Skip to content

Commit 916c997

Browse files
krishna2803krishna2803
committed
merge: branch 'main' into users/krishna2803/modfbf6
Signed-off-by: Krishna Pandey <[email protected]>
2 parents 7284969 + e4eccd6 commit 916c997

File tree

350 files changed

+13612
-8802
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

350 files changed

+13612
-8802
lines changed

‎.github/CODEOWNERS

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -112,6 +112,9 @@
112112
/mlir/**/NVGPU*/ @grypp
113113
/mlir/test/**/CUDA/ @grypp
114114

115+
# MLIR GPU Dialect
116+
/mlir/**/GPU*/ @fabianmcg
117+
115118
# MLIR NVVM Dialect in MLIR
116119
/mlir/**/LLVMIR/**/BasicPtxBuilderInterface* @grypp
117120
/mlir/**/NVVM* @grypp

‎bolt/include/bolt/Core/MCPlusBuilder.h

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -718,6 +718,20 @@ class MCPlusBuilder {
718718
return false;
719719
}
720720

721+
/// Returns true if Inst is a trap instruction.
722+
///
723+
/// Tests if Inst is an instruction that immediately causes an abnormal
724+
/// program termination, for example when a security violation is detected
725+
/// by a compiler-inserted check.
726+
///
727+
/// @note An implementation of this method should likely return false for
728+
/// calls to library functions like abort(), as it is possible that the
729+
/// execution state is partially attacker-controlled at this point.
730+
virtual bool isTrap(const MCInst &Inst) const {
731+
llvm_unreachable("not implemented");
732+
return false;
733+
}
734+
721735
virtual bool isBreakpoint(const MCInst &Inst) const {
722736
llvm_unreachable("not implemented");
723737
return false;

‎bolt/lib/Passes/PAuthGadgetScanner.cpp

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1078,6 +1078,15 @@ class DstSafetyAnalysis {
10781078
dbgs() << ")\n";
10791079
});
10801080

1081+
// If this instruction terminates the program immediately, no
1082+
// authentication oracles are possible past this point.
1083+
if (BC.MIB->isTrap(Point)) {
1084+
LLVM_DEBUG({ traceInst(BC, "Trap instruction found", Point); });
1085+
DstState Next(NumRegs, RegsToTrackInstsFor.getNumTrackedRegisters());
1086+
Next.CannotEscapeUnchecked.set();
1087+
return Next;
1088+
}
1089+
10811090
// If this instruction is reachable by the analysis, a non-empty state will
10821091
// be propagated to it sooner or later. Until then, skip computeNext().
10831092
if (Cur.empty()) {
@@ -1185,8 +1194,8 @@ class DataflowDstSafetyAnalysis
11851194
//
11861195
// A basic block without any successors, on the other hand, can be
11871196
// pessimistically initialized to everything-is-unsafe: this will naturally
1188-
// handle both return and tail call instructions and is harmless for
1189-
// internal indirect branch instructions (such as computed gotos).
1197+
// handle return, trap and tail call instructions. At the same time, it is
1198+
// harmless for internal indirect branch instructions, like computed gotos.
11901199
if (BB.succ_empty())
11911200
return createUnsafeState();
11921201

‎bolt/lib/Target/AArch64/AArch64MCPlusBuilder.cpp

Lines changed: 30 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -382,10 +382,9 @@ class AArch64MCPlusBuilder : public MCPlusBuilder {
382382
// the list of successors of this basic block as appropriate.
383383

384384
// Any of the above code sequences assume the fall-through basic block
385-
// is a dead-end BRK instruction (any immediate operand is accepted).
385+
// is a dead-end trap instruction.
386386
const BinaryBasicBlock *BreakBB = BB.getFallthrough();
387-
if (!BreakBB || BreakBB->empty() ||
388-
BreakBB->front().getOpcode() != AArch64::BRK)
387+
if (!BreakBB || BreakBB->empty() || !isTrap(BreakBB->front()))
389388
return std::nullopt;
390389

391390
// Iterate over the instructions of BB in reverse order, matching opcodes
@@ -1744,6 +1743,34 @@ class AArch64MCPlusBuilder : public MCPlusBuilder {
17441743
Inst.addOperand(MCOperand::createImm(0));
17451744
}
17461745

1746+
bool isTrap(const MCInst &Inst) const override {
1747+
if (Inst.getOpcode() != AArch64::BRK)
1748+
return false;
1749+
// Only match the immediate values that are likely to indicate this BRK
1750+
// instruction is emitted to terminate the program immediately and not to
1751+
// be handled by a SIGTRAP handler, for example.
1752+
switch (Inst.getOperand(0).getImm()) {
1753+
case 0xc470:
1754+
case 0xc471:
1755+
case 0xc472:
1756+
case 0xc473:
1757+
// Explicit Pointer Authentication check failed, see
1758+
// AArch64AsmPrinter::emitPtrauthCheckAuthenticatedValue().
1759+
return true;
1760+
case 0x1:
1761+
// __builtin_trap(), as emitted by Clang.
1762+
return true;
1763+
case 0x3e8: // decimal 1000
1764+
// __builtin_trap(), as emitted by GCC.
1765+
return true;
1766+
default:
1767+
// Some constants may indicate intentionally recoverable break-points.
1768+
// This is the case at least for 0xf000, which is used by
1769+
// __builtin_debugtrap() supported by Clang.
1770+
return false;
1771+
}
1772+
}
1773+
17471774
bool isStorePair(const MCInst &Inst) const {
17481775
const unsigned opcode = Inst.getOpcode();
17491776

