[zero-call-used-regs] Mark only non-debug instruction's register as used

[xgupta]

Summary

zero-call-used-regs pass generate an xor instruction to help mitigate
return-oriented programming exploits via zeroing out used registers. But
in this below test case with -g option there is dbg.value instruction
associating the register with the debug-info description of the formal
parameter d, which makes the register appear used, therefore it zero the
register edi in -g case and makes binary different from without -g option.

The pass should be looking only at the non-debug uses.

$ cat test.c
char a[];
int b;
attribute((zero_call_used_regs("used"))) char c(int d) {

*a = ({
  int e = d;
  b;
});

}

This fixes https://github.com/llvm/llvm-project/issues/57962.

[dblaikie]

Could you add a test case?

llvm/lib/CodeGen/PrologEpilogInserter.cpp

1242–1244

probably makes sense to put this outside the MI.operands() loop, so the loop isn't even run for debug instnructions

[xgupta]

In D138757#3952422, @dblaikie wrote:

Could you add a test case?

I had tried but assertions are not generating with update_llc_test_checks.py when -g flag specified with -S -emit-llvm. Should I manually write CHECK lines in test case?

[xgupta]

address comments

[dblaikie]

In D138757#3952450, @xgupta wrote:

In D138757#3952422, @dblaikie wrote:

Could you add a test case?

I had tried but assertions are not generating with update_llc_test_checks.py when -g flag specified with -S -emit-llvm. Should I manually write CHECK lines in test case?

Can't say I'm especially familiar with update_llc_test_checks.py and where it could/should be used (I guess by the name, it's for updating existing tests - so maybe this needs a new test written?) But, yes, either way, may require writing a test with hand-crafted CHECK lines.

llvm/lib/CodeGen/PrologEpilogInserter.cpp

1233–1237

Need some curly braces on this loop now? (& the indentation of the isDebugStr check looks like it's off-by-one)

[xgupta]

address comments

[xgupta]

Can't say I'm especially familiar with update_llc_test_checks.py and where it could/should be used (I guess by the name, it's for updating existing tests - so maybe this needs a new test written?) But, yes, either way, may require writing a test with hand-crafted CHECK lines.

OK, Does it requires mir, assembly or llvm ir testcase because there is no change at ir level wrt -g or without -g, see https://godbolt.org/z/ndz36Kn3P.

llvm/lib/CodeGen/PrologEpilogInserter.cpp

1233–1237

Yeah, missed that.

[dblaikie]

In D138757#3955993, @xgupta wrote:

Can't say I'm especially familiar with update_llc_test_checks.py and where it could/should be used (I guess by the name, it's for updating existing tests - so maybe this needs a new test written?) But, yes, either way, may require writing a test with hand-crafted CHECK lines.

OK, Does it requires mir, assembly or llvm ir testcase because there is no change at ir level wrt -g or without -g, see https://godbolt.org/z/ndz36Kn3P.

I'd probably do it in IR->asm, but other folks might be more familiar with how to do this as a narrower MIR test or the like.

[nickdesaulniers]

Thanks for the patch! Sorry for the delay reviewing; a few of us where off last week for the Thanksgiving holiday.

Change LGTM; but this must have a test added.

In D138757#3952450, @xgupta wrote:

In D138757#3952422, @dblaikie wrote:

Could you add a test case?

I had tried but assertions are not generating with update_llc_test_checks.py when -g flag specified with -S -emit-llvm. Should I manually write CHECK lines in test case?

Did you add a ; RUN: line to the beginning of your test BEFORE running update_llc_checks.py? Forgetting to do so is a common way for those scripts not to make changes. (I'll also recommend using llvm-reduce to minimize the .ll reproducer).

[nickdesaulniers]

In D138757#3957674, @dblaikie wrote:

In D138757#3955993, @xgupta wrote:

Can't say I'm especially familiar with update_llc_test_checks.py and where it could/should be used (I guess by the name, it's for updating existing tests - so maybe this needs a new test written?) But, yes, either way, may require writing a test with hand-crafted CHECK lines.

OK, Does it requires mir, assembly or llvm ir testcase because there is no change at ir level wrt -g or without -g, see https://godbolt.org/z/ndz36Kn3P.

Not true: https://godbolt.org/z/6516an1rh
Without -g, there is no calls to the @llvm.dbg.value intrinsic or !dbg metadata nodes.

I'd probably do it in IR->asm, but other folks might be more familiar with how to do this as a narrower MIR test or the like.

