LLVM  16.0.0git
DataFlowSanitizer.cpp
Go to the documentation of this file.
1 //===- DataFlowSanitizer.cpp - dynamic data flow analysis -----------------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 /// \file
10 /// This file is a part of DataFlowSanitizer, a generalised dynamic data flow
11 /// analysis.
12 ///
13 /// Unlike other Sanitizer tools, this tool is not designed to detect a specific
14 /// class of bugs on its own. Instead, it provides a generic dynamic data flow
15 /// analysis framework to be used by clients to help detect application-specific
16 /// issues within their own code.
17 ///
18 /// The analysis is based on automatic propagation of data flow labels (also
19 /// known as taint labels) through a program as it performs computation.
20 ///
21 /// Argument and return value labels are passed through TLS variables
22 /// __dfsan_arg_tls and __dfsan_retval_tls.
23 ///
24 /// Each byte of application memory is backed by a shadow memory byte. The
25 /// shadow byte can represent up to 8 labels. On Linux/x86_64, memory is then
26 /// laid out as follows:
27 ///
28 /// +--------------------+ 0x800000000000 (top of memory)
29 /// | application 3 |
30 /// +--------------------+ 0x700000000000
31 /// | invalid |
32 /// +--------------------+ 0x610000000000
33 /// | origin 1 |
34 /// +--------------------+ 0x600000000000
35 /// | application 2 |
36 /// +--------------------+ 0x510000000000
37 /// | shadow 1 |
38 /// +--------------------+ 0x500000000000
39 /// | invalid |
40 /// +--------------------+ 0x400000000000
41 /// | origin 3 |
42 /// +--------------------+ 0x300000000000
43 /// | shadow 3 |
44 /// +--------------------+ 0x200000000000
45 /// | origin 2 |
46 /// +--------------------+ 0x110000000000
47 /// | invalid |
48 /// +--------------------+ 0x100000000000
49 /// | shadow 2 |
50 /// +--------------------+ 0x010000000000
51 /// | application 1 |
52 /// +--------------------+ 0x000000000000
53 ///
54 /// MEM_TO_SHADOW(mem) = mem ^ 0x500000000000
55 /// SHADOW_TO_ORIGIN(shadow) = shadow + 0x100000000000
56 ///
57 /// For more information, please refer to the design document:
58 /// http://clang.llvm.org/docs/DataFlowSanitizerDesign.html
59 //
60 //===----------------------------------------------------------------------===//
61 
63 #include "llvm/ADT/DenseMap.h"
64 #include "llvm/ADT/DenseSet.h"
66 #include "llvm/ADT/None.h"
67 #include "llvm/ADT/SmallPtrSet.h"
68 #include "llvm/ADT/SmallVector.h"
69 #include "llvm/ADT/StringRef.h"
70 #include "llvm/ADT/StringSet.h"
71 #include "llvm/ADT/Triple.h"
72 #include "llvm/ADT/iterator.h"
76 #include "llvm/IR/Argument.h"
77 #include "llvm/IR/Attributes.h"
78 #include "llvm/IR/BasicBlock.h"
79 #include "llvm/IR/Constant.h"
80 #include "llvm/IR/Constants.h"
81 #include "llvm/IR/DataLayout.h"
82 #include "llvm/IR/DerivedTypes.h"
83 #include "llvm/IR/Dominators.h"
84 #include "llvm/IR/Function.h"
85 #include "llvm/IR/GlobalAlias.h"
86 #include "llvm/IR/GlobalValue.h"
87 #include "llvm/IR/GlobalVariable.h"
88 #include "llvm/IR/IRBuilder.h"
89 #include "llvm/IR/InstVisitor.h"
90 #include "llvm/IR/InstrTypes.h"
91 #include "llvm/IR/Instruction.h"
92 #include "llvm/IR/Instructions.h"
93 #include "llvm/IR/IntrinsicInst.h"
94 #include "llvm/IR/MDBuilder.h"
95 #include "llvm/IR/Module.h"
96 #include "llvm/IR/PassManager.h"
97 #include "llvm/IR/Type.h"
98 #include "llvm/IR/User.h"
99 #include "llvm/IR/Value.h"
100 #include "llvm/InitializePasses.h"
101 #include "llvm/Pass.h"
102 #include "llvm/Support/Alignment.h"
103 #include "llvm/Support/Casting.h"
111 #include <algorithm>
112 #include <cassert>
113 #include <cstddef>
114 #include <cstdint>
115 #include <memory>
116 #include <set>
117 #include <string>
118 #include <utility>
119 #include <vector>
120 
121 using namespace llvm;
122 
123 // This must be consistent with ShadowWidthBits.
124 static const Align ShadowTLSAlignment = Align(2);
125 
126 static const Align MinOriginAlignment = Align(4);
127 
128 // The size of TLS variables. These constants must be kept in sync with the ones
129 // in dfsan.cpp.
130 static const unsigned ArgTLSSize = 800;
131 static const unsigned RetvalTLSSize = 800;
132 
133 // The -dfsan-preserve-alignment flag controls whether this pass assumes that
134 // alignment requirements provided by the input IR are correct. For example,
135 // if the input IR contains a load with alignment 8, this flag will cause
136 // the shadow load to have alignment 16. This flag is disabled by default as
137 // we have unfortunately encountered too much code (including Clang itself;
138 // see PR14291) which performs misaligned access.
140  "dfsan-preserve-alignment",
141  cl::desc("respect alignment requirements provided by input IR"), cl::Hidden,
142  cl::init(false));
143 
144 // The ABI list files control how shadow parameters are passed. The pass treats
145 // every function labelled "uninstrumented" in the ABI list file as conforming
146 // to the "native" (i.e. unsanitized) ABI. Unless the ABI list contains
147 // additional annotations for those functions, a call to one of those functions
148 // will produce a warning message, as the labelling behaviour of the function is
149 // unknown. The other supported annotations for uninstrumented functions are
150 // "functional" and "discard", which are described below under
151 // DataFlowSanitizer::WrapperKind.
152 // Functions will often be labelled with both "uninstrumented" and one of
153 // "functional" or "discard". This will leave the function unchanged by this
154 // pass, and create a wrapper function that will call the original.
155 //
156 // Instrumented functions can also be annotated as "force_zero_labels", which
157 // will make all shadow and return values set zero labels.
158 // Functions should never be labelled with both "force_zero_labels" and
159 // "uninstrumented" or any of the unistrumented wrapper kinds.
161  "dfsan-abilist",
162  cl::desc("File listing native ABI functions and how the pass treats them"),
163  cl::Hidden);
164 
165 // Controls whether the pass includes or ignores the labels of pointers in load
166 // instructions.
168  "dfsan-combine-pointer-labels-on-load",
169  cl::desc("Combine the label of the pointer with the label of the data when "
170  "loading from memory."),
171  cl::Hidden, cl::init(true));
172 
173 // Controls whether the pass includes or ignores the labels of pointers in
174 // stores instructions.
176  "dfsan-combine-pointer-labels-on-store",
177  cl::desc("Combine the label of the pointer with the label of the data when "
178  "storing in memory."),
179  cl::Hidden, cl::init(false));
180 
181 // Controls whether the pass propagates labels of offsets in GEP instructions.
183  "dfsan-combine-offset-labels-on-gep",
184  cl::desc(
185  "Combine the label of the offset with the label of the pointer when "
186  "doing pointer arithmetic."),
187  cl::Hidden, cl::init(true));
188 
190  "dfsan-combine-taint-lookup-table",
191  cl::desc(
192  "When dfsan-combine-offset-labels-on-gep and/or "
193  "dfsan-combine-pointer-labels-on-load are false, this flag can "
194  "be used to re-enable combining offset and/or pointer taint when "
195  "loading specific constant global variables (i.e. lookup tables)."),
196  cl::Hidden);
197 
199  "dfsan-debug-nonzero-labels",
200  cl::desc("Insert calls to __dfsan_nonzero_label on observing a parameter, "
201  "load or return with a nonzero label"),
202  cl::Hidden);
203 
204 // Experimental feature that inserts callbacks for certain data events.
205 // Currently callbacks are only inserted for loads, stores, memory transfers
206 // (i.e. memcpy and memmove), and comparisons.
207 //
208 // If this flag is set to true, the user must provide definitions for the
209 // following callback functions:
210 // void __dfsan_load_callback(dfsan_label Label, void* addr);
211 // void __dfsan_store_callback(dfsan_label Label, void* addr);
212 // void __dfsan_mem_transfer_callback(dfsan_label *Start, size_t Len);
213 // void __dfsan_cmp_callback(dfsan_label CombinedLabel);
215  "dfsan-event-callbacks",
216  cl::desc("Insert calls to __dfsan_*_callback functions on data events."),
217  cl::Hidden, cl::init(false));
218 
219 // Experimental feature that inserts callbacks for conditionals, including:
220 // conditional branch, switch, select.
221 // This must be true for dfsan_set_conditional_callback() to have effect.
223  "dfsan-conditional-callbacks",
224  cl::desc("Insert calls to callback functions on conditionals."), cl::Hidden,
225  cl::init(false));
226 
227 // Controls whether the pass tracks the control flow of select instructions.
229  "dfsan-track-select-control-flow",
230  cl::desc("Propagate labels from condition values of select instructions "
231  "to results."),
232  cl::Hidden, cl::init(true));
233 
234 // TODO: This default value follows MSan. DFSan may use a different value.
236  "dfsan-instrument-with-call-threshold",
237  cl::desc("If the function being instrumented requires more than "
238  "this number of origin stores, use callbacks instead of "
239  "inline checks (-1 means never use callbacks)."),
240  cl::Hidden, cl::init(3500));
241 
242 // Controls how to track origins.
243 // * 0: do not track origins.
244 // * 1: track origins at memory store operations.
245 // * 2: track origins at memory load and store operations.
246 // TODO: track callsites.
247 static cl::opt<int> ClTrackOrigins("dfsan-track-origins",
248  cl::desc("Track origins of labels"),
249  cl::Hidden, cl::init(0));
250 
252  "dfsan-ignore-personality-routine",
253  cl::desc("If a personality routine is marked uninstrumented from the ABI "
254  "list, do not create a wrapper for it."),
255  cl::Hidden, cl::init(false));
256 
258  // Types of GlobalVariables are always pointer types.
259  Type *GType = G.getValueType();
260  // For now we support excluding struct types only.
261  if (StructType *SGType = dyn_cast<StructType>(GType)) {
262  if (!SGType->isLiteral())
263  return SGType->getName();
264  }
265  return "<unknown type>";
266 }
267 
268 namespace {
269 
270 // Memory map parameters used in application-to-shadow address calculation.
271 // Offset = (Addr & ~AndMask) ^ XorMask
272 // Shadow = ShadowBase + Offset
273 // Origin = (OriginBase + Offset) & ~3ULL
274 struct MemoryMapParams {
275  uint64_t AndMask;
276  uint64_t XorMask;
277  uint64_t ShadowBase;
278  uint64_t OriginBase;
279 };
280 
281 } // end anonymous namespace
282 
283 // x86_64 Linux
284 // NOLINTNEXTLINE(readability-identifier-naming)
285 static const MemoryMapParams Linux_X86_64_MemoryMapParams = {
286  0, // AndMask (not used)
287  0x500000000000, // XorMask
288  0, // ShadowBase (not used)
289  0x100000000000, // OriginBase
290 };
291 
292 namespace {
293 
294 class DFSanABIList {
295  std::unique_ptr<SpecialCaseList> SCL;
296 
297 public:
298  DFSanABIList() = default;
299 
300  void set(std::unique_ptr<SpecialCaseList> List) { SCL = std::move(List); }
301 
302  /// Returns whether either this function or its source file are listed in the
303  /// given category.
304  bool isIn(const Function &F, StringRef Category) const {
305  return isIn(*F.getParent(), Category) ||
306  SCL->inSection("dataflow", "fun", F.getName(), Category);
307  }
308 
309  /// Returns whether this global alias is listed in the given category.
310  ///
311  /// If GA aliases a function, the alias's name is matched as a function name
312  /// would be. Similarly, aliases of globals are matched like globals.
313  bool isIn(const GlobalAlias &GA, StringRef Category) const {
314  if (isIn(*GA.getParent(), Category))
315  return true;
316 
317  if (isa<FunctionType>(GA.getValueType()))
318  return SCL->inSection("dataflow", "fun", GA.getName(), Category);
319 
320  return SCL->inSection("dataflow", "global", GA.getName(), Category) ||
321  SCL->inSection("dataflow", "type", getGlobalTypeString(GA),
322  Category);
323  }
324 
325  /// Returns whether this module is listed in the given category.
326  bool isIn(const Module &M, StringRef Category) const {
327  return SCL->inSection("dataflow", "src", M.getModuleIdentifier(), Category);
328  }
329 };
330 
331 /// TransformedFunction is used to express the result of transforming one
332 /// function type into another. This struct is immutable. It holds metadata
333 /// useful for updating calls of the old function to the new type.
334 struct TransformedFunction {
335  TransformedFunction(FunctionType *OriginalType, FunctionType *TransformedType,
336  std::vector<unsigned> ArgumentIndexMapping)
337  : OriginalType(OriginalType), TransformedType(TransformedType),
338  ArgumentIndexMapping(ArgumentIndexMapping) {}
339 
340  // Disallow copies.
341  TransformedFunction(const TransformedFunction &) = delete;
342  TransformedFunction &operator=(const TransformedFunction &) = delete;
343 
344  // Allow moves.
345  TransformedFunction(TransformedFunction &&) = default;
346  TransformedFunction &operator=(TransformedFunction &&) = default;
347 
348  /// Type of the function before the transformation.
349  FunctionType *OriginalType;
350 
351  /// Type of the function after the transformation.
352  FunctionType *TransformedType;
353 
354  /// Transforming a function may change the position of arguments. This
355  /// member records the mapping from each argument's old position to its new
356  /// position. Argument positions are zero-indexed. If the transformation
357  /// from F to F' made the first argument of F into the third argument of F',
358  /// then ArgumentIndexMapping[0] will equal 2.
359  std::vector<unsigned> ArgumentIndexMapping;
360 };
361 
362 /// Given function attributes from a call site for the original function,
363 /// return function attributes appropriate for a call to the transformed
364 /// function.
366 transformFunctionAttributes(const TransformedFunction &TransformedFunction,
367  LLVMContext &Ctx, AttributeList CallSiteAttrs) {
368 
369  // Construct a vector of AttributeSet for each function argument.
370  std::vector<llvm::AttributeSet> ArgumentAttributes(
371  TransformedFunction.TransformedType->getNumParams());
372 
373  // Copy attributes from the parameter of the original function to the
374  // transformed version. 'ArgumentIndexMapping' holds the mapping from
375  // old argument position to new.
376  for (unsigned I = 0, IE = TransformedFunction.ArgumentIndexMapping.size();
377  I < IE; ++I) {
378  unsigned TransformedIndex = TransformedFunction.ArgumentIndexMapping[I];
379  ArgumentAttributes[TransformedIndex] = CallSiteAttrs.getParamAttrs(I);
380  }
381 
382  // Copy annotations on varargs arguments.
383  for (unsigned I = TransformedFunction.OriginalType->getNumParams(),
384  IE = CallSiteAttrs.getNumAttrSets();
385  I < IE; ++I) {
386  ArgumentAttributes.push_back(CallSiteAttrs.getParamAttrs(I));
387  }
388 
389  return AttributeList::get(Ctx, CallSiteAttrs.getFnAttrs(),
390  CallSiteAttrs.getRetAttrs(),
391  llvm::makeArrayRef(ArgumentAttributes));
392 }
393 
394 class DataFlowSanitizer {
395  friend struct DFSanFunction;
396  friend class DFSanVisitor;
397 
398  enum { ShadowWidthBits = 8, ShadowWidthBytes = ShadowWidthBits / 8 };
399 
400  enum { OriginWidthBits = 32, OriginWidthBytes = OriginWidthBits / 8 };
401 
402  /// How should calls to uninstrumented functions be handled?
403  enum WrapperKind {
404  /// This function is present in an uninstrumented form but we don't know
405  /// how it should be handled. Print a warning and call the function anyway.
406  /// Don't label the return value.
407  WK_Warning,
408 
409  /// This function does not write to (user-accessible) memory, and its return
410  /// value is unlabelled.
411  WK_Discard,
412 
413  /// This function does not write to (user-accessible) memory, and the label
414  /// of its return value is the union of the label of its arguments.
415  WK_Functional,
416 
417  /// Instead of calling the function, a custom wrapper __dfsw_F is called,
418  /// where F is the name of the function. This function may wrap the
419  /// original function or provide its own implementation. WK_Custom uses an
420  /// extra pointer argument to return the shadow. This allows the wrapped
421  /// form of the function type to be expressed in C.
422  WK_Custom
423  };
424 
425  Module *Mod;
426  LLVMContext *Ctx;
427  Type *Int8Ptr;
428  IntegerType *OriginTy;
429  PointerType *OriginPtrTy;
430  ConstantInt *ZeroOrigin;
431  /// The shadow type for all primitive types and vector types.
432  IntegerType *PrimitiveShadowTy;
433  PointerType *PrimitiveShadowPtrTy;
434  IntegerType *IntptrTy;
435  ConstantInt *ZeroPrimitiveShadow;
436  Constant *ArgTLS;
437  ArrayType *ArgOriginTLSTy;
438  Constant *ArgOriginTLS;
439  Constant *RetvalTLS;
440  Constant *RetvalOriginTLS;
441  FunctionType *DFSanUnionLoadFnTy;
442  FunctionType *DFSanLoadLabelAndOriginFnTy;
443  FunctionType *DFSanUnimplementedFnTy;
444  FunctionType *DFSanWrapperExternWeakNullFnTy;
445  FunctionType *DFSanSetLabelFnTy;
446  FunctionType *DFSanNonzeroLabelFnTy;
447  FunctionType *DFSanVarargWrapperFnTy;
448  FunctionType *DFSanConditionalCallbackFnTy;
449  FunctionType *DFSanConditionalCallbackOriginFnTy;
450  FunctionType *DFSanCmpCallbackFnTy;
451  FunctionType *DFSanLoadStoreCallbackFnTy;
452  FunctionType *DFSanMemTransferCallbackFnTy;
453  FunctionType *DFSanChainOriginFnTy;
454  FunctionType *DFSanChainOriginIfTaintedFnTy;
455  FunctionType *DFSanMemOriginTransferFnTy;
456  FunctionType *DFSanMemShadowOriginTransferFnTy;
457  FunctionType *DFSanMemShadowOriginConditionalExchangeFnTy;
458  FunctionType *DFSanMaybeStoreOriginFnTy;
459  FunctionCallee DFSanUnionLoadFn;
460  FunctionCallee DFSanLoadLabelAndOriginFn;
461  FunctionCallee DFSanUnimplementedFn;
462  FunctionCallee DFSanWrapperExternWeakNullFn;
463  FunctionCallee DFSanSetLabelFn;
464  FunctionCallee DFSanNonzeroLabelFn;
465  FunctionCallee DFSanVarargWrapperFn;
466  FunctionCallee DFSanLoadCallbackFn;
467  FunctionCallee DFSanStoreCallbackFn;
468  FunctionCallee DFSanMemTransferCallbackFn;
469  FunctionCallee DFSanConditionalCallbackFn;
470  FunctionCallee DFSanConditionalCallbackOriginFn;
471  FunctionCallee DFSanCmpCallbackFn;
472  FunctionCallee DFSanChainOriginFn;
473  FunctionCallee DFSanChainOriginIfTaintedFn;
474  FunctionCallee DFSanMemOriginTransferFn;
475  FunctionCallee DFSanMemShadowOriginTransferFn;
476  FunctionCallee DFSanMemShadowOriginConditionalExchangeFn;
477  FunctionCallee DFSanMaybeStoreOriginFn;
478  SmallPtrSet<Value *, 16> DFSanRuntimeFunctions;
479  MDNode *ColdCallWeights;
480  MDNode *OriginStoreWeights;
481  DFSanABIList ABIList;
482  DenseMap<Value *, Function *> UnwrappedFnMap;
483  AttributeMask ReadOnlyNoneAttrs;
484  StringSet<> CombineTaintLookupTableNames;
485 
486  /// Memory map parameters used in calculation mapping application addresses
487  /// to shadow addresses and origin addresses.
488  const MemoryMapParams *MapParams;
489 
490  Value *getShadowOffset(Value *Addr, IRBuilder<> &IRB);
491  Value *getShadowAddress(Value *Addr, Instruction *Pos);
492  Value *getShadowAddress(Value *Addr, Instruction *Pos, Value *ShadowOffset);
493  std::pair<Value *, Value *>
494  getShadowOriginAddress(Value *Addr, Align InstAlignment, Instruction *Pos);
495  bool isInstrumented(const Function *F);
496  bool isInstrumented(const GlobalAlias *GA);
497  bool isForceZeroLabels(const Function *F);
498  TransformedFunction getCustomFunctionType(FunctionType *T);
499  WrapperKind getWrapperKind(Function *F);
500  void addGlobalNameSuffix(GlobalValue *GV);
501  void buildExternWeakCheckIfNeeded(IRBuilder<> &IRB, Function *F);
502  Function *buildWrapperFunction(Function *F, StringRef NewFName,
503  GlobalValue::LinkageTypes NewFLink,
504  FunctionType *NewFT);
505  void initializeCallbackFunctions(Module &M);
506  void initializeRuntimeFunctions(Module &M);
507  void injectMetadataGlobals(Module &M);
508  bool initializeModule(Module &M);
509 
510  /// Advances \p OriginAddr to point to the next 32-bit origin and then loads
511  /// from it. Returns the origin's loaded value.
512  Value *loadNextOrigin(Instruction *Pos, Align OriginAlign,
513  Value **OriginAddr);
514 
515  /// Returns whether the given load byte size is amenable to inlined
516  /// optimization patterns.
517  bool hasLoadSizeForFastPath(uint64_t Size);
518 
519  /// Returns whether the pass tracks origins. Supports only TLS ABI mode.
520  bool shouldTrackOrigins();
521 
522  /// Returns a zero constant with the shadow type of OrigTy.
523  ///
524  /// getZeroShadow({T1,T2,...}) = {getZeroShadow(T1),getZeroShadow(T2,...}
525  /// getZeroShadow([n x T]) = [n x getZeroShadow(T)]
526  /// getZeroShadow(other type) = i16(0)
527  Constant *getZeroShadow(Type *OrigTy);
528  /// Returns a zero constant with the shadow type of V's type.
529  Constant *getZeroShadow(Value *V);
530 
531  /// Checks if V is a zero shadow.
532  bool isZeroShadow(Value *V);
533 
534  /// Returns the shadow type of OrigTy.
535  ///
536  /// getShadowTy({T1,T2,...}) = {getShadowTy(T1),getShadowTy(T2),...}
537  /// getShadowTy([n x T]) = [n x getShadowTy(T)]
538  /// getShadowTy(other type) = i16
539  Type *getShadowTy(Type *OrigTy);
540  /// Returns the shadow type of of V's type.
541  Type *getShadowTy(Value *V);
542 
543  const uint64_t NumOfElementsInArgOrgTLS = ArgTLSSize / OriginWidthBytes;
544 
545 public:
546  DataFlowSanitizer(const std::vector<std::string> &ABIListFiles);
547 
548  bool runImpl(Module &M,
550 };
551 
552 struct DFSanFunction {
553  DataFlowSanitizer &DFS;
554  Function *F;
555  DominatorTree DT;
556  bool IsNativeABI;
557  bool IsForceZeroLabels;
558  TargetLibraryInfo &TLI;
559  AllocaInst *LabelReturnAlloca = nullptr;
560  AllocaInst *OriginReturnAlloca = nullptr;
561  DenseMap<Value *, Value *> ValShadowMap;
562  DenseMap<Value *, Value *> ValOriginMap;
563  DenseMap<AllocaInst *, AllocaInst *> AllocaShadowMap;
564  DenseMap<AllocaInst *, AllocaInst *> AllocaOriginMap;
565 
566  struct PHIFixupElement {
567  PHINode *Phi;
568  PHINode *ShadowPhi;
569  PHINode *OriginPhi;
570  };
571  std::vector<PHIFixupElement> PHIFixups;
572 
573  DenseSet<Instruction *> SkipInsts;
574  std::vector<Value *> NonZeroChecks;
575 
576  struct CachedShadow {
577  BasicBlock *Block; // The block where Shadow is defined.
578  Value *Shadow;
579  };
580  /// Maps a value to its latest shadow value in terms of domination tree.
581  DenseMap<std::pair<Value *, Value *>, CachedShadow> CachedShadows;
582  /// Maps a value to its latest collapsed shadow value it was converted to in
583  /// terms of domination tree. When ClDebugNonzeroLabels is on, this cache is
584  /// used at a post process where CFG blocks are split. So it does not cache
585  /// BasicBlock like CachedShadows, but uses domination between values.
586  DenseMap<Value *, Value *> CachedCollapsedShadows;
587  DenseMap<Value *, std::set<Value *>> ShadowElements;
588 
589  DFSanFunction(DataFlowSanitizer &DFS, Function *F, bool IsNativeABI,
590  bool IsForceZeroLabels, TargetLibraryInfo &TLI)
591  : DFS(DFS), F(F), IsNativeABI(IsNativeABI),
592  IsForceZeroLabels(IsForceZeroLabels), TLI(TLI) {
593  DT.recalculate(*F);
594  }
595 
596  /// Computes the shadow address for a given function argument.
