safely optimizing casts between
play

Safely Optimizing Casts between Pointers and Integers Juneyoung Lee - PowerPoint PPT Presentation

Jan 18, 2023 •2.54k likes •3.34k views

EuroLLVM19 SRC Safely Optimizing Casts between Pointers and Integers Juneyoung Lee Seoul National Univ. Chung-Kil Hur MPI-SWS Ralf Jung Zhengyang Liu University of Utah John Regehr Nuno P. Lopes Microsoft Research 1 Overview

  1. EuroLLVM’19 SRC Safely Optimizing Casts between Pointers and Integers Juneyoung Lee Seoul National Univ. Chung-Kil Hur MPI-SWS Ralf Jung Zhengyang Liu University of Utah John Regehr Nuno P. Lopes Microsoft Research 1

  2. Overview Assembly LLVM IR (x86-64, ARM, ..) [0, 2 64 ) [0, 2 64 ) + provenance Pointer [0, 2 64 ) [0, 2 64 ) + ? Integer 2

  3. Problem: Pointer as a Pure Integer We use C syntax for LLVM IR code for readability char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(q[0]); } * https://godbolt.org/z/9eNt6w 3

  4. Problem: Pointer as a Pure Integer We use C syntax for LLVM IR code for readability char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(q[0]); } * https://godbolt.org/z/9eNt6w 3

  5. Problem: Pointer as a Pure Integer We use C syntax for LLVM IR code for readability char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(q[0]); } * https://godbolt.org/z/9eNt6w 3

  6. Problem: Pointer as a Pure Integer We use C syntax for LLVM IR code for readability char p[1],q[1] = {0}; int ip = (int)(p+1); int iq = (int)q; if (iq == ip) { *(p+1) = 10; print(q[0]); } * https://godbolt.org/z/9eNt6w 3

  7. Problem: Pointer as a Pure Integer We use C syntax for LLVM IR code for readability char p[1],q[1] = {0}; char p[1],q[1] = {0}; int ip = (int)(p+1); int ip = (int)(p+1); int iq = (int)q; int iq = (int)q; if (iq == ip) { if (iq == ip) { *(p+1) = 10; *(p+1) = 10; constant print(q[0]); print(0); } prop. } * https://godbolt.org/z/9eNt6w 3

  8. Problem: Pointer as a Pure Integer Memory: 0x0 char p[1],q[1] = {0}; char p[1],q[1] = {0}; int ip = (int)(p+1); int ip = (int)(p+1); int iq = (int)q; int iq = (int)q; if (iq == ip) { if (iq == ip) { *(p+1) = 10; *(p+1) = 10; constant print(q[0]); print(0); } prop. } * https://godbolt.org/z/9eNt6w 3

  9. Problem: Pointer as a Pure Integer - Memory: 0x0 0x100 0x100 char p[1],q[1] = {0}; char p[1],q[1] = {0}; int ip = (int)(p+1); int ip = (int)(p+1); int iq = (int)q; int iq = (int)q; if (iq == ip) { if (iq == ip) { *(p+1) = 10; *(p+1) = 10; constant print(q[0]); print(0); } prop. } * https://godbolt.org/z/9eNt6w 3

  10. Problem: Pointer as a Pure Integer 0 - Memory: 0x0 0x100 0x101 0x100 0x101 char p[1],q[1] = {0}; char p[1],q[1] = {0}; int ip = (int)(p+1); int ip = (int)(p+1); int iq = (int)q; int iq = (int)q; if (iq == ip) { if (iq == ip) { *(p+1) = 10; *(p+1) = 10; constant print(q[0]); print(0); } prop. } * https://godbolt.org/z/9eNt6w 3

  11. Problem: Pointer as a Pure Integer 0 - Memory: 0x0 0x100 0x101 0x100 0x101 char p[1],q[1] = {0}; char p[1],q[1] = {0}; int ip = (int)(p+1); int ip = (int)(p+1); int iq = (int)q; int iq = (int)q; true if (iq == ip) { if (iq == ip) { *(p+1) = 10; *(p+1) = 10; constant print(q[0]); print(0); } prop. } * https://godbolt.org/z/9eNt6w 3

