Skip to content

Commit c30ff92

Browse files
thurstondthurstond
authored
[msan] Handle llvm.x86.vcvtps2ph.128/256 explicitly (#130705)
Check whether each lane is fully initialized, and propagate the shadow per lane instead of using the strict handling of visitInstruction. Updates the tests from #129807
1 parent 8c7f0ea commit c30ff92

File tree

2 files changed

+105
-64
lines changed

2 files changed

+105
-64
lines changed

‎llvm/lib/Transforms/Instrumentation/MemorySanitizer.cpp‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -207,6 +207,7 @@
207207
#include <cstddef>
208208
#include <cstdint>
209209
#include <memory>
210+
#include <numeric>
210211
#include <string>
211212
#include <tuple>
212213

@@ -3273,6 +3274,64 @@ struct MemorySanitizerVisitor : public InstVisitor<MemorySanitizerVisitor> {
32733274
setOriginForNaryOp(I);
32743275
}
32753276

3277+
/// Handle x86 SSE single-precision to half-precision conversion.
3278+
///
3279+
/// e.g.,
3280+
/// <8 x i16> @llvm.x86.vcvtps2ph.256(<8 x float> %a0, i32 0)
3281+
/// <8 x i16> @llvm.x86.vcvtps2ph.128(<4 x float> %a0, i32 0)
3282+
/// Note: if the output has more elements, they are zero-initialized (and
3283+
/// therefore the shadow will also be initialized).
3284+
///
3285+
/// This differs from handleSSEVectorConvertIntrinsic() because it
3286+
/// propagates uninitialized shadow (instead of checking the shadow).
3287+
void handleSSEVectorConvertIntrinsicByProp(IntrinsicInst &I) {
3288+
assert(I.arg_size() == 2);
3289+
Value *Src = I.getArgOperand(0);
3290+
assert(Src->getType()->isVectorTy());
3291+
[[maybe_unused]] Value *RoundingMode = I.getArgOperand(1);
3292+
assert(RoundingMode->getType()->isIntegerTy());
3293+
3294+
// The return type might have more elements than the input.
3295+
// Temporarily shrink the return type's number of elements.
3296+
VectorType *ShadowType = cast<VectorType>(getShadowTy(&I));
3297+
if (ShadowType->getElementCount() ==
3298+
cast<VectorType>(Src->getType())->getElementCount() * 2)
3299+
ShadowType = VectorType::getHalfElementsVectorType(ShadowType);
3300+
3301+
assert(ShadowType->getElementCount() ==
3302+
cast<VectorType>(Src->getType())->getElementCount());
3303+
3304+
IRBuilder<> IRB(&I);
3305+
Value *S0 = getShadow(&I, 0);
3306+
3307+
/// For scalars:
3308+
/// Since they are converting from floating-point to integer, the output is
3309+
/// - fully uninitialized if *any* bit of the input is uninitialized
3310+
/// - fully ininitialized if all bits of the input are ininitialized
3311+
/// We apply the same principle on a per-field basis for vectors.
3312+
Value *Shadow =
3313+
IRB.CreateSExt(IRB.CreateICmpNE(S0, getCleanShadow(S0)), ShadowType);
3314+
3315+
// The return type might have more elements than the input.
3316+
// Extend the return type back to its original width if necessary.
3317+
Value *FullShadow = getCleanShadow(&I);
3318+
3319+
if (Shadow->getType() == FullShadow->getType()) {
3320+
FullShadow = Shadow;
3321+
} else {
3322+
SmallVector<int, 8> ShadowMask(
3323+
cast<FixedVectorType>(FullShadow->getType())->getNumElements());
3324+
std::iota(ShadowMask.begin(), ShadowMask.end(), 0);
3325+
3326+
// Append zeros
3327+
FullShadow =
3328+
IRB.CreateShuffleVector(Shadow, getCleanShadow(Shadow), ShadowMask);
3329+
}
3330+
3331+
setShadow(&I, FullShadow);
3332+
setOriginForNaryOp(I);
3333+
}
3334+
32763335
// Instrument x86 SSE vector convert intrinsic.
32773336
//
32783337
// This function instruments intrinsics like cvtsi2ss:
@@ -4868,6 +4927,12 @@ struct MemorySanitizerVisitor : public InstVisitor<MemorySanitizerVisitor> {
48684927
break;
48694928
}
48704929