597  ///
598  /// Shadow = ArgTLS+ArgOffset.
599  Value *getArgTLS(Type *T, unsigned ArgOffset, IRBuilder<> &IRB);
600 
601  /// Computes the shadow address for a return value.
602  Value *getRetvalTLS(Type *T, IRBuilder<> &IRB);
603 
604  /// Computes the origin address for a given function argument.
605  ///
606  /// Origin = ArgOriginTLS[ArgNo].
607  Value *getArgOriginTLS(unsigned ArgNo, IRBuilder<> &IRB);
608 
609  /// Computes the origin address for a return value.
610  Value *getRetvalOriginTLS();
611 
612  Value *getOrigin(Value *V);
613  void setOrigin(Instruction *I, Value *Origin);
614  /// Generates IR to compute the origin of the last operand with a taint label.
615  Value *combineOperandOrigins(Instruction *Inst);
616  /// Before the instruction Pos, generates IR to compute the last origin with a
617  /// taint label. Labels and origins are from vectors Shadows and Origins
618  /// correspondingly. The generated IR is like
619  /// Sn-1 != Zero ? On-1: ... S2 != Zero ? O2: S1 != Zero ? O1: O0
620  /// When Zero is nullptr, it uses ZeroPrimitiveShadow. Otherwise it can be
621  /// zeros with other bitwidths.
622  Value *combineOrigins(const std::vector<Value *> &Shadows,
623  const std::vector<Value *> &Origins, Instruction *Pos,
624  ConstantInt *Zero = nullptr);
625 
626  Value *getShadow(Value *V);
627  void setShadow(Instruction *I, Value *Shadow);
628  /// Generates IR to compute the union of the two given shadows, inserting it
629  /// before Pos. The combined value is with primitive type.
630  Value *combineShadows(Value *V1, Value *V2, Instruction *Pos);
631  /// Combines the shadow values of V1 and V2, then converts the combined value
632  /// with primitive type into a shadow value with the original type T.
633  Value *combineShadowsThenConvert(Type *T, Value *V1, Value *V2,
634  Instruction *Pos);
635  Value *combineOperandShadows(Instruction *Inst);
636 
637  /// Generates IR to load shadow and origin corresponding to bytes [\p
638  /// Addr, \p Addr + \p Size), where addr has alignment \p
639  /// InstAlignment, and take the union of each of those shadows. The returned
640  /// shadow always has primitive type.
641  ///
642  /// When tracking loads is enabled, the returned origin is a chain at the
643  /// current stack if the returned shadow is tainted.
644  std::pair<Value *, Value *> loadShadowOrigin(Value *Addr, uint64_t Size,
645  Align InstAlignment,
646  Instruction *Pos);
647 
648  void storePrimitiveShadowOrigin(Value *Addr, uint64_t Size,
649  Align InstAlignment, Value *PrimitiveShadow,
650  Value *Origin, Instruction *Pos);
651  /// Applies PrimitiveShadow to all primitive subtypes of T, returning
652  /// the expanded shadow value.
653  ///
654  /// EFP({T1,T2, ...}, PS) = {EFP(T1,PS),EFP(T2,PS),...}
655  /// EFP([n x T], PS) = [n x EFP(T,PS)]
656  /// EFP(other types, PS) = PS
657  Value *expandFromPrimitiveShadow(Type *T, Value *PrimitiveShadow,
658  Instruction *Pos);
659  /// Collapses Shadow into a single primitive shadow value, unioning all
660  /// primitive shadow values in the process. Returns the final primitive
661  /// shadow value.
662  ///
663  /// CTP({V1,V2, ...}) = UNION(CFP(V1,PS),CFP(V2,PS),...)
664  /// CTP([V1,V2,...]) = UNION(CFP(V1,PS),CFP(V2,PS),...)
665  /// CTP(other types, PS) = PS
666  Value *collapseToPrimitiveShadow(Value *Shadow, Instruction *Pos);
667 
668  void storeZeroPrimitiveShadow(Value *Addr, uint64_t Size, Align ShadowAlign,
669  Instruction *Pos);
670 
671  Align getShadowAlign(Align InstAlignment);
672 
673  // If ClConditionalCallbacks is enabled, insert a callback after a given
674  // branch instruction using the given conditional expression.
675  void addConditionalCallbacksIfEnabled(Instruction &I, Value *Condition);
676 
677  bool isLookupTableConstant(Value *P);
678 
679 private:
680  /// Collapses the shadow with aggregate type into a single primitive shadow
681  /// value.
682  template <class AggregateType>
683  Value *collapseAggregateShadow(AggregateType *AT, Value *Shadow,
684  IRBuilder<> &IRB);
685 
686  Value *collapseToPrimitiveShadow(Value *Shadow, IRBuilder<> &IRB);
687 
688  /// Returns the shadow value of an argument A.
689  Value *getShadowForTLSArgument(Argument *A);
690 
691  /// The fast path of loading shadows.
692  std::pair<Value *, Value *>
693  loadShadowFast(Value *ShadowAddr, Value *OriginAddr, uint64_t Size,
694  Align ShadowAlign, Align OriginAlign, Value *FirstOrigin,
695  Instruction *Pos);
696 
697  Align getOriginAlign(Align InstAlignment);
698 
699  /// Because 4 contiguous bytes share one 4-byte origin, the most accurate load
700  /// is __dfsan_load_label_and_origin. This function returns the union of all
701  /// labels and the origin of the first taint label. However this is an
702  /// additional call with many instructions. To ensure common cases are fast,
703  /// checks if it is possible to load labels and origins without using the
704  /// callback function.
705  ///
706  /// When enabling tracking load instructions, we always use
707  /// __dfsan_load_label_and_origin to reduce code size.
708  bool useCallbackLoadLabelAndOrigin(uint64_t Size, Align InstAlignment);
709 
710  /// Returns a chain at the current stack with previous origin V.
711  Value *updateOrigin(Value *V, IRBuilder<> &IRB);
712 
713  /// Returns a chain at the current stack with previous origin V if Shadow is
714  /// tainted.
715  Value *updateOriginIfTainted(Value *Shadow, Value *Origin, IRBuilder<> &IRB);
716 
717  /// Creates an Intptr = Origin | Origin << 32 if Intptr's size is 64. Returns
718  /// Origin otherwise.
719  Value *originToIntptr(IRBuilder<> &IRB, Value *Origin);
720 
721  /// Stores Origin into the address range [StoreOriginAddr, StoreOriginAddr +
722  /// Size).
723  void paintOrigin(IRBuilder<> &IRB, Value *Origin, Value *StoreOriginAddr,
724  uint64_t StoreOriginSize, Align Alignment);
725 
726  /// Stores Origin in terms of its Shadow value.
727  /// * Do not write origins for zero shadows because we do not trace origins
728  /// for untainted sinks.
729  /// * Use __dfsan_maybe_store_origin if there are too many origin store
730  /// instrumentations.
731  void storeOrigin(Instruction *Pos, Value *Addr, uint64_t Size, Value *Shadow,
732  Value *Origin, Value *StoreOriginAddr, Align InstAlignment);
733 
734  /// Convert a scalar value to an i1 by comparing with 0.
735  Value *convertToBool(Value *V, IRBuilder<> &IRB, const Twine &Name = "");
736 
737  bool shouldInstrumentWithCall();
738 
739  /// Generates IR to load shadow and origin corresponding to bytes [\p
740  /// Addr, \p Addr + \p Size), where addr has alignment \p
741  /// InstAlignment, and take the union of each of those shadows. The returned
742  /// shadow always has primitive type.
743  std::pair<Value *, Value *>
744  loadShadowOriginSansLoadTracking(Value *Addr, uint64_t Size,
745  Align InstAlignment, Instruction *Pos);
746  int NumOriginStores = 0;
747 };
748 
749 class DFSanVisitor : public InstVisitor<DFSanVisitor> {
750 public:
751  DFSanFunction &DFSF;
752 
753  DFSanVisitor(DFSanFunction &DFSF) : DFSF(DFSF) {}
754 
755  const DataLayout &getDataLayout() const {
756  return DFSF.F->getParent()->getDataLayout();
757  }
758 
759  // Combines shadow values and origins for all of I's operands.
760  void visitInstOperands(Instruction &I);
761 
762  void visitUnaryOperator(UnaryOperator &UO);
763  void visitBinaryOperator(BinaryOperator &BO);
764  void visitBitCastInst(BitCastInst &BCI);
765  void visitCastInst(CastInst &CI);
766  void visitCmpInst(CmpInst &CI);
767  void visitLandingPadInst(LandingPadInst &LPI);
768  void visitGetElementPtrInst(GetElementPtrInst &GEPI);
769  void visitLoadInst(LoadInst &LI);
770  void visitStoreInst(StoreInst &SI);
771  void visitAtomicRMWInst(AtomicRMWInst &I);
772  void visitAtomicCmpXchgInst(AtomicCmpXchgInst &I);
773  void visitReturnInst(ReturnInst &RI);
774  void visitLibAtomicLoad(CallBase &CB);
775  void visitLibAtomicStore(CallBase &CB);
776  void visitLibAtomicExchange(CallBase &CB);
777  void visitLibAtomicCompareExchange(CallBase &CB);
778  void visitCallBase(CallBase &CB);
779  void visitPHINode(PHINode &PN);
780  void visitExtractElementInst(ExtractElementInst &I);
781  void visitInsertElementInst(InsertElementInst &I);
782  void visitShuffleVectorInst(ShuffleVectorInst &I);
783  void visitExtractValueInst(ExtractValueInst &I);
784  void visitInsertValueInst(InsertValueInst &I);
785  void visitAllocaInst(AllocaInst &I);
786  void visitSelectInst(SelectInst &I);
787  void visitMemSetInst(MemSetInst &I);
788  void visitMemTransferInst(MemTransferInst &I);
789  void visitBranchInst(BranchInst &BR);
790  void visitSwitchInst(SwitchInst &SW);
791 
792 private:
793  void visitCASOrRMW(Align InstAlignment, Instruction &I);
794 
795  // Returns false when this is an invoke of a custom function.
796  bool visitWrappedCallBase(Function &F, CallBase &CB);
797 
798  // Combines origins for all of I's operands.
799  void visitInstOperandOrigins(Instruction &I);
800 
801  void addShadowArguments(Function &F, CallBase &CB, std::vector<Value *> &Args,
802  IRBuilder<> &IRB);
803 
804  void addOriginArguments(Function &F, CallBase &CB, std::vector<Value *> &Args,
805  IRBuilder<> &IRB);
806 
807  Value *makeAddAcquireOrderingTable(IRBuilder<> &IRB);
808  Value *makeAddReleaseOrderingTable(IRBuilder<> &IRB);
809 };
810 
811 bool LibAtomicFunction(const Function &F) {
812  // This is a bit of a hack because TargetLibraryInfo is a function pass.
813  // The DFSan pass would need to be refactored to be function pass oriented
814  // (like MSan is) in order to fit together nicely with TargetLibraryInfo.
815  // We need this check to prevent them from being instrumented, or wrapped.
816  // Match on name and number of arguments.
817  if (!F.hasName() || F.isVarArg())
818  return false;
819  switch (F.arg_size()) {
820  case 4:
821  return F.getName() == "__atomic_load" || F.getName() == "__atomic_store";
822  case 5:
823  return F.getName() == "__atomic_exchange";
824  case 6:
825  return F.getName() == "__atomic_compare_exchange";
826  default:
827  return false;
828  }
829 }
830 
831 } // end anonymous namespace
832 
833 DataFlowSanitizer::DataFlowSanitizer(
834  const std::vector<std::string> &ABIListFiles) {
835  std::vector<std::string> AllABIListFiles(std::move(ABIListFiles));
836  llvm::append_range(AllABIListFiles, ClABIListFiles);
837  // FIXME: should we propagate vfs::FileSystem to this constructor?
838  ABIList.set(
840 
842  CombineTaintLookupTableNames.insert(v);
843 }
844 
845 TransformedFunction DataFlowSanitizer::getCustomFunctionType(FunctionType *T) {
846  SmallVector<Type *, 4> ArgTypes;
847 
848  // Some parameters of the custom function being constructed are
849  // parameters of T. Record the mapping from parameters of T to
850  // parameters of the custom function, so that parameter attributes
851  // at call sites can be updated.
852  std::vector<unsigned> ArgumentIndexMapping;
853  for (unsigned I = 0, E = T->getNumParams(); I != E; ++I) {
854  Type *ParamType = T->getParamType(I);
855  ArgumentIndexMapping.push_back(ArgTypes.size());
856  ArgTypes.push_back(ParamType);
857  }
858  for (unsigned I = 0, E = T->getNumParams(); I != E; ++I)
859  ArgTypes.push_back(PrimitiveShadowTy);
860  if (T->isVarArg())
861  ArgTypes.push_back(PrimitiveShadowPtrTy);
862  Type *RetType = T->getReturnType();
863  if (!RetType->isVoidTy())
864  ArgTypes.push_back(PrimitiveShadowPtrTy);
865 
866  if (shouldTrackOrigins()) {
867  for (unsigned I = 0, E = T->getNumParams(); I != E; ++I)
868  ArgTypes.push_back(OriginTy);
869  if (T->isVarArg())
870  ArgTypes.push_back(OriginPtrTy);
871  if (!RetType->isVoidTy())
872  ArgTypes.push_back(OriginPtrTy);
873  }
874 
875  return TransformedFunction(
876  T, FunctionType::get(T->getReturnType(), ArgTypes, T->isVarArg()),
877  ArgumentIndexMapping);
878 }
879 
880 bool DataFlowSanitizer::isZeroShadow(Value *V) {
881  Type *T = V->getType();
882  if (!isa<ArrayType>(T) && !isa<StructType>(T)) {
883  if (const ConstantInt *CI = dyn_cast<ConstantInt>(V))
884  return CI->isZero();
885  return false;
886  }
887 
888  return isa<ConstantAggregateZero>(V);
889 }
890 
891 bool DataFlowSanitizer::hasLoadSizeForFastPath(uint64_t Size) {
892  uint64_t ShadowSize = Size * ShadowWidthBytes;
893  return ShadowSize % 8 == 0 || ShadowSize == 4;
894 }
895 
896 bool DataFlowSanitizer::shouldTrackOrigins() {
897  static const bool ShouldTrackOrigins = ClTrackOrigins;
898  return ShouldTrackOrigins;
899 }
900 
901 Constant *DataFlowSanitizer::getZeroShadow(Type *OrigTy) {
902  if (!isa<ArrayType>(OrigTy) && !isa<StructType>(OrigTy))
903  return ZeroPrimitiveShadow;
904  Type *ShadowTy = getShadowTy(OrigTy);
905  return ConstantAggregateZero::get(ShadowTy);
906 }
907 
908 Constant *DataFlowSanitizer::getZeroShadow(Value *V) {
909  return getZeroShadow(V->getType());
910 }
911 
913  Value *Shadow, SmallVector<unsigned, 4> &Indices, Type *SubShadowTy,
914  Value *PrimitiveShadow, IRBuilder<> &IRB) {
915  if (!isa<ArrayType>(SubShadowTy) && !isa<StructType>(SubShadowTy))
916  return IRB.CreateInsertValue(Shadow, PrimitiveShadow, Indices);
917 
918  if (ArrayType *AT = dyn_cast<ArrayType>(SubShadowTy)) {
919  for (unsigned Idx = 0; Idx < AT->getNumElements(); Idx++) {
920  Indices.push_back(Idx);
922  Shadow, Indices, AT->getElementType(), PrimitiveShadow, IRB);
923  Indices.pop_back();
924  }
925  return Shadow;
926  }
927 
928  if (StructType *ST = dyn_cast<StructType>(SubShadowTy)) {
929  for (unsigned Idx = 0; Idx < ST->getNumElements(); Idx++) {
930  Indices.push_back(Idx);
932  Shadow, Indices, ST->getElementType(Idx), PrimitiveShadow, IRB);
933  Indices.pop_back();
934  }
935  return Shadow;
936  }
937  llvm_unreachable("Unexpected shadow type");
938 }
939 
940 bool DFSanFunction::shouldInstrumentWithCall() {
941  return ClInstrumentWithCallThreshold >= 0 &&
942  NumOriginStores >= ClInstrumentWithCallThreshold;
943 }
944 
945 Value *DFSanFunction::expandFromPrimitiveShadow(Type *T, Value *PrimitiveShadow,
946  Instruction *Pos) {
947  Type *ShadowTy = DFS.getShadowTy(T);
948 
949  if (!isa<ArrayType>(ShadowTy) && !isa<StructType>(ShadowTy))
950  return PrimitiveShadow;
951 
952  if (DFS.isZeroShadow(PrimitiveShadow))
953  return DFS.getZeroShadow(ShadowTy);
954 
955  IRBuilder<> IRB(Pos);
956  SmallVector<unsigned, 4> Indices;
957  Value *Shadow = UndefValue::get(ShadowTy);
958  Shadow = expandFromPrimitiveShadowRecursive(Shadow, Indices, ShadowTy,
959  PrimitiveShadow, IRB);
960 
961  // Caches the primitive shadow value that built the shadow value.
962  CachedCollapsedShadows[Shadow] = PrimitiveShadow;
963  return Shadow;
964 }
965 
966 template <class AggregateType>
967 Value *DFSanFunction::collapseAggregateShadow(AggregateType *AT, Value *Shadow,
968  IRBuilder<> &IRB) {
969  if (!AT->getNumElements())
970  return DFS.ZeroPrimitiveShadow;
971 
972  Value *FirstItem = IRB.CreateExtractValue(Shadow, 0);
973  Value *Aggregator = collapseToPrimitiveShadow(FirstItem, IRB);
974 
975  for (unsigned Idx = 1; Idx < AT->getNumElements(); Idx++) {
976  Value *ShadowItem = IRB.CreateExtractValue(Shadow, Idx);
977  Value *ShadowInner = collapseToPrimitiveShadow(ShadowItem, IRB);
978  Aggregator = IRB.CreateOr(Aggregator, ShadowInner);
979  }
980  return Aggregator;
981 }
982 
983 Value *DFSanFunction::collapseToPrimitiveShadow(Value *Shadow,
984  IRBuilder<> &IRB) {
985  Type *ShadowTy = Shadow->getType();
986  if (!isa<ArrayType>(ShadowTy) && !isa<StructType>(ShadowTy))
987  return Shadow;
988  if (ArrayType *AT = dyn_cast<ArrayType>(ShadowTy))
989  return collapseAggregateShadow<>(AT, Shadow, IRB);
990  if (StructType *ST = dyn_cast<StructType>(ShadowTy))
991  return collapseAggregateShadow<>(ST, Shadow, IRB);
992  llvm_unreachable("Unexpected shadow type");
993 }
994 
995 Value *DFSanFunction::collapseToPrimitiveShadow(Value *Shadow,
996  Instruction *Pos) {
997  Type *ShadowTy = Shadow->getType();
998  if (!isa<ArrayType>(ShadowTy) && !isa<StructType>(ShadowTy))
999  return Shadow;
1000 
1001  // Checks if the cached collapsed shadow value dominates Pos.
1002  Value *&CS = CachedCollapsedShadows[Shadow];
1003  if (CS && DT.dominates(CS, Pos))
1004  return CS;
1005 
1006  IRBuilder<> IRB(Pos);
1007  Value *PrimitiveShadow = collapseToPrimitiveShadow(Shadow, IRB);
1008  // Caches the converted primitive shadow value.
1009  CS = PrimitiveShadow;
1010  return PrimitiveShadow;
1011 }
1012 
1013 void DFSanFunction::addConditionalCallbacksIfEnabled(Instruction &I,
1014  Value *Condition) {
1015  if (!ClConditionalCallbacks) {
1016  return;
1017  }
1018  IRBuilder<> IRB(&I);
1019  Value *CondShadow = getShadow(Condition);
1020  if (DFS.shouldTrackOrigins()) {
1021  Value *CondOrigin = getOrigin(Condition);
1022  IRB.CreateCall(DFS.DFSanConditionalCallbackOriginFn,
1023  {CondShadow, CondOrigin});
1024  } else {
1025  IRB.CreateCall(DFS.DFSanConditionalCallbackFn, {CondShadow});
1026  }
1027 }
1028 
1029 Type *DataFlowSanitizer::getShadowTy(Type *OrigTy) {
1030  if (!OrigTy->isSized())
1031  return PrimitiveShadowTy;
1032  if (isa<IntegerType>(OrigTy))
1033  return PrimitiveShadowTy;
1034  if (isa<VectorType>(OrigTy))
1035  return PrimitiveShadowTy;
1036  if (ArrayType *AT = dyn_cast<ArrayType>(OrigTy))
1037  return ArrayType::get(getShadowTy(AT->getElementType()),
1038  AT->getNumElements());
1039  if (StructType *ST = dyn_cast<StructType>(OrigTy)) {
1041  for (unsigned I = 0, N = ST->getNumElements(); I < N; ++I)
1042  Elements.push_back(getShadowTy(ST->getElementType(I)));
1043  return StructType::get(*Ctx, Elements);
1044  }
1045  return PrimitiveShadowTy;
1046 }
1047 
1048 Type *DataFlowSanitizer::getShadowTy(Value *V) {
1049  return getShadowTy(V->getType());
1050 }
1051 
1052 bool DataFlowSanitizer::initializeModule(Module &M) {
1053  Triple TargetTriple(M.getTargetTriple());
1054  const DataLayout &DL = M.getDataLayout();
1055 
1056  if (TargetTriple.getOS() != Triple::Linux)
1057  report_fatal_error("unsupported operating system");
1058  if (TargetTriple.getArch() != Triple::x86_64)
1059  report_fatal_error("unsupported architecture");
1060  MapParams = &Linux_X86_64_MemoryMapParams;
1061 
1062  Mod = &M;
1063  Ctx = &M.getContext();
1064  Int8Ptr = Type::getInt8PtrTy(*Ctx);
1065  OriginTy = IntegerType::get(*Ctx, OriginWidthBits);
1066  OriginPtrTy = PointerType::getUnqual(OriginTy);
1067  PrimitiveShadowTy = IntegerType::get(*Ctx, ShadowWidthBits);
1068  PrimitiveShadowPtrTy = PointerType::getUnqual(PrimitiveShadowTy);
1069  IntptrTy = DL.getIntPtrType(*Ctx);
1070  ZeroPrimitiveShadow = ConstantInt::getSigned(PrimitiveShadowTy, 0);
1071  ZeroOrigin = ConstantInt::getSigned(OriginTy, 0);
1072 
1073  Type *DFSanUnionLoadArgs[2] = {PrimitiveShadowPtrTy, IntptrTy};
1074  DFSanUnionLoadFnTy = FunctionType::get(PrimitiveShadowTy, DFSanUnionLoadArgs,
1075  /*isVarArg=*/false);
1076  Type *DFSanLoadLabelAndOriginArgs[2] = {Int8Ptr, IntptrTy};
1077  DFSanLoadLabelAndOriginFnTy =
1078  FunctionType::get(IntegerType::get(*Ctx, 64), DFSanLoadLabelAndOriginArgs,
1079  /*isVarArg=*/false);
1080  DFSanUnimplementedFnTy = FunctionType::get(
1081  Type::getVoidTy(*Ctx), Type::getInt8PtrTy(*Ctx), /*isVarArg=*/false);
1082  Type *DFSanWrapperExternWeakNullArgs[2] = {Int8Ptr, Int8Ptr};
1083  DFSanWrapperExternWeakNullFnTy =
1084  FunctionType::get(Type::getVoidTy(*Ctx), DFSanWrapperExternWeakNullArgs,
1085  /*isVarArg=*/false);
1086  Type *DFSanSetLabelArgs[4] = {PrimitiveShadowTy, OriginTy,
1087  Type::getInt8PtrTy(*Ctx), IntptrTy};
1088  DFSanSetLabelFnTy = FunctionType::get(Type::getVoidTy(*Ctx),
1089  DFSanSetLabelArgs, /*isVarArg=*/false);
1090  DFSanNonzeroLabelFnTy =
1091  FunctionType::get(Type::getVoidTy(*Ctx), None, /*isVarArg=*/false);
1092  DFSanVarargWrapperFnTy = FunctionType::get(
1093  Type::getVoidTy(*Ctx), Type::getInt8PtrTy(*Ctx), /*isVarArg=*/false);
1094  DFSanConditionalCallbackFnTy =
1095  FunctionType::get(Type::getVoidTy(*Ctx), PrimitiveShadowTy,
1096  /*isVarArg=*/false);
1097  Type *DFSanConditionalCallbackOriginArgs[2] = {PrimitiveShadowTy, OriginTy};
1098  DFSanConditionalCallbackOriginFnTy = FunctionType::get(
1099  Type::getVoidTy(*Ctx), DFSanConditionalCallbackOriginArgs,
1100  /*isVarArg=*/false);
1101  DFSanCmpCallbackFnTy =
1102  FunctionType::get(Type::getVoidTy(*Ctx), PrimitiveShadowTy,
1103  /*isVarArg=*/false);
1104  DFSanChainOriginFnTy =
1105  FunctionType::get(OriginTy, OriginTy, /*isVarArg=*/false);
1106  Type *DFSanChainOriginIfTaintedArgs[2] = {PrimitiveShadowTy, OriginTy};
1107  DFSanChainOriginIfTaintedFnTy = FunctionType::get(
1108  OriginTy, DFSanChainOriginIfTaintedArgs, /*isVarArg=*/false);
1109  Type *DFSanMaybeStoreOriginArgs[4] = {IntegerType::get(*Ctx, ShadowWidthBits),
1110  Int8Ptr, IntptrTy, OriginTy};
1111  DFSanMaybeStoreOriginFnTy = FunctionType::get(
1112  Type::getVoidTy(*Ctx), DFSanMaybeStoreOriginArgs, /*isVarArg=*/false);
1113  Type *DFSanMemOriginTransferArgs[3] = {Int8Ptr, Int8Ptr, IntptrTy};
1114  DFSanMemOriginTransferFnTy = FunctionType::get(
1115  Type::getVoidTy(*Ctx), DFSanMemOriginTransferArgs, /*isVarArg=*/false);
1116  Type *DFSanMemShadowOriginTransferArgs[3] = {Int8Ptr, Int8Ptr, IntptrTy};
1117  DFSanMemShadowOriginTransferFnTy =
1118  FunctionType::get(Type::getVoidTy(*Ctx), DFSanMemShadowOriginTransferArgs,
1119  /*isVarArg=*/false);
1120  Type *DFSanMemShadowOriginConditionalExchangeArgs[5] = {
1121  IntegerType::get(*Ctx, 8), Int8Ptr, Int8Ptr, Int8Ptr, IntptrTy};
1122  DFSanMemShadowOriginConditionalExchangeFnTy = FunctionType::get(
1123  Type::getVoidTy(*Ctx), DFSanMemShadowOriginConditionalExchangeArgs,
1124  /*isVarArg=*/false);
1125  Type *DFSanLoadStoreCallbackArgs[2] = {PrimitiveShadowTy, Int8Ptr};
1126  DFSanLoadStoreCallbackFnTy =
1127  FunctionType::get(Type::getVoidTy(*Ctx), DFSanLoadStoreCallbackArgs,
1128  /*isVarArg=*/false);
1129  Type *DFSanMemTransferCallbackArgs[2] = {PrimitiveShadowPtrTy, IntptrTy};
1130  DFSanMemTransferCallbackFnTy =
1131  FunctionType::get(Type::getVoidTy(*Ctx), DFSanMemTransferCallbackArgs,
1132  /*isVarArg=*/false);
1133 
1134  ColdCallWeights = MDBuilder(*Ctx).createBranchWeights(1, 1000);
1135  OriginStoreWeights = MDBuilder(*Ctx).createBranchWeights(1, 1000);
1136  return true;
1137 }
1138 
1139 bool DataFlowSanitizer::isInstrumented(const Function *F) {
1140  return !ABIList.isIn(*F, "uninstrumented");
1141 }
1142 
1143 bool DataFlowSanitizer::isInstrumented(const GlobalAlias *GA) {
1144  return !ABIList.isIn(*GA, "uninstrumented");
1145 }
1146 
1147 bool DataFlowSanitizer::isForceZeroLabels(const Function *F) {
1148  return ABIList.isIn(*F, "force_zero_labels");
1149 }
1150 
1151 DataFlowSanitizer::WrapperKind DataFlowSanitizer::getWrapperKind(Function *F) {
1152  if (ABIList.isIn(*F, "functional"))
1153  return WK_Functional;
1154  if (ABIList.isIn(*F, "discard"))
1155  return WK_Discard;
1156  if (ABIList.isIn(*F, "custom"))
1157  return WK_Custom;
1158 
1159  return WK_Warning;
1160 }
1161 
1162 void DataFlowSanitizer::addGlobalNameSuffix(GlobalValue *GV) {
1163  std::string GVName = std::string(GV->getName()), Suffix = ".dfsan";
1164  GV->setName(GVName + Suffix);
1165 
1166  // Try to change the name of the function in module inline asm. We only do
1167  // this for specific asm directives, currently only ".symver", to try to avoid
1168  // corrupting asm which happens to contain the symbol name as a substring.
