1 /* -*- mode: C; c-basic-offset: 3; -*- */
4 This file is part of MemCheck, a heavyweight Valgrind tool for
5 detecting memory errors.
7 Copyright (C) 2012-2017 Florian Krohm
9 This program is free software; you can redistribute it and/or
10 modify it under the terms of the GNU General Public License as
11 published by the Free Software Foundation; either version 2 of the
12 License, or (at your option) any later version.
14 This program is distributed in the hope that it will be useful, but
15 WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
17 General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program; if not, see <http://www.gnu.org/licenses/>.
22 The GNU General Public License is contained in the file COPYING.
26 #include <string.h> // memset
30 /* A convenience function to compute either v1 & ~v2 & val2 or
31 v1 & ~v2 & ~val2 depending on INVERT_VAL2. */
33 and_combine(vbits_t v1
, vbits_t v2
, value_t val2
, int invert_val2
)
35 assert(v1
.num_bits
== v2
.num_bits
);
37 vbits_t
new = { .num_bits
= v2
.num_bits
};
40 switch (v2
.num_bits
) {
41 case 1: val2
.u1
= ~val2
.u1
& 1; break;
42 case 8: val2
.u8
= ~val2
.u8
& 0xff; break;
43 case 16: val2
.u16
= ~val2
.u16
& 0xffff; break;
44 case 32: val2
.u32
= ~val2
.u32
; break;
45 case 64: val2
.u64
= ~val2
.u64
; break;
51 switch (v2
.num_bits
) {
53 new.bits
.u1
= (v1
.bits
.u1
& ~v2
.bits
.u1
& val2
.u1
) & 1;
56 new.bits
.u8
= (v1
.bits
.u8
& ~v2
.bits
.u8
& val2
.u8
) & 0xff;
59 new.bits
.u16
= (v1
.bits
.u16
& ~v2
.bits
.u16
& val2
.u16
) & 0xffff;
62 new.bits
.u32
= (v1
.bits
.u32
& ~v2
.bits
.u32
& val2
.u32
);
65 new.bits
.u64
= (v1
.bits
.u64
& ~v2
.bits
.u64
& val2
.u64
);
73 /* Check the result of a binary operation. */
75 check_result_for_binary(const irop_t
*op
, const test_data_t
*data
)
77 const opnd_t
*result
= &data
->result
;
78 const opnd_t
*opnd1
= &data
->opnds
[0];
79 const opnd_t
*opnd2
= &data
->opnds
[1];
81 vbits_t expected_vbits
;
83 /* Only handle those undef-kinds that actually occur. */
84 switch (op
->undef_kind
) {
86 expected_vbits
= defined_vbits(result
->vbits
.num_bits
);
90 /* Iop_ShlD64, Iop_ShrD64, Iop_ShlD128, Iop_ShrD128 have
91 * one immediate operand in operand 2.
93 expected_vbits
= undefined_vbits(result
->vbits
.num_bits
);
97 // LEFT with respect to the leftmost 1-bit in both operands
98 expected_vbits
= left_vbits(or_vbits(opnd1
->vbits
, opnd2
->vbits
),
99 result
->vbits
.num_bits
);
103 assert(opnd1
->vbits
.num_bits
== opnd2
->vbits
.num_bits
);
104 assert(opnd1
->vbits
.num_bits
== result
->vbits
.num_bits
);
106 // SAME with respect to the 1-bits in both operands
107 expected_vbits
= or_vbits(opnd1
->vbits
, opnd2
->vbits
);
111 assert(opnd1
->vbits
.num_bits
== opnd2
->vbits
.num_bits
);
112 assert(result
->vbits
.num_bits
== 2 * opnd1
->vbits
.num_bits
);
113 expected_vbits
= concat_vbits(opnd1
->vbits
, opnd2
->vbits
);
117 /* If any bit in the 2nd operand is undefined, so are all bits
119 if (! completely_defined_vbits(opnd2
->vbits
)) {
120 expected_vbits
= undefined_vbits(result
->vbits
.num_bits
);
122 assert(opnd2
->vbits
.num_bits
== 8);
123 unsigned shift_amount
= opnd2
->value
.u8
;
125 expected_vbits
= shl_vbits(opnd1
->vbits
, shift_amount
);
130 /* If any bit in the 2nd operand is undefined, so are all bits
132 if (! completely_defined_vbits(opnd2
->vbits
)) {
133 expected_vbits
= undefined_vbits(result
->vbits
.num_bits
);
135 assert(opnd2
->vbits
.num_bits
== 8);
136 unsigned shift_amount
= opnd2
->value
.u8
;
138 expected_vbits
= shr_vbits(opnd1
->vbits
, shift_amount
);
143 /* If any bit in the 2nd operand is undefined, so are all bits
145 if (! completely_defined_vbits(opnd2
->vbits
)) {
146 expected_vbits
= undefined_vbits(result
->vbits
.num_bits
);
148 assert(opnd2
->vbits
.num_bits
== 8);
149 unsigned shift_amount
= opnd2
->value
.u8
;
151 expected_vbits
= sar_vbits(opnd1
->vbits
, shift_amount
);
