC_OPTION_DEFAULT(type, name, value, description) \
OPTION_COMMAND(type, name, value, #name, {}, description, STATIC, OP_PCACHE_GLOBAL)
#define PC_OPTION(type, name, description) PC_OPTION_DEFAULT(type, name, 0, description)
#define PCL_OPTION_DEFAULT(type, name, value, description) \
OPTION_COMMAND(type, name, value, #name, {}, description, STATIC, OP_PCACHE_LOCAL)
#define PCL_OPTION(type, name, description) PCL_OPTION_DEFAULT(type, name, 0, description)
CHECK: if most options end up being dynamic just add a flag to the above */
#define DYNAMIC_OPTION_DEFAULT(type, name, value, description) \
OPTION_COMMAND(type, name, value, #name, {}, description, DYNAMIC, OP_PCACHE_NOP)
#define DYNAMIC_OPTION(type, name, description) \
DYNAMIC_OPTION_DEFAULT(type, name, 0, description)
#define DYNAMIC_PCL_OPTION_DEFAULT(type, name, value, description) \
OPTION_COMMAND(type, name, value, #name, {}, description, DYNAMIC, OP_PCACHE_LOCAL)
#define DYNAMIC_PCL_OPTION(type, name, description) \
DYNAMIC_PCL_OPTION_DEFAULT(type, name, 0, description)
value, Note we can't read the real type/description, and aliases are not transitive */
#define OPTION_ALIAS(new_alias, real_internal_name, real_value, dynamic_flag, pcache) \
OPTION_COMMAND( \
bool, new_alias##_aka_##real_internal_name, false, #new_alias, \
{ \
if (options->new_alias##_aka_##real_internal_name) \
options->real_internal_name = real_value; \
}, \
#new_alias " is an alias for " #real_internal_name, dynamic_flag, pcache)
define constants with default values that are used by INTERNAL_OPTION */
#define OPTION_DEFAULT_INTERNAL(type, name, value, description) \
OPTION_COMMAND_INTERNAL(type, name, value, #name, {}, description, STATIC, \
OP_PCACHE_NOP)
#define OPTION_NAME_INTERNAL(type, name, option_name, description) \
OPTION_COMMAND_INTERNAL(type, name, 0, option_name, {}, description, STATIC, \
OP_PCACHE_NOP)
#define OPTION_INTERNAL(type, name, description) \
OPTION_DEFAULT_INTERNAL(type, name, 0, description)
#define PC_OPTION_DEFAULT_INTERNAL(type, name, value, description) \
OPTION_COMMAND_INTERNAL(type, name, value, #name, {}, description, STATIC, \
OP_PCACHE_GLOBAL)
#define PC_OPTION_INTERNAL(type, name, description) \
PC_OPTION_DEFAULT_INTERNAL(type, name, 0, description)
#define DISABLE_RESET(prefix) \
{ \
(prefix)->enable_reset = false; \
IF_INTERNAL((prefix)->reset_at_fragment_count = 0;) \
(prefix)->reset_at_nth_thread = 0; \
(prefix)->reset_at_switch_to_os_at_vmm_limit = false; \
(prefix)->reset_at_vmm_percent_free_limit = 0; \
(prefix)->reset_at_vmm_free_limit = 0; \
(prefix)->reset_at_vmm_full = false; \
(prefix)->reset_at_commit_percent_free_limit = 0; \
(prefix)->reset_at_commit_free_limit = 0; \
(prefix)->reset_every_nth_pending = 0; \
(prefix)->reset_at_nth_bb_unit = 0; \
(prefix)->reset_at_nth_trace_unit = 0; \
(prefix)->reset_every_nth_bb_unit = 0; \
(prefix)->reset_every_nth_trace_unit = 0; \
}
#define REENABLE_RESET(prefix) \
{ \
(prefix)->enable_reset = true; \
(prefix)->reset_at_vmm_full = DEFAULT_OPTION_VALUE(reset_at_vmm_full); \
(prefix)->reset_every_nth_pending = \
DEFAULT_OPTION_VALUE(reset_every_nth_pending); \
(prefix)->reset_at_switch_to_os_at_vmm_limit = \
DEFAULT_OPTION_VALUE(reset_at_switch_to_os_at_vmm_limit); \
(prefix)->reset_at_vmm_percent_free_limit = \
DEFAULT_OPTION_VALUE(reset_at_vmm_percent_free_limit); \
(prefix)->reset_at_vmm_free_limit = \
DEFAULT_OPTION_VALUE(reset_at_vmm_free_limit); \
(prefix)->reset_at_commit_percent_free_limit = \
DEFAULT_OPTION_VALUE(reset_at_commit_percent_free_limit); \
(prefix)->reset_at_commit_free_limit = \
DEFAULT_OPTION_VALUE(reset_at_commit_free_limit); \
}
* reset_at_vmm_threshold reset_at_commit_threshold shouldn't be
* disabled in DISABLE_RESET but left under the main option
*/
#define DISABLE_TRACES(prefix) \
{ \
(prefix)->disable_traces = true; \
(prefix)->enable_traces = false; \
(prefix)->shared_traces = false; \
(prefix)->shared_trace_ibl_routine = false; \
(prefix)->bb_ibl_targets = true; \
}
#define REENABLE_TRACES(prefix) \
{ \
(prefix)->disable_traces = false; \
(prefix)->enable_traces = true; \
(prefix)->shared_traces = true; \
(prefix)->shared_trace_ibl_routine = true; \
(prefix)->bb_ibl_targets = false; \
}
#define ENABLE_SECURITY(prefix) \
{ \
options->native_exec = true; \
options->code_origins = true; \
options->ret_after_call = true; \
\
\
options->indirect_stubs = true; \
\
IF_RCT_IND_BRANCH( \
options->rct_ind_call = IF_WINDOWS_ELSE( \
OPTION_ENABLED | OPTION_BLOCK | OPTION_REPORT, OPTION_DISABLED);) \
IF_RCT_IND_BRANCH( \
options->rct_ind_jump = IF_WINDOWS_ELSE( \
OPTION_ENABLED | OPTION_BLOCK | OPTION_REPORT, OPTION_DISABLED);) \
IF_WINDOWS(options->apc_policy = \
OPTION_ENABLED | OPTION_BLOCK | OPTION_REPORT | OPTION_CUSTOM;) \
}
DYNAMIC_OPTION_DEFAULT(bool, dynamic_options, true, "dynamically update options")
#ifdef EXPOSE_INTERNAL_OPTIONS
OPTION_COMMAND_INTERNAL(
bool, dummy_version, 0, "version",
{
if (for_this_process)
print_file(STDERR, "<%s>\n", dynamorio_version_string);
},
"print version number", STATIC, OP_PCACHE_NOP)
#endif
PC_OPTION_INTERNAL(bool, nolink, "disable linking")
PC_OPTION_DEFAULT_INTERNAL(bool, link_ibl, true, "link indirect branches")
OPTION_INTERNAL(bool, tracedump_binary, "binary dump of traces (after optimization)")
OPTION_INTERNAL(bool, tracedump_text, "text dump of traces (after optimization)")
OPTION_INTERNAL(bool, tracedump_origins, "write out original instructions for each trace")
OPTION(bool, syntax_intel, "use Intel disassembly syntax")
OPTION(bool, syntax_att, "use AT&T disassembly syntax")
OPTION(bool, syntax_arm, "use ARM (32-bit) disassembly syntax")
OPTION(bool, syntax_riscv, "use RISC-V disassembly syntax")
OPTION(bool, decode_strict, "mark all known-invalid instructions as invalid")
OPTION(uint, disasm_mask, "disassembly style as a dr_disasm_flags_t bitmask")
OPTION_INTERNAL(bool, bbdump_tags, "dump tags, sizes, and sharedness of all bbs")
OPTION_INTERNAL(bool, gendump, "dump generated code")
OPTION_DEFAULT(bool, global_rstats, true, "enable global release-build statistics")
OPTION_DEFAULT_INTERNAL(bool, rstats_to_stderr, false,
"print the final global rstats to stderr")
OPTION_DEFAULT(pathstring_t, logdir, EMPTY_STRING, "directory for log files")
OPTION(bool, log_to_stderr, "log to stderr instead of files")
#ifdef DEBUG
* debug build for more information.
* FIXME: somehow restrict info we dump out to prevent IP leakage for INTERNAL=0?
* restrict loglevel to <= 2 for INTERNAL=0?
*/
yet we'll also have the initial value in options_t at the cost of 8 bytes */
OPTION_COMMAND(
uint, stats_logmask, 0, "logmask",
{
if (d_r_stats != NULL && for_this_process)
d_r_stats->logmask = options->stats_logmask;
},
"set mask for logging from specified modules", DYNAMIC, OP_PCACHE_NOP)
OPTION_COMMAND(
uint, stats_loglevel, 0, "loglevel",
{
if (d_r_stats != NULL && for_this_process)
d_r_stats->loglevel = options->stats_loglevel;
},
"set level of detail for logging", DYNAMIC, OP_PCACHE_NOP)
OPTION_INTERNAL(uint, log_at_fragment_count,
"start execution at loglevel 1 and raise to the specified -loglevel at "
"this fragment count")
OPTION_INTERNAL(
uint, go_native_at_bb_count,
"once this count is reached, each thread will go native when creating a new bb")
*/
OPTION_DEFAULT(uint, checklevel, 2, "level of asserts/consistency checks (PR 211887)")
OPTION_DEFAULT_INTERNAL(bool, thread_stats, true, "enable thread local statistics")
OPTION_DEFAULT_INTERNAL(bool, global_stats, true, "enable global statistics")
OPTION_DEFAULT_INTERNAL(
uint, thread_stats_interval, 10000,
"per-thread statistics dump interval in fragments, 0 to disable periodic dump")
OPTION_DEFAULT_INTERNAL(
uint, global_stats_interval, 5000,
"global statistics dump interval in fragments, 0 to disable periodic dump")
# ifdef HASHTABLE_STATISTICS
OPTION_DEFAULT_INTERNAL(bool, hashtable_study, true, "enable hashtable studies")
OPTION_DEFAULT_INTERNAL(bool, hashtable_ibl_stats, true,
"enable hashtable statistics for IBL routines")
OPTION_DEFAULT_INTERNAL(bool, hashtable_ibl_entry_stats, false,
"enable hashtable statistics per IBL entry")
OPTION_DEFAULT_INTERNAL(uint, hashtable_ibl_study_interval, 50,
"dump stats after some IBL entry additions")
OPTION_DEFAULT_INTERNAL(bool, stay_on_trace_stats, false,
"enable stay on trace statistics")
OPTION_DEFAULT_INTERNAL(bool, speculate_last_exit_stats, false,
"enable speculative last stay_on_trace_stats")
# endif
#endif
#ifdef KSTATS
OPTION_DEFAULT(bool, kstats, IF_DEBUG_ELSE_0(IF_X86_ELSE(true, false)),
"enable path timing statistics")
#endif
#ifdef DEADLOCK_AVOIDANCE
OPTION_DEFAULT_INTERNAL(bool, deadlock_avoidance, true,
"enable deadlock avoidance checks")
OPTION_DEFAULT_INTERNAL(
uint, mutex_callstack, 0 ,
"collect a callstack up to specified depth when a mutex is locked")
#endif
#ifdef CALL_PROFILE
OPTION(uint, prof_caller,
"collect caller data for instrumented routines to this depth")
#endif
#ifdef HEAP_ACCOUNTING
OPTION_DEFAULT_INTERNAL(bool, heap_accounting_assert, true,
"enable heap accounting assert")
#endif
#if defined(UNIX)
OPTION_NAME_INTERNAL(bool, profile_pcs, "prof_pcs", "pc-sampling profiling")
OPTION_DEFAULT_INTERNAL(uint_size, prof_pcs_heap_size, 24 * 1024,
"special heap size for pc-sampling profiling")
#else
# ifdef WINDOWS_PC_SAMPLE
OPTION_NAME(bool, profile_pcs, "prof_pcs", "pc-sampling profiling")
# endif
#endif
OPTION_DEFAULT(bool, opt_jit, false, "optimize translation of dynamically generated code")
#ifdef UNIX
OPTION_COMMAND(
pathstring_t, xarch_root, EMPTY_STRING, "xarch_root",
{
* the failed-takeover QEMU thread native, so we bundle that
* here for convenience. We target the common use case of a
* small app, for which we want a small timeout.
*/
if (options->xarch_root[0] != '\0') {
options->unsafe_ignore_takeover_timeout = true;
options->takeover_timeout_ms = 400;
}
},
"QEMU support: prefix to add to opened files for emulation; also sets "
"-unsafe_ignore_takeover_timeout and -takeover_timeout_ms 400",
STATIC, OP_PCACHE_NOP)
#endif
#ifdef EXPOSE_INTERNAL_OPTIONS
# ifdef PROFILE_RDTSC
OPTION_NAME_INTERNAL(bool, profile_times, "prof_times", "profiling via measuring time")
# endif
* client option strings to matter, so we check them separately
* from the general -persist_check_options.
*/
* versions (or by having some kind of true alias where _lib points to the other).
*/
OPTION_DEFAULT_INTERNAL(liststring_t, client_lib, EMPTY_STRING,
";-separated string containing client "
"lib paths, IDs, and options")
# ifdef X64
OPTION_COMMAND_INTERNAL(
liststring_t, client_lib64, EMPTY_STRING, "client_lib64",
{
snprintf(options->client_lib, BUFFER_SIZE_ELEMENTS(options->client_lib), "%s",
options->client_lib64);
NULL_TERMINATE_BUFFER(options->client_lib);
},
";-separated string containing client "
"lib paths, IDs, and options",
STATIC, OP_PCACHE_NOP )
# define ALT_CLIENT_LIB_NAME client_lib32
# else
OPTION_COMMAND_INTERNAL(
liststring_t, client_lib32, EMPTY_STRING, "client_lib32",
{
snprintf(options->client_lib, BUFFER_SIZE_ELEMENTS(options->client_lib), "%s",
options->client_lib32);
NULL_TERMINATE_BUFFER(options->client_lib);
},
";-separated string containing client "
"lib paths, IDs, and options",
STATIC, OP_PCACHE_NOP )
# define ALT_CLIENT_LIB_NAME client_lib64
# endif
OPTION_COMMAND_INTERNAL(liststring_t, ALT_CLIENT_LIB_NAME, EMPTY_STRING,
IF_X64_ELSE("client_lib32", "client_lib64"), {},
";-separated string containing client "
"lib paths, IDs, and options for other-bitwidth children",
STATIC, OP_PCACHE_GLOBAL)
* don't want to mess up any legacy tools that rely on hotp libs in
* regular loader list
*/
OPTION_DEFAULT_INTERNAL(bool, private_loader,
IF_STATIC_LIBRARY_ELSE(IF_WINDOWS_ELSE(true, false),
IF_MACOS_ELSE(false, true)),
"use private loader for clients and dependents")
# ifdef UNIX
* so use the runtime option to control the tls size.
*/
OPTION_DEFAULT_INTERNAL(uint, client_lib_tls_size, 1,
"number of pages used for client libraries' TLS memory")
* overhead if gdb is not attached, and if it is, we probably want to have
* symbols anyway.
*/
OPTION_DEFAULT_INTERNAL(bool, privload_register_gdb, true,
"register private loader DLLs with gdb")
# endif
# ifdef WINDOWS
OPTION_DEFAULT_INTERNAL(bool, privlib_privheap, true,
"redirect heap usage by private libraries to DR heap")
* Valid only with -private_loader.
* XXX: turning this option off is not supported. Should we remove it?
*/
OPTION_DEFAULT_INTERNAL(bool, private_peb, true,
"use private PEB + TEB fields for private libraries")
# endif
* manipulation events and sets some default options. We can't
* afford to check for this in our exported routines, so we allow
* ourselves to be used as a utility or standalone library
* regardless of this option.
* For the static library, we commit to use with code_api and enable
* it by default as it's more of a pain to set options with this model.
*/
OPTION_COMMAND_INTERNAL(
bool, code_api, IF_STATIC_LIBRARY_ELSE(true, false), "code_api",
{
if (options->code_api) {
options_enable_code_api_dependences(options);
}
},
"enable Code Manipulation API", STATIC, OP_PCACHE_NOP)
* default, so -probe_api by itself will give users the lightweight
* and more restricted version of the probe API. If users want the
* flexibility to place a probe anywhere, or if they also want code
* manipulation ability, they'll have to enable the code manip API
* as well. For simplicity, we assume they're willing to accept
* any associated performance hit (e.g., turning off elision), when
* enabling the code manip API.
