[hwasan] Do not instrument accesses to uninteresting allocas.

[fmayer]

Summary

This leads to a statistically significant improvement when using -hwasan-instrument-stack=0: https://bit.ly/3AZUIKI.
When enabling stack instrumentation, the data appears gets better but not statistically significantly so. This is consistent
with the very moderate improvements I have seen for stack safety otherwise, so I expect it to improve when the underlying
issue of that is resolved.

[fmayer]

better test.

[fmayer]

ignore all alloca access if stack not instrumented

[fmayer]

better variable naming.

[fmayer]

add test

[fmayer]

allow to control strictness of alloc matching

[fmayer]

format

[fmayer]

remove comment

[fmayer]

simplify code

[eugenis]

I don't like the new flag. If we want this as a mitigation, IMHO it's a bad idea to allow overflows from stack. Even constant sized ones. Well, maybe reasonably small constant overflows are ok.

Consider adopting AddressSanitizer::isSafeAccess instead.

[eugenis]

In face, isSafeAccess seems pretty limited. Surely ScalarEvolution (similar to how it is used in StackSafetyAnalysis) can capture more cases, including a non-constant offset that can be proven to be within range?

[fmayer]

rework to address comment

[fmayer]

In D108457#2963679, @eugenis wrote:

In face, isSafeAccess seems pretty limited. Surely ScalarEvolution (similar to how it is used in StackSafetyAnalysis) can capture more cases, including a non-constant offset that can be proven to be within range?

Done. PTAL.

What I do right now is not emit any checks when we can we disable stack instrumentation and we can trace back an operation to an alloca. While we could potentially overflow towards other regions, I think it is not unexpected that we do not catch this if stack instrumentation is disabled. What do you think?

[eugenis]

This is pretty cool, I thought it would be more complicated.

This change needs comprehensive tests in llvm/test/Analysis/StackSafetyAnalysis. Update the print() method to show safe/unsafe instructions (or maybe only list known safe instruction).

What if an instruction may access either stack or heap?

i32 *p = flag ? p_heap_i16 : &stack_i32;
*p = 42;

The analysis will say "safe" because it is only scanning from the stack roots.
This should probably be fixed in hwasan by tracking the underlying alloca.

[fmayer]

handle stores that might or might not use an alloca

[fmayer]

In D108457#2983236, @eugenis wrote:

What if an instruction may access either stack or heap?

i32 *p = flag ? p_heap_i16 : &stack_i32;
*p = 42;

The analysis will say "safe" because it is only scanning from the stack roots.
This should probably be fixed in hwasan by tracking the underlying alloca.

Ah yes, I did handle this but then accidentally lost that when I refactored around some stuff. Put that back and added an IR test.

[fmayer]

don't use argument in select test

[fmayer]

In D108457#2984855, @fmayer wrote:

In D108457#2983236, @eugenis wrote:

What if an instruction may access either stack or heap?

i32 *p = flag ? p_heap_i16 : &stack_i32;
*p = 42;

The analysis will say "safe" because it is only scanning from the stack roots.
This should probably be fixed in hwasan by tracking the underlying alloca.

Ah yes, I did handle this but then accidentally lost that when I refactored around some stuff. Put that back and added an IR test.

Thinking again I remembered why I removed the explicit case for this during the refactoring: in this case, SCEV will not be able to calculate an in-range offset between the operant of the store and the alloca, so it will not be judged a safe access

[fmayer]

add tests for stack safety analysis

[fmayer]

format

[fmayer]

EDIT: I ran pdfium benchmarks and had some results here, but I spoke too early and need to run some more.

[eugenis]

@vitalybuka

Ideas for more analysis tests:

• unsafe alloca with a mix of safe and unsafe accesses
• memcpy that is safe on one side and unsafe on the other. Either between two allocas, or within the same (memmove?). Or between alloca and non-stack memory.

In D108457#2985198, @fmayer wrote:

In D108457#2984855, @fmayer wrote:

In D108457#2983236, @eugenis wrote:

What if an instruction may access either stack or heap?

i32 *p = flag ? p_heap_i16 : &stack_i32;
*p = 42;

The analysis will say "safe" because it is only scanning from the stack roots.
This should probably be fixed in hwasan by tracking the underlying alloca.

Ah yes, I did handle this but then accidentally lost that when I refactored around some stuff. Put that back and added an IR test.