Ah, they joys of writing MIR tests...a MIR test is appropriate, since this is only one pass we need to test; PEI.

To help generate a test, I recommend:

1. dump IR
2. llvm-reduce IR
3. llc -O2 -stop-before=prolog-epilog-insertion -o new_mir_test.mir
4. add the ; RUN: line to new_mir_test.mir: ; RUN: llc -run-pass=prolog-epilog-insertion ...

That way you don't have to write MIR by hand, and we get a concise and quick test.

Or you can simply add another IR test case to the existing test for this feature.
llvm/test/CodeGen/X86/zero-call-used-regs.ll
or
llvm/test/CodeGen/AArch64/zero-call-used-regs.ll
would be appropriate.

I don't care which you do. The IR->asm test is probably easier; writing MIR tests builds character (and they run faster, since we're running less of the compilation pipeline).

[nickdesaulniers]

In D138757#3957857, @nickdesaulniers wrote:

3. llc -O2 -stop-before=prolog-epilog-insertion -o new_mir_test.mir
4. add the ; RUN: line to new_mir_test.mir: ; RUN: llc -run-pass=prolog-epilog-insertion ...

Ah, looks like PEI is called prologepilog not prolog-epilog-insertion.

You can generally find the pass identifier as DEBUG_TYPE near the top of the file. These don't always correspond 1:1 with the pass name (for complicated passes in multiple files, they usually have individual DEBUG_TYPEs), but a common pattern in LLVM is that they do.

[xgupta]

add test case

[xgupta]

Hi,

I am not able to complete 2nd and 4th part. Any idea what may be wrong.

Thanks,
shivam

2. llvm-reduce IR

xgupta@archlinux ~/compiler/llvm-project/build/bin (arcpatch-D138757) $ ./llvm-reduce --test=test.sh pr57962.ll                

Input isn't interesting! Verify interesting-ness test

xgupta@archlinux ~/compiler/llvm-project/build/bin (arcpatch-D138757) $ cat test.sh 
#!/usr/bin/env bash
$HOME/compiler/llvm-project/build/bin/llc  $1 |& grep PrologEpilogInserter

4. add the ; RUN: line to new_mir_test.mir: ; RUN: llc -run-pass=prolog-epilog-insertion ...

xgupta@archlinux ~/compiler/llvm-project (arcpatch-D138757?) $ ./llvm/utils/update_mir_test_checks.py llvm/test/CodeGen/X86/pr57962.mir 
error: YAML:99:1: unknown key 'debugInstrRef'
debugInstrRef:   true
^~~~~~~~~~~~~
WARNING: Error processing file: llvm/test/CodeGen/X86/pr57962.mir
Traceback (most recent call last):
  File "/home/xgupta/compiler/llvm-project/./llvm/utils/update_mir_test_checks.py", line 456, in <module>
    main()
  File "/home/xgupta/compiler/llvm-project/./llvm/utils/update_mir_test_checks.py", line 449, in main
    update_test_file(ti.args, ti.path, ti.test_autogenerated_note)
  File "/home/xgupta/compiler/llvm-project/./llvm/utils/update_mir_test_checks.py", line 343, in update_test_file
    raw_tool_output = args.llc_binary(llc_args, test)
  File "/home/xgupta/compiler/llvm-project/./llvm/utils/update_mir_test_checks.py", line 74, in __call__
    stdout = subprocess.check_output('{} {}'.format(self.bin, args),
  File "/usr/lib/python3.10/subprocess.py", line 421, in check_output
    return run(*popenargs, stdout=PIPE, timeout=timeout, check=True,
  File "/usr/lib/python3.10/subprocess.py", line 526, in run
    raise CalledProcessError(retcode, process.args,
subprocess.CalledProcessError: Command 'llc -run-pass=prologepilog -o - -x mir' returned non-zero exit status 1.

[jmorse]

In D138757#4071031, @xgupta wrote:

I am not able to complete 2nd and 4th part. Any idea what may be wrong.

[...]

error: YAML:99:1: unknown key 'debugInstrRef'
debugInstrRef: true
^~~~~~~~~~~~~

[...]

subprocess.CalledProcessError: Command 'llc -run-pass=prologepilog -o - -x mir' returned non-zero exit status 1.

Ah, this particular fault is because I recently added a new element to MIR files. It would appear that you're using an older version of llc to read the output of a newer llc -- you should be able to just rebuild llc and it will work, or in the worst case, rebase onto a commit more recent than rG9f8544713ad8e57.