*/
OPTION_COMMAND_INTERNAL(
bool, probe_api, false, "probe_api",
{
if (options->probe_api) {
IF_HOTP(options->hot_patching = true);
IF_HOTP(options->liveshields = false;)
IF_GBOP(options->gbop = 0;)
}
},
"enable Probe API", STATIC, OP_PCACHE_NOP)
# define DISABLE_PROBE_API(prefix) \
{ \
(prefix)->probe_api = false; \
IF_HOTP((prefix)->hot_patching = false;) \
}
* expose these separately (PR 225139), and fully support their
* robustness esp in presence of clients: for now we consider this
* less robust.
* FIXME: actually we can't turn elision on b/c it violates our
* translation and client trace building assumptions: plus Tim
* hit crashes w/ max_elide_call and code_api on in 32-bit linux.
* So leaving option here for now but not documenting it.
*/
OPTION_COMMAND(
bool, opt_speed, false, "opt_speed",
{
if (options->opt_speed) {
* so elision is the only thing left here, but -indcall2direct
* is significant on windows server apps.
*/
* with clients: but we risk it here.
*/
options->max_elide_jmp = 16;
options->max_elide_call = 16;
options->indcall2direct = true;
}
},
"enable high performance at potential loss in client fidelity", STATIC, OP_PCACHE_NOP)
OPTION_COMMAND(
bool, opt_memory, false, "opt_memory",
{
if (options->opt_memory) {
ENABLE_COARSE_UNITS(options);
}
},
"enable memory savings at potential loss in performance", STATIC, OP_PCACHE_NOP)
PC_OPTION_DEFAULT_INTERNAL(bool, bb_prefixes, IF_AARCH64_ELSE(true, false),
"give all bbs a prefix")
* requests a full decode regardless of whether there is a bb hook.
* Note that there is no way to make this available for non-CI builds
* yet be exposed in non-internal CI builds, so we make it CI-only.
*/
OPTION_INTERNAL(bool, full_decode, "decode all instrs to level 3 during bb building")
* use any libraries that need to see all instructions.
* Not officially supported yet: see i#805 and i#1112.
* Not compatible with DR_EMIT_STORE_TRANSLATIONS.
*/
OPTION_INTERNAL(bool, fast_client_decode,
"avoid full decoding even when clients are present (risky)")
#endif
#ifdef UNIX
OPTION_DEFAULT_INTERNAL(bool, separate_private_bss, true,
"place empty page to separate private lib .bss")
#endif
* 0 - no optimization
* 1 - callee's register usage analysis, e.g. use of XMM registers
* 2 - simple callee inline optimization,
* callee save reg analysis
* aflags usage analysis and optimization on the instrumented ilist
* 3 - more aggressive callee inline optimization
* All the optimizations assume that clean callee will not be changed
* later.
*/
OPTION_DEFAULT_INTERNAL(uint, opt_cleancall, IF_X86_ELSE(2, IF_AARCH64_ELSE(1, 0)),
"optimization level on optimizing clean call sequences")
* i.e., initialize the eflags before using it, we can skip the eflags
* clear code.
* Note: we still clear DF for string instructions.
* Note: this option is ignored for ARM.
*/
OPTION_DEFAULT(bool, cleancall_ignore_eflags, true,
"skip eflags clear code with assumption that clean call does not rely on "
"cleared eflags")
#ifdef X86
* On X86, we use -mangle_app_seg to control if we will steal app's TLS.
* If -mangle_app_seg is true, DR steals app's TLS and monitors/mangles all
* accesses to app's TLS. This provides better isolation between app and DR.
* Private loader and libraries (-private_loader) also relies on -mangle_app_seg
* for better transparency with separate copy of TLS used by client libraries.
*
* On ARM, we want to steal app's TLS for similar reason (better transparaency).
* In addition, because monitoring app's TLS is easier (we only need mangle simple
* thread register read instruction) and more robust (fewer assumptions about
* app's TLS layout for storing DR's TLS base), we decide to always steal the
* app's TLS, and so no option is needed. Also, we cannot easily handle
* raw threads created without CLONE_SETTLS without stealing TLS.
*/
* mangle the app's segment usage.
* It cannot be used with DGC_DIAGNOSTICS.
*/
OPTION_DEFAULT_INTERNAL(bool, mangle_app_seg,
IF_WINDOWS_ELSE(false, IF_LINUX_ELSE(true, false)),
"mangle application's segment usage.")
#endif
#ifdef X64
# ifdef WINDOWS
OPTION_DEFAULT(bool, inject_x64, false,
"Inject 64-bit DynamoRIO into 32-bit child processes.")
# endif
OPTION_COMMAND(
bool, x86_to_x64, false, "x86_to_x64",
{
* we do not support any cases of using decode_fragment, including
* trace and coarse_units (coarse-grain code cache management).
*/
if (options->x86_to_x64) {
DISABLE_TRACES(options);
DISABLE_COARSE_UNITS(options);
}
},
"translate x86 code to x64 when on a 64-bit kernel.", STATIC, OP_PCACHE_GLOBAL)
OPTION_DEFAULT(bool, x86_to_x64_ibl_opt, false,
"Optimize ibl code with extra 64-bit registers in x86_to_x64 mode.")
#endif
#ifdef AARCHXX
OPTION_DEFAULT_INTERNAL(uint, steal_reg, IF_X64_ELSE(28 , 10 ),
"the register stolen/used by DynamoRIO")
OPTION_DEFAULT_INTERNAL(uint, steal_reg_at_reset, 0, "reg to switch to at first reset")
* 0 - no optimization,
* 1 - simple optimization with fast and simple analysis for low overhead
* at instrumentation time,
* 2 - aggressive optimization with complex analysis for better performance
* at execution time.
*/
OPTION_DEFAULT_INTERNAL(uint, opt_mangle, 1,
"optimization level on optimizing mangle sequences")
#endif
#ifdef AARCH64
OPTION_DEFAULT_INTERNAL(bool, unsafe_build_ldstex, false,
"replace blocks using exclusive load/store with a "
"macro-instruction (unsafe)")
#endif
#ifdef AARCHXX
* + ldrexd..strexd.
* + Predicated exclusive loads or stores.
* It will continue with a debug build warning if it sees those.
*/
OPTION_DEFAULT_INTERNAL(bool, ldstex2cas, true,
"replace exclusive load/store with compare-and-swap to "
"allow instrumentation, at the risk of ABA errors")
#endif
#ifdef WINDOWS_PC_SAMPLE
OPTION_DEFAULT(uint, prof_pcs_DR, 2,
"PC profile dynamorio.dll, value is bit shift to use, < 2 or > 32 "
"disables, requires -prof_pcs")
OPTION_DEFAULT(uint, prof_pcs_gencode, 2,
"PC profile generated code, value is bit shift to use, < 2 or > 32 "
"disables, requires -prof_pcs")
OPTION_DEFAULT(uint, prof_pcs_fcache, 30,
"PC profile fcache units, value is bit shift to use, < 2 or > 32 "
"disables, requires -prof_pcs")
OPTION_DEFAULT(uint, prof_pcs_stubs, 30,
"PC profile separate stub units. Value is bit shift to use: < 2 or > 32 "
"disables. Requires -prof_pcs.")
OPTION_DEFAULT(uint, prof_pcs_ntdll, 30,
"PC profile ntdll.dll, value is bit shift to use, < 2 or > 32 disables, "
"requires -prof_pcs")
OPTION_DEFAULT(uint, prof_pcs_global, 30,
"PC profile global, value is bit shift to use, < 8 or > 32 sets to "
"default, requires -prof_pcs")
OPTION_DEFAULT(uint, prof_pcs_freq, 10000,
"Profiling sample frequency in 100's of nanoseconds, requires -prof_pcs")
#endif
DYNAMIC_OPTION_DEFAULT(
uint, msgbox_mask,
* we can't print to the cmd console. The user must explicitly disable
* for automation or running daemons.
*/
IF_WINDOWS_ELSE(IF_UNIT_TEST_ELSE(0, IF_AUTOMATED_ELSE(0, 0xC)), 0),
"show a messagebox for events")
#ifdef WINDOWS
OPTION_DEFAULT(uint_time, eventlog_timeout, 10000,
"gives the timeout (in ms) to use for an eventlog transaction")
#else
DYNAMIC_OPTION(bool, pause_via_loop,
"For -msgbox_mask, use an infinite loop instead of waiting for stdin")
#endif
DYNAMIC_OPTION_DEFAULT(uint, syslog_mask, 0,
"log only specified message types")
* -syslog_mask 0x6 - error and warning messages
*/
OPTION_DEFAULT_INTERNAL(uint, syslog_internal_mask,
0,
"log only specified internal message types")
OPTION_DEFAULT(
bool, syslog_init, false,
"initialize syslog, unnecessary if correctly installed")
product: true */
#ifdef WINDOWS
DYNAMIC_OPTION(uint, internal_detach_mask,
"indicates what events the core should detach from the app on")
#endif
* now what's packaged up. For test suites we can explicitly turn it on
* in the future by setting up some other define.
* Good defaults for Windows are 0x8bff, for Linux 0x837f
*/
DYNAMIC_OPTION_DEFAULT(uint, dumpcore_mask, 0, "indicate events to dump core on")
IF_UNIX(OPTION_ALIAS(pause_on_error, dumpcore_mask, DUMPCORE_OPTION_PAUSE, STATIC,
OP_PCACHE_NOP))
DYNAMIC_OPTION_DEFAULT(uint, dumpcore_violation_threshold, 3,
"maximum number of violations to core dump on")
DYNAMIC_OPTION_DEFAULT(
bool, live_dump, IF_WINDOWS_ELSE(true, IF_VMX86_ELSE(true, false)),
"do a live core dump (no outside dependencies) when warranted by the dumpcore_mask")
#ifdef WINDOWS
OPTION_INTERNAL(
bool, external_dump,
"do a core dump using an external debugger (specified in the ONCRASH registry value) "
"when warranted by the dumpcore_mask (kills process on win2k or w/ drwtsn32)")
#endif
#if defined(STATIC_LIBRARY) && defined(UNIX)
* If this were off by default it could be a dumpcore bitflag instead.
*/
OPTION_DEFAULT_INTERNAL(bool, invoke_app_on_crash, true,
"On a DR crash, invoke the app fault handler if it exists.")
#endif
OPTION_DEFAULT(uint, stderr_mask,
IF_DEBUG_ELSE(SYSLOG_ALL, SYSLOG_CRITICAL | SYSLOG_ERROR),
"show messages onto stderr")
OPTION_DEFAULT(uint, appfault_mask, IF_DEBUG_ELSE(APPFAULT_CRASH, 0),
"report diagnostic information on application faults")
#ifdef UNIX
* application tries to close them. */
OPTION_DEFAULT(bool, dup_stdout_on_close, true,
"Duplicate stdout for DynamoRIO "
"or client usage if app tries to close it.")
OPTION_DEFAULT(bool, dup_stderr_on_close, true,
"Duplicate stderr for DynamoRIO "
"or client usage if app tries to close it.")
OPTION_DEFAULT(bool, dup_stdin_on_close, true,
"Duplicate stdin for DynamoRIO "
"or client usage if app tries to close it.")
* No downside to raising since we'll let the app have ours if it
* runs out.
*/
OPTION_DEFAULT(uint, steal_fds, 96,
"number of fds to steal from the app outside the app's reach")
OPTION_DEFAULT(bool, fail_on_stolen_fds, true,
"return failure on app operations on fds preserved for DR's usage")
* to an app crash. */
OPTION_DEFAULT(bool, avoid_dlclose, true, "Avoid calling dlclose from DynamoRIO.")
OPTION_DEFAULT(bool, intercept_all_signals, true, "intercept all signals")
OPTION_DEFAULT(bool, reroute_alarm_signals, true,
"reroute alarm signals arriving in a blocked-for-app thread")
OPTION_DEFAULT(uint, max_pending_signals, 8,
"maximum count of pending signals per thread")
* context to a given state. Turning this off will instead use a direct
* mechanism that will set only the GPR's and will assume the target stack
* is valid and its beyond-TOS slot can be clobbered. X86-only.
*/
OPTION_DEFAULT_INTERNAL(bool, use_sigreturn_setcontext, true,
"use sigreturn to set a thread's context")
* avoids expensive reads of /proc/pid/maps, but if the cache becomes stale,
* we may have incorrect results.
* This option has no effect on platforms with a direct memory query, such
* as MacOS.
*/
OPTION_DEFAULT(bool, use_all_memory_areas, true,
"Use all_memory_areas "
"address space cache to query page protections.")
#endif
DYNAMIC_OPTION_DEFAULT(bool, diagnostics, false, "enable diagnostic reporting")
OPTION_DEFAULT(uint, max_supported_os_version, IF_WINDOWS_ELSE(105, IF_MACOS_ELSE(19, 0)),
* Windows 7 added with i#218
* Windows 8 added with i#565
* Windows 8.1 added with i#1203
* Windows 10 added with i#1714
*/
"Warn on unsupported (but workable) operating system versions greater "
"than max_supported_os_version")
OPTION_DEFAULT(
uint, os_aslr,
* we do not disable persistent caches b/c they're off by default
* anyway and if someone turns them on then up to him/her to understand
* that we don't have relocation support (i#661)
*/
0x1 ,
"disable selectively pcache or our ASLR when OS provides ASLR on most modules")
OPTION_DEFAULT_INTERNAL(uint, os_aslr_version, 60,
"minimal OS version to assume ASLR may be provided by OS")
OPTION_DEFAULT(uint_time, svchost_timeout, 1000,
"timeout (in ms) on an untimely unloaded library on Windows NT or Windows "
"2000")
374
*/
OPTION_DEFAULT(uint_time, deadlock_timeout,
IF_DEBUG_ELSE_0(60) * 3 * 1000,
"timeout (in ms) before assuming a deadlock had occurred (0 to disable)")
OPTION_DEFAULT(uint_size, stack_size,
* a larger stack even w/ no client present.
* 32KB is the max that will still allow sharing per-thread
* gencode in the same 64KB alloc as the stack on Windows.
*/
IF_MACOSA64_ELSE(32 * 1024, 24 * 1024),
"size of thread-private stacks, in KB")
#ifdef UNIX
OPTION_DEFAULT(uint_size, signal_stack_size, 24 * 1024,
"size of signal handling stacks, in KB")
#endif
* on Linux.
* FIXME PR 403008: stack_shares_gencode fails on vmkernel
*/
OPTION_DEFAULT(bool, stack_shares_gencode,
* that aren't nec reachable. Plus, client stacks are big
* enough now (56K) that this option was internally never triggered.
*/
false,
"stack and thread-private generated code share an allocation region")
OPTION_DEFAULT(uint, spinlock_count_on_SMP, 1000U, "spinlock loop cycles on SMP")
instead of yielding and waiting on a kernel object. See Robbins for a discussion on a
good value for the above -
it should be based on expectations on how long does it take to finish a task. */
* in the initial thread. However, we can have races if a new thread
* appears for which we did not see the creation call: e.g., for a nudge,
* or any other externally-created thread. Thus this is off by default.
*/
OPTION_INTERNAL(bool, nop_initial_bblock,
"nop bb building lock until 2nd thread is created")
PC_OPTION_INTERNAL(bool, nullcalls, "do not take over")
OPTION_COMMAND_INTERNAL(
uint, trace_threshold, 50U, "trace_threshold",
{ options->disable_traces = options->trace_threshold == 0; },
"hot threshold value for trace creation", STATIC, OP_PCACHE_NOP)
* -enable_traces to turn them on; plus, -probe and -security
* turn them on.
* We mark as pcache-affecting though we have other explicit checks
*/
OPTION_COMMAND(
bool, disable_traces, IF_X86_ELSE(false, true), "disable_traces",
{
if (options->disable_traces) {
DISABLE_TRACES(options);
}
},
"disable trace creation (block fragments only)", STATIC, OP_PCACHE_GLOBAL)
OPTION_COMMAND(
bool, enable_traces, IF_X86_ELSE(true, false), "enable_traces",
{
if (options->enable_traces) {
REENABLE_TRACES(options);
}
},
"enable trace creation", STATIC, OP_PCACHE_GLOBAL)
OPTION_DEFAULT_INTERNAL(
uint, trace_counter_on_delete, 0U,
"trace head counter will be reset to this value upon trace deletion")
OPTION_DEFAULT(uint, max_elide_jmp, 16, "maximum direct jumps to elide in a basic block")
OPTION_DEFAULT(uint, max_elide_call, 16, "maximum direct calls to elide in a basic block")
OPTION_DEFAULT(bool, elide_back_jmps, true,
"elide backward unconditional jumps in basic blocks?")