Thinking again I remembered why I removed the explicit case for this during the refactoring: in this case, SCEV will not be able to calculate an in-range offset between the operant of the store and the alloca, so it will not be judged a safe access

Right, of course. Any reachable instruction we would require to be *always* within the alloca range.

llvm/lib/Analysis/StackSafetyAnalysis.cpp

836

This affect compilation time and memory. Ideally we would not do it if the client can not use this info (ex. MTE).

llvm/lib/Transforms/Instrumentation/HWAddressSanitizer.cpp

787

if (findAllocaForValue(Ptr)) return true;

[fmayer]

address comment

[fmayer]

remove unnecessary check

[fmayer]

only calculate address information when needed.

[fmayer]

revert unneeded change

[fmayer]

clang format

[eugenis]

still missing test cases for combinations of mixed safe/unsafe accesses

llvm/include/llvm/Analysis/StackSafetyAnalysis.h

68

you want either DenseMap or SmallPtrSet here. std::map is unnecessarily ordered, logarithmic, and wastes memory

[vitalybuka]

llvm/include/llvm/Analysis/StackSafetyAnalysis.h

67

why do we need bool if missing instruction is equivalent to false?
std::set?

67

just std::map<const Instruction *, bool>Accesses;

InfoTy in unique_ptr to avoid exposing it into the header.

68

std set/map seems fine
class is movable, DenseMap or SmallPtrSet don't support efficient move.

68

I don't see value in ::getAccesses when accessIsSafe can access the field.

llvm/lib/Analysis/StackSafetyAnalysis.cpp

135–138

Less boilerplate this way:
auto Ins = Accesses.emplace(I, R);
Then use Ins.first and Ins.second where needed.

140–142

the point of <it, bool> result that you can update if insert failed and avoid the second lookup

456

may I ask you to extract two NFC patches which you can land without review:

1. break -> return !US.Range.isFullSet(); I assume no tests need updates.
2. Wrap updateRange into trivial:

void addRange(I, R) {
   // the rest you will add in D108457
   updateRange(R);
 }

I assume also not tests should be affected.

814

this is a separate NFC patch

827

so we lazily construct this on the request
if so I am pretty sure we can have sorted std::vector<Instruction*> Accesses for free;
and accessIsSafe can use std::binary_search and it will be faster then map/set lookups.

836

I am a little bit skeptical that we can measure a difference. I'd rather keep it simple.

llvm/lib/Transforms/Instrumentation/HWAddressSanitizer.cpp

290

HWAsan and related tests should be in a separate patch

[fmayer]

split change

[fmayer]

I split the stack safety change to D109503 and added more tests to that.

llvm/include/llvm/Analysis/StackSafetyAnalysis.h

67

While I build this up, there are two cases:

the instruction hadn't been considered yet
the instruction was considered but wasn't safe.
This allows to conveniently keep them apart.

67

I reverted to calculating this in getInfo and putting it into the InfoTy.

@eugenis is that okay?

llvm/lib/Analysis/StackSafetyAnalysis.cpp

140–142

That doesn't work, because it's not move constructible (I think, I don't fully remember what exactly it complained about when I did that).

456

Actually no one looks at the return value, so I just made it void.

836

I reverted it to what it was before for simplicity. We can change it again later if it becomes a problem.

[fmayer]

remove unnecessary check (again)

[fmayer]

style

[eugenis]

LGTM

llvm/lib/Transforms/Instrumentation/HWAddressSanitizer.cpp

786

I'm still on the fence about this. A stack pointer can be used to access heap if the offset is attacker controlled, but that sounds a bit exotic.

But let's land it like this for now.

One thing I'd like to explore is applying the same SCEV computation as in StackSafetyAnalysis and excluding instrumentation for anything with offset provably within 32 bits or less - that should be reasonably common (indices are often int, not long) and safe (heap is unlikely to be within 4Gb from stack on 64-bit).

[fmayer]

rebase

llvm/include/llvm/Analysis/StackSafetyAnalysis.h

 public:
   struct InfoTy;
 
 private:
   Module *M = nullptr;
   std::function<const StackSafetyInfo &(Function &F)> GetSSI;
   const ModuleSummaryIndex *Index = nullptr;
   mutable std::unique_ptr<InfoTy> Info;
   const InfoTy &getInfo() const;
 
 public:
   StackSafetyGlobalInfo();
   StackSafetyGlobalInfo(
       Module *M, std::function<const StackSafetyInfo &(Function &F)> GetSSI,
       const ModuleSummaryIndex *Index);
   StackSafetyGlobalInfo(StackSafetyGlobalInfo &&);
   StackSafetyGlobalInfo &operator=(StackSafetyGlobalInfo &&);
   ~StackSafetyGlobalInfo();
 
   bool isSafe(const AllocaInst &AI) const;
+  bool accessIsSafe(const Instruction *I) const;
   void print(raw_ostream &O) const;
   void dump() const;
 };
 
