Skip to content

Commit

Permalink
[msan] Instrument x86.*_cvt* intrinsics.
Browse files Browse the repository at this point in the history 
Currently MSan checks that arguments of *cvt* intrinsics are fully initialized.
That's too much to ask: some of them only operate on lower half, or even
quarter, of the input register.


git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@192599 91177308-0d34-0410-b5e6-96231b3b80d8
  • Loading branch information
@eugenis
eugenis committed Oct 14, 2013
1 parent 942827b commit 9586430
Show file tree
Hide file tree
Showing 2 changed files with 215 additions and 28 deletions.
177 changes: 149 additions & 28 deletions lib/Transforms/Instrumentation/MemorySanitizer.cpp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -469,18 +469,21 @@ struct MemorySanitizerVisitor : public InstVisitor<MemorySanitizerVisitor> {
MemorySanitizer &MS;
SmallVector<PHINode *, 16> ShadowPHINodes, OriginPHINodes;
ValueMap<Value*, Value*> ShadowMap, OriginMap;
OwningPtr<VarArgHelper> VAHelper;

// The following flags disable parts of MSan instrumentation based on
// blacklist contents and command-line options.
bool InsertChecks;
bool LoadShadow;
bool PoisonStack;
bool PoisonUndef;
bool CheckReturnValue;
OwningPtr<VarArgHelper> VAHelper;

struct ShadowOriginAndInsertPoint {
Instruction *Shadow;
Instruction *Origin;
Value *Shadow;
Value *Origin;
Instruction *OrigIns;
ShadowOriginAndInsertPoint(Instruction *S, Instruction *O, Instruction *I)
ShadowOriginAndInsertPoint(Value *S, Value *O, Instruction *I)
: Shadow(S), Origin(O), OrigIns(I) { }
ShadowOriginAndInsertPoint() : Shadow(0), Origin(0), OrigIns(0) { }
};
Expand Down Expand Up @@ -521,7 +524,7 @@ struct MemorySanitizerVisitor : public InstVisitor<MemorySanitizerVisitor> {
(void)NewSI;

if (ClCheckAccessAddress)
insertCheck(Addr, &I);
insertShadowCheck(Addr, &I);

if (I.isAtomic())
I.setOrdering(addReleaseOrdering(I.getOrdering()));
Expand All @@ -534,11 +537,10 @@ struct MemorySanitizerVisitor : public InstVisitor<MemorySanitizerVisitor> {
} else {
Value *ConvertedShadow = convertToShadowTyNoVec(Shadow, IRB);

Constant *Cst = dyn_cast_or_null<Constant>(ConvertedShadow);
// TODO(eugenis): handle non-zero constant shadow by inserting an
// unconditional check (can not simply fail compilation as this could
// be in the dead code).
if (Cst)
if (isa<Constant>(ConvertedShadow))
continue;

Value *Cmp = IRB.CreateICmpNE(ConvertedShadow,
Expand All @@ -556,12 +558,15 @@ struct MemorySanitizerVisitor : public InstVisitor<MemorySanitizerVisitor> {

void materializeChecks() {
for (size_t i = 0, n = InstrumentationList.size(); i < n; i++) {
Instruction *Shadow = InstrumentationList[i].Shadow;
Value *Shadow = InstrumentationList[i].Shadow;
Instruction *OrigIns = InstrumentationList[i].OrigIns;
IRBuilder<> IRB(OrigIns);
DEBUG(dbgs() << " SHAD0 : " << *Shadow << "\n");
Value *ConvertedShadow = convertToShadowTyNoVec(Shadow, IRB);
DEBUG(dbgs() << " SHAD1 : " << *ConvertedShadow << "\n");
// See the comment in materializeStores().
if (isa<Constant>(ConvertedShadow))
continue;
Value *Cmp = IRB.CreateICmpNE(ConvertedShadow,
getCleanShadow(ConvertedShadow), "_mscmp");
Instruction *CheckTerm =
Expand All @@ -571,7 +576,7 @@ struct MemorySanitizerVisitor : public InstVisitor<MemorySanitizerVisitor> {

