Thanks to visit codestin.com
Credit goes to github.com

Skip to content

[BOLT] Gadget scanner: improve handling of unreachable basic blocks #136183

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: users/atrosinenko/bolt-gs-cfi-debug-printing
Choose a base branch
from
Open

[BOLT] Gadget scanner: improve handling of unreachable basic blocks #136183

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c11b901
[BOLT] Gadget scanner: improve handling of unreachable basic blocks
atrosinenko Apr 17, 2025
49f2679
Fix handling of unreachable loops of BBs
atrosinenko Apr 30, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
67 changes: 56 additions & 11 deletions bolt/lib/Passes/PAuthGadgetScanner.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -343,6 +343,12 @@ class SrcSafetyAnalysis {
return S;
}

/// Creates a state with all registers marked unsafe (not to be confused
/// with empty state).
SrcState createUnsafeState() const {
return SrcState(NumRegs, RegsToTrackInstsFor.getNumTrackedRegisters());
}

BitVector getClobberedRegs(const MCInst &Point) const {
BitVector Clobbered(NumRegs);
// Assume a call can clobber all registers, including callee-saved
Expand Down Expand Up @@ -585,6 +591,13 @@ class DataflowSrcSafetyAnalysis
if (BB.isEntryPoint())
return createEntryState();

// If a basic block without any predecessors is found in an optimized code,
// this likely means that some CFG edges were not detected. Pessimistically
// assume all registers to be unsafe before this basic block and warn about
// this fact in FunctionAnalysis::findUnsafeUses().
if (BB.pred_empty())
return createUnsafeState();

return SrcState();
}

Expand Down Expand Up @@ -658,12 +671,6 @@ class CFGUnawareSrcSafetyAnalysis : public SrcSafetyAnalysis {
BC.MIB->removeAnnotation(I.second, StateAnnotationIndex);
}

/// Creates a state with all registers marked unsafe (not to be confused
/// with empty state).
SrcState createUnsafeState() const {
return SrcState(NumRegs, RegsToTrackInstsFor.getNumTrackedRegisters());
}

public:
CFGUnawareSrcSafetyAnalysis(BinaryFunction &BF,
MCPlusBuilder::AllocatorIdTy AllocId,
Expand Down Expand Up @@ -1342,17 +1349,55 @@ void FunctionAnalysisContext::findUnsafeUses(
BF.dump();
});

bool UnreachableBBReported = false;
if (BF.hasCFG()) {
// Warn on basic blocks being unreachable according to BOLT (at most once
// per BinaryFunction), as this likely means the CFG reconstructed by BOLT
// is imprecise. A basic block can be
// * reachable from an entry basic block - a hopefully correct non-empty
// state is propagated to that basic block sooner or later. All basic
// blocks are expected to belong to this category under normal conditions.
// * reachable from a "directly unreachable" BB (a basic block that has no
// direct predecessors and this is not because it is an entry BB) - *some*
// non-empty state is propagated to this basic block sooner or later, as
// the initial state of directly unreachable basic blocks is
// pessimistically initialized to "all registers are unsafe"
// - a warning can be printed for the "directly unreachable" basic block
// * neither reachable from an entry nor from a "directly unreachable" BB
// (such as if this BB is in an isolated loop of basic blocks) - the final
// state is computed to be empty for this basic block
// - a warning can be printed for this basic block
for (BinaryBasicBlock &BB : BF) {
MCInst *FirstInst = BB.getFirstNonPseudoInstr();
// Skip empty basic block early for simplicity.
if (!FirstInst)
continue;

bool IsDirectlyUnreachable = BB.pred_empty() && !BB.isEntryPoint();
bool HasNoStateComputed = Analysis->getStateBefore(*FirstInst).empty();
if (!IsDirectlyUnreachable && !HasNoStateComputed)
continue;

// Arbitrarily attach the report to the first instruction of BB.
Reports.push_back(
make_generic_report(MCInstReference::get(FirstInst, BF),
"Warning: the function has unreachable basic "
"blocks (possibly incomplete CFG)"));
UnreachableBBReported = true;
break; // One warning per function.
}
}

iterateOverInstrs(BF, [&](MCInstReference Inst) {
if (BC.MIB->isCFI(Inst))
return;

const SrcState &S = Analysis->getStateBefore(Inst);

// If non-empty state was never propagated from the entry basic block
// to Inst, assume it to be unreachable and report a warning.
if (S.empty()) {
Reports.push_back(
make_generic_report(Inst, "Warning: unreachable instruction found"));
LLVM_DEBUG(
{ traceInst(BC, "Instruction has no state, skipping", Inst); });
assert(UnreachableBBReported && "Should be reported at least once");
(void)UnreachableBBReported;
return;
}

