Skip to content

Commit 7454439

Browse files
xguptaxgupta
committed
[zero-call-used-regs] Mark only non-debug instruction's register as used
zero-call-used-regs pass generate an xor instruction to help mitigate return-oriented programming exploits via zeroing out used registers. But in this below test case with -g option there is dbg.value instruction associating the register with the debug-info description of the formal parameter d, which makes the register appear used, therefore it zero the register edi in -g case and makes binary different from without -g option. The pass should be looking only at the non-debug uses. $ cat test.c char a[]; int b; __attribute__((zero_call_used_regs("used"))) char c(int d) { *a = ({ int e = d; b; }); } This fixes #57962. Differential Revision: https://reviews.llvm.org/D138757
1 parent c9401f2 commit 7454439

File tree

2 files changed

+148
-1
lines changed

2 files changed

+148
-1
lines changed

‎llvm/lib/CodeGen/PrologEpilogInserter.cpp

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1230,7 +1230,11 @@ void PEI::insertZeroCallUsedRegs(MachineFunction &MF) {
12301230
BitVector UsedRegs(TRI.getNumRegs());
12311231
if (OnlyUsed)
12321232
for (const MachineBasicBlock &MBB : MF)
1233-
for (const MachineInstr &MI : MBB)
1233+
for (const MachineInstr &MI : MBB) {
1234+
// skip debug instructions
1235+
if (MI.isDebugInstr())
1236+
continue;
1237+
12341238
for (const MachineOperand &MO : MI.operands()) {
12351239
if (!MO.isReg())
12361240
continue;
@@ -1240,6 +1244,7 @@ void PEI::insertZeroCallUsedRegs(MachineFunction &MF) {
12401244
(MO.isDef() || MO.isUse()))
12411245
UsedRegs.set(Reg);
12421246
}
1247+
}
12431248

12441249
// Get a list of registers that are used.
12451250
BitVector LiveIns(TRI.getNumRegs());