4930+
case Intrinsic::x86_vcvtps2ph_128:
4931+
case Intrinsic::x86_vcvtps2ph_256: {
4932+
handleSSEVectorConvertIntrinsicByProp(I);
4933+
break;
4934+
}
4935+
48714936
case Intrinsic::fshl:
48724937
case Intrinsic::fshr:
48734938
handleFunnelShift(I);

‎llvm/test/Instrumentation/MemorySanitizer/X86/f16c-intrinsics.ll‎

Lines changed: 40 additions & 64 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
;
44
; Forked from llvm/test/CodeGen/X86/f16c-intrinsics.ll
55
;
6-
; Handled by visitInstruction:
6+
; Handled by handleSSEVectorConvertIntrinsicByProp:
77
; - llvm.x86.vcvtps2ph.128/256
88

99
target datalayout = "e-p:64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:64:64-f32:32:32-f64:64:64-v64:64:64-v128:128:128-a0:0:64-s0:64:64-f80:128:128-n8:16:32:64-S128"
@@ -14,15 +14,11 @@ define <8 x i16> @test_x86_vcvtps2ph_128(<4 x float> %a0) #0 {
1414
; CHECK-SAME: <4 x float> [[A0:%.*]]) #[[ATTR0:[0-9]+]] {
1515
; CHECK-NEXT: [[TMP1:%.*]] = load <4 x i32>, ptr @__msan_param_tls, align 8
1616
; CHECK-NEXT: call void @llvm.donothing()
17-
; CHECK-NEXT: [[TMP2:%.*]] = bitcast <4 x i32> [[TMP1]] to i128
18-
; CHECK-NEXT: [[_MSCMP:%.*]] = icmp ne i128 [[TMP2]], 0
19-
; CHECK-NEXT: br i1 [[_MSCMP]], label %[[BB3:.*]], label %[[BB4:.*]], !prof [[PROF1:![0-9]+]]
20-
; CHECK: [[BB3]]:
21-
; CHECK-NEXT: call void @__msan_warning_noreturn() #[[ATTR4:[0-9]+]]
22-
; CHECK-NEXT: unreachable
23-
; CHECK: [[BB4]]:
17+
; CHECK-NEXT: [[TMP2:%.*]] = icmp ne <4 x i32> [[TMP1]], zeroinitializer
18+
; CHECK-NEXT: [[TMP3:%.*]] = sext <4 x i1> [[TMP2]] to <4 x i16>
19+
; CHECK-NEXT: [[TMP11:%.*]] = shufflevector <4 x i16> [[TMP3]], <4 x i16> zeroinitializer, <8 x i32> <i32 0, i32 1, i32 2, i32 3, i32 4, i32 5, i32 6, i32 7>
2420
; CHECK-NEXT: [[RES:%.*]] = call <8 x i16> @llvm.x86.vcvtps2ph.128(<4 x float> [[A0]], i32 0)
25-
; CHECK-NEXT: store <8 x i16> zeroinitializer, ptr @__msan_retval_tls, align 8
21+
; CHECK-NEXT: store <8 x i16> [[TMP11]], ptr @__msan_retval_tls, align 8
2622
; CHECK-NEXT: ret <8 x i16> [[RES]]
2723
;
2824
%res = call <8 x i16> @llvm.x86.vcvtps2ph.128(<4 x float> %a0, i32 0) ; <<8 x i16>> [#uses=1]
@@ -35,15 +31,10 @@ define <8 x i16> @test_x86_vcvtps2ph_256(<8 x float> %a0) #0 {
3531
; CHECK-SAME: <8 x float> [[A0:%.*]]) #[[ATTR0]] {
3632
; CHECK-NEXT: [[TMP1:%.*]] = load <8 x i32>, ptr @__msan_param_tls, align 8
3733
; CHECK-NEXT: call void @llvm.donothing()
38-
; CHECK-NEXT: [[TMP2:%.*]] = bitcast <8 x i32> [[TMP1]] to i256
39-