OPTION_DEFAULT(bool, elide_back_calls, true,
"elide backward direct calls in basic blocks?")
* with pattern reverify from case 4020. Though if too big can cause issues
* with max bb size (even 64 may be too big), xref case 7893. */
OPTION_DEFAULT(uint, selfmod_max_writes, 5, "maximum write instrs per selfmod fragment")
* "exceeded maximum size" failure.
*/
OPTION_DEFAULT(uint, max_bb_instrs, 256, "maximum instrs per basic block")
PC_OPTION_DEFAULT(bool, process_SEH_push, IF_RETURN_AFTER_CALL_ELSE(true, false),
"break bb's at an SEH push so we can see the frame pushed on in "
"interp, required for -borland_SEH_rct")
OPTION_DEFAULT_INTERNAL(
bool, check_for_SEH_push, true,
"extra debug build checking to ensure -process_SEH_push is catching "
"all SEH frame pushes")
PC_OPTION_DEFAULT(bool, shared_bbs, IF_HAVE_TLS_ELSE(true, false),
"use thread-shared basic blocks")
* off -shared_traces to avoid tripping over un-initialized ibl tables
* PR 361894: if no TLS available, we fall back to thread-private
*/
OPTION_COMMAND(
bool, shared_traces, IF_HAVE_TLS_ELSE(IF_X86_ELSE(true, false), false),
"shared_traces",
{
* traces: */
IF_NOT_X64_OR_ARM(options->private_ib_in_tls = options->shared_traces;)
options->atomic_inlined_linking = options->shared_traces;
options->shared_trace_ibl_routine = options->shared_traces;
* measure it: FIXME */
if (!options->shared_traces && options->indirect_stubs)
options->inline_trace_ibl = true;
IF_NOT_X64(IF_WINDOWS(options->shared_fragment_shared_syscalls =
(options->shared_traces && options->shared_syscalls);))
},
"use thread-shared traces", STATIC, OP_PCACHE_GLOBAL)
OPTION_COMMAND(
bool, thread_private, IF_HAVE_TLS_ELSE(false, true), "thread_private",
{
options->shared_bbs = !options->thread_private;
options->shared_traces = !options->thread_private;
*/
options->finite_bb_cache = !options->thread_private;
options->finite_trace_cache = !options->thread_private;
if (options->thread_private && options->indirect_stubs) {
IF_NOT_ARM(options->coarse_units = true);
}
IF_NOT_X64_OR_ARM(options->private_ib_in_tls = !options->thread_private;)
options->atomic_inlined_linking = !options->thread_private;
options->shared_trace_ibl_routine = !options->thread_private;
* measure it: FIXME */
if (options->thread_private && options->indirect_stubs)
options->inline_trace_ibl = true;
IF_NOT_X64(
IF_WINDOWS(options->shared_fragment_shared_syscalls =
(!options->thread_private && options->shared_syscalls)));
* the cost of individual frees on thread exit (i#4334) for
* more compact caches. (ARM can't reach, so x86-only.)
*/
IF_X86(options->separate_private_stubs = !options->thread_private);
IF_X86(options->free_private_stubs = !options->thread_private);
},
"use thread-private code caches", STATIC, OP_PCACHE_GLOBAL)
OPTION_DEFAULT_INTERNAL(bool, remove_shared_trace_heads, true,
"remove a shared trace head replaced with a trace")
OPTION_DEFAULT(bool, remove_trace_components, false, "remove bb components of new traces")
OPTION_DEFAULT(bool, shared_deletion, true, "enable shared fragment deletion")
OPTION_DEFAULT(bool, syscalls_synch_flush, true,
"syscalls are flush synch points (currently for shared_deletion only)")
OPTION_DEFAULT(uint, lazy_deletion_max_pending, 128,
"maximum size of lazy shared deletion list before moving to normal list")
OPTION_DEFAULT(bool, free_unmapped_futures, true,
"free futures on app mem dealloc (potential perf hit)")
* and for x64 (PR 244737, PR 215396)
* PR 361894: if no TLS available, we fall back to thread-private
*/
* ibl using tls when any fragments are shared
*/
PC_OPTION_DEFAULT(bool, private_ib_in_tls,
IF_HAVE_TLS_ELSE(true, IF_X64_ELSE(true, false)),
"use tls for indirect branch slot in private caches")
OPTION_INTERNAL(bool, single_thread_in_DR, "only one thread in DR at a time")
* For x86, we avoid separate private stubs when they are rare due to shared
* caches being on by default, to avoid having to walk and free individual fragments
* in order to free the stubs on thread exit (i#4334).
*/
OPTION_DEFAULT(bool, separate_private_stubs, false,
"place private direct exit stubs in a separate area from the code cache")
OPTION_DEFAULT(bool, separate_shared_stubs, IF_X86_ELSE(true, false),
"place shared direct exit stubs in a separate area from the code cache")
OPTION_DEFAULT(bool, free_private_stubs, false,
"free separated private direct exit stubs when not pointed at")
* linking atomicity. (case 2081). */
OPTION_DEFAULT(bool, unsafe_free_shared_stubs, false,
"free separated shared direct exit stubs when not pointed at")
* be shared with an unlinked fall-through. If we switch to allowing
* "ldr pc, [pc + X]" as an exit cti we can turn this back on for 32-bit ARM.
*/
OPTION_DEFAULT_INTERNAL(bool, cbr_single_stub, IF_X86_ELSE(true, false),
"both sides of a cbr share a single stub")
* Core2, and on IIS on P4. Note that this gets disabled if
* coarse_units is on (PR 213262 covers supporting it there).
*/
* avoid a stub unless we use "ldr pc, [r10+offs]" as an exit cti, which
* complicates the code that handles exit ctis and doesn't work for A64.
*/
OPTION_COMMAND(
bool, indirect_stubs, IF_X86_ELSE(false, true), "indirect_stubs",
{
* though should re-measure whether inlining is worthwhile */
if (options->thread_private && options->indirect_stubs) {
options->inline_trace_ibl = true;
options->coarse_units = true;
}
},
"use indirect stubs to keep source information", STATIC, OP_PCACHE_GLOBAL)
* don't turn this on (need atomic linking for trace building in a shared
* cache) without turning on atomic_inlined_linking,
* should be ok for traces since ?think? only need atomic unlinking
* there (for flushing), reconsider esp. if we go to a shared trace cache
*/
OPTION_DEFAULT(bool, inline_bb_ibl, false, "inline head of ibl routine in basic blocks")
OPTION_DEFAULT(bool, atomic_inlined_linking, IF_HAVE_TLS_ELSE(true, false),
"make linking of inlined_ibls atomic with respect to thread in the cache, "
"required for inline_{bb,traces}_ibl with {bb,traces} being shared, cost "
"is an extra 7 bytes per inlined stub (77 bytes instead of 70)")
OPTION_DEFAULT(bool, inline_trace_ibl, false, "inline head of ibl routine in traces")
OPTION_DEFAULT(bool, shared_bb_ibt_tables, false, "use thread-shared BB IBT tables")
OPTION_DEFAULT(bool, shared_trace_ibt_tables, false, "use thread-shared trace IBT tables")
OPTION_DEFAULT(bool, ref_count_shared_ibt_tables, true,
"use ref-counting to free thread-shared IBT tables prior to process exit")
OPTION_DEFAULT(bool, ibl_table_in_tls, IF_HAVE_TLS_ELSE(true, false),
"use TLS to hold IBL table addresses & masks")
OPTION_DEFAULT(bool, bb_ibl_targets, IF_X86_ELSE(false, true), "enable BB to BB IBL")
* simultaneously since the restore of %eax in the former case means that the
* 2nd flags restore in the full prefix would be wrong. So if the BB table
* is including trace targets, bb_single_restore_prefix and
* trace_single_restore_prefix must be the same value. See options.c for
* what is currently done for options compatibility.
*/
OPTION(bool, bb_ibt_table_includes_traces, "BB IBT tables holds trace targets also")
PC_OPTION(bool, bb_single_restore_prefix, "BBs use single restore prefixes")
OPTION(bool, trace_single_restore_prefix, "Traces use single restore prefixes")
OPTION_DEFAULT_INTERNAL(
uint, rehash_unlinked_threshold, 100,
"%-age of #unlinked entries to trigger a rehash of a shared BB IBT table")
OPTION_DEFAULT_INTERNAL(bool, rehash_unlinked_always, false,
"always rehash a shared BB IBT table when # unlinked entries > 0")
#ifdef SHARING_STUDY
OPTION_COMMAND_INTERNAL(
bool, fragment_sharing_study, false, "fragment_sharing_study",
{
if (options->fragment_sharing_study) {
options->shared_bbs = false;
options->shared_traces = false;
IF_NOT_X64(IF_WINDOWS(options->shared_fragment_shared_syscalls = false;))
IF_NOT_X64_OR_ARM(options->private_ib_in_tls = false;)
options->shared_trace_ibl_routine = false;
options->finite_bb_cache = false;
options->finite_trace_cache = false;
}
},
"counts duplication of bbs and traces among threads (requires all-private fragments)",
STATIC, OP_PCACHE_NOP)
#endif
OPTION_COMMAND(
bool, shared_bbs_only, false, "shared_bbs_only",
{
if (options->shared_bbs_only) {
DISABLE_TRACES(options);
options->shared_bbs = true;
options->private_ib_in_tls = true;
}
},
"Run in shared BBs, no traces mode", STATIC, OP_PCACHE_NOP)
OPTION_DEFAULT(bool, shared_trace_ibl_routine,
IF_HAVE_TLS_ELSE(IF_X86_ELSE(true, false), false),
"share ibl routine for traces")
OPTION_DEFAULT(bool, speculate_last_exit, false,
"enable speculative linking of trace last IB exit")
OPTION_DEFAULT(uint, max_trace_bbs, 128, "maximum number of basic blocks in a trace")
OPTION_DEFAULT(
uint, protect_mask,
IF_STATIC_LIBRARY_ELSE(
0x100 ,
IF_MACOSA64_ELSE(0,
IF_WINDOWS_ELSE(0x101 ,
0x100 ))),
"which memory regions to protect")
OPTION_INTERNAL(bool, single_privileged_thread,
"suspend all other threads when one is out of cache")
OPTION_DEFAULT_INTERNAL(uint, alt_hash_func, 1,
"use to select alternate hashing functions for all fragment "
"tables except those that have in cache lookups")
OPTION_DEFAULT(
uint, ibl_hash_func_offset, 0,
* for indcall hashtables).
* This may change the hash function distribution and for offsets
* larger than 3 (4 on x64) will add an extra instruction to the IBL hit path.
*/
"mask out lower bits in IBL table hash function")
OPTION_DEFAULT(uint, ibl_indcall_hash_offset, IF_X64_ELSE(4, 0),
"mask out lower bits in indcall IBL table hash function")
OPTION_DEFAULT_INTERNAL(
uint, shared_bb_load,
* hurt us lot (case 1677) when we hit a bad hash function distribution -
* My current theory is that since modules addresses are 64KB
* aligned we are doing bad on the 16-bit capacity.
*/
55, "load factor percent for shared bb hashtable")
OPTION_DEFAULT_INTERNAL(uint, shared_trace_load,
55, "load factor percent for shared trace hashtable")
OPTION_DEFAULT_INTERNAL(uint, shared_future_load,
60, "load factor percent for shared future hashtable")
OPTION_DEFAULT(uint, shared_after_call_load,
80, "load factor percent for after call hashtables")
OPTION_DEFAULT(uint, global_rct_ind_br_load,
80, "load factor percent for global rct ind branch hashtable")
OPTION_DEFAULT_INTERNAL(uint, private_trace_load,
* we can probably use higher than \alpha = 1/2
*/
55, "load factor percent for private trace hashtables")
OPTION_DEFAULT(uint, private_ibl_targets_load,
* we started with \alpha = 1/2,
* 40 seemed to be the best tradeoff of memory & perf for
* crafty, which is of course our primary nemesis.
* Increasing to accommodate IIS for private tables.
* FIXME: case 4902 this doesn't really control the effective load.
*/
50, "load factor percent for private ibl target trace hashtables")
OPTION_DEFAULT(uint, private_bb_ibl_targets_load,
*/
60, "load factor percent for private ibl hashtables targeting shared bbs")
OPTION_DEFAULT(uint, shared_ibt_table_trace_init, 7,
"Shared trace shared IBT tables initial size, log_2 (in bits)")
OPTION_DEFAULT(uint, shared_ibt_table_bb_init, 7,
"Shared BB shared IBT tables initial size, log_2 (in bits)")
OPTION_DEFAULT(uint, shared_ibt_table_trace_load, 50,
"load factor percent for shared ibl hashtables targeting shared traces")
OPTION_DEFAULT(uint, shared_ibt_table_bb_load, 70,
"load factor percent for shared ibl hashtables targeting shared bbs")
OPTION_DEFAULT(uint, coarse_htable_load,
80, "load factor percent for all coarse module hashtables")
OPTION_DEFAULT(uint, coarse_th_htable_load,
80, "load factor percent for all coarse module trace head hashtables")
OPTION_DEFAULT(uint, coarse_pclookup_htable_load,
80, "load factor percent for all coarse module trace head hashtables")
OPTION_DEFAULT(
uint, bb_ibt_groom,
0, "groom factor percent for ibl hashtables targeting bb's")
OPTION_DEFAULT(uint, trace_ibt_groom,
* since traces are considered hot already, grooming the table may not work
* as well here
*/
0, "groom factor percent for ibl hashtables targeting traces")
OPTION_DEFAULT(uint, private_trace_ibl_targets_init, 7,
"Trace IBL tables initial size, log_2 (in bits)")
OPTION_DEFAULT(uint, private_bb_ibl_targets_init, 6,
"BB IBL tables initial size, log_2 (in bits)")
*/
OPTION_DEFAULT(uint, private_trace_ibl_targets_max, 0,
"Trace IBL tables maximum size, log_2 (in bits)")
OPTION_DEFAULT(uint, private_bb_ibl_targets_max, 0,
"BB IBL tables maximum size, log_2 (in bits)")
OPTION_DEFAULT_INTERNAL(uint, private_bb_load,
60, "load factor percent for private bb hashtables")
OPTION_DEFAULT_INTERNAL(uint, private_future_load,
65, "load factor percent for private future hashtables")
OPTION_DEFAULT_INTERNAL(bool, spin_yield_rwlock, false,
"use old spin-yield rwlock implementation")
OPTION_INTERNAL(bool, simulate_contention,
"simulate lock contention for testing purposes only")
* We assume that our reservations cover 99% of the usage, and that we do not
* need to tune our sizes for standalone allocations where we would want 64K
* units for Windows. If we exceed the reservations we'll end up with less
* efficient sizing, but that is worth the simpler and cleaner common case
* sizing. We save a lot of wasted alignment space by using a smaller
* granularity (PR 415959, i#2575) and we avoid the complexity of adding guard
* pages while maintaining larger-than-page sizing (i#2607).
*
* vmm_block_size may be adjusted by adjust_defaults_for_page_size().
*/
OPTION_DEFAULT(uint_size, vmm_block_size, 4 * 1024,
"allocation unit for virtual memory manager")
OPTION_DEFAULT(uint_size, initial_heap_unit_size, 24 * 1024,
"initial private heap unit size")
* non-persistent heap which often stays under 12K (i#2575).
*/
OPTION_DEFAULT(uint_size, initial_heap_nonpers_size, IF_WINDOWS_ELSE(24, 12) * 1024,
"initial private non-persistent heap unit size")
OPTION_DEFAULT(uint_size, initial_global_heap_unit_size, 24 * 1024,
"initial global heap unit size")
* DR areas and subsequent problems with DR areas and allmem synch (i#369)
*/
OPTION_DEFAULT_INTERNAL(uint_size, max_heap_unit_size, 256 * 1024,
"maximum heap unit size")
OPTION_DEFAULT(uint_size, heap_commit_increment, 4 * 1024, "heap commit increment")
OPTION_DEFAULT(uint_size, cache_commit_increment, 4 * 1024, "cache commit increment")
* FIXME: these are external for now while we study the right way to
* tune them for server apps as well as desktop apps
* Should we make then internal again once we're happy with the defaults?
*
* FIXME: unit params aren't that user-friendly -- there's an ordering required:
* init < quadruple < max && init < upgrade < max
* We complain if that's violated, but if you just set max we make you go and
* set the others instead of forcing the others to be ==max.
*
* FIXME: now that we have cache commit-on-demand we should make the
* private-configuration caches larger. We could even get rid of the
* fcache shifting.
