AVI and InstCombine are the bottleneck of the lifting process.
This commit introduces a whitelist of jump targets that are considered
by AVI during harvesting.
The whitelist is initialized by the jump targets that are new with
respect to the last run of AVI. Then, it's expanded with all the jump
targets that can reach the initial set of jump targets through direct
jumps.
When translation of code overflows into an unmapped page, we can get a
SIGSEGV. To avoid this, for each set of contiguous pages, we add "guard
page" containing an architecture-specific pattern that ensure basic
block termination.
Unlike the previous iteration of `MetaAddress`, which tried to stuff all
the parts of `MetaAddress` within the existing `PC` CSV, this
implementation adds a set of new CSVs (or marks some existing ones as) to
represent the four portions of the current PC's `MetaAddress`.
* Introduce `ProgramCounterHandler`: a class responsible to maintain the
PC-related CSVs. This class is also used to manipulate the new
dispatcher.
* `AdvancedValueInfo`: update for new MetaAddress.
* External jump handler: do not clobber registers.
When introducing support for dynamic binaries, we didn't realize that
in x86-64 we were clobbering `r11`. To avoid this, we have to jump to
an address stored in memory. However, due to the new `MetaAddress`,
obtaining a *jumpable* address from the PC-related CSVs might require
some computations (and it does in ARM). Therefore, we introduce a new
global variable, `jumpablepc`, whose only role is to contain the
jumpable version of the program counter and then be the target of the
memory-indirect jump instruction.
* Labels care only about absolute addresses.
* CSAA: mark call site, even if no accesses.
It might happend that, while parsing an input binary, we are request to
read at a valid address, but a for a size leading outside of a valid
page.
This commit, copies as much data as possible from the valid page into a
temporary buffer of the appropriate size, and then performs the read on
that temporary buffer.
We now run InstCombine on the generated code in order to simplify
further analyses. In particular this is useful to handle code such as
the following:
%pc = load @pc
%is_thumb = and %pc, 1
%address = and %pc, ~1
%pc2 = or %is_thumb, %pc
After InstCombine `%pc` and `%pc2` are collapsed.
`MetaAddress` replaces all the `uint64_t` used to represent a virtual
address. Its main features are:
* It has a non-zero representation of invalid addresses.
* It supports tags to represent code that has different interpretations but
resides at the same address in memory (namely ARM vs Thumb).
* Arithmetic operations cannot overflow.
* It supports epochs, a way we intend to employ to handle self-modifying code
(i.e., different code at the same address at different times).
* It supports "address spaces", which enable handling architectures with
multiple address spaces.
* It fits in two 64-bit registers.
The loop creating the labes in `BinaryFile::parseELF` was badly indent
and resulted in the creation of labels only if the `.dynamic` section
was available.
`JumpTargetManager::purgeTranslation` deletes some basic blocks that
need to re-translated, however references to some instructions remained
in `OriginalInstructionAddresses`.
* Drop unused argument names from function prototypes
* Make `static` some methods
* Disable some copy constructors
* Fix casing of Doxygen `\file` directives
* Add some casts to make the compiler happy
* Initialize `hasRelocationAddend` for AArch64
* Use references in range-for where possible
* Drop default for `switch` statements covering all the entries of an `enum`
* Make some global variables `static`
* Drop dead functions
LLVM already implements an analogous `mapped_iterator` type in
`STLExtras.h` header. `llvm::mapped_iterator` has been used to
substitute `TransformIterator` in the project so that we don't need to
reinvent the wheel.
Before this commit, the header `revng/Support/DebugHelper.h` could only
be included after explicitly including
`llvm/IR/AssemblyAnnotationWriter.h`, since `DebugHelper.h` used the
LLVM class `AssemblyAnnotationWriter`, that is not defined in
`DebugHelper.h`.
This commit includes `llvm/IR/AssemblyAnnotationWriter.h` directly into
`revng/Support/DebugHelper.h`, which can now be included alone without
compilation errors.
LLVM 9 drops the `TerminatorInst` class. This commit replaces it with
`Instruction` where possible and asserts
`Instruction::isTerminator()`. It also switches from
`TerminatorInst::successors` to `successors(TerminatorInst *)`.
This commit replicates the structure of the install directory into the
build directory in order to simplify the management of RPATHs.
This commit also drop `QEMU_INSTALL_PATH`.
In `PTCDump.cpp` we were using `strncpy` in an invalid fashion: the `n`
argument was exactly the same size of the buffer, which might lead to a
missing NUL-terminator. This commit increases the buffer size by one
byte and initializes it with '\0'.
This bug was reported by `-Wstringop-truncation` of GCC 9.1.0 on a
Release build.
`DropMarkerCalls` used to take an `ArrayRef<StringRef>` as an argument,
however the `ArrayRef` was copied in a class field, leading to a
reference to a temporary array.
This commit switches from `ArrayRef` to `SmallVector`.
When loading a CSV, we sometimes need to mask part of the loaded
value. However, this happened also when the source and target types had
the same size, leading to complex code doing nothing.
This bug has been discovered due to a problem in i386: all the function
calls were identified as indirect.
`CpuLoopFunctionPass` is a pass performing some changes to
`cpu_loop`. Among these, calls to `cpu_*_exec` are replaced with the
value of `exception_index`.
This commit does not directly loads it but computes its address as an
offset from `CPUState`. This commit goes in tandem with the
corresponding QEMU commit which provide `exception_index` as an offset
from `CPUState` instead than from `env`. All of this makes CSAA more
effective.
* Introduce `ShrinkInstructionOperandsPass`: a transformation shrinking
operands and the results of instructions if they are
zero/sign-extended immediately before and after the instruction.
* Introduce `ConstantRangeSet`: similar to `ConstantRange` but allows
disjoint ranges.
* Introduce `MaterializedValue`: a class that can represent a constant
value or a symbol plus offset pair.
* Introduce `DropHelperCallsPass`: a transformation removing calls to
helpers and replacing them with a function call reading the CSVs that
the helper reads and writing the CSVs that the helper writes
(according to CSAA).
* Introduce `DropRangeMetadataPass`: a transformation dropping the
`range` metadata, which, in certain situations, lowers the quality of
the results provided by `LazyValueInfo`.
* Introduce `AdvancedValueInfo`: an analysis exploiting results of
`LazyValueInfo` but collecting them as `ConstantRangeSet` with a
monotone framework. It produces `MaterializedValue`.
* Anticipate linking of helpers: `AVI` requires `CSAA`, which requires
helper functions to be linked in.
* Drop `--no-link`.
* Force x86-64 `DataLayout`.
* Reorganize harvesting to either collect simple literals or go with
(incremental) `AVI`.
* Drop `SET`, `OSRA`, the reaching definition analysis, the
`SimplifyComparisonsPass` and all the sumjump-related code: e now
clone `root`, optimize it and analyze it with `AVI`.
* Temporarily drop the `NoReturnAnalysis`.
* Link `libLLVMInstCombine`, `libLLVMCodeGen` and `libLLVMPasses`.
* Introduce tests for `AdvancedValueInfo`,
`ShrinkInstructionOperandsPass` and `ConstantRangeSet`.
* Fix test results.
* Add `llvm.bswap.i64` and `@pc` to the LLVM template module for unit
tests.
To release memory of a `PTCInstructionList`, we used to call
`ptc_instruction_list_free` only. However, that function does not
release memory. This commit calls `delete` to actually release the
memory and prevent memory from leaking.
Alessandro Di Federico