[PPT] - Reconciling High-Level Optimizations and Low-Level Code in LLVM PowerPoint Presentation

SLIDE 1

Reconciling High-Level Optimizations and Low-Level Code in LLVM

Nuno P. Lopes

OOPSLA’18 Boston

Seoul National Univ. Juneyoung Lee Chung-Kil Hur Zhengyang Liu John Regehr University of Utah Ralf Jung Microsoft Research MPI-SWS

SLIDE 2

Overview

2

PC

C

Low-level Code

SLIDE 3

Overview

2

PC

C

Low-level Code

Allows access via int-to-ptr cast

SLIDE 4

Overview

2

PIR P’IR

High-level Optimizations

PC

C LLVM IR

Low-level Code

Allows access via int-to-ptr cast

SLIDE 5

Overview

2

PIR P’IR

High-level Optimizations

PC

C LLVM IR

Low-level Code

Allows access via int-to-ptr cast Assumes no one can access my local vars

SLIDE 6

Overview

2

PIR P’IR

High-level Optimizations

PC

C LLVM IR

Low-level Code

Allows access via int-to-ptr cast Assumes no one can access my local vars

SLIDE 7

Finding a Good Memory Model

A memory model specifies the behavior of memory operations
As a result, it determines
1. Which low-level programs are valid
2. Which high-level assumptions are valid
A good memory model should make valid both
1. Common low-level programs
2. Common high-level assumptions

3

SLIDE 8

char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(q[0]); }

Memory ≠ Byte Array

4

SLIDE 9

char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(q[0]); }

Memory ≠ Byte Array

4

SLIDE 10

char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(q[0]); }

Memory ≠ Byte Array

4

SLIDE 11

char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(q[0]); }

Memory ≠ Byte Array

4

SLIDE 12

char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(q[0]); } char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(0); }

constant prop.

Memory ≠ Byte Array

4

SLIDE 13

char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(q[0]); } char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(0); }

We use C syntax for LLVM IR code for readability

constant prop.

Memory ≠ Byte Array

4

SLIDE 14

char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(q[0]); } char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(0); }

constant prop.

Memory ≠ Byte Array

4

0x0

Memory:

SLIDE 15

char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(q[0]); } char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(0); }

constant prop.

Memory ≠ Byte Array

4

0x0

Memory:

0x100

0x100

SLIDE 16

char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(q[0]); } char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(0); }

constant prop.

Memory ≠ Byte Array

4

0x0

Memory:

0x100

0x101

0x100 0x101

SLIDE 17

char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(q[0]); } char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(0); }

constant prop.

Memory ≠ Byte Array

4

0x0

Memory:

0x100

0x101

0x100 0x101 true

SLIDE 18

char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(q[0]); } char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(0); }

constant prop.

Memory ≠ Byte Array

4

0x0

Memory:

0x100

0x101

0x100 0x101 0x101 true

SLIDE 19

char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(q[0]); } char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(0); }

constant prop.

Memory ≠ Byte Array

4

0x0

Memory:

0x100

0x101

0x100 0x101 0x101 true

10

SLIDE 20

char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(q[0]); } char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(0); }

constant prop.

Memory ≠ Byte Array

4

0x0

Memory:

0x100

0x101

0x100 0x101 0x101 true

10

SLIDE 21

char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(q[0]); } char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(0); }

constant prop.

Memory ≠ Byte Array

4

0x0

Memory:

0x100

0x101

0x100 0x101 0x101 true

10

SLIDE 22

char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(q[0]); } char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(0); }

constant prop.

Memory ≠ Byte Array

4

0x0

Memory:

0x100

0x101

0x100 0x101 0x101 true

10

Problem

q can be accessed from p by pointer arithmetic

SLIDE 23

char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(q[0]); }

0x100 0x101

0x100

0x101

char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(0); }

constant prop.

Abstract Memory Explains Optimizations

5

0x0

Memory:

SLIDE 24

char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(q[0]); }

(p,0x100) (q,0x101)

0x100

0x101

char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(0); }

constant prop.