*/
OPTION(uint_size, cache_bb_max, "max size of bb cache, in KB or MB")
* our temp private bbs
*/
* We no longer need to hit 64K since VMM blocks are now 4K, but we keep the
* sizes to match historical values and to avoid i#4433.
*/
OPTION_DEFAULT(uint_size, cache_bb_unit_init, (IF_X64_ELSE(56, 4) * 1024),
"initial bb cache unit size, in KB or MB")
OPTION_DEFAULT(uint_size, cache_bb_unit_max, (56 * 1024),
"maximum bb cache unit size, in KB or MB")
OPTION_DEFAULT(uint_size, cache_bb_unit_quadruple, (56 * 1024),
"bb cache units are grown by 4X until this size, in KB or MB")
OPTION(uint_size, cache_trace_max, "max size of trace cache, in KB or MB")
OPTION_DEFAULT(uint_size, cache_trace_unit_init, (IF_X64_ELSE(56, 8) * 1024),
"initial trace cache unit size, in KB or MB")
OPTION_DEFAULT(uint_size, cache_trace_unit_max, (56 * 1024),
"maximum trace cache unit size, in KB or MB")
OPTION_DEFAULT(uint_size, cache_trace_unit_quadruple, (IF_X64_ELSE(56, 32) * 1024),
"trace cache units are grown by 4X until this size, in KB or MB")
OPTION(uint_size, cache_shared_bb_max, "max size of shared bb cache, in KB or MB")
OPTION_DEFAULT(uint_size, cache_shared_bb_unit_init, (56 * 1024),
should be 32*1024 */
"initial shared bb cache unit size, in KB or MB")
OPTION_DEFAULT(uint_size, cache_shared_bb_unit_max, (56 * 1024),
"maximum shared bb cache unit size, in KB or MB")
OPTION_DEFAULT(uint_size, cache_shared_bb_unit_quadruple,
(56 * 1024),
"shared bb cache units are grown by 4X until this size, in KB or MB")
OPTION(uint_size, cache_shared_trace_max, "max size of shared trace cache, in KB or MB")
OPTION_DEFAULT(uint_size, cache_shared_trace_unit_init, (56 * 1024),
should be 32*1024 */
"initial shared trace cache unit size, in KB or MB")
OPTION_DEFAULT(uint_size, cache_shared_trace_unit_max, (56 * 1024),
"maximum shared trace cache unit size, in KB or MB")
OPTION_DEFAULT(uint_size, cache_shared_trace_unit_quadruple,
(56 * 1024),
"shared trace cache units are grown by 4X until this size, in KB or MB")
OPTION(uint_size, cache_coarse_bb_max, "max size of coarse bb cache, in KB or MB")
OPTION_DEFAULT(uint_size, cache_coarse_bb_unit_init, (56 * 1024),
should be 32*1024 */
"initial coarse bb cache unit size, in KB or MB")
OPTION_DEFAULT(uint_size, cache_coarse_bb_unit_max, (56 * 1024),
"maximum coarse bb cache unit size, in KB or MB")
OPTION_DEFAULT(uint_size, cache_coarse_bb_unit_quadruple,
(56 * 1024),
"coarse bb cache units are grown by 4X until this size, in KB or MB")
OPTION_DEFAULT(bool, finite_bb_cache, true, "adaptive working set bb cache management")
OPTION_DEFAULT(bool, finite_trace_cache, true,
"adaptive working set trace cache management")
OPTION_DEFAULT(bool, finite_shared_bb_cache, false,
"adaptive working set shared bb cache management")
OPTION_DEFAULT(bool, finite_shared_trace_cache, false,
"adaptive working set shared trace cache management")
OPTION_DEFAULT(bool, finite_coarse_bb_cache, false,
"adaptive working set shared bb cache management")
OPTION_DEFAULT(uint_size, cache_bb_unit_upgrade, (56 * 1024),
"bb cache units are always upgraded to this size, in KB or MB")
OPTION_DEFAULT(uint_size, cache_trace_unit_upgrade, (56 * 1024),
"trace cache units are always upgraded to this size, in KB or MB")
OPTION_DEFAULT(uint_size, cache_shared_bb_unit_upgrade, (56 * 1024),
"shared bb cache units are always upgraded to this size, in KB or MB")
OPTION_DEFAULT(uint_size, cache_shared_trace_unit_upgrade, (56 * 1024),
"shared trace cache units are always upgraded to this size, in KB or MB")
OPTION_DEFAULT(uint_size, cache_coarse_bb_unit_upgrade, (56 * 1024),
"shared coarse cache units are always upgraded to this size, in KB or MB")
OPTION_DEFAULT(uint, cache_bb_regen, 10, "#regen per #replaced ratio for sizing bb cache")
OPTION_DEFAULT(uint, cache_bb_replace, 50,
"#regen per #replaced ratio for sizing bb cache")
OPTION_DEFAULT(uint, cache_trace_regen, 10,
"#regen per #replaced ratio for sizing trace cache")
OPTION_DEFAULT(uint, cache_trace_replace, 50,
"#regen per #replaced ratio for sizing trace cache")
OPTION_DEFAULT(uint, cache_shared_bb_regen, 20,
"#regen per #replaced ratio for sizing shared bb cache")
OPTION_DEFAULT(uint, cache_shared_bb_replace, 100,
* regen param a percentage */
"#regen per #replaced ratio for sizing shared bb cache")
OPTION_DEFAULT(uint, cache_shared_trace_regen, 10,
"#regen per #replaced ratio for sizing shared trace cache")
OPTION_DEFAULT(uint, cache_shared_trace_replace, 100,
* regen param a percentage */
"#regen per #replaced ratio for sizing shared trace cache")
OPTION_DEFAULT(uint, cache_coarse_bb_regen, 20,
"#regen per #replaced ratio for sizing shared coarse cache")
OPTION_DEFAULT(uint, cache_coarse_bb_replace, 100,
* regen param a percentage */
"#regen per #replaced ratio for sizing shared coarse cache")
OPTION_DEFAULT(uint, cache_trace_align, 8, "alignment of trace cache slots")
OPTION_DEFAULT(uint, cache_bb_align, 4, "alignment of bb cache slots")
OPTION_DEFAULT(uint, cache_coarse_align, 1, "alignment of coarse bb cache slots")
OPTION_DEFAULT(uint, ro2sandbox_threshold, 10,
"#write faults in a region before switching to sandboxing, 0 to disable")
OPTION_DEFAULT(
uint, sandbox2ro_threshold, 20,
"#executions in a sandboxed region before switching to page prot, 0 to disable")
OPTION_COMMAND(
bool, sandbox_writable, false, "sandbox_writable",
{
if (options->sandbox_writable) {
options->sandbox2ro_threshold = 0;
}
},
"always sandbox writable regions", STATIC, OP_PCACHE_GLOBAL)
* making this the default for a single process only, we might
* want to make it OP_PCACHE_NOP.
*/
OPTION_COMMAND(
bool, sandbox_non_text, false, "sandbox_non_text",
{
if (options->sandbox_non_text) {
options->sandbox2ro_threshold = 0;
}
},
"always sandbox non-text writable regions", STATIC, OP_PCACHE_GLOBAL)
OPTION_DEFAULT(bool, cache_shared_free_list, true,
"use size-separated free lists to manage empty shared cache slots")
* reset_* trigger options as well.
*/
OPTION_COMMAND(
bool, enable_reset, IF_X86_ELSE(true, false), "enable_reset",
{
if (!options->enable_reset) {
DISABLE_RESET(options);
}
},
"separate persistent memory from non-persistent for resets", STATIC, OP_PCACHE_NOP)
OPTION_DEFAULT_INTERNAL(uint, reset_at_fragment_count, 0,
"reset all caches at a certain fragment count")
OPTION(uint, reset_at_nth_thread,
"reset all caches when the nth thread is explicitly created")
* app, however that's prob. better then us spinning (xref 9145). It would be nice
* to switch back to resetting when the address space is getting low, but there's
* no easy way to figure that out. */
OPTION_DEFAULT(
bool, switch_to_os_at_vmm_reset_limit, true,
"if we hit the reset_at_vmm_*_limit switch to requesting from the os (so we'll "
"only actually reset once the os is out and we're at the limit)")
OPTION_DEFAULT(bool, reset_at_switch_to_os_at_vmm_limit,
IF_X86_ELSE(true,
false),
"schedule a reset the first (and only the first) time we switch to the os "
"allocations from -switch_to_os_at_vmm_reset_limit above")
OPTION_DEFAULT(
uint, reset_at_vmm_percent_free_limit,
IF_X86_ELSE(10, 0),
"reset all when vmm heap % free is < reset_at_vmm_percent_free (0 disables)")
OPTION_DEFAULT(
uint_size, reset_at_vmm_free_limit, 0,
"reset all when vmm heap has less then reset_at_vmm_free free memory remaining")
OPTION_DEFAULT(
uint, report_reset_vmm_threshold, 3,
"syslog one thrash warning message after this many resets at low vmm heap free")
OPTION_DEFAULT(bool, reset_at_vmm_full,
IF_X86_ELSE(true,
false),
"reset all caches the first time vmm heap runs out of space")
OPTION_DEFAULT(uint, reset_at_commit_percent_free_limit, 0,
"reset all less than this % of the commit limit remains free (0 disables)")
OPTION_DEFAULT(uint_size, reset_at_commit_free_limit,
IF_X86_ELSE((32 * 1024 * 1024),
0),
"reset all when less then this much free committable memory remains")
OPTION_DEFAULT(uint, report_reset_commit_threshold, 3,
"syslog one thrash warning message after this many resets at low commit")
OPTION_DEFAULT(uint, reset_every_nth_pending,
IF_X86_ELSE(35, 0),
"reset all caches when pending deletion has this many entries")
* to avoid being triggered by new, empty, private units for new threads
*/
OPTION(uint, reset_at_nth_bb_unit,
"reset all caches once, when the nth new bb cache unit is created/reused")
OPTION(uint, reset_at_nth_trace_unit,
"reset all caches once, when the nth new trace cache unit is created/reused")
OPTION(uint, reset_every_nth_bb_unit,
"reset all caches every nth bb cache unit that is created/reused")
OPTION(uint, reset_every_nth_trace_unit,
"reset all caches every nth trace cache unit that is created/reused")
* app */
OPTION_DEFAULT_INTERNAL(
bool, skip_out_of_vm_reserve_curiosity, false,
"skip the assert curiosity on out of vm_reserve (for regression tests)")
OPTION_DEFAULT(bool, vm_reserve, true, "reserve virtual memory")
OPTION_DEFAULT(uint_size, vm_size,
* 2G to allow for -vm_base_near_app to reduce overheads.
* If this is set to 2G, -vm_base_near_app will always fail.
*/
* region so Windows can support a 2G size.
*/
IF_X64_ELSE(IF_WINDOWS_ELSE(512, 1024UL), 128) * 1024 * 1024,
"capacity of virtual memory region reserved (maximum supported is "
"512MB for 32-bit and 2GB for 64-bit) for code and reachable heap")
OPTION_DEFAULT(uint_size, vmheap_size, IF_X64_ELSE(8192ULL, 128) * 1024 * 1024,
* for which we need more than 256MB.
*/
"capacity of virtual memory region reserved for unreachable heap")
#ifdef WINDOWS
OPTION_DEFAULT(uint_size, vmheap_size_wow64, 128 * 1024 * 1024,
* for which we need more than 256MB.
*/
"capacity of virtual memory region reserved for unreachable heap "
"on WoW64 processes")
#endif
* in vmk_init().
* For Linux we start higher to avoid limiting the brk (i#766), but with our
* new default -vm_size of 0x20000000 we want to stay below our various
* preferred addresses of 0x7xxx0000 so we keep the base plus offset plus
* size below that.
* For a 64-bit process on MacOS __PAGEZERO takes up the first 4GB by default.
* We ignore this for x64 if -vm_base_near_app and the app is far away.
*/
OPTION_DEFAULT(uint_addr, vm_base,
IF_VMX86_ELSE(IF_X64_ELSE(0x40000000, 0x10800000),
IF_WINDOWS_ELSE(0x16000000,
IF_MACOS_ELSE(IF_X64_ELSE(0x120000000,
0x3f000000),
0x3f000000))),
"preferred base address hint for reachable code+heap")
*/
OPTION_DEFAULT(uint_addr, vm_max_offset,
IF_VMX86_ELSE(IF_X64_ELSE(0x18000000, 0x05800000), 0x10000000),
"base address maximum random jitter")
OPTION_DEFAULT(bool, vm_allow_not_at_base, true,
"if we can't allocate vm heap at "
"preferred base (plus random jitter) allow the os to choose where to "
"place it instead of dying")
OPTION_DEFAULT(bool, vm_allow_smaller, true,
"if we can't allocate vm heap of "
"requested size, try smaller sizes instead of dying")
OPTION_DEFAULT(bool, vm_base_near_app, true,
"allocate vm region near the app if possible (if not, if "
"-vm_allow_not_at_base, will try elsewhere)")
#ifdef X64
* an absolute requirement (XXX i#829: it is required for mixed-mode).
*/
OPTION_DEFAULT(bool, heap_in_lower_4GB, false,
"on 64bit request that the dr heap be allocated entirely within the "
"lower 4GB of address space so that it can be accessed directly as a "
"32bit address. See PR 215395. Requires -reachable_heap.")
OPTION_DEFAULT(bool, reachable_heap, false,
"guarantee that all heap memory is 32-bit-displacement "
"reachable from the code cache.")
OPTION_DEFAULT(bool, reachable_client, IF_STATIC_LIBRARY_ELSE(false, true),
"guarantee that clients are reachable from the code cache.")
#endif
* + It is not implemented for Windows or Mac.
* + Pcaches are not supported.
* + -native_exec_list is not supported.
* + dr_nonheap_alloc(rwx) is not supported.
* + DR_ALLOC_CACHE_REACHABLE is not supported.
* Clients using other non-vmcode sources of +wx memory will also not comply.
*/
OPTION_DEFAULT(bool, satisfy_w_xor_x, false,
"avoids ever allocating memory that is both writable and executable.")
* 12bits of randomness. Could make it larger if we verify as
* collision free the whole range [vm_base, * vm_base+vm_size+vm_max_offset)
*/
OPTION_INTERNAL(bool, vm_use_last, "use the vm reservation only as a last resort")
OPTION(uint, silent_oom_mask,
* (OOM_COMMIT | OOM_EXTEND) on commit limit either when
* system running out of pagefile or process hitting job limit
*/
"silently die when out of memory")
* should rather go into a configuration file. Since
* per-executable no real need for an append list. */
OPTION_DEFAULT(liststring_t, silent_commit_oom_list, OPTION_STRING("wmiprvse.exe"),
"silently die on reachinig commit limit in these ;-separated executables")
OPTION_DEFAULT(uint_time, oom_timeout, 5 * 1000,
* when out of memory, but gives us a chance to not die */
* a memory hog on the machine would die by the time we retry.
* Applies only to committed memory, for reservations sleeping
* is futile (other than artificial ballooning).
*
* Note: Two of these timeouts on the same thread's request
* and we'll terminate - we will also try freeing up our own
* memory after the first timeout.
*/
"short sleep (in ms) and retry after a commit failure")
* any one of the three says we should, see their descriptions for more details. */
DYNAMIC_OPTION_DEFAULT(bool, follow_children, true,
"inject into all spawned processes unless preinjector is set up "
"to inject into them or they have app-specific RUNUNDER_OFF")
OPTION_DEFAULT(bool, follow_systemwide, true,
"inject into all spawned processes that are configured to run under dr "
"(app specific RUNUNDER_ON, or no app specific and RUNUNDER_ALL in the "
"global key), dangerous without either -early_inject or "
"-block_mod_load_list_default preventing double injection")
DYNAMIC_OPTION_DEFAULT(
bool, follow_explicit_children, true,
"inject into all spawned processes that have app-specific RUNUNDER_EXPLICIT")
* if so be sure we update os.c:early_inject_location on change etc. */
* code like get_application_short_name() called from drpreload before
* even _init is run needs to have a non-early default.
* Thus we turn this on in privload_early_inject.
*/
* over where to inject via a hook and alternate injection methods, rather than using
* the old thread injection.
* XXX: Clean up by removing this option and thread injection completely?
*/
OPTION_COMMAND(
bool, early_inject, IF_UNIX_ELSE(false , true), "early_inject",
{
if (options->early_inject) {
IF_UNIX(options->emulate_brk = true;)
}
},
"inject early", STATIC, OP_PCACHE_GLOBAL)
OPTION_DEFAULT(bool, early_inject_map, true, "inject earliest via map")
* os version. Our default is late injection to make it easier on clients
* (as noted in i#980, we don't want to be too early for a private kernel32).