1169  // Note that the substitution for .symver assumes that the versioned symbol
1170  // also has an instrumented name.
1171  std::string Asm = GV->getParent()->getModuleInlineAsm();
1172  std::string SearchStr = ".symver " + GVName + ",";
1173  size_t Pos = Asm.find(SearchStr);
1174  if (Pos != std::string::npos) {
1175  Asm.replace(Pos, SearchStr.size(), ".symver " + GVName + Suffix + ",");
1176  Pos = Asm.find("@");
1177 
1178  if (Pos == std::string::npos)
1179  report_fatal_error(Twine("unsupported .symver: ", Asm));
1180 
1181  Asm.replace(Pos, 1, Suffix + "@");
1183  }
1184 }
1185 
1186 void DataFlowSanitizer::buildExternWeakCheckIfNeeded(IRBuilder<> &IRB,
1187  Function *F) {
1188  // If the function we are wrapping was ExternWeak, it may be null.
1189  // The original code before calling this wrapper may have checked for null,
1190  // but replacing with a known-to-not-be-null wrapper can break this check.
1191  // When replacing uses of the extern weak function with the wrapper we try
1192  // to avoid replacing uses in conditionals, but this is not perfect.
1193  // In the case where we fail, and accidentally optimize out a null check
1194  // for a extern weak function, add a check here to help identify the issue.
1195  if (GlobalValue::isExternalWeakLinkage(F->getLinkage())) {
1196  std::vector<Value *> Args;
1197  Args.push_back(IRB.CreatePointerCast(F, IRB.getInt8PtrTy()));
1198  Args.push_back(IRB.CreateGlobalStringPtr(F->getName()));
1199  IRB.CreateCall(DFSanWrapperExternWeakNullFn, Args);
1200  }
1201 }
1202 
1203 Function *
1204 DataFlowSanitizer::buildWrapperFunction(Function *F, StringRef NewFName,
1205  GlobalValue::LinkageTypes NewFLink,
1206  FunctionType *NewFT) {
1207  FunctionType *FT = F->getFunctionType();
1208  Function *NewF = Function::Create(NewFT, NewFLink, F->getAddressSpace(),
1209  NewFName, F->getParent());
1210  NewF->copyAttributesFrom(F);
1211  NewF->removeRetAttrs(
1213 
1214  BasicBlock *BB = BasicBlock::Create(*Ctx, "entry", NewF);
1215  if (F->isVarArg()) {
1216  NewF->removeFnAttr("split-stack");
1217  CallInst::Create(DFSanVarargWrapperFn,
1218  IRBuilder<>(BB).CreateGlobalStringPtr(F->getName()), "",
1219  BB);
1220  new UnreachableInst(*Ctx, BB);
1221  } else {
1222  auto ArgIt = pointer_iterator<Argument *>(NewF->arg_begin());
1223  std::vector<Value *> Args(ArgIt, ArgIt + FT->getNumParams());
1224 
1225  CallInst *CI = CallInst::Create(F, Args, "", BB);
1226  if (FT->getReturnType()->isVoidTy())
1227  ReturnInst::Create(*Ctx, BB);
1228  else
1229  ReturnInst::Create(*Ctx, CI, BB);
1230  }
1231 
1232  return NewF;
1233 }
1234 
1235 // Initialize DataFlowSanitizer runtime functions and declare them in the module
1236 void DataFlowSanitizer::initializeRuntimeFunctions(Module &M) {
1237  LLVMContext &C = M.getContext();
1238  {
1239  AttributeList AL;
1240  AL = AL.addFnAttribute(C, Attribute::NoUnwind);
1241  AL = AL.addFnAttribute(
1243  AL = AL.addRetAttribute(C, Attribute::ZExt);
1244  DFSanUnionLoadFn =
1245  Mod->getOrInsertFunction("__dfsan_union_load", DFSanUnionLoadFnTy, AL);
1246  }
1247  {
1248  AttributeList AL;
1249  AL = AL.addFnAttribute(C, Attribute::NoUnwind);
1250  AL = AL.addFnAttribute(
1252  AL = AL.addRetAttribute(C, Attribute::ZExt);
1253  DFSanLoadLabelAndOriginFn = Mod->getOrInsertFunction(
1254  "__dfsan_load_label_and_origin", DFSanLoadLabelAndOriginFnTy, AL);
1255  }
1256  DFSanUnimplementedFn =
1257  Mod->getOrInsertFunction("__dfsan_unimplemented", DFSanUnimplementedFnTy);
1258  DFSanWrapperExternWeakNullFn = Mod->getOrInsertFunction(
1259  "__dfsan_wrapper_extern_weak_null", DFSanWrapperExternWeakNullFnTy);
1260  {
1261  AttributeList AL;
1262  AL = AL.addParamAttribute(M.getContext(), 0, Attribute::ZExt);
1263  AL = AL.addParamAttribute(M.getContext(), 1, Attribute::ZExt);
1264  DFSanSetLabelFn =
1265  Mod->getOrInsertFunction("__dfsan_set_label", DFSanSetLabelFnTy, AL);
1266  }
1267  DFSanNonzeroLabelFn =
1268  Mod->getOrInsertFunction("__dfsan_nonzero_label", DFSanNonzeroLabelFnTy);
1269  DFSanVarargWrapperFn = Mod->getOrInsertFunction("__dfsan_vararg_wrapper",
1270  DFSanVarargWrapperFnTy);
1271  {
1272  AttributeList AL;
1273  AL = AL.addParamAttribute(M.getContext(), 0, Attribute::ZExt);
1274  AL = AL.addRetAttribute(M.getContext(), Attribute::ZExt);
1275  DFSanChainOriginFn = Mod->getOrInsertFunction("__dfsan_chain_origin",
1276  DFSanChainOriginFnTy, AL);
1277  }
1278  {
1279  AttributeList AL;
1280  AL = AL.addParamAttribute(M.getContext(), 0, Attribute::ZExt);
1281  AL = AL.addParamAttribute(M.getContext(), 1, Attribute::ZExt);
1282  AL = AL.addRetAttribute(M.getContext(), Attribute::ZExt);
1283  DFSanChainOriginIfTaintedFn = Mod->getOrInsertFunction(
1284  "__dfsan_chain_origin_if_tainted", DFSanChainOriginIfTaintedFnTy, AL);
1285  }
1286  DFSanMemOriginTransferFn = Mod->getOrInsertFunction(
1287  "__dfsan_mem_origin_transfer", DFSanMemOriginTransferFnTy);
1288 
1289  DFSanMemShadowOriginTransferFn = Mod->getOrInsertFunction(
1290  "__dfsan_mem_shadow_origin_transfer", DFSanMemShadowOriginTransferFnTy);
1291 
1292  DFSanMemShadowOriginConditionalExchangeFn =
1293  Mod->getOrInsertFunction("__dfsan_mem_shadow_origin_conditional_exchange",
1294  DFSanMemShadowOriginConditionalExchangeFnTy);
1295 
1296  {
1297  AttributeList AL;
1298  AL = AL.addParamAttribute(M.getContext(), 0, Attribute::ZExt);
1299  AL = AL.addParamAttribute(M.getContext(), 3, Attribute::ZExt);
1300  DFSanMaybeStoreOriginFn = Mod->getOrInsertFunction(
1301  "__dfsan_maybe_store_origin", DFSanMaybeStoreOriginFnTy, AL);
1302  }
1303 
1304  DFSanRuntimeFunctions.insert(
1305  DFSanUnionLoadFn.getCallee()->stripPointerCasts());
1306  DFSanRuntimeFunctions.insert(
1307  DFSanLoadLabelAndOriginFn.getCallee()->stripPointerCasts());
1308  DFSanRuntimeFunctions.insert(
1309  DFSanUnimplementedFn.getCallee()->stripPointerCasts());
1310  DFSanRuntimeFunctions.insert(
1311  DFSanWrapperExternWeakNullFn.getCallee()->stripPointerCasts());
1312  DFSanRuntimeFunctions.insert(
1313  DFSanSetLabelFn.getCallee()->stripPointerCasts());
1314  DFSanRuntimeFunctions.insert(
1315  DFSanNonzeroLabelFn.getCallee()->stripPointerCasts());
1316  DFSanRuntimeFunctions.insert(
1317  DFSanVarargWrapperFn.getCallee()->stripPointerCasts());
1318  DFSanRuntimeFunctions.insert(
1319  DFSanLoadCallbackFn.getCallee()->stripPointerCasts());
1320  DFSanRuntimeFunctions.insert(
1321  DFSanStoreCallbackFn.getCallee()->stripPointerCasts());
1322  DFSanRuntimeFunctions.insert(
1323  DFSanMemTransferCallbackFn.getCallee()->stripPointerCasts());
1324  DFSanRuntimeFunctions.insert(
1325  DFSanConditionalCallbackFn.getCallee()->stripPointerCasts());
1326  DFSanRuntimeFunctions.insert(
1327  DFSanConditionalCallbackOriginFn.getCallee()->stripPointerCasts());
1328  DFSanRuntimeFunctions.insert(
1329  DFSanCmpCallbackFn.getCallee()->stripPointerCasts());
1330  DFSanRuntimeFunctions.insert(
1331  DFSanChainOriginFn.getCallee()->stripPointerCasts());
1332  DFSanRuntimeFunctions.insert(
1333  DFSanChainOriginIfTaintedFn.getCallee()->stripPointerCasts());
1334  DFSanRuntimeFunctions.insert(
1335  DFSanMemOriginTransferFn.getCallee()->stripPointerCasts());
1336  DFSanRuntimeFunctions.insert(
1337  DFSanMemShadowOriginTransferFn.getCallee()->stripPointerCasts());
1338  DFSanRuntimeFunctions.insert(
1339  DFSanMemShadowOriginConditionalExchangeFn.getCallee()
1340  ->stripPointerCasts());
1341  DFSanRuntimeFunctions.insert(
1342  DFSanMaybeStoreOriginFn.getCallee()->stripPointerCasts());
1343 }
1344 
1345 // Initializes event callback functions and declare them in the module
1346 void DataFlowSanitizer::initializeCallbackFunctions(Module &M) {
1347  DFSanLoadCallbackFn = Mod->getOrInsertFunction("__dfsan_load_callback",
1348  DFSanLoadStoreCallbackFnTy);
1349  DFSanStoreCallbackFn = Mod->getOrInsertFunction("__dfsan_store_callback",
1350  DFSanLoadStoreCallbackFnTy);
1351  DFSanMemTransferCallbackFn = Mod->getOrInsertFunction(
1352  "__dfsan_mem_transfer_callback", DFSanMemTransferCallbackFnTy);
1353  DFSanCmpCallbackFn =
1354  Mod->getOrInsertFunction("__dfsan_cmp_callback", DFSanCmpCallbackFnTy);
1355 
1356  DFSanConditionalCallbackFn = Mod->getOrInsertFunction(
1357  "__dfsan_conditional_callback", DFSanConditionalCallbackFnTy);
1358  DFSanConditionalCallbackOriginFn =
1359  Mod->getOrInsertFunction("__dfsan_conditional_callback_origin",
1360  DFSanConditionalCallbackOriginFnTy);
1361 }
1362 
1363 void DataFlowSanitizer::injectMetadataGlobals(Module &M) {
1364  // These variables can be used:
1365  // - by the runtime (to discover what the shadow width was, during
1366  // compilation)
1367  // - in testing (to avoid hardcoding the shadow width and type but instead
1368  // extract them by pattern matching)
1369  Type *IntTy = Type::getInt32Ty(*Ctx);
1370  (void)Mod->getOrInsertGlobal("__dfsan_shadow_width_bits", IntTy, [&] {
1371  return new GlobalVariable(
1372  M, IntTy, /*isConstant=*/true, GlobalValue::WeakODRLinkage,
1373  ConstantInt::get(IntTy, ShadowWidthBits), "__dfsan_shadow_width_bits");
1374  });
1375  (void)Mod->getOrInsertGlobal("__dfsan_shadow_width_bytes", IntTy, [&] {
1376  return new GlobalVariable(M, IntTy, /*isConstant=*/true,
1378  ConstantInt::get(IntTy, ShadowWidthBytes),
1379  "__dfsan_shadow_width_bytes");
1380  });
1381 }
1382 
1385  initializeModule(M);
1386 
1387  if (ABIList.isIn(M, "skip"))
1388  return false;
1389 
1390  const unsigned InitialGlobalSize = M.global_size();
1391  const unsigned InitialModuleSize = M.size();
1392 
1393  bool Changed = false;
1394 
1395  auto GetOrInsertGlobal = [this, &Changed](StringRef Name,
1396  Type *Ty) -> Constant * {
1397  Constant *C = Mod->getOrInsertGlobal(Name, Ty);
1398  if (GlobalVariable *G = dyn_cast<GlobalVariable>(C)) {
1399  Changed |= G->getThreadLocalMode() != GlobalVariable::InitialExecTLSModel;
1400  G->setThreadLocalMode(GlobalVariable::InitialExecTLSModel);
1401  }
1402  return C;
1403  };
1404 
1405  // These globals must be kept in sync with the ones in dfsan.cpp.
1406  ArgTLS =
1407  GetOrInsertGlobal("__dfsan_arg_tls",
1408  ArrayType::get(Type::getInt64Ty(*Ctx), ArgTLSSize / 8));
1409  RetvalTLS = GetOrInsertGlobal(
1410  "__dfsan_retval_tls",
1411  ArrayType::get(Type::getInt64Ty(*Ctx), RetvalTLSSize / 8));
1412  ArgOriginTLSTy = ArrayType::get(OriginTy, NumOfElementsInArgOrgTLS);
1413  ArgOriginTLS = GetOrInsertGlobal("__dfsan_arg_origin_tls", ArgOriginTLSTy);
1414  RetvalOriginTLS = GetOrInsertGlobal("__dfsan_retval_origin_tls", OriginTy);
1415 
1416  (void)Mod->getOrInsertGlobal("__dfsan_track_origins", OriginTy, [&] {
1417  Changed = true;
1418  return new GlobalVariable(
1419  M, OriginTy, true, GlobalValue::WeakODRLinkage,
1420  ConstantInt::getSigned(OriginTy,
1421  shouldTrackOrigins() ? ClTrackOrigins : 0),
1422  "__dfsan_track_origins");
1423  });
1424 
1425  injectMetadataGlobals(M);
1426 
1427  initializeCallbackFunctions(M);
1428  initializeRuntimeFunctions(M);
1429 
1430  std::vector<Function *> FnsToInstrument;
1431  SmallPtrSet<Function *, 2> FnsWithNativeABI;
1432  SmallPtrSet<Function *, 2> FnsWithForceZeroLabel;
1433  SmallPtrSet<Constant *, 1> PersonalityFns;
1434  for (Function &F : M)
1435  if (!F.isIntrinsic() && !DFSanRuntimeFunctions.contains(&F) &&
1436  !LibAtomicFunction(F)) {
1437  FnsToInstrument.push_back(&F);
1438  if (F.hasPersonalityFn())
1439  PersonalityFns.insert(F.getPersonalityFn()->stripPointerCasts());
1440  }
1441 
1443  for (auto *C : PersonalityFns) {
1444  assert(isa<Function>(C) && "Personality routine is not a function!");
1445  Function *F = cast<Function>(C);
1446  if (!isInstrumented(F))
1447  llvm::erase_value(FnsToInstrument, F);
1448  }
1449  }
1450 
1451  // Give function aliases prefixes when necessary, and build wrappers where the
1452  // instrumentedness is inconsistent.
1453  for (GlobalAlias &GA : llvm::make_early_inc_range(M.aliases())) {
1454  // Don't stop on weak. We assume people aren't playing games with the
1455  // instrumentedness of overridden weak aliases.
1456  auto *F = dyn_cast<Function>(GA.getAliaseeObject());
1457  if (!F)
1458  continue;
1459 
1460  bool GAInst = isInstrumented(&GA), FInst = isInstrumented(F);
1461  if (GAInst && FInst) {
1462  addGlobalNameSuffix(&GA);
1463  } else if (GAInst != FInst) {
1464  // Non-instrumented alias of an instrumented function, or vice versa.
1465  // Replace the alias with a native-ABI wrapper of the aliasee. The pass
1466  // below will take care of instrumenting it.
1467  Function *NewF =
1468  buildWrapperFunction(F, "", GA.getLinkage(), F->getFunctionType());
1469  GA.replaceAllUsesWith(ConstantExpr::getBitCast(NewF, GA.getType()));
1470  NewF->takeName(&GA);
1471  GA.eraseFromParent();
1472  FnsToInstrument.push_back(NewF);
1473  }
1474  }
1475 
1476  // TODO: This could be more precise.
1477  ReadOnlyNoneAttrs.addAttribute(Attribute::Memory);
1478 
1479  // First, change the ABI of every function in the module. ABI-listed
1480  // functions keep their original ABI and get a wrapper function.
1481  for (std::vector<Function *>::iterator FI = FnsToInstrument.begin(),
1482  FE = FnsToInstrument.end();
1483  FI != FE; ++FI) {
1484  Function &F = **FI;
1485  FunctionType *FT = F.getFunctionType();
1486 
1487  bool IsZeroArgsVoidRet = (FT->getNumParams() == 0 && !FT->isVarArg() &&
1488  FT->getReturnType()->isVoidTy());
1489 
1490  if (isInstrumented(&F)) {
1491  if (isForceZeroLabels(&F))
1492  FnsWithForceZeroLabel.insert(&F);
1493 
1494  // Instrumented functions get a '.dfsan' suffix. This allows us to more
1495  // easily identify cases of mismatching ABIs. This naming scheme is
1496  // mangling-compatible (see Itanium ABI), using a vendor-specific suffix.
1497  addGlobalNameSuffix(&F);
1498  } else if (!IsZeroArgsVoidRet || getWrapperKind(&F) == WK_Custom) {
1499  // Build a wrapper function for F. The wrapper simply calls F, and is
1500  // added to FnsToInstrument so that any instrumentation according to its
1501  // WrapperKind is done in the second pass below.
1502 
1503  // If the function being wrapped has local linkage, then preserve the
1504  // function's linkage in the wrapper function.
1505  GlobalValue::LinkageTypes WrapperLinkage =
1506  F.hasLocalLinkage() ? F.getLinkage()
1507  : GlobalValue::LinkOnceODRLinkage;
1508 
1509  Function *NewF = buildWrapperFunction(
1510  &F,
1511  (shouldTrackOrigins() ? std::string("dfso$") : std::string("dfsw$")) +
1512  std::string(F.getName()),
1513  WrapperLinkage, FT);
1514  NewF->removeFnAttrs(ReadOnlyNoneAttrs);
1515 
1516  Value *WrappedFnCst =
1517  ConstantExpr::getBitCast(NewF, PointerType::getUnqual(FT));
1518 
1519  // Extern weak functions can sometimes be null at execution time.
1520  // Code will sometimes check if an extern weak function is null.
1521  // This could look something like:
1522  // declare extern_weak i8 @my_func(i8)
1523  // br i1 icmp ne (i8 (i8)* @my_func, i8 (i8)* null), label %use_my_func,
1524  // label %avoid_my_func
1525  // The @"dfsw$my_func" wrapper is never null, so if we replace this use
1526  // in the comparison, the icmp will simplify to false and we have
1527  // accidentally optimized away a null check that is necessary.
1528  // This can lead to a crash when the null extern_weak my_func is called.
1529  //
1530  // To prevent (the most common pattern of) this problem,
1531  // do not replace uses in comparisons with the wrapper.
1532  // We definitely want to replace uses in call instructions.
1533  // Other uses (e.g. store the function address somewhere) might be
1534  // called or compared or both - this case may not be handled correctly.
1535  // We will default to replacing with wrapper in cases we are unsure.
1536  auto IsNotCmpUse = [](Use &U) -> bool {
1537  User *Usr = U.getUser();
1538  if (ConstantExpr *CE = dyn_cast<ConstantExpr>(Usr)) {
1539  // This is the most common case for icmp ne null
1540  if (CE->getOpcode() == Instruction::ICmp) {
1541  return false;
1542  }
1543  }
1544  if (Instruction *I = dyn_cast<Instruction>(Usr)) {
1545  if (I->getOpcode() == Instruction::ICmp) {
1546  return false;
1547  }
1548  }
1549  return true;
1550  };
1551  F.replaceUsesWithIf(WrappedFnCst, IsNotCmpUse);
1552 
1553  UnwrappedFnMap[WrappedFnCst] = &F;
1554  *FI = NewF;
1555 
1556  if (!F.isDeclaration()) {
1557  // This function is probably defining an interposition of an
1558  // uninstrumented function and hence needs to keep the original ABI.
1559  // But any functions it may call need to use the instrumented ABI, so
1560  // we instrument it in a mode which preserves the original ABI.
1561  FnsWithNativeABI.insert(&F);
1562 
1563  // This code needs to rebuild the iterators, as they may be invalidated
1564  // by the push_back, taking care that the new range does not include
1565  // any functions added by this code.
1566  size_t N = FI - FnsToInstrument.begin(),
1567  Count = FE - FnsToInstrument.begin();
1568  FnsToInstrument.push_back(&F);
1569  FI = FnsToInstrument.begin() + N;
1570  FE = FnsToInstrument.begin() + Count;
1571  }
1572  // Hopefully, nobody will try to indirectly call a vararg
1573  // function... yet.
1574  } else if (FT->isVarArg()) {
1575  UnwrappedFnMap[&F] = &F;
1576  *FI = nullptr;
1577  }
1578  }
1579 
1580  for (Function *F : FnsToInstrument) {
1581  if (!F || F->isDeclaration())
1582  continue;
1583 
1585 
1586  DFSanFunction DFSF(*this, F, FnsWithNativeABI.count(F),
1587  FnsWithForceZeroLabel.count(F), GetTLI(*F));
1588 
1589  // DFSanVisitor may create new basic blocks, which confuses df_iterator.
