)]}' { "log": [ { "commit": "2829c0d2a972e49b30bf78fe658b5fd7ca4c8c03", "tree": "740116d6a6ec425e90970df235a205709f10becf", "parents": [ "380b833fc9e438af6ad657fd56bad4f7922ae843" ], "author": { "name": "Bin Wang", "email": "biwa@google.com", "time": "Thu Oct 29 19:06:03 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 29 19:06:03 2026" }, "message": "i#8021 kernel: Advance kernel module initialization through thread init (#8232)\n\nFollowing up on #8196, this PR moves the kernel early return in\n`dynamorio_app_app_init()` past `dynamorio_thread_init()` and\n`loader_init_epilogue()`. The CPU handling the init ioctl now\ninitializes a dcontext through DR\u0027s normal main-thread path.\nInitializing other CPUs will be a follow-up PR.\n\n- Add no-op OS function stubs in the kernel build: `os_tls_init()`,\n`os_thread_init_finalize()`, and `os_loader_init_epilogue()`.\n- Implement `os_thread_init()` with no OS-specific data.\n- Add a kernel `linux_event_t` with `create_event()` and\n`destroy_event()`, needed by `fragment_thread_init()`.\n\nIssue: #8021" }, { "commit": "380b833fc9e438af6ad657fd56bad4f7922ae843", "tree": "969ef308ee6a74ce0476d961096189884f32eea2", "parents": [ "10972089fb56c057c44f67272655be86a306e04a" ], "author": { "name": "Bin Wang", "email": "biwa@google.com", "time": "Thu Oct 29 17:04:15 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 29 17:04:15 2026" }, "message": "i#8021 kernel: Rename atomic_inc/dec_and_test() with d_r_ prefix (#8238)\n\nDR and the Linux kernel both define `atomic_inc_and_test()` and\n`atomic_dec_and_test()`, so when compiling the kernel module there would\nbe a naming conflict. Example failed build:\n\nhttps://github.com/DynamoRIO/dynamorio/actions/runs/40815855922/job/123256612973?pr\u003d8235\n\nOn x86 I was able to avoid this by carefully avoiding inclusion of\n`\"atomic_exports.h\"` and `\u003clinux/atomic.h\u003e` in the same file. This is\nharder to do in AArch64 because of how the ARM64 kernel headers are\norganized. Also this would be brittle and easily broken by code changes\nin the future. So I think renaming our functions is the cleaner\nlong-term solution.\n\nIssue: #8021\nIssue: #3348" }, { "commit": "10972089fb56c057c44f67272655be86a306e04a", "tree": "eab695d03652f4c37c65c9e430122e7f31e1d8d8", "parents": [ "76a66e21fe643a6f84ff886d202adce94737089e" ], "author": { "name": "Bin Wang", "email": "biwa@google.com", "time": "Thu Oct 29 01:16:41 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 29 01:16:41 2026" }, "message": "i8021 kernel: Make the Kbuild file architecture-neutral (#8233)\n\nThis PR removes the hard-coded x86-assumptions from the Kbuild file to\nprepare for the upcoming AArch64 support.\n\n- Map the kernel\u0027s `SRCARCH` to DynamoRIO\u0027s architecture name\n(`dr_arch`).\n- Replace hard-coded `core/arch/x86/` and `core/ir/x86/` include paths\nwith `core/arch/\u003cdr_arch\u003e/` and `core/ir/\u003cdr_arch\u003e/`.\n- Replace `x86.asm` with a per-architecture list.\n- Apply x86-specific flags only on x86.\n\nThis does not introduce any functional change on x86.\n\nIssue: #8021" }, { "commit": "76a66e21fe643a6f84ff886d202adce94737089e", "tree": "21a60680cc786007da3317dd4feb90a216842c27", "parents": [ "5ca699eb86522f0258239f767dfe38fdc262f878" ], "author": { "name": "Derek Bruening", "email": "bruening@google.com", "time": "Wed Oct 28 03:23:10 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 28 03:23:10 2026" }, "message": "Clarify drcachesim directory contents in README\n\nUpdated README to clarify the contents of the drcachesim directory." }, { "commit": "5ca699eb86522f0258239f767dfe38fdc262f878", "tree": "fb2c3d149f77a6d485294b67740fe403492a5975", "parents": [ "e093aeec128691eaeaabf8b6da04d73b2ce81773" ], "author": { "name": "Derek Bruening", "email": "bruening@google.com", "time": "Mon Oct 26 22:00:29 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 26 22:00:29 2026" }, "message": "i#5635: Fix zlib_istream more-data condition (#8231)\n\nFixes an incorrect condition for when more data needs to be read in the\nzlib_istream. Before the fix, an internal build in a certain config hit\na hardened libc++ assert about 25% of the time. With this fix, it passes\nevery time.\n\nRemoves the explicit inflateEnd from one error path for consistency, to\nmatch the other error paths (inflateEnd is already called in the\ndestructor).\n\nRemoves the flaky marker from aarch64 under the assumption that this\nsame bug was the culprit.\n\nFixes #5635" }, { "commit": "e093aeec128691eaeaabf8b6da04d73b2ce81773", "tree": "2c330e8afcb56d63df4ac3c4ec7d2084467cac47", "parents": [ "a474cd1206c71857092d5aded07e17df6daa08ac" ], "author": { "name": "Abhinav Anil Sharma", "email": "sharmaabhinav@google.com", "time": "Mon Oct 26 01:05:53 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 26 01:05:53 2026" }, "message": " Point to AArch64 far fragment linking details in porting doc (#8191)\n\nUpdates the AArch64 porting doc to point to the details in the AArch64\nfar fragment linking doc in the discussion on branching between\nfragments." }, { "commit": "a474cd1206c71857092d5aded07e17df6daa08ac", "tree": "0efa558178825fef700bbc42b37bd0fa90673d71", "parents": [ "91fef1b8f42db0106619adefd23a6e5c61e303cb" ], "author": { "name": "Derek Bruening", "email": "bruening@google.com", "time": "Fri Oct 23 21:47:00 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 23 21:47:00 2026" }, "message": "i#8187: Add new drmemtrace i/o queries (#8227)\n\nAdds two new drmemtrace public i/o queries:\n\n+ drmemtrace_get_file_ops_ex() to retrieve the current i/o functions,\nincluding the defaults, to allow selectively using the defaults mixed\nwith replacements instead of all-or-nothing.\n\n+ drmemtrace_get_bytes_written() to retrieve the total bytes written for\ninternal statistics when using the default i/o functions.\n\nAdds testing in burst_replaceall.\n\nFixes #8187" }, { "commit": "91fef1b8f42db0106619adefd23a6e5c61e303cb", "tree": "195503d8f5733557af3d0730108f5c56597ededd", "parents": [ "32fb9a051684506973955c8c47b6493da0299a63" ], "author": { "name": "Bin Wang", "email": "biwa@google.com", "time": "Fri Oct 23 19:14:42 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 23 19:14:42 2026" }, "message": "I8021 kernel: Initialize DynamoRIO in the kernel module through ioctl (#8196)\n\nKernel tracing initialization currently runs during module loading, with\nruntime options supplied as a module parameter. This means if we want to\ntrace with a different set of options, we need to unload/reload. This PR\nseparates module loading from session initialization by introducing an\nioctl control interface and a user space controller. This lays the\ngroundwork for managing tracing sessions independently of the module’s\nlifetime.\n\n- Register `/dev/dynamorio` as a root-only control device and require\n`CAP_SYS_ADMIN` for ioctl requests.\n- Add an initialization ioctl that accepts a runtime options string and\ncalls `dynamorio_app_init()`.\n- Add `session_lock` and `session_state` for kernel module state\ntracking.\n- Add a user space controller (`drkernel_ctl`) and build it alongside\nthe kernel module.\n- Update CI to load the module, initialize through the controller, and\nverify successful unloading in debug and release configurations.\n\nIssue: #8021\nIssue: #8115" }, { "commit": "32fb9a051684506973955c8c47b6493da0299a63", "tree": "4b5c7676538a551457d4823d0ac85f1ee979444e", "parents": [ "66ad7f9f0c69fd82400b539c521181f42d8eb3b5" ], "author": { "name": "Derek Bruening", "email": "bruening@google.com", "time": "Fri Oct 23 00:05:30 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 23 00:05:30 2026" }, "message": "i#4243 redir heap: Redirect aligned_alloc (#8198)\n\nC11/C++17 added aligned_alloc(), which we see in some internal private\nlibraries. Without redirection, the allocation uses libc malloc, and\nthen the corresponding free() is redirected and raises a DR debug assert\non a memory pattern mismatch.\n\nAdds redirection of aligned_alloc() along with general alignment\nsupport.\n\nAdds some test cases. Also tested internally where the libraries now\nwork.\n\nIssue: #4243" }, { "commit": "66ad7f9f0c69fd82400b539c521181f42d8eb3b5", "tree": "222b43d09ca96fee0075d8fe7beb534abd56ecf1", "parents": [ "47ac72920aa78547c5f4616d9326972923735ebf" ], "author": { "name": "Derek Bruening", "email": "bruening@google.com", "time": "Thu Oct 22 04:55:26 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 22 04:55:26 2026" }, "message": "i#8219: Fix lz4_ostream vector error (#8220)\n\nThe lz4_ostream code was unsafely calling front() on an empty vector. We\nreplace it with a call to data().\n\nConfirmed that this removes the hardened libc++ assertion that found\nthis problem.\n\nFixes #8219" }, { "commit": "47ac72920aa78547c5f4616d9326972923735ebf", "tree": "4f360860fcce65a2d029ca149249935f6e3ba0c1", "parents": [ "41363de8085426837a8a37e769bf93aa2acc9697" ], "author": { "name": "Derek Bruening", "email": "bruening@google.com", "time": "Thu Oct 22 04:54:50 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 22 04:54:50 2026" }, "message": "Remove explicit common/ from drmemtrace includes (#8221)\n\nRemoves the common/ subdir that still remains in a few drmemtrace\nincludes (most were removed in earlier cleanups). Having no subdirectory\nmakes it easier to build in other build systems including our internal\nbuild." }, { "commit": "41363de8085426837a8a37e769bf93aa2acc9697", "tree": "02d24a92b30d19d40a4dbc36e5e03774997588f7", "parents": [ "9cfaa2c27aad508f453e13d05b7368724974df20" ], "author": { "name": "Bin Wang", "email": "biwa@google.com", "time": "Wed Oct 21 06:11:12 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 21 06:11:12 2026" }, "message": "i#5908: Add a nop instruction to the api.rseq/rseq_splitvma thread loop on X86 (#8218)\n\nThe api.rseq and api.rseq_splitvma tests often fail to detach with\n\"Failed to\nsynchronize with all threads when detaching\", nearly always on some AMD\nEPYC CI\nrunners. DR elides stores in the instrumented run of an rseq region, and\ndrmemtrace switches to its no-tracing mode before detach. That leaves\nthe helper\nthread\u0027s loop in the code cache with a single translatable app\ninstruction,\nwhich suspend signals almost never land on. The thread is never at a\nsafe spot\nand the detach synch gives up.\n\nAs a temporary workaround, add a nop to the loop so it has a\ntranslatable app\ninstruction where suspend signals usually land. Tested with 272 runs on\nEPYC\n7763, 9V74, and 9V45 runners with no failures, versus 30-100% failure\nrates\nwithout this change.\n\nA DR-side fix to force such threads to a safe spot is still needed.\n\nIssue: #5908" }, { "commit": "9cfaa2c27aad508f453e13d05b7368724974df20", "tree": "fb492c3f48cce11ac58a0ba1f8edb85f98d0b5fa", "parents": [ "d8c05b4db67be9edc11152a563da692a2fa83837" ], "author": { "name": "Derek Bruening", "email": "bruening@google.com", "time": "Wed Oct 21 04:05:09 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 21 04:05:09 2026" }, "message": "i#8195: Add getauxval() private library support (#8197)\n\nAdds a redirect for getauxval() called in a private library (currently\nit fails, typically leading to crashes).\n\nAdds a sanity test case. Also tested on a larger internal set of\nlibraries where this fixes a crash.\n\nFixes #8195" }, { "commit": "d8c05b4db67be9edc11152a563da692a2fa83837", "tree": "f72587921828ec2d14d3ca49e55aed3365eb78f6", "parents": [ "69419762f4c471ded1323c19c84b8798021385e6" ], "author": { "name": "Bin Wang", "email": "biwa@google.com", "time": "Tue Oct 20 17:14:07 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 20 17:14:07 2026" }, "message": "i#8021 kernel: Advance kernel module initialization through `native_exec_init()` (#8193)\n\nFollowing up on #8155, this PR advances kernel module initialization\nthrough `native_exec_init()`. It now stops before `hotp_init()`.\n \n- Implement `get_timer_frequency()` using the kernel\u0027s `tsc_khz`, which\n`kstat_init()` uses as the kstats tick rate. When KSTATS is enabled,\nfail module loading if the TSC frequency is unavailable, since kstats\ndivide by it when reporting.\n- Force `-native_exec`, `-native_exec_retakeover` and `-native_exec_opt`\noff in the kernel build: native execution of kernel code is unsupported.\n- Add no-op `native_module_init()`/`native_module_exit()`, since native\nmodule retakeover relies on ELF PLT/GOT and ld.so hooking, which has no\nkernel equivalent.\n\nIssue: #8021" }, { "commit": "69419762f4c471ded1323c19c84b8798021385e6", "tree": "161fcab8177cd9e4f1f0ee031325efefb7d927bf", "parents": [ "6d2165aa485ca91bf10faa64440cfadce850b0bc" ], "author": { "name": "Derek Bruening", "email": "bruening@google.com", "time": "Mon Oct 19 20:18:58 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 20:18:58 2026" }, "message": "i#5505 kernel tacing: Only set kcore path when active (#8194)\n\nBefore, the drmemtrace kcore path was being set all the time, even when\nkernel tracing not enabled. This caused confusion with users.\n\nAdds checks to the burst_replaceall test to ensure the kcore path is\nempty when no kernel tracing is being done.\n\nIssue: #5505" }, { "commit": "6d2165aa485ca91bf10faa64440cfadce850b0bc", "tree": "09a3cd380f8ef69b7d814a32475822875fc845cd", "parents": [ "17dc7500d92815234b1a6a0c535a3d23ea210e59" ], "author": { "name": "Enrico Deiana", "email": "edeiana@google.com", "time": "Sun Oct 18 09:05:39 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Oct 18 09:05:39 2026" }, "message": "i#3995 irregular window tracing: last window bug fix (#7448)\n\nWhen a workload executed more than `DELAY_FOREVER_THRESHOLD`\n(\u003d 1024^3) instructions after the last window specified in\n`-trace_instr_intervals_file`, the tracing of an unwanted, infinite\n\"trace\" window triggered.\n\nThis happened because the last \"no trace\" window that we create\n(not the user), was set to `DELAY_FOREVER_THRESHOLD` instead\nof the larger value `UINT64_MAX`, which we assume is a large enough\nvalue to stop tracing for the remaining of the execution of the traced\nprogram. This last window exists to stop the tracing after the last,\nuser-defined window set in `-trace_instr_intervals_file` (reminder:\nif the user wants to trace the end of the execution, the last window\nin the file has to be large enough to cover the end of the workload\nexecution).\n\nTested manually, as a new binary that executes at least\n`DELAY_FOREVER_THRESHOLD` instructions takes way more than\n90 seconds to run a tool like `basic_counts`, which we normally use\nto count windows (by looking at its output).