  12. Problem: Pointer as a Pure Integer 0 - Memory: 0x0 0x100 0x101 0x100 0x101 char p[1],q[1] = {0}; char p[1],q[1] = {0}; int ip = (int)(p+1); int ip = (int)(p+1); 0x101 int iq = (int)q; int iq = (int)q; true if (iq == ip) { if (iq == ip) { *(p+1) = 10; *(p+1) = 10; constant print(q[0]); print(0); } prop. } * https://godbolt.org/z/9eNt6w 3

  13. Problem: Pointer as a Pure Integer 0 - 10 Memory: 0x0 0x100 0x101 0x100 0x101 char p[1],q[1] = {0}; char p[1],q[1] = {0}; int ip = (int)(p+1); int ip = (int)(p+1); 0x101 int iq = (int)q; int iq = (int)q; true if (iq == ip) { if (iq == ip) { *(p+1) = 10; *(p+1) = 10; constant print(q[0]); print(0); } prop. } * https://godbolt.org/z/9eNt6w 3

  14. Problem: Pointer as a Pure Integer 0 - 10 Memory: 0x0 0x100 0x101 0x100 0x101 char p[1],q[1] = {0}; char p[1],q[1] = {0}; int ip = (int)(p+1); int ip = (int)(p+1); 0x101 int iq = (int)q; int iq = (int)q; true if (iq == ip) { if (iq == ip) { *(p+1) = 10; *(p+1) = 10; constant print(q[0]); print(0); } prop. } * https://godbolt.org/z/9eNt6w 3

  15. Problem: Pointer as a Pure Integer 0 - 10 Memory: 0x0 0x100 0x101 0x100 0x101 char p[1],q[1] = {0}; char p[1],q[1] = {0}; int ip = (int)(p+1); int ip = (int)(p+1); 0x101 int iq = (int)q; int iq = (int)q; true if (iq == ip) { if (iq == ip) { *(p+1) = 10; *(p+1) = 10; constant print(q[0]); print(0); } prop. } 10 * https://godbolt.org/z/9eNt6w 3

  16. Problem: Pointer as a Pure Integer 0 - 10 Memory: 0x0 0x100 0x101 0x100 0x101 char p[1],q[1] = {0}; Problem with “pointer as a pure integer” char p[1],q[1] = {0}; int ip = (int)(p+1); int ip = (int)(p+1); 0x101 int iq = (int)q; int iq = (int)q; true if (iq == ip) { if (iq == ip) { Cannot protect accesses from different blocks *(p+1) = 10; *(p+1) = 10; constant print(q[0]); print(0); } prop. } 10 * https://godbolt.org/z/9eNt6w 3

  17. LLVM’s Solution: Pointers have Provenance - 0 0 Memory: 0x0 0x100 0x101 0x100 0x101 char p[1],q[1] = {0}; char p[1],q[1] = {0}; int ip = (int)(p+1); int ip = (int)(p+1); int iq = (int)q; int iq = (int)q; if (iq == ip) { if (iq == ip) { *(p+1) = 10; *(p+1) = 10; constant print(q[0]); print(0); } prop. } * https://godbolt.org/z/9eNt6w 4

  18. LLVM’s Solution: Pointers have Provenance Provenance Provenance - 0 p: - 0 0 q: 0 Memory: 0x0 0x100 0x100 0x101 0x101 (p,0x100) (q,0x101) char p[1],q[1] = {0}; char p[1],q[1] = {0}; int ip = (int)(p+1); int ip = (int)(p+1); int iq = (int)q; int iq = (int)q; if (iq == ip) { if (iq == ip) { *(p+1) = 10; *(p+1) = 10; constant print(q[0]); print(0); } prop. } * https://godbolt.org/z/9eNt6w 4