IRB.SetInsertPoint(CheckTerm);
if (MS.TrackOrigins) {
Instruction *Origin = InstrumentationList[i].Origin;
Value *Origin = InstrumentationList[i].Origin;
IRB.CreateStore(Origin ? (Value*)Origin : (Value*)IRB.getInt32(0),
MS.OriginTLS);
}
Expand Down Expand Up @@ -888,20 +893,29 @@ struct MemorySanitizerVisitor : public InstVisitor<MemorySanitizerVisitor> {
/// \brief Remember the place where a shadow check should be inserted.
///
/// This location will be later instrumented with a check that will print a
/// UMR warning in runtime if the value is not fully defined.
void insertCheck(Value *Val, Instruction *OrigIns) {
assert(Val);
/// UMR warning in runtime if the shadow value is not 0.
void insertShadowCheck(Value *Shadow, Value *Origin, Instruction *OrigIns) {
assert(Shadow);
if (!InsertChecks) return;
Instruction *Shadow = dyn_cast_or_null<Instruction>(getShadow(Val));
if (!Shadow) return;
#ifndef NDEBUG
Type *ShadowTy = Shadow->getType();
assert((isa<IntegerType>(ShadowTy) || isa<VectorType>(ShadowTy)) &&
"Can only insert checks for integer and vector shadow types");
#endif
Instruction *Origin = dyn_cast_or_null<Instruction>(getOrigin(Val));
InstrumentationList.push_back(
ShadowOriginAndInsertPoint(Shadow, Origin, OrigIns));
ShadowOriginAndInsertPoint(Shadow, Origin, OrigIns));
}

/// \brief Remember the place where a shadow check should be inserted.
///
/// This location will be later instrumented with a check that will print a
/// UMR warning in runtime if the value is not fully defined.
void insertShadowCheck(Value *Val, Instruction *OrigIns) {
assert(Val);
Instruction *Shadow = dyn_cast_or_null<Instruction>(getShadow(Val));
if (!Shadow) return;
Instruction *Origin = dyn_cast_or_null<Instruction>(getOrigin(Val));
insertShadowCheck(Shadow, Origin, OrigIns);
}

AtomicOrdering addReleaseOrdering(AtomicOrdering a) {
Expand Down Expand Up @@ -958,7 +972,7 @@ struct MemorySanitizerVisitor : public InstVisitor<MemorySanitizerVisitor> {
}

if (ClCheckAccessAddress)
insertCheck(I.getPointerOperand(), &I);
insertShadowCheck(I.getPointerOperand(), &I);

if (I.isAtomic())
I.setOrdering(addAcquireOrdering(I.getOrdering()));
Expand Down Expand Up @@ -990,13 +1004,13 @@ struct MemorySanitizerVisitor : public InstVisitor<MemorySanitizerVisitor> {
Value *ShadowPtr = getShadowPtr(Addr, I.getType(), IRB);

if (ClCheckAccessAddress)
insertCheck(Addr, &I);
insertShadowCheck(Addr, &I);

// Only test the conditional argument of cmpxchg instruction.
// The other argument can potentially be uninitialized, but we can not
// detect this situation reliably without possible false positives.
if (isa<AtomicCmpXchgInst>(I))
insertCheck(I.getOperand(1), &I);
insertShadowCheck(I.getOperand(1), &I);

IRB.CreateStore(getCleanShadow(&I), ShadowPtr);

Expand All @@ -1015,23 +1029,23 @@ struct MemorySanitizerVisitor : public InstVisitor<MemorySanitizerVisitor> {

// Vector manipulation.
void visitExtractElementInst(ExtractElementInst &I) {
insertCheck(I.getOperand(1), &I);
insertShadowCheck(I.getOperand(1), &I);
IRBuilder<> IRB(&I);
setShadow(&I, IRB.CreateExtractElement(getShadow(&I, 0), I.getOperand(1),
"_msprop"));
setOrigin(&I, getOrigin(&I, 0));
}

void visitInsertElementInst(InsertElementInst &I) {
insertCheck(I.getOperand(2), &I);
insertShadowCheck(I.getOperand(2), &I);
IRBuilder<> IRB(&I);
setShadow(&I, IRB.CreateInsertElement(getShadow(&I, 0), getShadow(&I, 1),
I.getOperand(2), "_msprop"));
setOriginForNaryOp(I);
}