‎llvm/test/CodeGen/X86/zero-call-used-regs-debug-info.mir

Lines changed: 142 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,142 @@
1+
# NOTE: Assertions have been autogenerated by utils/update_mir_test_checks.py
2+
# RUN: llc -run-pass=prologepilog -o - %s | FileCheck %s
3+
4+
# Test that the presence of debug instructions doesn't trigger arbitrary registers that are unused to be zeroed out.
5+
6+
--- |
7+
; ModuleID = 'zero-call-used-regs-debug-info.ll'
8+
source_filename = "zero-call-used-regs-debug-info.c"
9+
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-f80:128-n8:16:32:64-S128"
10+
target triple = "x86_64-unknown-linux-gnu"
11+
12+
@b = dso_local local_unnamed_addr global i32 0, align 4, !dbg !0
13+
@a = dso_local local_unnamed_addr global [1 x i8] zeroinitializer, align 1, !dbg !5
14+
15+
; Function Attrs: mustprogress nofree norecurse nosync nounwind willreturn memory(readwrite, argmem: none, inaccessiblemem: none) uwtable
16+
define dso_local signext i8 @c(i32 noundef %d) local_unnamed_addr #0 !dbg !19 {
17+
entry:
18+
call void @llvm.dbg.value(metadata i32 %d, metadata !23, metadata !DIExpression()), !dbg !26
19+
call void @llvm.dbg.value(metadata i32 %d, metadata !24, metadata !DIExpression()), !dbg !27
20+
%0 = load i32, ptr @b, align 4, !dbg !28, !tbaa !29
21+
%conv = trunc i32 %0 to i8, !dbg !33
22+
store i8 %conv, ptr @a, align 1, !dbg !34, !tbaa !35
23+
ret i8 undef, !dbg !36
24+
}
25+
26+
; Function Attrs: nocallback nofree nosync nounwind speculatable willreturn memory(none)
27+
declare void @llvm.dbg.value(metadata, metadata, metadata) #2
28+
29+
attributes #0 = { mustprogress nofree norecurse nosync nounwind willreturn memory(readwrite, argmem: none, inaccessiblemem: none) uwtable "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" "zero-call-used-regs"="used" }
30+
attributes #1 = { mustprogress nofree norecurse nosync nounwind willreturn memory(none) uwtable "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
31+
attributes #2 = { nocallback nofree nosync nounwind speculatable willreturn memory(none) }
32+
33+
!llvm.dbg.cu = !{!2}
34+
!llvm.module.flags = !{!12, !13, !14, !15, !16, !17}
35+
!llvm.ident = !{!18}
36+
37+
!0 = !DIGlobalVariableExpression(var: !1, expr: !DIExpression())
38+
!1 = distinct !DIGlobalVariable(name: "b", scope: !2, file: !3, line: 2, type: !11, isLocal: false, isDefinition: true)
39+
!2 = distinct !DICompileUnit(language: DW_LANG_C11, file: !3, producer: "clang version 16.0.0 (https://github.com/llvm/llvm-project.git ba5acedd979aa94a81be555e0add8e4421499d4f)", isOptimized: true, runtimeVersion: 0, emissionKind: FullDebug, globals: !4, splitDebugInlining: false, nameTableKind: None)
40+
!3 = !DIFile(filename: "zero-call-used-regs-debug-info.c", directory: "/home/xgupta/compiler/llvm-project/build/bin", checksumkind: CSK_MD5, checksum: "fe3a5f45289411a008e07c7debb490ca")
41+
!4 = !{!5, !0}
42+
!5 = !DIGlobalVariableExpression(var: !6, expr: !DIExpression())
43+
!6 = distinct !DIGlobalVariable(name: "a", scope: !2, file: !3, line: 1, type: !7, isLocal: false, isDefinition: true)
44+
!7 = !DICompositeType(tag: DW_TAG_array_type, baseType: !8, size: 8, elements: !9)
45+
!8 = !DIBasicType(name: "char", size: 8, encoding: DW_ATE_signed_char)
46+
!9 = !{!10}
47+
!10 = !DISubrange(count: 1)
48+
!11 = !DIBasicType(name: "int", size: 32, encoding: DW_ATE_signed)
49+
!12 = !{i32 7, !"Dwarf Version", i32 5}
50+
!13 = !{i32 2, !"Debug Info Version", i32 3}
51+
!14 = !{i32 1, !"wchar_size", i32 4}
52+
!15 = !{i32 8, !"PIC Level", i32 2}
53+
!16 = !{i32 7, !"PIE Level", i32 2}
54+
!17 = !{i32 7, !"uwtable", i32 2}
55+