\n\nThe reason `code_api|tool.drcachesim.irregular-windows-simple`\npassed is that the test binary traced (`simple_app`) executes\n~100k instructions, which is way less than\n`DELAY_FOREVER_THRESHOLD` instructions, so the last \"no trace\"\nwindow of `DELAY_FOREVER_THRESHOLD` was large enough to\nnot trigger a new, infinite \"trace\" window.\n\nAdds a check for user-defined instruction intervals with a\nduration of 0. They are meaningless, so we ignore them and\nprint a `NOTIFY` message letting the user know.\n\nAdds a `NOTIFY` message when user-defined instruction intervals\noverlap (in which case, they are merged).\n\nIssue #3995" }, { "commit": "17dc7500d92815234b1a6a0c535a3d23ea210e59", "tree": "3ae2d0605040d7f3e31dd1955dfac04b1c405be2", "parents": [ "b1cf37cc836727818806a3774c93610d24ca3593" ], "author": { "name": "Bin Wang", "email": "biwa@google.com", "time": "Thu Oct 15 22:03:57 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 15 22:03:57 2026" }, "message": "i#8021 kernel: Advance kernel module initialization through arch init (#8155)\n\nFollowing up on #8145 and #8166, this PR advances kernel module\ninitialization through `d_r_arch_init()`.\n\n- Implement `os_tls_offset()` and `d_r_get_tls()`/`d_r_set_tls()` for\nthe kernel module on top of the kernel\u0027s gs-based per-CPU area.\n- Add a debug self-check verifying that `gs:[os_tls_offset(slot)]`\naliases the CPU-local state in both directions.\n- Force `protect_mask` to 0 in kernel build since DR memory is a single\nRWX region and changing permission during runtime is currently\nunsupported (#8124).\n- Advance kernel module initialization past `d_r_arch_init()`, it now\nstops before `synch_init()`.\n• Implement `get_dynamorio_dll_start()`/`_end()`,\n`get_dynamorio_library_path()`, `query_time_millis()`/`_micros()` and\n`mem_stats_snapshot()`, which DR\u0027s assertion reporting uses, so a failed\n`ASSERT` (such as the new TLS self-check) prints a report instead of\nhitting a stub.\n\nIssue: #8021" }, { "commit": "b1cf37cc836727818806a3774c93610d24ca3593", "tree": "09df328c5d242983ab3ac11816e55587400019d3", "parents": [ "f6a8e7c5f234b0f70217095f7d53336c40dd81b6" ], "author": { "name": "Derek Bruening", "email": "bruening@google.com", "time": "Thu Oct 15 21:30:47 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 15 21:30:47 2026" }, "message": "Fix typo in scheduler docs (#8192)\n\nFixes a misspelled word in the docs for output_bindings for the\ndrmemtraec scheduler." }, { "commit": "f6a8e7c5f234b0f70217095f7d53336c40dd81b6", "tree": "f2835de4f5b26c099c1626ba18b26a1a01693a50", "parents": [ "d1a47572c0ad60cc9f6e5eb240a6028e4c4a5693" ], "author": { "name": "Suyash Mahar", "email": "smahar@meta.com", "time": "Thu Oct 15 01:19:15 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 15 01:19:15 2026" }, "message": "AArch64: allow vmcode reservations above 2 GB (#8189)\n\nRaise the AArch64 vmcode limit from 2 GB to 64 GB, and disable 32-bit\nheap reachability tracking when -vm_size is above 2 GB.\n\nAArch64 uses absolute targets for far fragment links and for calls into\nDR, so DR itself does not need the x86-style 32-bit reachability window.\nClients can still rely on DR\u0027s reachability guarantees, so they are kept\nfor a -vm_size of 2 GB or less and removed only above that. Disabling\nthe tracking also lets reachable allocations fall back to OS memory at\nany address when vmcode is full.\n\nOn AArch64 with -vm_size above 2 GB, this PR:\n\n- Disables heap reachability tracking, so memory from\n`dr_thread_alloc()`, `dr_global_alloc()`, and `dr_nonheap_alloc()` is no\nlonger guaranteed to be reachable from the code cache.\n- Makes `dr_custom_alloc()` with `DR_ALLOC_CACHE_REACHABLE` return NULL.\n- Reduces -vm_size to 2 GB if -reachable_heap or -heap_in_lower_4GB is\nset.\n- Turns off -reachable_client.\n\nIt also updates the reachability docs for this mode: sec_64bit_reach in\nintro.dox, the -reachable_heap and -reachable_client options in\ndeployment.dox, `DR_ALLOC_CACHE_REACHABLE` in dr_tools.h, and the\n-vm_size option description.\n\nx86 and RISC-V behavior is unchanged, and so is AArch64 with a -vm_size\nof 2 GB or less.\n\nTested with drmemtrace on a large internal AArch64 application." }, { "commit": "d1a47572c0ad60cc9f6e5eb240a6028e4c4a5693", "tree": "61ee40cde27edb7d78564292a97629a3e9c12f7a", "parents": [ "a3598232d7f29723bc917c16f20716507c1f6e88" ], "author": { "name": "Nathan Williams", "email": "112201612+sizeru@users.noreply.github.com", "time": "Wed Oct 14 14:03:20 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 14 14:03:20 2026" }, "message": "i#8180: remove incorrectly used doxygen cmd (#8182)\n\nFixes the problem where the `\\p` [doxygen command](https://www.doxygen.nl/manual/commands.html#cmdp) is used on\nthe `\u003ctt\u003e` tag, which escapes the opening tag and leaves a dangling\nclosing tag, resulting in HTML with lexing errors, and causing builds to\nfail. The `\\p \u003cword\u003e` doxygen command is equivalent to `\u003ctt\u003eword\u003c/tt\u003e`,\nso only one is needed.\n\n\nFixes: #8180" }, { "commit": "a3598232d7f29723bc917c16f20716507c1f6e88", "tree": "063f02a12777e43ddd93f1b53dcb0001cd5625f7", "parents": [ "7bb2c5c0be0430557195812c7dc223775ddbf5f3" ], "author": { "name": "Bin Wang", "email": "biwa@google.com", "time": "Tue Oct 13 22:25:07 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 13 22:25:07 2026" }, "message": "i#8183: Handle large rseq TLS offsets on AArch64 (#8188)\n\nWhen implementing #8177, I discovered a bug in rseq pointer handling on\nAArch64: large TLS offsets can exceed the store instruction\u0027s immediate\nrange and prevent code generation. This change enables those stores to\nencode correctly.\n\n- Adjust the TLS base and displacement when setting and clearing the\nrseq pointer, preserving condition flags and alignment.\n- Update state translation to recognize the generated address\nadjustments and stores.\n- Expand the `api.rseq_splitvma` test allocation to 64 KB + 2 to test\nlarge offsets and larger page sizes. 64KB is currently the largest\npossible base page size on the platforms that `api.rseq_splitvma` will\nrun.\n\nFixes #8183" }, { "commit": "7bb2c5c0be0430557195812c7dc223775ddbf5f3", "tree": "9c6b13cac82f04bc5184a6974cbabf0f33495680", "parents": [ "a842f0eb3463f2c1846d082ecac0b4b2d5f894c9" ], "author": { "name": "Bin Wang", "email": "biwa@google.com", "time": "Tue Oct 13 21:14:33 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 13 21:14:33 2026" }, "message": "i#8165: Widen TLS segment offsets from ushort to int (#8166)\n\nCurrently, DynamoRIO assumes that TLS segment offsets fit in `ushort`.\nThis is no longer true with the x64 Linux kernel build, where the\ndisplacement can be larger than the range of `ushort` or even a negative\nvalue (since Linux 6.15). This PR makes TLS displacements signed `int`\nthroughout core, but user-space encodings and stub sizes remain the\nsame.\n\n- `os_tls_offset()` returns `int`. `os_local_state_offset()` becomes a\nshared inline function that takes an explicit base and can fail.\n- The TLS slot asm accessors now sign-extend the offset.\n- x86 TLS spill/restore and entrance-stub emission are refactored into\nhelpers. The kernel build uses a 9-byte sign-extended disp32 RAX spill,\nso its direct stub grows from 23 to 24 bytes.\n- `instr_raw_is_tls_spill()` now matches every emitted form, including\nRAX, and fixes the 32-bit non-`addr16` pattern.\n- `translate.c` tracks \"spilled\" in a separate flag, since every `int`\nis a valid offset, and fixes a double `os_tls_offset()` in\n`instr_is_seg_ref_load()`.\n- `local_exit_stub_size()` checks for indirect stubs explicitly, because\ndirect and indirect stubs are now the same size in kernel builds.\n- Public `uint` offset APIs are unchanged. Negative displacements are\npassed as their unsigned bit pattern.\n- Adds unit tests for TLS emission and translation, plus two\nseparate-stubs test configs.\n\nFixes #8165\nIssue: #8021\nIssue: #4308" }, { "commit": "a842f0eb3463f2c1846d082ecac0b4b2d5f894c9", "tree": "f5ddac7bd1f2c5705c5303d154966c8dcb0eee7d", "parents": [ "53f74f09dcb548531d08b2d76b37daa05fe58908" ], "author": { "name": "Suyash Mahar", "email": "smahar@meta.com", "time": "Mon Oct 12 22:08:11 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 12 22:08:11 2026" }, "message": "i#4913: Keep base deltas beyond 16 bits (#8190)\n\nraw2trace cast the base delta of elided addresses to int16_t, so when a\nbase moved more than 32KiB within one block, addresses in the trace were\nsilently off by a multiple of 64KiB. Removes the casts added in #8120\nand adds a unit test that fails without the fix.\n\nIssue: #4913\nIssue: #4898" }, { "commit": "53f74f09dcb548531d08b2d76b37daa05fe58908", "tree": "e05d5aa81deec20addd112878a665e26ada65abb", "parents": [ "8a73e0c6901ce960e38fa9623380a7d7819c1b46" ], "author": { "name": "Suyash Mahar", "email": "smahar@meta.com", "time": "Fri Oct 09 19:45:55 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 09 19:45:55 2026" }, "message": "Fix -vm_allow_smaller dividing the size pointer (#8186)\n\n`vmm_place_vmcode()` computed the shrink step as `size / 16` where size\nis a `size_t` pointer, so the step was derived from a stack address and\nthe \"don\u0027t go too small\" check always broke out of the loop. A failed\nvmcode reservation therefore never retried with a smaller size. Use\n`*size` instead." }, { "commit": "8a73e0c6901ce960e38fa9623380a7d7819c1b46", "tree": "15d7fd1c1d9e376d0ebb46325981ad886ced92fa", "parents": [ "38aea725fe1b8e2a2ebff886ec15672b45f7fece" ], "author": { "name": "Bin Wang", "email": "biwa@google.com", "time": "Fri Oct 09 16:14:06 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 09 16:14:06 2026" }, "message": "i#8159: Probe rseq length 64 and align test struct (#8185)\n\nThis PR fixes two bugs identified in #8159:\n\n- The `api.rseq` test register an rseq with `sizeof(*tls_rseq)` which is\n64, but the address is only 32-aligned. The fix is to add\n`__attribute__((aligned(64)))` to the declaration.\n- After adding `__attribute__((aligned(64)))`, our `try_struct_rseq()`\nstill cannot find it. This is because the linux kernel requires\n`rseq_len` to match the registered length (64), and we were not testing\n64 in `try_struct_rseq()`.\n\nAlso added a print on registration failure in\n`api.rseq/api.rseq_splitvma` to help with debugging in the future.\n\nTested on my local workstation with kernel 7.1.6 and glibc 2.43\n- Before: `api.rseq` fails at assertion `res \u003d\u003d 0 || (res \u003d\u003d -1 \u0026\u0026 errno\n\u003d\u003d ENOSYS)`.\n- Now: `api.rseq` fails at assertion `restarts \u003e 0`, like the other\ntests in #8159.\n\nIssue: #8159" }, { "commit": "38aea725fe1b8e2a2ebff886ec15672b45f7fece", "tree": "645ad7463caca5ea7c94b4740b90d91461034f93", "parents": [ "f507e20c31202d71b60876bfd36afc1add84a8b4" ], "author": { "name": "Derek Bruening", "email": "bruening@google.com", "time": "Fri Oct 09 16:01:52 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 09 16:01:52 2026" }, "message": "i#8173: Support local path in record_file_reader (#8175)\n\nReplaces an assert on a slash existing in any path with handling a local\npath in record_file_reader.\n\nTested:\n\nBefore the fix:\n```\n$ bin64/drrun -t drmemtrace -tool record_filter -filter_modify_marker_value 12,6 \\\n -outdir tmp -infile mock_templates_arch.x86_64\ndrmemtrace_launcher: clients/drcachesim/reader/record_file_reader.h:287: \\\nstd::string dynamorio::drmemtrace::record_file_reader_t\u003cT\u003e::get_stream_name() const [with T \u003d dynamorio::drmemtrace::gzip_reader_t; std::string \u003d std::__cxx11::basic_string\u003cchar\u003e]: \\\nAssertion `ind !\u003d std::string::npos\u0027 failed.\n```\n\nAfter the fix:\n\n```\n$ bin64/drrun -t drmemtrace -tool record_filter -filter_modify_marker_value 12,6 \\\n -outdir tmp -infile mock_templates_arch.v8.x86_64\nOutput 30 entries from 30 entries.\n```\n\nFixes #8173" }, { "commit": "f507e20c31202d71b60876bfd36afc1add84a8b4", "tree": "218d59e39c848c3ea6755d046b7d8edbf2f25535", "parents": [ "bf5cd6da33b8140e08b44555902032aac309db1a" ], "author": { "name": "Derek Bruening", "email": "bruening@google.com", "time": "Fri Oct 09 15:58:08 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 09 15:58:08 2026" }, "message": "i#4915 nofetch: Use kernel templates by version (#8171)\n\nChanges the drmemtrace scheduler to store a different kernel template\n(both switch and syscalls) per drmemtrace version. If it can\u0027t find a\ntemplate for a given input\u0027s version (for syscalls) or output\u0027s version\n(for switches) it raises an error.\n\nThe scheduler\u0027s template file reading is extended to handle multiple\nback-to-back versions.\n\nChanges raw2trace to handle multi-versioned template files by ignoring\nentries that are not for the current version.\n\nUpdates raw2trace_directory to support reading a zipfile-format template\nfile. Adds an error check for raw2trace failing to find any syscalls\n(before, there was no error when the plain reader failed to read the\nzipfile).\n\nUpdates the mock switch and syscall files to store back-to-back\ntemplates for versions 6, 7, and 8.\n\nRelaxes the view and invariant_checker complaints about varying versions\nto not apply to template files.\n\nAdds scheduler unit tests for invalid versions and multiple versions.\nAdds mutiple versions to the raw2trace static injection unit test.\n\nAdds an end-to-end test of raw2trace using the checked-in mock syscall\ntemplates (this did not exist before: burst_syscall_inject uses its own\ngenerated templates).\n\nManually tested with the new multi-version checked-in mock files. Also\ndid manual testing of error detection:\n```\n$ bin64/drrun -t drmemtrace -tool record_filter -filter_modify_marker_value 12,5 \\\n -outdir foo -indir ../src/clients/drcachesim/tests/drmemtrace.threadsig.x64.tracedir\nOutput 975332 entries from 975332 entries.\n$ bin64/drrun -t drmemtrace -indir foo \\\n -sched_syscall_file ../src/clients/drcachesim/tests/mock_syscall_sequences.x64.zip \\\n -sched_switch_file ../src/clients/drcachesim/tests/mock_switch_sequences.x64.zip \\\n -core_sharded -cores 1\nERROR: failed to run analyzer: Failed on drmemtrace.threadsig.872894.3824.trace.zip: \\\nFailed to find syscall sequence for version 5 and number 15\n```\n\nIssue: #4915" }, { "commit": "bf5cd6da33b8140e08b44555902032aac309db1a", "tree": "f2b1b41d2edf665c63dc6959d83de336c4a05e59", "parents": [ "650b415b84c7611cd3ca3a31c1ed89c4ef759e82" ], "author": { "name": "Nathan Williams", "email": "112201612+sizeru@users.noreply.github.com", "time": "Fri Oct 09 02:15:59 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 09 02:15:59 2026" }, "message": "i#8178: remove outdated doxygen flag (#8179)\n\nThe `DOT_MULTI_TARGETS` flag is deprecated as of doxygen 1.18.0 and will\ncause the build to fail if included.