/*--------------------------------------------------------------------*/

/*--- Instrument IR to propagate taint. tnt_translate.c ---*/

/*--------------------------------------------------------------------*/

/*

This file is part of Taintgrind, the taint analysis Valgrind tool.

This program is free software; you can redistribute it and/or

modify it under the terms of the GNU General Public License as

published by the Free Software Foundation; either version 2 of the

License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but

WITHOUT ANY WARRANTY; without even the implied warranty of

MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU

General Public License for more details.

You should have received a copy of the GNU General Public License

along with this program; if not, write to the Free Software

Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA

02111-1307, USA.

The GNU General Public License is contained in the file COPYING.

*/

#include "pub_tool_basics.h"

#include "pub_tool_hashtable.h" // For tnt_include.h, VgHashtable

#include "pub_tool_libcassert.h" // tl_assert

#include "pub_tool_libcbase.h" // VG_STREQN, VG_(memset), VG_(random)

#include "pub_tool_libcprint.h" // VG_(message), VG_(printf)

#include "pub_tool_machine.h" // VG_(fnptr_to_fnentry)

#include "pub_tool_mallocfree.h" // VG_(malloc), VG_(free)

//#include "pub_tool_options.h" // VG_STR/BHEX/BINT_CLO

#include "pub_tool_replacemalloc.h" // 0

#include "pub_tool_stacktrace.h" // VG_get_StackTrace

#include "pub_tool_tooliface.h"

#include "pub_tool_xarray.h" // VG_(sizeXA), VG_(newXA), VG_(addtoXA)

#include "tnt_include.h"

//#include "tnt_strings.h"

#include "copy.h"

/*------------------------------------------------------------*/

/*--- Forward decls ---*/

/*------------------------------------------------------------*/

struct _MCEnv;

// See below for comments explaining what this is for.

typedef

enum __attribute__((packed)) { HuUnU=0, HuPCa=1, HuOth=2 }

HowUsed;

static IRType shadowTypeV ( IRType ty );

// Taintgrind: Primarily used by do_shadow_WRTMP

static IRExpr* expr2vbits ( struct _MCEnv* mce, IRExpr* e,

HowUsed hu/*use HuOth if unknown*/ );

// Taintgrind: Same as expr2vbits, except only for Iex_RdTmp's and Iex_Const's,

// Used by all functions except do_shadow_WRTMP

static IRExpr* atom2vbits ( struct _MCEnv* mce, IRExpr* e );

//static IRTemp findShadowTmpB ( struct _MCEnv* mce, IRTemp orig );

static IRExpr *i128_const_zero(void);

/*------------------------------------------------------------*/

/*--- Memcheck running state, and tmp management. ---*/

/*------------------------------------------------------------*/

/* For a few (maybe 1%) IROps, we have both a cheaper, less exact vbit

propagation scheme, and a more expensive, more precise vbit propagation

scheme. This enum describes, for such an IROp, which scheme to use. */

typedef

enum {

// Use the cheaper, less-exact variant.

DLcheap=4,

// Choose between cheap and expensive based on analysis of the block

// to be instrumented. Note that the choice may be done on a

// per-instance basis of the IROp that this DetailLevel describes.

DLauto,

// Use the more expensive, more-exact variant.

DLexpensive

}

DetailLevel;

/* A readonly part of the running state. For IROps that have both a

less-exact and more-exact interpretation, records which interpretation is

to be used. */

typedef

struct {

// For Add32/64 and Sub32/64, all 3 settings are allowed. For the

// DLauto case, a per-instance decision is to be made by inspecting

// the associated tmp's entry in MCEnv.tmpHowUsed.

DetailLevel dl_Add32;

DetailLevel dl_Add64;

DetailLevel dl_Sub32;

DetailLevel dl_Sub64;

// For Cmp{EQ,NE}{64,32,16,8}, only DLcheap and DLexpensive are

// allowed.

DetailLevel dl_CmpEQ64_CmpNE64;

DetailLevel dl_CmpEQ32_CmpNE32;

DetailLevel dl_CmpEQ16_CmpNE16;

DetailLevel dl_CmpEQ8_CmpNE8;

}

DetailLevelByOp;

static void DetailLevelByOp__set_all ( /*OUT*/DetailLevelByOp* dlbo,

DetailLevel dl )

{

dlbo->dl_Add32 = dl;

dlbo->dl_Add64 = dl;

dlbo->dl_Sub32 = dl;

dlbo->dl_Sub64 = dl;

dlbo->dl_CmpEQ64_CmpNE64 = dl;

dlbo->dl_CmpEQ32_CmpNE32 = dl;

dlbo->dl_CmpEQ16_CmpNE16 = dl;

dlbo->dl_CmpEQ8_CmpNE8 = dl;

}

static void DetailLevelByOp__check_sanity ( const DetailLevelByOp* dlbo )

{

tl_assert(dlbo->dl_Add32 >= DLcheap && dlbo->dl_Add32 <= DLexpensive);

tl_assert(dlbo->dl_Add64 >= DLcheap && dlbo->dl_Add64 <= DLexpensive);

tl_assert(dlbo->dl_Sub32 >= DLcheap && dlbo->dl_Sub32 <= DLexpensive);

tl_assert(dlbo->dl_Sub64 >= DLcheap && dlbo->dl_Sub64 <= DLexpensive);

tl_assert(dlbo->dl_CmpEQ64_CmpNE64 == DLcheap

|| dlbo->dl_CmpEQ64_CmpNE64 == DLexpensive);

tl_assert(dlbo->dl_CmpEQ32_CmpNE32 == DLcheap

|| dlbo->dl_CmpEQ32_CmpNE32 == DLexpensive);

tl_assert(dlbo->dl_CmpEQ16_CmpNE16 == DLcheap

|| dlbo->dl_CmpEQ16_CmpNE16 == DLexpensive);

tl_assert(dlbo->dl_CmpEQ8_CmpNE8 == DLcheap

|| dlbo->dl_CmpEQ8_CmpNE8 == DLexpensive);