1590  // Build a copy of the list before iterating over it.
1591  SmallVector<BasicBlock *, 4> BBList(depth_first(&F->getEntryBlock()));
1592 
1593  for (BasicBlock *BB : BBList) {
1594  Instruction *Inst = &BB->front();
1595  while (true) {
1596  // DFSanVisitor may split the current basic block, changing the current
1597  // instruction's next pointer and moving the next instruction to the
1598  // tail block from which we should continue.
1599  Instruction *Next = Inst->getNextNode();
1600  // DFSanVisitor may delete Inst, so keep track of whether it was a
1601  // terminator.
1602  bool IsTerminator = Inst->isTerminator();
1603  if (!DFSF.SkipInsts.count(Inst))
1604  DFSanVisitor(DFSF).visit(Inst);
1605  if (IsTerminator)
1606  break;
1607  Inst = Next;
1608  }
1609  }
1610 
1611  // We will not necessarily be able to compute the shadow for every phi node
1612  // until we have visited every block. Therefore, the code that handles phi
1613  // nodes adds them to the PHIFixups list so that they can be properly
1614  // handled here.
1615  for (DFSanFunction::PHIFixupElement &P : DFSF.PHIFixups) {
1616  for (unsigned Val = 0, N = P.Phi->getNumIncomingValues(); Val != N;
1617  ++Val) {
1618  P.ShadowPhi->setIncomingValue(
1619  Val, DFSF.getShadow(P.Phi->getIncomingValue(Val)));
1620  if (P.OriginPhi)
1621  P.OriginPhi->setIncomingValue(
1622  Val, DFSF.getOrigin(P.Phi->getIncomingValue(Val)));
1623  }
1624  }
1625 
1626  // -dfsan-debug-nonzero-labels will split the CFG in all kinds of crazy
1627  // places (i.e. instructions in basic blocks we haven't even begun visiting
1628  // yet). To make our life easier, do this work in a pass after the main
1629  // instrumentation.
1630  if (ClDebugNonzeroLabels) {
1631  for (Value *V : DFSF.NonZeroChecks) {
1632  Instruction *Pos;
1633  if (Instruction *I = dyn_cast<Instruction>(V))
1634  Pos = I->getNextNode();
1635  else
1636  Pos = &DFSF.F->getEntryBlock().front();
1637  while (isa<PHINode>(Pos) || isa<AllocaInst>(Pos))
1638  Pos = Pos->getNextNode();
1639  IRBuilder<> IRB(Pos);
1640  Value *PrimitiveShadow = DFSF.collapseToPrimitiveShadow(V, Pos);
1641  Value *Ne =
1642  IRB.CreateICmpNE(PrimitiveShadow, DFSF.DFS.ZeroPrimitiveShadow);
1643  BranchInst *BI = cast<BranchInst>(SplitBlockAndInsertIfThen(
1644  Ne, Pos, /*Unreachable=*/false, ColdCallWeights));
1645  IRBuilder<> ThenIRB(BI);
1646  ThenIRB.CreateCall(DFSF.DFS.DFSanNonzeroLabelFn, {});
1647  }
1648  }
1649  }
1650 
1651  return Changed || !FnsToInstrument.empty() ||
1652  M.global_size() != InitialGlobalSize || M.size() != InitialModuleSize;
1653 }
1654 
1655 Value *DFSanFunction::getArgTLS(Type *T, unsigned ArgOffset, IRBuilder<> &IRB) {
1656  Value *Base = IRB.CreatePointerCast(DFS.ArgTLS, DFS.IntptrTy);
1657  if (ArgOffset)
1658  Base = IRB.CreateAdd(Base, ConstantInt::get(DFS.IntptrTy, ArgOffset));
1659  return IRB.CreateIntToPtr(Base, PointerType::get(DFS.getShadowTy(T), 0),
1660  "_dfsarg");
1661 }
1662 
1663 Value *DFSanFunction::getRetvalTLS(Type *T, IRBuilder<> &IRB) {
1664  return IRB.CreatePointerCast(
1665  DFS.RetvalTLS, PointerType::get(DFS.getShadowTy(T), 0), "_dfsret");
1666 }
1667 
1668 Value *DFSanFunction::getRetvalOriginTLS() { return DFS.RetvalOriginTLS; }
1669 
1670 Value *DFSanFunction::getArgOriginTLS(unsigned ArgNo, IRBuilder<> &IRB) {
1671  return IRB.CreateConstGEP2_64(DFS.ArgOriginTLSTy, DFS.ArgOriginTLS, 0, ArgNo,
1672  "_dfsarg_o");
1673 }
1674 
1675 Value *DFSanFunction::getOrigin(Value *V) {
1676  assert(DFS.shouldTrackOrigins());
1677  if (!isa<Argument>(V) && !isa<Instruction>(V))
1678  return DFS.ZeroOrigin;
1679  Value *&Origin = ValOriginMap[V];
1680  if (!Origin) {
1681  if (Argument *A = dyn_cast<Argument>(V)) {
1682  if (IsNativeABI)
1683  return DFS.ZeroOrigin;
1684  if (A->getArgNo() < DFS.NumOfElementsInArgOrgTLS) {
1685  Instruction *ArgOriginTLSPos = &*F->getEntryBlock().begin();
1686  IRBuilder<> IRB(ArgOriginTLSPos);
1687  Value *ArgOriginPtr = getArgOriginTLS(A->getArgNo(), IRB);
1688  Origin = IRB.CreateLoad(DFS.OriginTy, ArgOriginPtr);
1689  } else {
1690  // Overflow
1691  Origin = DFS.ZeroOrigin;
1692  }
1693  } else {
1694  Origin = DFS.ZeroOrigin;
1695  }
1696  }
1697  return Origin;
1698 }
1699 
1700 void DFSanFunction::setOrigin(Instruction *I, Value *Origin) {
1701  if (!DFS.shouldTrackOrigins())
1702  return;
1703  assert(!ValOriginMap.count(I));
1704  assert(Origin->getType() == DFS.OriginTy);
1705  ValOriginMap[I] = Origin;
1706 }
1707 
1708 Value *DFSanFunction::getShadowForTLSArgument(Argument *A) {
1709  unsigned ArgOffset = 0;
1710  const DataLayout &DL = F->getParent()->getDataLayout();
1711  for (auto &FArg : F->args()) {
1712  if (!FArg.getType()->isSized()) {
1713  if (A == &FArg)
1714  break;
1715  continue;
1716  }
1717 
1718  unsigned Size = DL.getTypeAllocSize(DFS.getShadowTy(&FArg));
1719  if (A != &FArg) {
1720  ArgOffset += alignTo(Size, ShadowTLSAlignment);
1721  if (ArgOffset > ArgTLSSize)
1722  break; // ArgTLS overflows, uses a zero shadow.
1723  continue;
1724  }
1725 
1726  if (ArgOffset + Size > ArgTLSSize)
1727  break; // ArgTLS overflows, uses a zero shadow.
1728 
1729  Instruction *ArgTLSPos = &*F->getEntryBlock().begin();
1730  IRBuilder<> IRB(ArgTLSPos);
1731  Value *ArgShadowPtr = getArgTLS(FArg.getType(), ArgOffset, IRB);
1732  return IRB.CreateAlignedLoad(DFS.getShadowTy(&FArg), ArgShadowPtr,
1734  }
1735 
1736  return DFS.getZeroShadow(A);
1737 }
1738 
1739 Value *DFSanFunction::getShadow(Value *V) {
1740  if (!isa<Argument>(V) && !isa<Instruction>(V))
1741  return DFS.getZeroShadow(V);
1742  if (IsForceZeroLabels)
1743  return DFS.getZeroShadow(V);
1744  Value *&Shadow = ValShadowMap[V];
1745  if (!Shadow) {
1746  if (Argument *A = dyn_cast<Argument>(V)) {
1747  if (IsNativeABI)
1748  return DFS.getZeroShadow(V);
1749  Shadow = getShadowForTLSArgument(A);
1750  NonZeroChecks.push_back(Shadow);
1751  } else {
1752  Shadow = DFS.getZeroShadow(V);
1753  }
1754  }
1755  return Shadow;
1756 }
1757 
1758 void DFSanFunction::setShadow(Instruction *I, Value *Shadow) {
1759  assert(!ValShadowMap.count(I));
1760  ValShadowMap[I] = Shadow;
1761 }
1762 
1763 /// Compute the integer shadow offset that corresponds to a given
1764 /// application address.
1765 ///
1766 /// Offset = (Addr & ~AndMask) ^ XorMask
1767 Value *DataFlowSanitizer::getShadowOffset(Value *Addr, IRBuilder<> &IRB) {
1768  assert(Addr != RetvalTLS && "Reinstrumenting?");
1769  Value *OffsetLong = IRB.CreatePointerCast(Addr, IntptrTy);
1770 
1771  uint64_t AndMask = MapParams->AndMask;
1772  if (AndMask)
1773  OffsetLong =
1774  IRB.CreateAnd(OffsetLong, ConstantInt::get(IntptrTy, ~AndMask));
1775 
1776  uint64_t XorMask = MapParams->XorMask;
1777  if (XorMask)
1778  OffsetLong = IRB.CreateXor(OffsetLong, ConstantInt::get(IntptrTy, XorMask));
1779  return OffsetLong;
1780 }
1781 
1782 std::pair<Value *, Value *>
1783 DataFlowSanitizer::getShadowOriginAddress(Value *Addr, Align InstAlignment,
1784  Instruction *Pos) {
1785  // Returns ((Addr & shadow_mask) + origin_base - shadow_base) & ~4UL
1786  IRBuilder<> IRB(Pos);
1787  Value *ShadowOffset = getShadowOffset(Addr, IRB);
1788  Value *ShadowLong = ShadowOffset;
1789  uint64_t ShadowBase = MapParams->ShadowBase;
1790  if (ShadowBase != 0) {
1791  ShadowLong =
1792  IRB.CreateAdd(ShadowLong, ConstantInt::get(IntptrTy, ShadowBase));
1793  }
1794  IntegerType *ShadowTy = IntegerType::get(*Ctx, ShadowWidthBits);
1795  Value *ShadowPtr =
1796  IRB.CreateIntToPtr(ShadowLong, PointerType::get(ShadowTy, 0));
1797  Value *OriginPtr = nullptr;
1798  if (shouldTrackOrigins()) {
1799  Value *OriginLong = ShadowOffset;
1800  uint64_t OriginBase = MapParams->OriginBase;
1801  if (OriginBase != 0)
1802  OriginLong =
1803  IRB.CreateAdd(OriginLong, ConstantInt::get(IntptrTy, OriginBase));
1804  const Align Alignment = llvm::assumeAligned(InstAlignment.value());
1805  // When alignment is >= 4, Addr must be aligned to 4, otherwise it is UB.
1806  // So Mask is unnecessary.
1807  if (Alignment < MinOriginAlignment) {
1809  OriginLong = IRB.CreateAnd(OriginLong, ConstantInt::get(IntptrTy, ~Mask));
1810  }
1811  OriginPtr = IRB.CreateIntToPtr(OriginLong, OriginPtrTy);
1812  }
1813  return std::make_pair(ShadowPtr, OriginPtr);
1814 }
1815 
1816 Value *DataFlowSanitizer::getShadowAddress(Value *Addr, Instruction *Pos,
1817  Value *ShadowOffset) {
1818  IRBuilder<> IRB(Pos);
1819  return IRB.CreateIntToPtr(ShadowOffset, PrimitiveShadowPtrTy);
1820 }
1821 
1822 Value *DataFlowSanitizer::getShadowAddress(Value *Addr, Instruction *Pos) {
1823  IRBuilder<> IRB(Pos);
1824  Value *ShadowOffset = getShadowOffset(Addr, IRB);
1825  return getShadowAddress(Addr, Pos, ShadowOffset);
1826 }
1827 
1828 Value *DFSanFunction::combineShadowsThenConvert(Type *T, Value *V1, Value *V2,
1829  Instruction *Pos) {
1830  Value *PrimitiveValue = combineShadows(V1, V2, Pos);
1831  return expandFromPrimitiveShadow(T, PrimitiveValue, Pos);
1832 }
1833 
1834 // Generates IR to compute the union of the two given shadows, inserting it
1835 // before Pos. The combined value is with primitive type.
1836 Value *DFSanFunction::combineShadows(Value *V1, Value *V2, Instruction *Pos) {
1837  if (DFS.isZeroShadow(V1))
1838  return collapseToPrimitiveShadow(V2, Pos);
1839  if (DFS.isZeroShadow(V2))
1840  return collapseToPrimitiveShadow(V1, Pos);
1841  if (V1 == V2)
1842  return collapseToPrimitiveShadow(V1, Pos);
1843 
1844  auto V1Elems = ShadowElements.find(V1);
1845  auto V2Elems = ShadowElements.find(V2);
1846  if (V1Elems != ShadowElements.end() && V2Elems != ShadowElements.end()) {
1847  if (std::includes(V1Elems->second.begin(), V1Elems->second.end(),
1848  V2Elems->second.begin(), V2Elems->second.end())) {
1849  return collapseToPrimitiveShadow(V1, Pos);
1850  }
1851  if (std::includes(V2Elems->second.begin(), V2Elems->second.end(),
1852  V1Elems->second.begin(), V1Elems->second.end())) {
1853  return collapseToPrimitiveShadow(V2, Pos);
1854  }
1855  } else if (V1Elems != ShadowElements.end()) {
1856  if (V1Elems->second.count(V2))
1857  return collapseToPrimitiveShadow(V1, Pos);
1858  } else if (V2Elems != ShadowElements.end()) {
1859  if (V2Elems->second.count(V1))
1860  return collapseToPrimitiveShadow(V2, Pos);
1861  }
1862 
1863  auto Key = std::make_pair(V1, V2);
1864  if (V1 > V2)
1865  std::swap(Key.first, Key.second);
1866  CachedShadow &CCS = CachedShadows[Key];
1867  if (CCS.Block && DT.dominates(CCS.Block, Pos->getParent()))
1868  return CCS.Shadow;
1869 
1870  // Converts inputs shadows to shadows with primitive types.
1871  Value *PV1 = collapseToPrimitiveShadow(V1, Pos);
1872  Value *PV2 = collapseToPrimitiveShadow(V2, Pos);
1873 
1874  IRBuilder<> IRB(Pos);
1875  CCS.Block = Pos->getParent();
1876  CCS.Shadow = IRB.CreateOr(PV1, PV2);
1877 
1878  std::set<Value *> UnionElems;
1879  if (V1Elems != ShadowElements.end()) {
1880  UnionElems = V1Elems->second;
1881  } else {
1882  UnionElems.insert(V1);
1883  }
1884  if (V2Elems != ShadowElements.end()) {
1885  UnionElems.insert(V2Elems->second.begin(), V2Elems->second.end());
1886  } else {
1887  UnionElems.insert(V2);
1888  }
1889  ShadowElements[CCS.Shadow] = std::move(UnionElems);
1890 
1891  return CCS.Shadow;
1892 }
1893 
1894 // A convenience function which folds the shadows of each of the operands
1895 // of the provided instruction Inst, inserting the IR before Inst. Returns
1896 // the computed union Value.
1897 Value *DFSanFunction::combineOperandShadows(Instruction *Inst) {
1898  if (Inst->getNumOperands() == 0)
1899  return DFS.getZeroShadow(Inst);
1900 
1901  Value *Shadow = getShadow(Inst->getOperand(0));
1902  for (unsigned I = 1, N = Inst->getNumOperands(); I < N; ++I)
1903  Shadow = combineShadows(Shadow, getShadow(Inst->getOperand(I)), Inst);
1904 
1905  return expandFromPrimitiveShadow(Inst->getType(), Shadow, Inst);
1906 }
1907 
1908 void DFSanVisitor::visitInstOperands(Instruction &I) {
1909  Value *CombinedShadow = DFSF.combineOperandShadows(&I);
1910  DFSF.setShadow(&I, CombinedShadow);
1911  visitInstOperandOrigins(I);
1912 }
1913 
1914 Value *DFSanFunction::combineOrigins(const std::vector<Value *> &Shadows,
1915  const std::vector<Value *> &Origins,
1916  Instruction *Pos, ConstantInt *Zero) {
1917  assert(Shadows.size() == Origins.size());
1918  size_t Size = Origins.size();
1919  if (Size == 0)
1920  return DFS.ZeroOrigin;
1921  Value *Origin = nullptr;
1922  if (!Zero)
1923  Zero = DFS.ZeroPrimitiveShadow;
1924  for (size_t I = 0; I != Size; ++I) {
1925  Value *OpOrigin = Origins[I];
1926  Constant *ConstOpOrigin = dyn_cast<Constant>(OpOrigin);
1927  if (ConstOpOrigin && ConstOpOrigin->isNullValue())
1928  continue;
1929  if (!Origin) {
1930  Origin = OpOrigin;
1931  continue;
1932  }
1933  Value *OpShadow = Shadows[I];
1934  Value *PrimitiveShadow = collapseToPrimitiveShadow(OpShadow, Pos);
1935  IRBuilder<> IRB(Pos);
1936  Value *Cond = IRB.CreateICmpNE(PrimitiveShadow, Zero);
1937  Origin = IRB.CreateSelect(Cond, OpOrigin, Origin);
1938  }
1939  return Origin ? Origin : DFS.ZeroOrigin;
1940 }
1941 
1942 Value *DFSanFunction::combineOperandOrigins(Instruction *Inst) {
1943  size_t Size = Inst->getNumOperands();
1944  std::vector<Value *> Shadows(Size);
1945  std::vector<Value *> Origins(Size);
1946  for (unsigned I = 0; I != Size; ++I) {
1947  Shadows[I] = getShadow(Inst->getOperand(I));
1948  Origins[I] = getOrigin(Inst->getOperand(I));
1949  }
1950  return combineOrigins(Shadows, Origins, Inst);
1951 }
1952 
1953 void DFSanVisitor::visitInstOperandOrigins(Instruction &I) {
1954  if (!DFSF.DFS.shouldTrackOrigins())
1955  return;
1956  Value *CombinedOrigin = DFSF.combineOperandOrigins(&I);
1957  DFSF.setOrigin(&I, CombinedOrigin);
1958 }
1959 
1960 Align DFSanFunction::getShadowAlign(Align InstAlignment) {
1961  const Align Alignment = ClPreserveAlignment ? InstAlignment : Align(1);
1962  return Align(Alignment.value() * DFS.ShadowWidthBytes);
1963 }
1964 
1965 Align DFSanFunction::getOriginAlign(Align InstAlignment) {
1966  const Align Alignment = llvm::assumeAligned(InstAlignment.value());
1967  return Align(std::max(MinOriginAlignment, Alignment));
1968 }
1969 
1970 bool DFSanFunction::isLookupTableConstant(Value *P) {
1971  if (GlobalVariable *GV = dyn_cast<GlobalVariable>(P->stripPointerCasts()))
1972  if (GV->isConstant() && GV->hasName())
1973  return DFS.CombineTaintLookupTableNames.count(GV->getName());
1974 
1975  return false;
1976 }
1977 
1978 bool DFSanFunction::useCallbackLoadLabelAndOrigin(uint64_t Size,
1979  Align InstAlignment) {
1980  // When enabling tracking load instructions, we always use
1981  // __dfsan_load_label_and_origin to reduce code size.
1982  if (ClTrackOrigins == 2)
1983  return true;
1984 
1985  assert(Size != 0);
1986  // * if Size == 1, it is sufficient to load its origin aligned at 4.
1987  // * if Size == 2, we assume most cases Addr % 2 == 0, so it is sufficient to
1988  // load its origin aligned at 4. If not, although origins may be lost, it
1989  // should not happen very often.
1990  // * if align >= 4, Addr must be aligned to 4, otherwise it is UB. When
1991  // Size % 4 == 0, it is more efficient to load origins without callbacks.
1992  // * Otherwise we use __dfsan_load_label_and_origin.
1993  // This should ensure that common cases run efficiently.
1994  if (Size <= 2)
1995  return false;
1996 
1997  const Align Alignment = llvm::assumeAligned(InstAlignment.value());
1998  return Alignment < MinOriginAlignment || !DFS.hasLoadSizeForFastPath(Size);
1999 }
2000 
2001 Value *DataFlowSanitizer::loadNextOrigin(Instruction *Pos, Align OriginAlign,
2002  Value **OriginAddr) {
2003  IRBuilder<> IRB(Pos);
2004  *OriginAddr =
2005  IRB.CreateGEP(OriginTy, *OriginAddr, ConstantInt::get(IntptrTy, 1));
2006  return IRB.CreateAlignedLoad(OriginTy, *OriginAddr, OriginAlign);
2007 }
2008 
2009 std::pair<Value *, Value *> DFSanFunction::loadShadowFast(
2010  Value *ShadowAddr, Value *OriginAddr, uint64_t Size, Align ShadowAlign,
2011  Align OriginAlign, Value *FirstOrigin, Instruction *Pos) {
2012  const bool ShouldTrackOrigins = DFS.shouldTrackOrigins();
2013  const uint64_t ShadowSize = Size * DFS.ShadowWidthBytes;
2014 
2015  assert(Size >= 4 && "Not large enough load size for fast path!");
2016 
2017  // Used for origin tracking.
2018  std::vector<Value *> Shadows;
2019  std::vector<Value *> Origins;
2020 
2021  // Load instructions in LLVM can have arbitrary byte sizes (e.g., 3, 12, 20)
2022  // but this function is only used in a subset of cases that make it possible
2023  // to optimize the instrumentation.
2024  //
2025  // Specifically, when the shadow size in bytes (i.e., loaded bytes x shadow
2026  // per byte) is either:
2027  // - a multiple of 8 (common)
2028  // - equal to 4 (only for load32)
2029  //
2030  // For the second case, we can fit the wide shadow in a 32-bit integer. In all
2031  // other cases, we use a 64-bit integer to hold the wide shadow.
2032  Type *WideShadowTy =
2033  ShadowSize == 4 ? Type::getInt32Ty(*DFS.Ctx) : Type::getInt64Ty(*DFS.Ctx);
2034 
2035  IRBuilder<> IRB(Pos);
2036  Value *WideAddr = IRB.CreateBitCast(ShadowAddr, WideShadowTy->getPointerTo());
2037  Value *CombinedWideShadow =
2038  IRB.CreateAlignedLoad(WideShadowTy, WideAddr, ShadowAlign);
2039 
2040  unsigned WideShadowBitWidth = WideShadowTy->getIntegerBitWidth();
2041  const uint64_t BytesPerWideShadow = WideShadowBitWidth / DFS.ShadowWidthBits;
2042 
2043  auto AppendWideShadowAndOrigin = [&](Value *WideShadow, Value *Origin) {
2044  if (BytesPerWideShadow > 4) {
2045  assert(BytesPerWideShadow == 8);
2046  // The wide shadow relates to two origin pointers: one for the first four
2047  // application bytes, and one for the latest four. We use a left shift to
2048  // get just the shadow bytes that correspond to the first origin pointer,
2049  // and then the entire shadow for the second origin pointer (which will be
2050  // chosen by combineOrigins() iff the least-significant half of the wide
2051  // shadow was empty but the other half was not).
2052  Value *WideShadowLo = IRB.CreateShl(
2053  WideShadow, ConstantInt::get(WideShadowTy, WideShadowBitWidth / 2));
2054  Shadows.push_back(WideShadow);
2055  Origins.push_back(DFS.loadNextOrigin(Pos, OriginAlign, &OriginAddr));
2056 
2057  Shadows.push_back(WideShadowLo);
2058  Origins.push_back(Origin);
2059  } else {
2060  Shadows.push_back(WideShadow);
2061  Origins.push_back(Origin);
2062  }
2063  };
2064 
2065  if (ShouldTrackOrigins)
2066  AppendWideShadowAndOrigin(CombinedWideShadow, FirstOrigin);
2067 
2068  // First OR all the WideShadows (i.e., 64bit or 32bit shadow chunks) linearly;
2069  // then OR individual shadows within the combined WideShadow by binary ORing.
2070  // This is fewer instructions than ORing shadows individually, since it
2071  // needs logN shift/or instructions (N being the bytes of the combined wide
2072  // shadow).
2073  for (uint64_t ByteOfs = BytesPerWideShadow; ByteOfs < Size;
2074  ByteOfs += BytesPerWideShadow) {
2075  WideAddr = IRB.CreateGEP(WideShadowTy, WideAddr,
2076  ConstantInt::get(DFS.IntptrTy, 1));
2077  Value *NextWideShadow =
2078  IRB.CreateAlignedLoad(WideShadowTy, WideAddr, ShadowAlign);
2079  CombinedWideShadow = IRB.CreateOr(CombinedWideShadow, NextWideShadow);
2080  if (ShouldTrackOrigins) {
2081  Value *NextOrigin = DFS.loadNextOrigin(Pos, OriginAlign, &OriginAddr);
2082  AppendWideShadowAndOrigin(NextWideShadow, NextOrigin);
2083  }
2084  }
2085  for (unsigned Width = WideShadowBitWidth / 2; Width >= DFS.ShadowWidthBits;
2086  Width >>= 1) {
2087  Value *ShrShadow = IRB.CreateLShr(CombinedWideShadow, Width);
2088  CombinedWideShadow = IRB.CreateOr(CombinedWideShadow, ShrShadow);
2089  }
2090  return {IRB.CreateTrunc(CombinedWideShadow, DFS.PrimitiveShadowTy),
2091  ShouldTrackOrigins
2092  ? combineOrigins(Shadows, Origins, Pos,
2093  ConstantInt::getSigned(IRB.getInt64Ty(), 0))
2094  : DFS.ZeroOrigin};
2095 }
2096 
2097 std::pair<Value *, Value *> DFSanFunction::loadShadowOriginSansLoadTracking(
2098  Value *Addr, uint64_t Size, Align InstAlignment, Instruction *Pos) {
2099  const bool ShouldTrackOrigins = DFS.shouldTrackOrigins();
2100 
2101  // Non-escaped loads.