  19. LLVM’s Solution: Pointers have Provenance Provenance Provenance - 0 p: - 0 0 q: 0 Memory: 0x0 0x100 0x100 0x101 0x101 (p,0x100) (q,0x101) char p[1],q[1] = {0}; char p[1],q[1] = {0}; int ip = (int)(p+1); int ip = (int)(p+1); int iq = (int)q; int iq = (int)q; true if (iq == ip) { if (iq == ip) { *(p+1) = 10; *(p+1) = 10; constant print(q[0]); print(0); } prop. } * https://godbolt.org/z/9eNt6w 4

  20. LLVM’s Solution: Pointers have Provenance Provenance Provenance - 0 p: - 0 0 q: 0 Memory: 0x0 0x100 0x100 0x101 0x101 (p,0x100) (q,0x101) char p[1],q[1] = {0}; char p[1],q[1] = {0}; int ip = (int)(p+1); int ip = (int)(p+1); int iq = (int)q; int iq = (int)q; true if (iq == ip) { if (iq == ip) { *(p+1) = 10; *(p+1) = 10; constant print(q[0]); print(0); } prop. } (p,0x101) * https://godbolt.org/z/9eNt6w 4

  21. LLVM’s Solution: Pointers have Provenance Provenance Provenance - 0 p: - 0 0 q: 0 Memory: 0x0 0x100 0x100 0x101 0x101 (p,0x100) (q,0x101) char p[1],q[1] = {0}; char p[1],q[1] = {0}; int ip = (int)(p+1); int ip = (int)(p+1); int iq = (int)q; int iq = (int)q; true if (iq == ip) { if (iq == ip) { *(p+1) = 10; *(p+1) = 10; constant print(q[0]); print(0); } prop. } (p,0x101) * https://godbolt.org/z/9eNt6w 4

  22. LLVM’s Solution: Pointers have Provenance Provenance Provenance - 0 p: - 0 0 q: 0 Memory: 0x0 0x100 0x100 0x101 0x101 (p,0x100) (q,0x101) char p[1],q[1] = {0}; char p[1],q[1] = {0}; int ip = (int)(p+1); int ip = (int)(p+1); int iq = (int)q; int iq = (int)q; true if (iq == ip) { if (iq == ip) { *(p+1) = 10; *(p+1) = 10; constant print(q[0]); print(0); Undefined Behavior } prop. } (p,0x101) because p ≠ q * https://godbolt.org/z/9eNt6w 4

  23. What about Integers? Assembly LLVM IR (x86-64, ARM, ..) [0, 2 64 ) [0, 2 64 ) + provenance Pointer Casting [0, 2 64 ) [0, 2 64 ) + ? Integer 5

  24. Miscompilation with PtrIntCast char p[1],q[1] = {0}; char p[1],q[1] = {0}; int ip = (int)(p+1); int ip = (int)(p+1); int iq = (int)q; int iq = (int)q; if (iq == ip) { if (iq == ip) { *(p+1) = 10; *(p+1) = 10; constant print(q[0]); print(0); } prop. } 6

  25. Miscompilation with PtrIntCast char p[1],q[1] = {0}; char p[1],q[1] = {0}; int ip = (int)(p+1); int ip = (int)(p+1); int iq = (int)q; int iq = (int)q; if (iq == ip) { if (iq == ip) { *(p+1) = 10; *(p+1) = 10; constant print(q[0]); print(0); } prop. } 6

  26. Miscompilation with PtrIntCast int. eq. char p[1],q[1]={0}; char p[1],q[1]={0}; prop. int ip = (int)(p+1); int ip = (int)(p+1); int iq = (int)q; int iq = (int)q; if (iq == ip) { if (iq == ip) { *(char*)(int)(p+1)=10; *(char*)iq = 10; print(q[0]); print(q[0]); } } cast elim. char p[1],q[1] = {0}; char p[1],q[1] = {0}; int ip = (int)(p+1); int ip = (int)(p+1); int iq = (int)q; int iq = (int)q; if (iq == ip) { if (iq == ip) { *(p+1) = 10; *(p+1) = 10; constant print(q[0]); print(0); } prop. } 6