; CHECK-NEXT: [[_MSCMP:%.*]] = icmp ne i256 [[TMP2]], 0
40-
; CHECK-NEXT: br i1 [[_MSCMP]], label %[[BB3:.*]], label %[[BB4:.*]], !prof [[PROF1]]
41-
; CHECK: [[BB3]]:
42-
; CHECK-NEXT: call void @__msan_warning_noreturn() #[[ATTR4]]
43-
; CHECK-NEXT: unreachable
44-
; CHECK: [[BB4]]:
34+
; CHECK-NEXT: [[TMP2:%.*]] = icmp ne <8 x i32> [[TMP1]], zeroinitializer
35+
; CHECK-NEXT: [[TMP3:%.*]] = sext <8 x i1> [[TMP2]] to <8 x i16>
4536
; CHECK-NEXT: [[RES:%.*]] = call <8 x i16> @llvm.x86.vcvtps2ph.256(<8 x float> [[A0]], i32 0)
46-
; CHECK-NEXT: store <8 x i16> zeroinitializer, ptr @__msan_retval_tls, align 8
37+
; CHECK-NEXT: store <8 x i16> [[TMP3]], ptr @__msan_retval_tls, align 8
4738
; CHECK-NEXT: ret <8 x i16> [[RES]]
4839
;
4940
%res = call <8 x i16> @llvm.x86.vcvtps2ph.256(<8 x float> %a0, i32 0) ; <<8 x i16>> [#uses=1]
@@ -59,24 +50,19 @@ define void @test_x86_vcvtps2ph_256_m(ptr nocapture %d, <8 x float> %a) nounwind
5950
; CHECK-NEXT: [[TMP17:%.*]] = load <8 x i32>, ptr inttoptr (i64 add (i64 ptrtoint (ptr @__msan_param_tls to i64), i64 8) to ptr), align 8
6051
; CHECK-NEXT: [[TMP18:%.*]] = load i64, ptr @__msan_param_tls, align 8
6152
; CHECK-NEXT: call void @llvm.donothing()
62-
; CHECK-NEXT: [[TMP4:%.*]] = bitcast <8 x i32> [[TMP17]] to i256
63-
; CHECK-NEXT: [[_MSCMP:%.*]] = icmp ne i256 [[TMP4]], 0
64-
; CHECK-NEXT: br i1 [[_MSCMP]], label %[[BB3:.*]], label %[[BB4:.*]], !prof [[PROF1]]
65-
; CHECK: [[BB3]]:
66-
; CHECK-NEXT: call void @__msan_warning_noreturn() #[[ATTR4]]
67-
; CHECK-NEXT: unreachable
68-
; CHECK: [[BB4]]:
53+
; CHECK-NEXT: [[TMP20:%.*]] = icmp ne <8 x i32> [[TMP17]], zeroinitializer
54+
; CHECK-NEXT: [[TMP21:%.*]] = sext <8 x i1> [[TMP20]] to <8 x i16>
6955
; CHECK-NEXT: [[TMP0:%.*]] = tail call <8 x i16> @llvm.x86.vcvtps2ph.256(<8 x float> [[A]], i32 3)
7056
; CHECK-NEXT: [[_MSCMP1:%.*]] = icmp ne i64 [[TMP18]], 0
71-
; CHECK-NEXT: br i1 [[_MSCMP1]], label %[[BB6:.*]], label %[[BB7:.*]], !prof [[PROF1]]
72-
; CHECK: [[BB6]]:
73-
; CHECK-NEXT: call void @__msan_warning_noreturn() #[[ATTR4]]
57+
; CHECK-NEXT: br i1 [[_MSCMP1]], label %[[BB5:.*]], label %[[BB6:.*]], !prof [[PROF1:![0-9]+]]
58+
; CHECK: [[BB5]]:
59+
; CHECK-NEXT: call void @__msan_warning_noreturn() #[[ATTR4:[0-9]+]]
7460
; CHECK-NEXT: unreachable
75-
; CHECK: [[BB7]]:
61+
; CHECK: [[BB6]]:
7662
; CHECK-NEXT: [[TMP1:%.*]] = ptrtoint ptr [[D]] to i64
7763
; CHECK-NEXT: [[TMP2:%.*]] = xor i64 [[TMP1]], 87960930222080
7864