\n\nThe [default\nvalue](https://web.archive.org/web/20260225031249/https://www.doxygen.nl/manual/config.html#cfg_dot_multi_targets)\nof this flag on older versions of doxygen was NO, so removing it from\nthe config does not affect anything.\n\nFixes: #8178" }, { "commit": "650b415b84c7611cd3ca3a31c1ed89c4ef759e82", "tree": "ef609a3f02b4e25ecb5484344a80c108909d3a4a", "parents": [ "9fe0764ea3ef6536956b29e2715505b3531edb20" ], "author": { "name": "Bin Wang", "email": "biwa@google.com", "time": "Thu Oct 08 18:53:05 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 08 18:53:05 2026" }, "message": "I#8174: Search rseq in neighboring VMAs (#8177)\n\nWhen DynamoRIO attaches to a running application, it must locate the\napplication’s previously registered `struct rseq` in static TLS. Naming\nTLS pages or changing their memory attributes can split the allocation\ninto multiple VMAs. Searching only the VMA containing the thread pointer\ncan therefore miss valid registrations. This PR extends attach-time\ndiscovery to neighboring mappings to handle split TLS allocations.\n\n- Search adjacent read-write mappings, stopping at gaps or non-writable\nmappings. Limit extensions to 1 MB from the thread pointer while\npreserving the full search of its containing mapping.\n- Search outward from the thread pointer on both sides together so both\nstatic TLS and struct pthread are checked before reaching the stack.\n- Fix an off-by-one in `try_struct_rseq()` so re-registration uses the\nmatched registration size.\n- Add a new test `api.rseq_splitvma` which places the registered `struct\nrseq` in a separate VMA using `PR_SET_VMA_ANON_NAME` (with a\n`MADV_DONTFORK` fallback), reproducing the original attach failure\nwithout this fix and passing with it.\n\nFixes #8174" }, { "commit": "9fe0764ea3ef6536956b29e2715505b3531edb20", "tree": "d3753bba5b0ac54a967c0726607ef943b5cda5e0", "parents": [ "a522a505582076eb7f68363b5d301ddca44399e2" ], "author": { "name": "Bin Wang", "email": "biwa@google.com", "time": "Wed Oct 07 21:21:33 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 07 21:21:33 2026" }, "message": "i#8021 kernel: Generate obj list for the kernel module by reusing CORE_SRCS/ARCH_SRCS (#8172)\n\nThis PR is a follow up on #8169. Instead of hardcoding the kernel module\nobject file list, we are reusing existing `CORE_SRCS` and `ARCH_SRCS` to\ngenerate the object file list. Overall, the current process is easier to\nmaintain and less error prone. It\u0027s also easier to replicate in a\ndifferent build system. The trade-offs are there are some files we don\u0027t\nactually need getting pulled in, so the build time is slightly longer\n(\u003c10s longer) and the built `.ko` file is slightly larger (~130KB larger\nwith DEBUG ON, ~20KB larger with DEBUG OFF).\n\n- Use existing `CORE_SRCS` and `ARCH_SRCS` defined in\n`core/CMakeLists.txt` for kernel module object file list generation.\n- Prevent `emit_utils.c` from being included in `ARCH_SRCS` twice when\n`ARCH_NAME` and `ARCH_NAME_SHARED` are the same in\n`core/CMakeLists.txt`. This isn\u0027t a bug per se: both CMake and kbuild\ncan handle duplicate files. I just thought this would be cleaner and\nless confusing.\n- Disable annotations (by `undef ANNOTATIONS`) in `configure.cmake.h`.\n- Use `limits_wrapper.h` in `core/hotpatch.c`.\n- Remove redundant `lib/dr_annotations.h` in `core/jit_opt.c`.\n\nIssue: #8021" }, { "commit": "a522a505582076eb7f68363b5d301ddca44399e2", "tree": "d3b06cffb2c3f99ecd535efcdf0b51d54dd42e01", "parents": [ "1bfd4e57cd3beadf0680605f423a6744ab54f8c3" ], "author": { "name": "Bin Wang", "email": "biwa@google.com", "time": "Tue Oct 06 18:03:53 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 06 18:03:53 2026" }, "message": "i#8021 kernel: Move module build rules into a shared Kbuild (#8169)\n\nIn our internal system we need to support a different build system where\nCMake is not available. This PR moves several module build rules from\nCMake into a checked-in Kbuild so different build systems can share the\nsame implementation by supplying a prepared source tree, generated\nheaders, and an object list.\n\n- Replace `Kbuild.in` with a checked-in `Kbuild`. CMake generates\n`dr_objs` in a separate `Kbuild.sources` file.\n- Make Kbuild paths relative to the module build tree. CMake prepares\nthis tree using symlinks to sources and generated headers.\n- Move shared include paths, defines, and C/assembly flags from CMake\ninto Kbuild.\n- Move `x86.asm` → `x86.S` preprocessing and placeholder replacement\ninto Kbuild.\n- Move development stub generation into Kbuild. Generate weak stubs with\nfunction declarations from the component objects before linking,\nallowing the module to build in one Kbuild invocation.\n- Select assembly flags for GNU `as` or LLVM’s integrated assembler.\n- Keep the existing kernel source list and add a TODO to generate the\nobject list from the shared core source lists.\n\nIssue: #8021\nFixes #8112" }, { "commit": "1bfd4e57cd3beadf0680605f423a6744ab54f8c3", "tree": "5782251d12a7f19cce9a84ca484a772563f985b3", "parents": [ "172ac29731d4518ce82cf1d815897207cc2f957e" ], "author": { "name": "Derek Bruening", "email": "bruening@google.com", "time": "Tue Oct 06 04:12:48 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 06 04:12:48 2026" }, "message": "i#4915 nofetch: Improve analyzer scheduler error reporting (#8168)\n\nIncludes the scheduler error string in errors returned to the analyzer.\n\nChanges the analyzer\u0027s scheduler_ field to become a unique_ptr, to\nbetter support code sharing with subclasses, including error\nreporting.\n\nAdds a per-stream error string to avoid races accessing the\noverall scheduler object\u0027s string for non-initialization errors.\n\nAdds an exit path in the scheduler\u0027s rebalance_queues() if there are no\nlive outputs. Withtout this, an error in one output thread can cause\nanother doing a rebalance to hit a floating point crash, which was hit\nand confirmed fixed.\n\nTested on forthcoming #4915 kernel template versioning changes which\nreturn an error if the right version is missing. Without this change,\nthe error showed up as a vague \"Failed to read from trace\". With this\nchange it says:\n```\nERROR: failed to run analyzer: Failed on allasm_x86_64_ver5.trace.zip: \\\nFailed to find syscall sequence for version 5 and number 1\n```\n\nIssue: #4915" }, { "commit": "172ac29731d4518ce82cf1d815897207cc2f957e", "tree": "522e73552ac5017135edb5cd3e4ca5cad31bd106", "parents": [ "51fdf3e34f9854bc5a17546e1335fd3dccbdd149" ], "author": { "name": "Suyash Mahar", "email": "smahar@meta.com", "time": "Mon Oct 05 18:30:33 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 05 18:30:33 2026" }, "message": "i#8117: Validate shared ELF mappings during module scan (#8122)\n\nDuring the initial address-space scan, DynamoRIO can mistake a read-only\nMAP_SHARED view of an ELF file (for example, `r--s`) for a loaded\nmodule. It then projects the ELF’s PT_LOAD segments into its internal\nmodule map even when those segments are not actually mapped there.\n\nThis PR:\n\n- Validates shared ELF candidates by requiring their executable PT_LOAD\nsegments to be mapped at the expected addresses and file offsets from\nthe same file.\n- Adds regression coverage for one-page and full-span flat views, plus a\nvalid shared PT_LOAD layout.\n\nThe validation is limited to MAP_SHARED mappings as standard ELF loaders\ntypically map PT_LOAD segments with MAP_PRIVATE, so normal loaded\nmodules do not take this path.\n\nFixes #8117" }, { "commit": "51fdf3e34f9854bc5a17546e1335fd3dccbdd149", "tree": "d98d50085bbbe549b26c55c3e2894bda5007ffb1", "parents": [ "2ef1f41e0b74893c699ba7ccdbf4c8c890025bba" ], "author": { "name": "Derek Bruening", "email": "bruening@google.com", "time": "Mon Oct 05 16:34:51 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 05 16:34:51 2026" }, "message": "i#4915 nonfetch: Update header version in filter (#8167)\n\nWhen the version marker is updated in the drmemtrace record_filter tool,\nthe version stored in the header is now updated as well.\n\nAdds an error check in the reader that the marker version matches the\nmost recent header version (a new header is allowed to be different, to\nsupport multiple versions in the same file for kernel templates).\n(Previously, there was no error reported on such a mistmach.) This was\ntested with the record_filter before its update here:\n```\n$ bin64/drrun -t drmemtrace -tool record_filter -filter_trace_types 29 \\\n-filter_modify_marker_value 12,8 -outdir foo \\\n-indir ../src/clients/drcachesim/tests/drmemtrace.threadsig.x64.tracedir/\nOutput 975206 entries from 975332 entries.\n$ bin64/drrun -t drmemtrace -tool view -indir foo 2\u003e\u00261 | head\nVersion mismatch: header 7 !\u003d marker 8\n```\n\nRemoves redundant footer and header checks in reader_t::operator++.\n\nAdds a record_filter unit test for the new behavior.\n\nIssue: #4915" }, { "commit": "2ef1f41e0b74893c699ba7ccdbf4c8c890025bba", "tree": "4bf6c67dcb3757a09b07382613ff26a8833bb2df", "parents": [ "fb2c48b70fc2e070f55ae2d2e7152503568bbf76" ], "author": { "name": "Derek Bruening", "email": "bruening@google.com", "time": "Sat Oct 03 03:36:03 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 03 03:36:03 2026" }, "message": "i#4914 repstr: Do not expand repstr for offline filters (#8158)\n\nExtends the drmemtrace first-last-iter non-expanded repeated-string\nscheme to include filters in offline mode. This is accomplished for\nd-filters by inserting a clean call at the end of the loop and having it\nwalk the addresses and apply the d-cache filter, with raw2trace modified\nto read all the entries. The same clean call is invoked on a fault\ninterrupting a repstring. For i-filters, raw2trace is modified to\nperform its loop walk and record synthesis for this mode just like\nnon-filtered.\n\nThe clean call outputs the buffer if it hits the end; it rolls back the\nbuffer header to prevent the markers causing problems with raw2trace.\nThis is tested by adding a 4K OP_lods in allasm_repstr and running the\nnew tests with a 128-record buffer limit.\n\nThe TRACE_MARKER_TYPE_INSTRUCTION_COUNT value was incorrectly including\nthe nofetch records: that is fixed here as a side effect of not\nexpanding the repstring.\n\nThe drreg issue filed as #8153 is fixed here by removing used registers\nfrom the drreg vector. This issue only happens with this filter change,\nso it belongs in this PR.\n\nAdds 3 new tests based on allasm_repstr with i, d, and i+d filtering.\n\nAdds filter cases to the burst_repstr test.\n\nUpdates raw2trace_unit_tests.\n\nFixes #4914" }, { "commit": "fb2c48b70fc2e070f55ae2d2e7152503568bbf76", "tree": "225d7381a2ae89729bf6b89d80ed84fe438d3893", "parents": [ "ba4bef0e75ce6b3bfbc87a61b4073fa0d0aff4e7" ], "author": { "name": "Derek Bruening", "email": "bruening@google.com", "time": "Thu Oct 01 22:34:22 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 01 22:34:22 2026" }, "message": "i#8161 shrink logs: Remove 31K lines from test output (#8163)\n\nReduces the verbosity used in the scheduler_unit_tests and\nraw2trace_unit_tests to remove 31K lines (!) from their output. I had to\ngo all the way down to 0 to accomplish this as even at 1 there are so\nmany tests the output adds up. These tests are designed as unit tests\nwhich should be completely deterministic, so we should not need extra\nverbosity on the Github servers.\n\nBefore:\n```\n$ clients/bin64/tool.scheduler.unit_tests ~/dr/git/src/clients/drcachesim/tests 2\u003e\u00261 | wc\n 25421 182840 1556574\n$ clients/bin64/tool.drcacheoff.raw2trace_unit_tests 2\u003e\u00261 | wc\n 6607 45631 308008\n```\n\nAfter:\n```\n$ clients/bin64/tool.scheduler.unit_tests ~/dr/git/src/clients/drcachesim/tests 2\u003e\u00261 | wc\n 564 2397 47550 OUT\n$ clients/bin64/tool.drcacheoff.raw2trace_unit_tests 2\u003e\u00261 | wc\n 139 258 2310\n```\n\nIssue: #8161" }, { "commit": "ba4bef0e75ce6b3bfbc87a61b4073fa0d0aff4e7", "tree": "0ce18c1e025d142b0b16750474aa4da39b19f323", "parents": [ "2bc48cd10f472b1bcf05399fb81f70891d1934d1" ], "author": { "name": "Derek Bruening", "email": "bruening@google.com", "time": "Thu Oct 01 22:30:09 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 01 22:30:09 2026" }, "message": "i#4915: Remove non-fetched instruction records (#8151)\n\nDeprecates the \"non-fetched\" instruction record in drmemtrace. Increases\nthe drmemtrace trace version number, with all new traces simply omitting\nany instruction record on non-initial x86 repeated string loops.\n\nAdds a new TRACE_TYPE_INSTR_STRING_LOOP type to make it easier to\nidentify string loops ahead of time, as their long sequences of loads\nand stores may warrant planning in some consumers. This type is\nconsidered type_is_instr().\n\nOnline traces and filtered-offline traces still generate fetch records,\nwhich are removed in the reader for online and raw2trace for offline.\nFuture work will eliminate this for offline; doing so for online is\ncomplex, covered by #4948, and not currently planned.\n\nAdds buffer output for syscall templates to avoid overflow now that\nno-fetch records cannot be used as output points.\n\nAdds invariant checks that we do not see no-fetch (or maybe-fetch)\nrecords in new traces.\nThese checks are once-only per shard. We do expect the no-fetch\ninvariant to show up with the current kernel trace templates. We plan to\nseparately create new templates.\n\nRemoves \"(fetched)\" from basic_counts output and only outputs\n\"non-fetched\" counts for legacy traces with non-zero counts. This also\nremoves the non-fetched that were being counted by the opcode_mix tool.\n\nUpdates documentation and tests.\n\nIssue: #4915" }, { "commit": "2bc48cd10f472b1bcf05399fb81f70891d1934d1", "tree": "71603877cdb3d540aea238e3eb3a9175925dcfdf", "parents": [ "2b5cc022ccfcdb3cf8da258dd462516a86132481" ], "author": { "name": "Jack Gallagher", "email": "jack.gallagher@arm.com", "time": "Thu Oct 01 06:26:32 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 01 06:26:32 2026" }, "message": "i#7585 AArch64 selfmod: Fix TestAllocWE regression (#8157)\n\nAfter recently enabling -hw_cache_consistency on AArch64 the test\nsecurity-common.TestAllocWE started failing on Linux \u003e\u003d 5.13 when run on\nrecent AArch64 hardware.