  27. Miscompilation with PtrIntCast int. eq. char p[1],q[1]={0}; char p[1],q[1]={0}; prop. int ip = (int)(p+1); int ip = (int)(p+1); int iq = (int)q; int iq = (int)q; if (iq == ip) { if (iq == ip) { *(char*)(int)(p+1)=10; *(char*)iq = 10; print(q[0]); print(q[0]); } } char p[1],q[1] = {0}; char p[1],q[1] = {0}; int ip = (int)(p+1); int ip = (int)(p+1); int iq = (int)q; int iq = (int)q; if (iq == ip) { if (iq == ip) { *(p+1) = 10; *(p+1) = 10; print(q[0]); print(0); } } 7

Recommend

Supplementary Material Purification of maize nucleotide pyrophosphatase/phosphodiesterase casts

Supplementary Material Purification of maize nucleotide pyrophosphatase/phosphodiesterase casts

Supplementary Material Purification of maize nucleotide pyrophosphatase/phosphodiesterase casts doubt on the existence of zeatin cis-trans isomerase in plants Tom Hluska, Marek ebela, Ren Lenobel, Ivo Frbort, Petr Galuszka

288 views • 6 slides
Ultrasound Technology and Missing Women in India: Analyses and Now-casts Based on Google

Ultrasound Technology and Missing Women in India: Analyses and Now-casts Based on Google

Ultrasound Technology and Missing Women in India: Analyses and Now-casts Based on Google Searches Ridhi Kashyap 1 , Francesco Billari 1 , Nicol` o Cavalli 1 , Eric Qian 2 , and Ingmar Weber 3 1 Nuffield College and Department of

2.38k views • 21 slides
Optimizing re me dia tio n a ppro a c he s Optimizing re me dia tio n a ppro a c he s a t mine

Optimizing re me dia tio n a ppro a c he s Optimizing re me dia tio n a ppro a c he s a t mine

Optimizing re me dia tio n a ppro a c he s Optimizing re me dia tio n a ppro a c he s a t mine site s: ho w unde rsta nding b io g e o c he mic a l pro c e sse s a nd b io g e o c he mic a l pro c e sse s a nd mo de ling c a n g uide

394 views • 26 slides
Project MOSAIC M-CASTS Whats an M-CAST A regularly scheduled but informal way to share

Project MOSAIC M-CASTS Whats an M-CAST A regularly scheduled but informal way to share

Project MOSAIC M-CASTS Whats an M-CAST A regularly scheduled but informal way to share ideas about teaching and develop collaborations for further development of those ideas. Broadcast via Internet. Most are presentations, but some

543 views • 30 slides
Semantic Casts: Contracts and Structural Subtyping in a Nominal World Robby Findler University

Semantic Casts: Contracts and Structural Subtyping in a Nominal World Robby Findler University

Semantic Casts: Contracts and Structural Subtyping in a Nominal World Robby Findler University of Chicago Matthew Flatt University of Utah Matthias Felleisen Northeastern University 1 Component marketplace - McIlroy's vision (1969) -

1.01k views • 73 slides
OUR OBJECTIVE : OPTIMIZING YOUR TRANSACTION 1 OPTIMIZING YOUR TRANSACTION, is bringing added

OUR OBJECTIVE : OPTIMIZING YOUR TRANSACTION 1 OPTIMIZING YOUR TRANSACTION, is bringing added

OUR OBJECTIVE : OPTIMIZING YOUR TRANSACTION 1 OPTIMIZING YOUR TRANSACTION, is bringing added value to you appropriate for each stage of your project. 2 p.4 Presentation of Trianon Corporate Finance Our team p.12 References p.15 p.24

288 views • 24 slides
Chatting Safely Online commonsense.org/education Shareable with attribution for noncommercial

Chatting Safely Online commonsense.org/education Shareable with attribution for noncommercial

DIGITAL CITIZENSHIP | GRADE 6 Chatting Safely Online commonsense.org/education Shareable with attribution for noncommercial use. Remixing is permitted. Essential Question How do you chat safely with people you meet online?