; CHECK-NEXT: [[TMP3:%.*]] = inttoptr i64 [[TMP2]] to ptr
79-
; CHECK-NEXT: store <8 x i16> zeroinitializer, ptr [[TMP3]], align 16
65+
; CHECK-NEXT: store <8 x i16> [[TMP21]], ptr [[TMP3]], align 16
8066
; CHECK-NEXT: store <8 x i16> [[TMP0]], ptr [[D]], align 16
8167
; CHECK-NEXT: ret void
8268
;
@@ -93,14 +79,11 @@ define void @test_x86_vcvtps2ph_128_m(ptr nocapture %d, <4 x float> %a) nounwind
9379
; CHECK-NEXT: [[TMP9:%.*]] = load <4 x i32>, ptr inttoptr (i64 add (i64 ptrtoint (ptr @__msan_param_tls to i64), i64 8) to ptr), align 8
9480
; CHECK-NEXT: [[TMP10:%.*]] = load i64, ptr @__msan_param_tls, align 8
9581
; CHECK-NEXT: call void @llvm.donothing()
96-
; CHECK-NEXT: [[TMP5:%.*]] = bitcast <4 x i32> [[TMP9]] to i128
97-
; CHECK-NEXT: [[_MSCMP:%.*]] = icmp ne i128 [[TMP5]], 0
98-
; CHECK-NEXT: br i1 [[_MSCMP]], label %[[BB3:.*]], label %[[BB4:.*]], !prof [[PROF1]]
99-
; CHECK: [[BB3]]:
100-
; CHECK-NEXT: call void @__msan_warning_noreturn() #[[ATTR4]]
101-
; CHECK-NEXT: unreachable
102-
; CHECK: [[BB4]]:
82+
; CHECK-NEXT: [[TMP12:%.*]] = icmp ne <4 x i32> [[TMP9]], zeroinitializer
83+
; CHECK-NEXT: [[TMP13:%.*]] = sext <4 x i1> [[TMP12]] to <4 x i16>
84+
; CHECK-NEXT: [[TMP11:%.*]] = shufflevector <4 x i16> [[TMP13]], <4 x i16> zeroinitializer, <8 x i32> <i32 0, i32 1, i32 2, i32 3, i32 4, i32 5, i32 6, i32 7>
10385
; CHECK-NEXT: [[TMP0:%.*]] = tail call <8 x i16> @llvm.x86.vcvtps2ph.128(<4 x float> [[A]], i32 3)
86+
; CHECK-NEXT: [[_MSPROP:%.*]] = shufflevector <8 x i16> [[TMP11]], <8 x i16> splat (i16 -1), <4 x i32> <i32 0, i32 1, i32 2, i32 3>
10487
; CHECK-NEXT: [[TMP1:%.*]] = shufflevector <8 x i16> [[TMP0]], <8 x i16> poison, <4 x i32> <i32 0, i32 1, i32 2, i32 3>
10588
; CHECK-NEXT: [[_MSCMP1:%.*]] = icmp ne i64 [[TMP10]], 0
10689
; CHECK-NEXT: br i1 [[_MSCMP1]], label %[[BB7:.*]], label %[[BB8:.*]], !prof [[PROF1]]
@@ -111,7 +94,7 @@ define void @test_x86_vcvtps2ph_128_m(ptr nocapture %d, <4 x float> %a) nounwind
11194
; CHECK-NEXT: [[TMP2:%.*]] = ptrtoint ptr [[D]] to i64
11295
; CHECK-NEXT: [[TMP3:%.*]] = xor i64 [[TMP2]], 87960930222080
11396
; CHECK-NEXT: [[TMP4:%.*]] = inttoptr i64 [[TMP3]] to ptr
114-
; CHECK-NEXT: store <4 x i16> zeroinitializer, ptr [[TMP4]], align 8
97+
; CHECK-NEXT: store <4 x i16> [[_MSPROP]], ptr [[TMP4]], align 8
11598
; CHECK-NEXT: store <4 x i16> [[TMP1]], ptr [[D]], align 8
11699
; CHECK-NEXT: ret void
117100
;
@@ -129,26 +112,24 @@ define void @test_x86_vcvtps2ph_128_m2(ptr nocapture %hf4x16, <4 x float> %f4X86