}

static UInt DetailLevelByOp__count ( const DetailLevelByOp* dlbo,

DetailLevel dl )

{

UInt n = 0;

n += (dlbo->dl_Add32 == dl ? 1 : 0);

n += (dlbo->dl_Add64 == dl ? 1 : 0);

n += (dlbo->dl_Sub32 == dl ? 1 : 0);

n += (dlbo->dl_Sub64 == dl ? 1 : 0);

n += (dlbo->dl_CmpEQ64_CmpNE64 == dl ? 1 : 0);

n += (dlbo->dl_CmpEQ32_CmpNE32 == dl ? 1 : 0);

n += (dlbo->dl_CmpEQ16_CmpNE16 == dl ? 1 : 0);

n += (dlbo->dl_CmpEQ8_CmpNE8 == dl ? 1 : 0);

return n;

}

/* Carries info about a particular tmp. The tmp's number is not

recorded, as this is implied by (equal to) its index in the tmpMap

in MCEnv. The tmp's type is also not recorded, as this is present

in MCEnv.sb->tyenv.

When .kind is Orig, .shadowV and .shadowB may give the identities

of the temps currently holding the associated definedness (shadowV)

and origin (shadowB) values, or these may be IRTemp_INVALID if code

to compute such values has not yet been emitted.

When .kind is VSh or BSh then the tmp is holds a V- or B- value,

and so .shadowV and .shadowB must be IRTemp_INVALID, since it is

illogical for a shadow tmp itself to be shadowed.

*/

typedef

enum { Orig=1, VSh=2 } //, BSh=3 } Not doing origin tracking

TempKind;

typedef

struct {

TempKind kind;

IRTemp shadowV;

// IRTemp shadowB; Not doing origin tracking

}

TempMapEnt;

/* Carries around state during instrumentation. */

typedef

struct _MCEnv {

/* MODIFIED: the superblock being constructed. IRStmts are

added. */

IRSB* sb;

Bool trace;

/* MODIFIED: a table [0 .. #temps_in_sb-1] which gives the

current kind and possibly shadow temps for each temp in the

IRSB being constructed. Note that it does not contain the

type of each tmp. If you want to know the type, look at the

relevant entry in sb->tyenv. It follows that at all times

during the instrumentation process, the valid indices for

tmpMap and sb->tyenv are identical, being 0 .. N-1 where N is

total number of Orig, V- and B- temps allocated so far.

The reason for this strange split (types in one place, all

other info in another) is that we need the types to be

attached to sb so as to make it possible to do

"typeOfIRExpr(mce->bb->tyenv, ...)" at various places in the

instrumentation process. */

XArray* /* of TempMapEnt */ tmpMap;

/* READONLY: contains details of which ops should be expensively

instrumented. */

DetailLevelByOp dlbo;

/* READONLY: for each original tmp, how the tmp is used. This is

computed by |preInstrumentationAnalysis|. Valid indices are

0 .. #temps_in_sb-1 (same as for tmpMap). */

HowUsed* tmpHowUsed;

/* READONLY: the guest layout. This indicates which parts of

the guest state should be regarded as 'always defined'. */

const VexGuestLayout* layout;

/* READONLY: the host word type. Needed for constructing

arguments of type 'HWord' to be passed to helper functions.

Ity_I32 or Ity_I64 only. */

IRType hWordTy;

}

MCEnv;

/* SHADOW TMP MANAGEMENT. */

/* Create a new IRTemp of type 'ty' and kind 'kind', and add it to

both the table in mce->sb and to our auxiliary mapping. Note that

newTemp may cause mce->tmpMap to resize, hence previous results

from VG_(indexXA)(mce->tmpMap) are invalidated. */

static IRTemp newTemp ( MCEnv* mce, IRType ty, TempKind kind )

{

Word newIx;

TempMapEnt ent;

IRTemp tmp = newIRTemp(mce->sb->tyenv, ty);

ent.kind = kind;

ent.shadowV = IRTemp_INVALID;

// ent.shadowB = IRTemp_INVALID;

newIx = VG_(addToXA)( mce->tmpMap, &ent );

tl_assert(newIx == (Word)tmp);

return tmp;

}

/* Find the tmp currently shadowing the given original tmp. If none

so far exists, allocate one. */

static IRTemp findShadowTmpV ( MCEnv* mce, IRTemp orig )

{

TempMapEnt* ent;

/* VG_(indexXA) range-checks 'orig', hence no need to check

here. */

ent = (TempMapEnt*)VG_(indexXA)( mce->tmpMap, (Word)orig );

tl_assert(ent->kind == Orig);

if (ent->shadowV == IRTemp_INVALID) {

IRTemp tmpV

= newTemp( mce, shadowTypeV(mce->sb->tyenv->types[orig]), VSh );

/* newTemp may cause mce->tmpMap to resize, hence previous results

from VG_(indexXA) are invalid. */

ent = (TempMapEnt*)VG_(indexXA)( mce->tmpMap, (Word)orig );

tl_assert(ent->kind == Orig);

tl_assert(ent->shadowV == IRTemp_INVALID);

ent->shadowV = tmpV;

}

return ent->shadowV;

}

/* Allocate a new shadow for the given original tmp. This means any

previous shadow is abandoned. This is needed because it is

necessary to give a new value to a shadow once it has been tested

for undefinedness, but unfortunately IR's SSA property disallows

this. Instead we must abandon the old shadow, allocate a new one

and use that instead.