156 /* Let v1, v2 be the V-bits of the 1st and 2nd operand, respectively
157 Let b1, b2 be the actual value of the 1st and 2nd operand, respect.
158 And output bit is undefined (i.e. its V-bit == 1), iff
159 (1) (v1 == 1) && (v2 == 1) OR
160 (2) (v1 == 1) && (v2 == 0 && b2 == 1) OR
161 (3) (v2 == 1) && (v1 == 0 && b1 == 1)
163 vbits_t term1
, term2
, term3
;
164 term1
= and_vbits(opnd1
->vbits
, opnd2
->vbits
);
165 term2
= and_combine(opnd1
->vbits
, opnd2
->vbits
, opnd2
->value
, 0);
166 term3
= and_combine(opnd2
->vbits
, opnd1
->vbits
, opnd1
->value
, 0);
167 expected_vbits
= or_vbits(term1
, or_vbits(term2
, term3
));
172 /* Let v1, v2 be the V-bits of the 1st and 2nd operand, respectively
173 Let b1, b2 be the actual value of the 1st and 2nd operand, respect.
174 And output bit is undefined (i.e. its V-bit == 1), iff
175 (1) (v1 == 1) && (v2 == 1) OR
176 (2) (v1 == 1) && (v2 == 0 && b2 == 0) OR
177 (3) (v2 == 1) && (v1 == 0 && b1 == 0)
179 vbits_t term1
, term2
, term3
;
180 term1
= and_vbits(opnd1
->vbits
, opnd2
->vbits
);
181 term2
= and_combine(opnd1
->vbits
, opnd2
->vbits
, opnd2
->value
, 1);
182 term3
= and_combine(opnd2
->vbits
, opnd1
->vbits
, opnd1
->value
, 1);
183 expected_vbits
= or_vbits(term1
, or_vbits(term2
, term3
));
188 /* Set expected_vbits for the Iop_CmpORD category of iops.
189 * If any of the input bits is undefined the least significant
190 * three bits in the result will be set, i.e. 0xe.
