[all-commits] [llvm/llvm-project] 98c781: [llubi] Add basic support for provenance modeling ...

[Yingwei Zheng via All-commits]

  Branch: refs/heads/main
  Home:   https://github.com/llvm/llvm-project
  Commit: 98c7814ca93baa6976b92a753d8a6364915266f0
      https://github.com/llvm/llvm-project/commit/98c7814ca93baa6976b92a753d8a6364915266f0
  Author: Yingwei Zheng <dtcxzyw2333 at gmail.com>
  Date:   2026-05-28 (Thu, 28 May 2026)

  Changed paths:
    M llvm/test/tools/llubi/alloca.ll
    M llvm/test/tools/llubi/assume_misalign_all_ones.ll
    M llvm/test/tools/llubi/assume_null.ll
    M llvm/test/tools/llubi/assume_null_all_ones.ll
    M llvm/test/tools/llubi/attribute_dereferenceable_ub_nullary_provenance.ll
    M llvm/test/tools/llubi/attributes.ll
    M llvm/test/tools/llubi/bitcast_be.ll
    M llvm/test/tools/llubi/bitcast_le.ll
    M llvm/test/tools/llubi/freeze.ll
    M llvm/test/tools/llubi/gep.ll
    M llvm/test/tools/llubi/inttoptr.ll
    M llvm/test/tools/llubi/lib_calloc_large_size.ll
    M llvm/test/tools/llubi/lib_calloc_size_overflow.ll
    M llvm/test/tools/llubi/lib_free_nullary_pointer.ll
    M llvm/test/tools/llubi/lib_malloc_large_size.ll
    M llvm/test/tools/llubi/loadstore_be.ll
    M llvm/test/tools/llubi/loadstore_le.ll
    M llvm/test/tools/llubi/loadstore_uaf.ll
    M llvm/test/tools/llubi/metadata.ll
    M llvm/test/tools/llubi/store_dead.ll
    M llvm/tools/llubi/lib/Context.cpp
    M llvm/tools/llubi/lib/Context.h
    M llvm/tools/llubi/lib/Value.cpp
    M llvm/tools/llubi/lib/Value.h

  Log Message:
  -----------
  [llubi] Add basic support for provenance modeling (#185977)

There are four solutions to model the provenance in the memory:
1. `(allocid, bitindex)` for each bit: It follows the definition of byte
type.
2. `(allocid, bitindex)` for each byte: This assumes the pointer/byte
types are always byte-sized, and requires bitextract/bitinsert to shift
by multiples of 8, as posted in
https://discourse.llvm.org/t/rfc-add-a-new-byte-type-to-llvm-ir/89522/53.
I believe this is true in most real-world cases.
3. Assign a random tag for each memory object: The tag has the same
width as the address. It is stored in the memory like addresses. Thus,
each logical byte only occupies 4 bytes. When loading a pointer, the tag
is loaded and used to recover the provenance. Incorrect bit ordering
will result in nullary provenance (with a negligible rate of false
negatives). I think it is feasible because we can always turn a false
negative into a positive with a different seed. It is also compatible
with captured components
(https://github.com/dtcxzyw/llvm-ub-aware-interpreter/blob/d15dfef5bc0c1b30b05512bbc28fddb2b50cc0b1/ubi.h#L187)
and noalias (https://jhostert.de/blog/2025/noalias/) if we maintain the
tree structure in a hashmap.
4. Maintains a `addr -> provenance` map like
[miri](https://github.com/rust-lang/rust/blob/main/compiler/rustc_middle/src/mir/interpret/allocation/provenance_map.rs).
It also looks expensive to maintain the provenance at the bit level.

This patch implements the third approach. After
https://github.com/llvm/llvm-project/pull/178666 lands, I can add more
tests to play with byte types.



To unsubscribe from these emails, change your notification settings at https://github.com/llvm/llvm-project/settings/notifications