This is the same as findShadowTmpV, except we don't bother to see

if a shadow temp already existed -- we simply allocate a new one

regardless. */

static void newShadowTmpV ( MCEnv* mce, IRTemp orig )

{

TempMapEnt* ent;

/* VG_(indexXA) range-checks 'orig', hence no need to check

here. */

ent = (TempMapEnt*)VG_(indexXA)( mce->tmpMap, (Word)orig );

tl_assert(ent->kind == Orig);

if (1) {

IRTemp tmpV

= newTemp( mce, shadowTypeV(mce->sb->tyenv->types[orig]), VSh );

/* newTemp may cause mce->tmpMap to resize, hence previous results

from VG_(indexXA) are invalid. */

ent = (TempMapEnt*)VG_(indexXA)( mce->tmpMap, (Word)orig );

tl_assert(ent->kind == Orig);

ent->shadowV = tmpV;

}

}

/*------------------------------------------------------------*/

/*--- IRAtoms -- a subset of IRExprs ---*/

/*------------------------------------------------------------*/

/* An atom is either an IRExpr_Const or an IRExpr_Tmp, as defined by

isIRAtom() in libvex_ir.h. Because this instrumenter expects flat

input, most of this code deals in atoms. Usefully, a value atom

always has a V-value which is also an atom: constants are shadowed

by constants, and temps are shadowed by the corresponding shadow

temporary. */

typedef IRExpr IRAtom;

/* (used for sanity checks only): is this an atom which looks

like it's from original code? */

static Bool isOriginalAtom ( MCEnv* mce, IRAtom* a1 )

{

if (a1->tag == Iex_Const)

return True;

if (a1->tag == Iex_RdTmp) {

TempMapEnt* ent = VG_(indexXA)( mce->tmpMap, a1->Iex.RdTmp.tmp );

return ent->kind == Orig;

}

return False;

}

/* (used for sanity checks only): is this an atom which looks

like it's from shadow code? */

static Bool isShadowAtom ( MCEnv* mce, IRAtom* a1 )

{

if (a1->tag == Iex_Const)

return True;

if (a1->tag == Iex_RdTmp) {

TempMapEnt* ent = VG_(indexXA)( mce->tmpMap, a1->Iex.RdTmp.tmp );

return ent->kind == VSh; // || ent->kind == BSh;

}

return False;

}

/* (used for sanity checks only): check that both args are atoms and

are identically-kinded. */

static Bool sameKindedAtoms ( IRAtom* a1, IRAtom* a2 )

{

if (a1->tag == Iex_RdTmp && a2->tag == Iex_RdTmp)

return True;

if (a1->tag == Iex_Const && a2->tag == Iex_Const)

return True;

return False;

}

/*------------------------------------------------------------*/

/*--- Type management ---*/

/*------------------------------------------------------------*/

/* Shadow state is always accessed using integer types. This returns

an integer type with the same size (as per sizeofIRType) as the

given type. The only valid shadow types are Bit, I8, I16, I32,

I64, V128. */

static IRType shadowTypeV ( IRType ty )

{

switch (ty) {

case Ity_I1:

case Ity_I8:

case Ity_I16:

case Ity_I32:

case Ity_I64:

case Ity_I128: return ty;

case Ity_F16: return Ity_I16;

case Ity_F32: return Ity_I32;

case Ity_D32: return Ity_I32;

case Ity_F64: return Ity_I64;

case Ity_D64: return Ity_I64;

case Ity_F128: return Ity_I128;

case Ity_D128: return Ity_I128;

case Ity_V128: return Ity_V128;

case Ity_V256: return Ity_V256;

default: ppIRType(ty);

VG_(tool_panic)("tnt_translate.c: shadowTypeV");

}

}

/* Produce a 'defined' value of the given shadow type. Should only be

supplied shadow types (Bit/I8/I16/I32/UI64). */

static IRExpr* definedOfType ( IRType ty ) {

switch (ty) {

case Ity_I1: return IRExpr_Const(IRConst_U1(False));

case Ity_I8: return IRExpr_Const(IRConst_U8(0));

case Ity_I16: return IRExpr_Const(IRConst_U16(0));

case Ity_I32: return IRExpr_Const(IRConst_U32(0));

case Ity_I64: return IRExpr_Const(IRConst_U64(0));

case Ity_I128: return i128_const_zero();

case Ity_V128: return IRExpr_Const(IRConst_V128(0x0000));

case Ity_V256: return IRExpr_Const(IRConst_V256(0x00000000));

default: VG_(tool_panic)("tnt_translate.c: definedOfType");

}

}

/*------------------------------------------------------------*/

/*--- Constructing IR fragments ---*/

/*------------------------------------------------------------*/

/* add stmt to a bb */

static inline void stmt ( HChar cat, MCEnv* mce, IRStmt* st ) {

if (mce->trace) {

VG_(printf)(" %c: ", cat);

ppIRStmt(st);

VG_(printf)("\n");

}

addStmtToIRSB(mce->sb, st);

}

/* assign value to tmp */

static inline

void assign ( HChar cat, MCEnv* mce, IRTemp tmp, IRExpr* expr ) {

stmt(cat, mce, IRStmt_WrTmp(tmp,expr));

