This patch adds a two markers for llvm::GraphTraits:
- NodePairFilteredGraph
- EdgeFilteredGraph
Both these markers allow to specify a static predicate that is used to
filter edges.
This predicate is a boolean function such that:
- for NodePairFilteredGraph, it takes a pair of const NodeRef & that
are used to represent an edge, and it evaluates a given property of
that pair;
- for EdgeFilteredGraph, it takes a const EdgeRef & that represents an
edge, and it evaluates a given property on the edge.
The filtered graph contains only the edges for which the predicate
evaluates true.
Notice that the predicate must have static lifetime, meaning that all
the edge properties must be entirely evaluated on the pair of node (for
NodePairFilteredGraph) or on the edge (for EdgeFilteredGraph).
This means that you cannot pass mutable state to the predicate at
runtime.
The new markers are designed to interoperate well with llvm::Inverse and
to allow you to traverse the marked graphs with llvm::depth_first,
llvm::inverse_depth_first, llvm::breadth_first, and to compute dominator
trees and post-dominator trees on filtered graphs.
Add EdgeRef and ChildEdgeIteratorType to GraphTraits<DotNode *> and to
GraphTraits<const DotNode *>.
This allows iterating on edges of DotGraphs, which will be useful for
some testing on edge properties.
This commits fixes a typo, probably a leftover from copy-paste, that
caused `DotGraph::end()` methods to actually return `begin()`.
Nobody was relying on this, which caused this bug to go unnoticed.
This commit adds calls to
`legacy::FunctionPassManager::doInitialization()` and
`legacy::FunctionPassManager::doFinalization()` before and after calls
to `legacy::FunctionPassManager::run()`.
`legacy::FunctionPassManager`s must be explicitly initialized before
running and finalized after running.
Given that we used these managers only in two places and their are the
only ones that need explicit initialization and finalization, we forgot
to do it.
This caused problems with recent versions of llvm.
In particular, when compiled with aggressive optimizations (at least
`-O2`), missed initialization resulted in null pointers being
dereferenced, causing crashes.
The crashes were caused by the compiler optimizing away `nullptr` checks
on values returned from `getPSI`.
Some tests have been disabled in the past, but they work.
Specifically, this commit re-enables the `memset` and `fibonacci` tests.
The commit also describes why the test remaining disabled are so.
AVI and InstCombine are the bottleneck of the lifting process.
This commit introduces a whitelist of jump targets that are considered
by AVI during harvesting.
The whitelist is initialized by the jump targets that are new with
respect to the last run of AVI. Then, it's expanded with all the jump
targets that can reach the initial set of jump targets through direct
jumps.
When translation of code overflows into an unmapped page, we can get a
SIGSEGV. To avoid this, for each set of contiguous pages, we add "guard
page" containing an architecture-specific pattern that ensure basic
block termination.
Unlike the previous iteration of `MetaAddress`, which tried to stuff all
the parts of `MetaAddress` within the existing `PC` CSV, this
implementation adds a set of new CSVs (or marks some existing ones as) to
represent the four portions of the current PC's `MetaAddress`.
* Introduce `ProgramCounterHandler`: a class responsible to maintain the
PC-related CSVs. This class is also used to manipulate the new
dispatcher.
* `AdvancedValueInfo`: update for new MetaAddress.
* External jump handler: do not clobber registers.
When introducing support for dynamic binaries, we didn't realize that
in x86-64 we were clobbering `r11`. To avoid this, we have to jump to
an address stored in memory. However, due to the new `MetaAddress`,
obtaining a *jumpable* address from the PC-related CSVs might require
some computations (and it does in ARM). Therefore, we introduce a new
global variable, `jumpablepc`, whose only role is to contain the
jumpable version of the program counter and then be the target of the
memory-indirect jump instruction.
* Labels care only about absolute addresses.
* CSAA: mark call site, even if no accesses.
It might happend that, while parsing an input binary, we are request to
read at a valid address, but a for a size leading outside of a valid
page.
This commit, copies as much data as possible from the valid page into a
temporary buffer of the appropriate size, and then performs the read on
that temporary buffer.
We now run InstCombine on the generated code in order to simplify
further analyses. In particular this is useful to handle code such as
the following:
%pc = load @pc
%is_thumb = and %pc, 1
%address = and %pc, ~1
%pc2 = or %is_thumb, %pc
After InstCombine `%pc` and `%pc2` are collapsed.
`MetaAddress` replaces all the `uint64_t` used to represent a virtual
address. Its main features are:
* It has a non-zero representation of invalid addresses.
* It supports tags to represent code that has different interpretations but
resides at the same address in memory (namely ARM vs Thumb).
* Arithmetic operations cannot overflow.
* It supports epochs, a way we intend to employ to handle self-modifying code
(i.e., different code at the same address at different times).
* It supports "address spaces", which enable handling architectures with
multiple address spaces.
* It fits in two 64-bit registers.
The loop creating the labes in `BinaryFile::parseELF` was badly indent
and resulted in the creation of labels only if the `.dynamic` section
was available.
`JumpTargetManager::purgeTranslation` deletes some basic blocks that
need to re-translated, however references to some instructions remained
in `OriginalInstructionAddresses`.
Pietro Fezzardi