[llvm] [BOLT] Gadget scanner: detect authentication oracles (PR #135663)

Anatoly Trosinenko via llvm-commits llvm-commits at lists.llvm.org
Tue May 27 13:23:17 PDT 2025


================
@@ -717,6 +716,466 @@ SrcSafetyAnalysis::create(BinaryFunction &BF,
                                                        RegsToTrackInstsFor);
 }
 
+/// A state representing which registers are safe to be used as the destination
+/// operand of an authentication instruction.
+///
+/// Similar to SrcState, it is the analysis that should take register aliasing
+/// into account.
+///
----------------
atrosinenko wrote:

Pushed more cleanups not involving significant changes to SrcState machinery in bd116389db1dda28ba16fe5a846747014e0e756a. I plan to send a few more cleanups as a separate PRs like #141665 because it is probably reasonable to keep the two sets of classes similar (even if not refactored) and then refactor them in parallel via a separate PR.

While the two sets of classes (those related to SrcState and DstState) sometimes share almost identical pieces of code, I'm not sure it is worth deduplicating everything. For example, both SrcState and DstState contain several BitVector fields and exactly one vector of sets of instructions, but this is kind of coincidence: for example, I can imagine adding another vector of sets of instructions to SrcState to track the instructions specifically related to "trusted" register state (no such change is planned so far, though).

https://github.com/llvm/llvm-project/pull/135663


More information about the llvm-commits mailing list