Expand Down
7 changes: 6 additions & 1 deletion bolt/test/binary-analysis/AArch64/gs-pacret-autiasp.s
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -215,12 +215,17 @@ f_callclobbered_calleesaved:
.globl f_unreachable_instruction
.type f_unreachable_instruction,@function
f_unreachable_instruction:
// CHECK-LABEL: GS-PAUTH: Warning: unreachable instruction found in function f_unreachable_instruction, basic block {{[0-9a-zA-Z.]+}}, at address
// CHECK-LABEL: GS-PAUTH: Warning: the function has unreachable basic blocks (possibly incomplete CFG) in function f_unreachable_instruction, basic block {{[0-9a-zA-Z.]+}}, at address
// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: add x0, x1, x2
// CHECK-NOT: instructions that write to the affected registers after any authentication are:
// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_unreachable_instruction, basic block {{[0-9a-zA-Z.]+}}, at address
// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: ret
// CHECK-NEXT: The 0 instructions that write to the affected registers after any authentication are:
b 1f
add x0, x1, x2
1:
// "ret" is reported as unprotected, as LR is pessimistically assumed
// unsafe at "add x0, x1, x2", thus it is unsafe at "ret" as well.
ret
.size f_unreachable_instruction, .-f_unreachable_instruction

Expand Down
84 changes: 84 additions & 0 deletions bolt/test/binary-analysis/AArch64/gs-pauth-calls.s
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1428,6 +1428,90 @@ printed_instrs_nocfg:
br x0
.size printed_instrs_nocfg, .-printed_instrs_nocfg

// Test handling of unreachable basic blocks.
//
// Basic blocks without any predecessors were observed in real-world optimized
// code. At least sometimes they were actually reachable via jump table, which
// was not detected, but the function was processed as if its CFG was
// reconstructed successfully.
//
// As a more predictable model example, let's use really unreachable code
// for testing.

.globl bad_unreachable_call
.type bad_unreachable_call,@function
bad_unreachable_call:
// CHECK-LABEL: GS-PAUTH: Warning: the function has unreachable basic blocks (possibly incomplete CFG) in function bad_unreachable_call, basic block {{[^,]+}}, at address
// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x0
// CHECK-NOT: instructions that write to the affected registers after any authentication are:
// CHECK-LABEL: GS-PAUTH: non-protected call found in function bad_unreachable_call, basic block {{[^,]+}}, at address
// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x0
// CHECK-NEXT: The 0 instructions that write to the affected registers after any authentication are:
paciasp
stp x29, x30, [sp, #-16]!
mov x29, sp

b 1f
// unreachable basic block:
blr x0

1: // reachable basic block:
ldp x29, x30, [sp], #16
autiasp
ret
.size bad_unreachable_call, .-bad_unreachable_call

.globl good_unreachable_call
.type good_unreachable_call,@function
good_unreachable_call:
// CHECK-NOT: non-protected call{{.*}}good_unreachable_call
// CHECK-LABEL: GS-PAUTH: Warning: the function has unreachable basic blocks (possibly incomplete CFG) in function good_unreachable_call, basic block {{[^,]+}}, at address
// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: autia x0, x1
// CHECK-NOT: instructions that write to the affected registers after any authentication are:
// CHECK-NOT: non-protected call{{.*}}good_unreachable_call
paciasp
stp x29, x30, [sp, #-16]!
mov x29, sp

b 1f
// unreachable basic block:
autia x0, x1
blr x0 // <-- this call is definitely protected provided at least
// basic block boundaries are detected correctly

1: // reachable basic block:
ldp x29, x30, [sp], #16
autiasp
ret
.size good_unreachable_call, .-good_unreachable_call

.globl unreachable_loop_of_bbs
.type unreachable_loop_of_bbs,@function
unreachable_loop_of_bbs:
// CHECK-NOT: unreachable basic blocks{{.*}}unreachable_loop_of_bbs
// CHECK-NOT: non-protected call{{.*}}unreachable_loop_of_bbs
// CHECK-LABEL: GS-PAUTH: Warning: the function has unreachable basic blocks (possibly incomplete CFG) in function unreachable_loop_of_bbs, basic block {{[^,]+}}, at address
// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x0
// CHECK-NOT: unreachable basic blocks{{.*}}unreachable_loop_of_bbs
// CHECK-NOT: non-protected call{{.*}}unreachable_loop_of_bbs
paciasp
stp x29, x30, [sp, #-16]!
mov x29, sp
b .Lreachable_epilogue_bb

.Lfirst_unreachable_bb:
blr x0 // <-- this call is not analyzed
b .Lsecond_unreachable_bb
.Lsecond_unreachable_bb:
blr x1 // <-- this call is not analyzed
b .Lfirst_unreachable_bb

.Lreachable_epilogue_bb:
ldp x29, x30, [sp], #16
autiasp
ret
.size unreachable_loop_of_bbs, .-unreachable_loop_of_bbs

.globl main
.type main,@function
main:
Expand Down
Loading