On Nov 30, 2020, at 11:18 AM, Martin Sebor <mse...@gmail.com> wrote:
>>>>>>>> Does gcc provide an iterator to traverse all the local variables that
>>>>>>>> are declared in the current routine?
>>>>>>>>
>>>>>>>> If not, what’s the best way to traverse the local variables?
>>>>>>>
>>>>>>> Depends on what for. There's the source level view you get by walking
>>>>>>> BLOCK_VARS of the
>>>>>>> scope tree, theres cfun->local_variables (FOR_EACH_LOCAL_DECL) and
>>>>>>> there's SSA names
>>>>>>> (FOR_EACH_SSA_NAME).
>>>>>>
>>>>>> I am planing to add a new phase immediately after
>>>>>> “pass_late_warn_uninitialized” to initialize all auto-variables that are
>>>>>> not explicitly initialized in the declaration, the basic idea is
>>>>>> following:
>>>>>>
>>>>>> ** The proposal:
>>>>>>
>>>>>> A. add a new GCC option: (same name and meaning as CLANG)
>>>>>> -ftrivial-auto-var-init=[pattern|zero], similar pattern init as CLANG;
>>>>>>
>>>>>> B. add a new attribute for variable:
>>>>>> __attribute((uninitialized)
>>>>>> the marked variable is uninitialized intentionaly for performance
>>>>>> purpose.
>>>>>>
>>>>>> C. The implementation needs to keep the current static warning on
>>>>>> uninitialized
>>>>>> variables untouched in order to avoid "forking the language".
>>>>>>
>>>>>>
>>>>>> ** The implementation:
>>>>>>
>>>>>> There are two major requirements for the implementation:
>>>>>>
>>>>>> 1. all auto-variables that do not have an explicit initializer should be
>>>>>> initialized to
>>>>>> zero by this option. (Same behavior as CLANG)
>>>>>>
>>>>>> 2. keep the current static warning on uninitialized variables untouched.
>>>>>>
>>>>>> In order to satisfy 1, we should check whether an auto-variable has
>>>>>> initializer
>>>>>> or not;
>>>>>> In order to satisfy 2, we should add this new transformation after
>>>>>> "pass_late_warn_uninitialized".
>>>>>>
>>>>>> So, we should be able to check whether an auto-variable has initializer
>>>>>> or not after “pass_late_warn_uninitialized”,
>>>>>> If Not, then insert an initialization for it.
>>>>>>
>>>>>> For this purpose, I guess that “FOR_EACH_LOCAL_DECL” might be better?
>>>>>
>>>>> Yes, but do you want to catch variables promoted to register as well
>>>>> or just variables
>>>>> on the stack?
>>>> I think both as long as they are source-level auto-variables. Then which
>>>> one is better?
>>>>>
>>>>>> Another issue is, in order to check whether an auto-variable has
>>>>>> initializer, I plan to add a new bit in “decl_common” as:
>>>>>> /* In a VAR_DECL, this is DECL_IS_INITIALIZED. */
>>>>>> unsigned decl_is_initialized :1;
>>>>>>
>>>>>> /* IN VAR_DECL, set when the decl is initialized at the declaration. */
>>>>>> #define DECL_IS_INITIALIZED(NODE) \
>>>>>> (DECL_COMMON_CHECK (NODE)->decl_common.decl_is_initialized)
>>>>>>
>>>>>> set this bit when setting DECL_INITIAL for the variables in FE. then
>>>>>> keep it
>>>>>> even though DECL_INITIAL might be NULLed.
>>>>>
>>>>> For locals it would be more reliable to set this flag during
>>>>> gimplification.
>>>> You mean I can set the flag “DECL_IS_INITIALIZED (decl)” inside the
>>>> routine “gimpley_decl_expr” (gimplify.c) as following:
>>>> if (VAR_P (decl) && !DECL_EXTERNAL (decl))
>>>> {
>>>> tree init = DECL_INITIAL (decl);
>>>> ...
>>>> if (init && init != error_mark_node)
>>>> {
>>>> if (!TREE_STATIC (decl))
>>>> {
>>>> DECL_IS_INITIALIZED(decl) = 1;
>>>> }
>>>> Is this enough for all Frontends? Are there other places that I need to
>>>> maintain this bit?
>>>>>
>>>>>> Do you have any comment and suggestions?
>>>>>
>>>>> As said above - do you want to cover registers as well as locals?
>>>> All the locals from the source-code point of view should be covered.
>>>> (From my study so far, looks like that Clang adds that phase in FE).
>>>> If GCC adds this phase in FE, then the following design requirement
>>>> C. The implementation needs to keep the current static warning on
>>>> uninitialized
>>>> variables untouched in order to avoid "forking the language”.
>>>> cannot be satisfied. Since gcc’s uninitialized variables analysis is
>>>> applied quite late.
>>>> So, we have to add this new phase after “pass_late_warn_uninitialized”.