*/
OPTION_DEFAULT(uint, early_inject_location, 8 ,
"where to hook for early_injection. Use 5 =="
"INJECT_LOCATION_KiUserApcdefault for earliest injection; use "
"4 == INJECT_LOCATION_LdrDefault for easier-but-still-early.")
OPTION_DEFAULT(uint_addr, early_inject_address, 0,
"specify the address to hook at for INJECT_LOCATION_LdrCustom")
#ifdef WINDOWS
OPTION_DEFAULT(
pathstring_t, early_inject_helper_dll, OPTION_STRING(INJECT_HELPER_DLL1_NAME),
"path to 1st early inject helper dll that is used to auto find LdrpLoadImportModule")
OPTION_DEFAULT(pathstring_t, early_inject_helper_name,
OPTION_STRING(INJECT_HELPER_DLL2_NAME),
"PE name of 2nd early inject helper dll that is used to auto find "
"LdrpLoadImportModule")
#endif
OPTION_DEFAULT_INTERNAL(
bool, early_inject_stress_helpers, false,
"When early injected and using early_inject_location LdprLoadImportModule, don't use "
"parent's address, instead always use helper dlls to find it")
* in maybe_inject_into_proccess() in os.c (see notes there) */
OPTION_DEFAULT(bool, inject_at_create_process, false,
"inject at post create process instead of create first thread, requires "
"early injection")
* process (there is no separate create first thread). On vista+ proc
* params are available at create process so everything works out. */
OPTION_DEFAULT(
bool, vista_inject_at_create_process, true,
"if os version is vista+, inject at post create (requires early injection)")
OPTION_DEFAULT(bool, inject_primary, false,
"check and wait for injection in the primary thread")
#ifdef UNIX
OPTION_DEFAULT(bool, emulate_brk, false, "i#1004: emulate brk for early injection")
#endif
OPTION_DEFAULT(uint, synch_thread_max_loops, 10000,
"max number of wait loops in "
"synch_with_thread before we give up (UINT_MAX loops forever)")
OPTION_DEFAULT(uint, synch_all_threads_max_loops, 10000,
"max number of wait loops "
"in synch_with_all_threads before we give up (UINT_MAX loops forever)")
OPTION_DEFAULT(bool, synch_thread_sleep_UP, true,
"for uni-proc machines : if true "
"use sleep in synch_with_* wait loops instead of yield")
OPTION_DEFAULT(bool, synch_thread_sleep_MP, true,
"for multi-proc machines : if "
"true use sleep in synch_with_* wait loops instead of yield")
OPTION_DEFAULT(uint_time, synch_with_sleep_time, 5,
"time in ms to sleep for each "
"wait loop in synch_with_* routines")
#ifdef WINDOWS
OPTION_DEFAULT(
bool, suspend_on_synch_failure_for_app_suspend, true,
"if we fail "
"to synch with a thread for an app suspend, suspend anyways to preserved the "
"apps suspend count")
#endif
OPTION_DEFAULT(bool, ignore_syscalls, IF_WINDOWS_ELSE(false, true),
"ignore system calls that do not need to be intercepted")
OPTION_DEFAULT(bool, inline_ignored_syscalls, true,
"inline ignored system calls in the middle of bbs")
#ifdef LINUX
OPTION_DEFAULT(bool, hook_vsyscall, true, "hook vdso vsyscall if possible")
OPTION_ALIAS(sysenter_is_int80, hook_vsyscall, false, STATIC, OP_PCACHE_GLOBAL)
OPTION_DEFAULT(bool, disable_rseq, false,
"cause the restartable sequence SYS_rseq "
"system call to return -ENOSYS as a workaround for rseq features not "
"supportable by DR")
#endif
#ifdef UNIX
OPTION_DEFAULT(bool, restart_syscalls, true,
"restart appropriate syscalls when interrupted by a signal")
#endif
#if defined(WINDOWS) || defined(MACOS64)
PC_OPTION_DEFAULT(uint, tls_align,
IF_WINDOWS_ELSE(1 , 0),
* 32 - Pentium III, Pentium M cache line
* 64 - Pentium 4 cache line
*/
* consider implications on platform-independence of persisted caches
*/
"TLS slots preferred alignment")
#endif
#ifdef WINDOWS
OPTION_DEFAULT(bool, ignore_syscalls_follow_sysenter, true,
"for ignore_syscalls, continue interp after the sysenter")
* by DR by executing them using shared syscall. */
OPTION_DEFAULT(
bool, shared_syscalls, true,
"syscalls that do not need to be intercepted are executed by shared syscall")
OPTION_DEFAULT(bool, shared_fragment_shared_syscalls, IF_HAVE_TLS_ELSE(true, false),
"enable fragments that use shared syscall to be share-able")
* possible. This currently works only w/-disable_traces. */
OPTION_INTERNAL(bool, shared_syscalls_fastpath, "use a faster version of shared syscall")
* only ignorable syscalls can be optimized. 'false' means that a much broader
* set of syscalls can be optimized -- any syscall that DR doesn't need to
* intercept, as identified in the syscall_requires_action array in win32/os.c.
*/
OPTION_INTERNAL(bool, shared_eq_ignore,
"use ignorable syscall classification for shared_syscalls")
PC_OPTION_DEFAULT(uint, tls_flags, 1 | 2,
* TLS_FLAG_CACHE_LINE_START */
"TLS allocation choices")
PC_OPTION_DEFAULT(bool, alt_teb_tls, true,
"Use other parts of the TEB for TLS once out of real TLS slots")
#endif
* whether a thread's TLS is initialized yet, on x86.
* XXX: we plan to remove this once we're sure it's stable.
*/
OPTION_DEFAULT_INTERNAL(bool, safe_read_tls_init, IF_LINUX_ELSE(true, false),
"use a safe read to identify uninit TLS")
OPTION_DEFAULT(bool, guard_pages, true,
"add guard pages to all thread-shared vmm allocations; if disabled, also "
"disables -per_thread_guard_pages")
OPTION_DEFAULT(
bool, per_thread_guard_pages, true,
"add guard pages to all thread-private vmm allocations, if -guard_pages is also on")
* option into a number in the future to catch larger strides beyond TOS.
* There are problems on Windows where the PAGE_GUARD pages must be used, yet
* the kernel's automated stack expansion does not do the right thing vs
* our -vm_reserve.
*/
OPTION_DEFAULT(bool, stack_guard_pages, IF_WINDOWS_ELSE(false, true),
"add guard pages to detect stack overflow")
#ifdef PROGRAM_SHEPHERDING
* Memory Firewall API */
OPTION_COMMAND_INTERNAL(
bool, security_api, false, "security_api",
{
if (options->security_api) {
ENABLE_SECURITY(options);
}
},
"enable Security API", STATIC, OP_PCACHE_NOP)
* option_command_internal so that we can use for release builds. */
OPTION_COMMAND(
bool, security, false, "security",
{
if (options->security) {
options->diagnostics = true;
options->syslog_mask = SYSLOG_ALL_NOVERBOSE;
options->syslog_init = true;
IF_INTERNAL(options->syslog_internal_mask = SYSLOG_ALL;)
* -staged).
*/
ENABLE_SECURITY(options);
* (ENABLE_SECURITY turns on -indirect_stubs for us)
*/
options->coarse_units = true;
}
},
"enable Memory Firewall security checking", STATIC, OP_PCACHE_NOP)
DYNAMIC_PCL_OPTION(bool, detect_mode,
"only report security violations - will execute attackers code!")
OPTION_COMMAND(
uint, detect_mode_max, 0, "detect_mode_max", { options->detect_mode = true; },
"max number of security violations to allow in detect_mode - will revert to "
"next higher-priority handling option after the max",
DYNAMIC, OP_PCACHE_NOP)
DYNAMIC_OPTION(bool, diagnose_violation_mode,
"on a security violations, report whether a trampoline")
DYNAMIC_OPTION_DEFAULT(
uint, report_max, 20,
"max number of security violations to report, (0 is infinitely many)")
DYNAMIC_OPTION(bool, kill_thread,
"kill offending thread only, WARNING: application may hang")
OPTION_COMMAND(
uint, kill_thread_max, 10, "kill_thread_max", { options->kill_thread = true; },
"max number of threads to kill before killing process", DYNAMIC, OP_PCACHE_NOP)
DYNAMIC_OPTION(bool, throw_exception,
"throw exception on security violations, WARNING: application may die")
OPTION_COMMAND(
uint, throw_exception_max, 10, "throw_exception_max",
{ options->throw_exception = true; },
"max number of exceptions before killing thread or process", DYNAMIC, OP_PCACHE_NOP)
DYNAMIC_OPTION_DEFAULT(uint, throw_exception_max_per_thread, 10,
"max number of exceptions per single thread")
DYNAMIC_OPTION(uint_time, timeout, "timeout value to throttle down an attack")
# ifdef SIMULATE_ATTACK
DYNAMIC_OPTION_DEFAULT(pathstring_t, simulate_at, EMPTY_STRING,
"fragment count list for simulated attacks")
# endif
* Disabled for now since -sandbox2ro_threshold invalidates its assumptions
* (case 8167)
*/
OPTION_DEFAULT(bool, selfmod_futureexec, true,
"leave selfmod areas on the future-exec list")
* example: -no_executable_if_flush
* note that if_flush and if_alloc use the future list, and so their regions
* are considered executable until de-allocated -- even if written to!
* N.B.: any changes in defaults must also change the -X command below!
*/
* require changing from PC_ to PCL_, and changing whether we mark modules as
* exempted!
*/
OPTION(bool, code_origins, "check that code origins meet security policies")
# ifdef WINDOWS
PC_OPTION_DEFAULT(bool, executable_if_flush, true,
"allow execution after a region has been NtFlushInstructionCache-d")
PC_OPTION(bool, executable_after_load,
"allow execution from region marked x but modified during load time (normal "
"behavior for relocation or rebinding)")
PC_OPTION_DEFAULT(bool, emulate_IAT_writes, true, "keep IAT non-w, emulate writes there")
PC_OPTION_DEFAULT(
bool, unsafe_ignore_IAT_writes, false,
"ignore IAT writes by the loader, assuming nothing else writes at the same time")
# endif
PC_OPTION_DEFAULT(bool, executable_if_rx_text, true,
"allow execution from any rx portion of the text section, subsumes "
"-executable_after_load")
PC_OPTION_DEFAULT(bool, executable_if_alloc, true,
"allow execution from certain regions marked x at allocation time")
PC_OPTION_DEFAULT(bool, executable_if_trampoline, true,
"allow execution from pattern-matched trampoline blocks")
PC_OPTION_DEFAULT(bool, executable_if_hook, true,
"allow execution from text section briefly marked rwx")
PC_OPTION_DEFAULT(bool, trampoline_dirjmp, true, "allow direct jmp trampoline")
PC_OPTION_DEFAULT(bool, trampoline_dircall, true, "allow direct call trampoline")
PC_OPTION(bool, trampoline_com_ret, "allow .NET COM method table ret trampoline")
PC_OPTION_DEFAULT(bool, trampoline_displaced_code, true,
"allow hook-displaced code trampoline")
PC_OPTION_DEFAULT(bool, executable_if_driver, true,
"allow execution from a kernel-mode address (case 9022)")
PC_OPTION_DEFAULT(
bool, driver_rct, true,
"allow any RCT if source is from a kernel-mode address (case 9022/9096)")
PCL_OPTION(
bool, executable_if_text,
"allow execution from text sections of modules, subsumes -executable_if_rx_text")
PCL_OPTION(bool, executable_if_dot_data, "allow execution from .data sections of modules")
PCL_OPTION(bool, executable_if_dot_data_x,
"allow execution from .data sections of modulesif marked x")
* .-x means care about execute with no write permission. See case 3287.
*/
PCL_OPTION(bool, executable_if_x, "allow execution from regions marked ..x")
PCL_OPTION(bool, executable_if_rx, "allow execution from regions marked .-x")
PCL_OPTION(bool, executable_if_image,
"allow execution from any mapped section from an executable or library image")
OPTION(bool, executable_stack, "allow execution from the stack")
OPTION(bool, executable_heap, "allow execution from the heap")
OPTION_ALIAS(A, executable_stack, true, STATIC, OP_PCACHE_NOP )
OPTION_ALIAS(B, executable_heap, true, STATIC, OP_PCACHE_NOP )
PCL_OPTION_DEFAULT(bool, exempt_text, true, "allow execution from exempt text sections")
PCL_OPTION_DEFAULT(liststring_t, exempt_text_list, EMPTY_STRING,
"allow execution from text sections of these ;-separated modules")
PC_OPTION_DEFAULT(liststring_t, exempt_mapped_image_text_default_list,
OPTION_STRING("LVPrcInj.dll"),
"allow execution from text sections in MEM_IMAGE mappings"
" of these ;-separated modules, default")
PCL_OPTION_DEFAULT(liststring_t, exempt_mapped_image_text_list, EMPTY_STRING,
"allow execution from text sections in MEM_IMAGE mappings"
" of these ;-separated modules, append")
PCL_OPTION_DEFAULT(bool, exempt_dot_data, true,
"allow execution from exempt .data sections")
* by default will not have shared pcaches for any process w/ ANY non-default
* exemption lists */
PCL_OPTION_DEFAULT(liststring_t, exempt_dot_data_list, OPTION_STRING("SM2USER.dll"),
"allow execution from .data sections of these ;-separated modules")
PCL_OPTION_DEFAULT(bool, exempt_dot_data_x, true,
"allow execution from exempt .data sections if marked x")
* -executable_if_dot_data_rx, turn it on by default and set this exempt
* list to empty.
