Cold-Air-Networks/mirror-llvm-project
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 7

[BOLT][rewrite] warn about functions without CFG before binary analyses. (#197294)

Browse source
This commit is contained in:
David CARLIER 2026-06-19 17:02:11 +01:00 committed by GitHub
parent 8c922aa493
commit abbb031d38
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 60 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
bolt/lib/Rewrite/RewriteInstance.cpp
View file

@ -3918,8 +3918,28 @@ void RewriteInstance::runBinaryAnalyses() {
NamedRegionTimer T("runBinaryAnalyses", "run binary analysis passes",
TimerGroupName, TimerGroupDesc, opts::TimeRewrite);
BinaryFunctionPassManager Manager(*BC);
// FIXME: add a pass that warns about which functions do not have CFG,
// and therefore, analysis is most likely to be less accurate.
// Warn about functions for which BOLT could not reconstruct the CFG: binary
// analyses are less precise on them and may report both false negatives and
// false positives.
unsigned NoCFGCount = 0;
for (const auto &BFI : BC->getBinaryFunctions()) {
const BinaryFunction &BF = BFI.second;
// Skip ignored functions: BOLT does not attempt to build a CFG for them
// (e.g. pseudo functions such as PLT stubs), so a missing CFG there is
// expected rather than a sign of degraded analysis.
if (BF.isIgnored() || BF.hasCFG())
continue;
++NoCFGCount;
if (opts::Verbosity >= 1)
BC->errs() << "BOLT-WARNING: no CFG for " << BF
<< "; binary analyses may be imprecise\n";
}
if (NoCFGCount)
BC->errs() << "BOLT-WARNING: " << NoCFGCount
<< " function(s) lack CFG; binary-analysis results may be"
" incomplete. Re-run with -v=1 to list these functions.\n";
using PtrAuthScanner = PAuthGadgetScanner::Analysis;
// Accumulate all enabled analyses.

38
bolt/test/binary-analysis/AArch64/cfg-warning.s Normal file
View file

@ -0,0 +1,38 @@
## Verify that binary analyses warn about functions for which BOLT could not
## reconstruct the CFG, since analysis results are less reliable for them.
// RUN: %clang %cflags %s %p/../../Inputs/asm_main.c -o %t.exe
// RUN: llvm-bolt-binary-analysis --scanners=ptrauth-pac-ret %t.exe 2>&1 \
// RUN: | FileCheck --check-prefix=SUMMARY %s
// RUN: llvm-bolt-binary-analysis --scanners=ptrauth-pac-ret -v=1 %t.exe 2>&1 \
// RUN: | FileCheck --check-prefix=VERBOSE %s
.text
## A function with a regular CFG must not be reported.
.globl f_good
.type f_good,@function
f_good:
ret
.size f_good, .-f_good
// SUMMARY-NOT: BOLT-WARNING:{{.*}}f_good
// VERBOSE-NOT: BOLT-WARNING:{{.*}}f_good
## An unanalyzable indirect branch prevents BOLT from building the CFG.
.globl f_nocfg
.type f_nocfg,@function
f_nocfg:
adr x2, 1f
br x2
1:
ret
.size f_nocfg, .-f_nocfg
## Without -v, only the aggregate warning is emitted; functions are not listed
## individually.
// SUMMARY-NOT: BOLT-WARNING: no CFG for
// SUMMARY: BOLT-WARNING: {{[0-9]+}} function(s) lack CFG; binary-analysis results may be incomplete. Re-run with -v=1 to list these functions.
## With -v=1, each function lacking a CFG is listed before the summary.
// VERBOSE: BOLT-WARNING: no CFG for {{.*}}f_nocfg{{.*}}; binary analyses may be imprecise
// VERBOSE: BOLT-WARNING: {{[0-9]+}} function(s) lack CFG; binary-analysis results may be incomplete. Re-run with -v=1 to list these functions.