}

/* build various kinds of expressions */

#define triop(_op, _arg1, _arg2, _arg3) \

IRExpr_Triop((_op),(_arg1),(_arg2),(_arg3))

#define binop(_op, _arg1, _arg2) IRExpr_Binop((_op),(_arg1),(_arg2))

#define unop(_op, _arg) IRExpr_Unop((_op),(_arg))

#define mkU1(_n) IRExpr_Const(IRConst_U1(_n))

#define mkU8(_n) IRExpr_Const(IRConst_U8(_n))

#define mkU16(_n) IRExpr_Const(IRConst_U16(_n))

#define mkU32(_n) IRExpr_Const(IRConst_U32(_n))

#define mkU64(_n) IRExpr_Const(IRConst_U64(_n))

#define mkV128(_n) IRExpr_Const(IRConst_V128(_n))

#define mkexpr(_tmp) IRExpr_RdTmp((_tmp))

/* Bind the given expression to a new temporary, and return the

temporary. This effectively converts an arbitrary expression into

an atom.

'ty' is the type of 'e' and hence the type that the new temporary

needs to be. But passing it in is redundant, since we can deduce

the type merely by inspecting 'e'. So at least use that fact to

assert that the two types agree. */

static IRAtom* assignNew ( HChar cat, MCEnv* mce, IRType ty, IRExpr* e )

{

TempKind k;

IRTemp t;

IRType tyE = typeOfIRExpr(mce->sb->tyenv, e);

tl_assert(tyE == ty); /* so 'ty' is redundant (!) */

switch (cat) {

case 'V': k = VSh; break;

// case 'B': k = BSh; break;

case 'C': k = Orig; break;

/* happens when we are making up new "orig"

expressions, for IRCAS handling */

default: tl_assert(0);

}

t = newTemp(mce, ty, k);

assign(cat, mce, t, e);

return mkexpr(t);

}

/*------------------------------------------------------------*/

/*--- Helper functions for 128-bit ops ---*/

/*------------------------------------------------------------*/

static IRExpr *i128_const_zero(void)

{

IRAtom* z64 = IRExpr_Const(IRConst_U64(0));

return binop(Iop_64HLto128, z64, z64);

}

/* There are no I128-bit loads and/or stores [as generated by any

current front ends]. So we do not need to worry about that in

expr2vbits_Load */

/*------------------------------------------------------------*/

/*--- Constructing definedness primitive ops ---*/

/*------------------------------------------------------------*/

/* --------- Defined-if-either-defined --------- */

static IRAtom* mkDifD1 ( MCEnv* mce, IRAtom* a1, IRAtom* a2 ) {

tl_assert(isShadowAtom(mce,a1));

tl_assert(isShadowAtom(mce,a2));

return assignNew('V', mce, Ity_I1, binop(Iop_And1, a1, a2));

}

static IRAtom* mkDifD8 ( MCEnv* mce, IRAtom* a1, IRAtom* a2 ) {

tl_assert(isShadowAtom(mce,a1));

tl_assert(isShadowAtom(mce,a2));

return assignNew('V', mce, Ity_I8, binop(Iop_And8, a1, a2));

}

static IRAtom* mkDifD16 ( MCEnv* mce, IRAtom* a1, IRAtom* a2 ) {

tl_assert(isShadowAtom(mce,a1));

tl_assert(isShadowAtom(mce,a2));

return assignNew('V', mce, Ity_I16, binop(Iop_And16, a1, a2));

}

static IRAtom* mkDifD32 ( MCEnv* mce, IRAtom* a1, IRAtom* a2 ) {

tl_assert(isShadowAtom(mce,a1));

tl_assert(isShadowAtom(mce,a2));

return assignNew('V', mce, Ity_I32, binop(Iop_And32, a1, a2));

}

static IRAtom* mkDifD64 ( MCEnv* mce, IRAtom* a1, IRAtom* a2 ) {

tl_assert(isShadowAtom(mce,a1));

tl_assert(isShadowAtom(mce,a2));

return assignNew('V', mce, Ity_I64, binop(Iop_And64, a1, a2));

}

static IRAtom* mkDifDV128 ( MCEnv* mce, IRAtom* a1, IRAtom* a2 ) {

tl_assert(isShadowAtom(mce,a1));

tl_assert(isShadowAtom(mce,a2));

return assignNew('V', mce, Ity_V128, binop(Iop_AndV128, a1, a2));

}

static IRAtom* mkDifDV256 ( MCEnv* mce, IRAtom* a1, IRAtom* a2 ) {

tl_assert(isShadowAtom(mce,a1));

tl_assert(isShadowAtom(mce,a2));

return assignNew('V', mce, Ity_V256, binop(Iop_AndV256, a1, a2));

}

/* --------- Undefined-if-either-undefined --------- */

static IRAtom* mkUifU1 ( MCEnv* mce, IRAtom* a1, IRAtom* a2 ) {

tl_assert(isShadowAtom(mce,a1));

tl_assert(isShadowAtom(mce,a2));

return assignNew('V', mce, Ity_I1, binop(Iop_Or1, a1, a2));

}

static IRAtom* mkUifU8 ( MCEnv* mce, IRAtom* a1, IRAtom* a2 ) {

tl_assert(isShadowAtom(mce,a1));

tl_assert(isShadowAtom(mce,a2));

return assignNew('V', mce, Ity_I8, binop(Iop_Or8, a1, a2));

}

static IRAtom* mkUifU16 ( MCEnv* mce, IRAtom* a1, IRAtom* a2 ) {

tl_assert(isShadowAtom(mce,a1));

tl_assert(isShadowAtom(mce,a2));

return assignNew('V', mce, Ity_I16, binop(Iop_Or16, a1, a2));