\n\nIssue: #7585" }, { "commit": "2b5cc022ccfcdb3cf8da258dd462516a86132481", "tree": "64677f13224edc9f7e4946a367258dd051c6ce12", "parents": [ "92c01234648d28e178ada15c4faf4320b3f37f4c" ], "author": { "name": "Bin Wang", "email": "biwa@google.com", "time": "Wed Sep 30 18:07:15 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 30 18:07:15 2026" }, "message": "i#4103 clang-tidy: Fixes misc-include-cleaner warnings (#8156)\n\nFixes misc-include-cleaner warnings seen when importing recent changes\ninto our environment:\n- `core/unix/signal_linux_x86.c`: Includes `proc.h` for `XCR0_*\nandarch_exports.h` for `ZMM_ENABLED()`.\n- `core/lib/instrument.c`: Includes `dr_project_wide_defines.h` for\n`BUFFER_SIZE_ELEMENTS` and `NULL_TERMINATE_BUFFER`.\n- `core/lib/instrument.c`: Calls `d_r_snprintf()` and `d_r_strstr()`\ndirectly in `report_client_lib_load_error()`. include-cleaner maps any\nmacro named like a C standard library function to the libc header, so\nthe `snprintf` and `strstr` macros in `globals.h` are reported as\nneeding `\u003cstdio.h\u003e` and `\u003cstring.h\u003e`. Using the underlying names\nresolves them to their declarations in `globals.h`.\n- `suite/tests/linux/sigcontext.c`: Includes `dr_project_wide_defines.h`\nfor `TESTANY`.\n\nclang-tidy with misc-include-cleaner no longer reports these warnings on\nthe changed lines.\n\nIssue: #4103" }, { "commit": "92c01234648d28e178ada15c4faf4320b3f37f4c", "tree": "f9d2e8aeb33b78e6e4bf33c560f163ec9a0f6d6b", "parents": [ "d3f40b0ff7d4d3a1f32526f92bdfb03fcad29beb" ], "author": { "name": "Bin Wang", "email": "biwa@google.com", "time": "Wed Sep 30 05:16:50 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 30 05:16:50 2026" }, "message": "i#8021 kernel: Flx clang errors when building the kernel module (#8154)\n\nBuilding the kernel module with clang fails with `-Werror`. This PR\nfixes two errors while keeping the gcc builds working.\n\n- `kernel_interface.h`: clang does not support the `gnu_printf` format\narchetype (`-Wignored-attributes`). Use `__printf__` instead, which is\nportable across both gcc and clang.\n- `instrument.c`: clang inlines `add_client_lib()` into\n`instrument_load_client_libs()`. That combines the 2 KiB option buffer\nwith the 3 KiB error-message buffers from the load-failure path and\nexceeds the module\u0027s `-Wframe-larger-than\u003d4096`:\n\n ``` \nerror: stack frame size (5176) exceeds limit (4096) in\n\u0027instrument_load_client_libs\u0027 [-Werror,-Wframe-larger-than]\n ```\n\nMove the load-failure reporting into a NOINLINE helper\n(`report_client_lib_load_error()`) so those buffers are on the stack\nonly when a client library fails to load. No functional change.\n\nIssue: #8021" }, { "commit": "d3f40b0ff7d4d3a1f32526f92bdfb03fcad29beb", "tree": "76ef978aaacafc1e4f493189ad6a5b244990e283", "parents": [ "953202802a3ecaa13f23570e2074247f8709e594" ], "author": { "name": "Bin Wang", "email": "biwa@google.com", "time": "Tue Sep 29 01:36:09 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 29 01:36:09 2026" }, "message": "i#8021 kernel: Advance kernel module initialization through loader setup (#8145)\n\nFollow up on #8123. This PR adds CPU-local DR state and the kernel OS\nhooks needed to advance the module initialization through OS,\nconfiguration heap, initial-stack, and loader setup code. Initialization\nnow stops before `d_r_arch_init()`.\n\n- Add a fixed 1 KiB per-CPU buffer, with allocation and lifetime managed\nby the Linux module loader.\n- Validate storage capacity and alignment during `d_r_os_init()`.\n- Implement local-state and dcontext accessors.\n- Add a no-op `os_loader_init_prologue()`. Linux has already loaded and\nrelocated the module; kernel client loading remains future work.\n\nIssue: #8021" }, { "commit": "953202802a3ecaa13f23570e2074247f8709e594", "tree": "bca3e9984220c48cd6543485b7cc4ac930a90206", "parents": [ "60b05e5195db9a91ee516968c4eefecc9655aeed" ], "author": { "name": "ZheWang", "email": "wang.zhe20@zte.com.cn", "time": "Mon Sep 28 18:38:28 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 28 18:38:28 2026" }, "message": "i#3544: Save vector registers with LMUL\u003d1 for any VLEN \u003c\u003d 256 (#8074)\n\nThe vector register save/restore paths (append_save_simd_reg,\nappend_restore_simd_reg, insert_push_all_registers, and\ninsert_pop_all_registers) copied eight registers at a time with LMUL\u003d8.\nAn LMUL\u003d8 group store packs the eight registers contiguously, so\nregister N\u0027s bytes land at \u0026simd[N] only when VLEN is exactly 256 bits\nand fills a whole dr_simd_t slot. On any other VLEN the mcontext layout\ncontract VREG_OFFSET(reg) \u003d\u003d \u0026simd[reg - VR0] is broken.\n\nCopy one register at a time with LMUL\u003d1 instead, so each register\u0027s\nvlenb bytes always land in the low bytes of its own dr_simd_t slot for\nany supported VLEN \u003c\u003d 256 bits.\n\nIssue: #3544" }, { "commit": "60b05e5195db9a91ee516968c4eefecc9655aeed", "tree": "25bd2f97da6d900e1dcff5bdda2071b8584ae4dc", "parents": [ "da292d2f56d262832aff44aadeab331d582cafc6" ], "author": { "name": "Bin Wang", "email": "biwa@google.com", "time": "Mon Sep 28 18:09:26 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 28 18:09:26 2026" }, "message": "i#7996: Preserve the signal frame’s XSAVE state bitmap (#8150)\n\nOn x86 Linux with recent Intel CPUs (e.g., Xeon 8573C and 6973P-C),\n`XCR0` can contain state components, such as AMX tile data, that are\nabsent from a particular signal frame. Copying all `XCR0` bits into that\nframe\u0027s `XSAVE` bitmap can cause `sigreturn` to fail. This PR preserves\nthe frame\u0027s bitmap while marking the register state DynamoRIO actually\nwrites.\n\nFixes #7996" }, { "commit": "da292d2f56d262832aff44aadeab331d582cafc6", "tree": "444e19f8c6428c4f74cacc6063a3d8e4a62ee4c6", "parents": [ "75c6533f24b1867d3533c676923870e6e25dd3db" ], "author": { "name": "Suyash Mahar", "email": "smahar@meta.com", "time": "Mon Sep 28 16:02:00 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 28 16:02:00 2026" }, "message": "i#8148: Define DRMEMTRACE_STATIC for drmemtrace_nomain and drmemtrace_drstatic (#8149)\n\nDefine DRMEMTRACE_STATIC for the drmemtrace_nomain and\ndrmemtrace_drstatic static variants too, so func_trace no longer skips\nthe application executable when recording functions.\n\nFixes #8148" }, { "commit": "75c6533f24b1867d3533c676923870e6e25dd3db", "tree": "ad7671082c9ca7da2f70b18a0293f53a9080552b", "parents": [ "db24e61f8a1f65b2fa827efaa3a244dd95b5fb50" ], "author": { "name": "Derek Bruening", "email": "bruening@google.com", "time": "Sat Sep 26 01:45:48 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Sep 26 01:45:48 2026" }, "message": "i#8146: Avoid compression writes with buffer handoff (#8147)\n\nAdds conditionals to avoid drmemtrace file writes from compression\nsetup, headers, and teardown when the buffer handoff callback is set.\n\nThis fixes an assert in the burst_replaceall test when a new enough LZ4\nis available to be used when linking statically. Confirmed that this\nfixes the test on a machine where it was failing.\n\nIssue: #8146" }, { "commit": "db24e61f8a1f65b2fa827efaa3a244dd95b5fb50", "tree": "deb4b441e099610ef3bf7352fcc7444f9631bb77", "parents": [ "3cf4f9653786bc69d0ab8ad5c0b82ac308ab6a3d" ], "author": { "name": "Derek Bruening", "email": "bruening@google.com", "time": "Sat Sep 26 01:45:25 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Sep 26 01:45:25 2026" }, "message": "i#8125 arm opt: Increase main drmemtrace buffer by 8x (#8142)\n\nIncreases the default drmemtrace trace buffer size by 8x from 4K records\nto 8K records. This improves SPECPU2017 INT performance with no i/o by\n14% on x86; with lz4 output it is estimated from 2 runs at half that.\nAlthough a larger buffer provides better performance, we limit the\nlarger default to just the main thread to better scale to thousands of\nthreads.\n\nAdds snappy support for buffers larger than 64K by splitting them up\ninto multiple to work with snappy\u0027s built-in 64K-per-output limit.\n\nDocuments in the options and release notes that this decreases the\ngranularity of -trace_for_instrs and -exit_after_instrs. Tweaks a few\ntests using these options whose output assumed the old 4K default so\nthat their assumptions on window counts and exit points are met.\n\nIssue #8125" }, { "commit": "3cf4f9653786bc69d0ab8ad5c0b82ac308ab6a3d", "tree": "e3cbcdd72d030db8a992ce912bcee3281c484629", "parents": [ "d1094c126e3836e8efc8c5518b61c0182f100fdd" ], "author": { "name": "Jack Gallagher", "email": "jack.gallagher@arm.com", "time": "Fri Sep 25 09:16:10 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 25 09:16:10 2026" }, "message": "i#7585 AArch64 selfmod: Fix state corruption bug (#8128)\n\nThis commit fixes two related state corruption bugs.\n\nWhen hw_cache_consistency is enabled DynamoRIO sets writable/executable\npages to read-only in order to detect any writes to code regions. If\nthese writes occurred whilst app state was spilled, the signal handler\nfailed to restore app state before returning to d_r_dispatch, which\ncaused app state corruption.\n\nSimilarly, if this fault happened on an instruction that uses the stolen\nregister, we would enter the signal handler with the stolen register\nrestored to its app state. The signal handler assumed it contained the\ntls pointer and left things in a corrupt state.\n\nDiscovered while testing simple Java commands with hw_cache_consistency\nenabled on AArch64:\n drrun -- javac HelloWorld.java\n\nWith this bug fixed I am not aware of any other issues with\nhw_cache_consistency on AArch64 so this commit also turns\nhw_cache_consistency on by deafult on AArch64.\n\nIssue: #7585\nFixes #2055, #5771" }, { "commit": "d1094c126e3836e8efc8c5518b61c0182f100fdd", "tree": "3dc55d086a7c770c6e165d55aa8570d245a3b6a2", "parents": [ "63ec6a7f9a9015164c80f942362503e6c8bfc12f" ], "author": { "name": "Derek Bruening", "email": "bruening@google.com", "time": "Thu Sep 24 23:06:52 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 24 23:06:52 2026" }, "message": "i#8138: Silence privload, VDSO, and vmareas messages (#8139)\n\nSilences a spurious curiosity about the recursion depth of private\nmodule loading by adding a missing decrement: it was really reaching\nonly depth 3 for 21 modules, but complained about reaching depth 20.\n\nSilences a spurious curiosity that a module is the VDSO by adding a\ncheck for soname staring with \"linux-gate.so\".\n\nSilences a vmareas assert on a size 0 mmap by adding an early exit.\n\nIssue: #8138, #6152\nFixes #8138" }, { "commit": "63ec6a7f9a9015164c80f942362503e6c8bfc12f", "tree": "c0c73b9e70fc4265f49a3df1d374441169830b01", "parents": [ "0293afa454fa2f28ac4867c3ec058df8fe917d8d" ], "author": { "name": "Derek Bruening", "email": "bruening@google.com", "time": "Thu Sep 24 23:06:21 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 24 23:06:21 2026" }, "message": "i#8125 a64 opt: Invert redzone check (#8135)\n\nInverts the drmemtrace trace buffer redzone check. Instead of re-setting\nthe buffer to 0 every time and the redzone to -1 and identifying when to\noutput by reading a non-0 value, we set the redzone to hold a sentinel\nrecord value: the value 1, which would be a load/store of the address 1,\nwhich seems pretty unlikely (we do see 0 in prefetches). If it does\nhappen, we\u0027ll just output early; the output code is updated here to\nclobber the 1 so the same record won\u0027t trigger again.\n\nFor online, with 12-byte records, we set the 1st pointer-sized bytes to\nthe sentinel 1 and the final 4 to 0. This is a write to 0, which should\nalso be rare.\n\nFor 32-bit, we have to keep the memset, as loads and stores assume the\ntop word is already zeroed, but 32-bit is not a performance priority.\n\nChanging the clean call skip is pretty simple on arm; on x86 it adds a\nredirection jump. The filter mode change checks that leverage the\nredzone check are more complicated and we change those to branches that\nskip over the other skips.\n\nOn SPECCPU2017 INT this provides a 2% performance improvement, but it\nenables larger buffer sizes without paying a memset cost. A future\nupdate will make the main thread\u0027s buffer 8x larger, which is a 14%\nno-i/o improvement and half that with LZ4 output.\n\nIssue: #8125" }, { "commit": "0293afa454fa2f28ac4867c3ec058df8fe917d8d", "tree": "86e6ae4a424229710b1f38aff8cce4f81a0d9855", "parents": [ "c71f56643db0d14010ba3fb3638e7b5e3ae7ddc2" ], "author": { "name": "Bin Wang", "email": "biwa@google.com", "time": "Thu Sep 24 21:43:45 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 24 21:43:45 2026" }, "message": "i#8021 kernel: Advance kernel module initialization through modules_init() (#8123)\n\nPreviously in #8096, we implemented\n`dynamorio_app_init_part_one_options()` in `dynamorio_app_init()` to\nparse and initialize DynamoRIO runtime options when loading the kernel\nmodule.\n\nThis PR advances kernel module initialization into part two of\n`dynamorio_app_init()` through `modules_init()` (including VMM/heap, VM\nareas, decoder, processor, and module initialization). The rest of part\ntwo is left for follow-up PRs to keep this one relatively small and\nreviewable.\n\n- Call `dynamorio_app_init()` from `dynamorio_module_init()`, and add a\ntemporary kernel-only early return after `modules_init()` in\n`dynamorio_app_init_part_two_finalize()`.\n- Resolve kernel `_text` and `_end` symbols to implement\n`get_application_base()` and `get_application_end()`.\n- Change default heap size to 256MB and allocate heap as RWX\n(`PAGE_KERNEL_EXEC`). Implement `os_heap_reserve_in_region()`,\n`os_heap_commit()`, `os_heap_decommit()`, and\n`os_heap_get_commit_limit()`.\n- Update `os_check_option_compatibility()` to configure VMM placement\nfor the pre-allocated module heap (`reachable_heap`, `vm_base_near_app`,\n`vmm_block_size`, and clamping `vm_size`) and disable reset options via\n`DISABLE_RESET()`.\n- Switch `LINUX_KERNEL` from `HAVE_MEMINFO_MAPS` to\n`HAVE_MEMINFO_QUERY`, implement `is_readable_without_exception*()` using\n`copy_from_{user,kernel}_nofault()`, and stub out `all_memory_areas`\nhelpers.\n- Implement `os_modules_init()`/`exit()`, `report_diagnostics()`, and\n`diagnost_exit()` as no-ops in kernel mode.