Abstract Memory Explains Optimizations

5

0x0

Memory:

p: -

0x100 0x101

q: 0

Provenance Provenance

SLIDE 25

char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(q[0]); }

(p,0x100) (q,0x101)

0x100

0x101

char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(0); }

constant prop.

Abstract Memory Explains Optimizations

5

0x0

Memory:

p: -

0x100

true

0x101

q: 0

Provenance Provenance

SLIDE 26

char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(q[0]); }

(p,0x100) (q,0x101)

0x100

0x101

char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(0); }

constant prop.

Abstract Memory Explains Optimizations

5

0x0

Memory:

p: -

0x100

(p,0x101) true

0x101

q: 0

Provenance Provenance

SLIDE 27

char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(q[0]); }

(p,0x100) (q,0x101)

0x100

0x101

char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(0); }

constant prop.

Abstract Memory Explains Optimizations

5

0x0

Memory:

p: -

0x100

(p,0x101) true

0x101

q: 0

Provenance Provenance

SLIDE 28

char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(q[0]); }

(p,0x100) (q,0x101)

0x100

0x101

char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(0); }

constant prop.

Abstract Memory Explains Optimizations

5

0x0

Memory:

p: -

0x100

(p,0x101) true

0x101

q: 0

Undefined Behavior because p ≠ q Provenance Provenance

SLIDE 29

char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(q[0]); }

(p,0x100) (q,0x101)

0x100

0x101

char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(0); }

constant prop.

Abstract Memory Explains Optimizations

5

0x0

Memory:

p: -

0x100

(p,0x101) true

0x101

q: 0

Undefined Behavior because p ≠ q Provenance Provenance

Principles of UB

1. Compilers assume input programs never raise UB
2. Programmers should not write programs raising UB

SLIDE 30

6

constant prop.

char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(q[0]); } char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(0); }

Miscompilation with Int-Ptr Casting

SLIDE 31

6

constant prop.

char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(q[0]); } char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(0); }

Miscompilation with Int-Ptr Casting

SLIDE 32

6

constant prop.

char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(q[0]); } char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(0); }

Miscompilation with Int-Ptr Casting

char p[1],q[1]={0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(char*)(int)(p+1)=10; print(q[0]); } char p[1],q[1]={0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(char*)iq = 10; print(q[0]); }

int. eq.

prop. cast elim.

SLIDE 33

7

Miscompilation with Int-Ptr Casting

char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(0); } char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(q[0]); } char p[1],q[1]={0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(char*)(int)(p+1)=10; print(q[0]); } char p[1],q[1]={0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(char*)iq = 10; print(q[0]); }

int. eq.

prop.

SLIDE 34

7

Miscompilation with Int-Ptr Casting

char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(0); } char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(q[0]); } char p[1],q[1]={0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(char*)(int)(p+1)=10; print(q[0]); } char p[1],q[1]={0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(char*)iq = 10; print(q[0]); }

int. eq.

prop.

SLIDE 35

7

Miscompilation with Int-Ptr Casting

char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(0); } char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(q[0]); } char p[1],q[1]={0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(char*)(int)(p+1)=10; print(q[0]); } char p[1],q[1]={0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(char*)iq = 10; print(q[0]); }

int. eq.

prop.

SLIDE 36

7

Miscompilation with Int-Ptr Casting

char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(0); } char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(q[0]); } char p[1],q[1]={0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(char*)(int)(p+1)=10; print(q[0]); } char p[1],q[1]={0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(char*)iq = 10; print(q[0]); }

cast elim.

SLIDE 37

7

Miscompilation with Int-Ptr Casting

char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(0); } char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(q[0]); } char p[1],q[1]={0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(char*)(int)(p+1)=10; print(q[0]); } char p[1],q[1]={0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(char*)iq = 10; print(q[0]); }

constant prop.