*/
* by default will not have shared pcaches for any process w/ ANY non-default
* exemption lists */
PCL_OPTION_DEFAULT(
liststring_t, exempt_dot_data_x_list,
OPTION_STRING("kbd??.dll;kbd???.dll;kbd????.dll;kbd?????.dll"),
"allow execution from .data sections of these ;-separated modules if marked x")
PCL_OPTION_DEFAULT(bool, exempt_image, true, "allow execution from exempt image modules")
PCL_OPTION_DEFAULT(
liststring_t, exempt_image_list, EMPTY_STRING,
"allow execution from anywhere in the image of these ;-separated modules")
OPTION_DEFAULT(bool, exempt_dll2heap, true,
"allow execution in heap first targeted by exempt modules")
OPTION_DEFAULT(liststring_t, exempt_dll2heap_list, EMPTY_STRING,
"allow execution in heap first targeted by these ;-separated modules")
OPTION_DEFAULT(bool, exempt_dll2stack, true,
"allow execution in stack first targeted by exempt modules")
OPTION_DEFAULT(liststring_t, exempt_dll2stack_list, EMPTY_STRING,
"allow execution in stack first targeted by these ;-separated modules")
DYNAMIC_PCL_OPTION_DEFAULT(bool, exempt_threat, true, "allow exempt threat ids")
DYNAMIC_PCL_OPTION_DEFAULT(
liststring_t, exempt_threat_list, EMPTY_STRING,
"silently allow these ;-separated threat ids, ? wildcards allowed")
DYNAMIC_OPTION_DEFAULT(liststring_t, silent_block_threat_list, EMPTY_STRING,
"silently block these ;-separated threat ids, ? wildcards allowed")
# ifdef RETURN_AFTER_CALL
PC_OPTION_DEFAULT(bool, ret_after_call, false,
"return after previous call instructions only")
OPTION_ALIAS(C, ret_after_call, false, STATIC, OP_PCACHE_GLOBAL)
PC_OPTION_DEFAULT(bool, vbjmp_allowed, true, "allow execution of VB direct jmp via ret")
PC_OPTION_DEFAULT(bool, vbpop_rct, true, "allow execution of VB pop via ret")
PC_OPTION_DEFAULT(bool, fiber_rct, true, "allow execution of fiber initialization")
PC_OPTION_DEFAULT(bool, mso_rct, true,
"allow execution of MSO continuations")
PC_OPTION_DEFAULT(
bool, licdll_rct, true,
"allow execution of licdll obfuscated call")
PC_OPTION_DEFAULT(bool, seh_rct, true, "allow execution of SEH ret constructs")
PC_OPTION_DEFAULT(bool, borland_SEH_rct, true,
"allow execution of borland SEH constructs")
* off by default as case 7266 has us currently running these dlls natively
*/
PC_OPTION(bool, pushregret_rct, "allow execution of push;ret constructs")
PC_OPTION_DEFAULT(bool, iret_rct, IF_X64_ELSE(true, false),
"allow ntdll64!RtlRestoreContext iret")
* off by default as case 7266 has us currently running these dlls natively
*/
PC_OPTION(bool, xdata_rct, "allow ret to .xdata NtFlush targets")
PC_OPTION_DEFAULT(bool, exempt_rct, true, "allow rct in exempt modules")
* FIXME slsvc.exe is also in exempt_rct_to_default_list for slsvc.exe -> slsvc.exe
* .C violations which would be covered here if it weren't for case 285. */
PC_OPTION_DEFAULT(
liststring_t, exempt_rct_default_list,
OPTION_STRING("dpcdll.dll;licdll.dll;mso.dll;winlogon.exe;sysfer.dll;slsvc.exe"),
"allow rct within these ;-separated modules or to DGC")
PCL_OPTION_DEFAULT(liststring_t, exempt_rct_list, EMPTY_STRING,
"allow rct within these ;-separated modules or to DGC, append")
PCL_OPTION_DEFAULT(liststring_t, exempt_rct_from_default_list, EMPTY_STRING,
"allow rct from these ;-separated modules")
PCL_OPTION_DEFAULT(liststring_t, exempt_rct_from_list, EMPTY_STRING,
"allow rct from these ;-separated modules, append")
* FIXME: should be in exempt_rct_default_list, case 285 */
* FIXME: should be in exempt_rct_default_list, case 285 */
* FIXME: should be in exempt_rct_default_list, case 285 */
* FIXME: should be only in exempt_rct_default_list, case 285 */
PC_OPTION_DEFAULT(
liststring_t, exempt_rct_to_default_list,
OPTION_STRING(
"dpcdll.dll;licdll.dll;mso.dll;winlogon.exe;sysfer.dll;iss-pam1.dll;jmail.dll;"
"msvbvm50.dll;msvbvm60.dll;vbe6.dll;LVPrcInj.dll;slc.dll;slsvc.exe"),
"allow rct to these ;-separated modules")
PCL_OPTION_DEFAULT(liststring_t, exempt_rct_to_list, EMPTY_STRING,
"allow rct to these ;-separated modules, append")
* releases we use the default attack handling (e.g. kill thread for services)
*/
OPTION_DEFAULT(uint, rct_ret_unreadable,
OPTION_ENABLED | OPTION_BLOCK | OPTION_NO_HANDLING | OPTION_NO_REPORT,
"alternative handling of return targets in unreadable memory")
PC_OPTION(bool, rct_sticky, "leaves all RCT tables on unmap, potential memory leak")
PC_OPTION_DEFAULT(bool, rac_dgc_sticky, true,
"leaves all RAC tables from DGC, potential memory leak")
PC_OPTION_DEFAULT(
uint, rct_cache_exempt, 1,
"whether to cache exempted addresses, 0 never, 1 only in modules, 2 always")
PC_OPTION_DEFAULT(uint, rct_section_type, 0x20,
"bitflag to enable RCT checks on module code 0x20,data 0x40, or "
"uninitialized sections 0x80")
PC_OPTION_DEFAULT(uint, rct_section_type_exclude,
0x80000020,
"TESTALL bitflag to disable RCT checks for specific module sections "
"sections that are matched by rct_section_type")
PC_OPTION_DEFAULT(
bool, rct_modified_entry, true,
"if not within module, lookup image entry point"
"in LDR list for already mapped modules, and at MapViewOfSection for late")
# ifdef RCT_IND_BRANCH
* details */
PC_OPTION_DEFAULT(uint, rct_ind_call, OPTION_DISABLED,
"indirect call policy: address taken instructions only")
PC_OPTION_DEFAULT(uint, rct_ind_jump, OPTION_DISABLED,
"indirect jump policy: address taken or return targets")
PC_OPTION_DEFAULT(bool, rct_analyze_at_load, true,
"analyze modules for ind branch targets at module load time")
PC_OPTION_DEFAULT(bool, rct_reloc, true, "use relocation information to find references")
* but only in modules that executed code we didn't see.
* This option controls whether we proactively scan or only rely on our
* scan-on-violation (PR 277044/277064).
*/
PC_OPTION_DEFAULT(
bool, rct_scan_at_init, IF_X64_ELSE(true, false),
"scan modules present at inject time for rip-rel lea even when relocs are present")
* don't have per-module RCT tables there.
*/
PC_OPTION_DEFAULT(bool, rct_exempt_intra_jmp,
IF_X64_ELSE(IF_WINDOWS_ELSE(true, false), false),
"allow jmps to target any intra-module address")
OPTION_ALIAS(E, rct_ind_call, OPTION_DISABLED, STATIC, OP_PCACHE_GLOBAL)
OPTION_ALIAS(F, rct_ind_jump, OPTION_DISABLED, STATIC, OP_PCACHE_GLOBAL)
# endif
# endif
* options are added here; and less importantly make sure that
* when options are turned off by default they are taken out
*/
OPTION_COMMAND(
bool, X, false, "X",
{
IF_RETURN_AFTER_CALL(options->ret_after_call = false;)
IF_WINDOWS(options->executable_if_flush = false;)
options->executable_if_alloc = false;
options->executable_if_trampoline = false;
options->executable_if_hook = false;
options->executable_if_x = true;
IF_RCT_IND_BRANCH(options->rct_ind_call = OPTION_DISABLED;)
IF_RCT_IND_BRANCH(options->rct_ind_jump = OPTION_DISABLED;)
},
"duplicate Microsoft's nx: allow x memory only and don't enforce RCT", DYNAMIC,
OP_PCACHE_GLOBAL )
#endif
OPTION_DEFAULT(bool, enable_block_mod_load, true,
"switch for enabling the block module from being loaded feature, if "
"enabled the modules to block from loading are specified by the "
"block_mod_load_list[_default] options")
* children from double injecting if the process is already under dr */
* if LdrLoadDll calls fail, e.g. do not use the result for
* GetProcAddress.
*/
OPTION_DEFAULT(liststring_t, block_mod_load_list_default,
OPTION_STRING("dynamorio.dll;entapi.dll;hidapi.dll"),
"if -enable_block_mod_load block the loading (at LdrLoadDll) of the "
"following ;-separated modules, note that since this is blocking at "
"LdrLoadDll the module match will be based on the filename of module "
"being loaded NOT the PE name (which is used by most other options)")
OPTION_DEFAULT(liststring_t, block_mod_load_list, EMPTY_STRING,
"if -enable_block_mod_load, block the loading (at LdrLoadDll) of the "
"following ;-separated modules, note that since this is blocking at "
"LdrLoadDll the module match will be based on the filename of module "
"being loaded NOT the PE name (which is used by most other options)")
OPTION_DEFAULT(
uint, handle_DR_modify, 1 ,
"specify how to handle app attempts to modify DR memory protection: either halt with "
"an error, turn into a nop (default), or return failure to the app")
OPTION_DEFAULT(uint, handle_ntdll_modify,
* err on the side of DR missing stuff while native rather than
* messing up the app's behavior.
*/
3 ,
"specify how to handle app attempts to modify ntdll code: either halt "
"with an error, turn into a nop (default), or return failure to the app")
OPTION_DEFAULT(liststring_t, patch_proof_default_list, EMPTY_STRING,
"ignore protection changes and writes to text of ;-separated module list, "
"or * for all")
OPTION_DEFAULT(liststring_t, patch_proof_list, EMPTY_STRING,
"ignore protection changes and writes to text of ;-separated module list, "
"append, or * for all")
PC_OPTION_DEFAULT(bool, use_moduledb, false, "activate module database")
OPTION_ALIAS(staged, use_moduledb, false, STATIC, OP_PCACHE_GLOBAL)
PC_OPTION_DEFAULT(liststring_t, allowlist_company_names_default,
OPTION_STRING(COMPANY_LONG_NAME),
"don't relax protections as part of moduledb matching for these ; "
"separated company names")
PC_OPTION_DEFAULT(liststring_t, allowlist_company_names,
OPTION_STRING("Microsoft Corporation"),
"don't relax protections as part of moduledb matching for these ; "
"separated company names")
PC_OPTION_DEFAULT(
uint, unknown_module_policy,
0xf,
"module policy control field for non-allowlisted modules")
OPTION_DEFAULT(uint, unknown_module_load_report_max, 10,
"max number of non allowlist modules to log/report at load time")
OPTION_DEFAULT(uint, moduledb_exemptions_report_max, 3,
"max number of moduledb security exemptions to report")
* unload, and also case 9364 for .C only after unload
*/
OPTION_DEFAULT(bool, unloaded_target_exception, true,
"detect and silently handle as exceptions app races during DLL unload")
#ifdef WINDOWS
OPTION_DEFAULT(bool, hide, true, "remove DR dll from module lists")
OPTION_DEFAULT(uint, hide_from_query,
3 ,
"mask to control what option to take to hide dr when the app does a query "
"virtual memory call on our dll base")
OPTION_DEFAULT(bool, track_module_filenames, true,
"track module file names by watching section creation")
#endif
* and the gui should set true only when going to detach to prevent a security risk.
* The setting should be removed when detach is complete.
* In vault mode: -no_allow_detach -no_dynamic_options
*/
DYNAMIC_OPTION_DEFAULT(bool, allow_detach, true, "allow detaching from process")
#ifdef WINDOWS
PC_OPTION_INTERNAL(bool, noasynch, "disable asynchronous event interceptions")
#endif
PC_OPTION_DEFAULT_INTERNAL(
bool, hw_cache_consistency, IF_X86_ELSE(true, false),
"keep code cache consistent in face of hardware implicit icache sync")
OPTION_DEFAULT_INTERNAL(bool, sandbox_writes, true,
"check each sandboxed write for selfmod?")
OPTION_DEFAULT_INTERNAL(bool, safe_translate_flushed, false,
"store info at flush time for safe post-flush translation")
PC_OPTION_INTERNAL(bool, store_translations,
"store info at emit time for fragment translation")
PC_OPTION(bool, translate_fpu_pc,
"translate the saved last floating-point pc when FPU state is saved")
* owner to have overwritten the files.
* XXX: not supported on linux
*/
OPTION_DEFAULT(bool, validate_owner_dir, IF_WINDOWS_ELSE(true, false),
"validate owner of persisted cache or ASLR directory")
OPTION_DEFAULT(bool, validate_owner_file, false,
"validate owner of persisted cache or ASLR, on each file")
#define ENABLE_COARSE_UNITS(prefix) \
{ \
(prefix)->coarse_units = true; \
* -coarse_units doesn't support that yet (that's i#659/PR 213262). \
* XXX: duplicated in -persist \
*/ \
(prefix)->indirect_stubs = true; \
}
#define DISABLE_COARSE_UNITS(prefix) \
{ \
(prefix)->coarse_units = false; \
\
(prefix)->indirect_stubs = false; \
}
OPTION_COMMAND(
bool, coarse_units, false, "coarse_units",
{
if (options->coarse_units) {
ENABLE_COARSE_UNITS(options);
}
},
"use coarse-grain code cache management when possible", STATIC, OP_PCACHE_GLOBAL)
OPTION_ALIAS(enable_full_api, coarse_units, false, STATIC, OP_PCACHE_GLOBAL)
OPTION_DEFAULT(bool, coarse_enable_freeze, false, "enable freezing of coarse units")
DYNAMIC_OPTION_DEFAULT(bool, coarse_freeze_at_exit, false,
"freeze coarse units at process exit")
DYNAMIC_OPTION_DEFAULT(bool, coarse_freeze_at_unload, false,
"freeze coarse units at module unload or other flush")
* Though bb building time would recommend a fragment count threshold, for
* sharing benefits we care about code size.
* Remember also that we get wss and time improvements from RCT table
* being persisted; yet a large module w/ many RCT targets is likely to have
* a lot of code, though we may not execute much of it, so we have
* the coarse_freeze_rct_min option.
* Xref case 10362 on using pcache files for RCT independently of code caches.
*/
DYNAMIC_OPTION_DEFAULT(uint_size, coarse_freeze_min_size, 512,
"only freeze new coarse code > this cache size (bytes)")
DYNAMIC_OPTION_DEFAULT(uint_size, coarse_freeze_append_size, 256,
"only append new coarse code > this cache size (bytes)")
DYNAMIC_OPTION_DEFAULT(uint_size, coarse_freeze_rct_min, 2 * 1024,
"freeze a coarse module w/ > this RCT entries")
DYNAMIC_OPTION_DEFAULT(bool, coarse_freeze_clobber, false,
"overwrite existing persisted temp files")
DYNAMIC_OPTION_DEFAULT(bool, coarse_freeze_rename, true,
"rename existing persisted files when writing new ones")
DYNAMIC_OPTION_DEFAULT(bool, coarse_freeze_clean, true, "delete renamed persisted files")
DYNAMIC_OPTION_DEFAULT(bool, coarse_freeze_merge, true,
"merge unfrozen coarse code with frozen code when persisting")
DYNAMIC_OPTION_DEFAULT(bool, coarse_lone_merge, true,
"merge un-persisted unit w/ disk file when persisting")
DYNAMIC_OPTION_DEFAULT(bool, coarse_disk_merge, true,
"merge persisted unit w/ disk file when persisting")
#ifdef WINDOWS
DYNAMIC_OPTION_DEFAULT(
bool, coarse_freeze_rebased_aslr, false,
"freeze modules with ASLR enabled that failed to load due to rebasing")
#endif
OPTION_DEFAULT(bool, coarse_freeze_elide_ubr, true,
"elide fall-through ubr when freezing coarse units")
PC_OPTION(bool, unsafe_freeze_elide_sole_ubr,
"elide sole-ubr-bb fall-through ubr when freezing coarse units")
OPTION_DEFAULT(bool, coarse_pclookup_table, true,
"use a reverse cache lookup table for faster entry-pc lookup,"
"critical for performance of frozen units + trace building")
OPTION_DEFAULT(bool, persist_per_app, false,
"use separate persisted cache per executable")
OPTION_DEFAULT(bool, persist_per_user, true, "use separate persisted cache per user")
OPTION_DEFAULT(bool, use_persisted, false, "use persisted cache if it exists")
OPTION_DEFAULT(liststring_t, persist_exclude_list, EMPTY_STRING,
"exclude these ;-separated modules from persisted use and generation")
#ifdef RCT_IND_BRANCH
OPTION_DEFAULT(bool, persist_rct, true,
"persist RCT (call* target) tables; if this option is off, "
"we will still persist for Borland modules, but no others")
OPTION_DEFAULT(bool, persist_rct_entire, true,
"if -persist_rct, persist RCT tables for entire module")
OPTION_DEFAULT(bool, use_persisted_rct, true,
"use persisted RCT info, if available, instead of analyzing module")
#endif
#ifdef HOT_PATCHING_INTERFACE
OPTION_DEFAULT(bool, use_persisted_hotp, true,
"use persisted hotp info to avoid flushing perscaches")
#endif
OPTION_DEFAULT(uint, coarse_fill_ibl, 1,
* indicating which per-type table(s) to fill */
"fill 1st thread's ibl tables from persisted RAC/RCT tables")
OPTION_DEFAULT(bool, persist_map_rw_separate, true,
"map persisted read-only sections separately to support sharing"
"(option must be on both when generated and when using)")
OPTION_DEFAULT(bool, persist_lock_file, true,
"keep persisted file handle open to prevent writes/deletes")
OPTION_DEFAULT(uint, persist_gen_validation, IF_WINDOWS_ELSE(0x1d, 0xd),
PERSCACHE_GENFILE_MD5_{SHORT,COMPLETE} */
"controls md5 values that we store when we persist")
OPTION_DEFAULT(uint, persist_load_validation, 0x5,
"controls which md5 values we check when we load a persisted file; must "
"be a subset of -persist_gen_validation, else we won't load anything")
* Size must match that in effect at persist time. */
PC_OPTION_DEFAULT(uint_size, persist_short_digest, (4 * 1024),
"size of file header and footer to check, in KB or MB")
OPTION_DEFAULT(bool, persist_check_options, true,
"consider pcache-affecting options when using pcaches")
PC_OPTION_DEFAULT(bool, persist_check_local_options, false,
"include all local options in -persist_check_options")
PC_OPTION_DEFAULT(bool, persist_check_exempted_options, true,
"only check local options for modules affected by exemptions")
OPTION_DEFAULT(bool, persist_protect_stubs, true, "keep persisted cache stubs read-only")
OPTION_DEFAULT(uint, persist_protect_stubs_limit, 0,
"stop write-protecting stubs after this many writes (0 protects forever)")
OPTION_DEFAULT(bool, persist_touch_stubs, true,
"touch stubs prior to protecting to avoid pagefile cost")
PC_OPTION_DEFAULT(bool, coarse_merge_iat, true,
"merge iat page into coarse unit at +rx transition")
* TODO: should auto-enable (on Linux or Vista+ only?) for -coarse_enable_freeze?