 /// StackSafetyInfo wrapper for the new pass manager.
 class StackSafetyAnalysis : public AnalysisInfoMixin<StackSafetyAnalysis> {
   friend AnalysisInfoMixin<StackSafetyAnalysis>;
   static AnalysisKey Key;

llvm/lib/Analysis/StackSafetyAnalysis.cpp

 #include "llvm/IR/ModuleSummaryIndex.h"
 #include "llvm/InitializePasses.h"
 #include "llvm/Support/Casting.h"
 #include "llvm/Support/CommandLine.h"
 #include "llvm/Support/FormatVariadic.h"
 #include "llvm/Support/raw_ostream.h"
 #include <algorithm>
 #include <memory>
+#include <tuple>
 
 using namespace llvm;
 
 #define DEBUG_TYPE "stack-safety"
 
 STATISTIC(NumAllocaStackSafe, "Number of safe allocas");
 STATISTIC(NumAllocaTotal, "Number of total allocas");
 
template <typename CalleeTy> struct CallInfo {
   };
 };
 
 /// Describe uses of address (alloca or parameter) inside of the function.
 template <typename CalleeTy> struct UseInfo {
   // Access range if the address (alloca or parameters).
   // It is allowed to be empty-set when there are no known accesses.
   ConstantRange Range;
+  std::map<const Instruction *, const ConstantRange> Accesses;
 
   // List of calls which pass address as an argument.
   // Value is offset range of address from base address (alloca or calling
   // function argument). Range should never set to empty-set, that is an invalid
   // access range that can cause empty-set to be propagated with
   // ConstantRange::add
   using CallsTy = std::map<CallInfo<CalleeTy>, ConstantRange,
                            typename CallInfo<CalleeTy>::Less>;
   CallsTy Calls;
 
   UseInfo(unsigned PointerSize) : Range{PointerSize, false} {}
 
   void updateRange(const ConstantRange &R) { Range = unionNoWrap(Range, R); }
+  void addRange(const Instruction *I, const ConstantRange &R) {
+    bool Inserted;
+    std::map<const Instruction *, const ConstantRange>::iterator It;
+    std::tie(It, Inserted) = Accesses.emplace(I, R);
+    if (!Inserted) {
+      auto Union = unionNoWrap(It->second, R);
+      Accesses.erase(It);
+      std::tie(It, Inserted) = Accesses.emplace(I, Union);
+      assert(Inserted);
+    }
+    updateRange(R);
+  }
 };
 
 template <typename CalleeTy>
 raw_ostream &operator<<(raw_ostream &OS, const UseInfo<CalleeTy> &U) {
   OS << U.Range;
   for (auto &Call : U.Calls)
     OS << ", "
        << "@" << Call.first.Callee->getName() << "(arg" << Call.first.ParamNo

 
 struct StackSafetyInfo::InfoTy {
   FunctionInfo<GlobalValue> Info;
 };
 
 struct StackSafetyGlobalInfo::InfoTy {
   GVToSSI Info;
   SmallPtrSet<const AllocaInst *, 8> SafeAllocas;
+  std::map<const Instruction *, bool> Accesses;
 };
 
 namespace {
 
 class StackSafetyLocalAnalysis {
   Function &F;
   const DataLayout &DL;
   ScalarEvolution &SE;
for (const Use &UI : V->uses()) {
       if (!SL.isReachable(I))
         continue;
 
       assert(V == UI.get());
 
       switch (I->getOpcode()) {
       case Instruction::Load: {
         if (AI && !SL.isAliveAfter(AI, I)) {
-          US.updateRange(UnknownRange);
-          return false;
+          US.addRange(I, UnknownRange);
+          break;
         }
-        US.updateRange(
+        US.addRange(I,
                     getAccessRange(UI, Ptr, DL.getTypeStoreSize(I->getType())));
         break;
       }
 
       case Instruction::VAArg:
         // "va-arg" from a pointer is safe.
         break;
       case Instruction::Store: {
         if (V == I->getOperand(0)) {
           // Stored the pointer - conservatively assume it may be unsafe.
-          US.updateRange(UnknownRange);
-          return false;
+          US.addRange(I, UnknownRange);
+          break;
         }
         if (AI && !SL.isAliveAfter(AI, I)) {
-          US.updateRange(UnknownRange);
-          return false;
+          US.addRange(I, UnknownRange);
+          break;
         }
-        US.updateRange(getAccessRange(
+        US.addRange(
+            I, getAccessRange(
                    UI, Ptr, DL.getTypeStoreSize(I->getOperand(0)->getType())));
         break;
       }
 