}

static IRAtom* mkUifU32 ( MCEnv* mce, IRAtom* a1, IRAtom* a2 ) {

tl_assert(isShadowAtom(mce,a1));

tl_assert(isShadowAtom(mce,a2));

return assignNew('V', mce, Ity_I32, binop(Iop_Or32, a1, a2));

}

static IRAtom* mkUifU64 ( MCEnv* mce, IRAtom* a1, IRAtom* a2 ) {

tl_assert(isShadowAtom(mce,a1));

tl_assert(isShadowAtom(mce,a2));

return assignNew('V', mce, Ity_I64, binop(Iop_Or64, a1, a2));

}

static IRAtom* mkUifU128 ( MCEnv* mce, IRAtom* a1, IRAtom* a2 ) {

IRAtom *tmp1, *tmp2, *tmp3, *tmp4, *tmp5, *tmp6;

tl_assert(isShadowAtom(mce,a1));

tl_assert(isShadowAtom(mce,a2));

tmp1 = assignNew('V', mce, Ity_I64, unop(Iop_128to64, a1));

tmp2 = assignNew('V', mce, Ity_I64, unop(Iop_128HIto64, a1));

tmp3 = assignNew('V', mce, Ity_I64, unop(Iop_128to64, a2));

tmp4 = assignNew('V', mce, Ity_I64, unop(Iop_128HIto64, a2));

tmp5 = assignNew('V', mce, Ity_I64, binop(Iop_Or64, tmp1, tmp3));

tmp6 = assignNew('V', mce, Ity_I64, binop(Iop_Or64, tmp2, tmp4));

return assignNew('V', mce, Ity_I128, binop(Iop_64HLto128, tmp6, tmp5));

}

static IRAtom* mkUifUV128 ( MCEnv* mce, IRAtom* a1, IRAtom* a2 ) {

tl_assert(isShadowAtom(mce,a1));

tl_assert(isShadowAtom(mce,a2));

return assignNew('V', mce, Ity_V128, binop(Iop_OrV128, a1, a2));

}

static IRAtom* mkUifUV256 ( MCEnv* mce, IRAtom* a1, IRAtom* a2 ) {

tl_assert(isShadowAtom(mce,a1));

tl_assert(isShadowAtom(mce,a2));

return assignNew('V', mce, Ity_V256, binop(Iop_OrV256, a1, a2));

}

static IRAtom* mkUifU ( MCEnv* mce, IRType vty, IRAtom* a1, IRAtom* a2 ) {

switch (vty) {

case Ity_I8: return mkUifU8(mce, a1, a2);

case Ity_I16: return mkUifU16(mce, a1, a2);

case Ity_I32: return mkUifU32(mce, a1, a2);

case Ity_I64: return mkUifU64(mce, a1, a2);

case Ity_I128: return mkUifU128(mce, a1, a2);

case Ity_V128: return mkUifUV128(mce, a1, a2);

case Ity_V256: return mkUifUV256(mce, a1, a2);

default:

VG_(printf)("\n"); ppIRType(vty); VG_(printf)("\n");

VG_(tool_panic)("tnt_translate.c:mkUifU");

}

}

/* --------- The Left-family of operations. --------- */

static IRAtom* mkLeft8 ( MCEnv* mce, IRAtom* a1 ) {

tl_assert(isShadowAtom(mce,a1));

return assignNew('V', mce, Ity_I8, unop(Iop_Left8, a1));

}

static IRAtom* mkLeft16 ( MCEnv* mce, IRAtom* a1 ) {

tl_assert(isShadowAtom(mce,a1));

return assignNew('V', mce, Ity_I16, unop(Iop_Left16, a1));

}

static IRAtom* mkLeft32 ( MCEnv* mce, IRAtom* a1 ) {

tl_assert(isShadowAtom(mce,a1));

return assignNew('V', mce, Ity_I32, unop(Iop_Left32, a1));

}

static IRAtom* mkLeft64 ( MCEnv* mce, IRAtom* a1 ) {

tl_assert(isShadowAtom(mce,a1));

return assignNew('V', mce, Ity_I64, unop(Iop_Left64, a1));

}

/* --------- The Right-family of operations. --------- */

/* Unfortunately these are a lot more expensive then their Left

counterparts. Fortunately they are only very rarely used -- only for

count-leading-zeroes instrumentation. */

static IRAtom* mkRight32 ( MCEnv* mce, IRAtom* a1 )

{

for (Int i = 1; i <= 16; i *= 2) {

// a1 |= (a1 >>u i)

IRAtom* tmp

= assignNew('V', mce, Ity_I32, binop(Iop_Shr32, a1, mkU8(i)));

a1 = assignNew('V', mce, Ity_I32, binop(Iop_Or32, a1, tmp));

}

return a1;

}

static IRAtom* mkRight64 ( MCEnv* mce, IRAtom* a1 )

{

for (Int i = 1; i <= 32; i *= 2) {

// a1 |= (a1 >>u i)

IRAtom* tmp

= assignNew('V', mce, Ity_I64, binop(Iop_Shr64, a1, mkU8(i)));

a1 = assignNew('V', mce, Ity_I64, binop(Iop_Or64, a1, tmp));

}

return a1;

}

/* --------- 'Improvement' functions for AND/OR. --------- */

/* ImproveAND(data, vbits) = data OR vbits. Defined (0) data 0s give

defined (0); all other -> undefined (1).