2102  if (AllocaInst *AI = dyn_cast<AllocaInst>(Addr)) {
2103  const auto SI = AllocaShadowMap.find(AI);
2104  if (SI != AllocaShadowMap.end()) {
2105  IRBuilder<> IRB(Pos);
2106  Value *ShadowLI = IRB.CreateLoad(DFS.PrimitiveShadowTy, SI->second);
2107  const auto OI = AllocaOriginMap.find(AI);
2108  assert(!ShouldTrackOrigins || OI != AllocaOriginMap.end());
2109  return {ShadowLI, ShouldTrackOrigins
2110  ? IRB.CreateLoad(DFS.OriginTy, OI->second)
2111  : nullptr};
2112  }
2113  }
2114 
2115  // Load from constant addresses.
2117  getUnderlyingObjects(Addr, Objs);
2118  bool AllConstants = true;
2119  for (const Value *Obj : Objs) {
2120  if (isa<Function>(Obj) || isa<BlockAddress>(Obj))
2121  continue;
2122  if (isa<GlobalVariable>(Obj) && cast<GlobalVariable>(Obj)->isConstant())
2123  continue;
2124 
2125  AllConstants = false;
2126  break;
2127  }
2128  if (AllConstants)
2129  return {DFS.ZeroPrimitiveShadow,
2130  ShouldTrackOrigins ? DFS.ZeroOrigin : nullptr};
2131 
2132  if (Size == 0)
2133  return {DFS.ZeroPrimitiveShadow,
2134  ShouldTrackOrigins ? DFS.ZeroOrigin : nullptr};
2135 
2136  // Use callback to load if this is not an optimizable case for origin
2137  // tracking.
2138  if (ShouldTrackOrigins &&
2139  useCallbackLoadLabelAndOrigin(Size, InstAlignment)) {
2140  IRBuilder<> IRB(Pos);
2141  CallInst *Call =
2142  IRB.CreateCall(DFS.DFSanLoadLabelAndOriginFn,
2143  {IRB.CreatePointerCast(Addr, IRB.getInt8PtrTy()),
2144  ConstantInt::get(DFS.IntptrTy, Size)});
2145  Call->addRetAttr(Attribute::ZExt);
2146  return {IRB.CreateTrunc(IRB.CreateLShr(Call, DFS.OriginWidthBits),
2147  DFS.PrimitiveShadowTy),
2148  IRB.CreateTrunc(Call, DFS.OriginTy)};
2149  }
2150 
2151  // Other cases that support loading shadows or origins in a fast way.
2152  Value *ShadowAddr, *OriginAddr;
2153  std::tie(ShadowAddr, OriginAddr) =
2154  DFS.getShadowOriginAddress(Addr, InstAlignment, Pos);
2155 
2156  const Align ShadowAlign = getShadowAlign(InstAlignment);
2157  const Align OriginAlign = getOriginAlign(InstAlignment);
2158  Value *Origin = nullptr;
2159  if (ShouldTrackOrigins) {
2160  IRBuilder<> IRB(Pos);
2161  Origin = IRB.CreateAlignedLoad(DFS.OriginTy, OriginAddr, OriginAlign);
2162  }
2163 
2164  // When the byte size is small enough, we can load the shadow directly with
2165  // just a few instructions.
2166  switch (Size) {
2167  case 1: {
2168  LoadInst *LI = new LoadInst(DFS.PrimitiveShadowTy, ShadowAddr, "", Pos);
2169  LI->setAlignment(ShadowAlign);
2170  return {LI, Origin};
2171  }
2172  case 2: {
2173  IRBuilder<> IRB(Pos);
2174  Value *ShadowAddr1 = IRB.CreateGEP(DFS.PrimitiveShadowTy, ShadowAddr,
2175  ConstantInt::get(DFS.IntptrTy, 1));
2176  Value *Load =
2177  IRB.CreateAlignedLoad(DFS.PrimitiveShadowTy, ShadowAddr, ShadowAlign);
2178  Value *Load1 =
2179  IRB.CreateAlignedLoad(DFS.PrimitiveShadowTy, ShadowAddr1, ShadowAlign);
2180  return {combineShadows(Load, Load1, Pos), Origin};
2181  }
2182  }
2183  bool HasSizeForFastPath = DFS.hasLoadSizeForFastPath(Size);
2184 
2185  if (HasSizeForFastPath)
2186  return loadShadowFast(ShadowAddr, OriginAddr, Size, ShadowAlign,
2187  OriginAlign, Origin, Pos);
2188 
2189  IRBuilder<> IRB(Pos);
2190  CallInst *FallbackCall = IRB.CreateCall(
2191  DFS.DFSanUnionLoadFn, {ShadowAddr, ConstantInt::get(DFS.IntptrTy, Size)});
2192  FallbackCall->addRetAttr(Attribute::ZExt);
2193  return {FallbackCall, Origin};
2194 }
2195 
2196 std::pair<Value *, Value *> DFSanFunction::loadShadowOrigin(Value *Addr,
2197  uint64_t Size,
2198  Align InstAlignment,
2199  Instruction *Pos) {
2200  Value *PrimitiveShadow, *Origin;
2201  std::tie(PrimitiveShadow, Origin) =
2202  loadShadowOriginSansLoadTracking(Addr, Size, InstAlignment, Pos);
2203  if (DFS.shouldTrackOrigins()) {
2204  if (ClTrackOrigins == 2) {
2205  IRBuilder<> IRB(Pos);
2206  auto *ConstantShadow = dyn_cast<Constant>(PrimitiveShadow);
2207  if (!ConstantShadow || !ConstantShadow->isZeroValue())
2208  Origin = updateOriginIfTainted(PrimitiveShadow, Origin, IRB);
2209  }
2210  }
2211  return {PrimitiveShadow, Origin};
2212 }
2213 
2215  switch (AO) {
2216  case AtomicOrdering::NotAtomic:
2217  return AtomicOrdering::NotAtomic;
2219  case AtomicOrdering::Monotonic:
2220  case AtomicOrdering::Acquire:
2221  return AtomicOrdering::Acquire;
2222  case AtomicOrdering::Release:
2223  case AtomicOrdering::AcquireRelease:
2224  return AtomicOrdering::AcquireRelease;
2225  case AtomicOrdering::SequentiallyConsistent:
2226  return AtomicOrdering::SequentiallyConsistent;
2227  }
2228  llvm_unreachable("Unknown ordering");
2229 }
2230 
2232  if (!V->getType()->isPointerTy())
2233  return V;
2234 
2235  // DFSan pass should be running on valid IR, but we'll
2236  // keep a seen set to ensure there are no issues.
2238  Visited.insert(V);
2239  do {
2240  if (auto *GEP = dyn_cast<GEPOperator>(V)) {
2241  V = GEP->getPointerOperand();
2242  } else if (Operator::getOpcode(V) == Instruction::BitCast) {
2243  V = cast<Operator>(V)->getOperand(0);
2244  if (!V->getType()->isPointerTy())
2245  return V;
2246  } else if (isa<GlobalAlias>(V)) {
2247  V = cast<GlobalAlias>(V)->getAliasee();
2248  }
2249  } while (Visited.insert(V).second);
2250 
2251  return V;
2252 }
2253 
2254 void DFSanVisitor::visitLoadInst(LoadInst &LI) {
2255  auto &DL = LI.getModule()->getDataLayout();
2256  uint64_t Size = DL.getTypeStoreSize(LI.getType());
2257  if (Size == 0) {
2258  DFSF.setShadow(&LI, DFSF.DFS.getZeroShadow(&LI));
2259  DFSF.setOrigin(&LI, DFSF.DFS.ZeroOrigin);
2260  return;
2261  }
2262 
2263  // When an application load is atomic, increase atomic ordering between
2264  // atomic application loads and stores to ensure happen-before order; load
2265  // shadow data after application data; store zero shadow data before
2266  // application data. This ensure shadow loads return either labels of the
2267  // initial application data or zeros.
2268  if (LI.isAtomic())
2270 
2271  Instruction *Pos = LI.isAtomic() ? LI.getNextNode() : &LI;
2272  std::vector<Value *> Shadows;
2273  std::vector<Value *> Origins;
2274  Value *PrimitiveShadow, *Origin;
2275  std::tie(PrimitiveShadow, Origin) =
2276  DFSF.loadShadowOrigin(LI.getPointerOperand(), Size, LI.getAlign(), Pos);
2277  const bool ShouldTrackOrigins = DFSF.DFS.shouldTrackOrigins();
2278  if (ShouldTrackOrigins) {
2279  Shadows.push_back(PrimitiveShadow);
2280  Origins.push_back(Origin);
2281  }
2283  DFSF.isLookupTableConstant(
2285  Value *PtrShadow = DFSF.getShadow(LI.getPointerOperand());
2286  PrimitiveShadow = DFSF.combineShadows(PrimitiveShadow, PtrShadow, Pos);
2287  if (ShouldTrackOrigins) {
2288  Shadows.push_back(PtrShadow);
2289  Origins.push_back(DFSF.getOrigin(LI.getPointerOperand()));
2290  }
2291  }
2292  if (!DFSF.DFS.isZeroShadow(PrimitiveShadow))
2293  DFSF.NonZeroChecks.push_back(PrimitiveShadow);
2294 
2295  Value *Shadow =
2296  DFSF.expandFromPrimitiveShadow(LI.getType(), PrimitiveShadow, Pos);
2297  DFSF.setShadow(&LI, Shadow);
2298 
2299  if (ShouldTrackOrigins) {
2300  DFSF.setOrigin(&LI, DFSF.combineOrigins(Shadows, Origins, Pos));
2301  }
2302 
2303  if (ClEventCallbacks) {
2304  IRBuilder<> IRB(Pos);
2305  Value *Addr8 = IRB.CreateBitCast(LI.getPointerOperand(), DFSF.DFS.Int8Ptr);
2306  IRB.CreateCall(DFSF.DFS.DFSanLoadCallbackFn, {PrimitiveShadow, Addr8});
2307  }
2308 }
2309 
2310 Value *DFSanFunction::updateOriginIfTainted(Value *Shadow, Value *Origin,
2311  IRBuilder<> &IRB) {
2312  assert(DFS.shouldTrackOrigins());
2313  return IRB.CreateCall(DFS.DFSanChainOriginIfTaintedFn, {Shadow, Origin});
2314 }
2315 
2316 Value *DFSanFunction::updateOrigin(Value *V, IRBuilder<> &IRB) {
2317  if (!DFS.shouldTrackOrigins())
2318  return V;
2319  return IRB.CreateCall(DFS.DFSanChainOriginFn, V);
2320 }
2321 
2322 Value *DFSanFunction::originToIntptr(IRBuilder<> &IRB, Value *Origin) {
2323  const unsigned OriginSize = DataFlowSanitizer::OriginWidthBytes;
2324  const DataLayout &DL = F->getParent()->getDataLayout();
2325  unsigned IntptrSize = DL.getTypeStoreSize(DFS.IntptrTy);
2326  if (IntptrSize == OriginSize)
2327  return Origin;
2328  assert(IntptrSize == OriginSize * 2);
2329  Origin = IRB.CreateIntCast(Origin, DFS.IntptrTy, /* isSigned */ false);
2330  return IRB.CreateOr(Origin, IRB.CreateShl(Origin, OriginSize * 8));
2331 }
2332 
2333 void DFSanFunction::paintOrigin(IRBuilder<> &IRB, Value *Origin,
2334  Value *StoreOriginAddr,
2335  uint64_t StoreOriginSize, Align Alignment) {
2336  const unsigned OriginSize = DataFlowSanitizer::OriginWidthBytes;
2337  const DataLayout &DL = F->getParent()->getDataLayout();
2338  const Align IntptrAlignment = DL.getABITypeAlign(DFS.IntptrTy);
2339  unsigned IntptrSize = DL.getTypeStoreSize(DFS.IntptrTy);
2340  assert(IntptrAlignment >= MinOriginAlignment);
2341  assert(IntptrSize >= OriginSize);
2342 
2343  unsigned Ofs = 0;
2344  Align CurrentAlignment = Alignment;
2345  if (Alignment >= IntptrAlignment && IntptrSize > OriginSize) {
2346  Value *IntptrOrigin = originToIntptr(IRB, Origin);
2347  Value *IntptrStoreOriginPtr = IRB.CreatePointerCast(
2348  StoreOriginAddr, PointerType::get(DFS.IntptrTy, 0));
2349  for (unsigned I = 0; I < StoreOriginSize / IntptrSize; ++I) {
2350  Value *Ptr =
2351  I ? IRB.CreateConstGEP1_32(DFS.IntptrTy, IntptrStoreOriginPtr, I)
2352  : IntptrStoreOriginPtr;
2353  IRB.CreateAlignedStore(IntptrOrigin, Ptr, CurrentAlignment);
2354  Ofs += IntptrSize / OriginSize;
2355  CurrentAlignment = IntptrAlignment;
2356  }
2357  }
2358 
2359  for (unsigned I = Ofs; I < (StoreOriginSize + OriginSize - 1) / OriginSize;
2360  ++I) {
2361  Value *GEP = I ? IRB.CreateConstGEP1_32(DFS.OriginTy, StoreOriginAddr, I)
2362  : StoreOriginAddr;
2363  IRB.CreateAlignedStore(Origin, GEP, CurrentAlignment);
2364  CurrentAlignment = MinOriginAlignment;
2365  }
2366 }
2367 
2368 Value *DFSanFunction::convertToBool(Value *V, IRBuilder<> &IRB,
2369  const Twine &Name) {
2370  Type *VTy = V->getType();
2371  assert(VTy->isIntegerTy());
2372  if (VTy->getIntegerBitWidth() == 1)
2373  // Just converting a bool to a bool, so do nothing.
2374  return V;
2375  return IRB.CreateICmpNE(V, ConstantInt::get(VTy, 0), Name);
2376 }
2377 
2378 void DFSanFunction::storeOrigin(Instruction *Pos, Value *Addr, uint64_t Size,
2379  Value *Shadow, Value *Origin,
2380  Value *StoreOriginAddr, Align InstAlignment) {
2381  // Do not write origins for zero shadows because we do not trace origins for
2382  // untainted sinks.
2383  const Align OriginAlignment = getOriginAlign(InstAlignment);
2384  Value *CollapsedShadow = collapseToPrimitiveShadow(Shadow, Pos);
2385  IRBuilder<> IRB(Pos);
2386  if (auto *ConstantShadow = dyn_cast<Constant>(CollapsedShadow)) {
2387  if (!ConstantShadow->isZeroValue())
2388  paintOrigin(IRB, updateOrigin(Origin, IRB), StoreOriginAddr, Size,
2389  OriginAlignment);
2390  return;
2391  }
2392 
2393  if (shouldInstrumentWithCall()) {
2394  IRB.CreateCall(DFS.DFSanMaybeStoreOriginFn,
2395  {CollapsedShadow,
2396  IRB.CreatePointerCast(Addr, IRB.getInt8PtrTy()),
2397  ConstantInt::get(DFS.IntptrTy, Size), Origin});
2398  } else {
2399  Value *Cmp = convertToBool(CollapsedShadow, IRB, "_dfscmp");
2401  Cmp, &*IRB.GetInsertPoint(), false, DFS.OriginStoreWeights, &DT);
2402  IRBuilder<> IRBNew(CheckTerm);
2403  paintOrigin(IRBNew, updateOrigin(Origin, IRBNew), StoreOriginAddr, Size,
2404  OriginAlignment);
2405  ++NumOriginStores;
2406  }
2407 }
2408 
2409 void DFSanFunction::storeZeroPrimitiveShadow(Value *Addr, uint64_t Size,
2410  Align ShadowAlign,
2411  Instruction *Pos) {
2412  IRBuilder<> IRB(Pos);
2413  IntegerType *ShadowTy =
2414  IntegerType::get(*DFS.Ctx, Size * DFS.ShadowWidthBits);
2415  Value *ExtZeroShadow = ConstantInt::get(ShadowTy, 0);
2416  Value *ShadowAddr = DFS.getShadowAddress(Addr, Pos);
2417  Value *ExtShadowAddr =
2418  IRB.CreateBitCast(ShadowAddr, PointerType::getUnqual(ShadowTy));
2419  IRB.CreateAlignedStore(ExtZeroShadow, ExtShadowAddr, ShadowAlign);
2420  // Do not write origins for 0 shadows because we do not trace origins for
2421  // untainted sinks.
2422 }
2423 
2424 void DFSanFunction::storePrimitiveShadowOrigin(Value *Addr, uint64_t Size,
2425  Align InstAlignment,
2426  Value *PrimitiveShadow,
2427  Value *Origin,
2428  Instruction *Pos) {
2429  const bool ShouldTrackOrigins = DFS.shouldTrackOrigins() && Origin;
2430 
2431  if (AllocaInst *AI = dyn_cast<AllocaInst>(Addr)) {
2432  const auto SI = AllocaShadowMap.find(AI);
2433  if (SI != AllocaShadowMap.end()) {
2434  IRBuilder<> IRB(Pos);
2435  IRB.CreateStore(PrimitiveShadow, SI->second);
2436 
2437  // Do not write origins for 0 shadows because we do not trace origins for
2438  // untainted sinks.
2439  if (ShouldTrackOrigins && !DFS.isZeroShadow(PrimitiveShadow)) {
2440  const auto OI = AllocaOriginMap.find(AI);
2441  assert(OI != AllocaOriginMap.end() && Origin);
2442  IRB.CreateStore(Origin, OI->second);
2443  }
2444  return;
2445  }
2446  }
2447 
2448  const Align ShadowAlign = getShadowAlign(InstAlignment);
2449  if (DFS.isZeroShadow(PrimitiveShadow)) {
2450  storeZeroPrimitiveShadow(Addr, Size, ShadowAlign, Pos);
2451  return;
2452  }
2453 
2454  IRBuilder<> IRB(Pos);
2455  Value *ShadowAddr, *OriginAddr;
2456  std::tie(ShadowAddr, OriginAddr) =
2457  DFS.getShadowOriginAddress(Addr, InstAlignment, Pos);
2458 
2459  const unsigned ShadowVecSize = 8;
2460  assert(ShadowVecSize * DFS.ShadowWidthBits <= 128 &&
2461  "Shadow vector is too large!");
2462 
2463  uint64_t Offset = 0;
2464  uint64_t LeftSize = Size;
2465  if (LeftSize >= ShadowVecSize) {
2466  auto *ShadowVecTy =
2467  FixedVectorType::get(DFS.PrimitiveShadowTy, ShadowVecSize);
2468  Value *ShadowVec = PoisonValue::get(ShadowVecTy);
2469  for (unsigned I = 0; I != ShadowVecSize; ++I) {
2470  ShadowVec = IRB.CreateInsertElement(
2471  ShadowVec, PrimitiveShadow,
2472  ConstantInt::get(Type::getInt32Ty(*DFS.Ctx), I));
2473  }
2474  Value *ShadowVecAddr =
2475  IRB.CreateBitCast(ShadowAddr, PointerType::getUnqual(ShadowVecTy));
2476  do {
2477  Value *CurShadowVecAddr =
2478  IRB.CreateConstGEP1_32(ShadowVecTy, ShadowVecAddr, Offset);
2479  IRB.CreateAlignedStore(ShadowVec, CurShadowVecAddr, ShadowAlign);
2480  LeftSize -= ShadowVecSize;
2481  ++Offset;
2482  } while (LeftSize >= ShadowVecSize);
2483  Offset *= ShadowVecSize;
2484  }
2485  while (LeftSize > 0) {
2486  Value *CurShadowAddr =
2487  IRB.CreateConstGEP1_32(DFS.PrimitiveShadowTy, ShadowAddr, Offset);
2488  IRB.CreateAlignedStore(PrimitiveShadow, CurShadowAddr, ShadowAlign);
2489  --LeftSize;
2490  ++Offset;
2491  }
2492 
2493  if (ShouldTrackOrigins) {
2494  storeOrigin(Pos, Addr, Size, PrimitiveShadow, Origin, OriginAddr,
2495  InstAlignment);
2496  }
2497 }
2498 
2500  switch (AO) {
2501  case AtomicOrdering::NotAtomic:
2502  return AtomicOrdering::NotAtomic;
2504  case AtomicOrdering::Monotonic:
2505  case AtomicOrdering::Release:
2506  return AtomicOrdering::Release;
2507  case AtomicOrdering::Acquire:
2508  case AtomicOrdering::AcquireRelease:
2509  return AtomicOrdering::AcquireRelease;
2510  case AtomicOrdering::SequentiallyConsistent:
2511  return AtomicOrdering::SequentiallyConsistent;
2512  }
2513  llvm_unreachable("Unknown ordering");
2514 }
2515 
2516 void DFSanVisitor::visitStoreInst(StoreInst &SI) {
2517  auto &DL = SI.getModule()->getDataLayout();
2518  Value *Val = SI.getValueOperand();
2519  uint64_t Size = DL.getTypeStoreSize(Val->getType());
2520  if (Size == 0)
2521  return;
2522 
2523  // When an application store is atomic, increase atomic ordering between
2524  // atomic application loads and stores to ensure happen-before order; load
2525  // shadow data after application data; store zero shadow data before
2526  // application data. This ensure shadow loads return either labels of the
2527  // initial application data or zeros.
2528  if (SI.isAtomic())
2529  SI.setOrdering(addReleaseOrdering(SI.getOrdering()));
2530 
2531  const bool ShouldTrackOrigins =
2532  DFSF.DFS.shouldTrackOrigins() && !SI.isAtomic();
2533  std::vector<Value *> Shadows;
2534  std::vector<Value *> Origins;
2535 
2536  Value *Shadow =
2537  SI.isAtomic() ? DFSF.DFS.getZeroShadow(Val) : DFSF.getShadow(Val);
2538 
2539  if (ShouldTrackOrigins) {
2540  Shadows.push_back(Shadow);
2541  Origins.push_back(DFSF.getOrigin(Val));
2542  }
2543 
2544  Value *PrimitiveShadow;
2546  Value *PtrShadow = DFSF.getShadow(SI.getPointerOperand());
2547  if (ShouldTrackOrigins) {
2548  Shadows.push_back(PtrShadow);
2549  Origins.push_back(DFSF.getOrigin(SI.getPointerOperand()));
2550  }
2551  PrimitiveShadow = DFSF.combineShadows(Shadow, PtrShadow, &SI);
2552  } else {
2553  PrimitiveShadow = DFSF.collapseToPrimitiveShadow(Shadow, &SI);
2554  }
2555  Value *Origin = nullptr;
2556  if (ShouldTrackOrigins)
2557  Origin = DFSF.combineOrigins(Shadows, Origins, &SI);
2558  DFSF.storePrimitiveShadowOrigin(SI.getPointerOperand(), Size, SI.getAlign(),
2559  PrimitiveShadow, Origin, &SI);
2560  if (ClEventCallbacks) {
2561  IRBuilder<> IRB(&SI);
2562  Value *Addr8 = IRB.CreateBitCast(SI.getPointerOperand(), DFSF.DFS.Int8Ptr);
2563  IRB.CreateCall(DFSF.DFS.DFSanStoreCallbackFn, {PrimitiveShadow, Addr8});
2564  }
2565 }
2566 
2567 void DFSanVisitor::visitCASOrRMW(Align InstAlignment, Instruction &I) {
2568  assert(isa<AtomicRMWInst>(I) || isa<AtomicCmpXchgInst>(I));
2569 
2570  Value *Val = I.getOperand(1);
2571  const auto &DL = I.getModule()->getDataLayout();
2572  uint64_t Size = DL.getTypeStoreSize(Val->getType());
2573  if (Size == 0)
2574  return;
2575 
2576  // Conservatively set data at stored addresses and return with zero shadow to
2577  // prevent shadow data races.
2578  IRBuilder<> IRB(&I);
2579  Value *Addr = I.getOperand(0);
2580  const Align ShadowAlign = DFSF.getShadowAlign(InstAlignment);
2581  DFSF.storeZeroPrimitiveShadow(Addr, Size, ShadowAlign, &I);
2582  DFSF.setShadow(&I, DFSF.DFS.getZeroShadow(&I));
2583  DFSF.setOrigin(&I, DFSF.DFS.ZeroOrigin);
2584 }
2585 
2586 void DFSanVisitor::visitAtomicRMWInst(AtomicRMWInst &I) {
2587  visitCASOrRMW(I.getAlign(), I);
2588  // TODO: The ordering change follows MSan. It is possible not to change
2589  // ordering because we always set and use 0 shadows.
2590  I.setOrdering(addReleaseOrdering(I.getOrdering()));
2591 }
2592 
2593 void DFSanVisitor::visitAtomicCmpXchgInst(AtomicCmpXchgInst &I) {
2594  visitCASOrRMW(I.getAlign(), I);
2595  // TODO: The ordering change follows MSan. It is possible not to change
2596  // ordering because we always set and use 0 shadows.