*/
PC_OPTION_DEFAULT(bool, coarse_split_calls, false,
"make all calls fine-grained and in own bbs")
#ifdef X64
PC_OPTION_DEFAULT(bool, coarse_split_riprel, false,
"make all rip-relative references fine-grained and in own bbs")
#endif
#ifdef UNIX
OPTION_DEFAULT(bool, persist_trust_textrel, true,
"if textrel flag is not set, assume module has no text relocs")
#endif
OPTION_DEFAULT(pathstring_t, persist_dir, EMPTY_STRING,
"base per-user directory for persistent caches")
OPTION_DEFAULT(pathstring_t, persist_shared_dir, EMPTY_STRING,
"base shared directory for persistent caches")
OPTION_COMMAND(
bool, persist, false, "persist",
{
if (options->persist) {
ENABLE_COARSE_UNITS(options);
options->coarse_enable_freeze = true;
options->coarse_freeze_at_exit = true;
options->coarse_freeze_at_unload = true;
options->use_persisted = true;
IF_UNIX(options->coarse_split_calls = true;)
IF_X64(options->coarse_split_riprel = true;)
DISABLE_PROBE_API(options);
* pcaches */
DISABLE_RESET(options);
} else {
options->coarse_enable_freeze = false;
options->use_persisted = false;
REENABLE_RESET(options);
}
},
"generate and use persisted caches", STATIC, OP_PCACHE_GLOBAL)
OPTION_COMMAND(
bool, desktop, false, "desktop",
{
if (options->desktop) {
options->coarse_enable_freeze = true;
options->use_persisted = true;
options->coarse_freeze_at_unload = true;
DISABLE_TRACES(options);
options->shared_bb_ibt_tables = true;
* bb N.B.: if we re-enable traces we'll want to turn this back on
*/
options->indcall2direct = false;
* pcaches */
DISABLE_RESET(options);
} else {
* sequences of -desktop -no_desktop
*/
options->coarse_enable_freeze = false;
options->use_persisted = false;
options->coarse_freeze_at_unload = false;
REENABLE_TRACES(options);
options->shared_bb_ibt_tables = false;
options->indcall2direct = true;
REENABLE_RESET(options);
}
},
"desktop process protection", STATIC, OP_PCACHE_GLOBAL)
* modules loaded by natively-executed modules
* these don't affect pcaches since the trampoline bbs won't be coarse-grain.
*/
OPTION_DEFAULT(bool, native_exec, IF_X86_ELSE(true, false),
"attempt to execute certain libraries natively (WARNING: lots of issues "
"with this, use at own risk)")
* Symantec JVM, and Panda AV working, but with very limited workload testing so far
*/
OPTION_DEFAULT(
liststring_t, native_exec_default_list,
OPTION_STRING("mscorsvr.dll;mscorwks.dll;aspnet_isapi.dll;mscorwks_ntdef.dll;msjava."
"dll;msawt.dll;jvm.dll;symcjit.dll;pavdll.dll"),
"execute these ;-separated modules natively")
* default list visible and settable at global level
*/
OPTION_DEFAULT(liststring_t, native_exec_list, EMPTY_STRING,
"execute these ;-separated modules natively")
OPTION_DEFAULT(bool, native_exec_syscalls, true,
"intercept system calls while application is native")
OPTION_DEFAULT(bool, native_exec_dircalls, true,
"check direct calls as gateways to native_exec modules")
OPTION_DEFAULT(bool, native_exec_callcall, true,
"put gateway on 1st call of a pair where 2nd targets a native_exec module")
OPTION_DEFAULT(
bool, native_exec_guess_calls, true,
"if TOS looks like a ret addr, assume transition to a new module was via call*")
OPTION_DEFAULT(bool, native_exec_managed_code, true,
"if module has managed code, execute it natively")
* FIXME - for case 6765 turn this into a liststring_t so we can consider native exec
* for other potentially problematic sections like .aspack, .pcle, and .sforce */
OPTION_DEFAULT(
bool, native_exec_dot_pexe, true,
"if module has .pexe section (proxy for strange int 3 behavior), execute it natively")
OPTION_DEFAULT(
bool, native_exec_retakeover, false,
"attempt to re-takeover when a native module calls out to a non-native module")
OPTION_COMMAND(
bool, native_exec_opt, false, "native_exec_opt",
{
if (options->native_exec_opt) {
IF_KSTATS(options->kstats = false);
DISABLE_TRACES(options);
}
},
"optimize control flow transition between native and non-native modules", STATIC,
OP_PCACHE_GLOBAL)
#ifdef WINDOWS
OPTION_DEFAULT(bool, skip_terminating_threads, false,
"do not takeover threads that are terminating")
#endif
OPTION_DEFAULT(bool, sleep_between_takeovers, false,
"sleep between takeover attempts to allow threads to exit syscalls")
OPTION_DEFAULT(uint, takeover_attempts, 8, "number of takeover attempts")
OPTION_DEFAULT_INTERNAL(bool, inline_calls, true, "inline calls in traces")
* This is separated from the optimization flags that follow below as it
* applies to all fragments, not just traces.
* FIXME Delete the setting after sufficient testing & qualification?
*/
PC_OPTION_DEFAULT(bool, indcall2direct, true,
"optimization: convert indirect calls to direct calls")
*/
PC_OPTION_DEFAULT(bool, IAT_convert, false,
"convert indirect call or jmp through IAT to direct call or jmp")
PC_OPTION_DEFAULT(bool, IAT_elide, false,
"elide indirect call or jmp converted by IAT_convert"
"unless reached max_elide_{jmp,call}; requires IAT_convert")
OPTION_DEFAULT_INTERNAL(bool, unsafe_IAT_ignore_hooker, false, "ignore IAT writes")
OPTION_DEFAULT(
uint, thread_policy,
OPTION_DISABLED | OPTION_NO_BLOCK | OPTION_NO_REPORT | OPTION_NO_CUSTOM,
"thread delivered to a writable region allowed or squashed (optionally silently)")
#ifdef WINDOWS
OPTION_DEFAULT(
uint, apc_policy,
OPTION_DISABLED | OPTION_NO_BLOCK | OPTION_NO_REPORT | OPTION_NO_CUSTOM,
"APC delivered to a writable region allowed or squashed (optionally silently)")
OPTION_DEFAULT_INTERNAL(
bool, hook_image_entry, true,
"Allow hooking of the image "
"entry point when we lose control at a pre-image-entry-point callback return. "
"Typically it's not needed to regain control if -native_exec_syscalls is on.")
OPTION_DEFAULT_INTERNAL(
bool, hook_ldr_dll_routines, false,
"Hook LdrLoadDll and LdrUnloadDll even with no direct reason other than "
"regaining control on AppInit injection.")
OPTION_DEFAULT(
bool, clean_testalert, true,
"restore NtTestAlert to a pristine state at load by clearing away any hooks")
OPTION_DEFAULT(uint, hook_conflict, 1 ,
"action on conflict with existing non Nt* hooks: die, squash or chain")
OPTION_DEFAULT(uint, native_exec_hook_conflict,
* DR missing something while native. Native intercept matters only
* for AppInit, or tools that go native, or future attach: all rare
* things.
*/
4 ,
"action on conflict with existing Nt* hooks: die, squash, or deeper")
* read */
OPTION_DEFAULT(
bool, dr_sygate_int, false,
"Perform dr int system calls in a sygate compatible fashion (indirected via ntdll)")
OPTION_DEFAULT(
bool, dr_sygate_sysenter, false,
"Perform dr int system calls in a sygate compatible fashion (indirected via ntdll)")
* calls. Dr system calls will still indirect as controlled by
* above options. */
OPTION_DEFAULT(
bool, sygate_int, false,
"Perform app int system calls in Sygate compatible fashion (indirected via ntdll)")
OPTION_DEFAULT(bool, sygate_sysenter, false,
"Perform app sysenter system calls in Sygate compatible fashion "
"(indirected via ntdll)")
OPTION_DEFAULT(bool, native_exec_hook_create_thread, true,
"if using native_exec hooks, decides whether or not to hook CreateThread "
"(disable for Sygate compatibility)")
OPTION_COMMAND(
bool, sygate, false, "sygate",
{
options->dr_sygate_int = true;
options->dr_sygate_sysenter = true;
options->sygate_int = true;
options->sygate_sysenter = true;
options->native_exec_hook_conflict = 3;
options->native_exec_hook_create_thread = false;
},
"Sets necessary options for running in Sygate compatible mode", STATIC, OP_PCACHE_NOP)
* should re-enable once we have a better solution. xref PR 253621 */
OPTION_DEFAULT(bool, aslr_dr, IF_X64_ELSE(false, true),
* aslr_parent_offset to control randomization padding which
* currently gives us 8 bits of randomness for wasting 16MB
* virtual space; breaks sharing for the relocated
* portions of our DLL
*/
"randomization needs to be set in parent process")
OPTION_DEFAULT(uint, aslr, 0 ,
"address space layout randomization, from aslr_option_t")
OPTION_ALIAS(R, aslr, 0 , STATIC, OP_PCACHE_NOP)
OPTION_DEFAULT(
uint, aslr_action, 0x111,
"address space layout handling and reporting, from aslr_action_t")
OPTION_DEFAULT(uint, aslr_retry, 2,
* 1 would allow linear range choice to leapfrog other DLLs
* 2+ would also have a chance to deal with unlikely races
*/
"private ASLR attempts for a good fit after failure, 0 fallback to native")
OPTION_DEFAULT(
uint, aslr_cache, 0,
"address space layout process shared and persistent cache, from aslr_cache_t")
#endif
OPTION_DEFAULT(uint_size, min_free_disk, 50 * (1024 * 1024),
"minimum free disk space (or quota) on DLL cache volume")
* Note default size is in Kilobytes, so it's best to always add M qualifier.
* Examples: 1m, 10M
*/
#ifdef WINDOWS
OPTION_DEFAULT_INTERNAL(
uint, aslr_internal, 0 ,
"address space layout randomization, internal flags from aslr_internal_option_t")
OPTION_DEFAULT(uint_addr, aslr_dll_base, 0x40000000, "starting DLL base addresses")
*
* FIXME: how is STATUS_ILLEGAL_DLL_RELOCATION determined, we
* have to know stay out of the way since loader fails app if it
* finds that user32.dll is not where it wanted?
*/
OPTION_DEFAULT(uint_addr, aslr_dll_top, 0x77000000, "top of DLL range")
* AllocationGranularity is 64KB). This here gives us 12bits of
* randomness. Could make it larger if necessary. */
OPTION_DEFAULT(uint_addr, aslr_dll_offset, 0x10000000,
"maximum random jitter for first DLL")
OPTION_DEFAULT(uint_addr, aslr_dll_pad, 0x00100000, "maximum random jitter between DLLs")
* AllocationGranularity is 64KB). FIXME: This here gives us 8 bits of
* randomness. Could make it larger if necessary. */
OPTION_DEFAULT(uint_addr, aslr_parent_offset, 0x01000000,
"maximum random jitter for parent reservation")
* well This here gives us 12 bits of randomness. Could make it
* larger if necessary.
*/
OPTION_DEFAULT(uint_addr, aslr_heap_reserve_offset, 0x10000000,
"random jitter for first child reservation (large)")
OPTION_DEFAULT(
uint_addr, aslr_heap_exe_reserve_offset, 0x01000000,
"random jitter for reservation after executable (smaller)")
* vs too much fragmentation */
OPTION_DEFAULT(uint_addr, aslr_reserve_pad, 0x00100000,
"random jitter between reservations (tiny)")
* ASLR_PERSISTENT_SOURCE_DIGEST | ASLR_PERSISTENT_SHORT_DIGESTS */
OPTION_DEFAULT(uint, aslr_validation, 0x1,
"consistency and security validation level of stringency")
OPTION_DEFAULT(uint_size, aslr_short_digest, (16 * 1024),
"size of file header and footer to check, in KB or MB")
* note that if this value is changed previously persisted
* files will not be accepted.
* 0 turns into a full file digest
*/
OPTION_DEFAULT(uint_size, aslr_section_prefix, (16 * 1024),
"size of section prefix to match, in KB or MB")
* if enabled by ASLR_PERSISTENT_PARANOID_PREFIX.
* 0 disables section validation
*/
OPTION_DEFAULT(
liststring_t, exempt_aslr_default_list,
* clear whether loader is just whining, or there
* is a good reason it shouldn't be rebased.
* FIXME: without early injection affects only RU=5 processes that load it late,
* SHOWSTOPPER on XP.
* FIXME: Hopefully shouldn't be necessary for all KnownDlls, investigate full
* list. ole32.dll - case 7746 on Win2000 and case 7743 on NT complaining about
* STATUS_ILLEGAL_DLL_RELOCATION sfc.dll - case 8705 update.exe targeting directly
* sfc.dll!MySfcTerminateWatcherThread in winlogon.exe
* kbdus.dll,kbdbg.dll - case 6671 FIXME: list not complete,
* FIXME: case 6740: we don't actually support kbd*.dll
* kernel32.dll - with early injection this one also complains of being
* rebased.
*/
OPTION_STRING(
"kernel32.dll;user32.dll;ole32.dll;sfc.dll;kbdus.dll;kbdbu.dll;kbd*.dll"),
"exempt from randomization these ;-separated modules")
OPTION_DEFAULT(liststring_t, exempt_aslr_list,
EMPTY_STRING,
"exempt from randomization these ;-separated modules, append")
* impact on visible memory, and in stress testing on performance.
* not really recommended but available until we enable sharing
*/
OPTION_DEFAULT(bool, aslr_extra, false, "ASLR DLL exempt longer list")
OPTION_DEFAULT(liststring_t, exempt_aslr_extra_list,
* but to file names for ASLR cache */
OPTION_STRING("mshtml.dll;msi.dll;mso.dll;shell32.dll"),
"exempt from randomization these ;-separated modules")
* persist. Note that one cannot use simultaneously an include and
* exclude list, so to remove an entry from either need to provide the
* whole list as '#advapi32.dll'
*/
OPTION_DEFAULT(uint, aslr_cache_list, 1,
"controls DLLs to be shared via aslr_cache {all,include,exclude}")
OPTION_DEFAULT(
liststring_t, aslr_cache_include_list,
* exempt_aslr_extra_list. */
* length before adding, and leave some room for DLLs that we
* may want to add in the field.