*/

static IRAtom* mkImproveAND1 ( MCEnv* mce, IRAtom* data, IRAtom* vbits )

{

tl_assert(isOriginalAtom(mce, data));

tl_assert(isShadowAtom(mce, vbits));

tl_assert(sameKindedAtoms(data, vbits));

return assignNew('V', mce, Ity_I1, binop(Iop_Or1, data, vbits));

}

static IRAtom* mkImproveAND8 ( MCEnv* mce, IRAtom* data, IRAtom* vbits )

{

tl_assert(isOriginalAtom(mce, data));

tl_assert(isShadowAtom(mce, vbits));

tl_assert(sameKindedAtoms(data, vbits));

return assignNew('V', mce, Ity_I8, binop(Iop_Or8, data, vbits));

}

static IRAtom* mkImproveAND16 ( MCEnv* mce, IRAtom* data, IRAtom* vbits )

{

tl_assert(isOriginalAtom(mce, data));

tl_assert(isShadowAtom(mce, vbits));

tl_assert(sameKindedAtoms(data, vbits));

return assignNew('V', mce, Ity_I16, binop(Iop_Or16, data, vbits));

}

static IRAtom* mkImproveAND32 ( MCEnv* mce, IRAtom* data, IRAtom* vbits )

{

tl_assert(isOriginalAtom(mce, data));

tl_assert(isShadowAtom(mce, vbits));

tl_assert(sameKindedAtoms(data, vbits));

return assignNew('V', mce, Ity_I32, binop(Iop_Or32, data, vbits));

}

static IRAtom* mkImproveAND64 ( MCEnv* mce, IRAtom* data, IRAtom* vbits )

{

tl_assert(isOriginalAtom(mce, data));

tl_assert(isShadowAtom(mce, vbits));

tl_assert(sameKindedAtoms(data, vbits));

return assignNew('V', mce, Ity_I64, binop(Iop_Or64, data, vbits));

}

static IRAtom* mkImproveANDV128 ( MCEnv* mce, IRAtom* data, IRAtom* vbits )

{

tl_assert(isOriginalAtom(mce, data));

tl_assert(isShadowAtom(mce, vbits));

tl_assert(sameKindedAtoms(data, vbits));

return assignNew('V', mce, Ity_V128, binop(Iop_OrV128, data, vbits));

}

static IRAtom* mkImproveANDV256 ( MCEnv* mce, IRAtom* data, IRAtom* vbits )

{

tl_assert(isOriginalAtom(mce, data));

tl_assert(isShadowAtom(mce, vbits));

tl_assert(sameKindedAtoms(data, vbits));

return assignNew('V', mce, Ity_V256, binop(Iop_OrV256, data, vbits));

}

/* ImproveOR(data, vbits) = ~data OR vbits. Defined (0) data 1s give

defined (0); all other -> undefined (1).

*/

static IRAtom* mkImproveOR1 ( MCEnv* mce, IRAtom* data, IRAtom* vbits )

{

tl_assert(isOriginalAtom(mce, data));

tl_assert(isShadowAtom(mce, vbits));

tl_assert(sameKindedAtoms(data, vbits));

return assignNew(

'V', mce, Ity_I1,

binop(Iop_Or1,

assignNew('V', mce, Ity_I1, unop(Iop_Not1, data)),

vbits) );

}

static IRAtom* mkImproveOR8 ( MCEnv* mce, IRAtom* data, IRAtom* vbits )

{

tl_assert(isOriginalAtom(mce, data));

tl_assert(isShadowAtom(mce, vbits));

tl_assert(sameKindedAtoms(data, vbits));

return assignNew(

'V', mce, Ity_I8,

binop(Iop_Or8,

assignNew('V', mce, Ity_I8, unop(Iop_Not8, data)),

vbits) );

}

static IRAtom* mkImproveOR16 ( MCEnv* mce, IRAtom* data, IRAtom* vbits )

{

tl_assert(isOriginalAtom(mce, data));

tl_assert(isShadowAtom(mce, vbits));

tl_assert(sameKindedAtoms(data, vbits));

return assignNew(

'V', mce, Ity_I16,

binop(Iop_Or16,

assignNew('V', mce, Ity_I16, unop(Iop_Not16, data)),

vbits) );

}

static IRAtom* mkImproveOR32 ( MCEnv* mce, IRAtom* data, IRAtom* vbits )

{

tl_assert(isOriginalAtom(mce, data));

tl_assert(isShadowAtom(mce, vbits));

tl_assert(sameKindedAtoms(data, vbits));

return assignNew(

'V', mce, Ity_I32,

binop(Iop_Or32,

assignNew('V', mce, Ity_I32, unop(Iop_Not32, data)),

vbits) );

}

static IRAtom* mkImproveOR64 ( MCEnv* mce, IRAtom* data, IRAtom* vbits )

{

tl_assert(isOriginalAtom(mce, data));

tl_assert(isShadowAtom(mce, vbits));

tl_assert(sameKindedAtoms(data, vbits));

return assignNew(

'V', mce, Ity_I64,

binop(Iop_Or64,

assignNew('V', mce, Ity_I64, unop(Iop_Not64, data)),

vbits) );

}

static IRAtom* mkImproveORV128 ( MCEnv* mce, IRAtom* data, IRAtom* vbits )

{

tl_assert(isOriginalAtom(mce, data));

tl_assert(isShadowAtom(mce, vbits));

tl_assert(sameKindedAtoms(data, vbits));

return assignNew(

'V', mce, Ity_V128,

binop(Iop_OrV128,

assignNew('V', mce, Ity_V128, unop(Iop_NotV128, data)),

vbits) );