\n\nIssue: #8021" }, { "commit": "c71f56643db0d14010ba3fb3638e7b5e3ae7ddc2", "tree": "22dfdd25a3035985f15528d0158cae14a057446b", "parents": [ "e5c00ca6a0a77f14c1133d32fe787e759d8f3f1e" ], "author": { "name": "Derek Bruening", "email": "bruening@google.com", "time": "Thu Sep 24 20:45:24 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 24 20:45:24 2026" }, "message": "i#8136: Ignore rseq committing store side effects (#8137)\n\nOn the first execution, we need to nop out a store\u0027s memory operations\nbut not its register side effects if it\u0027s mid-sequence: but not if it\u0027s\nthe final instruction (committing store). We relax the existing fatal\nerror on a store with multiple destinations if it\u0027s the final\ninstruction.\n\nAdds a test case that fails without the fix.\n\nAlso tested on our internal application where this was first hit.\n\nFixes #8136" }, { "commit": "e5c00ca6a0a77f14c1133d32fe787e759d8f3f1e", "tree": "280889050d10e85aa09cca63d7a5bb1842b05212", "parents": [ "d53efb2f19e406e48bbf0c01f9664518ad8c5e3e" ], "author": { "name": "Derek Bruening", "email": "bruening@google.com", "time": "Tue Sep 22 23:59:23 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 22 23:59:23 2026" }, "message": "i#8125 a64 opt: Make trace buffer size option-controlled (#8134)\n\nAdds two new drmemtrace options: -main_buf_records and\n-trace_buf_records, controlling the buffer size (in record count) for\nthe main (initial) thread and subsequent threads. The main thread has a\ndifferent size to facilitate forthcoming increases (after we invert the\nredzone check) without adding space for every thread.\n\nTested:\n\n```\n$ bin64/drrun -t drmemtrace -offline -main_buf_records 32K -verbose 2 \\\n -- suite/tests/bin/pthreads.pthreads\nT177260 trace buffer size\u003d262144 max\u003d266240 redzone\u003d4096\nT177274 trace buffer size\u003d32768 max\u003d36864 redzone\u003d4096\nT177275 trace buffer size\u003d32768 max\u003d36864 redzone\u003d4096\n```\n\nIssue: #8125" }, { "commit": "d53efb2f19e406e48bbf0c01f9664518ad8c5e3e", "tree": "e0537ff2f42c165687f8007759fd0828e4c0769a", "parents": [ "a51df51418309358570680f7363c3d3b8748f94d" ], "author": { "name": "Bin Wang", "email": "biwa@google.com", "time": "Tue Sep 22 01:36:37 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 22 01:36:37 2026" }, "message": "i#8131: Return CPU id plus one for kernel thread id helpers (#8132)\n\nKernel thread ID helpers return CPU numbers, which can be zero and\ncollide with `INVALID_THREAD_ID`. In debug builds, when module\ninitialization happens on CPU 0, DR will mistake an unowned mutex (whose\n`owner` equals `INVALID_THREAD_ID`) for a mutex owned by the current\nCPU, causing heap initialization to fail.\n\n- Change `d_r_get_thread_id()` to return CPU ID plus one, and have\n`get_sys_thread_id()` use the same helper.\n- Add XXX comments about alternative approaches.\n- Link issue #8131 to the existing XXX comments above\n`INVALID_THREAD_ID`.\n\nFixes #8131" }, { "commit": "a51df51418309358570680f7363c3d3b8748f94d", "tree": "275a85e853f82567532924def91e9947f787a539", "parents": [ "dcd8185559181769c83819ed314633878ffa992a" ], "author": { "name": "Derek Bruening", "email": "bruening@google.com", "time": "Mon Sep 21 17:39:56 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 21 17:39:56 2026" }, "message": "i#8125 a64 opt: Optimize memcpy and memset-non-zero (#8130)\n\nAdds simple 16-byte-aligned loop optimizations to our memcpy and\nmemset-to-non-zero asm routines.\nOur versions are still 50% slower than libc, but they are 10x faster\nthan before and shouldn\u0027t be bottlenecks anymore.\n\nBefore:\n```\nour_memcpy_time: size\u003d1 time\u003d0\nlibc_memcpy_time: size\u003d1 time\u003d0\nour_memcpy_time: size\u003d4 time\u003d0\nlibc_memcpy_time: size\u003d4 time\u003d1\nour_memcpy_time: size\u003d128 time\u003d4\nlibc_memcpy_time: size\u003d128 time\u003d0\nour_memcpy_time: size\u003d512 time\u003d17\nlibc_memcpy_time: size\u003d512 time\u003d1\nour_memcpy_time: size\u003d8192 time\u003d261\nlibc_memcpy_time: size\u003d8192 time\u003d12\nour_memcpy_time: size\u003d20480 time\u003d650\nlibc_memcpy_time: size\u003d20480 time\u003d31\n\nour_memset_time: 635\nlibc_memset_time: 30\n```\n\nAfter:\n```\nour_memcpy_time: size\u003d1 time\u003d0\nlibc_memcpy_time: size\u003d1 time\u003d0\nour_memcpy_time: size\u003d4 time\u003d0\nlibc_memcpy_time: size\u003d4 time\u003d1\nour_memcpy_time: size\u003d128 time\u003d0\nlibc_memcpy_time: size\u003d128 time\u003d0\nour_memcpy_time: size\u003d512 time\u003d2\nlibc_memcpy_time: size\u003d512 time\u003d1\nour_memcpy_time: size\u003d8192 time\u003d17\nlibc_memcpy_time: size\u003d8192 time\u003d13\nour_memcpy_time: size\u003d20480 time\u003d42\nlibc_memcpy_time: size\u003d20480 time\u003d31\n\nour_memset_time: 58\nlibc_memset_time: 31\n```\n\nWe already have tests of memcpy in core_unit_tests from io.c.\n\nIssue: #8125" }, { "commit": "dcd8185559181769c83819ed314633878ffa992a", "tree": "278ccc15bedf7d2c32e8f8a5bfb235f9544c2181", "parents": [ "6c8a0c34be4adeab20deed5326acd5bdf08650a1" ], "author": { "name": "Derek Bruening", "email": "bruening@google.com", "time": "Mon Sep 21 16:45:55 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 21 16:45:55 2026" }, "message": "i#8125 a64 opt: Optimize memset with DV ZVA (#8127)\n\nAdds a fastpath to the AArch64 memset using DC ZVA when setting to 0.\nThis speeds up drmemtrace by 2.3x on SPECCPU (see\nhttps://github.com/DynamoRIO/dynamorio/issues/8125#issuecomment-5722352941),\nas drmemtrace zeroes out its trace buffer for its redzone scheme. This\nwas a major cause of why AArch64 drmemtrace was so much slower than x86\ndrmemtrace.\n\nAdds memset unit tests.\n\nThe core_unit_tests memset times compared to libc with the -1 removed\n(so just 0) went from:\n```\nour_memset_time: 751\nlibc_memset_time: 12\n```\nTo:\n```\nour_memset_time: 18\nlibc_memset_time: 11\n```\n\nAdding back the -1 it went from:\n```\nour_memset_time: 1458\nlibc_memset_time: 31\n```\nto:\n```\nour_memset_time: 635\nlibc_memset_time: 30\n```\n\nFurther tested by successfully running SPECCPU (results at\nhttps://github.com/DynamoRIO/dynamorio/issues/8125#issuecomment-5722352941).\n\nIssue: #8125" }, { "commit": "6c8a0c34be4adeab20deed5326acd5bdf08650a1", "tree": "e4fc6b712e4d498f52527dea44a66dae7562672c", "parents": [ "028db755679601c5dc0a728ed1db2bc762e71fbc" ], "author": { "name": "Derek Bruening", "email": "bruening@google.com", "time": "Sat Sep 19 02:01:47 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Sep 19 02:01:47 2026" }, "message": "i#4898: Elide AArch64 stack pointers in drmemtrace (#8129)\n\nAdds elision of AArch64 stack pointers by treating like the stolen\nregister and removing the displacement. This lets them use the existing\nbasic no-displacement and elision machinery. The newly added\nGPR-generalized pre-post-indexed elision support takes over from there.\n\nThis speeds up SPECPU2017 INT by 10%.\n\nAdds test cases to the burst_traceopts and raw2trace_unit_tests tests.\n\nFixes #4898" }, { "commit": "028db755679601c5dc0a728ed1db2bc762e71fbc", "tree": "b2ee490bf672e7dd45c2f64084fcceb44773df41", "parents": [ "d9cf598ee3552399dcca00efae974918583e5945" ], "author": { "name": "Derek Bruening", "email": "bruening@google.com", "time": "Fri Sep 18 20:10:45 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 18 20:10:45 2026" }, "message": "i#8125 a64 opt: Remove superfluous buffer load on elided memref (#8126)\n\nIn drmemtrace, the buffer load added prior to a memory-accessing\ninstruction ends up being superfluous if that instruction\u0027s memref(s)\nare all elided. Here we remove it to reduce overhead. Measurements show\nthis has on average just a 1% impact, mostly in the noise: presumably\nbecause the buffer pointer is always in the L1 cache. It is still\nworthwhile to shrink the instrumentation size and remove unnecessary\nloads.\n\nIn the same vein of small instrumentation improvements: also adds a\nconditional to limit delayed instruction counting to offline mode; this\nwas observed to cause extra code run during tracing on instructions\nbeyond the first one (but no extra instrumentation: instrument_instr has\na flag causing it to short-circuit).\n\nTested:\n\nIn the allasm_aarch64_prefetch app we have prefetches whose addresses\nare all elided, so the superfluous loads really jump out:\n\nBefore:\n\n```\n 0x0000000041d10058 f9800000 prfm $0x00 (%x0)\n 0x0000000041d1005c f940d782 ldr +0x01a8(%x28)[8byte] -\u003e %x2\n 0x0000000041d10060 f8800000 prfum $0x00 (%x0)\n 0x0000000041d10064 f940d782 ldr +0x01a8(%x28)[8byte] -\u003e %x2\n 0x0000000041d10068 f9800001 prfm $0x01 (%x0)\n 0x0000000041d1006c f940d782 ldr +0x01a8(%x28)[8byte] -\u003e %x2\n 0x0000000041d10070 f8800001 prfum $0x01 (%x0)\n 0x0000000041d10074 f940d782 ldr +0x01a8(%x28)[8byte] -\u003e %x2\n 0x0000000041d10078 f8800001 prfum $0x01 (%x0)\n 0x0000000041d1007c f940d782 ldr +0x01a8(%x28)[8byte] -\u003e %x2\n 0x0000000041d10080 f9800002 prfm $0x02 (%x0)\n 0x0000000041d10084 f940d782 ldr +0x01a8(%x28)[8byte] -\u003e %x2\n 0x0000000041d10088 f8800002 prfum $0x02 (%x0)\n 0x0000000041d1008c f940d782 ldr +0x01a8(%x28)[8byte] -\u003e %x2\n 0x0000000041d10090 f9800002 prfm $0x02 (%x0)\n```\n\nAfter:\n\n```\n 0x00000000492f0058 f9800000 prfm $0x00 (%x0)\n 0x00000000492f005c f8800000 prfum $0x00 (%x0)\n 0x00000000492f0060 f9800001 prfm $0x01 (%x0)\n 0x00000000492f0064 f8800001 prfum $0x01 (%x0)\n 0x00000000492f0068 f8800001 prfum $0x01 (%x0)\n 0x00000000492f006c f9800002 prfm $0x02 (%x0)\n 0x00000000492f0070 f8800002 prfum $0x02 (%x0)\n 0x00000000492f0074 f9800002 prfm $0x02 (%x0)\n```\n\nIssue: #8125" }, { "commit": "d9cf598ee3552399dcca00efae974918583e5945", "tree": "4f4f791674bb3085cc5dc04940cf57ea8361c4b1", "parents": [ "370781ab9782e5b0c89dbf588e6f319a29e8837b" ], "author": { "name": "Derek Bruening", "email": "bruening@google.com", "time": "Fri Sep 18 20:10:34 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 18 20:10:34 2026" }, "message": "i#4913 elide++: Add elision support for GPR add, sub, indexing (#8120)\n\nExtends the drmemtrace offline trace elision optimizations to support\nany general-purpose base register being modified by an add, a subtract,\nan x86 LEA, or an arm pre-indexed or post-indexed addressing mode.\n\nThis was measured to speed up x86 SPECCPU2017 INT by 2.3%: so a modest\nspeedup on top of stack push/pop elision which is already in place.\n\nAdds test cases to burst_traceopts.\n\nAdds test cases to raw2trace_unit_tests, which required adding\nconvenience macros for INSTR_CREATE_{ld,st}{r,p}_imm_{pre,post}index().\n\nAArch64 still does not elide stack pointer bases: that is under #4898\nand will be resolved separately, but it needs this pre-and-post-indexed\ntracking in order to work.\n\nIssue: #4913" }, { "commit": "370781ab9782e5b0c89dbf588e6f319a29e8837b", "tree": "ec201e8b4c4e8bbbf50f96e437356d8e44b4ab5d", "parents": [ "21252f351262e3b53061c8e63da99051009a883f" ], "author": { "name": "Derek Bruening", "email": "bruening@google.com", "time": "Wed Sep 16 21:55:46 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 16 21:55:46 2026" }, "message": "i#8109: Properly assign dfiltered addresses (#8121)\n\nFixes the \"L0\" data cache online filtering of drmemtrace to properly\nassign filtered addresses to their owning instrutions within each block.\nPreviously, the first set of load or store instructions in the block was\ngreedily and blindly assigned the addresses. We have to insert 0-count\nPC records to properly assign them.\n\nAdds a new allasm-dfilter test with alternating hits and misses to test\nthis.\n\nWithout the fix:\n```\n 2: W0.Tx ifetch 3 byte(s) @ 0x401008 48 8b 01 mov (%rcx), %rax\n 2: W0.Tx read 8 byte(s) @ 0x402000 by PC 0x401008\n 3: W0.Tx ifetch 4 byte(s) @ 0x40100b 48 8b 41 20 mov 0x20(%rcx), %rax\n 3: W0.Tx read 8 byte(s) @ 0x402040 by PC 0x40100b\n 4: W0.Tx ifetch 4 byte(s) @ 0x40100f 48 8b 41 40 mov 0x40(%rcx), %rax\n 4: W0.Tx read 8 byte(s) @ 0x402080 by PC 0x40100f\n 5: W0.Tx ifetch 4 byte(s) @ 0x401013 48 8b 41 60 mov 0x60(%rcx), %rax\n 5: W0.Tx read 8 byte(s) @ 0x4020c0 by PC 0x401013\n 6: W0.Tx ifetch 7 byte(s) @ 0x401017 48 8b 81 80 00 00 00 mov 0x80(%rcx), %rax\n 7: W0.Tx ifetch 7 byte(s) @ 0x40101e 48 8b 81 a0 00 00 00 mov 0xa0(%rcx), %rax\n 8: W0.Tx ifetch 7 byte(s) @ 0x401025 48 8b 81 c0 00 00 00 mov 0xc0(%rcx), %rax\n```\n\nWith the fix:\n```\n 2: W0.Tx ifetch 3 byte(s) @ 0x401008 48 8b 01 mov (%rcx), %rax\n 2: W0.Tx read 8 byte(s) @ 0x402000 by PC 0x401008\n 3: W0.Tx ifetch 4 byte(s) @ 0x40100b 48 8b 41 20 mov 0x20(%rcx), %rax\n 4: W0.Tx ifetch 4 byte(s) @ 0x40100f 48 8b 41 40 mov 0x40(%rcx), %rax\n 4: W0.Tx read 8 byte(s) @ 0x402040 by PC 0x40100f\n 5: W0.Tx ifetch 4 byte(s) @ 0x401013 48 8b 41 60 mov 0x60(%rcx), %rax\n 6: W0.Tx ifetch 7 byte(s) @ 0x401017 48 8b 81 80 00 00 00 mov 0x80(%rcx), %rax\n 6: W0.Tx read 8 byte(s) @ 0x402080 by PC 0x401017\n 7: W0.Tx ifetch 7 byte(s) @ 0x40101e 48 8b 81 a0 00 00 00 mov 0xa0(%rcx), %rax\n 8: W0.Tx ifetch 7 byte(s) @ 0x401025 48 8b 81 c0 00 00 00 mov 0xc0(%rcx), %rax\n 8: W0.Tx read 8 byte(s) @ 0x4020c0 by PC 0x401025\n```\n\nFixes #8109" }, { "commit": "21252f351262e3b53061c8e63da99051009a883f", "tree": "fe079624281512c33d34286b1465c4435b8d7469", "parents": [ "fb928d93720e01b9cc26760569aa6e73f1eb30a0" ], "author": { "name": "Jack Gallagher", "email": "jack.gallagher@arm.com", "time": "Wed Sep 16 07:43:09 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 16 07:43:09 2026" }, "message": "i#7585 AArch64 selfmod: Implement sandboxing (#8103)\n\nImplement an AArch64 version of insert_selfmod_sandbox() modelled after\nthe x86 version.\n\nThe existing AArch64 self-modifying code support works by mangling ic\ncache maintenance instructions to flush code cache fragments containing\ninvalidated addresses. This works fine for code which uses ic\ninstructions but there are two cases where cache maintenance\ninstructions are not required which this does not address:\n- Hardware with coherent icaches where software is not required to\nperform explicit cache maintenance.\n - Concurrent Modification and Execution of Instructions (CMODX).\n\nSandboxing adds support for these cases by adding a check for\nmodifications at the beginning for fragments corresponding to writable\nmemory.\n\nThe new behaviour is currently off by default on AArch64 but can be\nenabled with the -hw_cache_consistency option. From my testing I believe\nthat the new mangling code is correct but I have seem some app data\ncorruption crashes stemming from the signal handling code where an app\nwrites to a page that DR has made read-only to detect writes. I am\nintending for fix this issue in a separate PR. Once this is fixed and\nfurther testing shows no more bugs -hw_cache_consistency will become the\nnew default behaviour on AArch64.