@@ -152,6 +152,8 @@ class TrackedRegisters {
152
152
// in the gadgets to be reported. This information is used in the second run
153
153
// to also track which instructions last wrote to those registers.
154
154
155
+ typedef SmallPtrSet<const MCInst *, 4 > SetOfRelatedInsts;
156
+
155
157
// / A state representing which registers are safe to use by an instruction
156
158
// / at a given program point.
157
159
// /
@@ -195,7 +197,7 @@ struct SrcState {
195
197
// / pac-ret analysis, the expectation is that almost all return instructions
196
198
// / only use register `X30`, and therefore, this vector will probably have
197
199
// / length 1 in the second run.
198
- std::vector<SmallPtrSet< const MCInst *, 4 > > LastInstWritingReg;
200
+ std::vector<SetOfRelatedInsts > LastInstWritingReg;
199
201
200
202
// / Construct an empty state.
201
203
SrcState () {}
@@ -231,7 +233,7 @@ struct SrcState {
231
233
};
232
234
233
235
static void printInstsShort (raw_ostream &OS,
234
- ArrayRef<SmallPtrSet< const MCInst *, 4 > > Insts) {
236
+ ArrayRef<SetOfRelatedInsts > Insts) {
235
237
OS << " Insts: " ;
236
238
for (unsigned I = 0 ; I < Insts.size (); ++I) {
237
239
auto &Set = Insts[I];
@@ -322,13 +324,12 @@ class SrcSafetyAnalysis {
322
324
DenseMap<const MCInst *, std::pair<MCPhysReg, const MCInst *>>
323
325
CheckerSequenceInfo;
324
326
325
- SmallPtrSet<const MCInst *, 4 > &lastWritingInsts (SrcState &S,
326
- MCPhysReg Reg) const {
327
+ SetOfRelatedInsts &lastWritingInsts (SrcState &S, MCPhysReg Reg) const {
327
328
unsigned Index = RegsToTrackInstsFor.getIndex (Reg);
328
329
return S.LastInstWritingReg [Index];
329
330
}
330
- const SmallPtrSet< const MCInst *, 4 > &lastWritingInsts (const SrcState &S,
331
- MCPhysReg Reg) const {
331
+ const SetOfRelatedInsts &lastWritingInsts (const SrcState &S,
332
+ MCPhysReg Reg) const {
332
333
unsigned Index = RegsToTrackInstsFor.getIndex (Reg);
333
334
return S.LastInstWritingReg [Index];
334
335
}
@@ -742,8 +743,8 @@ SrcSafetyAnalysis::create(BinaryFunction &BF,
742
743
// / A state representing which registers are safe to be used as the destination
743
744
// / operand of an authentication instruction.
744
745
// /
745
- // / Similar to SrcState, it is the analysis that should take register aliasing
746
- // / into account.
746
+ // / Similar to SrcState, it is the responsibility of the analysis to take
747
+ // / register aliasing into account.
747
748
// /
748
749
// / Depending on the implementation, it may be possible that an authentication
749
750
// / instruction returns an invalid pointer on failure instead of terminating
@@ -777,9 +778,9 @@ struct DstState {
777
778
// / instructions should only be written to such registers.
778
779
BitVector CannotEscapeUnchecked;
779
780
780
- std::vector<SmallPtrSet< const MCInst *, 4 > > FirstInstLeakingReg;
781
+ std::vector<SetOfRelatedInsts > FirstInstLeakingReg;
781
782
782
- // / Construct an empty state.
783
+ // / Constructs an empty state.
783
784
DstState () {}
784
785
785
786
DstState (unsigned NumRegs, unsigned NumRegsToTrack)
@@ -882,13 +883,12 @@ class DstSafetyAnalysis {
882
883
// / operates on separate instructions.
883
884
DenseMap<const MCInst *, MCPhysReg> RegCheckedAt;
884
885
885
- SmallPtrSet<const MCInst *, 4 > &firstLeakingInsts (DstState &S,
886
- MCPhysReg Reg) const {
886
+ SetOfRelatedInsts &firstLeakingInsts (DstState &S, MCPhysReg Reg) const {
887
887
unsigned Index = RegsToTrackInstsFor.getIndex (Reg);
888
888
return S.FirstInstLeakingReg [Index];
889
889
}
890
- const SmallPtrSet< const MCInst *, 4 > &firstLeakingInsts (const DstState &S,
891
- MCPhysReg Reg) const {
890
+ const SetOfRelatedInsts &firstLeakingInsts (const DstState &S,
891
+ MCPhysReg Reg) const {
892
892
unsigned Index = RegsToTrackInstsFor.getIndex (Reg);
893
893
return S.FirstInstLeakingReg [Index];
894
894
}
@@ -899,6 +899,9 @@ class DstSafetyAnalysis {
899
899
return DstState (NumRegs, RegsToTrackInstsFor.getNumTrackedRegisters ());
900
900
}
901
901
902
+ // / Returns the set of registers that can be leaked by this instruction.
903
+ // / This is computed similar to the set of clobbered registers, but taking
904
+ // / input operands instead of outputs.
902
905
BitVector getLeakedRegs (const MCInst &Inst) const {
903
906
BitVector Leaked (NumRegs);
904
907
@@ -1067,6 +1070,8 @@ class DataflowDstSafetyAnalysis
1067
1070
: DstSafetyAnalysis(BF, RegsToTrackInstsFor), DFParent(BF, AllocId) {}
1068
1071
1069
1072
const DstState &getStateAfter (const MCInst &Inst) const override {
1073
+ // The dataflow analysis base class iterates backwards over the
1074
+ // instructions, thus "after" vs. "before" difference.
1070
1075
return DFParent::getStateBefore (Inst).get ();
1071
1076
}
1072
1077
0 commit comments