       case Instruction::Ret:
         // Information leak.
         // FIXME: Process parameters correctly. This is a leak only if we return
         // alloca.
-        US.updateRange(UnknownRange);
-        return false;
+        US.addRange(I, UnknownRange);
+        break;
 
       case Instruction::Call:
       case Instruction::Invoke: {
         if (I->isLifetimeStartOrEnd())
           break;
 
         if (AI && !SL.isAliveAfter(AI, I)) {
-          US.updateRange(UnknownRange);
-          return false;
+          US.addRange(I, UnknownRange);
+          break;
         }
 
         if (const MemIntrinsic *MI = dyn_cast<MemIntrinsic>(I)) {
-          US.updateRange(getMemIntrinsicAccessRange(MI, UI, Ptr));
+          US.addRange(I, getMemIntrinsicAccessRange(MI, UI, Ptr));
           break;
         }
 
         const auto &CB = cast<CallBase>(*I);
         if (!CB.isArgOperand(&UI)) {
-          US.updateRange(UnknownRange);
-          return false;
+          US.addRange(I, UnknownRange);
+          break;
         }
 
         unsigned ArgNo = CB.getArgOperandNo(&UI);
         if (CB.isByValArgument(ArgNo)) {
-          US.updateRange(getAccessRange(
-              UI, Ptr, DL.getTypeStoreSize(CB.getParamByValType(ArgNo))));
+          US.addRange(I, getAccessRange(
+                             UI, Ptr,
+                             DL.getTypeStoreSize(CB.getParamByValType(ArgNo))));
           break;
         }
 
         // FIXME: consult devirt?
         // Do not follow aliases, otherwise we could inadvertently follow
         // dso_preemptable aliases or aliases with interposable linkage.
         const GlobalValue *Callee =
             dyn_cast<GlobalValue>(CB.getCalledOperand()->stripPointerCasts());
         if (!Callee) {
-          US.updateRange(UnknownRange);
-          return false;
+          US.addRange(I, UnknownRange);
+          break;
         }
 
         assert(isa<Function>(Callee) || isa<GlobalAlias>(Callee));
         ConstantRange Offsets = offsetFrom(UI, Ptr);
         auto Insert =
             US.Calls.emplace(CallInfo<GlobalValue>(Callee, ArgNo), Offsets);
         if (!Insert.second)
           Insert.first->second = Insert.first->second.unionWith(Offsets);
         break;
       }
 
       default:
         if (Visited.insert(I).second)
           WorkList.push_back(cast<const Instruction>(I));
       }
     }
   }
 
-  return true;
+  return !US.Range.isFullSet();
 }
 
 FunctionInfo<GlobalValue> StackSafetyLocalAnalysis::run() {
   FunctionInfo<GlobalValue> Info;
   assert(!F.isDeclaration() &&
          "Can't run StackSafety on a function declaration");
 
   LLVM_DEBUG(dbgs() << "[StackSafety] " << F.getName() << "\n");
if (!Info) {
     StackSafetyLocalAnalysis SSLA(*F, GetSE());
     Info.reset(new InfoTy{SSLA.run()});
   }
   return *Info;
 }
 
 void StackSafetyInfo::print(raw_ostream &O) const {
   getInfo().Info.print(O, F->getName(), dyn_cast<Function>(F));
 }
 
 const StackSafetyGlobalInfo::InfoTy &StackSafetyGlobalInfo::getInfo() const {
   if (!Info) {
     std::map<const GlobalValue *, FunctionInfo<GlobalValue>> Functions;
     for (auto &F : M->functions()) {
       if (!F.isDeclaration()) {
         auto FI = GetSSI(F).getInfo().Info;
         Functions.emplace(&F, std::move(FI));
       }
     }
     Info.reset(new InfoTy{
-        createGlobalStackSafetyInfo(std::move(Functions), Index), {}});
+        createGlobalStackSafetyInfo(std::move(Functions), Index), {}, {}});
     for (auto &FnKV : Info->Info) {
       for (auto &KV : FnKV.second.Allocas) {
         ++NumAllocaTotal;
         const AllocaInst *AI = KV.first;
-        if (getStaticAllocaSizeRange(*AI).contains(KV.second.Range)) {
+        auto AIRange = getStaticAllocaSizeRange(*AI);
+        if (AIRange.contains(KV.second.Range)) {
           Info->SafeAllocas.insert(AI);
           ++NumAllocaStackSafe;
         }
+        for (const auto &A : KV.second.Accesses) {
+          bool IsSafe = AIRange.contains(A.second);
+          bool Inserted;
+          std::map<const Instruction *, bool>::iterator It;
+          std::tie(It, Inserted) = Info->Accesses.emplace(A.first, IsSafe);
+          if (!Inserted)
+            It->second = It->second && IsSafe;
+        }
       }
     }
     if (StackSafetyPrint)
       print(errs());
   }
   return *Info;
 }
 