2597  I.setSuccessOrdering(addReleaseOrdering(I.getSuccessOrdering()));
2598 }
2599 
2600 void DFSanVisitor::visitUnaryOperator(UnaryOperator &UO) {
2601  visitInstOperands(UO);
2602 }
2603 
2604 void DFSanVisitor::visitBinaryOperator(BinaryOperator &BO) {
2605  visitInstOperands(BO);
2606 }
2607 
2608 void DFSanVisitor::visitBitCastInst(BitCastInst &BCI) {
2609  // Special case: if this is the bitcast (there is exactly 1 allowed) between
2610  // a musttail call and a ret, don't instrument. New instructions are not
2611  // allowed after a musttail call.
2612  if (auto *CI = dyn_cast<CallInst>(BCI.getOperand(0)))
2613  if (CI->isMustTailCall())
2614  return;
2615  visitInstOperands(BCI);
2616 }
2617 
2618 void DFSanVisitor::visitCastInst(CastInst &CI) { visitInstOperands(CI); }
2619 
2620 void DFSanVisitor::visitCmpInst(CmpInst &CI) {
2621  visitInstOperands(CI);
2622  if (ClEventCallbacks) {
2623  IRBuilder<> IRB(&CI);
2624  Value *CombinedShadow = DFSF.getShadow(&CI);
2625  IRB.CreateCall(DFSF.DFS.DFSanCmpCallbackFn, CombinedShadow);
2626  }
2627 }
2628 
2629 void DFSanVisitor::visitLandingPadInst(LandingPadInst &LPI) {
2630  // We do not need to track data through LandingPadInst.
2631  //
2632  // For the C++ exceptions, if a value is thrown, this value will be stored
2633  // in a memory location provided by __cxa_allocate_exception(...) (on the
2634  // throw side) or __cxa_begin_catch(...) (on the catch side).
2635  // This memory will have a shadow, so with the loads and stores we will be
2636  // able to propagate labels on data thrown through exceptions, without any
2637  // special handling of the LandingPadInst.
2638  //
2639  // The second element in the pair result of the LandingPadInst is a
2640  // register value, but it is for a type ID and should never be tainted.
2641  DFSF.setShadow(&LPI, DFSF.DFS.getZeroShadow(&LPI));
2642  DFSF.setOrigin(&LPI, DFSF.DFS.ZeroOrigin);
2643 }
2644 
2645 void DFSanVisitor::visitGetElementPtrInst(GetElementPtrInst &GEPI) {
2647  DFSF.isLookupTableConstant(
2649  visitInstOperands(GEPI);
2650  return;
2651  }
2652 
2653  // Only propagate shadow/origin of base pointer value but ignore those of
2654  // offset operands.
2655  Value *BasePointer = GEPI.getPointerOperand();
2656  DFSF.setShadow(&GEPI, DFSF.getShadow(BasePointer));
2657  if (DFSF.DFS.shouldTrackOrigins())
2658  DFSF.setOrigin(&GEPI, DFSF.getOrigin(BasePointer));
2659 }
2660 
2661 void DFSanVisitor::visitExtractElementInst(ExtractElementInst &I) {
2662  visitInstOperands(I);
2663 }
2664 
2665 void DFSanVisitor::visitInsertElementInst(InsertElementInst &I) {
2666  visitInstOperands(I);
2667 }
2668 
2669 void DFSanVisitor::visitShuffleVectorInst(ShuffleVectorInst &I) {
2670  visitInstOperands(I);
2671 }
2672 
2673 void DFSanVisitor::visitExtractValueInst(ExtractValueInst &I) {
2674  IRBuilder<> IRB(&I);
2675  Value *Agg = I.getAggregateOperand();
2676  Value *AggShadow = DFSF.getShadow(Agg);
2677  Value *ResShadow = IRB.CreateExtractValue(AggShadow, I.getIndices());
2678  DFSF.setShadow(&I, ResShadow);
2679  visitInstOperandOrigins(I);
2680 }
2681 
2682 void DFSanVisitor::visitInsertValueInst(InsertValueInst &I) {
2683  IRBuilder<> IRB(&I);
2684  Value *AggShadow = DFSF.getShadow(I.getAggregateOperand());
2685  Value *InsShadow = DFSF.getShadow(I.getInsertedValueOperand());
2686  Value *Res = IRB.CreateInsertValue(AggShadow, InsShadow, I.getIndices());
2687  DFSF.setShadow(&I, Res);
2688  visitInstOperandOrigins(I);
2689 }
2690 
2691 void DFSanVisitor::visitAllocaInst(AllocaInst &I) {
2692  bool AllLoadsStores = true;
2693  for (User *U : I.users()) {
2694  if (isa<LoadInst>(U))
2695  continue;
2696 
2697  if (StoreInst *SI = dyn_cast<StoreInst>(U)) {
2698  if (SI->getPointerOperand() == &I)
2699  continue;
2700  }
2701 
2702  AllLoadsStores = false;
2703  break;
2704  }
2705  if (AllLoadsStores) {
2706  IRBuilder<> IRB(&I);
2707  DFSF.AllocaShadowMap[&I] = IRB.CreateAlloca(DFSF.DFS.PrimitiveShadowTy);
2708  if (DFSF.DFS.shouldTrackOrigins()) {
2709  DFSF.AllocaOriginMap[&I] =
2710  IRB.CreateAlloca(DFSF.DFS.OriginTy, nullptr, "_dfsa");
2711  }
2712  }
2713  DFSF.setShadow(&I, DFSF.DFS.ZeroPrimitiveShadow);
2714  DFSF.setOrigin(&I, DFSF.DFS.ZeroOrigin);
2715 }
2716 
2717 void DFSanVisitor::visitSelectInst(SelectInst &I) {
2718  Value *CondShadow = DFSF.getShadow(I.getCondition());
2719  Value *TrueShadow = DFSF.getShadow(I.getTrueValue());
2720  Value *FalseShadow = DFSF.getShadow(I.getFalseValue());
2721  Value *ShadowSel = nullptr;
2722  const bool ShouldTrackOrigins = DFSF.DFS.shouldTrackOrigins();
2723  std::vector<Value *> Shadows;
2724  std::vector<Value *> Origins;
2725  Value *TrueOrigin =
2726  ShouldTrackOrigins ? DFSF.getOrigin(I.getTrueValue()) : nullptr;
2727  Value *FalseOrigin =
2728  ShouldTrackOrigins ? DFSF.getOrigin(I.getFalseValue()) : nullptr;
2729 
2730  DFSF.addConditionalCallbacksIfEnabled(I, I.getCondition());
2731 
2732  if (isa<VectorType>(I.getCondition()->getType())) {
2733  ShadowSel = DFSF.combineShadowsThenConvert(I.getType(), TrueShadow,
2734  FalseShadow, &I);
2735  if (ShouldTrackOrigins) {
2736  Shadows.push_back(TrueShadow);
2737  Shadows.push_back(FalseShadow);
2738  Origins.push_back(TrueOrigin);
2739  Origins.push_back(FalseOrigin);
2740  }
2741  } else {
2742  if (TrueShadow == FalseShadow) {
2743  ShadowSel = TrueShadow;
2744  if (ShouldTrackOrigins) {
2745  Shadows.push_back(TrueShadow);
2746  Origins.push_back(TrueOrigin);
2747  }
2748  } else {
2749  ShadowSel =
2750  SelectInst::Create(I.getCondition(), TrueShadow, FalseShadow, "", &I);
2751  if (ShouldTrackOrigins) {
2752  Shadows.push_back(ShadowSel);
2753  Origins.push_back(SelectInst::Create(I.getCondition(), TrueOrigin,
2754  FalseOrigin, "", &I));
2755  }
2756  }
2757  }
2758  DFSF.setShadow(&I, ClTrackSelectControlFlow
2759  ? DFSF.combineShadowsThenConvert(
2760  I.getType(), CondShadow, ShadowSel, &I)
2761  : ShadowSel);
2762  if (ShouldTrackOrigins) {
2764  Shadows.push_back(CondShadow);
2765  Origins.push_back(DFSF.getOrigin(I.getCondition()));
2766  }
2767  DFSF.setOrigin(&I, DFSF.combineOrigins(Shadows, Origins, &I));
2768  }
2769 }
2770 
2771 void DFSanVisitor::visitMemSetInst(MemSetInst &I) {
2772  IRBuilder<> IRB(&I);
2773  Value *ValShadow = DFSF.getShadow(I.getValue());
2774  Value *ValOrigin = DFSF.DFS.shouldTrackOrigins()
2775  ? DFSF.getOrigin(I.getValue())
2776  : DFSF.DFS.ZeroOrigin;
2777  IRB.CreateCall(
2778  DFSF.DFS.DFSanSetLabelFn,
2779  {ValShadow, ValOrigin,
2780  IRB.CreateBitCast(I.getDest(), Type::getInt8PtrTy(*DFSF.DFS.Ctx)),
2781  IRB.CreateZExtOrTrunc(I.getLength(), DFSF.DFS.IntptrTy)});
2782 }
2783 
2784 void DFSanVisitor::visitMemTransferInst(MemTransferInst &I) {
2785  IRBuilder<> IRB(&I);
2786 
2787  // CopyOrMoveOrigin transfers origins by refering to their shadows. So we
2788  // need to move origins before moving shadows.
2789  if (DFSF.DFS.shouldTrackOrigins()) {
2790  IRB.CreateCall(
2791  DFSF.DFS.DFSanMemOriginTransferFn,
2792  {IRB.CreatePointerCast(I.getArgOperand(0), IRB.getInt8PtrTy()),
2793  IRB.CreatePointerCast(I.getArgOperand(1), IRB.getInt8PtrTy()),
2794  IRB.CreateIntCast(I.getArgOperand(2), DFSF.DFS.IntptrTy, false)});
2795  }
2796 
2797  Value *RawDestShadow = DFSF.DFS.getShadowAddress(I.getDest(), &I);
2798  Value *SrcShadow = DFSF.DFS.getShadowAddress(I.getSource(), &I);
2799  Value *LenShadow =
2800  IRB.CreateMul(I.getLength(), ConstantInt::get(I.getLength()->getType(),
2801  DFSF.DFS.ShadowWidthBytes));
2802  Type *Int8Ptr = Type::getInt8PtrTy(*DFSF.DFS.Ctx);
2803  Value *DestShadow = IRB.CreateBitCast(RawDestShadow, Int8Ptr);
2804  SrcShadow = IRB.CreateBitCast(SrcShadow, Int8Ptr);
2805  auto *MTI = cast<MemTransferInst>(
2806  IRB.CreateCall(I.getFunctionType(), I.getCalledOperand(),
2807  {DestShadow, SrcShadow, LenShadow, I.getVolatileCst()}));
2808  MTI->setDestAlignment(DFSF.getShadowAlign(I.getDestAlign().valueOrOne()));
2809  MTI->setSourceAlignment(DFSF.getShadowAlign(I.getSourceAlign().valueOrOne()));
2810  if (ClEventCallbacks) {
2811  IRB.CreateCall(DFSF.DFS.DFSanMemTransferCallbackFn,
2812  {RawDestShadow,
2813  IRB.CreateZExtOrTrunc(I.getLength(), DFSF.DFS.IntptrTy)});
2814  }
2815 }
2816 
2817 void DFSanVisitor::visitBranchInst(BranchInst &BR) {
2818  if (!BR.isConditional())
2819  return;
2820 
2821  DFSF.addConditionalCallbacksIfEnabled(BR, BR.getCondition());
2822 }
2823 
2824 void DFSanVisitor::visitSwitchInst(SwitchInst &SW) {
2825  DFSF.addConditionalCallbacksIfEnabled(SW, SW.getCondition());
2826 }
2827 
2828 static bool isAMustTailRetVal(Value *RetVal) {
2829  // Tail call may have a bitcast between return.
2830  if (auto *I = dyn_cast<BitCastInst>(RetVal)) {
2831  RetVal = I->getOperand(0);
2832  }
2833  if (auto *I = dyn_cast<CallInst>(RetVal)) {
2834  return I->isMustTailCall();
2835  }
2836  return false;
2837 }
2838 
2839 void DFSanVisitor::visitReturnInst(ReturnInst &RI) {
2840  if (!DFSF.IsNativeABI && RI.getReturnValue()) {
2841  // Don't emit the instrumentation for musttail call returns.
2843  return;
2844 
2845  Value *S = DFSF.getShadow(RI.getReturnValue());
2846  IRBuilder<> IRB(&RI);
2847  Type *RT = DFSF.F->getFunctionType()->getReturnType();
2848  unsigned Size = getDataLayout().getTypeAllocSize(DFSF.DFS.getShadowTy(RT));
2849  if (Size <= RetvalTLSSize) {
2850  // If the size overflows, stores nothing. At callsite, oversized return
2851  // shadows are set to zero.
2852  IRB.CreateAlignedStore(S, DFSF.getRetvalTLS(RT, IRB), ShadowTLSAlignment);
2853  }
2854  if (DFSF.DFS.shouldTrackOrigins()) {
2855  Value *O = DFSF.getOrigin(RI.getReturnValue());
2856  IRB.CreateStore(O, DFSF.getRetvalOriginTLS());
2857  }
2858  }
2859 }
2860 
2861 void DFSanVisitor::addShadowArguments(Function &F, CallBase &CB,
2862  std::vector<Value *> &Args,
2863  IRBuilder<> &IRB) {
2864  FunctionType *FT = F.getFunctionType();
2865 
2866  auto *I = CB.arg_begin();
2867 
2868  // Adds non-variable argument shadows.
2869  for (unsigned N = FT->getNumParams(); N != 0; ++I, --N)
2870  Args.push_back(DFSF.collapseToPrimitiveShadow(DFSF.getShadow(*I), &CB));
2871 
2872  // Adds variable argument shadows.
2873  if (FT->isVarArg()) {
2874  auto *LabelVATy = ArrayType::get(DFSF.DFS.PrimitiveShadowTy,
2875  CB.arg_size() - FT->getNumParams());
2876  auto *LabelVAAlloca =
2877  new AllocaInst(LabelVATy, getDataLayout().getAllocaAddrSpace(),
2878  "labelva", &DFSF.F->getEntryBlock().front());
2879 
2880  for (unsigned N = 0; I != CB.arg_end(); ++I, ++N) {
2881  auto *LabelVAPtr = IRB.CreateStructGEP(LabelVATy, LabelVAAlloca, N);
2882  IRB.CreateStore(DFSF.collapseToPrimitiveShadow(DFSF.getShadow(*I), &CB),
2883  LabelVAPtr);
2884  }
2885 
2886  Args.push_back(IRB.CreateStructGEP(LabelVATy, LabelVAAlloca, 0));
2887  }
2888 
2889  // Adds the return value shadow.
2890  if (!FT->getReturnType()->isVoidTy()) {
2891  if (!DFSF.LabelReturnAlloca) {
2892  DFSF.LabelReturnAlloca = new AllocaInst(
2893  DFSF.DFS.PrimitiveShadowTy, getDataLayout().getAllocaAddrSpace(),
2894  "labelreturn", &DFSF.F->getEntryBlock().front());
2895  }
2896  Args.push_back(DFSF.LabelReturnAlloca);
2897  }
2898 }
2899 
2900 void DFSanVisitor::addOriginArguments(Function &F, CallBase &CB,
2901  std::vector<Value *> &Args,
2902  IRBuilder<> &IRB) {
2903  FunctionType *FT = F.getFunctionType();
2904 
2905  auto *I = CB.arg_begin();
2906 
2907  // Add non-variable argument origins.
2908  for (unsigned N = FT->getNumParams(); N != 0; ++I, --N)
2909  Args.push_back(DFSF.getOrigin(*I));
2910 
2911  // Add variable argument origins.
2912  if (FT->isVarArg()) {
2913  auto *OriginVATy =
2914  ArrayType::get(DFSF.DFS.OriginTy, CB.arg_size() - FT->getNumParams());
2915  auto *OriginVAAlloca =
2916  new AllocaInst(OriginVATy, getDataLayout().getAllocaAddrSpace(),
2917  "originva", &DFSF.F->getEntryBlock().front());
2918 
2919  for (unsigned N = 0; I != CB.arg_end(); ++I, ++N) {
2920  auto *OriginVAPtr = IRB.CreateStructGEP(OriginVATy, OriginVAAlloca, N);
2921  IRB.CreateStore(DFSF.getOrigin(*I), OriginVAPtr);
2922  }
2923 
2924  Args.push_back(IRB.CreateStructGEP(OriginVATy, OriginVAAlloca, 0));
2925  }
2926 
2927  // Add the return value origin.
2928  if (!FT->getReturnType()->isVoidTy()) {
2929  if (!DFSF.OriginReturnAlloca) {
2930  DFSF.OriginReturnAlloca = new AllocaInst(
2931  DFSF.DFS.OriginTy, getDataLayout().getAllocaAddrSpace(),
2932  "originreturn", &DFSF.F->getEntryBlock().front());
2933  }
2934  Args.push_back(DFSF.OriginReturnAlloca);
2935  }
2936 }
2937 
2938 bool DFSanVisitor::visitWrappedCallBase(Function &F, CallBase &CB) {
2939  IRBuilder<> IRB(&CB);
2940  switch (DFSF.DFS.getWrapperKind(&F)) {
2941  case DataFlowSanitizer::WK_Warning:
2942  CB.setCalledFunction(&F);
2943  IRB.CreateCall(DFSF.DFS.DFSanUnimplementedFn,
2944  IRB.CreateGlobalStringPtr(F.getName()));
2945  DFSF.DFS.buildExternWeakCheckIfNeeded(IRB, &F);
2946  DFSF.setShadow(&CB, DFSF.DFS.getZeroShadow(&CB));
2947  DFSF.setOrigin(&CB, DFSF.DFS.ZeroOrigin);
2948  return true;
2949  case DataFlowSanitizer::WK_Discard:
2950  CB.setCalledFunction(&F);
2951  DFSF.DFS.buildExternWeakCheckIfNeeded(IRB, &F);
2952  DFSF.setShadow(&CB, DFSF.DFS.getZeroShadow(&CB));
2953  DFSF.setOrigin(&CB, DFSF.DFS.ZeroOrigin);
2954  return true;
2955  case DataFlowSanitizer::WK_Functional:
2956  CB.setCalledFunction(&F);
2957  DFSF.DFS.buildExternWeakCheckIfNeeded(IRB, &F);
2958  visitInstOperands(CB);
2959  return true;
2960  case DataFlowSanitizer::WK_Custom:
2961  // Don't try to handle invokes of custom functions, it's too complicated.
2962  // Instead, invoke the dfsw$ wrapper, which will in turn call the __dfsw_
2963  // wrapper.
2964  CallInst *CI = dyn_cast<CallInst>(&CB);
2965  if (!CI)
2966  return false;
2967 
2968  const bool ShouldTrackOrigins = DFSF.DFS.shouldTrackOrigins();
2969  FunctionType *FT = F.getFunctionType();
2970  TransformedFunction CustomFn = DFSF.DFS.getCustomFunctionType(FT);
2971  std::string CustomFName = ShouldTrackOrigins ? "__dfso_" : "__dfsw_";
2972  CustomFName += F.getName();
2973  FunctionCallee CustomF = DFSF.DFS.Mod->getOrInsertFunction(
2974  CustomFName, CustomFn.TransformedType);
2975  if (Function *CustomFn = dyn_cast<Function>(CustomF.getCallee())) {
2976  CustomFn->copyAttributesFrom(&F);
2977 
2978  // Custom functions returning non-void will write to the return label.
2979  if (!FT->getReturnType()->isVoidTy()) {
2980  CustomFn->removeFnAttrs(DFSF.DFS.ReadOnlyNoneAttrs);
2981  }
2982  }
2983 
2984  std::vector<Value *> Args;
2985 
2986  // Adds non-variable arguments.
2987  auto *I = CB.arg_begin();
2988  for (unsigned N = FT->getNumParams(); N != 0; ++I, --N) {
2989  Args.push_back(*I);
2990  }
2991 
2992  // Adds shadow arguments.
2993  const unsigned ShadowArgStart = Args.size();
2994  addShadowArguments(F, CB, Args, IRB);
2995 
2996  // Adds origin arguments.
2997  const unsigned OriginArgStart = Args.size();
2998  if (ShouldTrackOrigins)
2999  addOriginArguments(F, CB, Args, IRB);
3000 
3001  // Adds variable arguments.
3002  append_range(Args, drop_begin(CB.args(), FT->getNumParams()));
3003 
3004  CallInst *CustomCI = IRB.CreateCall(CustomF, Args);
3005  CustomCI->setCallingConv(CI->getCallingConv());
3006  CustomCI->setAttributes(transformFunctionAttributes(
3007  CustomFn, CI->getContext(), CI->getAttributes()));
3008 
3009  // Update the parameter attributes of the custom call instruction to
3010  // zero extend the shadow parameters. This is required for targets
3011  // which consider PrimitiveShadowTy an illegal type.
3012  for (unsigned N = 0; N < FT->getNumParams(); N++) {
3013  const unsigned ArgNo = ShadowArgStart + N;
3014  if (CustomCI->getArgOperand(ArgNo)->getType() ==
3015  DFSF.DFS.PrimitiveShadowTy)
3016  CustomCI->addParamAttr(ArgNo, Attribute::ZExt);
3017  if (ShouldTrackOrigins) {
3018  const unsigned OriginArgNo = OriginArgStart + N;
3019  if (CustomCI->getArgOperand(OriginArgNo)->getType() ==
3020  DFSF.DFS.OriginTy)
3021  CustomCI->addParamAttr(OriginArgNo, Attribute::ZExt);
3022  }
3023  }
3024 
3025  // Loads the return value shadow and origin.
3026  if (!FT->getReturnType()->isVoidTy()) {
3027  LoadInst *LabelLoad =
3028  IRB.CreateLoad(DFSF.DFS.PrimitiveShadowTy, DFSF.LabelReturnAlloca);
3029  DFSF.setShadow(CustomCI, DFSF.expandFromPrimitiveShadow(
3030  FT->getReturnType(), LabelLoad, &CB));
3031  if (ShouldTrackOrigins) {
3032  LoadInst *OriginLoad =
3033  IRB.CreateLoad(DFSF.DFS.OriginTy, DFSF.OriginReturnAlloca);
3034  DFSF.setOrigin(CustomCI, OriginLoad);
3035  }
3036  }
3037 
3038  CI->replaceAllUsesWith(CustomCI);
3039  CI->eraseFromParent();
3040  return true;
3041  }
3042  return false;
3043 }
3044 
3045 Value *DFSanVisitor::makeAddAcquireOrderingTable(IRBuilder<> &IRB) {
3046  constexpr int NumOrderings = (int)AtomicOrderingCABI::seq_cst + 1;
3047  uint32_t OrderingTable[NumOrderings] = {};
3048 
3049  OrderingTable[(int)AtomicOrderingCABI::relaxed] =
3050  OrderingTable[(int)AtomicOrderingCABI::acquire] =
3051  OrderingTable[(int)AtomicOrderingCABI::consume] =
3052  (int)AtomicOrderingCABI::acquire;
3053  OrderingTable[(int)AtomicOrderingCABI::release] =
3054  OrderingTable[(int)AtomicOrderingCABI::acq_rel] =
3055  (int)AtomicOrderingCABI::acq_rel;
3056  OrderingTable[(int)AtomicOrderingCABI::seq_cst] =
3057  (int)AtomicOrderingCABI::seq_cst;
3058 
3059  return ConstantDataVector::get(IRB.getContext(),
3060  makeArrayRef(OrderingTable, NumOrderings));
3061 }
3062 
3063 void DFSanVisitor::visitLibAtomicLoad(CallBase &CB) {
3064  // Since we use getNextNode here, we can't have CB terminate the BB.
3065  assert(isa<CallInst>(CB));
3066 
3067  IRBuilder<> IRB(&CB);
3068  Value *Size = CB.getArgOperand(0);
3069  Value *SrcPtr = CB.getArgOperand(1);
3070  Value *DstPtr = CB.getArgOperand(2);
3071  Value *Ordering = CB.getArgOperand(3);
3072  // Convert the call to have at least Acquire ordering to make sure
3073  // the shadow operations aren't reordered before it.