418 views • 17 slides
How to safely reduce Michigans $2 billion corrections budget Laura Sager Executive

How to safely reduce Michigans $2 billion corrections budget Laura Sager Executive

How to safely reduce Michigans $2 billion corrections budget Laura Sager Executive Director October 30, 2014 1 Citizens Alliance on Prisons and Public Spending CAPPS Mission: Safely reduce the prisoner population,

338 views • 21 slides
Optimizing over the Split Closure Optimizing over the Split Closure Anureet Saxena ACO PhD

Optimizing over the Split Closure Optimizing over the Split Closure Anureet Saxena ACO PhD

Optimizing over the Split Closure Optimizing over the Split Closure Anureet Saxena ACO PhD Student, Tepper School of Business, Carnegie Mellon University. (Joint Work with Egon Balas) MIP Model MIP Model min cx Contains x j 0 j 2 N x j

837 views • 56 slides
Fast Rope Optimizing IDIQs as a Prime and a S ub Feb 2016 Optimizing IDIQ and GWACs Prime

Fast Rope Optimizing IDIQs as a Prime and a S ub Feb 2016 Optimizing IDIQ and GWACs Prime

Fast Rope Optimizing IDIQs as a Prime and a S ub Feb 2016 Optimizing IDIQ and GWACs Prime Perspective Panelist Keith Bull Miller, S martronix Fabian Plath, NES Associates Richard Goudie, Optech Michael

655 views • 18 slides
Techniques Used for Optimizing 3D Techniques Used for Optimizing 3D Geovisualization of Terez n

Techniques Used for Optimizing 3D Techniques Used for Optimizing 3D Geovisualization of Terez n

Techniques Used for Optimizing 3D Techniques Used for Optimizing 3D Geovisualization of Terez n n Geovisualization of Terez Memorial Memorial Karel Jedli ka, Vclav ada, Radek Fiala, Pavel Hjek, Karel Jane ka, Jan Jeek, Jan

453 views • 20 slides
Safely back to work in the new normal Alliance Overview April 2020 Enabling workers to return to

Safely back to work in the new normal Alliance Overview April 2020 Enabling workers to return to

Safely back to work in the new normal Alliance Overview April 2020 Enabling workers to return to work safely The COVID-19 health crisis and continued lockdown in many markets is posing unparalleled challenges to people and economies around the

349 views • 19 slides
John Wrapp Waste Disposition Manager March 10, 2016 Safely Delivering DOEs Vision for the 1

John Wrapp Waste Disposition Manager March 10, 2016 Safely Delivering DOEs Vision for the 1

Safely Delivering DOEs Vision for the East Tennessee Technology Park Mission The Disposition of Former No Path To Disposal Wastes A ETTP 2016 Update John Wrapp Waste Disposition Manager March 10, 2016 Safely Delivering DOEs

271 views • 9 slides
Optimizing the perfectly matched layer by F. Collino, P . B. Monk Norbert Stoop Optimizing the

Optimizing the perfectly matched layer by F. Collino, P . B. Monk Norbert Stoop Optimizing the

Optimizing the perfectly matched layer by F. Collino, P . B. Monk Norbert Stoop Optimizing the perfectly matched layer p. 1 Overview PML constructed using a change of variables Cartesian coordinates (review) Comparison to Brengers

736 views • 34 slides
COVID 19 Lead Worker Representative Training Return to Workplace Safely Protocol June 2020

COVID 19 Lead Worker Representative Training Return to Workplace Safely Protocol June 2020

COVID 19 Lead Worker Representative Training Return to Workplace Safely Protocol June 2020 Covid 19 Return to the Workplace Safely The Governments Covid 19 Return to Work Safely Protocol requires each workplace to appoint at least one

281 views • 15 slides
Harry Potter, Wicca, and Bible Prophecy The girl with supernatural powers who learns

Harry Potter, Wicca, and Bible Prophecy The girl with supernatural powers who learns

Harry Potter, Wicca, and Bible Prophecy The girl with supernatural powers who learns to use her witchcraft wisely. tv.yahoo.com Buffys friend Willow casts spells and practices Witchcraft. Buffys friend Willow casts

447 views • 29 slides
A Case for Self-Optimizing File Systems Jason Liptak, Sam Burnett A Case for Self-Optimizing

A Case for Self-Optimizing File Systems Jason Liptak, Sam Burnett A Case for Self-Optimizing

A Case for Self-Optimizing File Systems Jason Liptak, Sam Burnett A Case for Self-Optimizing File Systems p.1/19 Motivation Current file systems do not take data access patterns into account. Most requests made are non-sequential.