192 expected_vbits
= cmpord_vbits(opnd1
->vbits
.num_bits
,
193 opnd2
->vbits
.num_bits
);
196 case UNDEF_CMP_EQ_NE
:
197 expected_vbits
= cmp_eq_ne_vbits(opnd1
->vbits
, opnd2
->vbits
,
198 opnd1
->value
, opnd2
->value
);
202 expected_vbits
= int_add_or_sub_vbits(1/*isAdd*/,
203 opnd1
->vbits
, opnd2
->vbits
,
204 opnd1
->value
, opnd2
->value
);
208 expected_vbits
= int_add_or_sub_vbits(0/*!isAdd*/,
209 opnd1
->vbits
, opnd2
->vbits
,
210 opnd1
->value
, opnd2
->value
);
214 assert(opnd1
->vbits
.num_bits
== opnd2
->vbits
.num_bits
);
216 undefined_vbits_BxE(64, 2,
217 or_vbits(opnd1
->vbits
, opnd2
->vbits
));
221 assert(opnd1
->vbits
.num_bits
== opnd2
->vbits
.num_bits
);
223 undefined_vbits_BxE(32, 4,
224 or_vbits(opnd1
->vbits
, opnd2
->vbits
));
228 assert(opnd1
->vbits
.num_bits
== opnd2
->vbits
.num_bits
);
230 undefined_vbits_BxE(16, 8,
231 or_vbits(opnd1
->vbits
, opnd2
->vbits
));
235 assert(opnd1
->vbits
.num_bits
== opnd2
->vbits
.num_bits
);
237 undefined_vbits_BxE(8, 16,
238 or_vbits(opnd1
->vbits
, opnd2
->vbits
));
241 case UNDEF_ALL_32x4_EVEN
:
242 /* Only even input bytes are used, result can be twice as wide */
243 assert(opnd1
->vbits
.num_bits
== opnd2
->vbits
.num_bits
);
245 undefined_vbits_BxE(64, 2,
246 undefined_vbits_128_even_element(32, 4,
247 or_vbits(opnd1
->vbits
, opnd2
->vbits
)));
250 case UNDEF_ALL_16x8_EVEN
:
251 /* Only even input bytes are used, result can be twice as wide */
252 assert(opnd1
->vbits
.num_bits
== opnd2
->vbits
.num_bits
);
254 undefined_vbits_BxE(32, 4,
255 undefined_vbits_128_even_element(16, 8,
256 or_vbits(opnd1
->vbits
, opnd2
->vbits
)));
259 case UNDEF_ALL_8x16_EVEN
:
260 /* Only even input bytes are used, result can be twice as wide */
261 assert(opnd1
->vbits
.num_bits
== opnd2
->vbits
.num_bits
);
263 undefined_vbits_BxE(16, 8,
264 undefined_vbits_128_even_element(8, 16,
265 or_vbits(opnd1
->vbits
, opnd2
->vbits
)));
268 case UNDEF_64x2_ROTATE
:
269 /* Rotate left each element in opnd1 by the amount in the corresponding
272 assert(opnd1
->vbits
.num_bits
== opnd2
->vbits
.num_bits
);
273 /* Setup the tmp to match what the vbit tester seems to use. I can't
274 * use opnd2-value since valgrind doesn't think it has been set.
276 tmp
.value
.u128
[0] = -1;
277 tmp
.value
.u128
[1] = -1;
278 /* Calculate expected for the first operand when it is shifted.
279 * If any of the vbits are set for the shift field of the second operand
280 * then the result of the expected result for that element is all 1's.
282 expected_vbits
= or_vbits(undefined_vbits_BxE_rotate(64, 2, opnd1
->vbits
,
284 undefined_vbits_BxE(64, 2, opnd2
->vbits
));
287 case UNDEF_32x4_ROTATE
:
288 /* Rotate left each element in opnd1 by the amount in the corresponding
291 assert(opnd1
->vbits
.num_bits
== opnd2
->vbits
.num_bits
);
292 expected_vbits
= undefined_vbits_BxE_rotate(32, 4, opnd1
->vbits
,
296 case UNDEF_16x8_ROTATE
:
297 /* Rotate left each element in opnd1 by the amount in the corresponding
300 assert(opnd1
->vbits
.num_bits
== opnd2
->vbits
.num_bits
);
301 expected_vbits
= undefined_vbits_BxE_rotate(16, 8, opnd1
->vbits
,
305 case UNDEF_8x16_ROTATE
:
306 /* Rotate left each element in opnd1 by the amount in the corresponding
309 assert(opnd1
->vbits
.num_bits
== opnd2
->vbits
.num_bits
);
310 expected_vbits
= undefined_vbits_BxE_rotate(16, 8, opnd1
->vbits
,
315 /* The result for the Iop_SHA256 and Iop_SHA256 is a secure hash. If
316 * one of the input bits is not defined there must be atleast one
317 * undefined bit in the output. Which bit and how many depends on
318 * which bit is undefined. Don't know the secure hash algorithm so
319 * we can only make sure at least one of the result bits is set.