\n\nAI tools were used to prototype and debug parts of this commit but all\ngenerated code has been reviewed and revised by me. The documentation\nchanges are handwritten.\n\nIssues: #2055, #5771, #7585" }, { "commit": "fb928d93720e01b9cc26760569aa6e73f1eb30a0", "tree": "2db6e700412a605ed58b217b72dc16edb9bc79bc", "parents": [ "76c5170fcda810fa53b5beb10b1038cc65018480" ], "author": { "name": "Derek Bruening", "email": "bruening@google.com", "time": "Tue Sep 15 14:47:11 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 15 14:47:11 2026" }, "message": "i#4914: Optimize rep strings in drmemtrace offline traces (#8114)\n\nFor non-filtered drmemtrace offline traces, disables unrolling of\nrepeated string loops. The first iteration\u0027s address(es) are recorded\nbefore the rep-string, and the last iteration\u0027s are recorded *after*. A\nnop is appended to avoid complexity if a block ends in a rep-string\n(unlikely.\n\nRaw2trace now unrolls the loop. It removes the records if it detects a\nzero-iteration loop (something we could try to optimize to avoid writing\nrecords; left for future work). Otherwise, it fills in between the start\nend end addresses, handling the different types of string operations and\ndirections. It outputs the block-record buffer when needed to avoid\noverflow.\n\nThis speeds up SPECCPU 2017 gcc ref subrun 5 by 10x! It also speeds up\nleela by 18%.\n\nIf a rep string loop is interrupted by a handled fault, the tracer\ndetects this in the kernel xfer event and on decoding and identifying a\nrep string, it inserts the end address(es). Raw2trace is updated to\nsupport a partially-interrupted rep string. It also detects a rep string\nthat never started and removes the instruction (and encoding, if added)\nand inserts a TRACE_MARKER_TYPE_UNCOMPLETED_INSTRUCTION marker.\n\nBumps the raw trace version so we can tell whether to expect this.\n\nAdds raw2trace unit tests for regular, legacy, and filtered cases.\n\nAdds a new burst_repstr test targeting interrupted string loops.\n\nFurther tested manually on allasm-repstr with its new backward loop: the\nfinal trace was diffed versus the code base before this PR and found to\nbe identical except thread id and timestamp values.\n\nUpdates the instcount test to pass a lower window count to keep the same\nbehavior with its rep loop becoming a single instruction in the counter.\nUpdates the windows-asm test output as its block boundaries changed and\nso its window boundaries changed.\n\nFuture work includes adding d-filter support via filtering in a clean\ncall after the loop, so we can then remove the no-fetch records for all\noffline, and have the reader remove for online (#4915).\n\nIssue: #4914" }, { "commit": "76c5170fcda810fa53b5beb10b1038cc65018480", "tree": "67bacd1513c4057014782bb428c6dbb704a37fc5", "parents": [ "aa12773ddb283b0d2beae9640657371e63e19a9a" ], "author": { "name": "Bin Wang", "email": "biwa@google.com", "time": "Mon Sep 14 20:45:54 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 14 20:45:54 2026" }, "message": "i#8021: Add DR options parsing in the kernel module init (#8096)\n\n- Add an `options` module parameter to accept DynamoRIO options on\n`insmod` and initialize them via `dynamorio_app_init_part_one_options()`\nduring module init.\n- Added functions in `core/kernel_linux/os.c` that\n`dynamorio_app_init_part_one_options()` depends on. They are exercised\nby the init path and tested in the insmod CI.\n- Implement `kernel_setenv()` for saving the options value. \n- Implement `os_check_option_compatibility()` to enforce kernel-mode\noptions constraints.\n- Update the kernel module insmod workflow to build with both\n`-DDEBUG\u003dON` and `OFF`, and verify that runtime options (`-loglevel 2`)\nare parsed and logged correctly in the debug build.\n\nOn configuration lookup: the shared init path still performs it, but\n`os_open()` is intentionally not implemented in kernel mode and returns\n`INVALID_FILE` unconditionally. So no config file can be found and\noptions can only be set using the module parameter.\n\nThe kernel-mode options constraints implemented in\n`os_check_option_compatibility()` are mostly copied from drk and may\nneed future adjustments. For example, #8116 tracks CPU-private fragment\nrestrictions (`shared_bbs`, `shared_traces`, `coarse_units`).\n\nThis initial implementation only supports setting options at module load\ntime. Dynamic updates and per-process options are tracked by #8115.\n\nIssue: #8021" }, { "commit": "aa12773ddb283b0d2beae9640657371e63e19a9a", "tree": "7e70ab99a9392a69751ec2c17c318a8a9f826e3c", "parents": [ "fb0dd19fe01674d888eef97dcda288b9fcc63a6d" ], "author": { "name": "Suyash Mahar", "email": "smahar@meta.com", "time": "Mon Sep 14 20:05:14 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 14 20:05:14 2026" }, "message": "i#8087: Fix visibility of safe-read assembly labels (#8107)\n\nThe safe-read labels are hidden in assembly but not in their C\ndeclarations. On ARM, this creates GOT-based address references that can\nbecome stale when BOLT moves `safe_read_asm()`, preventing fault\nrecovery.\n\nMark the declarations hidden to generate direct references to ensure no\nGOT entries are created for them. Tested on a large internal application\nthat uses BOLT.\n\nFixes #8087" }, { "commit": "fb0dd19fe01674d888eef97dcda288b9fcc63a6d", "tree": "dfef2bcd36fb242a6b7d651792a851203ec26179", "parents": [ "cb76a799e3fa205e6d5d818b51b57d178d65c6f9" ], "author": { "name": "Derek Bruening", "email": "bruening@google.com", "time": "Sat Sep 12 01:11:41 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Sep 12 01:11:41 2026" }, "message": "i#4914 repstr bounds: Add backward loop to allasm-repstr (#8113)\n\nAdds a backward loop to allasm-repstr.asm to help test that case. Split\nfrom the rest of #4914 to keep review sizes down.\n\nIssue: #4914" }, { "commit": "cb76a799e3fa205e6d5d818b51b57d178d65c6f9", "tree": "5444c03b5b875203e7a5307b97347e0ed1d5b2ba", "parents": [ "8c21ffef523782c1bf2bd831d687585ef1029870" ], "author": { "name": "Derek Bruening", "email": "bruening@google.com", "time": "Fri Sep 11 16:51:47 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 11 16:51:47 2026" }, "message": "i#8110: Clear last block in raw2trace on filter endpoint (#8111)\n\nWhen the decode cache is cleared on a filter endpoint, raw2trace needs\nto also clear its last block fields.\n\nAdds a unit test that fails without this fix.\n\nFixes #8110" }, { "commit": "8c21ffef523782c1bf2bd831d687585ef1029870", "tree": "d361552496aeddb3bad11274ce8e61b53fa55f28", "parents": [ "ca70b92f4e587d771191ceefce0971f9a27b27ef" ], "author": { "name": "Derek Bruening", "email": "bruening@google.com", "time": "Thu Sep 10 21:41:33 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 10 21:41:33 2026" }, "message": "i#4913: Elide push/pop base in x86 drmemtrace (#8105)\n\nAdds elision of the stack pointer base for repeated push/pop\ninstructions by tracking the displacement changes. Only supports x86\npush/pop for now.\n\nAdds reconstruction in raw2trace, using stack pointer tracking and an\ninstru_offline_t helper to detect elision breaks.\n\nBumps the raw trace version.\n\nAdds burst_traceopts test cases to confirm the actual addresses in the\nfinal trace match the non-optimized version.\n\nAdds a raw2trace unit test sanity test case.\n\nOn SPECCPU2017 INT, this was found to improve performance by 9% on\naverage.\n\nIssue: #4913" }, { "commit": "ca70b92f4e587d771191ceefce0971f9a27b27ef", "tree": "d41af5f18395d501bf835a673720294300d04161", "parents": [ "a19f42101c3b23950b022fc89e1b64bc28ba649b" ], "author": { "name": "Derek Bruening", "email": "bruening@google.com", "time": "Thu Sep 10 19:37:42 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 10 19:37:42 2026" }, "message": "Replace XXX with FIXME in docs on what not to use (#8108)\n\nPR #7580 incorrectly replaced XXX with FIXME in the style docs for what\nnot to use." }, { "commit": "a19f42101c3b23950b022fc89e1b64bc28ba649b", "tree": "5e4232c199853706adebdf5eab5a1f65c5eaf93f", "parents": [ "f50545b9fe31c536787de9f1e714fba99be7f810" ], "author": { "name": "Derek Bruening", "email": "bruening@google.com", "time": "Thu Sep 10 19:37:33 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 10 19:37:33 2026" }, "message": "i#4914 repstr bounds: Add 8-byte repstr creation macros (#8106)\n\nAdds the missing 8-byte versions INSTR_CREATE macros for MOVS, CMPS,\nSCAS and their repeating counterparts, along with the 8-byte repeating\nversions of STOS and LODS. Simplifies the memory sizes used in the\nmacros to avoid confusion by removing rex8.\n\nAdds test case to api.ir_x86.\n\nThese are wanted to build tests for the drmemtrace repstr bound\noptimizations.\n\nIssue: #4914" }, { "commit": "f50545b9fe31c536787de9f1e714fba99be7f810", "tree": "18af7f233f03ed3791b5e72dffc23d7219375973", "parents": [ "9209788cb946612fd0ca98f90cfa7827c53b21a9" ], "author": { "name": "Derek Bruening", "email": "bruening@google.com", "time": "Wed Sep 09 21:10:09 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 09 21:10:09 2026" }, "message": "i#7914 skipped memrefs: Refactor scatter/gather into raw2trace helper (#8102)\n\nRefactors the raw2trace scatter/gather skipped-memref code into a\nseparate helper function to keep the code easier to read and maintain.\n\nThis is a prelude to adding rep string expansion in raw2trace for\nparallel helper function.\n\nIssue: #7914, #4914" }, { "commit": "9209788cb946612fd0ca98f90cfa7827c53b21a9", "tree": "d7821135dbd951b5f87da8af21f4629281d6999a", "parents": [ "8aaa876bd301ce45d5dcbef1c3f23d4e05ee988e" ], "author": { "name": "Abhinav Anil Sharma", "email": "sharmaabhinav@google.com", "time": "Tue Sep 08 22:30:48 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 08 22:30:48 2026" }, "message": "i#8100: Try rseq_len value range in glibc struct rseq search (#8101)\n\nFixes glibc struct rseq detection heuristic, which is broken after\nrecent kernel changes that increased the size of the struct\n(https://lwn.net/Articles/885818). This affects DR mid-run attach uses\nwhere DR did not have a chance to observe glibc\u0027s original rseq syscall\nthat registered its struct.\n\nThe struct rseq was 32 bytes with padding before, which was supposed to\nbe passed as rseq_len to the rseq syscall. Now rseq_len may be\ngetauxval(AT_RSEQ_FEATURE_SIZE), so we need to try multiple sizes. As we\ndo not want to depend on the getauxval library call in DR code, we\nhardcode the value actually seen in a more recent environment where the\nprior try_struct_rseq failed.\n\nSee https://lwn.net/Articles/1033957/ for more details.\n\nFixes: #8100" }, { "commit": "8aaa876bd301ce45d5dcbef1c3f23d4e05ee988e", "tree": "d74802deabd14a840513f82aaabd2ef96ac6c2dc", "parents": [ "8161ea5959f4a1cf94ecb0d5b77bab1a946a4c0e" ], "author": { "name": "Bin Wang", "email": "biwa@google.com", "time": "Tue Sep 08 18:39:28 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 08 18:39:28 2026" }, "message": "i#8097: Rebuild kernel module when headers change (#8099)\n\nReplace the output-based custom command with an always-run target, so\nkbuild checks source and header dependencies on every build.\nPrebviously, header-only edits will not trigger a rebuild, which leaves\na stale .ko file.\n\nNote that this doesn\u0027t mean every `cmake --target dynamorio_module`\nrebuilds everything from scratch: kbuild itself still tracks\ndependencies and re-compiles only affected ordinary objects. In other\nwords, the changes in this PR simply delegate dependencies tracking to\nKbuild.\n\nFixes #8097" }, { "commit": "8161ea5959f4a1cf94ecb0d5b77bab1a946a4c0e", "tree": "fa786bbb88ab3e5ecf5f7dba843bd655fbe66190", "parents": [ "a55426cdb63e03ca749a9daa47e84044b1ef7952" ], "author": { "name": "Phil Ramsey", "email": "phil.ramsey@arm.com", "time": "Mon Sep 07 09:04:19 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 07 09:04:19 2026" }, "message": "i#8079 fix tool.drcacheoff.outdir-none-windows on CentOS and SLES (#8095)\n\nThis test assumes that the final output will be \"Hello, world!\" but if\nthe application shutdown code reaches a threshold there may be an\nadditional \"Hit retrace threshold\" message. This happens consistently on\nCentOS 9 and SLES 15.\n\nUpdate the .templatex file to allow optional output after \"Hello,\nworld!\"\n\nIssue: #8079" }, { "commit": "a55426cdb63e03ca749a9daa47e84044b1ef7952", "tree": "383a57d4ff2c7f51aae7cf56e252411109fe64cd", "parents": [ "f9ea8b20cebb2c0a87c458ff273e91b08bd7e9af" ], "author": { "name": "Bin Wang", "email": "biwa@google.com", "time": "Fri Sep 04 21:22:55 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 04 21:22:55 2026" }, "message": "I#8021: Set up integration test for DynamoRIO kernel module (#8090)\n\n- Set up a new GitHub workflow that (1) builds the kernel module against\nthe kernel inside the runner, and (2) loads/unloads the kernel module\nand checks whether the expected logs are printed in `dmesg`\n\n- Disable objtool validation with `OBJECT_FILES_NON_STANDARD :\u003d y` when\nbuilding the kernel module.\nOur x86.asm doesn\u0027t adhere to kernel objtool/SLS conventions. The GitHub\nrunner kernel has `CONFIG_OBJTOOL_WERROR` enabled, so objtool reports\nissues as errors instead of warnings.\n\n- Add -mfunction-return\u003dkeep flag when compiling the kernel module. \nBy default the kernel build system adds `-mfunction-return\u003dthunk-extern`\nfor Spectre mitigation, which generates `jmp __x86_return_thunk` instead\nof `ret` for every function return. When objtool validation is disabled,\nit doesn\u0027t generate the `.return_sites` section in the ELF section,\nwhich is needed for the mitigation to work. `-mfunction-return\u003dkeep`\ntells gcc to generate `ret` instead of `jmp __x86_return_thunk`.\n\n- Switch to `__vmalloc_node_range` for kernel module heap allocation.\nBefore we were only testing again kernel 6.6, and the GitHub runner has\na newer kernel which has `module_alloc()` removed. After some research I\ncome to the conclusion that across 6.6+ LTS kernels,\n`__vmalloc_node_range` is the only reliable API to allocate writable\nmemory within the 2GB reach of kernel text\n(`MODULES_VADDR..MODULES_END`). Alternatives:\n - `module_alloc()`: Removed in 6.10. Returns RW+NX.\n- `execmem_alloc()`: Introduced in 6.10. Returns RW+NX in 6.10-6.12, but\nread-only-execute (ROX) in 6.13+.\n - `execmem_alloc_rw()`: Introduced in 6.14. Returns RW+NX.