‎bolt/test/binary-analysis/AArch64/gs-pauth-address-checks.s

Lines changed: 22 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ resign_xpaci_good:
3131
xpaci x16
3232
cmp x0, x16
3333
b.eq 1f
34-
brk 0x1234
34+
brk 0xc471
3535
1:
3636
pacia x0, x2
3737
ret
@@ -46,7 +46,7 @@ resign_xpacd_good:
4646
xpacd x16
4747
cmp x0, x16
4848
b.eq 1f
49-
brk 0x1234
49+
brk 0xc473
5050
1:
5151
pacda x0, x2
5252
ret
@@ -117,7 +117,7 @@ resign_xpaci_unrelated_auth_and_check:
117117
xpaci x16
118118
cmp x0, x16
119119
b.eq 1f
120-
brk 0x1234
120+
brk 0xc471
121121
1:
122122
pacia x10, x2
123123
ret
@@ -139,7 +139,7 @@ resign_xpaci_wrong_pattern_1:
139139
xpaci x16
140140
cmp x0, x16
141141
b.eq 1f
142-
brk 0x1234
142+
brk 0xc471
143143
1:
144144
pacia x0, x2
145145
ret
@@ -157,7 +157,7 @@ resign_xpaci_wrong_pattern_2:
157157
xpaci x0 // x0 instead of x16
158158
cmp x0, x16
159159
b.eq 1f
160-
brk 0x1234
160+
brk 0xc471
161161
1:
162162
pacia x0, x2
163163
ret
@@ -174,7 +174,7 @@ resign_xpaci_wrong_pattern_3:
174174
xpaci x16
175175
cmp x16, x16 // x16 instead of x0
176176
b.eq 1f
177-
brk 0x1234
177+
brk 0xc471
178178
1:
179179
pacia x0, x2
180180
ret
@@ -191,7 +191,7 @@ resign_xpaci_wrong_pattern_4:
191191
xpaci x16
192192
cmp x0, x0 // x0 instead of x16
193193
b.eq 1f
194-
brk 0x1234
194+
brk 0xc471
195195
1:
196196
pacia x0, x2
197197
ret
@@ -208,7 +208,7 @@ resign_xpaci_wrong_pattern_5:
208208
mov x16, x16 // replace xpaci with a no-op instruction
209209
cmp x0, x16
210210
b.eq 1f
211-
brk 0x1234
211+
brk 0xc471
212212
1:
213213
pacia x0, x2
214214
ret
@@ -228,7 +228,7 @@ resign_xpaclri_good:
228228
xpaclri
229229
cmp x30, x16
230230
b.eq 1f
231-
brk 0x1234
231+
brk 0xc471
232232
1:
233233
pacia x30, x2
234234

@@ -246,7 +246,7 @@ xpaclri_check_keeps_lr_safe:
246246
xpaclri // clobbers LR
247247
cmp x30, x16
248248
b.eq 1f
249-
brk 0x1234 // marks LR as trusted and safe-to-dereference
249+
brk 0xc471 // marks LR as trusted and safe-to-dereference
250250
1:
251251
ret // not reporting non-protected return
252252
.size xpaclri_check_keeps_lr_safe, .-xpaclri_check_keeps_lr_safe
@@ -265,7 +265,7 @@ xpaclri_check_requires_safe_lr:
265265
xpaclri
266266
cmp x30, x16
267267
b.eq 1f
268-
brk 0x1234
268+
brk 0xc471
269269
1:
270270
ret
271271
.size xpaclri_check_requires_safe_lr, .-xpaclri_check_requires_safe_lr
@@ -283,7 +283,7 @@ resign_xpaclri_wrong_reg:
283283
xpaclri // ... but xpaclri still operates on x30
284284
cmp x20, x16
285285
b.eq 1f
286-
brk 0x1234
286+
brk 0xc471
287287
1:
288288
pacia x20, x2
289289

