86 lines · plain
1; Test for the conservative assembly handling mode used by KMSAN.2; RUN: opt < %s -msan-kernel=1 -msan-check-access-address=0 -msan-handle-asm-conservative=0 -S -passes=msan 2>&1 | FileCheck "-check-prefix=CHECK" %s3; RUN: opt < %s -msan-kernel=1 -msan-check-access-address=0 -msan-handle-asm-conservative=1 -S -passes=msan 2>&1 | FileCheck "-check-prefixes=CHECK,CHECK-CONS" %s4 5target datalayout = "e-m:e-i64:64-f80:128-n8:16:32:64-S128"6target triple = "x86_64-unknown-linux-gnu"7 8; The IR below was generated from the following source:9; int main() {10; bool bit;11; unsigned long value = 2;12; long nr = 0;13; unsigned long *addr = &value;14; asm("btsq %2, %1; setc %0" : "=qm" (bit), "=m" (addr): "Ir" (nr));15; if (bit)16; return 0;17; else18; return 1;19; }20;21; In the regular instrumentation mode MSan is unable to understand that |bit|22; is initialized by the asm() call, and therefore reports a false positive on23; the if-statement.24; The conservative assembly handling mode initializes every memory location25; passed by pointer into an asm() call. This prevents false positive reports,26; but may introduce false negatives.27;28; This test makes sure that the conservative mode unpoisons the shadow of |bit|29; by writing 0 to it.30 31define dso_local i32 @main() sanitize_memory {32entry:33 %retval = alloca i32, align 434 %bit = alloca i8, align 135 %value = alloca i64, align 836 %nr = alloca i64, align 837 %addr = alloca ptr, align 838 store i32 0, ptr %retval, align 439 store i64 2, ptr %value, align 840 store i64 0, ptr %nr, align 841 store ptr %value, ptr %addr, align 842 %0 = load i64, ptr %nr, align 843 call void asm "btsq $2, $1; setc $0", "=*qm,=*m,Ir,~{dirflag},~{fpsr},~{flags}"(ptr elementtype(i8) %bit, ptr elementtype(ptr) %addr, i64 %0)44 %1 = load i8, ptr %bit, align 145 %tobool = trunc i8 %1 to i146 br i1 %tobool, label %if.then, label %if.else47 48if.then: ; preds = %entry49 ret i32 050 51if.else: ; preds = %entry52 ret i32 153}54 55; %nr is first poisoned, then unpoisoned (written to). Need to optimize this in the future.56; CHECK: call void @__msan_poison_alloca(ptr %nr{{.*}})57; CHECK: call { ptr, ptr } @__msan_metadata_ptr_for_store_8(ptr %nr)58 59; Hooks for inputs usually go before the assembly statement. But here we have none,60; because %nr is passed by value. However we check %nr for being initialized.61; CHECK-CONS: call { ptr, ptr } @__msan_metadata_ptr_for_load_8(ptr %nr)62 63; In the conservative mode, call the store hooks for %bit and %addr:64; CHECK-CONS: call void @__msan_instrument_asm_store(ptr %bit, i64 1)65; CHECK-CONS: call void @__msan_instrument_asm_store(ptr %addr, i64 8)66 67; Landing pad for the %nr check above.68; CHECK-CONS: call void @__msan_warning69 70; CHECK: call void asm "btsq $2, $1; setc $0"71 72; CHECK: [[META:%.*]] = call {{.*}} @__msan_metadata_ptr_for_load_1(ptr %bit)73; CHECK: [[SHADOW:%.*]] = extractvalue { ptr, ptr } [[META]], 074 75; Now load the shadow value for the boolean.76; CHECK: [[MSLD:%.*]] = load {{.*}} [[SHADOW]]77; CHECK: [[MSPROP:%.*]] = trunc i8 [[MSLD]] to i178 79; Is the shadow poisoned?80; CHECK: br i1 [[MSPROP]], label %[[IFTRUE:.*]], label {{.*}}81 82; If yes, raise a warning.83; CHECK: [[IFTRUE]]:84; CHECK: call void @__msan_warning85 86