 
 StackSafetyGlobalInfo::~StackSafetyGlobalInfo() = default;
 
 bool StackSafetyGlobalInfo::isSafe(const AllocaInst &AI) const {
   const auto &Info = getInfo();
   return Info.SafeAllocas.count(&AI);
 }
 
+bool StackSafetyGlobalInfo::accessIsSafe(const Instruction *I) const {
+  const auto &Info = getInfo();
+  auto It = Info.Accesses.find(I);
+  if (It != Info.Accesses.end()) {
+    return It->second;
+  }
+  return false;
+}
+
 void StackSafetyGlobalInfo::print(raw_ostream &O) const {
   auto &SSI = getInfo().Info;
   if (SSI.empty())
     return;
   const Module &M = *SSI.begin()->first->getParent();
   for (auto &F : M.functions()) {
     if (!F.isDeclaration()) {
       SSI.find(&F)->second.print(O, F.getName(), &F);

llvm/lib/Transforms/Instrumentation/HWAddressSanitizer.cpp

public:
 
   void untagPointerOperand(Instruction *I, Value *Addr);
   Value *memToShadow(Value *Shadow, IRBuilder<> &IRB);
   void instrumentMemAccessInline(Value *Ptr, bool IsWrite,
                                  unsigned AccessSizeIndex,
                                  Instruction *InsertBefore);
   void instrumentMemIntrinsic(MemIntrinsic *MI);
   bool instrumentMemAccess(InterestingMemoryOperand &O);
-  bool ignoreAccess(Value *Ptr);
+  bool ignoreAccess(Instruction *Inst, Value *Ptr);
   void getInterestingMemoryOperands(
       Instruction *I, SmallVectorImpl<InterestingMemoryOperand> &Interesting);
 
   bool isInterestingAlloca(const AllocaInst &AI);
   void tagAlloca(IRBuilder<> &IRB, AllocaInst *AI, Value *Tag, size_t Size);
   Value *tagPointer(IRBuilder<> &IRB, Type *Ty, Value *PtrLong, Value *Tag);
   Value *untagPointer(IRBuilder<> &IRB, Value *PtrLong);
   static bool isStandardLifetime(const AllocaInfo &AllocaInfo,
Value *HWAddressSanitizer::getShadowNonTls(IRBuilder<> &IRB) {
   } else {
     Value *GlobalDynamicAddress =
         IRB.GetInsertBlock()->getParent()->getParent()->getOrInsertGlobal(
             kHwasanShadowMemoryDynamicAddress, Int8PtrTy);
     return IRB.CreateLoad(Int8PtrTy, GlobalDynamicAddress);
   }
 }
 
-bool HWAddressSanitizer::ignoreAccess(Value *Ptr) {
+bool HWAddressSanitizer::ignoreAccess(Instruction *Inst, Value *Ptr) {
   // Do not instrument acesses from different address spaces; we cannot deal
   // with them.
   Type *PtrTy = cast<PointerType>(Ptr->getType()->getScalarType());
   if (PtrTy->getPointerAddressSpace() != 0)
     return true;
 
   // Ignore swifterror addresses.
   // swifterror memory addresses are mem2reg promoted by instruction
   // selection. As such they cannot have regular uses like an instrumentation
   // function and it makes no sense to track them as memory.
   if (Ptr->isSwiftError())
     return true;
 
+  if (!InstrumentStack) {
+    const AllocaInst *AI = findAllocaForValue(Ptr);
+    if (AI)
+      return true;
+  } else if (SSI && SSI->accessIsSafe(Inst)) {
+    return true;
+  }
   return false;
 }
 
 void HWAddressSanitizer::getInterestingMemoryOperands(
     Instruction *I, SmallVectorImpl<InterestingMemoryOperand> &Interesting) {
   // Skip memory accesses inserted by another instrumentation.
   if (I->hasMetadata("nosanitize"))
     return;
 