Alternately, you can just delete the lines "debugInstrRef: true" from the tests safely, as you're not testing anything to do with that feature

[xgupta]

update test case for CHECK lines.

[xgupta]

use --llc-binary build/bin/llc to correcting update test case

[xgupta]

Ah, this particular fault is because I recently added a new element to MIR files. It would appear that you're using an older version of llc to read the output of a newer llc -- you should be able to just rebuild llc and it will work, or in the worst case, rebase onto a commit more recent than rG9f8544713ad8e57.

Thanks, I was using system-installed llc to update check lines, using --llc-binary fixes the issue.

[nickdesaulniers]

llvm/test/CodeGen/X86/pr57962.mir

1 ↗

(On Diff #491467)

Do you mind renaming this test from pr57962.mir to zero-call-used-regs-debug-info.mir.

3 ↗

(On Diff #491467)

Please add a comment along the lines of:

# Test that the presence of debug instructions doesn't trigger arbitrary registers that are unused to be zeroed out.

146–198 ↗

(On Diff #491467)

all of this will go away if you remove @main and rerun utils/update_mir_test_checks.py.

24–28 ↗

(On Diff #491462)

you can delete @main from this test, it's unnecessary.

Probably the metadata it references will need to be cleaned up, too.

[MatzeB]

llvm/lib/CodeGen/PrologEpilogInserter.cpp

1234–1236

Can you just use MO.readsReg() instead of MO.isUse() below (that will also skip other cases like undef that aren't really reading the register).

1243

Haven't followed this patch series. But skipping implicit operands seems odd at a first glance. They can read and write registers perfectly fine...

[MatzeB]

llvm/lib/CodeGen/PrologEpilogInserter.cpp

1234–1236

Hmm I thought MO.readsReg() would check for MO.isDebug() but apparently it does not. So this check here is fine, sorry for the confusion.

[xgupta]

address comments

[xgupta]

llvm/lib/CodeGen/PrologEpilogInserter.cpp

1243

not sure, maybe @nickdesaulniers or @void can comment on skipping implicit operands.

[nickdesaulniers]

Thanks for the work on this patch! MIR tests aren't the most fun to write/generate, but doing so builds muscle!

[xgupta]

In D138757#4078593, @nickdesaulniers wrote:

Thanks for the work on this patch! MIR tests aren't the most fun to write/generate, but doing so builds muscle!

Thank you for reviewing and helping me to submit it.

llvm/lib/CodeGen/PrologEpilogInserter.cpp

void PEI::insertZeroCallUsedRegs(MachineFunction &MF) {
 
   const TargetRegisterInfo &TRI = *MF.getSubtarget().getRegisterInfo();
   const BitVector AllocatableSet(TRI.getAllocatableSet(MF));
 
   // Mark all used registers.
   BitVector UsedRegs(TRI.getNumRegs());
   if (OnlyUsed)
     for (const MachineBasicBlock &MBB : MF)
-      for (const MachineInstr &MI : MBB)
+      for (const MachineInstr &MI : MBB) {
+        // skip debug instructions
+        if (MI.isDebugInstr())
+          continue;
+
         for (const MachineOperand &MO : MI.operands()) {
           if (!MO.isReg())
             continue;
 
           MCRegister Reg = MO.getReg();
           if (AllocatableSet[Reg] && !MO.isImplicit() &&
               (MO.isDef() || MO.isUse()))
             UsedRegs.set(Reg);
         }
+      }
 
   // Get a list of registers that are used.
   BitVector LiveIns(TRI.getNumRegs());
   for (const MachineBasicBlock::RegisterMaskPair &LI : MF.front().liveins())
     LiveIns.set(LI.PhysReg);
 