3074  Value *NewOrdering =
3075  IRB.CreateExtractElement(makeAddAcquireOrderingTable(IRB), Ordering);
3076  CB.setArgOperand(3, NewOrdering);
3077 
3078  IRBuilder<> NextIRB(CB.getNextNode());
3079  NextIRB.SetCurrentDebugLocation(CB.getDebugLoc());
3080 
3081  // TODO: Support ClCombinePointerLabelsOnLoad
3082  // TODO: Support ClEventCallbacks
3083 
3084  NextIRB.CreateCall(DFSF.DFS.DFSanMemShadowOriginTransferFn,
3085  {NextIRB.CreatePointerCast(DstPtr, NextIRB.getInt8PtrTy()),
3086  NextIRB.CreatePointerCast(SrcPtr, NextIRB.getInt8PtrTy()),
3087  NextIRB.CreateIntCast(Size, DFSF.DFS.IntptrTy, false)});
3088 }
3089 
3090 Value *DFSanVisitor::makeAddReleaseOrderingTable(IRBuilder<> &IRB) {
3091  constexpr int NumOrderings = (int)AtomicOrderingCABI::seq_cst + 1;
3092  uint32_t OrderingTable[NumOrderings] = {};
3093 
3094  OrderingTable[(int)AtomicOrderingCABI::relaxed] =
3095  OrderingTable[(int)AtomicOrderingCABI::release] =
3096  (int)AtomicOrderingCABI::release;
3097  OrderingTable[(int)AtomicOrderingCABI::consume] =
3098  OrderingTable[(int)AtomicOrderingCABI::acquire] =
3099  OrderingTable[(int)AtomicOrderingCABI::acq_rel] =
3100  (int)AtomicOrderingCABI::acq_rel;
3101  OrderingTable[(int)AtomicOrderingCABI::seq_cst] =
3102  (int)AtomicOrderingCABI::seq_cst;
3103 
3104  return ConstantDataVector::get(IRB.getContext(),
3105  makeArrayRef(OrderingTable, NumOrderings));
3106 }
3107 
3108 void DFSanVisitor::visitLibAtomicStore(CallBase &CB) {
3109  IRBuilder<> IRB(&CB);
3110  Value *Size = CB.getArgOperand(0);
3111  Value *SrcPtr = CB.getArgOperand(1);
3112  Value *DstPtr = CB.getArgOperand(2);
3113  Value *Ordering = CB.getArgOperand(3);
3114  // Convert the call to have at least Release ordering to make sure
3115  // the shadow operations aren't reordered after it.
3116  Value *NewOrdering =
3117  IRB.CreateExtractElement(makeAddReleaseOrderingTable(IRB), Ordering);
3118  CB.setArgOperand(3, NewOrdering);
3119 
3120  // TODO: Support ClCombinePointerLabelsOnStore
3121  // TODO: Support ClEventCallbacks
3122 
3123  IRB.CreateCall(DFSF.DFS.DFSanMemShadowOriginTransferFn,
3124  {IRB.CreatePointerCast(DstPtr, IRB.getInt8PtrTy()),
3125  IRB.CreatePointerCast(SrcPtr, IRB.getInt8PtrTy()),
3126  IRB.CreateIntCast(Size, DFSF.DFS.IntptrTy, false)});
3127 }
3128 
3129 void DFSanVisitor::visitLibAtomicExchange(CallBase &CB) {
3130  // void __atomic_exchange(size_t size, void *ptr, void *val, void *ret, int
3131  // ordering)
3132  IRBuilder<> IRB(&CB);
3133  Value *Size = CB.getArgOperand(0);
3134  Value *TargetPtr = CB.getArgOperand(1);
3135  Value *SrcPtr = CB.getArgOperand(2);
3136  Value *DstPtr = CB.getArgOperand(3);
3137 
3138  // This operation is not atomic for the shadow and origin memory.
3139  // This could result in DFSan false positives or false negatives.
3140  // For now we will assume these operations are rare, and
3141  // the additional complexity to address this is not warrented.
3142 
3143  // Current Target to Dest
3144  IRB.CreateCall(DFSF.DFS.DFSanMemShadowOriginTransferFn,
3145  {IRB.CreatePointerCast(DstPtr, IRB.getInt8PtrTy()),
3146  IRB.CreatePointerCast(TargetPtr, IRB.getInt8PtrTy()),
3147  IRB.CreateIntCast(Size, DFSF.DFS.IntptrTy, false)});
3148 
3149  // Current Src to Target (overriding)
3150  IRB.CreateCall(DFSF.DFS.DFSanMemShadowOriginTransferFn,
3151  {IRB.CreatePointerCast(TargetPtr, IRB.getInt8PtrTy()),
3152  IRB.CreatePointerCast(SrcPtr, IRB.getInt8PtrTy()),
3153  IRB.CreateIntCast(Size, DFSF.DFS.IntptrTy, false)});
3154 }
3155 
3156 void DFSanVisitor::visitLibAtomicCompareExchange(CallBase &CB) {
3157  // bool __atomic_compare_exchange(size_t size, void *ptr, void *expected, void
3158  // *desired, int success_order, int failure_order)
3159  Value *Size = CB.getArgOperand(0);
3160  Value *TargetPtr = CB.getArgOperand(1);
3161  Value *ExpectedPtr = CB.getArgOperand(2);
3162  Value *DesiredPtr = CB.getArgOperand(3);
3163 
3164  // This operation is not atomic for the shadow and origin memory.
3165  // This could result in DFSan false positives or false negatives.
3166  // For now we will assume these operations are rare, and
3167  // the additional complexity to address this is not warrented.
3168 
3169  IRBuilder<> NextIRB(CB.getNextNode());
3170  NextIRB.SetCurrentDebugLocation(CB.getDebugLoc());
3171 
3172  DFSF.setShadow(&CB, DFSF.DFS.getZeroShadow(&CB));
3173 
3174  // If original call returned true, copy Desired to Target.
3175  // If original call returned false, copy Target to Expected.
3176  NextIRB.CreateCall(
3177  DFSF.DFS.DFSanMemShadowOriginConditionalExchangeFn,
3178  {NextIRB.CreateIntCast(&CB, NextIRB.getInt8Ty(), false),
3179  NextIRB.CreatePointerCast(TargetPtr, NextIRB.getInt8PtrTy()),
3180  NextIRB.CreatePointerCast(ExpectedPtr, NextIRB.getInt8PtrTy()),
3181  NextIRB.CreatePointerCast(DesiredPtr, NextIRB.getInt8PtrTy()),
3182  NextIRB.CreateIntCast(Size, DFSF.DFS.IntptrTy, false)});
3183 }
3184 
3185 void DFSanVisitor::visitCallBase(CallBase &CB) {
3186  Function *F = CB.getCalledFunction();
3187  if ((F && F->isIntrinsic()) || CB.isInlineAsm()) {
3188  visitInstOperands(CB);
3189  return;
3190  }
3191 
3192  // Calls to this function are synthesized in wrappers, and we shouldn't
3193  // instrument them.
3194  if (F == DFSF.DFS.DFSanVarargWrapperFn.getCallee()->stripPointerCasts())
3195  return;
3196 
3197  LibFunc LF;
3198  if (DFSF.TLI.getLibFunc(CB, LF)) {
3199  // libatomic.a functions need to have special handling because there isn't
3200  // a good way to intercept them or compile the library with
3201  // instrumentation.
3202  switch (LF) {
3203  case LibFunc_atomic_load:
3204  if (!isa<CallInst>(CB)) {
3205  llvm::errs() << "DFSAN -- cannot instrument invoke of libatomic load. "
3206  "Ignoring!\n";
3207  break;
3208  }
3209  visitLibAtomicLoad(CB);
3210  return;
3211  case LibFunc_atomic_store:
3212  visitLibAtomicStore(CB);
3213  return;
3214  default:
3215  break;
3216  }
3217  }
3218 
3219  // TODO: These are not supported by TLI? They are not in the enum.
3220  if (F && F->hasName() && !F->isVarArg()) {
3221  if (F->getName() == "__atomic_exchange") {
3222  visitLibAtomicExchange(CB);
3223  return;
3224  }
3225  if (F->getName() == "__atomic_compare_exchange") {
3226  visitLibAtomicCompareExchange(CB);
3227  return;
3228  }
3229  }
3230 
3232  DFSF.DFS.UnwrappedFnMap.find(CB.getCalledOperand());
3233  if (UnwrappedFnIt != DFSF.DFS.UnwrappedFnMap.end())
3234  if (visitWrappedCallBase(*UnwrappedFnIt->second, CB))
3235  return;
3236 
3237  IRBuilder<> IRB(&CB);
3238 
3239  const bool ShouldTrackOrigins = DFSF.DFS.shouldTrackOrigins();
3240  FunctionType *FT = CB.getFunctionType();
3241  const DataLayout &DL = getDataLayout();
3242 
3243  // Stores argument shadows.
3244  unsigned ArgOffset = 0;
3245  for (unsigned I = 0, N = FT->getNumParams(); I != N; ++I) {
3246  if (ShouldTrackOrigins) {
3247  // Ignore overflowed origins
3248  Value *ArgShadow = DFSF.getShadow(CB.getArgOperand(I));
3249  if (I < DFSF.DFS.NumOfElementsInArgOrgTLS &&
3250  !DFSF.DFS.isZeroShadow(ArgShadow))
3251  IRB.CreateStore(DFSF.getOrigin(CB.getArgOperand(I)),
3252  DFSF.getArgOriginTLS(I, IRB));
3253  }
3254 
3255  unsigned Size =
3256  DL.getTypeAllocSize(DFSF.DFS.getShadowTy(FT->getParamType(I)));
3257  // Stop storing if arguments' size overflows. Inside a function, arguments
3258  // after overflow have zero shadow values.
3259  if (ArgOffset + Size > ArgTLSSize)
3260  break;
3261  IRB.CreateAlignedStore(DFSF.getShadow(CB.getArgOperand(I)),
3262  DFSF.getArgTLS(FT->getParamType(I), ArgOffset, IRB),
3264  ArgOffset += alignTo(Size, ShadowTLSAlignment);
3265  }
3266 
3267  Instruction *Next = nullptr;
3268  if (!CB.getType()->isVoidTy()) {
3269  if (InvokeInst *II = dyn_cast<InvokeInst>(&CB)) {
3270  if (II->getNormalDest()->getSinglePredecessor()) {
3271  Next = &II->getNormalDest()->front();
3272  } else {
3273  BasicBlock *NewBB =
3274  SplitEdge(II->getParent(), II->getNormalDest(), &DFSF.DT);
3275  Next = &NewBB->front();
3276  }
3277  } else {
3278  assert(CB.getIterator() != CB.getParent()->end());
3279  Next = CB.getNextNode();
3280  }
3281 
3282  // Don't emit the epilogue for musttail call returns.
3283  if (isa<CallInst>(CB) && cast<CallInst>(CB).isMustTailCall())
3284  return;
3285 
3286  // Loads the return value shadow.
3287  IRBuilder<> NextIRB(Next);
3288  unsigned Size = DL.getTypeAllocSize(DFSF.DFS.getShadowTy(&CB));
3289  if (Size > RetvalTLSSize) {
3290  // Set overflowed return shadow to be zero.
3291  DFSF.setShadow(&CB, DFSF.DFS.getZeroShadow(&CB));
3292  } else {
3293  LoadInst *LI = NextIRB.CreateAlignedLoad(
3294  DFSF.DFS.getShadowTy(&CB), DFSF.getRetvalTLS(CB.getType(), NextIRB),
3295  ShadowTLSAlignment, "_dfsret");
3296  DFSF.SkipInsts.insert(LI);
3297  DFSF.setShadow(&CB, LI);
3298  DFSF.NonZeroChecks.push_back(LI);
3299  }
3300 
3301  if (ShouldTrackOrigins) {
3302  LoadInst *LI = NextIRB.CreateLoad(DFSF.DFS.OriginTy,
3303  DFSF.getRetvalOriginTLS(), "_dfsret_o");
3304  DFSF.SkipInsts.insert(LI);
3305  DFSF.setOrigin(&CB, LI);
3306  }
3307  }
3308 }
3309 
3310 void DFSanVisitor::visitPHINode(PHINode &PN) {
3311  Type *ShadowTy = DFSF.DFS.getShadowTy(&PN);
3312  PHINode *ShadowPN =
3313  PHINode::Create(ShadowTy, PN.getNumIncomingValues(), "", &PN);
3314 
3315  // Give the shadow phi node valid predecessors to fool SplitEdge into working.
3316  Value *UndefShadow = UndefValue::get(ShadowTy);
3317  for (BasicBlock *BB : PN.blocks())
3318  ShadowPN->addIncoming(UndefShadow, BB);
3319 
3320  DFSF.setShadow(&PN, ShadowPN);
3321 
3322  PHINode *OriginPN = nullptr;
3323  if (DFSF.DFS.shouldTrackOrigins()) {
3324  OriginPN =
3325  PHINode::Create(DFSF.DFS.OriginTy, PN.getNumIncomingValues(), "", &PN);
3326  Value *UndefOrigin = UndefValue::get(DFSF.DFS.OriginTy);
3327  for (BasicBlock *BB : PN.blocks())
3328  OriginPN->addIncoming(UndefOrigin, BB);
3329  DFSF.setOrigin(&PN, OriginPN);
3330  }
3331 
3332  DFSF.PHIFixups.push_back({&PN, ShadowPN, OriginPN});
3333 }
3334 
3336  ModuleAnalysisManager &AM) {
3337  auto GetTLI = [&](Function &F) -> TargetLibraryInfo & {
3338  auto &FAM =
3341  };
3342  if (!DataFlowSanitizer(ABIListFiles).runImpl(M, GetTLI))
3343  return PreservedAnalyses::all();
3344 
3346  // GlobalsAA is considered stateless and does not get invalidated unless
3347  // explicitly invalidated; PreservedAnalyses::none() is not enough. Sanitizers
3348  // make changes that require GlobalsAA to be invalidated.
3349  PA.abandon<GlobalsAA>();
3350  return PA;
3351 }
llvm::Check::Size
@ Size
Definition: FileCheck.h:77
llvm::GlobalsAA
Analysis pass providing a never-invalidated alias analysis result.
Definition: GlobalsModRef.h:127
ClABIListFiles
static cl::list< std::string > ClABIListFiles("dfsan-abilist", cl::desc("File listing native ABI functions and how the pass treats them"), cl::Hidden)
llvm::PreservedAnalyses
A set of analyses that are preserved following a run of a transformation pass.
Definition: PassManager.h:152
alignTo
static int alignTo(int Num, int PowOf2)
Definition: AArch64LoadStoreOptimizer.cpp:1204
Instrumentation.h
set
We currently generate a but we really shouldn eax ecx xorl edx divl ecx eax divl ecx movl eax ret A similar code sequence works for division We currently compile i32 v2 eax eax jo LBB1_2 atomic and others It is also currently not done for read modify write instructions It is also current not done if the OF or CF flags are needed The shift operators have the complication that when the shift count is EFLAGS is not set
Definition: README.txt:1277
llvm::Instruction::isTerminator
bool isTerminator() const
Definition: Instruction.h:167
llvm::Argument
This class represents an incoming formal argument to a Function.
Definition: Argument.h:28
llvm::IRBuilderBase::CreateIntCast
Value * CreateIntCast(Value *V, Type *DestTy, bool isSigned, const Twine &Name="")
Definition: IRBuilder.h:2054
llvm::BasicBlock::end
iterator end()
Definition: BasicBlock.h:308
llvm::Type::isSized
bool isSized(SmallPtrSetImpl< Type * > *Visited=nullptr) const
Return true if it makes sense to take the size of this type.
Definition: Type.h:283
llvm::IRBuilderBase::CreateStore
StoreInst * CreateStore(Value *Val, Value *Ptr, bool isVolatile=false)
Definition: IRBuilder.h:1695
llvm
This is an optimization pass for GlobalISel generic memory operations.
Definition: AddressRanges.h:18
M
We currently emits eax Perhaps this is what we really should generate is Is imull three or four cycles eax eax The current instruction priority is based on pattern complexity The former is more complex because it folds a load so the latter will not be emitted Perhaps we should use AddedComplexity to give LEA32r a higher priority We should always try to match LEA first since the LEA matching code does some estimate to determine whether the match is profitable if we care more about code then imull is better It s two bytes shorter than movl leal On a Pentium M
Definition: README.txt:252
llvm::Instruction::getModule
const Module * getModule() const
Return the module owning the function this instruction belongs to or nullptr it the function does not...
Definition: Instruction.cpp:69
llvm::AArch64CC::AL
@ AL
Definition: AArch64BaseInfo.h:269
llvm::IRBuilderBase::getInt64Ty
IntegerType * getInt64Ty()
Fetch the type representing a 64-bit integer.
Definition: IRBuilder.h:514
llvm::drop_begin
auto drop_begin(T &&RangeOrContainer, size_t N=1)
Return a range covering RangeOrContainer with the first N elements excluded.
Definition: STLExtras.h:387
llvm::ReturnInst
Return a value (possibly void), from a function.
Definition: Instructions.h:3052
llvm::IRBuilderBase::CreateAlignedStore
StoreInst * CreateAlignedStore(Value *Val, Value *Ptr, MaybeAlign Align, bool isVolatile=false)
Definition: IRBuilder.h:1718
llvm::StructType::get
static StructType * get(LLVMContext &Context, ArrayRef< Type * > Elements, bool isPacked=false)
This static method is the primary way to create a literal StructType.
Definition: Type.cpp:406
RetvalTLSSize
static const unsigned RetvalTLSSize
Definition: DataFlowSanitizer.cpp:131
llvm::DataLayout
A parsed version of the target data layout string in and methods for querying it.
Definition: DataLayout.h:113
llvm::IRBuilderBase::CreateExtractValue
Value * CreateExtractValue(Value *Agg, ArrayRef< unsigned > Idxs, const Twine &Name="")
Definition: IRBuilder.h:2372
ClConditionalCallbacks
static cl::opt< bool > ClConditionalCallbacks("dfsan-conditional-callbacks", cl::desc("Insert calls to callback functions on conditionals."), cl::Hidden, cl::init(false))
llvm::Type::getInt8PtrTy
static PointerType * getInt8PtrTy(LLVMContext &C, unsigned AS=0)
Definition: Type.cpp:291
IntrinsicInst.h
llvm::Type::isPointerTy
bool isPointerTy() const
True if this is an instance of PointerType.
Definition: Type.h:237
llvm::AnalysisManager::getResult
PassT::Result & getResult(IRUnitT &IR, ExtraArgTs... ExtraArgs)
Get the result of an analysis pass for a given IR unit.
Definition: PassManager.h:774
llvm::GlobalValue::getLinkage
LinkageTypes getLinkage() const
Definition: GlobalValue.h:541
llvm::Function::removeFnAttrs
void removeFnAttrs(const AttributeMask &Attrs)
Definition: Function.cpp:595
llvm::ExtractElementInst
This instruction extracts a single (scalar) element from a VectorType value.
Definition: Instructions.h:1872
llvm::MemTransferInst
This class wraps the llvm.memcpy/memmove intrinsics.
Definition: IntrinsicInst.h:1106
llvm::Function
Definition: Function.h:60
StringRef.h
P
This currently compiles esp xmm0 movsd esp eax eax esp ret We should use not the dag combiner This is because dagcombine2 needs to be able to see through the X86ISD::Wrapper which DAGCombine can t really do The code for turning x load into a single vector load is target independent and should be moved to the dag combiner The code for turning x load into a vector load can only handle a direct load from a global or a direct load from the stack It should be generalized to handle any load from P
Definition: README-SSE.txt:411
Pass.h
llvm::CallBase::setCalledFunction
void setCalledFunction(Function *Fn)
Sets the function called, including updating the function type.
Definition: InstrTypes.h:1436
llvm::BitCastInst
This class represents a no-op cast from one type to another.
Definition: Instructions.h:5256
llvm::IRBuilderBase::CreateXor
Value * CreateXor(Value *LHS, Value *RHS, const Twine &Name="")
Definition: IRBuilder.h:1425
llvm::ReturnInst::getReturnValue
Value * getReturnValue() const
Convenience accessor. Returns null if there is no return value.
Definition: Instructions.h:3097
llvm::ilist_node_with_parent::getNextNode
NodeTy * getNextNode()
Get the next node, or nullptr for the list tail.
Definition: ilist_node.h:289
llvm::SmallVector
This is a 'vector' (really, a variable-sized array), optimized for the case when the array is small.
Definition: SmallVector.h:1199
llvm::LandingPadInst
The landingpad instruction holds all of the information necessary to generate correct exception handl...
Definition: Instructions.h:2951
llvm::CallBase::isInlineAsm
bool isInlineAsm() const
Check if this call is an inline asm statement.
Definition: InstrTypes.h:1465
llvm::Value::hasName
bool hasName() const
Definition: Value.h:261
ErrorHandling.h
llvm::IRBuilder<>
llvm::GlobalVariable
Definition: GlobalVariable.h:39
llvm::IRBuilderBase::CreateStructGEP
Value * CreateStructGEP(Type *Ty, Value *Ptr, unsigned Idx, const Twine &Name="")
Definition: IRBuilder.h:1865
llvm::FunctionType::get
static FunctionType * get(Type *Result, ArrayRef< Type * > Params, bool isVarArg)
This static method is the primary way of constructing a FunctionType.
Definition: Type.cpp:361
llvm::GlobalAlias
Definition: GlobalAlias.h:28
ValueTracking.h
Local.h
llvm::AttributeList::get
static AttributeList get(LLVMContext &C, ArrayRef< std::pair< unsigned, Attribute >> Attrs)
Create an AttributeList with the specified parameters in it.
Definition: Attributes.cpp:1131
llvm::IRBuilderBase::CreateOr
Value * CreateOr(Value *LHS, Value *RHS, const Twine &Name="")
Definition: IRBuilder.h:1403
llvm::Module::getModuleInlineAsm
const std::string & getModuleInlineAsm() const
Get any module-scope inline assembly blocks.
Definition: Module.h:266
llvm::PreservedAnalyses::abandon
void abandon()
Mark an analysis as abandoned.
Definition: PassManager.h:206
llvm::DominatorTree
Concrete subclass of DominatorTreeBase that is used to compute a normal dominator tree.
Definition: Dominators.h:166
llvm::Triple
Triple - Helper class for working with autoconf configuration names.
Definition: Triple.h:44
FAM
FunctionAnalysisManager FAM
Definition: PassBuilderBindings.cpp:59
GlobalsModRef.h
llvm::cl::Hidden
@ Hidden
Definition: CommandLine.h:140
llvm::PreservedAnalyses::none
static PreservedAnalyses none()
Convenience factory function for the empty preserved set.
Definition: PassManager.h:155
Linux_X86_64_MemoryMapParams
static const MemoryMapParams Linux_X86_64_MemoryMapParams
Definition: DataFlowSanitizer.cpp:285
llvm::Type
The instances of the Type class are immutable: once they are created, they are never changed.
Definition: Type.h:45
DenseMap.h
llvm::removeUnreachableBlocks
bool removeUnreachableBlocks(Function &F, DomTreeUpdater *DTU=nullptr, MemorySSAUpdater *MSSAU=nullptr)
Remove all blocks that can not be reached from the function's entry.
Definition: Local.cpp:2581
Module.h
llvm::Triple::x86_64
@ x86_64
Definition: Triple.h:86
llvm::AttributeList
Definition: Attributes.h:430
llvm::AttributeMask
Definition: Attributes.h:977
llvm::CallBase::getAttributes
AttributeList getAttributes() const
Return the parameter attributes for this call.
Definition: InstrTypes.h:1475
llvm::CallBase::getFunctionType
FunctionType * getFunctionType() const
Definition: InstrTypes.h:1255
llvm::AttributeList::getFnAttrs
AttributeSet getFnAttrs() const
The function attributes are returned.
Definition: Attributes.cpp:1469
addAcquireOrdering
static AtomicOrdering addAcquireOrdering(AtomicOrdering AO)
Definition: DataFlowSanitizer.cpp:2214
llvm::DenseMapBase< DenseMap< KeyT, ValueT, DenseMapInfo< KeyT >, llvm::detail::DenseMapPair< KeyT, ValueT > >, KeyT, ValueT, DenseMapInfo< KeyT >, llvm::detail::DenseMapPair< KeyT, ValueT > >::count
size_type count(const_arg_type_t< KeyT > Val) const
Return 1 if the specified key is in the map, 0 otherwise.
Definition: DenseMap.h:145
T
#define T
Definition: Mips16ISelLowering.cpp:341
Offset
uint64_t Offset
Definition: ELFObjHandler.cpp:80
llvm::Module::getOrInsertFunction
FunctionCallee getOrInsertFunction(StringRef Name, FunctionType *T, AttributeList AttributeList)
Look up the specified function in the module symbol table.
Definition: Module.cpp:145
llvm::SmallPtrSet< Value *, 16 >
isMustTailCall
static bool isMustTailCall(Value *V)
Definition: InstructionCombining.cpp:3097
llvm::IRBuilderBase::CreateInsertElement
Value * CreateInsertElement(Type *VecTy, Value *NewElt, Value *Idx, const Twine &Name="")
Definition: IRBuilder.h:2328
llvm::max
Expected< ExpressionValue > max(const ExpressionValue &Lhs, const ExpressionValue &Rhs)
Definition: FileCheck.cpp:337
llvm::errs
raw_fd_ostream & errs()
This returns a reference to a raw_ostream for standard error.
Definition: raw_ostream.cpp:891
llvm::StringSet::insert
std::pair< typename Base::iterator, bool > insert(StringRef key)
Definition: StringSet.h:34
llvm::FunctionType::getNumParams
unsigned getNumParams() const
Return the number of fixed parameters this function type requires.
Definition: DerivedTypes.h:139
llvm::CallBase::arg_begin
User::op_iterator arg_begin()
Return the iterator pointing to the beginning of the argument list.
Definition: InstrTypes.h:1317
addReleaseOrdering
static AtomicOrdering addReleaseOrdering(AtomicOrdering AO)
Definition: DataFlowSanitizer.cpp:2499
llvm::GlobalValue::LinkageTypes
LinkageTypes
An enumeration for the kinds of linkage for global values.
Definition: GlobalValue.h:47
llvm::ArrayType
Class to represent array types.