   // Do not instrument the load fetching the dynamic shadow address.
   if (ShadowBase == I)
     return;
 
   if (LoadInst *LI = dyn_cast<LoadInst>(I)) {
-    if (!ClInstrumentReads || ignoreAccess(LI->getPointerOperand()))
+    if (!ClInstrumentReads || ignoreAccess(I, LI->getPointerOperand()))
       return;
     Interesting.emplace_back(I, LI->getPointerOperandIndex(), false,
                              LI->getType(), LI->getAlign());
   } else if (StoreInst *SI = dyn_cast<StoreInst>(I)) {
-    if (!ClInstrumentWrites || ignoreAccess(SI->getPointerOperand()))
+    if (!ClInstrumentWrites || ignoreAccess(I, SI->getPointerOperand()))
       return;
     Interesting.emplace_back(I, SI->getPointerOperandIndex(), true,
                              SI->getValueOperand()->getType(), SI->getAlign());
   } else if (AtomicRMWInst *RMW = dyn_cast<AtomicRMWInst>(I)) {
-    if (!ClInstrumentAtomics || ignoreAccess(RMW->getPointerOperand()))
+    if (!ClInstrumentAtomics || ignoreAccess(I, RMW->getPointerOperand()))
       return;
     Interesting.emplace_back(I, RMW->getPointerOperandIndex(), true,
                              RMW->getValOperand()->getType(), None);
   } else if (AtomicCmpXchgInst *XCHG = dyn_cast<AtomicCmpXchgInst>(I)) {
-    if (!ClInstrumentAtomics || ignoreAccess(XCHG->getPointerOperand()))
+    if (!ClInstrumentAtomics || ignoreAccess(I, XCHG->getPointerOperand()))
       return;
     Interesting.emplace_back(I, XCHG->getPointerOperandIndex(), true,
                              XCHG->getCompareOperand()->getType(), None);
   } else if (auto CI = dyn_cast<CallInst>(I)) {
     for (unsigned ArgNo = 0; ArgNo < CI->getNumArgOperands(); ArgNo++) {
       if (!ClInstrumentByval || !CI->isByValArgument(ArgNo) ||
-          ignoreAccess(CI->getArgOperand(ArgNo)))
+          ignoreAccess(I, CI->getArgOperand(ArgNo)))
         continue;
       Type *Ty = CI->getParamByValType(ArgNo);
       Interesting.emplace_back(I, ArgNo, false, Ty, Align(1));
     }
   }
 }
 
 static unsigned getPointerOperandIndex(Instruction *I) {

llvm/test/Instrumentation/HWAddressSanitizer/memaccess-clobber.ll

 ; Make sure memaccess checks preceed the following reads.
 ;
-; RUN: opt < %s -S -enable-new-pm=0 -hwasan -basic-aa -memdep -print-memdeps -analyze -mtriple aarch64-linux-android30 | FileCheck %s
+; RUN: opt < %s -S -enable-new-pm=0 -hwasan -hwasan-use-stack-safety=0 -basic-aa -memdep -print-memdeps -analyze -mtriple aarch64-linux-android30 | FileCheck %s
 
 target datalayout = "e-m:e-i8:8:32-i16:16:32-i64:64-i128:128-n32:64-S128"
 target triple = "aarch64--linux-android10000"
 
 declare void @use32(i32*)
 
 define i32 @test_alloca() sanitize_hwaddress {
 entry:

llvm/test/Instrumentation/HWAddressSanitizer/stack-safety-analysis.ll

-; RUN: opt -hwasan -hwasan-use-stack-safety=1 -hwasan-generate-tags-with-calls -S < %s | FileCheck %s --check-prefixes=SAFETY
-; RUN: opt -hwasan -hwasan-use-stack-safety=0 -hwasan-generate-tags-with-calls -S < %s | FileCheck %s --check-prefixes=NOSAFETY
-; RUN: opt -hwasan -hwasan-generate-tags-with-calls -S < %s | FileCheck %s --check-prefixes=SAFETY
+; RUN: opt -hwasan -hwasan-instrument-with-calls -hwasan-use-stack-safety=1 -hwasan-generate-tags-with-calls -S < %s | FileCheck %s --check-prefixes=SAFETY,CHECK
+; RUN: opt -hwasan -hwasan-instrument-with-calls -hwasan-use-stack-safety=0 -hwasan-generate-tags-with-calls -S < %s | FileCheck %s --check-prefixes=NOSAFETY,CHECK
+; RUN: opt -hwasan -hwasan-instrument-with-calls -hwasan-generate-tags-with-calls -S < %s | FileCheck %s --check-prefixes=SAFETY,CHECK
+; RUN: opt -hwasan -hwasan-instrument-stack=0 -hwasan-instrument-with-calls -hwasan-generate-tags-with-calls -S < %s | FileCheck %s --check-prefixes=NOSTACK,CHECK
 
 target datalayout = "e-m:e-i8:8:32-i16:16:32-i64:64-i128:128-n32:64-S128"
 target triple = "aarch64-unknown-linux-gnu"
 