321 * The Iop_SHA256, Iop_SHA512 iops have one immediate value in the
324 expected_vbits
.num_bits
= result
->vbits
.num_bits
;
326 if ((result
->vbits
.bits
.u128
[0] != 0) ||
327 (result
->vbits
.bits
.u128
[1] != 0)) {
328 expected_vbits
.bits
.u128
[0] = result
->vbits
.bits
.u128
[0];
329 expected_vbits
.bits
.u128
[1] = result
->vbits
.bits
.u128
[1];
332 /* The input had at least one vbit set but the result doesn't have any
333 * bit set. Set them all so we will trigger the error on the call
336 expected_vbits
.bits
.u128
[0] = ~0x0ULL
;
337 expected_vbits
.bits
.u128
[1] = ~0x0ULL
;
341 case UNDEF_NARROW256_AtoB
:
342 assert(opnd1
->vbits
.num_bits
== opnd2
->vbits
.num_bits
);
344 case Iop_NarrowBin64to32x4
:
346 undefined_vbits_Narrow256_AtoB(64, 32, opnd1
->vbits
, opnd1
->value
,
347 opnd2
->vbits
, opnd2
->value
,
350 case Iop_QNarrowBin64Sto32Sx4
:
352 undefined_vbits_Narrow256_AtoB(64, 32, opnd1
->vbits
, opnd1
->value
,
353 opnd2
->vbits
, opnd2
->value
,
356 case Iop_QNarrowBin64Uto32Ux4
:
358 undefined_vbits_Narrow256_AtoB(64, 32, opnd1
->vbits
, opnd1
->value
,
359 opnd2
->vbits
, opnd2
->value
,
363 fprintf(stderr
, "ERROR, unknown Iop for UNDEF_NARROW256_AtoB\n");
372 if (! equal_vbits(result
->vbits
, expected_vbits
))
373 complain(op
, data
, expected_vbits
);
378 test_shift(const irop_t
*op
, test_data_t
*data
)
380 unsigned num_input_bits
, i
;
381 opnd_t
*opnds
= data
->opnds
;
384 /* When testing the 1st operand's undefinedness propagation,
385 do so with all possible shift amnounts */
386 for (unsigned amount
= 0; amount
< bitsof_irtype(opnds
[0].type
); ++amount
) {
387 opnds
[1].value
.u8
= amount
;
389 // 1st (left) operand
390 num_input_bits
= bitsof_irtype(opnds
[0].type
);
392 for (i
= 0; i
< num_input_bits
; ++i
) {
393 opnds
[0].vbits
= onehot_vbits(i
, bitsof_irtype(opnds
[0].type
));
394 opnds
[1].vbits
= defined_vbits(bitsof_irtype(opnds
[1].type
));
396 valgrind_execute_test(op
, data
);
398 check_result_for_binary(op
, data
);
403 // 2nd (right) operand
405 /* If the operand is an immediate value, there are no v-bits to set. */
406 if (!op
->immediate_index
) return tests_done
;
408 num_input_bits
= bitsof_irtype(opnds
[1].type
);
410 for (i
= 0; i
< num_input_bits
; ++i
) {
411 opnds
[0].vbits
= defined_vbits(bitsof_irtype(opnds
[0].type
));
412 opnds
[1].vbits
= onehot_vbits(i
, bitsof_irtype(opnds
[1].type
));
414 valgrind_execute_test(op
, data
);
416 check_result_for_binary(op
, data
);
425 all_bits_zero_value(unsigned num_bits
)
430 case 1: val
.u1
= 0; break;
431 case 8: val
.u8
= 0; break;
432 case 16: val
.u16
= 0; break;
433 case 32: val
.u32
= 0; break;
434 case 64: val
.u64
= 0; break;
443 all_bits_one_value(unsigned num_bits
)
448 case 1: val
.u1
= 1; break;
449 case 8: val
.u8
= 0xff; break;
450 case 16: val
.u16
= 0xffff; break;
451 case 32: val
.u32
= ~0u; break;
452 case 64: val
.u64
= ~0ull; break;
461 test_and(const irop_t
*op
, test_data_t
*data
)
463 unsigned num_input_bits
, bitpos
;
464 opnd_t
*opnds
= data
->opnds
;
467 /* Undefinedness does not propagate if the other operand is 0.
