This is an archive of the discontinued LLVM Phabricator instance.

[PowerPC] Mark side effects of Power9 darn instruction
ClosedPublic

Authored by qiucf on Mar 30 2022, 11:54 PM.

Details

Summary

This fixes CVE-2019-15847 ( https://gcc.gnu.org/bugzilla/show_bug.cgi?id=91481 ).

For following case:

#include <stdio.h>
#include <stdint.h>

int main()
{
  uint64_t darn[32];
  for(size_t i = 0; i != 32; ++i)
    darn[i] = __builtin_darn();
  for(size_t i = 0; i != 32; ++i)
    printf("%016lX\n", darn[i]);
  return 0;
}

32 outputs are the same, however they should be different.

Diff Detail

Event Timeline

qiucf created this revision.Mar 30 2022, 11:54 PM
Herald added a project: Restricted Project. · View Herald TranscriptMar 30 2022, 11:54 PM
qiucf requested review of this revision.Mar 30 2022, 11:54 PM
Herald added a project: Restricted Project. · View Herald TranscriptMar 30 2022, 11:54 PM
qiucf added reviewers: nemanjai, jsji, shchenz, Restricted Project.Mar 30 2022, 11:56 PM
lkail added a subscriber: lkail.EditedMar 31 2022, 1:58 AM

Could you also add test of opt -passes='default<O3>' to ensure we don't optimize it out for the motivation case?

qiucf updated this revision to Diff 419692.Apr 1 2022, 2:50 AM

Add OPT test

lkail added inline comments.Apr 1 2022, 3:49 AM
llvm/test/CodeGen/PowerPC/builtins-ppc-p9-darn.ll
52

The test should include the loop in the motivation case, since we might LICM'ed the intrinsic, so we observe the same value of every element in the array.

qiucf updated this revision to Diff 421401.Apr 7 2022, 8:42 PM
qiucf marked an inline comment as done.
lkail accepted this revision.Apr 7 2022, 9:03 PM

LGTM with nit.

llvm/test/CodeGen/PowerPC/builtins-ppc-p9-darn.ll
55

I'm not sure this directive is generated via utils/update_llc_test_checks.py. If not, this might diverge from what ; NOTE: Assertions have been autogenerated by utils/update_llc_test_checks.py suggests.

This revision is now accepted and ready to land.Apr 7 2022, 9:03 PM
This revision was landed with ongoing or failed builds.Apr 17 2022, 10:23 PM
This revision was automatically updated to reflect the committed changes.
qiucf added inline comments.Apr 17 2022, 10:23 PM
llvm/test/CodeGen/PowerPC/builtins-ppc-p9-darn.ll
55

update_llc_test_checks.py will ignore the run lines.

nemanjai added inline comments.Apr 28 2022, 6:21 PM
llvm/lib/Target/PowerPC/PPCInstr64Bit.td
1041

Could you please commit a follow-up patch with a comment explaining why this flag is set. The instruction doesn't really have side effects in that it modifies some machine state, the flag is presumably needed so the instruction doesn't get optimized out.

llvm/test/CodeGen/PowerPC/builtins-ppc-p9-darn.ll
37

As general guidance, it is preferred if you pre-commit a test case like this with the original code generation so that the review (and subsequent commit) shows how the code generation changes as a result of the patch.