SLIDE 38

7

Miscompilation with Int-Ptr Casting

char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(0); } char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(q[0]); } char p[1],q[1]={0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(char*)(int)(p+1)=10; print(q[0]); } char p[1],q[1]={0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(char*)iq = 10; print(q[0]); }

10

SLIDE 39

7

Miscompilation with Int-Ptr Casting

char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(0); } char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(q[0]); } char p[1],q[1]={0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(char*)(int)(p+1)=10; print(q[0]); } char p[1],q[1]={0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(char*)iq = 10; print(q[0]); }

10

SLIDE 40

7

Miscompilation with Int-Ptr Casting

char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(0); } char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(q[0]); } char p[1],q[1]={0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(char*)(int)(p+1)=10; print(q[0]); } char p[1],q[1]={0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(char*)iq = 10; print(q[0]); }

10

SLIDE 41

7

Miscompilation with Int-Ptr Casting

char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(0); } char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(q[0]); } char p[1],q[1]={0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(char*)(int)(p+1)=10; print(q[0]); } char p[1],q[1]={0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(char*)iq = 10; print(q[0]); }

10

We found this miscompilation bug in both LLVM & GCC

SLIDE 42

7

Miscompilation with Int-Ptr Casting

char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(0); } char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(q[0]); } char p[1],q[1]={0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(char*)(int)(p+1)=10; print(q[0]); } char p[1],q[1]={0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(char*)iq = 10; print(q[0]); }

10

Goal of this paper Finding a good memory model for pointer ↔ integer casting We found this miscompilation bug in both LLVM & GCC

SLIDE 43

Problems & Our Solutions

8

SLIDE 44

Problem 1

9

SLIDE 45

Pointer → Integer Casting?

10

(int)p

SLIDE 46

Pointer → Integer Casting?

10

(int)p

(p,0x100)

SLIDE 47

Pointer → Integer Casting?

10

(int)p

(p,0x100)

SLIDE 48

Pointer → Integer Casting?

10

(int)p

(p,0x100) (p,0x100)

1. Carry

Provenance

SLIDE 49

Pointer → Integer Casting?

10

(int)p

(p,0x100) 0x100 (p,0x100)

2. Drop

Provenance

1. Carry

Provenance

SLIDE 50

Pointer → Integer Casting?

10

(int)p

(p,0x100) 0x100 (p,0x100)

2. Drop

Provenance

1. Carry

Provenance

SLIDE 51

Pointer → Integer Casting?

10

(int)p

(p,0x100) 0x100 (p,0x100)

2. Drop

Provenance

1. Carry

Provenance

SLIDE 52

k = (i==j ? i : j)

Carry Provenance: Integer Optimization Problem

11

k = j

1. Carry Provenance

SLIDE 53

k = (i==j ? i : j)

Carry Provenance: Integer Optimization Problem

11

k = j true

1. Carry Provenance

SLIDE 54

k = (i==j ? i : j)

Carry Provenance: Integer Optimization Problem

11

k = j true

1. Carry Provenance

i

SLIDE 55

k = (i==j ? i : j)

Carry Provenance: Integer Optimization Problem

11

k = j true

1. Carry Provenance

j

SLIDE 56

k = (i==j ? i : j)

Carry Provenance: Integer Optimization Problem

11

k = j

1. Carry Provenance

false

SLIDE 57

k = (i==j ? i : j)

Carry Provenance: Integer Optimization Problem

11

k = j

1. Carry Provenance

false j

SLIDE 58

k = (i==j ? i : j)

Carry Provenance: Integer Optimization Problem

11

k = j

1. Carry Provenance

j

SLIDE 59

k = (i==j ? i : j)

Carry Provenance: Integer Optimization Problem

11

k = j (p,0x100)

1. Carry Provenance

SLIDE 60

k = (i==j ? i : j)

Carry Provenance: Integer Optimization Problem

11

k = j (q,0x100) (p,0x100)

1. Carry Provenance

SLIDE 61

k = (i==j ? i : j)

Carry Provenance: Integer Optimization Problem

11

k = j true (q,0x100) (p,0x100)

1. Carry Provenance

SLIDE 62

k = (i==j ? i : j)

Carry Provenance: Integer Optimization Problem

11

k = j true (q,0x100) (p,0x100)

1. Carry Provenance

SLIDE 63

k = (i==j ? i : j)

Carry Provenance: Integer Optimization Problem

11

k = j true (q,0x100) (q,0x100) (p,0x100)

1. Carry Provenance

SLIDE 64

k = (i==j ? i : j)