 ; Check a safe alloca to ensure it does not get a tag.
-define i32 @test_load(i32* %a) sanitize_hwaddress {
+define i32 @test_simple(i32* %a) sanitize_hwaddress {
 entry:
+  ; CHECK-LABEL: @test_simple
   ; NOSAFETY: call {{.*}}__hwasan_generate_tag
+  ; NOSAFETY: call {{.*}}__hwasan_store
   ; SAFETY-NOT: call {{.*}}__hwasan_generate_tag
+  ; SAFETY-NOT: call {{.*}}__hwasan_store
+  ; NOSTACK-NOT: call {{.*}}__hwasan_generate_tag
+  ; NOSTACK-NOT: call {{.*}}__hwasan_store
   %buf.sroa.0 = alloca i8, align 4
   call void @llvm.lifetime.start.p0i8(i64 1, i8* nonnull %buf.sroa.0)
   store volatile i8 0, i8* %buf.sroa.0, align 4, !tbaa !8
   call void @llvm.lifetime.end.p0i8(i64 1, i8* nonnull %buf.sroa.0)
   ret i32 0
 }
 
 ; Check a non-safe alloca to ensure it gets a tag.
 define i32 @test_use(i32* %a) sanitize_hwaddress {
 entry:
+  ; CHECK-LABEL: @test_use
   ; NOSAFETY: call {{.*}}__hwasan_generate_tag
+  ; NOSAFETY: call {{.*}}__hwasan_store
   ; SAFETY: call {{.*}}__hwasan_generate_tag
+  ; SAFETY-NOT: call {{.*}}__hwasan_store
+  ; NOSTACK-NOT: call {{.*}}__hwasan_generate_tag
+  ; NOSTACK-NOT: call {{.*}}__hwasan_store
   %buf.sroa.0 = alloca i8, align 4
   call void @use(i8* nonnull %buf.sroa.0)
   call void @llvm.lifetime.start.p0i8(i64 1, i8* nonnull %buf.sroa.0)
   store volatile i8 0, i8* %buf.sroa.0, align 4, !tbaa !8
   call void @llvm.lifetime.end.p0i8(i64 1, i8* nonnull %buf.sroa.0)
   ret i32 0
 }
 