\n\n\n- Auto-generate weak stubs for undefined symbols so the module loads\nduring incremental development (`generate_stubs.cmake`). When\n`Module.symvers` is present, the build runs `nm -u` on the composite\nobject, filters out kernel-exported symbols, and generates a weak\n`BUG()` stub for each remaining symbol — so an unexpected call at\nruntime fails loudly with a kernel oops. When `Module.symvers` is\nabsent, stub generation is skipped and the build relies on\n`KBUILD_MODPOST_WARN\u003d1` for compile-only testing.\n\nIssue: #8021." }, { "commit": "f9ea8b20cebb2c0a87c458ff273e91b08bd7e9af", "tree": "9882b44039b7b241b0ff577b9e1ff15154f1068d", "parents": [ "aee08a1323dabaf512ce593844e12de26e78fd2e" ], "author": { "name": "Jeevan N", "email": "njeevan2216@gmail.com", "time": "Fri Sep 04 15:07:12 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 04 15:07:12 2026" }, "message": "i#8076: Fix query_time_seconds() inconsistency in kernel build (#8094)\n\nThe kernel implementation of query_time_seconds() currently returns\nseconds since the Unix Epoch (1970-01-01), while DR\u0027s documented\ncross-platform contract uses seconds since 1601-01-01.\n\nThis causes the kernel build to return a different time base from the\nuser-space implementation.\n\nMoves UTC_TO_EPOCH_SECONDS to os_shared.h making it available to both\nthe Unix and Linux kernel implementations, and converts the kernel\nquery_time_seconds() result to the 1601-based time.\n\nNo changes are made to the existing Unix implementations of\nquery_time_millis() or query_time_micros().\n\nFixes #8076\n\n---------\n\nCo-authored-by: Bin Wang \u003cbiwa@google.com\u003e" }, { "commit": "aee08a1323dabaf512ce593844e12de26e78fd2e", "tree": "f170e20824459ed5b865358e3a30d6a1d8c797e7", "parents": [ "14472393fc1f49ee0b2046454aa49aec2e149ee4" ], "author": { "name": "Derek Bruening", "email": "bruening@google.com", "time": "Thu Sep 03 18:20:17 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 03 18:20:17 2026" }, "message": "i#8092: Mark RDSSPQ as predicated (#8093)\n\nFixes a crash in drmemtrace due to RDSSPQ being treated as always\nwriting its destination register, when it\u0027s a nop if CET is unsupported.\n\nTested on SPECCPU 2017 omnetpp and leela, which both hit SIGILL without\nthis fix and work with it.\n\nFixes #8092" }, { "commit": "14472393fc1f49ee0b2046454aa49aec2e149ee4", "tree": "29b5e93efe3cbfbf673102de2d2554b647ce94cc", "parents": [ "105f47e54f65dd4d390e91eaab597d9584185c1d" ], "author": { "name": "Suyash Mahar", "email": "smahar@meta.com", "time": "Tue Sep 01 16:34:46 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 01 16:34:46 2026" }, "message": " Reuse raw2trace kernel-event lookahead storage in drcachesim (#8085)\n\nReuse a per-thread vector instead of constructing a deque for every\ninstruction level kernel-event check. The std::deque was being\nconstructed for every instruction and resulted in significant overhead\nfor non-ZIP output of drraw2trace.\n\nBenchmark with raw input and uncompressed output for a single 970 MiB\nraw shard (`-jobs 1`):\n\n* master: 75.78s\n* this PR: 55.34s (-27.0%)\n\nThe output is byte identical." }, { "commit": "105f47e54f65dd4d390e91eaab597d9584185c1d", "tree": "38d41f4afe2b7d0992f3095e8258f32f44117290", "parents": [ "0cd3d84e20407c57862b4eb01d799dc3ed6d22a2" ], "author": { "name": "Bin Wang", "email": "biwa@google.com", "time": "Tue Sep 01 14:54:03 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 01 14:54:03 2026" }, "message": "i#8021: Implement kernel module init/exit with symbol resolution and heap reservation (#8075)\n\n- Resolve `kallsyms_lookup_name` at runtime via kprobe, then use it to\nresolve `module_alloc`.\n- Reserve a heap region via `module_alloc`, and release it on module\nexit.\n- Add `MODULE_DESCRIPTION` and `MODULE_AUTHOR`.\n\nIssue: #8021" }, { "commit": "0cd3d84e20407c57862b4eb01d799dc3ed6d22a2", "tree": "dd44903909b01486a2ed63a50602fb5c3482ed31", "parents": [ "6ee8a5c3e1fce5ce4d7d39f81757145731198c3f" ], "author": { "name": "donfucius", "email": "donfucius@gmail.com", "time": "Tue Sep 01 06:34:25 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 01 06:34:25 2026" }, "message": "i#8082: Fix heap overflow in nt_get_context64_size on non-XSTATE CPUs (#8083)\n\n## Summary\nFix heap overflow risk in `nt_get_context64_size()` on non-XSTATE CPUs.\n\n`RtlGetExtendedContextLength(CONTEXT_XSTATE)` can fail on non-XSTATE\npaths.\nThis change checks availability/success of that query and falls back to\n`sizeof(CONTEXT_64) + 16` when unavailable, avoiding undersized\nallocation\nand out-of-bounds write in later context handling.\n\n## Root cause\n`nt_get_context64_size()` assumed extended context query success and\ncould\ncache a too-small size (effectively 16 bytes) on failure paths in\nrelease\nbuilds.\n\n## Fix\n- Guard `RtlGetExtendedContextLength` usage.\n- Require successful NTSTATUS and valid returned length for extended\npath.\n- Fallback to non-extended `CONTEXT_64` size + alignment headroom.\n\nIssue: https://github.com/DynamoRIO/dynamorio/issues/8082" }, { "commit": "6ee8a5c3e1fce5ce4d7d39f81757145731198c3f", "tree": "a2d41a48a4737f7df4b9b99943a5f5c63713ada6", "parents": [ "bf55bd0a689a50dc37b9d00fb4bd14fb51d290c8" ], "author": { "name": "Jack Gallagher", "email": "jack.gallagher@arm.com", "time": "Tue Sep 01 06:25:10 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 01 06:25:10 2026" }, "message": "i#8080: Simplify AArch64 feature management in tests (#8081)\n\nUse -march\u003dnative where possible to enable all architecture features\nsupported by hardware. Architecture feature specific test code can now\nbe enabled selectively in the source code using the __ARM_FEATURE_*\nmacros.\n\ngas does not support the -march\u003dnative option so tests written in\nAArch64 assembly now enable features in the test source using .arch or\n.arch_extension directives.\n\nThis should be more scalable than the old system which required a lot of\nCMake boilerplate for each architecture feature and did not allow a test\nto enable more than one feature at a time.\n\nFixes #8080" }, { "commit": "bf55bd0a689a50dc37b9d00fb4bd14fb51d290c8", "tree": "fbe8d590ade21e6dbd1b28df5b5bf4cc2b1ed0e6", "parents": [ "0ce43c05362777471552a5f7035b85c4ec14d821" ], "author": { "name": "Enrico Deiana", "email": "edeiana@google.com", "time": "Tue Sep 01 00:04:03 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 01 00:04:03 2026" }, "message": "i#8079: Add none raw trace output destination mode to drmemtrace (#8088)\n\nAdds support for `-outdir none` in offline tracing to measure pure\ninstrumentation and tracing overhead without incurring disk I/O\noverhead.\n\nMeasured execution time of an invocation of `tar -czvf` app with\n`-outdir none` and regular `-outdir ${TMP_DIR}` three times.\nWith `-outdir none`:\n```\n$ /usr/bin/time drrun -s 90 -quiet -debug -killpg -stderr_mask 0xC -dumpcore_mask 0 -code_api -t drmemtrace -offline -subdir_prefix tool.drcacheoff.none -outdir none -- tar -czvf archive.tar.gz ./sizeable_dir\n[...]\n13.58user 6.21system 0:13.93elapsed 142%CPU (0avgtext+0avgdata 21016maxresident)k\n13.45user 6.00system 0:13.71elapsed 141%CPU (0avgtext+0avgdata 21252maxresident)k\n13.44user 5.95system 0:13.66elapsed 141%CPU (0avgtext+0avgdata 21180maxresident)k\n```\nWith `-outdir ${TMP_DIR}`:\n```\n$ /usr/bin/time drrun -s 90 -quiet -debug -killpg -stderr_mask 0xC -dumpcore_mask 0 -code_api -t drmemtrace -offline -subdir_prefix tool.drcacheoff.none -outdir ${PWD}/to_remove -- tar -czvf archive.tar.gz ./sizeable_dir\n[...]\n20.37user 7.55system 0:21.88elapsed 127%CPU (0avgtext+0avgdata 21536maxresident)k\n20.03user 7.73system 0:21.87elapsed 126%CPU (0avgtext+0avgdata 22264maxresident)k\n20.48user 7.69system 0:22.75elapsed 123%CPU (0avgtext+0avgdata 21720maxresident)k\n```\nConsistently getting ~1.6x speedup for `none` compared to dumping\nthe trace.\n\nIn a previous iteration of this feature, a long path passed to `-outdir`\nwould trigger a call to malloc during tracing in 4 different places in\n`clients/drcachesim/tracer/output.cpp`, which is forbidden, causing the\ntracer to fail with:\n```\n\u003cApplication /usr/bin/tar (692738) DynamoRIO usage error : malloc invoked mid-run when disallowed by DR_DISALLOW_UNSAFE_STATIC\u003e\n\u003cUsage error: malloc invoked mid-run when disallowed by DR_DISALLOW_UNSAFE_STATIC (\u003comitted\u003e/core/loader_shared.c, line 1089)\n```\nA long path passed to `-outdir` causes a call to malloc because it\nexceeds the ~20 chars allowed by `std::string` internal buffer for\nSmall String Optimization.\nThis is now fixed by retrieving the value of `-outdir` only once in\n`clients/drcachesim/tracer/output.cpp:init_io()`, where it is safe to\ncall malloc and caching if we are in `-outdir none` mode for the\nrest of tracing.\n\nAdds `tool.drcacheoff.outdir-none`,\n`tool.drcacheoff.outdir-none-windows`,\nand `tool.drcacheoff.outdir-long-dir` tests.\nWhere `tool.drcacheoff.outdir-long-dir` is designed to trigger the\naforementioned \"forbidden call to malloc\" problem.\n\nIssue #8079" }, { "commit": "0ce43c05362777471552a5f7035b85c4ec14d821", "tree": "81779623f657298f79849975fb69d6d09911debb", "parents": [ "f5e2bada5428752a5dcf74c7fee2fe126e240c7a" ], "author": { "name": "Derek Bruening", "email": "bruening@google.com", "time": "Sat Aug 29 21:04:37 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Aug 29 21:04:37 2026" }, "message": "Revert \"i#8079: Add `none` raw trace output destination mode to drmemtrace (#8084)\" (#8086)\n\nThis reverts commit f5e2bada5428752a5dcf74c7fee2fe126e240c7a because it\ncalls malloc mid-run for long -outdir paths, breaking transparency and\ncrashing static-link setups.\n\nI directly observed it crash a large internal application.\n\nYou can see it trip our malloc check in a debug build by running an app\nwith multiple threads and a path long enough to exceed std::string\u0027s\ninlined buffer:\n\n```\n$ bin64/drrun -t drcachesim -offline -raw_compress none -outdir $PWD -- ~/dr/test/threadsig 8 20\n\u003cApplication ~/dr/test/threadsig (2440162) DynamoRIO usage error : malloc invoked mid-run when disallowed by DR_DISALLOW_UNSAFE_STATIC\u003e\n```" }, { "commit": "f5e2bada5428752a5dcf74c7fee2fe126e240c7a", "tree": "f09e041c66a47cb2bdf6c1a24107d88d39be6c4f", "parents": [ "7188e15d913570a35eb97ac7f27fe6d5c2f60b76" ], "author": { "name": "Enrico Deiana", "email": "edeiana@google.com", "time": "Sat Aug 29 03:24:23 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Aug 29 03:24:23 2026" }, "message": "i#8079: Add `none` raw trace output destination mode to drmemtrace (#8084)\n\nAdds support for `-outdir none` in offline tracing to measure pure\ninstrumentation and tracing overhead without incurring disk I/O\noverhead.\n\nAdds `tool.drcacheoff.outdir-none` and\n`tool.drcacheoff.outdir-none-windows` tests.\n\nMeasured execution time of `tar -czvf` app with `-outdir none` and\nregular `-outdir ${TMP_DIR}` three times.\nWith `-outdir none`:\n```\n$ /usr/bin/time drrun -s 90 -quiet -debug -killpg -stderr_mask 0xC -dumpcore_mask 0 -code_api -t drmemtrace -offline -subdir_prefix tool.drcacheoff.none -outdir none -- tar -czvf archive.tar.gz ./sizeable_dir\n[...]\n13.58user 6.21system 0:13.93elapsed 142%CPU (0avgtext+0avgdata 21016maxresident)k\n13.45user 6.00system 0:13.71elapsed 141%CPU (0avgtext+0avgdata 21252maxresident)k\n13.44user 5.95system 0:13.66elapsed 141%CPU (0avgtext+0avgdata 21180maxresident)k\n```\nWith `-outdir ${TMP_DIR}`:\n```\n$ /usr/bin/time drrun -s 90 -quiet -debug -killpg -stderr_mask 0xC -dumpcore_mask 0 -code_api -t drmemtrace -offline -subdir_prefix tool.drcacheoff.none -outdir ./to_remove -- tar -czvf archive.tar.gz ./sizeable_dir\n[...]\n20.37user 7.55system 0:21.88elapsed 127%CPU (0avgtext+0avgdata 21536maxresident)k\n20.03user 7.73system 0:21.87elapsed 126%CPU (0avgtext+0avgdata 22264maxresident)k\n20.48user 7.69system 0:22.75elapsed 123%CPU (0avgtext+0avgdata 21720maxresident)k\n```\nConsistently getting ~1.6x speedup for `none` compared to dumping\nthe trace.\n\nIssue #8079" }, { "commit": "7188e15d913570a35eb97ac7f27fe6d5c2f60b76", "tree": "81779623f657298f79849975fb69d6d09911debb", "parents": [ "b81b41cb47ad99b6f1e7b53a6608abd0183133cf" ], "author": { "name": "Enrico Deiana", "email": "edeiana@google.com", "time": "Sat Aug 29 02:45:11 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Aug 29 02:45:11 2026" }, "message": "i#8077: Add -raw_compress_level option for lz4 raw trace compression (#8078)\n\nAdds a new `-raw_compress_level` option to tracer.cpp to allow\nconfiguring he lz4 compression level when collecting offline raw\ntraces with`-raw_compress lz4`.\nThe option accepts negative integer values for lz4 acceleration mode,\nwhich provides faster compression throughput at lower compression\nratios, as well as positive integers for higher compression mode,\ndefaulting to 0.\n\nAdds documentation and tests.\n\nlz4 does not save the compression level used in its metadata, but\nchecking the tests on `simple_app`, the raw trace files have\ndifferent sizes, which would suggest the compression level is\nworking as intended:\n```\nraw-lz4-level-neg (-1024):\n346K tool.drcacheoff.raw-lz4-level-neg.simple_app.3086728.0997.raw.lz4\n\nraw-lz4-level-pos (3):\n68K tool.drcacheoff.raw-lz4-level-pos.simple_app.3118065.0303.raw.lz4\n\nraw-lz4 (0):\n90K tool.drcacheoff.raw-lz4.simple_app.3047195.4715.raw.lz4\n```\n\nFixes #8077" }, { "commit": "b81b41cb47ad99b6f1e7b53a6608abd0183133cf", "tree": "f4d193ee9245c008b4602cc8339b68e202600891", "parents": [ "de0b0c1bd0c2a47284ecd74fb2ae53f9f8bd3a82" ], "author": { "name": "donfucius", "email": "donfucius@gmail.com", "time": "Thu Aug 27 04:10:02 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 27 04:10:02 2026" }, "message": "i#8070: Fix NULL deref of RtlGetExtendedContextLength on non-AVX CPUs (#8071)\n\nThe extended-context `ntdll` function pointers are only resolved when\n`YMM_ENABLED()` (in `nt_get_context_extended_functions()`), so on\nCPUs/OS without AVX support they remain `NULL`. `nt_get_context_size()`\npreviously called `ntdll_RtlGetExtendedContextLength()` unconditionally,\ncrashing with an indirect call to address 0 (e.g., in\n`postsys_CreateUserProcess()` when an app creates a child process).\n\nRestructure `nt_get_context_size()` to check `TESTALL(CONTEXT_XSTATE,\nflags)`, mirroring `nt_initialize_context()`. When `CONTEXT_XSTATE` is\nnot requested (such as on non-AVX systems where `CONTEXT_DR_STATE` omits\nit), fall back to `sizeof(CONTEXT)` plus alignment headroom, avoiding\nthe `NULL` dereference.