Carry Provenance: Integer Optimization Problem

11

k = j true (q,0x100) (q,0x100) (p,0x100)

1. Carry Provenance

Problem

Integer optimizations may change provenance

SLIDE 65

k = (i==j ? i : j)

Carry Provenance: Integer Optimization Problem

12

k = j

2. Drop Provenance

true (q,0x100) (q,0x100) (p,0x100)

SLIDE 66

k = (i==j ? i : j)

Carry Provenance: Integer Optimization Problem

12

k = j

2. Drop Provenance

true (q,0x100) (q,0x100) (p,0x100) 0x100 0x100 0x100

SLIDE 67

Problem 2

13

SLIDE 68

(int*)0x100

Integer → Pointer Casting?

14

char p[1]

0x100

Memory:

SLIDE 69

(int*)0x100

Integer → Pointer Casting?

14

char p[1]

0x100

(Ø,0x100)

1. Always Empty

Memory:

SLIDE 70

(int*)0x100

Integer → Pointer Casting?

14

char p[1]

0x100

(Ø,0x100)

1. Always Empty

Memory:

2. Depending on

the Memory Layout

SLIDE 71

(int*)0x100

(Ø,0x100)

Integer → Pointer Casting?

14

0x100

(Ø,0x100)

1. Always Empty

Memory:

2. Depending on

the Memory Layout

SLIDE 72

(int*)0x100

(p,0x100)

Integer → Pointer Casting?

14

char p[1]

0x100

(Ø,0x100)

1. Always Empty

Memory:

2. Depending on

the Memory Layout

SLIDE 73

(int*)0x100

(p,0x100)

Integer → Pointer Casting?

14

char p[1]

0x100

(Ø,0x100) (∗,0x100)

1. Always Empty
3. Always Full

Memory:

2. Depending on

the Memory Layout

SLIDE 74

(int*)0x100

(p,0x100)

Integer → Pointer Casting?

14

char p[1]

0x100

(Ø,0x100) (∗,0x100)

1. Always Empty
3. Always Full

Memory:

2. Depending on

the Memory Layout

SLIDE 75

(int*)0x100

(p,0x100)

Integer → Pointer Casting?

14

char p[1]

0x100

(Ø,0x100) (∗,0x100)

1. Always Empty
3. Always Full

Memory:

2. Depending on

the Memory Layout

SLIDE 76

1. Always Empty

Empty Provenance: Pointer – Integer Round Trip

15

i = (int)p p2 = (char*)i *p2 = 10

char p[1]

0x100

Memory:

SLIDE 77

1. Always Empty

Empty Provenance: Pointer – Integer Round Trip

15

i = (int)p p2 = (char*)i *p2 = 10

char p[1]

0x100

Memory:

(p,0x100)

SLIDE 78

1. Always Empty

Empty Provenance: Pointer – Integer Round Trip

15

i = (int)p p2 = (char*)i *p2 = 10

char p[1]

0x100

Memory:

0x100 (p,0x100)

SLIDE 79

1. Always Empty

Empty Provenance: Pointer – Integer Round Trip

15

i = (int)p p2 = (char*)i *p2 = 10

(∅,0x100) char p[1]

0x100

Memory:

0x100 (p,0x100)

SLIDE 80

1. Always Empty

Empty Provenance: Pointer – Integer Round Trip

15

i = (int)p p2 = (char*)i *p2 = 10

(∅,0x100)

UB

char p[1]

0x100

Memory:

0x100 (p,0x100)

SLIDE 81

1. Always Empty

Empty Provenance: Pointer – Integer Round Trip

15

i = (int)p p2 = (char*)i *p2 = 10

(∅,0x100)

UB

char p[1]

0x100

Memory:

0x100 (p,0x100)

Problem Common program patterns raise UB

SLIDE 82

Empty Provenance: Pointer – Integer Round Trip

16

i = (int)p p2 = (char*)i *p2 = 10

(∅,0x100)

UB

char p[1]

0x100

Memory:

0x100

3. Always Full

(p,0x100)

SLIDE 83

Empty Provenance: Pointer – Integer Round Trip

16

i = (int)p p2 = (char*)i *p2 = 10

(∅,0x100)

UB

char p[1]

0x100

Memory:

0x100

3. Always Full

(∗,0x100) (p,0x100)

SLIDE 84

Empty Provenance: Pointer – Integer Round Trip

16

i = (int)p p2 = (char*)i *p2 = 10

(∅,0x100) char p[1]

0x100

Memory:

0x100

3. Always Full

(∗,0x100) (p,0x100) 10

SLIDE 85

(int*)0x100

Integer → Pointer Casting?