225 views • 19 slides
Fractal Prefetching B+-Trees: Optimizing Both Cache and Disk Performance Shimin Chen, Phillip B.

Fractal Prefetching B+-Trees: Optimizing Both Cache and Disk Performance Shimin Chen, Phillip B.

Introduction Optimizing I/O Performance Optimizing Cache Performance Evaluation Discussion Fractal Prefetching B+-Trees: Optimizing Both Cache and Disk Performance Shimin Chen, Phillip B. Gibbons, Todd C. Mowry, and Gary Valentin October 3,

341 views • 32 slides
Optimizing Dosing of Oncology Drugs Optimizing Dosing of Oncology Drugs Richard L. Schilsky, M.D.

Optimizing Dosing of Oncology Drugs Optimizing Dosing of Oncology Drugs Richard L. Schilsky, M.D.

Optimizing Dosing of Oncology Drugs Optimizing Dosing of Oncology Drugs Richard L. Schilsky, M.D. American Society of Clinical Oncology Current Approach to Dose Determination in Oncology Aimed at the maximum - tolerated dose (MTD) to

840 views • 56 slides
Optimizing Dosing of Oncology Drugs Optimizing Dosing of Oncology Drugs Richard L. Schilsky, M.D.

Optimizing Dosing of Oncology Drugs Optimizing Dosing of Oncology Drugs Richard L. Schilsky, M.D.

Optimizing Dosing of Oncology Drugs Optimizing Dosing of Oncology Drugs Richard L. Schilsky, M.D. American Society of Clinical Oncology Current Approach to Dose Determination in Oncology Aimed at the maximum - tolerated dose (MTD) to

603 views • 46 slides
Optimizing Discrete Wavelet Transform Optimizing Discrete Wavelet Transform on the Cell Broadband

Optimizing Discrete Wavelet Transform Optimizing Discrete Wavelet Transform on the Cell Broadband

Optimizing Discrete Wavelet Transform Optimizing Discrete Wavelet Transform on the Cell Broadband Engine on the Cell Broadband Engine Seunghwa Kang David A. Bader Key Contributions We design an efficient data decomposition scheme

586 views • 27 slides
HDA case study S. Skogestad, May 2006 Self- Self Thanks to Antonio Arajo 1 Process

HDA case study S. Skogestad, May 2006 Self- Self Thanks to Antonio Arajo 1 Process

-Optimizing Control Optimizing Control HDA case study S. Skogestad, May 2006 Self- Self Thanks to Antonio Arajo 1 Process Description -Optimizing Control Optimizing Control Benzene production from thermal-dealkalination of

397 views • 25 slides
You Are Anointed Acts 28:1-6 1 Once we were safely ashore, we learned that the island was

You Are Anointed Acts 28:1-6 1 Once we were safely ashore, we learned that the island was

Pastor Patrick D. Owens You Are Anointed Acts 28:1-6 1 Once we were safely ashore, we learned that the island was called Malta. 2 The islanders showed us extraordinary kindness. They kindled a fire and welcomed all of us because it was

453 views • 16 slides
Live Well, San Diego!: How Can We Support Living Safely? DATE TBD Agenda HHSA, Living

Live Well, San Diego!: How Can We Support Living Safely? DATE TBD Agenda HHSA, Living

Live Well, San Diego!: How Can We Support Living Safely? DATE TBD Agenda HHSA, Living Safely and Live Well, San Diego! - How They Connect Why Do We Need to Act? Where Do We Begin? We Want to Hear From You! A County That Is

386 views • 12 slides

More recommend