void visitShuffleVectorInst(ShuffleVectorInst &I) {
insertCheck(I.getOperand(2), &I);
insertShadowCheck(I.getOperand(2), &I);
IRBuilder<> IRB(&I);
setShadow(&I, IRB.CreateShuffleVector(getShadow(&I, 0), getShadow(&I, 1),
I.getOperand(2), "_msprop"));
Expand Down Expand Up @@ -1266,7 +1280,7 @@ struct MemorySanitizerVisitor : public InstVisitor<MemorySanitizerVisitor> {
void handleDiv(Instruction &I) {
IRBuilder<> IRB(&I);
// Strict on the second argument.
insertCheck(I.getOperand(1), &I);
insertShadowCheck(I.getOperand(1), &I);
setShadow(&I, getShadow(&I, 0));
setOrigin(&I, getOrigin(&I, 0));
}
Expand Down Expand Up @@ -1549,7 +1563,7 @@ struct MemorySanitizerVisitor : public InstVisitor<MemorySanitizerVisitor> {
IRB.CreateAlignedStore(Shadow, ShadowPtr, 1);

if (ClCheckAccessAddress)
insertCheck(Addr, &I);
insertShadowCheck(Addr, &I);

// FIXME: use ClStoreCleanOrigin
// FIXME: factor out common code from materializeStores
Expand All @@ -1576,9 +1590,8 @@ struct MemorySanitizerVisitor : public InstVisitor<MemorySanitizerVisitor> {
setShadow(&I, getCleanShadow(&I));
}


if (ClCheckAccessAddress)
insertCheck(Addr, &I);
insertShadowCheck(Addr, &I);

if (MS.TrackOrigins) {
if (LoadShadow)
Expand Down Expand Up @@ -1675,11 +1688,119 @@ struct MemorySanitizerVisitor : public InstVisitor<MemorySanitizerVisitor> {
setOrigin(&I, getOrigin(Op));
}

// \brief Instrument vector convert instrinsic.
//
// This function instruments intrinsics like cvtsi2ss:
// %Out = int_xxx_cvtyyy(%ConvertOp)
// or
// %Out = int_xxx_cvtyyy(%CopyOp, %ConvertOp)
// Intrinsic converts \p NumUsedElements elements of \p ConvertOp to the same
// number \p Out elements, and (if has 2 arguments) copies the rest of the
// elements from \p CopyOp.
// In most cases conversion involves floating-point value which may trigger a
// hardware exception when not fully initialized. For this reason we require
// \p ConvertOp[0:NumUsedElements] to be fully initialized and trap otherwise.
// We copy the shadow of \p CopyOp[NumUsedElements:] to \p
// Out[NumUsedElements:]. This means that intrinsics without \p CopyOp always
// return a fully initialized value.
void handleVectorConvertIntrinsic(IntrinsicInst &I, int NumUsedElements) {
IRBuilder<> IRB(&I);
Value *CopyOp, *ConvertOp;

switch (I.getNumArgOperands()) {
case 2:
CopyOp = I.getArgOperand(0);
ConvertOp = I.getArgOperand(1);
break;
case 1:
ConvertOp = I.getArgOperand(0);
CopyOp = NULL;
break;
default:
llvm_unreachable("Cvt intrinsic with unsupported number of arguments.");
}

// The first *NumUsedElements* elements of ConvertOp are converted to the
// same number of output elements. The rest of the output is copied from
// CopyOp, or (if not available) filled with zeroes.
// Combine shadow for elements of ConvertOp that are used in this operation,
// and insert a check.
// FIXME: consider propagating shadow of ConvertOp, at least in the case of
// int->any conversion.
Value *ConvertShadow = getShadow(ConvertOp);
Value *AggShadow = 0;
if (ConvertOp->getType()->isVectorTy()) {
AggShadow = IRB.CreateExtractElement(
ConvertShadow, ConstantInt::get(IRB.getInt32Ty(), 0));
for (int i = 1; i < NumUsedElements; ++i) {
Value *MoreShadow = IRB.CreateExtractElement(
ConvertShadow, ConstantInt::get(IRB.getInt32Ty(), i));
AggShadow = IRB.CreateOr(AggShadow, MoreShadow);
}
} else {
AggShadow = ConvertShadow;
}
assert(AggShadow->getType()->isIntegerTy());
insertShadowCheck(AggShadow, getOrigin(ConvertOp), &I);