!18 = !{!"clang version 16.0.0 (https://github.com/llvm/llvm-project.git ba5acedd979aa94a81be555e0add8e4421499d4f)"}
56+
!19 = distinct !DISubprogram(name: "c", scope: !3, file: !3, line: 3, type: !20, scopeLine: 3, flags: DIFlagPrototyped | DIFlagAllCallsDescribed, spFlags: DISPFlagDefinition | DISPFlagOptimized, unit: !2, retainedNodes: !22)
57+
!20 = !DISubroutineType(types: !21)
58+
!21 = !{!8, !11}
59+
!22 = !{!23, !24}
60+
!23 = !DILocalVariable(name: "d", arg: 1, scope: !19, file: !3, line: 3, type: !11)
61+
!24 = !DILocalVariable(name: "e", scope: !25, file: !3, line: 5, type: !11)
62+
!25 = distinct !DILexicalBlock(scope: !19, file: !3, line: 4, column: 9)
63+
!26 = !DILocation(line: 0, scope: !19)
64+
!27 = !DILocation(line: 0, scope: !25)
65+
!28 = !DILocation(line: 6, column: 5, scope: !25)
66+
!29 = !{!30, !30, i64 0}
67+
!30 = !{!"int", !31, i64 0}
68+
!31 = !{!"omnipotent char", !32, i64 0}
69+
!32 = !{!"Simple C/C++ TBAA"}
70+
!33 = !DILocation(line: 4, column: 8, scope: !19)
71+
!34 = !DILocation(line: 4, column: 6, scope: !19)
72+
!35 = !{!31, !31, i64 0}
73+
!36 = !DILocation(line: 8, column: 1, scope: !19)
74+
!37 = distinct !DISubprogram(name: "main", scope: !3, file: !3, line: 9, type: !38, scopeLine: 9, flags: DIFlagAllCallsDescribed, spFlags: DISPFlagDefinition | DISPFlagOptimized, unit: !2, retainedNodes: !40)
75+
!38 = !DISubroutineType(types: !39)
76+
!39 = !{null}
77+
!40 = !{}
78+
!41 = !DILocation(line: 9, column: 14, scope: !37)
79+
80+
...
81+
---
82+
name: c
83+
alignment: 16
84+
exposesReturnsTwice: false
85+
legalized: false
86+
regBankSelected: false
87+
selected: false
88+
failedISel: false
89+
tracksRegLiveness: true
90+
hasWinCFI: false
91+
callsEHReturn: false
92+
callsUnwindInit: false
93+
hasEHCatchret: false
94+
hasEHScopes: false
95+
hasEHFunclets: false
96+
debugInstrRef: true
97+
failsVerification: false
98+
tracksDebugUserValues: true
99+
registers: []
100+
liveins: []
101+
frameInfo:
102+
isFrameAddressTaken: false
103+
isReturnAddressTaken: false
104+
hasStackMap: false
105+
hasPatchPoint: false
106+
stackSize: 0
107+
offsetAdjustment: 0
108+
maxAlignment: 1
109+
adjustsStack: false
110+
hasCalls: false
111+
stackProtector: ''
112+
functionContext: ''
113+
maxCallFrameSize: 4294967295
114+
cvBytesOfCalleeSavedRegisters: 0
115+
hasOpaqueSPAdjustment: false
116+
hasVAStart: false
117+
hasMustTailInVarArgFunc: false
118+
hasTailCall: false
119+
localFrameSize: 0
120+
savePoint: ''
121+
restorePoint: ''
122+
fixedStack: []
123+
stack: []
124+
callSites: []
125+
debugValueSubstitutions: []
126+
constants: []
127+
machineFunctionInfo: {}
128+
body: |
129+
bb.0.entry:
130+
; CHECK-LABEL: name: c
131+
; CHECK: DBG_VALUE $edi, $noreg, !23, !DIExpression(), debug-location !26
132+
; CHECK-NEXT: DBG_VALUE $edi, $noreg, !24, !DIExpression(), debug-location !27
133+
; CHECK-NEXT: renamable $al = MOV8rm $rip, 1, $noreg, @b, $noreg, debug-location !28 :: (dereferenceable load (s8) from @b, align 4, !tbaa !29)
134+
; CHECK-NEXT: MOV8mr $rip, 1, $noreg, @a, $noreg, killed renamable $al, debug-location !34 :: (store (s8) into @a, !tbaa !35)
135+
; CHECK-NEXT: RET 0, undef $al, debug-location !36
136+
DBG_VALUE $edi, $noreg, !23, !DIExpression(), debug-location !26
137+
DBG_VALUE $edi, $noreg, !24, !DIExpression(), debug-location !27
138+
renamable $al = MOV8rm $rip, 1, $noreg, @b, $noreg, debug-location !28 :: (dereferenceable load (s8) from @b, align 4, !tbaa !29)
139+
MOV8mr $rip, 1, $noreg, @a, $noreg, killed renamable $al, debug-location !34 :: (store (s8) into @a, !tbaa !35)
140+
RET 0, undef $al, debug-location !36
141+
142+
...

0 commit comments

Comments
 (0)