17

char p[1]

0x100

(Ø,0x100) (∗,0x100)

1. Always Empty
3. Always Full

(p,0x100)

Memory:

(p,0x100)

2. Depending on

the Memory Layout

SLIDE 86

(int*)0x100

Integer → Pointer Casting?

17

char p[1]

0x100

(Ø,0x100) (∗,0x100)

1. Always Empty
3. Always Full

(p,0x100)

Memory:

(p,0x100)

2. Depending on

the Memory Layout

SLIDE 87

2. Depending on the Memory Layout

Depending on the Memory Layout: Reordering

18

char *p = malloc(1) q = (int*)0x100 q = (int*)0x100 char *p = malloc(1)

char p[1]

0x100

Memory:

SLIDE 88

2. Depending on the Memory Layout

Depending on the Memory Layout: Reordering

18

char *p = malloc(1) q = (int*)0x100 q = (int*)0x100 char *p = malloc(1)

char p[1]

0x100

Memory:

SLIDE 89

2. Depending on the Memory Layout

Depending on the Memory Layout: Reordering

18

char *p = malloc(1) q = (int*)0x100 q = (int*)0x100 char *p = malloc(1)

(p,0x100) char p[1]

0x100

Memory:

SLIDE 90

2. Depending on the Memory Layout

Depending on the Memory Layout: Reordering

18

char *p = malloc(1) q = (int*)0x100 q = (int*)0x100 char *p = malloc(1)

(p,0x100)

0x100

Memory:

SLIDE 91

2. Depending on the Memory Layout

Depending on the Memory Layout: Reordering

18

char *p = malloc(1) q = (int*)0x100 q = (int*)0x100 char *p = malloc(1)

(p,0x100) (Ø,0x100)

0x100

Memory:

SLIDE 92

2. Depending on the Memory Layout

Depending on the Memory Layout: Reordering

18

char *p = malloc(1) q = (int*)0x100 q = (int*)0x100 char *p = malloc(1)

(p,0x100) (Ø,0x100)

0x100

Memory:

Problem Movement of casts, or functions including them, is restricted

SLIDE 93

3. Always Full

q = (int*)0x100 char *p = malloc(1)

Depending on the Memory Layout: Reordering

19

char *p = malloc(1) q = (int*)0x100

(p,0x100) char p[1]

0x100

Memory:

(Ø,0x100)

SLIDE 94

3. Always Full

q = (int*)0x100 char *p = malloc(1)

Depending on the Memory Layout: Reordering

19

char *p = malloc(1) q = (int*)0x100

(p,0x100) char p[1]

0x100

Memory:

(∗,0x100) (Ø,0x100) (∗,0x100)

SLIDE 95

Problem 3

20

SLIDE 96

Problems with Full Provenance

21

char p[1] = {0}; f(); print(p[0]);

Anyone can modify other’s local variables by

1. Guessing their addresses &
2. Acquiring full provenance via casting

SLIDE 97

Problems with Full Provenance

21

char p[1] = {0}; f(); print(p[0]);

Anyone can modify other’s local variables by

1. Guessing their addresses &
2. Acquiring full provenance via casting

char p[1] = {0}; f(); print(0);

constant prop.

SLIDE 98

Problems with Full Provenance

21

char p[1] = {0}; f(); print(p[0]);

(p,0x100)

Anyone can modify other’s local variables by

1. Guessing their addresses &
2. Acquiring full provenance via casting

char p[1] = {0}; f(); print(0);

constant prop.

SLIDE 99

Problems with Full Provenance

21

char p[1] = {0}; f(); print(p[0]);

(p,0x100)

*(char*)(0x100)=1;

Anyone can modify other’s local variables by

1. Guessing their addresses &
2. Acquiring full provenance via casting

char p[1] = {0}; f(); print(0);

constant prop.