// Build result shadow by zero-filling parts of CopyOp shadow that come from
// ConvertOp.
if (CopyOp) {
assert(CopyOp->getType() == I.getType());
assert(CopyOp->getType()->isVectorTy());
Value *ResultShadow = getShadow(CopyOp);
Type *EltTy = ResultShadow->getType()->getVectorElementType();
for (int i = 0; i < NumUsedElements; ++i) {
ResultShadow = IRB.CreateInsertElement(
ResultShadow, ConstantInt::getNullValue(EltTy),
ConstantInt::get(IRB.getInt32Ty(), i));
}
setShadow(&I, ResultShadow);
setOrigin(&I, getOrigin(CopyOp));
} else {
setShadow(&I, getCleanShadow(&I));
}
}

void visitIntrinsicInst(IntrinsicInst &I) {
switch (I.getIntrinsicID()) {
case llvm::Intrinsic::bswap:
handleBswap(I);
break;
case llvm::Intrinsic::x86_avx512_cvtsd2usi64:
case llvm::Intrinsic::x86_avx512_cvtsd2usi:
case llvm::Intrinsic::x86_avx512_cvtss2usi64:
case llvm::Intrinsic::x86_avx512_cvtss2usi:
case llvm::Intrinsic::x86_avx512_cvttss2usi64:
case llvm::Intrinsic::x86_avx512_cvttss2usi:
case llvm::Intrinsic::x86_avx512_cvttsd2usi64:
case llvm::Intrinsic::x86_avx512_cvttsd2usi:
case llvm::Intrinsic::x86_avx512_cvtusi2sd:
case llvm::Intrinsic::x86_avx512_cvtusi2ss:
case llvm::Intrinsic::x86_avx512_cvtusi642sd:
case llvm::Intrinsic::x86_avx512_cvtusi642ss:
case llvm::Intrinsic::x86_sse2_cvtsd2si64:
case llvm::Intrinsic::x86_sse2_cvtsd2si:
case llvm::Intrinsic::x86_sse2_cvtsd2ss:
case llvm::Intrinsic::x86_sse2_cvtsi2sd:
case llvm::Intrinsic::x86_sse2_cvtsi642sd:
case llvm::Intrinsic::x86_sse2_cvtss2sd:
case llvm::Intrinsic::x86_sse2_cvttsd2si64:
case llvm::Intrinsic::x86_sse2_cvttsd2si:
case llvm::Intrinsic::x86_sse_cvtsi2ss:
case llvm::Intrinsic::x86_sse_cvtsi642ss:
case llvm::Intrinsic::x86_sse_cvtss2si64:
case llvm::Intrinsic::x86_sse_cvtss2si:
case llvm::Intrinsic::x86_sse_cvttss2si64:
case llvm::Intrinsic::x86_sse_cvttss2si:
handleVectorConvertIntrinsic(I, 1);
break;
case llvm::Intrinsic::x86_sse2_cvtdq2pd:
case llvm::Intrinsic::x86_sse2_cvtps2pd:
case llvm::Intrinsic::x86_sse_cvtps2pi:
case llvm::Intrinsic::x86_sse_cvttps2pi:
handleVectorConvertIntrinsic(I, 2);
break;
default:
if (!handleUnknownIntrinsic(I))
visitInstruction(I);
Expand Down Expand Up @@ -1826,7 +1947,7 @@ struct MemorySanitizerVisitor : public InstVisitor<MemorySanitizerVisitor> {
if (!RetVal) return;
Value *ShadowPtr = getShadowPtrForRetval(RetVal, IRB);
if (CheckReturnValue) {
insertCheck(RetVal, &I);
insertShadowCheck(RetVal, &I);
Value *Shadow = getCleanShadow(RetVal);
IRB.CreateAlignedStore(Shadow, ShadowPtr, kShadowTLSAlignment);
} else {
Expand Down Expand Up @@ -1973,7 +2094,7 @@ struct MemorySanitizerVisitor : public InstVisitor<MemorySanitizerVisitor> {
dumpInst(I);
DEBUG(dbgs() << "DEFAULT: " << I << "\n");
for (size_t i = 0, n = I.getNumOperands(); i < n; i++)
insertCheck(I.getOperand(i), &I);
insertShadowCheck(I.getOperand(i), &I);
setShadow(&I, getCleanShadow(&I));
setOrigin(&I, getCleanOrigin());
}
Expand Down
66 changes: 66 additions & 0 deletions test/Instrumentation/MemorySanitizer/vector_cvt.ll
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,66 @@
; RUN: opt < %s -msan -msan-check-access-address=0 -S | FileCheck %s