\n\nVerified on real hardware (Celeron J1900, no AVX, Win10 1809): before\nthe fix every child-spawning app crashed 100% under `drrun`; after the\nfix child following works in both release and `-debug` builds. CI cannot\ncover this (needs non-AVX hardware), so verification was manual.\n\nAI assistance disclosure: root-cause analysis and the patch were\ndeveloped with AI assistance; I reviewed the change and verified it\nmanually on the affected hardware.\n\nFixes #8070\nIssue: #6763" }, { "commit": "de0b0c1bd0c2a47284ecd74fb2ae53f9f8bd3a82", "tree": "278c9015e5c2db67a73d3f36114c7f1543327dc6", "parents": [ "51937e4dccfbfc1d79ba5c37e40a20430c992b60" ], "author": { "name": "ZheWang", "email": "wang.zhe20@zte.com.cn", "time": "Wed Aug 26 22:29:51 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Aug 26 22:29:51 2026" }, "message": "i#3544: OPFVF vector-FP scalar operand decoding as FP register (#8057)\n\nThe OPFVF vector floating-point instructions (OP-V major opcode with\nfunct3\u003d3\u0027b101, e.g. vfadd.vf, vfmv.s.f, vfmerge.vfm) encode their scalar\noperand in the rs1 field as a floating-point register (f0-f31), per the\nRISC-V V spec. Their ISL entries in core/ir/riscv64/isl/v.txt declared\nthis operand as rs1, which selects the integer-register decoder\n(decode_rs1_opnd -\u003e DR_REG_X0+) instead of the floating-point decoder\n(decode_rs1fp_opnd -\u003e DR_REG_F0+). As a result the scalar FP operand was\ndecoded from the wrong register file.\n\nIssue: #3544" }, { "commit": "51937e4dccfbfc1d79ba5c37e40a20430c992b60", "tree": "d403792c4fa7cc9d3b0902a50738e4e19de7fe4c", "parents": [ "ea4079c247ace00e31095f119abc5214c1ce2507" ], "author": { "name": "Bin Wang", "email": "biwa@google.com", "time": "Tue Aug 25 18:06:15 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Aug 25 18:06:15 2026" }, "message": "i#8021: Include source files in arch/ and arch/x86/ as dependencies for kernel module (#8064)\n\n- Include source files in `core/arch/`, `core/arch/x86/`, and `core/lib`\nas dependencies for the kernel module.\n- Resolve missing header by using wrapper headers or excluding headers\nthat don\u0027t have a kernel equivalent.\n- Exclude logic that doesn\u0027t apply in the kernel space.\n- Fix wrong return values in `dr_nudge_client_ex()` in\n`core/lib/instrument.c`.\n- Replicate assembly processing logic from `cpp2asm_support.cmake` in\n`core/kernel_linux/CMakeLists.txt` because `cpp2asm_support.cmake`\ncannot be used directly with kbuild.\n\nIssue: #8021" }, { "commit": "ea4079c247ace00e31095f119abc5214c1ce2507", "tree": "c3af1ec247d65269dd7799925bb1a966905e9dd1", "parents": [ "3fd15f649d6e2ebc986765116ad1edbab4887287" ], "author": { "name": "Enrico Deiana", "email": "edeiana@google.com", "time": "Mon Aug 24 18:53:45 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 24 18:53:45 2026" }, "message": "i#6662: Add year to BibTeX citation of Google Workload Traces (#8073)\n\nAdds year 2025 (when we published the traces) to the\nBibTeX citation of the Google Workload Traces Version 2.\n\nIssue #6662" }, { "commit": "3fd15f649d6e2ebc986765116ad1edbab4887287", "tree": "1d9372ff9f840e7db8ccba415c2f55d3430f56a5", "parents": [ "bf4463e4df1f181080610a8d1de127f6c576a755" ], "author": { "name": "WilliamQiufeng", "email": "williamqiufeng@outlook.com", "time": "Fri Aug 21 15:42:09 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Aug 21 15:42:09 2026" }, "message": "i#8047: Check file name against vdso (#8048)\n\nCheck the `module-\u003enames.file_name` against \"[vdso]\" inside the check for it being null, fixing the prior code which checked `name` instead.\n\nFixes: #8047" }, { "commit": "bf4463e4df1f181080610a8d1de127f6c576a755", "tree": "39ca1af5546d5e911382ef5b914805402b3bfc1e", "parents": [ "301b2b819ec66263baef2400eea7ad0cb83b4630" ], "author": { "name": "Derek Bruening", "email": "bruening@google.com", "time": "Thu Aug 20 19:34:53 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 20 19:34:53 2026" }, "message": "Add intel to drmemtrace -view_syntax docs (#8065)\n\nThe drmemtrace -view_syntax option\u0027s brief description was missing\n\"intel\" as one of the supported disassembly styles." }, { "commit": "301b2b819ec66263baef2400eea7ad0cb83b4630", "tree": "a57f90fd1213d5d19236ff04acd18e76164570e7", "parents": [ "e9884061d0125054b0f4d0f7d7b8bb4806e3cd3e" ], "author": { "name": "Derek Bruening", "email": "bruening@google.com", "time": "Thu Aug 20 19:30:33 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 20 19:30:33 2026" }, "message": "i#8060 fork leak: Free other thread data on fork (#8068)\n\nAugments drmemtrace to free compression buffers in other threads at the\ntime of a fork.\n\nAdds a new linux.fork-multithread test for a simpler, flake-free\nalternative to pthreads_fork_FLAKY which is trying to stress DR itself:\nhere we just want some threads around at the time of the fork.\n\nConfirmed a large (1639616 byte) leak is reported without the leak fix,\nfrom the 4 other threads. The leak goes away with the fix.\n\nAdds a new drcacheoff test that runs the new fork-multithread app. Uses\nbasic_counts instead of dr$sim to speed things up from 50s locally to\n10s (probably 6x slower on GA CI). Switches the existing drcacheoff fork\ntests to also use basic_counts which makes them 3x faster, allowing\nremoval of the doubled timeouts.\n\nThe new test is disabled for 32-bit until #8069 is fixed.\n\nFixes #8060" }, { "commit": "e9884061d0125054b0f4d0f7d7b8bb4806e3cd3e", "tree": "a32647cb2ee0726ecd45da4b09af313da83699eb", "parents": [ "1a9a91d93a05cf652b77a8e65d3e747844e1c176" ], "author": { "name": "Bin Wang", "email": "biwa@google.com", "time": "Thu Aug 20 05:39:55 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 20 05:39:55 2026" }, "message": "i#1947: Add support for Intel CET instructions (#7916)\n\n- Add decoding/encoding support for Intel CET instructions.\n- Ignore endbr64/endbr32/rdssp in drcpusim, as they decode as nop on\nolder CPUs.\n- Removed an outdated comment about how gdb handles lfence.\n- Use ext # directly for existing group 18/19 since they don\u0027t match\nIntel SDM.\n\nFixes #1947\nFixes #4040\nFixes #5109" }, { "commit": "1a9a91d93a05cf652b77a8e65d3e747844e1c176", "tree": "d4fb73bd3c9c93c70fbd71044f60bdd12e38ba9d", "parents": [ "bd4d8aa6a14b845a2f639d242e71e4078b7bddb1" ], "author": { "name": "Derek Bruening", "email": "bruening@google.com", "time": "Tue Aug 18 16:55:33 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Aug 18 16:55:33 2026" }, "message": "i#8060: Fix drmemtrace leak across fork (#8062)\n\nFixes a leak in drmemtrace across a fork where compression-related\nallocations were not being freed.\n\nAdds compression variant tests of the drcacheoff.fork test to cover\nleaks in those compression types.\n\nDoes not address leaks in other threads at the time of the fork: that\nwill be handled separately.\n\nIssue: #8060" }, { "commit": "bd4d8aa6a14b845a2f639d242e71e4078b7bddb1", "tree": "94eeb546561abea3336892b42a3c095d60812bbc", "parents": [ "0b5d9a883280313bb0a22351ca13b8c5487229e8" ], "author": { "name": "Bin Wang", "email": "biwa@google.com", "time": "Mon Aug 17 21:51:36 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 17 21:51:36 2026" }, "message": "i#8021: Include source files in ir/ and ir/x86/ as dependencies for kernel module (#8049)\n\n- Include source files as dependencies for kernel module:\n- 3 remaining files in `core/`: `translate.c`, `utils.c`, and\n`vmareas.c`.\n - Relevant files in `core/ir/`\n - Relevant files in `core/ir/x86/`\n- Exclude functions and logic that don\u0027t apply in kernel space, such as\nrseq and floating point arithmetic.\n- Update include headers. This includes using wrapper headers or\nexcluding headers that don\u0027t have an equivalent in kernel.\n- Some bug fixes that are uncovered by Kbuild compiler flags.\n\nIssue: #8021" }, { "commit": "0b5d9a883280313bb0a22351ca13b8c5487229e8", "tree": "e4c95a7fb649c8eb28e6e8d2b3807c60a6be70eb", "parents": [ "50542d1a1fc947d5db4076ffcbcb4984a287f170" ], "author": { "name": "Derek Bruening", "email": "bruening@google.com", "time": "Mon Aug 17 20:20:51 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 17 20:20:51 2026" }, "message": "i#8058: Remove missing headers to fix build (#8059)\n\nRemoves the linux/netrom.h and linux/scc.h headers from drsyscall\u0027s\nincludes, as these headers have been removed in recent kernels. The\ncorresponding ioctl codes are already disabled so this removal does not\ncause any problems.\n\nTested on a build on a recent kernel which failed without this change\nand works with the change.\n\nFixes #8058" }, { "commit": "50542d1a1fc947d5db4076ffcbcb4984a287f170", "tree": "dc084914fe89577e2bfd2c6676b4529eff4cc68f", "parents": [ "fcacba79aa401e4f9b799eb66b50d372338f48e6" ], "author": { "name": "Derek Bruening", "email": "bruening@google.com", "time": "Mon Aug 17 20:20:43 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 17 20:20:43 2026" }, "message": "i#8056: Fix flaky fork tests (#8061)\n\nRemoves a parent printout that races with the child\u0027s print and results\nin a flaky test (though it is very rare and we\u0027ve only seen it once in\nthe last several years).\n\nFixes #8056" }, { "commit": "fcacba79aa401e4f9b799eb66b50d372338f48e6", "tree": "859cbf04272ac51f07fc6b639627c3ad9755d8e9", "parents": [ "73482e820d9c3b69c4b69cb6a25afc2a550e8989" ], "author": { "name": "Bin Wang", "email": "biwa@google.com", "time": "Mon Aug 17 19:01:32 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 17 19:01:32 2026" }, "message": "i#8021: Fix wrong return value in instr_predicate_triggered (#8055)\n\nAs discussed in #8049:\n\n\u003e This was flagged by `-Werror\u003denum-conversion`. Upon a closer look I\nthink it\u0027s wrong to return `false` (equivalent to\n`DR_PRED_TRIGGER_NOPRED`) here. I think the logic here is that there is\npred but DR cannot check if it matches or not, so it should return\nDR_PRED_TRIGGER_UNKNOWN.\n\nIssue: #8021" }, { "commit": "73482e820d9c3b69c4b69cb6a25afc2a550e8989", "tree": "7461c062f396e3fb305076f4d349d88048bc1d66", "parents": [ "b7f32c071a0578539b0575dde54650edca05dc26" ], "author": { "name": "Tejash Gupta", "email": "tejash5489@gmail.com", "time": "Mon Aug 17 17:15:05 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 17 17:15:05 2026" }, "message": "i#1819: close imagelist file handle in DRload (#8052)\n\nDRload\u0027s `-imagelist` handling opens the list file with `fopen()` but\nnever\ncloses it after reading through it with `fgets()`, leaking the file\nhandle\nfor the lifetime of the process.\n\nAdd the missing `fclose(f)` once the read loop completes.\n\nFixes: #1819" }, { "commit": "b7f32c071a0578539b0575dde54650edca05dc26", "tree": "ea2ffc3f176a352ada2defb43f393b21db0ddafc", "parents": [ "65a7480ad5584c402273ce52225a918dc961ed10" ], "author": { "name": "Jack Gallagher", "email": "jack.gallagher@arm.com", "time": "Mon Aug 17 07:27:35 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 17 07:27:35 2026" }, "message": "i#8050 Fix selfmod tests on AArch64 (#8051)\n\nThere was a flaw with AArch64 version of the selfmod tests. The test\nfunctions work by modifying the immediate value of a later mov\ninstruction and observing which value was moved.\n\nAArch64 requires explicit synchronisation to guarantee that the\nmodification is seen by the CPU and the updated instruction is executed.\nThe tests implemented this by calling `tools_clear_icache()` after the\nmodification. However this undermines the test because DR detects the\ncall as a control transfer instruction and ends the block before we get\nto the instruction being modified. By the time DR gets to decode and\ntranslate the modified instruction it has already been modified. The\noriginal instruction was never translated and placed in the code cache\nso the test doesn\u0027t actually prove that the modification was handled\nproperly.\n\nWe can fix this by inlining the cache flush code and ensuring that there\nare no CTIs in between the code modification write and the modified\ninstruction.\n\nTo this end I have also lifted the restriction requiring isb to be the\nlast instruction of a block. This was added as part of the AArch64\nselfmod mechanism which mangled ic cvau instructions to store the\naddress range being flushed and mangled isb to do a sideline exit and\nperform the actual code cache flush. This mechanism has since been\nchanged to directly flush the code cache on ic cvau and isb no longer\nhas any special mangling so we don\u0027t need it to be the last instruction.\n\nFixes #8050" }, { "commit": "65a7480ad5584c402273ce52225a918dc961ed10", "tree": "bce665a294ec41df89988326af85bcc8ea4c16e2", "parents": [ "c9f64b7fac30c0a687586a606ccd761fffe8844e" ], "author": { "name": "Tejash Gupta", "email": "tejash5489@gmail.com", "time": "Mon Aug 17 02:23:14 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 17 02:23:14 2026" }, "message": "i#2073: fix confusing sizeof(XSP_SZ) usage (#8053)\n\nXSP_SZ is already defined as `(ssize_t)sizeof(reg_t)`, i.e. the stack\npointer width in bytes. Several call sites wrote `sizeof(XSP_SZ)`,\nwhich actually computes `sizeof(ssize_t)` rather than the intended\nvalue. As noted in the issue discussion, this happens to be\nnumerically equal on every currently supported platform (`ssize_t`\nand `reg_t` are always pointer-width), so it is not a functional bug,\nbut it reads as one and is worth cleaning up.\n\nReplace `sizeof(XSP_SZ)` with `XSP_SZ` at all three call sites\n(core/ir/opnd.h x2, core/unix/native_elf.c x3 occurrences on 3 lines).\n\nFixes: #2073" }, { "commit": "c9f64b7fac30c0a687586a606ccd761fffe8844e", "tree": "7eca45898840888eb4cadbbf351773aa25569c69", "parents": [ "5ba42078a09cd3270ab6bcef029c7e73f152a19e" ], "author": { "name": "Tejash Gupta", "email": "tejash5489@gmail.com", "time": "Mon Aug 17 02:22:54 2026" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 17 02:22:54 2026" }, "message": "i#1972: add DISABLE_DRGUI CMake option (#8054)\n\nAdds a DISABLE_DRGUI option, following the same pattern as the existing\nDISABLE_ZLIB option, so DrGUI can be skipped even when Qt5 is found.\n\nThis is useful for:\n1. Reproducible builds that always give the same result whether or not\n Qt5 is installed.\n2. Situations where compiling Qt5-related code fails, so the user can\n move on instead of spending time debugging it.\n3. Saving build time and disk space when DrGUI is not wanted.\n\nDefaults to OFF, so existing behavior (build DrGUI if Qt5 is found) is\nunchanged.\n\nFixes: #1972" } ], "next": "5ba42078a09cd3270ab6bcef029c7e73f152a19e" }