   BitVector RegsToZero(TRI.getNumRegs());
   for (MCRegister Reg : AllocatableSet.set_bits()) {

llvm/test/CodeGen/X86/zero-call-used-regs-debug-info.mir

+# NOTE: Assertions have been autogenerated by utils/update_mir_test_checks.py
+# RUN: llc -run-pass=prologepilog -o - %s | FileCheck %s
+
+# Test that the presence of debug instructions doesn't trigger arbitrary registers that are unused to be zeroed out.
+
+--- |
+  ; ModuleID = 'zero-call-used-regs-debug-info.ll'
+  source_filename = "zero-call-used-regs-debug-info.c"
+  target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-f80:128-n8:16:32:64-S128"
+  target triple = "x86_64-unknown-linux-gnu"
+
+  @b = dso_local local_unnamed_addr global i32 0, align 4, !dbg !0
+  @a = dso_local local_unnamed_addr global [1 x i8] zeroinitializer, align 1, !dbg !5
+
+  ; Function Attrs: mustprogress nofree norecurse nosync nounwind willreturn memory(readwrite, argmem: none, inaccessiblemem: none) uwtable
+  define dso_local signext i8 @c(i32 noundef %d) local_unnamed_addr #0 !dbg !19 {
+  entry:
+    call void @llvm.dbg.value(metadata i32 %d, metadata !23, metadata !DIExpression()), !dbg !26
+    call void @llvm.dbg.value(metadata i32 %d, metadata !24, metadata !DIExpression()), !dbg !27
+    %0 = load i32, ptr @b, align 4, !dbg !28, !tbaa !29
+    %conv = trunc i32 %0 to i8, !dbg !33
+    store i8 %conv, ptr @a, align 1, !dbg !34, !tbaa !35
+    ret i8 undef, !dbg !36
+  }
+
+  ; Function Attrs: nocallback nofree nosync nounwind speculatable willreturn memory(none)
+  declare void @llvm.dbg.value(metadata, metadata, metadata) #2
+
+  attributes #0 = { mustprogress nofree norecurse nosync nounwind willreturn memory(readwrite, argmem: none, inaccessiblemem: none) uwtable "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" "zero-call-used-regs"="used" }
+  attributes #1 = { mustprogress nofree norecurse nosync nounwind willreturn memory(none) uwtable "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
+  attributes #2 = { nocallback nofree nosync nounwind speculatable willreturn memory(none) }
+
+  !llvm.dbg.cu = !{!2}
+  !llvm.module.flags = !{!12, !13, !14, !15, !16, !17}
+  !llvm.ident = !{!18}
+
+  !0 = !DIGlobalVariableExpression(var: !1, expr: !DIExpression())
+  !1 = distinct !DIGlobalVariable(name: "b", scope: !2, file: !3, line: 2, type: !11, isLocal: false, isDefinition: true)
+  !2 = distinct !DICompileUnit(language: DW_LANG_C11, file: !3, producer: "clang version 16.0.0 (https://github.com/llvm/llvm-project.git ba5acedd979aa94a81be555e0add8e4421499d4f)", isOptimized: true, runtimeVersion: 0, emissionKind: FullDebug, globals: !4, splitDebugInlining: false, nameTableKind: None)
+  !3 = !DIFile(filename: "zero-call-used-regs-debug-info.c", directory: "/home/xgupta/compiler/llvm-project/build/bin", checksumkind: CSK_MD5, checksum: "fe3a5f45289411a008e07c7debb490ca")
+  !4 = !{!5, !0}
+  !5 = !DIGlobalVariableExpression(var: !6, expr: !DIExpression())
+  !6 = distinct !DIGlobalVariable(name: "a", scope: !2, file: !3, line: 1, type: !7, isLocal: false, isDefinition: true)
+  !7 = !DICompositeType(tag: DW_TAG_array_type, baseType: !8, size: 8, elements: !9)
+  !8 = !DIBasicType(name: "char", size: 8, encoding: DW_ATE_signed_char)
+  !9 = !{!10}
+  !10 = !DISubrange(count: 1)
+  !11 = !DIBasicType(name: "int", size: 32, encoding: DW_ATE_signed)
+  !12 = !{i32 7, !"Dwarf Version", i32 5}
+  !13 = !{i32 2, !"Debug Info Version", i32 3}
+  !14 = !{i32 1, !"wchar_size", i32 4}
+  !15 = !{i32 8, !"PIC Level", i32 2}
+  !16 = !{i32 7, !"PIE Level", i32 2}
+  !17 = !{i32 7, !"uwtable", i32 2}