target datalayout = "e-p:64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:64:64-f32:32:32-f64:64:64-v64:64:64-v128:128:128-a0:0:64-s0:64:64-f80:128:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

declare i32 @llvm.x86.sse2.cvtsd2si(<2 x double>) nounwind readnone
declare <2 x double> @llvm.x86.sse2.cvtsi2sd(<2 x double>, i32) nounwind readnone
declare x86_mmx @llvm.x86.sse.cvtps2pi(<4 x float>) nounwind readnone

; Single argument vector conversion.

define i32 @test_cvtsd2si(<2 x double> %value) sanitize_memory {
entry:
%0 = tail call i32 @llvm.x86.sse2.cvtsd2si(<2 x double> %value)
ret i32 %0
}

; CHECK: @test_cvtsd2si
; CHECK: [[S:%[_01-9a-z]+]] = extractelement <2 x i64> {{.*}}, i32 0
; CHECK: icmp ne {{.*}}[[S]], 0
; CHECK: br
; CHECK: call void @__msan_warning_noreturn
; CHECK: call i32 @llvm.x86.sse2.cvtsd2si
; CHECK: store i32 0, {{.*}} @__msan_retval_tls
; CHECK: ret i32

; Two-argument vector conversion.

define <2 x double> @test_cvtsi2sd(i32 %a, double %b) sanitize_memory {
entry:
%vec = insertelement <2 x double> undef, double %b, i32 1
%0 = tail call <2 x double> @llvm.x86.sse2.cvtsi2sd(<2 x double> %vec, i32 %a)
ret <2 x double> %0
}

; CHECK: @test_cvtsi2sd
; CHECK: [[Sa:%[_01-9a-z]+]] = load i32* {{.*}} @__msan_param_tls
; CHECK: [[Sout0:%[_01-9a-z]+]] = insertelement <2 x i64> <i64 -1, i64 -1>, i64 {{.*}}, i32 1
; Clear low half of result shadow
; CHECK: [[Sout:%[_01-9a-z]+]] = insertelement <2 x i64> {{.*}}[[Sout0]], i64 0, i32 0
; Trap on %a shadow.
; CHECK: icmp ne {{.*}}[[Sa]], 0
; CHECK: br
; CHECK: call void @__msan_warning_noreturn
; CHECK: call <2 x double> @llvm.x86.sse2.cvtsi2sd
; CHECK: store <2 x i64> {{.*}}[[Sout]], {{.*}} @__msan_retval_tls
; CHECK: ret <2 x double>

; x86_mmx packed vector conversion.

define x86_mmx @test_cvtps2pi(<4 x float> %value) sanitize_memory {
entry:
%0 = tail call x86_mmx @llvm.x86.sse.cvtps2pi(<4 x float> %value)
ret x86_mmx %0
}

; CHECK: @test_cvtps2pi
; CHECK: extractelement <4 x i32> {{.*}}, i32 0
; CHECK: extractelement <4 x i32> {{.*}}, i32 1
; CHECK: [[S:%[_01-9a-z]+]] = or i32
; CHECK: icmp ne {{.*}}[[S]], 0
; CHECK: br
; CHECK: call void @__msan_warning_noreturn
; CHECK: call x86_mmx @llvm.x86.sse.cvtps2pi
; CHECK: store i64 0, {{.*}} @__msan_retval_tls
; CHECK: ret x86_mmx

0 comments on commit 9586430

Please sign in to comment.