SLIDE 100

Problems with Full Provenance

21

char p[1] = {0}; f(); print(p[0]);

(p,0x100)

*(char*)(0x100)=1;

Anyone can modify other’s local variables by

1. Guessing their addresses &
2. Acquiring full provenance via casting

(∗,0x100)

char p[1] = {0}; f(); print(0);

constant prop.

Full Provenance

SLIDE 101

Problems with Full Provenance

21

char p[1] = {0}; f(); print(p[0]);

(p,0x100)

*(char*)(0x100)=1;

Anyone can modify other’s local variables by

1. Guessing their addresses &
2. Acquiring full provenance via casting

(∗,0x100)

char p[1] = {0}; f(); print(0);

constant prop.

Guessing Full Provenance

SLIDE 102

Problems with Full Provenance

21

char p[1] = {0}; f(); print(p[0]);

(p,0x100)

1

*(char*)(0x100)=1;

Anyone can modify other’s local variables by

1. Guessing their addresses &
2. Acquiring full provenance via casting

(∗,0x100)

char p[1] = {0}; f(); print(0);

constant prop.

Guessing Full Provenance

SLIDE 103

Our Solution

22

char p[1] = {0}; f(); print(p[0]);

1

constant prop.

Basic Idea Exploit Nondeterministic Allocation

(p,0x100)

*(char*)(0x100)=1;

(∗,0x100)

char p[1] = {0}; f(); print(0);

SLIDE 104

Our Solution

22

char p[1] = {0}; f(); print(p[0]);

1

constant prop.

Basic Idea Exploit Nondeterministic Allocation

Exec. 1
Exec. 2

(p,0x100)

*(char*)(0x100)=1;

(∗,0x100) (p,0x200)

char p[1] = {0}; f(); print(0);

SLIDE 105

Our Solution

22

char p[1] = {0}; f(); print(p[0]);

1

constant prop.

Basic Idea Exploit Nondeterministic Allocation

Exec. 1
Exec. 2

(p,0x100)

*(char*)(0x100)=1;

(∗,0x100) (p,0x200)

char p[1] = {0}; f(); print(0);

SLIDE 106

Our Solution

22

char p[1] = {0}; f(); print(p[0]);

1

constant prop.

Basic Idea Exploit Nondeterministic Allocation

Exec. 1
Exec. 2

(p,0x100)

*(char*)(0x100)=1;

(∗,0x100)

UB in Exec. 2 :

no object at 0x100

(p,0x200)

char p[1] = {0}; f(); print(0);

SLIDE 107

More Formally, Twin Allocation

23

char p[1] = {0}; *(char*)(0x100) = 1; print(p[0]); 0x100

Memory:

0x200

SLIDE 108

More Formally, Twin Allocation

23

char p[1] = {0}; *(char*)(0x100) = 1; print(p[0]); 0x100

Memory:

0x200

SLIDE 109

p

More Formally, Twin Allocation

23

char p[1] = {0}; *(char*)(0x100) = 1; print(p[0]); (p,0x100) 0x100

Memory:

0x200

Exec. 1

SLIDE 110

p p

More Formally, Twin Allocation

23

char p[1] = {0}; *(char*)(0x100) = 1; print(p[0]); (p,0x100) (p,0x200) 0x100

Memory:

0x200

Exec. 1
Exec. 2

SLIDE 111

p p

More Formally, Twin Allocation

23

char p[1] = {0}; *(char*)(0x100) = 1; print(p[0]); (p,0x100) (p,0x200) 0x100

Memory:

0x200

UB in Exec. 2 :

inaccessible at 0x100

Exec. 1
Exec. 2

SLIDE 112

p p

More Formally, Twin Allocation

23

char p[1] = {0}; *(char*)(0x100) = 1; print(p[0]); (p,0x100) (p,0x200) 0x100

Memory:

0x200

UB in Exec. 2 :

inaccessible at 0x100

Exec. 1
Exec. 2

N.B. This argument works only for unobserved addresses

SLIDE 113

char p[1] = {0}; *(char*)(0x100) = 1; print(p[0]);