}

static IRAtom* mkImproveORV256 ( MCEnv* mce, IRAtom* data, IRAtom* vbits )

{

tl_assert(isOriginalAtom(mce, data));

tl_assert(isShadowAtom(mce, vbits));

tl_assert(sameKindedAtoms(data, vbits));

return assignNew(

'V', mce, Ity_V256,

binop(Iop_OrV256,

assignNew('V', mce, Ity_V256, unop(Iop_NotV256, data)),

vbits) );

}

/* --------- Pessimising casts. --------- */

static IRAtom* mkPCastTo( MCEnv* mce, IRType dst_ty, IRAtom* vbits )

{

IRType src_ty;

IRAtom* tmp1;

/* Note, dst_ty is a shadow type, not an original type. */

tl_assert(isShadowAtom(mce,vbits));

src_ty = typeOfIRExpr(mce->sb->tyenv, vbits);

/* Fast-track some common cases */

if (src_ty == Ity_I32 && dst_ty == Ity_I32)

return assignNew('V', mce, Ity_I32, unop(Iop_CmpwNEZ32, vbits));

if (src_ty == Ity_I64 && dst_ty == Ity_I64)

return assignNew('V', mce, Ity_I64, unop(Iop_CmpwNEZ64, vbits));

if (src_ty == Ity_I32 && dst_ty == Ity_I64) {

IRAtom* tmp = assignNew('V', mce, Ity_I32, unop(Iop_CmpwNEZ32, vbits));

return assignNew('V', mce, Ity_I64, binop(Iop_32HLto64, tmp, tmp));

}

if (src_ty == Ity_I32 && dst_ty == Ity_V128) {

/* PCast the arg, then clone it 4 times. */

IRAtom* tmp = assignNew('V', mce, Ity_I32, unop(Iop_CmpwNEZ32, vbits));

tmp = assignNew('V', mce, Ity_I64, binop(Iop_32HLto64, tmp, tmp));

return assignNew('V', mce, Ity_V128, binop(Iop_64HLtoV128, tmp, tmp));

}

if (src_ty == Ity_I32 && dst_ty == Ity_V256) {

/* PCast the arg, then clone it 8 times. */

IRAtom* tmp = assignNew('V', mce, Ity_I32, unop(Iop_CmpwNEZ32, vbits));

tmp = assignNew('V', mce, Ity_I64, binop(Iop_32HLto64, tmp, tmp));

tmp = assignNew('V', mce, Ity_V128, binop(Iop_64HLtoV128, tmp, tmp));

return assignNew('V', mce, Ity_V256, binop(Iop_V128HLtoV256, tmp, tmp));

}

if (src_ty == Ity_I64 && dst_ty == Ity_I32) {

/* PCast the arg. This gives all 0s or all 1s. Then throw away

the top half. */

IRAtom* tmp = assignNew('V', mce, Ity_I64, unop(Iop_CmpwNEZ64, vbits));

return assignNew('V', mce, Ity_I32, unop(Iop_64to32, tmp));

}

if (src_ty == Ity_V128 && dst_ty == Ity_I64) {

/* Use InterleaveHI64x2 to copy the top half of the vector into

the bottom half. Then we can UifU it with the original, throw

away the upper half of the result, and PCast-I64-to-I64

the lower half. */

// Generates vbits[127:64] : vbits[127:64]

IRAtom* hi64hi64

= assignNew('V', mce, Ity_V128,

binop(Iop_InterleaveHI64x2, vbits, vbits));

// Generates

// UifU(vbits[127:64],vbits[127:64]) : UifU(vbits[127:64],vbits[63:0])

// == vbits[127:64] : UifU(vbits[127:64],vbits[63:0])

IRAtom* lohi64

= mkUifUV128(mce, hi64hi64, vbits);

// Generates UifU(vbits[127:64],vbits[63:0])

IRAtom* lo64

= assignNew('V', mce, Ity_I64, unop(Iop_V128to64, lohi64));

// Generates

// PCast-to-I64( UifU(vbits[127:64], vbits[63:0] )

// == PCast-to-I64( vbits[127:0] )

IRAtom* res

= assignNew('V', mce, Ity_I64, unop(Iop_CmpwNEZ64, lo64));

return res;

}

/* Else do it the slow way .. */

/* First of all, collapse vbits down to a single bit. */

tmp1 = NULL;

switch (src_ty) {

case Ity_I1:

tmp1 = vbits;

break;

case Ity_I8:

tmp1 = assignNew('V', mce, Ity_I1, unop(Iop_CmpNEZ8, vbits));

break;

case Ity_I16:

tmp1 = assignNew('V', mce, Ity_I1, unop(Iop_CmpNEZ16, vbits));

break;

case Ity_I32:

tmp1 = assignNew('V', mce, Ity_I1, unop(Iop_CmpNEZ32, vbits));

break;

case Ity_I64:

tmp1 = assignNew('V', mce, Ity_I1, unop(Iop_CmpNEZ64, vbits));

break;

case Ity_I128: {

/* Gah. Chop it in half, OR the halves together, and compare

that with zero. */

IRAtom* tmp2 = assignNew('V', mce, Ity_I64, unop(Iop_128HIto64, vbits));

IRAtom* tmp3 = assignNew('V', mce, Ity_I64, unop(Iop_128to64, vbits));

IRAtom* tmp4 = assignNew('V', mce, Ity_I64, binop(Iop_Or64, tmp2, tmp3));

tmp1 = assignNew('V', mce, Ity_I1,

unop(Iop_CmpNEZ64, tmp4));

break;

}

case Ity_V128: {

/* Chop it in half, OR the halves together, and compare that

* with zero.