468 Use an all-bits-zero operand and test the other operand in
469 the usual way (one bit undefined at a time). */
471 // 1st (left) operand variable, 2nd operand all-bits-zero
472 num_input_bits
= bitsof_irtype(opnds
[0].type
);
474 for (bitpos
= 0; bitpos
< num_input_bits
; ++bitpos
) {
475 opnds
[0].vbits
= onehot_vbits(bitpos
, bitsof_irtype(opnds
[0].type
));
476 opnds
[1].vbits
= defined_vbits(bitsof_irtype(opnds
[1].type
));
477 opnds
[1].value
= all_bits_zero_value(bitsof_irtype(opnds
[1].type
));
479 valgrind_execute_test(op
, data
);
481 check_result_for_binary(op
, data
);
485 // 2nd (right) operand variable, 1st operand all-bits-zero
486 num_input_bits
= bitsof_irtype(opnds
[1].type
);
488 for (bitpos
= 0; bitpos
< num_input_bits
; ++bitpos
) {
489 opnds
[1].vbits
= onehot_vbits(bitpos
, bitsof_irtype(opnds
[1].type
));
490 opnds
[0].vbits
= defined_vbits(bitsof_irtype(opnds
[0].type
));
491 opnds
[0].value
= all_bits_zero_value(bitsof_irtype(opnds
[0].type
));
493 valgrind_execute_test(op
, data
);
495 check_result_for_binary(op
, data
);
499 /* Undefinedness propagates if the other operand is 1.
500 Use an all-bits-one operand and test the other operand in
501 the usual way (one bit undefined at a time). */
503 // 1st (left) operand variable, 2nd operand all-bits-one
504 num_input_bits
= bitsof_irtype(opnds
[0].type
);
506 for (bitpos
= 0; bitpos
< num_input_bits
; ++bitpos
) {
507 opnds
[0].vbits
= onehot_vbits(bitpos
, bitsof_irtype(opnds
[0].type
));
508 opnds
[1].vbits
= defined_vbits(bitsof_irtype(opnds
[1].type
));
509 opnds
[1].value
= all_bits_one_value(bitsof_irtype(opnds
[1].type
));
511 valgrind_execute_test(op
, data
);
513 check_result_for_binary(op
, data
);
517 // 2nd (right) operand variable, 1st operand all-bits-one
518 num_input_bits
= bitsof_irtype(opnds
[1].type
);
520 for (bitpos
= 0; bitpos
< num_input_bits
; ++bitpos
) {
521 opnds
[1].vbits
= onehot_vbits(bitpos
, bitsof_irtype(opnds
[1].type
));
522 opnds
[0].vbits
= defined_vbits(bitsof_irtype(opnds
[0].type
));
523 opnds
[0].value
= all_bits_one_value(bitsof_irtype(opnds
[0].type
));
525 valgrind_execute_test(op
, data
);
527 check_result_for_binary(op
, data
);
535 test_or(const irop_t
*op
, test_data_t
*data
)
537 unsigned num_input_bits
, bitpos
;
538 opnd_t
*opnds
= data
->opnds
;
541 /* Undefinedness does not propagate if the other operand is 1.
542 Use an all-bits-one operand and test the other operand in
543 the usual way (one bit undefined at a time). */
545 // 1st (left) operand variable, 2nd operand all-bits-one
546 num_input_bits
= bitsof_irtype(opnds
[0].type
);
548 opnds
[0].vbits
= defined_vbits(bitsof_irtype(opnds
[0].type
));
549 opnds
[1].vbits
= defined_vbits(bitsof_irtype(opnds
[1].type
));
550 opnds
[1].value
= all_bits_one_value(bitsof_irtype(opnds
[1].type
));
552 for (bitpos
= 0; bitpos
< num_input_bits
; ++bitpos
) {
553 opnds
[0].vbits
= onehot_vbits(bitpos
, bitsof_irtype(opnds
[0].type
));
555 valgrind_execute_test(op
, data
);
557 check_result_for_binary(op
, data
);
561 // 2nd (right) operand variable, 1st operand all-bits-one
562 num_input_bits
= bitsof_irtype(opnds
[1].type
);
564 opnds
[0].vbits
= defined_vbits(bitsof_irtype(opnds
[0].type
));
565 opnds
[1].vbits
= defined_vbits(bitsof_irtype(opnds
[1].type
));
566 opnds
[0].value
= all_bits_one_value(bitsof_irtype(opnds
[0].type
));
568 for (bitpos
= 0; bitpos
< num_input_bits
; ++bitpos
) {
569 opnds
[1].vbits
= onehot_vbits(bitpos
, bitsof_irtype(opnds
[1].type
));
571 valgrind_execute_test(op
, data
);
573 check_result_for_binary(op
, data
);
577 /* Undefinedness propagates if the other operand is 0.