*/
OPTION_STRING(
"advapi32.dll;"
"comctl32.dll;"
"gdi32.dll;"
"jscript.dll;"
"msctf.dll;"
"mshtml.dll;"
"msvcrt.dll;"
"riched20.dll;"
"rpcrt4.dll;"
"sapi.dll;"
"setupapi.dll;"
"shell32.dll;"
* and has no relocations so it's fine to randomize privately
* the resources, while not having to validate them if in
* shared ASLR cache
*/
"sptip.dll;"
"sxs.dll;"
"uxtheme.dll;"
"ws2_32.dll"
),
"use shared cache only for these ;-separated modules")
OPTION_DEFAULT(liststring_t, aslr_cache_exclude_list,
OPTION_STRING("mso.dll;xpsp2res.dll"),
"exclude from shared cache these ;-separated modules")
OPTION_DEFAULT(bool, aslr_safe_save, true,
"ASLR DLL safe file creation in temporary file before rename")
OPTION_COMMAND(
bool, medium, false, "medium",
{
if (options->medium) {
options->aslr_extra = true;
options->thin_client = false;
}
},
"medium security/memory mapping", STATIC, OP_PCACHE_NOP)
OPTION_COMMAND(
bool, low, false, "low",
{
if (options->low) {
IF_HOTP(options->hot_patching = true);
IF_HOTP(options->hotp_only = true;)
IF_HOTP(options->liveshields = true;)
IF_HOTP(options->hotp_diagnostics = true;)
IF_HOTP(if (options->hotp_only == true) {
IF_RETURN_AFTER_CALL(options->ret_after_call = false;)
IF_RCT_IND_BRANCH(options->rct_ind_call = OPTION_DISABLED;)
IF_RCT_IND_BRANCH(options->rct_ind_jump = OPTION_DISABLED;)
});
IF_WINDOWS(options->apc_policy =
OPTION_ENABLED | OPTION_BLOCK | OPTION_REPORT | OPTION_CUSTOM;)
options->vm_size = 32 * 1024 * 1024;
IF_GBOP(options->gbop = 0x6037;)
options->aslr = 0x0;
DISABLE_RESET(options);
IF_KSTATS(options->kstats = false);
options->thin_client = false;
}
},
"low security/memory mapping", STATIC, OP_PCACHE_NOP)
OPTION_COMMAND(
bool, client, false, "client",
{
if (options->client) {
IF_HOTP(options->hot_patching = true);
IF_HOTP(options->hotp_only = true;)
IF_HOTP(options->liveshields = true;)
IF_HOTP(options->hotp_diagnostics = true;)
IF_HOTP(if (options->hotp_only == true) {
IF_RETURN_AFTER_CALL(options->ret_after_call = false;)
IF_RCT_IND_BRANCH(options->rct_ind_call = OPTION_DISABLED;)
IF_RCT_IND_BRANCH(options->rct_ind_jump = OPTION_DISABLED;)
});
IF_WINDOWS(options->apc_policy =
OPTION_ENABLED | OPTION_BLOCK | OPTION_REPORT | OPTION_CUSTOM;)
options->vm_size = 32 * 1024 * 1024;
IF_GBOP(options->gbop = 0x6037;)
if (options->low) {
options->aslr = 0x0;
options->aslr_cache = 0x0;
} else {
options->aslr = 0x7;
options->aslr_cache = 0x192;
}
* ASLR_SHARED_ANONYMOUS_CONSUMER | ASLR_SHARED_FILE_PRODUCER,
*/
DISABLE_RESET(options);
IF_KSTATS(options->kstats = false);
options->thin_client = false;
} else {
* case 8283 -no_client. Note that this will work well
* only for simple sequences of -client -no_client, as
* we do not attempt to actually recover and is very
* very likely we'll forget to keep this in synch
*/
IF_HOTP(options->hotp_only = false;)
IF_RETURN_AFTER_CALL(options->ret_after_call =
DEFAULT_OPTION_VALUE(ret_after_call);)
IF_RCT_IND_BRANCH(options->rct_ind_call = DEFAULT_OPTION_VALUE(rct_ind_call);)
IF_RCT_IND_BRANCH(options->rct_ind_jump = DEFAULT_OPTION_VALUE(rct_ind_jump);)
options->vm_size = DEFAULT_OPTION_VALUE(vm_size);
IF_GBOP(options->gbop = DEFAULT_OPTION_VALUE(gbop);)
options->aslr = DEFAULT_OPTION_VALUE(aslr);
options->aslr_cache = DEFAULT_OPTION_VALUE(aslr_cache);
REENABLE_RESET(options);
IF_KSTATS(options->kstats = true);
}
},
"client process protection", STATIC, OP_PCACHE_NOP)
# ifdef GBOP
OPTION_DEFAULT(uint, gbop, 0 , "GBOP control, from GBOP_OPTION")
OPTION_ALIAS(O, gbop, 0 , STATIC, OP_PCACHE_NOP)
DYNAMIC_OPTION_DEFAULT(uint, gbop_frames, 0,
"GBOP stack backtrace frame depth")
OPTION_DEFAULT(uint, gbop_include_set,
0x1
| 0x2
| 0x4
| 0x8
| 0x10
| 0x20
| 0x40
later round */
,
"GBOP policy group control, 0 means all")
OPTION_DEFAULT(uint, gbop_last_hook, 0 ,
* control over the performance impact of having extra GBOP hooks
*/
"GBOP number of hooks length, crude override")
* hooks, that may have different flags and different frame depth
*/
OPTION_DEFAULT(liststring_t, gbop_include_list,
EMPTY_STRING,
"include for GBOP these ;-separated module!func descriptors, append")
OPTION_DEFAULT(
liststring_t, gbop_exclude_list,
* Note the only wildcards supported are module.dll!*,
* or '*' as a stress test option to exclude all hooks.
*/
EMPTY_STRING,
"disable GBOP hook for these ;-separated module!func descriptors, append")
OPTION_DEFAULT(liststring_t, exempt_gbop_from_default_list, EMPTY_STRING,
"allow GBOP violations from these ;-separated modules")
OPTION_DEFAULT(liststring_t, exempt_gbop_from_list, EMPTY_STRING,
"allow GBOP violations from these ;-separated modules, append")
* extra hook injection will need a more explicit nudge-like
* mechanism
*/
# endif
OPTION_DEFAULT(bool, mute_nudge, true, "mute nudges for thin_clients")
#endif
* (currently vm_max_offset, aslr_dll_offset, aslr_dll_pad) */
OPTION_DEFAULT(uint, prng_seed, 0 ,
"if non-0 allows reproducible pseudo random number generator sequences")
#if defined(TRACE_HEAD_CACHE_INCR)
OPTION_DEFAULT(bool, pad_jmps, false,
"nop pads jmps in the cache that we might need to patch so that the "
"offset doesn't cross a L1 cache line boundary (necessary for atomic "
"linking/unlinking on an mp machine)")
#else
OPTION_DEFAULT(bool, pad_jmps, IF_X86_ELSE(true, false),
"nop pads jmps in the cache that we might need to patch so that the "
"offset doesn't cross a L1 cache line boundary (necessary for atomic "
"linking/unlinking on an mp machine)")
#endif
OPTION_DEFAULT_INTERNAL(bool, pad_jmps_return_excess_padding, true,
"if -pad_jmps returns any excess requested memory to fcache")
OPTION_DEFAULT_INTERNAL(bool, pad_jmps_shift_bb, true,
"if -pad_jmps shifts the start_pc for padding the first jmp of a "
"bb instead of inserting a nop")
OPTION_DEFAULT_INTERNAL(bool, pad_jmps_shift_trace, true,
"if -pad_jmps shifts the start_pc for padding the first jmp of a "
"trace instead of inserting a nop")
OPTION_DEFAULT_INTERNAL(
uint, pad_jmps_set_alignment, 0,
"if non-zero sets the pad_jmps alignment (useful for stress testing -pad_jmps code)")
OPTION_DEFAULT_INTERNAL(bool, ibl_sentinel_check,
true,
"check for sentinel overwraps in IBL routine instead of exit")
OPTION_DEFAULT(
bool, ibl_addr_prefix, false,
"uses shorter but slower encode with addr16 prefix in IBL routine and elsewhere")
OPTION_DEFAULT_INTERNAL(uint, slowdown_ibl_found, 0,
"add a loop to slow down the IBL hit path")
#ifdef ARM
* executed fragment.
*/
OPTION_INTERNAL(bool, store_last_pc,
"Inserts a store of the PC to TLS at the top of each fragment.")
#endif
OPTION_DEFAULT_INTERNAL(bool, stress_recreate_pc, false,
"stress test recreate pc after each trace or bb")
OPTION_COMMAND_INTERNAL(
bool, stress_recreate_state, false, "stress_recreate_state",
{
if (options->stress_recreate_state)
options->stress_recreate_pc = true;
},
"stress test recreate state after each trace or bb", STATIC, OP_PCACHE_NOP)
OPTION_DEFAULT_INTERNAL(bool, detect_dangling_fcache, false,
"detect any execution of a freed fragment")
OPTION_DEFAULT_INTERNAL(
bool, stress_detach_with_stacked_callbacks, false,
"detach once a thread has 2 levels of nested callbacks (for internal testing)")
OPTION_DEFAULT_INTERNAL(
bool, detach_fix_sysenter_on_stack, true ,
"if false then detach does not fix sysenter callbacks on the stack and instead "
"uses the emitted d_r_dispatch code used for other system calls (a fairly minor "
"transparency violation). Used for internal testing.")
OPTION_DEFAULT_INTERNAL(uint, vmarea_initial_size, 100, "initial vmarea vector size")
OPTION_DEFAULT_INTERNAL(uint, vmarea_increment_size, 100,
"incremental vmarea vector size")
OPTION_INTERNAL(uint_addr, stress_fake_userva,
"pretend system address space starts at this address (case 9022)")
OPTION_INTERNAL(bool, unsafe_crash_process, "unsafe: generates a DR exception")
OPTION_INTERNAL(bool, unsafe_hang_process, "unsafe: hang the process")
OPTION_DEFAULT_INTERNAL(bool, unsafe_ignore_overflow, false,
"do not preserve OF flag, unsafe")
OPTION_COMMAND_INTERNAL(
bool, unsafe_ignore_eflags, false, "unsafe_ignore_eflags",
{
if (options->unsafe_ignore_eflags) {
options->unsafe_ignore_eflags_trace = options->unsafe_ignore_eflags;
options->unsafe_ignore_eflags_prefix = options->unsafe_ignore_eflags;
options->unsafe_ignore_eflags_ibl = options->unsafe_ignore_eflags;
}
},
"do not preserve EFLAGS on any part of ind br handling, unsafe", STATIC,
OP_PCACHE_NOP)
OPTION_DEFAULT_INTERNAL(bool, unsafe_ignore_eflags_trace, false,
"do not preserve EFLAGS on in-trace cmp, unsafe")
OPTION_DEFAULT_INTERNAL(bool, unsafe_ignore_eflags_prefix, false,
"do not preserve EFLAGS on prefixes, unsafe")
OPTION_DEFAULT_INTERNAL(bool, unsafe_ignore_eflags_ibl, false,
"do not preserve EFLAGS in ibl proper, unsafe")
OPTION_DEFAULT(liststring_t, ignore_assert_list, EMPTY_STRING,
"convert into warnings these ;-separated assert identifiers")
* Most common ones look like 'arch/arch.c:142', but could also
* look like 'Not implemented @arch/arch.c:142' or
* 'Bug #4809 @arch/arch.c:145;Ignore message @arch/arch.c:146'
*/
* can have racy crashes at exit time (xref PR 470957).
*/
OPTION(bool, synch_at_exit, "synchronize with all threads at exit in release build")
OPTION(bool, multi_thread_exit,
"do not guarantee that process exit event callback is invoked single-threaded")
OPTION(bool, skip_thread_exit_at_exit, "skip thread exit events at process exit")
OPTION(bool, unsafe_ignore_takeover_timeout,
"ignore timeouts trying to take over one or more threads when initializing, "
"leaving those threads native, which is potentially unsafe")
OPTION_DEFAULT(uint, takeover_timeout_ms, 30000,
"timeout in milliseconds for each thread when taking over at "
"initialization/attach. Reaching a timeout is fatal, unless "
"-unsafe_ignore_takeover_timeout is set.")
#ifdef EXPOSE_INTERNAL_OPTIONS
OPTION_NAME(bool, optimize, " synthethic", "set if ANY opts are on")
# define OPTIMIZE_OPTION(type, name) \
OPTION_COMMAND( \
type, name, 0, #name, { options->optimize = true; }, "optimization", STATIC, \
OP_PCACHE_NOP)
# ifdef SIDELINE
OPTION(bool, sideline, "use sideline thread for optimization")
# endif
# if 0
OPTION(uint, aggressiveness, "level of aggressiveness in optimizations")
# endif
OPTIMIZE_OPTION(bool, prefetch)
OPTIMIZE_OPTION(bool, rlr)
OPTIMIZE_OPTION(bool, vectorize)
OPTIMIZE_OPTION(bool, unroll_loops)
OPTIMIZE_OPTION(bool, instr_counts)
OPTIMIZE_OPTION(bool, stack_adjust)
# ifdef LOAD_TO_CONST
OPTIMIZE_OPTION(bool, loads_to_const)
OPTIMIZE_OPTION(bool, safe_loads_to_const)
# endif
OPTIMIZE_OPTION(uint, remove_dead_code)
OPTIMIZE_OPTION(uint, constant_prop)
OPTIMIZE_OPTION(bool, call_return_matching)
OPTIMIZE_OPTION(bool, remove_unnecessary_zeroing)
OPTIMIZE_OPTION(bool, peephole)
# undef OPTIMIZE_OPTION
#endif
#ifdef HOT_PATCHING_INTERFACE
OPTION_DEFAULT(bool, hot_patching, false, "enable hot patching")
* logged. There can be numerous hotpatch events and dumping a
* forensics file for each one by default would result in too many,
* hence the need for this option. Note: hot patch exceptions and
* internal errors are not hot patch requested events, so this option
* won't be used to control forensics files for those.
*/
DYNAMIC_OPTION_DEFAULT(bool, hotp_diagnostics, false,
"produces forensics for hot patch events")
* full core control mode and hotp_only mode. So hotp_only is not DYNAMIC.
* TODO: Revisit when starting on "attach" mode.
* NOTE: hotp_only specifies the non-code cache mode, not liveshields; for
* liveshields must use the -liveshields option.
*/
OPTION_COMMAND(
bool, hotp_only, false, "hotp_only",
{
if (options->hotp_only) {
IF_RETURN_AFTER_CALL(options->ret_after_call = false;)
IF_RCT_IND_BRANCH(options->rct_ind_call = OPTION_DISABLED;)
IF_RCT_IND_BRANCH(options->rct_ind_jump = OPTION_DISABLED;)
IF_KSTATS(options->kstats = false);
DISABLE_RESET(options);
options->vm_size = 32 * 1024 * 1024;
options->thin_client = false;
options->native_exec = false;
* _required_ for -hotp_only */
}
},
"enable hot patching only mode, i.e., no code cache", STATIC, OP_PCACHE_NOP)
* ls-defs and probes can't be specified by one or more clients. The
* ultimate goal is to abstract out the probe api and convert LiveShields
* into a client using probe api, at which point -probe_api will be the
* same as -hot_patching. The same applies to gbop too, i.e., excluded
* when probe_api is turned on; gbop & livshields can co-exist as before.
*/
OPTION_COMMAND(
bool, liveshields, false, "liveshields",
{
if (options->liveshields) {
options->hot_patching = true;
options->hotp_diagnostics = true;
options->probe_api = false;
}
},
"enables LiveShields", STATIC, OP_PCACHE_NOP)
#endif
#ifdef PROCESS_CONTROL
DYNAMIC_OPTION_DEFAULT(uint, process_control, 0,
"sets process control mode {off,allowlist,blocklist} thereby "
"deciding if a process is allowed to execute or not")
DYNAMIC_OPTION_DEFAULT(uint, pc_num_hashes, 100,
"sets the number of hashes a process control hashlist can contain")
* separate is that it is distinctly different than other core features,
* and is exposed as orthogonal to other security features.
*
* FIXME: having a separate detect_mode option for each
* security mechanism won't scale even if each used the OPTION_* flags
* internally; should make the actual security mechanism parameterized to
* take in OPTION_* flags (which can't be done today because OPTION_* flags
* assume only on or off state and things like process control, gbop, aslr
* have more than one state, in some cases, they have their own set of
* operational flags) or parameterize individual actions like
* detect_mode, dumpcore, remediation action, forensics file, etc. */
DYNAMIC_OPTION_DEFAULT(
bool, pc_detect_mode, false,
"provides detect_mode for process control independent of -detect_mode")
DYNAMIC_OPTION_DEFAULT(
bool, pc_diagnostics, false,
"provides forensics for process control independent of -diagnostics")
#endif
* executes where there is no code cache, hotp_only, gbop or aslr.
* It hooks one or two system calls, enough to follow into child
* processes. Though it is intended to be used for process_control
* today, it has value independent of process_control. One example
* is to inflate/switch the core to hotp_only, gbop or aslr on the
* fly for any unprotected process, which I think would be very handy.
* Case 8576.
*/
OPTION_COMMAND(
bool, thin_client, false, "thin_client",
{
if (options->thin_client) {
* to hook syscalls to follow children.
*/
options->native_exec_syscalls = true;
* or aslring here.
*/
IF_HOTP(options->hot_patching = false;)
IF_HOTP(options->hotp_only = false;)
IF_GBOP(options->gbop = 0;)
IF_WINDOWS(options->aslr = 0;)
* thin_client; though check_options_compatibility() enforces this,
* this is a special case as the user may legitimately set both
* -client and -thin_client. Mostly for debugging; case 9037. */
IF_WINDOWS(options->client = false;)
IF_WINDOWS(options->low = false;)
IF_WINDOWS(options->medium = false;)
* reserving the default 128 mb takes 256 kb of page table
* space (case 8491), so reserve just 4 mb, in case we inflate
* to hotp_only mode.
*/
options->vm_size = 4 * 1024 * 1024;
* will move, causing them to crash. Also memory
* contiguity expected by .NET apps would be broken. The
* problem is when we inflate we still won't be randomized!
*/
options->vm_base = 0;
options->vm_max_offset = 0;
DISABLE_RESET(options);
IF_KSTATS(options->kstats = false);
}
},
"run dr in a light weight mode with nothing but a few hooks", STATIC, OP_PCACHE_NOP)
#undef OPTION
#undef OPTION_NAME
#undef OPTION_DEFAULT
#undef DYNAMIC_OPTION
#undef DYNAMIC_OPTION_DEFAULT