129112
; CHECK-NEXT: [[TMP0:%.*]] = load <4 x i32>, ptr inttoptr (i64 add (i64 ptrtoint (ptr @__msan_param_tls to i64), i64 8) to ptr), align 8
130113
; CHECK-NEXT: [[TMP1:%.*]] = load i64, ptr @__msan_param_tls, align 8
131114
; CHECK-NEXT: call void @llvm.donothing()
132-
; CHECK-NEXT: [[TMP2:%.*]] = bitcast <4 x i32> [[TMP0]] to i128
133-
; CHECK-NEXT: [[_MSCMP:%.*]] = icmp ne i128 [[TMP2]], 0
134-
; CHECK-NEXT: br i1 [[_MSCMP]], label %[[BB3:.*]], label %[[BB4:.*]], !prof [[PROF1]]
135-
; CHECK: [[BB3]]:
136-
; CHECK-NEXT: call void @__msan_warning_noreturn() #[[ATTR4]]
137-
; CHECK-NEXT: unreachable
138-
; CHECK: [[BB4]]:
115+
; CHECK-NEXT: [[TMP2:%.*]] = icmp ne <4 x i32> [[TMP0]], zeroinitializer
116+
; CHECK-NEXT: [[TMP3:%.*]] = sext <4 x i1> [[TMP2]] to <4 x i16>
117+
; CHECK-NEXT: [[TMP14:%.*]] = shufflevector <4 x i16> [[TMP3]], <4 x i16> zeroinitializer, <8 x i32> <i32 0, i32 1, i32 2, i32 3, i32 4, i32 5, i32 6, i32 7>
139118
; CHECK-NEXT: [[TMP11:%.*]] = tail call <8 x i16> @llvm.x86.vcvtps2ph.128(<4 x float> [[F4X86]], i32 3)
119+
; CHECK-NEXT: [[TMP13:%.*]] = bitcast <8 x i16> [[TMP14]] to <2 x i64>
140120
; CHECK-NEXT: [[TMP12:%.*]] = bitcast <8 x i16> [[TMP11]] to <2 x double>
121+
; CHECK-NEXT: [[_MSPROP:%.*]] = extractelement <2 x i64> [[TMP13]], i32 0
141122
; CHECK-NEXT: [[VECEXT:%.*]] = extractelement <2 x double> [[TMP12]], i32 0
142123
; CHECK-NEXT: [[_MSCMP1:%.*]] = icmp ne i64 [[TMP1]], 0
143-
; CHECK-NEXT: br i1 [[_MSCMP1]], label %[[BB7:.*]], label %[[BB8:.*]], !prof [[PROF1]]
144-
; CHECK: [[BB7]]:
124+
; CHECK-NEXT: br i1 [[_MSCMP1]], label %[[BB8:.*]], label %[[BB9:.*]], !prof [[PROF1]]
125+
; CHECK: [[BB8]]:
145126
; CHECK-NEXT: call void @__msan_warning_noreturn() #[[ATTR4]]
146127
; CHECK-NEXT: unreachable
147-
; CHECK: [[BB8]]:
128+
; CHECK: [[BB9]]:
148129
; CHECK-NEXT: [[TMP15:%.*]] = ptrtoint ptr [[HF4X16]] to i64
149130
; CHECK-NEXT: [[TMP16:%.*]] = xor i64 [[TMP15]], 87960930222080
150131
; CHECK-NEXT: [[TMP17:%.*]] = inttoptr i64 [[TMP16]] to ptr
151-
; CHECK-NEXT: store i64 0, ptr [[TMP17]], align 8
132+
; CHECK-NEXT: store i64 [[_MSPROP]], ptr [[TMP17]], align 8
152133
; CHECK-NEXT: store double [[VECEXT]], ptr [[HF4X16]], align 8
153134
; CHECK-NEXT: ret void
154135
;
@@ -167,27 +148,25 @@ define void @test_x86_vcvtps2ph_128_m3(ptr nocapture %hf4x16, <4 x float> %f4X86
167148
; CHECK-NEXT: [[TMP0:%.*]] = load <4 x i32>, ptr inttoptr (i64 add (i64 ptrtoint (ptr @__msan_param_tls to i64), i64 8) to ptr), align 8