*/

IRAtom* tmp2 = assignNew('V', mce, Ity_I64, unop(Iop_V128HIto64, vbits));

IRAtom* tmp3 = assignNew('V', mce, Ity_I64, unop(Iop_V128to64, vbits));

IRAtom* tmp4 = assignNew('V', mce, Ity_I64, binop(Iop_Or64, tmp2, tmp3));

tmp1 = assignNew('V', mce, Ity_I1,

unop(Iop_CmpNEZ64, tmp4));

break;

}

case Ity_V256: {

/* Chop it in half, OR the halves together, and compare that

* with zero.

*/

IRAtom* tmp2 = assignNew('V', mce, Ity_I64, unop(Iop_V256to64_0, vbits));

IRAtom* tmp3 = assignNew('V', mce, Ity_I64, unop(Iop_V256to64_1, vbits));

IRAtom* tmp4 = assignNew('V', mce, Ity_I64, binop(Iop_Or64, tmp2, tmp3));

IRAtom* tmp5 = assignNew('V', mce, Ity_I64, unop(Iop_V256to64_2, vbits));

IRAtom* tmp6 = assignNew('V', mce, Ity_I64, unop(Iop_V256to64_3, vbits));

IRAtom* tmp7 = assignNew('V', mce, Ity_I64, binop(Iop_Or64, tmp5, tmp6));

IRAtom* tmp8 = assignNew('V', mce, Ity_I64, binop(Iop_Or64, tmp4, tmp7));

tmp1 = assignNew('V', mce, Ity_I1,

unop(Iop_CmpNEZ64, tmp8));

break;

}

default:

ppIRType(src_ty);

VG_(tool_panic)("tnt_translate.c: mkPCastTo(1)");

}

tl_assert(tmp1);

/* Now widen up to the dst type. */

switch (dst_ty) {

case Ity_I1:

return tmp1;

case Ity_I8:

return assignNew('V', mce, Ity_I8, unop(Iop_1Sto8, tmp1));

case Ity_I16:

return assignNew('V', mce, Ity_I16, unop(Iop_1Sto16, tmp1));

case Ity_I32:

return assignNew('V', mce, Ity_I32, unop(Iop_1Sto32, tmp1));

case Ity_I64:

return assignNew('V', mce, Ity_I64, unop(Iop_1Sto64, tmp1));

case Ity_V128:

tmp1 = assignNew('V', mce, Ity_I64, unop(Iop_1Sto64, tmp1));

tmp1 = assignNew('V', mce, Ity_V128, binop(Iop_64HLtoV128, tmp1, tmp1));

return tmp1;

case Ity_I128:

tmp1 = assignNew('V', mce, Ity_I64, unop(Iop_1Sto64, tmp1));

tmp1 = assignNew('V', mce, Ity_I128, binop(Iop_64HLto128, tmp1, tmp1));

return tmp1;

case Ity_V256:

tmp1 = assignNew('V', mce, Ity_I64, unop(Iop_1Sto64, tmp1));

tmp1 = assignNew('V', mce, Ity_V128, binop(Iop_64HLtoV128,

tmp1, tmp1));

tmp1 = assignNew('V', mce, Ity_V256, binop(Iop_V128HLtoV256,

tmp1, tmp1));

return tmp1;

default:

ppIRType(dst_ty);

VG_(tool_panic)("tnt_translate.c: mkPCastTo(2)");

}

}

/* This is a minor variant. It takes an arg of some type and returns

a value of the same type. The result consists entirely of Defined

(zero) bits except its least significant bit, which is a PCast of

the entire argument down to a single bit. */

static IRAtom* mkPCastXXtoXXlsb ( MCEnv* mce, IRAtom* varg, IRType ty )

{

if (ty == Ity_V128) {

/* --- Case for V128 --- */

IRAtom* varg128 = varg;

// generates: PCast-to-I64(varg128)

IRAtom* pcdTo64 = mkPCastTo(mce, Ity_I64, varg128);

// Now introduce zeros (defined bits) in the top 63 places

// generates: Def--(63)--Def PCast-to-I1(varg128)

IRAtom* d63pc

= assignNew('V', mce, Ity_I64, binop(Iop_And64, pcdTo64, mkU64(1)));

// generates: Def--(64)--Def

IRAtom* d64

= definedOfType(Ity_I64);

// generates: Def--(127)--Def PCast-to-I1(varg128)

IRAtom* res

= assignNew('V', mce, Ity_V128, binop(Iop_64HLtoV128, d64, d63pc));

return res;

}

if (ty == Ity_I64) {

/* --- Case for I64 --- */

// PCast to 64

IRAtom* pcd = mkPCastTo(mce, Ity_I64, varg);

// Zero (Def) out the top 63 bits

IRAtom* res

= assignNew('V', mce, Ity_I64, binop(Iop_And64, pcd, mkU64(1)));

return res;

}

/*NOTREACHED*/

tl_assert(0);

}

/* --------- Optimistic casts. --------- */

/* The function takes and returns an expression of type TY. If any of the

VBITS indicate defined (value == 0) the resulting expression has all bits

set to 0. Otherwise, all bits are 1. In words, if any bits are defined

then all bits are made to be defined.

In short we compute (vbits - (vbits >>u 1)) >>s (bitsize(vbits)-1).

*/

static IRAtom* mkOCastAt( MCEnv* mce, IRType ty, IRAtom* vbits )

{

IROp opSUB, opSHR, opSAR;

UInt sh;