@@ -303,7 +303,7 @@ resign_checked_not_authenticated:
303303
xpaci x16
304304
cmp x0, x16
305305
b.eq 1f
306-
brk 0x1234
306+
brk 0xc471
307307
1:
308308
pacia x0, x2
309309
ret
@@ -323,7 +323,7 @@ resign_checked_before_authenticated:
323323
xpaci x16
324324
cmp x0, x16
325325
b.eq 1f
326-
brk 0x1234
326+
brk 0xc471
327327
1:
328328
autib x0, x1
329329
pacia x0, x2
@@ -339,7 +339,7 @@ resign_high_bits_tbz_good:
339339
autib x0, x1
340340
eor x16, x0, x0, lsl #1
341341
tbz x16, #62, 1f
342-
brk 0x1234
342+
brk 0xc471
343343
1:
344344
pacia x0, x2
345345
ret
@@ -378,7 +378,7 @@ resign_high_bits_tbz_wrong_bit:
378378
autib x0, x1
379379
eor x16, x0, x0, lsl #1
380380
tbz x16, #63, 1f
381-
brk 0x1234
381+
brk 0xc471
382382
1:
383383
pacia x0, x2
384384
ret
@@ -393,7 +393,7 @@ resign_high_bits_tbz_wrong_shift_amount:
393393
autib x0, x1
394394
eor x16, x0, x0, lsl #2
395395
tbz x16, #62, 1f
396-
brk 0x1234
396+
brk 0xc471
397397
1:
398398
pacia x0, x2
399399
ret
@@ -408,7 +408,7 @@ resign_high_bits_tbz_wrong_shift_type:
408408
autib x0, x1
409409
eor x16, x0, x0, lsr #1
410410
tbz x16, #62, 1f
411-
brk 0x1234
411+
brk 0xc471
412412
1:
413413
pacia x0, x2
414414
ret
@@ -423,7 +423,7 @@ resign_high_bits_tbz_wrong_pattern_1:
423423
autib x0, x1
424424
eor x16, x0, x0, lsl #1
425425
tbz x17, #62, 1f
426-
brk 0x1234
426+
brk 0xc471
427427
1:
428428
pacia x0, x2
429429
ret
@@ -438,7 +438,7 @@ resign_high_bits_tbz_wrong_pattern_2:
438438
autib x0, x1
439439
eor x16, x10, x0, lsl #1
440440
tbz x16, #62, 1f
441-
brk 0x1234
441+
brk 0xc471
442442
1:
443443
pacia x0, x2
444444
ret
@@ -453,7 +453,7 @@ resign_high_bits_tbz_wrong_pattern_3:
453453
autib x0, x1
454454
eor x16, x0, x10, lsl #1
455455
tbz x16, #62, 1f
456-
brk 0x1234
456+
brk 0xc471
457457
1:
458458
pacia x0, x2
459459
ret
@@ -648,7 +648,7 @@ many_checked_regs:
648648
xpacd x16 // ...
649649
cmp x2, x16 // ...
650650
b.eq 2f // end of basic block
651-
brk 0x1234
651+
brk 0xc473
652652
2:
653653
pacdza x0
654654
pacdza x1

‎bolt/test/binary-analysis/AArch64/gs-pauth-authentication-oracles.s

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,7 @@ good_explicit_check:
7979
autia x0, x1
8080
eor x16, x0, x0, lsl #1
8181
tbz x16, #62, 1f
82-
brk 0x1234
82+
brk 0xc470
8383
1:
8484
ret
8585
.size good_explicit_check, .-good_explicit_check
@@ -373,7 +373,7 @@ good_explicit_check_multi_bb:
373373
1:
374374
eor x16, x0, x0, lsl #1
375375
tbz x16, #62, 2f
376-
brk 0x1234
376+
brk 0xc470
377377
2:
378378
cbz x1, 3f
379379
nop
@@ -685,16 +685,15 @@ good_address_arith_nocfg:
685685
.globl good_explicit_check_unrelated_reg
686686
.type good_explicit_check_unrelated_reg,@function
687687
good_explicit_check_unrelated_reg:
688-
// CHECK-LABEL: GS-PAUTH: authentication oracle found in function good_explicit_check_unrelated_reg, basic block {{[^,]+}}, at address
689-
// FIXME: The below instruction is not an authentication oracle
688+
// CHECK-NOT: good_explicit_check_unrelated_reg
690689
autia x2, x3 // One of possible execution paths after this instruction
691690
// ends at BRK below, thus BRK used as a trap instruction
692691
// should formally "check everything" not to introduce
693692
// false-positive here.
694693
autia x0, x1
695694
eor x16, x0, x0, lsl #1
696695
tbz x16, #62, 1f
697-
brk 0x1234
696+
brk 0xc470
698697
1:
699698
ldr x4, [x2] // Right before this instruction X2 is checked - this
700699
// should be propagated to the basic block ending with

‎bolt/test/binary-analysis/AArch64/gs-pauth-signing-oracles.s

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ good_sign_auted_checked_brk:
5757
autda x0, x2
5858
eor x16, x0, x0, lsl #1
5959
tbz x16, #62, 1f
60-
brk 0x1234
60+
brk 0xc472
6161
1:
6262
pacda x0, x1
6363
ret
@@ -351,7 +351,7 @@ good_sign_auted_checked_brk_multi_bb:
351351
1:
352352
eor x16, x0, x0, lsl #1
353353
tbz x16, #62, 2f
354-
brk 0x1234
354+
brk 0xc472
355355
2:
356356
cbz x4, 3f
357357
nop
@@ -705,7 +705,7 @@ good_resign_with_increment_brk:
705705
add x0, x0, #8
706706
eor x16, x0, x0, lsl #1
707707
tbz x16, #62, 1f
708-
brk 0x1234
708+
brk 0xc472
709709
1:
710710
mov x2, x0
711711
pacda x2, x1

0 commit comments

Comments
 (0)