168149
; CHECK-NEXT: [[TMP1:%.*]] = load i64, ptr @__msan_param_tls, align 8
169150
; CHECK-NEXT: call void @llvm.donothing()
170-
; CHECK-NEXT: [[TMP2:%.*]] = bitcast <4 x i32> [[TMP0]] to i128
171-
; CHECK-NEXT: [[_MSCMP:%.*]] = icmp ne i128 [[TMP2]], 0
172-
; CHECK-NEXT: br i1 [[_MSCMP]], label %[[BB3:.*]], label %[[BB4:.*]], !prof [[PROF1]]
173-
; CHECK: [[BB3]]:
174-
; CHECK-NEXT: call void @__msan_warning_noreturn() #[[ATTR4]]
175-
; CHECK-NEXT: unreachable
176-
; CHECK: [[BB4]]:
151+
; CHECK-NEXT: [[TMP2:%.*]] = icmp ne <4 x i32> [[TMP0]], zeroinitializer
152+
; CHECK-NEXT: [[TMP3:%.*]] = sext <4 x i1> [[TMP2]] to <4 x i16>
153+
; CHECK-NEXT: [[TMP13:%.*]] = shufflevector <4 x i16> [[TMP3]], <4 x i16> zeroinitializer, <8 x i32> <i32 0, i32 1, i32 2, i32 3, i32 4, i32 5, i32 6, i32 7>
177154
; CHECK-NEXT: [[TMP11:%.*]] = tail call <8 x i16> @llvm.x86.vcvtps2ph.128(<4 x float> [[F4X86]], i32 3)
178-
; CHECK-NEXT: [[TMP12:%.*]] = bitcast <8 x i16> [[TMP11]] to <2 x i64>
155+
; CHECK-NEXT: [[TMP12:%.*]] = bitcast <8 x i16> [[TMP13]] to <2 x i64>
156+
; CHECK-NEXT: [[TMP14:%.*]] = bitcast <8 x i16> [[TMP11]] to <2 x i64>
179157
; CHECK-NEXT: [[VECEXT:%.*]] = extractelement <2 x i64> [[TMP12]], i32 0
158+
; CHECK-NEXT: [[VECEXT1:%.*]] = extractelement <2 x i64> [[TMP14]], i32 0
180159
; CHECK-NEXT: [[_MSCMP1:%.*]] = icmp ne i64 [[TMP1]], 0
181-
; CHECK-NEXT: br i1 [[_MSCMP1]], label %[[BB7:.*]], label %[[BB8:.*]], !prof [[PROF1]]
182-
; CHECK: [[BB7]]:
160+
; CHECK-NEXT: br i1 [[_MSCMP1]], label %[[BB8:.*]], label %[[BB9:.*]], !prof [[PROF1]]
161+
; CHECK: [[BB8]]:
183162
; CHECK-NEXT: call void @__msan_warning_noreturn() #[[ATTR4]]
184163
; CHECK-NEXT: unreachable
185-
; CHECK: [[BB8]]:
164+
; CHECK: [[BB9]]:
186165
; CHECK-NEXT: [[TMP15:%.*]] = ptrtoint ptr [[HF4X16]] to i64
187166
; CHECK-NEXT: [[TMP16:%.*]] = xor i64 [[TMP15]], 87960930222080
188167
; CHECK-NEXT: [[TMP17:%.*]] = inttoptr i64 [[TMP16]] to ptr
189-
; CHECK-NEXT: store i64 0, ptr [[TMP17]], align 8
190-
; CHECK-NEXT: store i64 [[VECEXT]], ptr [[HF4X16]], align 8
168+
; CHECK-NEXT: store i64 [[VECEXT]], ptr [[TMP17]], align 8
169+
; CHECK-NEXT: store i64 [[VECEXT1]], ptr [[HF4X16]], align 8
191170
; CHECK-NEXT: ret void
192171
;
193172
entry:
@@ -199,6 +178,3 @@ entry:
199178
}
200179

201180
attributes #0 = { sanitize_memory }
202-
;.
203-
; CHECK: [[PROF1]] = !{!"branch_weights", i32 1, i32 1048575}
204-
;.

0 commit comments

Comments
 (0)