Example with Observed Address

24

SLIDE 114

char p[1] = {0}; if (p == 0x100){ *(char*)(0x100) = 1; } print(p[0]);

Example with Observed Address

24

SLIDE 115

char p[1] = {0}; if (p == 0x100){ *(char*)(0x100) = 1; } print(p[0]);

Exec. 1
Exec. 2

Example with Observed Address

24

(p,0x100) (p,0x200)

SLIDE 116

char p[1] = {0}; if (p == 0x100){ *(char*)(0x100) = 1; } print(p[0]);

Exec. 1
Exec. 2

Example with Observed Address

24

(p,0x100) (p,0x200)

SLIDE 117

char p[1] = {0}; if (p == 0x100){ *(char*)(0x100) = 1; } print(p[0]);

Exec. 1
Exec. 2

Example with Observed Address

24

(p,0x100) (p,0x200)

No UB in Exec. 2

SLIDE 118

char p[1] = {0}; if (p == 0x100){ *(char*)(0x100) = 1; } print(p[0]);

Exec. 1
Exec. 2

Example with Observed Address

24

(p,0x100) (p,0x200)

Consistent with common compilers’ assumption: Observed variables can be modified by others

No UB in Exec. 2

SLIDE 119

25

Miscompilation Revisited

char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(0); } char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(q[0]); } char p[1],q[1]={0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(char*)(int)(p+1)=10; print(q[0]); } char p[1],q[1]={0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(char*)iq = 10; print(q[0]); }

constant prop.

int. eq.

prop. cast elim.

SLIDE 120

25

Miscompilation Revisited

char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(0); } char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(q[0]); } char p[1],q[1]={0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(char*)(int)(p+1)=10; print(q[0]); } char p[1],q[1]={0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(char*)iq = 10; print(q[0]); }

cast elim.

SLIDE 121

25

Miscompilation Revisited

char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(0); } char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(q[0]); } char p[1],q[1]={0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(char*)(int)(p+1)=10; print(q[0]); } char p[1],q[1]={0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(char*)iq = 10; print(q[0]); }

Can Access q[0] due to Full Prov. cast elim.

SLIDE 122

25

Miscompilation Revisited

char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(0); } char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(q[0]); } char p[1],q[1]={0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(char*)(int)(p+1)=10; print(q[0]); } char p[1],q[1]={0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(char*)iq = 10; print(q[0]); }

Can Access q[0] due to Full Prov. cast elim. Cannot Access q[0] due to Prov. p

SLIDE 123

25

Miscompilation Revisited

char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(0); } char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(q[0]); } char p[1],q[1]={0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(char*)(int)(p+1)=10; print(q[0]); } char p[1],q[1]={0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(char*)iq = 10; print(q[0]); }

Can Access q[0] due to Full Prov. cast elim. Cannot Access q[0] due to Prov. p

Ptr → Int → Ptr Cast Elimination Is Unsound: A Potential Performance Issue

SLIDE 124

Solution to the Cast Elim. Problem

Reducing # of Int ↔ Ptr Casts

Most casts are introduced by compilers for convenience
We recovered performance by reducing unnecessary casts
Int → Ptr: 95% removed
Ptr → Int: 75% removed

26

SLIDE 125

Solution to the Cast Elim. Problem

Reducing # of Int ↔ Ptr Casts

Most casts are introduced by compilers for convenience
We recovered performance by reducing unnecessary casts
Int → Ptr: 95% removed
Ptr → Int: 75% removed

26

The paper includes more details & a formal specification

SLIDE 126

Implementation & Evaluation

We fixed LLVM 6.0 to be sound in our memory model
We had to change only 1.7K LOC in total
Benchmark Results
SPEC CPU2017 : <0.1% avg, <0.5% max slowdown
LLVM Nightly Tests : <0.1% avg , <3% max slowdown
We verified key properties of our memory model in Coq

27

SLIDE 127

Conclusion

We develop a memory model for IR which supports

both low-level code & high-level optimizations

We use full provenance & twin allocation to reconcile them
Applying our model to LLVM has little impact on performance

28