578 Use an all-bits-zero operand and test the other operand in
579 the usual way (one bit undefined at a time). */
581 // 1st (left) operand variable, 2nd operand all-bits-zero
582 num_input_bits
= bitsof_irtype(opnds
[0].type
);
584 opnds
[0].vbits
= defined_vbits(bitsof_irtype(opnds
[0].type
));
585 opnds
[1].vbits
= defined_vbits(bitsof_irtype(opnds
[1].type
));
586 opnds
[1].value
= all_bits_zero_value(bitsof_irtype(opnds
[1].type
));
588 for (bitpos
= 0; bitpos
< num_input_bits
; ++bitpos
) {
589 opnds
[0].vbits
= onehot_vbits(bitpos
, bitsof_irtype(opnds
[0].type
));
591 valgrind_execute_test(op
, data
);
593 check_result_for_binary(op
, data
);
597 // 2nd (right) operand variable, 1st operand all-bits-zero
598 num_input_bits
= bitsof_irtype(opnds
[1].type
);
600 opnds
[0].vbits
= defined_vbits(bitsof_irtype(opnds
[0].type
));
601 opnds
[1].vbits
= defined_vbits(bitsof_irtype(opnds
[1].type
));
602 opnds
[0].value
= all_bits_zero_value(bitsof_irtype(opnds
[0].type
));
604 for (bitpos
= 0; bitpos
< num_input_bits
; ++bitpos
) {
605 opnds
[1].vbits
= onehot_vbits(bitpos
, bitsof_irtype(opnds
[1].type
));
607 valgrind_execute_test(op
, data
);
609 check_result_for_binary(op
, data
);
617 test_binary_op(const irop_t
*op
, test_data_t
*data
)
619 unsigned num_input_bits
, i
, bitpos
;
620 opnd_t
*opnds
= data
->opnds
;
623 /* Handle special cases upfront */
624 switch (op
->undef_kind
) {
628 return test_shift(op
, data
);
631 return test_and(op
, data
);
634 return test_or(op
, data
);
640 /* For each operand, set a single bit to undefined and observe how
641 that propagates to the output. Do this for all bits in each
643 for (i
= 0; i
< 2; ++i
) {
645 /* If this is a Iop that requires an immediate amount,
646 do not iterate the v-bits of the operand */
647 if (((i
+1) == op
->immediate_index
)
648 && (op
->immediate_index
)) break;
650 num_input_bits
= bitsof_irtype(opnds
[i
].type
);
651 opnds
[0].vbits
= defined_vbits(bitsof_irtype(opnds
[0].type
));
652 opnds
[1].vbits
= defined_vbits(bitsof_irtype(opnds
[1].type
));
654 /* Set the value of the 2nd operand to something != 0. So division
656 memset(&opnds
[1].value
, 0xff, sizeof opnds
[1].value
);
658 /* For immediate shift amounts choose a value of '1'. That value should
659 not cause a problem. Note: we always assign to the u64 member here.
660 The reason is that in ir_inject.c the value_t type is not visible.
661 The value is picked up there by interpreting the memory as an
662 ULong value. So, we rely on
664 ULong v1; // value picked up in ir_inject.c
665 value_t v2; // value assigned here
667 assert(sizeof xx.v1 == sizeof xx.v2.u64);
668 assert(xx.v1 == xx.v2.u64);
671 if (op
->immediate_index
> 0) {
672 assert((op
->immediate_type
== Ity_I8
)
673 || (op
->immediate_type
== Ity_I16
)
674 || (op
->immediate_type
== Ity_I32
));
675 opnds
[1].value
.u64
= 1;
678 for (bitpos
= 0; bitpos
< num_input_bits
; ++bitpos
) {
679 opnds
[i
].vbits
= onehot_vbits(bitpos
, bitsof_irtype(opnds
[i
].type
));
681 valgrind_execute_test(op
, data
);
683 check_result_for_binary(op
, data
);