+  !18 = !{!"clang version 16.0.0 (https://github.com/llvm/llvm-project.git ba5acedd979aa94a81be555e0add8e4421499d4f)"}
+  !19 = distinct !DISubprogram(name: "c", scope: !3, file: !3, line: 3, type: !20, scopeLine: 3, flags: DIFlagPrototyped | DIFlagAllCallsDescribed, spFlags: DISPFlagDefinition | DISPFlagOptimized, unit: !2, retainedNodes: !22)
+  !20 = !DISubroutineType(types: !21)
+  !21 = !{!8, !11}
+  !22 = !{!23, !24}
+  !23 = !DILocalVariable(name: "d", arg: 1, scope: !19, file: !3, line: 3, type: !11)
+  !24 = !DILocalVariable(name: "e", scope: !25, file: !3, line: 5, type: !11)
+  !25 = distinct !DILexicalBlock(scope: !19, file: !3, line: 4, column: 9)
+  !26 = !DILocation(line: 0, scope: !19)
+  !27 = !DILocation(line: 0, scope: !25)
+  !28 = !DILocation(line: 6, column: 5, scope: !25)
+  !29 = !{!30, !30, i64 0}
+  !30 = !{!"int", !31, i64 0}
+  !31 = !{!"omnipotent char", !32, i64 0}
+  !32 = !{!"Simple C/C++ TBAA"}
+  !33 = !DILocation(line: 4, column: 8, scope: !19)
+  !34 = !DILocation(line: 4, column: 6, scope: !19)
+  !35 = !{!31, !31, i64 0}
+  !36 = !DILocation(line: 8, column: 1, scope: !19)
+  !37 = distinct !DISubprogram(name: "main", scope: !3, file: !3, line: 9, type: !38, scopeLine: 9, flags: DIFlagAllCallsDescribed, spFlags: DISPFlagDefinition | DISPFlagOptimized, unit: !2, retainedNodes: !40)
+  !38 = !DISubroutineType(types: !39)
+  !39 = !{null}
+  !40 = !{}
+  !41 = !DILocation(line: 9, column: 14, scope: !37)
+
+...
+---
+name:            c
+alignment:       16
+exposesReturnsTwice: false
+legalized:       false
+regBankSelected: false
+selected:        false
+failedISel:      false
+tracksRegLiveness: true
+hasWinCFI:       false
+callsEHReturn:   false
+callsUnwindInit: false
+hasEHCatchret:   false
+hasEHScopes:     false
+hasEHFunclets:   false
+debugInstrRef:   true
+failsVerification: false
+tracksDebugUserValues: true
+registers:       []
+liveins:         []
+frameInfo:
+  isFrameAddressTaken: false
+  isReturnAddressTaken: false
+  hasStackMap:     false
+  hasPatchPoint:   false
+  stackSize:       0
+  offsetAdjustment: 0
+  maxAlignment:    1
+  adjustsStack:    false
+  hasCalls:        false
+  stackProtector:  ''
+  functionContext: ''
+  maxCallFrameSize: 4294967295
+  cvBytesOfCalleeSavedRegisters: 0
+  hasOpaqueSPAdjustment: false
+  hasVAStart:      false
+  hasMustTailInVarArgFunc: false
+  hasTailCall:     false
+  localFrameSize:  0
+  savePoint:       ''
+  restorePoint:    ''
+fixedStack:      []
+stack:           []
+callSites:       []
+debugValueSubstitutions: []
+constants:       []
+machineFunctionInfo: {}
+body:             |
+  bb.0.entry:
+    ; CHECK-LABEL: name: c
+    ; CHECK: DBG_VALUE $edi, $noreg, !23, !DIExpression(), debug-location !26
+    ; CHECK-NEXT: DBG_VALUE $edi, $noreg, !24, !DIExpression(), debug-location !27
+    ; CHECK-NEXT: renamable $al = MOV8rm $rip, 1, $noreg, @b, $noreg, debug-location !28 :: (dereferenceable load (s8) from @b, align 4, !tbaa !29)
+    ; CHECK-NEXT: MOV8mr $rip, 1, $noreg, @a, $noreg, killed renamable $al, debug-location !34 :: (store (s8) into @a, !tbaa !35)
+    ; CHECK-NEXT: RET 0, undef $al, debug-location !36
+    DBG_VALUE $edi, $noreg, !23, !DIExpression(), debug-location !26
+    DBG_VALUE $edi, $noreg, !24, !DIExpression(), debug-location !27
+    renamable $al = MOV8rm $rip, 1, $noreg, @b, $noreg, debug-location !28 :: (dereferenceable load (s8) from @b, align 4, !tbaa !29)
+    MOV8mr $rip, 1, $noreg, @a, $noreg, killed renamable $al, debug-location !34 :: (store (s8) into @a, !tbaa !35)
+    RET 0, undef $al, debug-location !36
+
+...