+; Check an alloca with in range GEP to ensure it does not get a tag or check.
+define i32 @test_in_range(i32* %a) sanitize_hwaddress {
+entry:
+  ; CHECK-LABEL: @test_in_range
+  ; NOSAFETY: call {{.*}}__hwasan_generate_tag
+  ; NOSAFETY: call {{.*}}__hwasan_store
+  ; SAFETY-NOT: call {{.*}}__hwasan_generate_tag
+  ; SAFETY-NOT: call {{.*}}__hwasan_store
+  ; NOSTACK-NOT: call {{.*}}__hwasan_generate_tag
+  ; NOSTACK-NOT: call {{.*}}__hwasan_store
+  %buf.sroa.0 = alloca [10 x i8], align 4
+  %ptr = getelementptr [10 x i8], [10 x i8]* %buf.sroa.0, i32 0, i32 0
+  call void @llvm.lifetime.start.p0i8(i64 10, i8* nonnull %ptr)
+  store volatile i8 0, i8* %ptr, align 4, !tbaa !8
+  call void @llvm.lifetime.end.p0i8(i64 10, i8* nonnull %ptr)
+  ret i32 0
+}
+
+; Check an alloca with in range GEP to ensure it does not get a tag or check.
+define i32 @test_in_range2(i32* %a) sanitize_hwaddress {
+entry:
+  ; CHECK-LABEL: @test_in_range2
+  ; NOSAFETY: call {{.*}}__hwasan_generate_tag
+  ; NOSAFETY: call {{.*}}__hwasan_store
+  ; SAFETY-NOT: call {{.*}}__hwasan_generate_tag
+  ; SAFETY-NOT: call {{.*}}__hwasan_store
+  ; NOSTACK-NOT: call {{.*}}__hwasan_generate_tag
+  ; NOSTACK-NOT: call {{.*}}__hwasan_store
+  %buf.sroa.0 = alloca [10 x i8], align 4
+  %ptr = getelementptr [10 x i8], [10 x i8]* %buf.sroa.0, i32 0, i32 9
+  %x = bitcast [10 x i8]* %buf.sroa.0 to i8*
+  call void @llvm.lifetime.start.p0i8(i64 10, i8* nonnull %x)
+  store volatile i8 0, i8* %ptr, align 4, !tbaa !8
+  call void @llvm.lifetime.end.p0i8(i64 10, i8* nonnull %x)
+  ret i32 0
+}
+
+; Check an alloca with out of range GEP to ensure it gets a tag and check.
+define i32 @test_out_of_range(i32* %a) sanitize_hwaddress {
+entry:
+  ; CHECK-LABEL: @test_out_of_range
+  ; NOSAFETY: call {{.*}}__hwasan_generate_tag
+  ; NOSAFETY: call {{.*}}__hwasan_store
+  ; SAFETY: call {{.*}}__hwasan_generate_tag
+  ; SAFETY: call {{.*}}__hwasan_store
+  ; NOSTACK-NOT: call {{.*}}__hwasan_generate_tag
+  ; NOSTACK-NOT: call {{.*}}__hwasan_store
+  %buf.sroa.0 = alloca [10 x i8], align 4
+  %ptr = getelementptr [10 x i8], [10 x i8]* %buf.sroa.0, i32 0, i32 10
+  %x = bitcast [10 x i8]* %buf.sroa.0 to i8*
+  call void @llvm.lifetime.start.p0i8(i64 10, i8* nonnull %x)
+  store volatile i8 0, i8* %ptr, align 4, !tbaa !8
+  call void @llvm.lifetime.end.p0i8(i64 10, i8* nonnull %x)
+  ret i32 0
+}
+
+; Check an alloca with potentially out of range GEP to ensure it gets a tag and
+; check.
+define i32 @test_potentially_out_of_range(i32* %a) sanitize_hwaddress {
+entry:
+  ; CHECK-LABEL: @test_potentially_out_of_range
+  ; NOSAFETY: call {{.*}}__hwasan_generate_tag
+  ; NOSAFETY: call {{.*}}__hwasan_store
+  ; SAFETY: call {{.*}}__hwasan_generate_tag
+  ; SAFETY: call {{.*}}__hwasan_store
+  ; NOSTACK-NOT: call {{.*}}__hwasan_generate_tag
+  ; NOSTACK-NOT: call {{.*}}__hwasan_store
+  %buf.sroa.0 = alloca [10 x i8], align 4
+  %off = call i32 @getoffset()
+  %ptr = getelementptr [10 x i8], [10 x i8]* %buf.sroa.0, i32 0, i32 %off
+  call void @llvm.lifetime.start.p0i8(i64 10, i8* nonnull %ptr)
+  store volatile i8 0, i8* %ptr, align 4, !tbaa !8
+  call void @llvm.lifetime.end.p0i8(i64 10, i8* nonnull %ptr)
+  ret i32 0
+}
+
+; Check an alloca with potentially out of range GEP to ensure it gets a tag and
+; check.
+define i32 @test_unclear(i32* %a) sanitize_hwaddress {
+entry:
+  ; CHECK-LABEL: @test_unclear
+  ; NOSAFETY: call {{.*}}__hwasan_generate_tag
+  ; NOSAFETY: call {{.*}}__hwasan_store
+  ; SAFETY: call {{.*}}__hwasan_generate_tag
+  ; SAFETY: call {{.*}}__hwasan_store
+  ; NOSTACK-NOT: call {{.*}}__hwasan_generate_tag
+  ; NOSTACK: call {{.*}}__hwasan_store
+  %buf.sroa.0 = alloca i8, align 4
+  %ptr = call i8* @getptr(i8* %buf.sroa.0)
+  call void @llvm.lifetime.start.p0i8(i64 10, i8* nonnull %ptr)
+  store volatile i8 0, i8* %ptr, align 4, !tbaa !8
+  call void @llvm.lifetime.end.p0i8(i64 10, i8* nonnull %ptr)
+  ret i32 0
+}
+
 ; Function Attrs: argmemonly mustprogress nofree nosync nounwind willreturn
 declare void @llvm.lifetime.start.p0i8(i64 immarg, i8* nocapture)
 
 ; Function Attrs: argmemonly mustprogress nofree nosync nounwind willreturn
 declare void @llvm.lifetime.end.p0i8(i64 immarg, i8* nocapture)
 
 declare void @use(i8* nocapture)
+declare i32 @getoffset()
+declare i8* @getptr(i8* nocapture)
 
 !8 = !{!9, !9, i64 0}
 !9 = !{!"omnipotent char", !10, i64 0}
 !10 = !{!"Simple C/C++ TBAA"}