>>>>> I'd do
>>>>> the actual zeroing during RTL expansion instead since otherwise you
>>>>> have to figure youself whether a local is actually used (see
>>>>> expand_stack_vars)
>>>> Adding this new transformation during RTL expansion is okay. I will
>>>> check on this in more details to see how to add it to RTL expansion phase.
>>>>>
>>>>> Note that optimization will already made have use of "uninitialized" state
>>>>> of locals so depending on what the actual goal is here "late" may be too
>>>>> late.
>>>> This is a really good point…
>>>> In order to avoid optimization to use the “uninitialized” state of
>>>> locals, we should add the zeroing phase as early as possible (adding it in
>>>> FE might be best
>>>> for this issue). However, if we have to met the following requirement:
>>>> C. The implementation needs to keep the current static warning on
>>>> uninitialized
>>>> variables untouched in order to avoid "forking the language”.
>>>> We have to move the new phase after all the uninitialized analysis is done
>>>> in order to avoid “forking the language”.
>>>> So, this is a problem that is not easy to resolve.
>>>> Do you have suggestion on this?
>>>
>>> Not having thought about it very long or hard I'd be tempted to do
>>> it the other way around. For each use of an uninitialized variable
>>> found, first either issue or queue up a -Wuninitialized for it and
>>> then initialize it. Then (if queued) at some later point, issue
>>> the queued up -Wuninitialized. The last part would be done in
>>> tree-ssa-uninit.c where the remaining uses of uninitialized
>>> variables would trigger warnings and induce their initialization
>>> (if there were any left).
>> The major issue with this approach is:
>> There are two passes for uninitialized variable analysis:
>> pass_early_warn_uninitialized
>> pass_late_warn_uninitialized
>> The early pass is placed at the very beginning of the tree optimizer. But
>> the late pass is placed at the very late stage of the tree optimizer.
>> If we add the initializations at the early pass, the result of the late pass
>> will be changed by the new added initializations. This does not meet
>> the requirement.
>> Do I miss anything here?
>
> I'm not sure. As I said, I'd consider issuing (or queuing up for
> issuing later) -Wuninitialized at the same time as initializing
> the uninitialized variables.
I have considered this approach in the very beginning of my study, but later I
realized that it would not work.
For example, for the following small example:
qinzhao@gcc10:~/Bugs/auto-init$ cat t1.c
void blah(int);
int foo_2 (int n, int l, int m, int r)
{
int v;
if ( (n < 10) && (m != 100) && (r < 20) )
v = r;
if (l > 100)
if ( (n <= 8) && (m < 102) && (r < 19) )
blah(v); /* { dg-warning "uninitialized" "real warning" } */
return 0;
}
With the latest gcc and the following options:
qinzhao@gcc10:~/Bugs/auto-init$ /home/qinzhao/Install/latest_write/bin/gcc
-Wuninitialized -Wmaybe-uninitialized -S t1.c
qinzhao@gcc10:~/Bugs/auto-init$
We can see that there is no any uninitialized warning issued by the latest gcc
if no optimization is specified. But for this case,
It’s clear that we should insert a zero initializer for auto-variable “v” even
though the current uninitialized variable analysis pass
is not able to determine “v” is not initialized in some execution paths.
The above is just a simple example to show that we cannot rely on the result of
the uninitialized variable analysis pass to decide
which variable should be initialized.
For security purpose, we should conservatively initialize all auto-variables
that might not be initialized. i.e, for all the auto-variables that
do not have an explicit initializer in source code level, we should insert
initializer for them.
This is the current behavior of LLVM with -ftrivial-auto-var-init=zero
-enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang.
I believe that GCC should do the same thing for the security benefit.
> With that approach I'd expect to
> diagnose all the same instances of uninitialized uses as the two
> passes do today (actually, I'd expect to diagnose more of them,
> including those Richard referred to above whose uninitialized
> state may have been made use of for optimization decisions(*)).
> Also with this approach the two existing warning passes would
> cease to serve their current purpose of hunting down uninitialized
> variables because by the time they ran all their uses would have
> been initialized (and warnings issued).
Inserting the zero-initializer before pass_late_warn_uninitialized will invalid
the current uninitialized variable analysis, which is unacceptable
based on my current understanding.
> One question in my mind is what to do with -Wmaybe-uninitialized.
> Should those also be initialized, even though they're not necessarily
> used? Or are you only hoping to tackle -Wuninitialized?
All the auto-variables that might not be initialized should be initialized with
the new option.
The decision on which auto-variable should be initialized should based on the
source code level initializer:
If an auto-variable does not have a source code level initializer, the compiler
should add a zero-initializer
for it.
Qing
>
> Martin
>
> [*] With the initialization approach I'd expect concerns about
> the cost of losing those optimization opportunities. Although
> those could be addressed by making the initialization optional
> (i.e., opt-in).