Definition: DerivedTypes.h:357
llvm::LoadInst::getPointerOperand
Value * getPointerOperand()
Definition: Instructions.h:261
llvm::IRBuilderBase::CreateAlignedLoad
LoadInst * CreateAlignedLoad(Type *Ty, Value *Ptr, MaybeAlign Align, const char *Name)
Definition: IRBuilder.h:1699
llvm::UnaryOperator
Definition: InstrTypes.h:102
llvm::IRBuilderBase::CreateGlobalStringPtr
Constant * CreateGlobalStringPtr(StringRef Str, const Twine &Name="", unsigned AddressSpace=0, Module *M=nullptr)
Same as CreateGlobalString, but return a pointer with "i8*" type instead of a pointer to array of i8.
Definition: IRBuilder.h:1875
llvm::CallBase::addParamAttr
void addParamAttr(unsigned ArgNo, Attribute::AttrKind Kind)
Adds the attribute to the indicated argument.
Definition: InstrTypes.h:1527
llvm::LoadInst::getAlign
Align getAlign() const
Return the alignment of the access that is being performed.
Definition: Instructions.h:217
DataFlowSanitizer.h
llvm::IRBuilderBase::CreateAlloca
AllocaInst * CreateAlloca(Type *Ty, unsigned AddrSpace, Value *ArraySize=nullptr, const Twine &Name="")
Definition: IRBuilder.h:1665
getGlobalTypeString
static StringRef getGlobalTypeString(const GlobalValue &G)
Definition: DataFlowSanitizer.cpp:257
llvm::Type::getInt32Ty
static IntegerType * getInt32Ty(LLVMContext &C)
Definition: Type.cpp:239
llvm::IRBuilderBase::CreateIntToPtr
Value * CreateIntToPtr(Value *V, Type *DestTy, const Twine &Name="")
Definition: IRBuilder.h:1980
DepthFirstIterator.h
F
#define F(x, y, z)
Definition: MD5.cpp:55
llvm::FunctionType::isVarArg
bool isVarArg() const
Definition: DerivedTypes.h:123
llvm::BasicBlock
LLVM Basic Block Representation.
Definition: BasicBlock.h:55
llvm::DominatorTree::dominates
bool dominates(const BasicBlock *BB, const Use &U) const
Return true if the (end of the) basic block BB dominates the use U.
Definition: Dominators.cpp:122
llvm::BitmaskEnumDetail::Mask
constexpr std::underlying_type_t< E > Mask()
Get a bitmask with 1s in all places up to the high-order bit of E's largest value.
Definition: BitmaskEnum.h:80
Instruction.h
CommandLine.h
llvm::IRBuilderBase::CreateInsertValue
Value * CreateInsertValue(Value *Agg, Value *Val, ArrayRef< unsigned > Idxs, const Twine &Name="")
Definition: IRBuilder.h:2379
llvm::ConstantInt
This is the shared class of boolean and integer constants.
Definition: Constants.h:79
ClEventCallbacks
static cl::opt< bool > ClEventCallbacks("dfsan-event-callbacks", cl::desc("Insert calls to __dfsan_*_callback functions on data events."), cl::Hidden, cl::init(false))
llvm::IRBuilderBase::CreateMul
Value * CreateMul(Value *LHS, Value *RHS, const Twine &Name="", bool HasNUW=false, bool HasNSW=false)
Definition: IRBuilder.h:1267
GlobalValue.h
Constants.h
llvm::Constant::isNullValue
bool isNullValue() const
Return true if this is the value that would be returned by getNullValue.
Definition: Constants.cpp:76
E
static GCRegistry::Add< CoreCLRGC > E("coreclr", "CoreCLR-compatible GC")
llvm::IRBuilderBase::CreateGEP
Value * CreateGEP(Type *Ty, Value *Ptr, ArrayRef< Value * > IdxList, const Twine &Name="", bool IsInBounds=false)
Definition: IRBuilder.h:1758
llvm::User
Definition: User.h:44
llvm::LibFunc
LibFunc
Definition: TargetLibraryInfo.h:36
C
(vector float) vec_cmpeq(*A, *B) C
Definition: README_ALTIVEC.txt:86
llvm::Instruction::isAtomic
bool isAtomic() const LLVM_READONLY
Return true if this instruction has an AtomicOrdering of unordered or higher.
Definition: Instruction.cpp:646
InstrTypes.h
llvm::CallBase::getCalledFunction
Function * getCalledFunction() const
Returns the function called, or null if this is an indirect function invocation or the function signa...
Definition: InstrTypes.h:1397
int
Clang compiles this i1 i64 store i64 i64 store i64 i64 store i64 i64 store i64 align Which gets codegen d xmm0 movaps rbp movaps rbp movaps rbp movaps rbp rbp rbp rbp rbp It would be better to have movq s of instead of the movaps s LLVM produces ret int
Definition: README.txt:536
llvm::CallBase::setAttributes
void setAttributes(AttributeList A)
Set the parameter attributes for this call.
Definition: InstrTypes.h:1479
llvm::IRBuilderBase::CreateLoad
LoadInst * CreateLoad(Type *Ty, Value *Ptr, const char *Name)
Provided to resolve 'CreateLoad(Ty, Ptr, "...")' correctly, instead of converting the string to 'bool...
Definition: IRBuilder.h:1682
llvm::MDBuilder::createBranchWeights
MDNode * createBranchWeights(uint32_t TrueWeight, uint32_t FalseWeight)
Return metadata containing two branch weights.
Definition: MDBuilder.cpp:37
llvm::Attribute::getWithMemoryEffects
static Attribute getWithMemoryEffects(LLVMContext &Context, MemoryEffects ME)
Definition: Attributes.cpp:214
llvm::CallInst::Create
static CallInst * Create(FunctionType *Ty, Value *F, const Twine &NameStr="", Instruction *InsertBefore=nullptr)
Definition: Instructions.h:1517
SI
@ SI
Definition: SIInstrInfo.cpp:7882
MinOriginAlignment
static const Align MinOriginAlignment
Definition: DataFlowSanitizer.cpp:126
llvm::AMDGPU::PALMD::Key
Key
PAL metadata keys.
Definition: AMDGPUMetadata.h:486
TargetLibraryInfo.h
llvm::Function::removeRetAttrs
void removeRetAttrs(const AttributeMask &Attrs)
removes the attributes from the return value list of attributes.
Definition: Function.cpp:607
llvm::InsertElementInst
This instruction inserts a single (scalar) element into a VectorType value.
Definition: Instructions.h:1936
DenseSet.h
llvm::IntegerType
Class to represent integer types.
Definition: DerivedTypes.h:40
llvm::Instruction
Definition: Instruction.h:42
MDBuilder.h
llvm::IRBuilderBase::getContext
LLVMContext & getContext() const
Definition: IRBuilder.h:175
llvm::report_fatal_error
void report_fatal_error(Error Err, bool gen_crash_diag=true)
Report a serious error, calling any installed error handler.
Definition: Error.cpp:145
llvm::Function::copyAttributesFrom
void copyAttributesFrom(const Function *Src)
copyAttributesFrom - copy all additional attributes (those not needed to create a Function) from the ...
Definition: Function.cpp:715
llvm::Value::setName
void setName(const Twine &Name)
Change the name of the value.
Definition: Value.cpp:375
llvm::Module::getOrInsertGlobal
Constant * getOrInsertGlobal(StringRef Name, Type *Ty, function_ref< GlobalVariable *()> CreateGlobalCallback)
Look up the specified global in the module symbol table.
Definition: Module.cpp:206
llvm::UndefValue::get
static UndefValue * get(Type *T)
Static factory methods - Return an 'undef' object of the specified type.
Definition: Constants.cpp:1713
llvm::ConstantInt::get
static Constant * get(Type *Ty, uint64_t V, bool IsSigned=false)
If Ty is a vector type, return a Constant with a splat of the given value.
Definition: Constants.cpp:879
SmallPtrSet.h
llvm::Module::setModuleInlineAsm
void setModuleInlineAsm(StringRef Asm)
Set the module-scope inline assembly blocks.
Definition: Module.h:305
Align
uint64_t Align
Definition: ELFObjHandler.cpp:82
ClInstrumentWithCallThreshold
static cl::opt< int > ClInstrumentWithCallThreshold("dfsan-instrument-with-call-threshold", cl::desc("If the function being instrumented requires more than " "this number of origin stores, use callbacks instead of " "inline checks (-1 means never use callbacks)."), cl::Hidden, cl::init(3500))
llvm::Align
This struct is a compact representation of a valid (non-zero power of two) alignment.
Definition: Alignment.h:39
llvm::MCID::Call
@ Call
Definition: MCInstrDesc.h:155
llvm::CallBase::getCallingConv
CallingConv::ID getCallingConv() const
Definition: InstrTypes.h:1456
llvm::PHINode::getNumIncomingValues
unsigned getNumIncomingValues() const
Return the number of incoming edges.
Definition: Instructions.h:2791
llvm::Type::getIntegerBitWidth
unsigned getIntegerBitWidth() const
Definition: DerivedTypes.h:97
llvm::MemoryEffects::readOnly
static MemoryEffects readOnly()
Create MemoryEffects that can read any memory.
Definition: ModRef.h:123
llvm::erase_value
void erase_value(Container &C, ValueType V)
Wrapper function to remove a value from a container:
Definition: STLExtras.h:1980
Type.h
llvm::IRBuilderBase::CreateAnd
Value * CreateAnd(Value *LHS, Value *RHS, const Twine &Name="")
Definition: IRBuilder.h:1381
llvm::MemSetInst
This class wraps the llvm.memset and llvm.memset.inline intrinsics.
Definition: IntrinsicInst.h:1073
llvm::IRBuilderBase::CreatePointerCast
Value * CreatePointerCast(Value *V, Type *DestTy, const Twine &Name="")
Definition: IRBuilder.h:2031
llvm::dxil::PointerTypeAnalysis::run
PointerTypeMap run(const Module &M)
Compute the PointerTypeMap for the module M.
Definition: PointerTypeAnalysis.cpp:189
llvm::InvokeInst
Invoke instruction.
Definition: Instructions.h:3811
llvm::ARM_PROC::IE
@ IE
Definition: ARMBaseInfo.h:27
llvm::CmpInst
This class is the base class for the comparison instructions.
Definition: InstrTypes.h:710
llvm::Type::isIntegerTy
bool isIntegerTy() const
True if this is an instance of IntegerType.
Definition: Type.h:210
llvm::function_ref
An efficient, type-erasing, non-owning reference to a callable.
Definition: STLFunctionalExtras.h:36
G
const DataFlowGraph & G
Definition: RDFGraph.cpp:200
llvm::DenseSet
Implements a dense probed hash-table based set.
Definition: DenseSet.h:268
llvm::pointer_iterator
Definition: iterator.h:344
llvm::AtomicOrdering
AtomicOrdering
Atomic ordering for LLVM's memory model.
Definition: AtomicOrdering.h:56
BasicBlock.h
llvm::cl::opt< bool >
llvm::RISCVFenceField::O
@ O
Definition: RISCVBaseInfo.h:264
llvm::IRBuilderBase::CreateBitCast
Value * CreateBitCast(Value *V, Type *DestTy, const Twine &Name="")
Definition: IRBuilder.h:1985
llvm::StoreInst
An instruction for storing to memory.
Definition: Instructions.h:298
llvm::GlobalValue
Definition: GlobalValue.h:44
llvm::AttributeList::getRetAttrs
AttributeSet getRetAttrs() const
The attributes for the ret value are returned.
Definition: Attributes.cpp:1465
llvm::Constant
This is an important base class in LLVM.
Definition: Constant.h:41
llvm::IRBuilderBase::GetInsertPoint
BasicBlock::iterator GetInsertPoint() const
Definition: IRBuilder.h:174
llvm::vfs::getRealFileSystem
IntrusiveRefCntPtr< FileSystem > getRealFileSystem()
Gets an vfs::FileSystem for the 'real' file system, as seen by the operating system.
Definition: VirtualFileSystem.cpp:377
llvm::Instruction::eraseFromParent
SymbolTableList< Instruction >::iterator eraseFromParent()
This method unlinks 'this' from the containing basic block and deletes it.
Definition: Instruction.cpp:81
llvm::PointerType::getUnqual
static PointerType * getUnqual(Type *ElementType)
This constructs a pointer to an object of the specified type in the default address space (address sp...
Definition: DerivedTypes.h:651
uint64_t
llvm::GlobalValue::getParent
Module * getParent()
Get the module that this global value is contained inside of...
Definition: GlobalValue.h:652
llvm::LoadInst::setOrdering
void setOrdering(AtomicOrdering Ordering)
Sets the ordering constraint of this load instruction.
Definition: Instructions.h:231
llvm::ARM_MB::ST
@ ST
Definition: ARMBaseInfo.h:73
Addr
uint64_t Addr
Definition: ELFObjHandler.cpp:79
llvm::PHINode::addIncoming
void addIncoming(Value *V, BasicBlock *BB)
Add an incoming value to the end of the PHI list.
Definition: Instructions.h:2849
move
compiles ldr LCPI1_0 ldr ldr mov lsr tst moveq r1 ldr LCPI1_1 and r0 bx lr It would be better to do something like to fold the shift into the conditional move
Definition: README.txt:546
llvm::LLVMContext
This is an important class for using LLVM in a threaded context.
Definition: LLVMContext.h:67
isConstant
static bool isConstant(const MachineInstr &MI)
Definition: AMDGPUInstructionSelector.cpp:2605
llvm::assumeAligned
Align assumeAligned(uint64_t Value)
Treats the value 0 as a 1, so Align is always at least 1.
Definition: Alignment.h:111
llvm::DenseMap
Definition: DenseMap.h:714
llvm::logicalview::LVPrintKind::Elements
@ Elements
llvm::Triple::Linux
@ Linux
Definition: Triple.h:195
iterator.h
I
#define I(x, y, z)
Definition: MD5.cpp:58
llvm::FunctionType::getParamType
Type * getParamType(unsigned i) const
Parameter type accessors.
Definition: DerivedTypes.h:135
llvm::IRBuilderBase::getInt8PtrTy
PointerType * getInt8PtrTy(unsigned AddrSpace=0)
Fetch the type representing a pointer to an 8-bit integer value.
Definition: IRBuilder.h:557
llvm::GetElementPtrInst
an instruction for type-safe pointer arithmetic to access elements of arrays and structs
Definition: Instructions.h:929
llvm::LoadInst::setAlignment
void setAlignment(Align Align)
Definition: Instructions.h:221
llvm::cl::init
initializer< Ty > init(const Ty &Val)
Definition: CommandLine.h:447
llvm::make_early_inc_range
iterator_range< early_inc_iterator_impl< detail::IterOfRange< RangeT > > > make_early_inc_range(RangeT &&Range)
Make a range that does early increment to allow mutation of the underlying range without disrupting i...
Definition: STLExtras.h:716
llvm::IRBuilderBase::CreateSelect
Value * CreateSelect(Value *C, Value *True, Value *False, const Twine &Name="", Instruction *MDFrom=nullptr)
Definition: IRBuilder.cpp:1123
llvm::PointerType
Class to represent pointers.
Definition: DerivedTypes.h:632
llvm::CallBase::addRetAttr
void addRetAttr(Attribute::AttrKind Kind)
Adds the attribute to the return value.
Definition: InstrTypes.h:1517
llvm::IRBuilderBase::CreateAdd
Value * CreateAdd(Value *LHS, Value *RHS, const Twine &Name="", bool HasNUW=false, bool HasNSW=false)
Definition: IRBuilder.h:1233
llvm::SpecialCaseList::createOrDie
static std::unique_ptr< SpecialCaseList > createOrDie(const std::vector< std::string > &Paths, llvm::vfs::FileSystem &FS)
Parses the special case list entries from files.
Definition: SpecialCaseList.cpp:90
llvm::DenseMapBase< DenseMap< KeyT, ValueT, DenseMapInfo< KeyT >, llvm::detail::DenseMapPair< KeyT, ValueT > >, KeyT, ValueT, DenseMapInfo< KeyT >, llvm::detail::DenseMapPair< KeyT, ValueT > >::find
iterator find(const_arg_type_t< KeyT > Val)
Definition: DenseMap.h:150
llvm::Function::Create
static Function * Create(FunctionType *Ty, LinkageTypes Linkage, unsigned AddrSpace, const Twine &N="", Module *M=nullptr)
Definition: Function.h:137
IRBuilder.h
assert
assert(ImpDefSCC.getReg()==AMDGPU::SCC &&ImpDefSCC.isDef())
std::swap
void swap(llvm::BitVector &LHS, llvm::BitVector &RHS)
Implement std::swap in terms of BitVector swap.
Definition: BitVector.h:853
llvm::IRBuilderBase::CreateExtractElement
Value * CreateExtractElement(Value *Vec, Value *Idx, const Twine &Name="")
Definition: IRBuilder.h:2316
Ptr
@ Ptr
Definition: TargetLibraryInfo.cpp:60
llvm::SelectInst
This class represents the LLVM 'select' instruction.
Definition: Instructions.h:1737
llvm::Type::isVoidTy
bool isVoidTy() const
Return true if this is 'void'.
Definition: Type.h:139
llvm::SwitchInst::getCondition
Value * getCondition() const
Definition: Instructions.h:3482
llvm::WinEH::EncodingType::CE
@ CE
Windows NT (Windows on ARM)
llvm::ArrayType::get
static ArrayType * get(Type *ElementType, uint64_t NumElements)
This static method is the primary way to construct an ArrayType.
Definition: Type.cpp:638
ClDebugNonzeroLabels
static cl::opt< bool > ClDebugNonzeroLabels("dfsan-debug-nonzero-labels", cl::desc("Insert calls to __dfsan_nonzero_label on observing a parameter, " "load or return with a nonzero label"), cl::Hidden)
llvm::Module
A Module instance is used to store all the information related to an LLVM module.
Definition: Module.h:65
llvm::MDNode
Metadata node.
Definition: Metadata.h:944
getOpcode
static std::optional< unsigned > getOpcode(ArrayRef< VPValue * > Values)
Returns the opcode of Values or ~0 if they do not all agree.
Definition: VPlanSLP.cpp:191
llvm::CallBase::arg_end
User::op_iterator arg_end()
Return the iterator pointing to the end of the argument list.
Definition: InstrTypes.h:1323
llvm::SmallPtrSetImpl::count
size_type count(ConstPtrType Ptr) const
count - Return 1 if the specified pointer is in the set, 0 otherwise.
Definition: SmallPtrSet.h:383
Triple.h
llvm::DominatorTreeBase::recalculate
void recalculate(ParentType &Func)
recalculate - compute a dominator tree for the given function
Definition: GenericDomTree.h:778
llvm::StringSet
StringSet - A wrapper for StringMap that provides set-like functionality.
Definition: StringSet.h:23
llvm::BinaryOperator
Definition: InstrTypes.h:189
None.h
DataLayout.h
llvm::StructType
Class to represent struct types.
Definition: DerivedTypes.h:213
Cond
SmallVector< MachineOperand, 4 > Cond
Definition: BasicBlockSections.cpp:138
llvm::PHINode::blocks
iterator_range< block_iterator > blocks()
Definition: Instructions.h:2777
ClPreserveAlignment
static cl::opt< bool > ClPreserveAlignment("dfsan-preserve-alignment", cl::desc("respect alignment requirements provided by input IR"), cl::Hidden, cl::init(false))
llvm::StringRef
StringRef - Represent a constant reference to a string, i.e.
Definition: StringRef.h:50
InstVisitor.h
llvm::logicalview::LVAttributeKind::Zero
@ Zero
llvm_unreachable
#define llvm_unreachable(msg)
Marks that the current location is not supposed to be reachable.
Definition: ErrorHandling.h:143
llvm::Value::getType
Type * getType() const
All values are typed, get the type of this value.
Definition: Value.h:255
llvm::GlobalValue::WeakODRLinkage
@ WeakODRLinkage
Same, but only replaced by something equivalent.
Definition: GlobalValue.h:53
ClCombinePointerLabelsOnLoad
static cl::opt< bool > ClCombinePointerLabelsOnLoad("dfsan-combine-pointer-labels-on-load", cl::desc("Combine the label of the pointer with the label of the data when " "loading from memory."), cl::Hidden, cl::init(true))
llvm::Value::replaceAllUsesWith
void replaceAllUsesWith(Value *V)
Change all uses of this to point to a new Value.
Definition: Value.cpp:532
A
* A
Definition: README_ALTIVEC.txt:89
llvm::BasicBlock::Create
static BasicBlock * Create(LLVMContext &Context, const Twine &Name="", Function *Parent=nullptr, BasicBlock *InsertBefore=nullptr)
Creates a new BasicBlock.
Definition: BasicBlock.h:97
uint32_t
llvm::append_range
void append_range(Container &C, Range &&R)
Wrapper function to append a range to a container.
Definition: STLExtras.h:1988
llvm::Value::getContext
LLVMContext & getContext() const
All values hold a context through their type.
Definition: Value.cpp:994
llvm::ilist_node_impl::getIterator
self_iterator getIterator()
Definition: ilist_node.h:82
ArgTLSSize
static const unsigned ArgTLSSize
Definition: DataFlowSanitizer.cpp:130
DL
MachineBasicBlock MachineBasicBlock::iterator DebugLoc DL
Definition: AArch64SLSHardening.cpp:76
S
add sub stmia L5 ldr r0 bl L_printf $stub Instead of a and a wouldn t it be better to do three moves *Return an aggregate type is even return S
Definition: README.txt:210
llvm::InstVisitor
Base class for instruction visitors.
Definition: InstVisitor.h:78
llvm::CastInst
This is the base class for all instructions that perform data casts.
Definition: InstrTypes.h:430
llvm::LoadInst::getOrdering
AtomicOrdering getOrdering() const
Returns the ordering constraint of this load instruction.
Definition: Instructions.h:226
llvm::Value::getName
StringRef getName() const
Return a constant reference to the value's name.
Definition: Value.cpp:308
llvm::LoadInst
An instruction for reading from memory.
Definition: Instructions.h:174
VirtualFileSystem.h
llvm::CallBase::setArgOperand
void setArgOperand(unsigned i, Value *v)
Definition: InstrTypes.h:1347
llvm::IRBuilderBase::CreateConstGEP1_32
Value * CreateConstGEP1_32(Type *Ty, Value *Ptr, unsigned Idx0, const Twine &Name="")
Definition: IRBuilder.h:1773
llvm::AtomicRMWInst
an instruction that atomically reads a memory location, combines it with another value,...
Definition: Instructions.h:715
llvm::Value::stripPointerCasts
const Value * stripPointerCasts() const
Strip off pointer casts, all-zero GEPs and address space casts.
Definition: Value.cpp:685
llvm::IRBuilderBase::CreateTrunc
Value * CreateTrunc(Value *V, Type *DestTy, const Twine &Name="")
Definition: IRBuilder.h:1889
llvm::FunctionCallee::getCallee
Value * getCallee()
Definition: DerivedTypes.h:184
Argument.h
llvm::BasicBlock::front
const Instruction & front() const
Definition: BasicBlock.h:318
ClIgnorePersonalityRoutine
static cl::opt< bool > ClIgnorePersonalityRoutine("dfsan-ignore-personality-routine", cl::desc("If a personality routine is marked uninstrumented from the ABI " "list, do not create a wrapper for it."), cl::Hidden, cl::init(false))
llvm::depth_first
iterator_range< df_iterator< T > > depth_first(const T &G)
Definition: DepthFirstIterator.h:230
ClTrackSelectControlFlow
static cl::opt< bool > ClTrackSelectControlFlow("dfsan-track-select-control-flow", cl::desc("Propagate labels from condition values of select instructions " "to results."), cl::Hidden, cl::init(true))
StringSet.h
Attributes.h
ClTrackOrigins
static cl::opt< int > ClTrackOrigins("dfsan-track-origins", cl::desc("Track origins of labels"), cl::Hidden, cl::init(0))
Constant.h
llvm::NVPTX::PTXLdStInstCode::V2
@ V2
Definition: NVPTX.h:123
llvm::SplitEdge
BasicBlock * SplitEdge(BasicBlock *From, BasicBlock *To, DominatorTree *DT=nullptr, LoopInfo *LI=nullptr, MemorySSAUpdater *MSSAU=nullptr, const Twine &BBName="")
Split the edge connecting the specified blocks, and return the newly created basic block between From...
Definition: BasicBlockUtils.cpp:598
llvm::Twine
Twine - A lightweight data structure for efficiently representing the concatenation of temporary valu...
Definition: Twine.h:81
Alignment.h
llvm::ConstantExpr
A constant value that is initialized with an expression using other constant values.
Definition: Constants.h:972
llvm::GraphProgram::Name
Name
Definition: GraphWriter.h:50
llvm::None
constexpr std::nullopt_t None
Definition: None.h:27
get
Should compile to something r4 addze r3 instead we get
Definition: README.txt:24
llvm::DenseMapBase< DenseMap< KeyT, ValueT, DenseMapInfo< KeyT >, llvm::detail::DenseMapPair< KeyT, ValueT > >, KeyT, ValueT, DenseMapInfo< KeyT >, llvm::detail::DenseMapPair< KeyT, ValueT > >::end
iterator end()
Definition: DenseMap.h:84
llvm::PreservedAnalyses::all
static PreservedAnalyses all()
Construct a special preserved set that preserves all passes.
Definition: PassManager.h:158
llvm::ISD::BR
@ BR
Control flow instructions. These all have token chains.
Definition: ISDOpcodes.h:982
llvm::X86::FirstMacroFusionInstKind::Cmp
@ Cmp
llvm::Align::value
uint64_t value() const
This is a hole in the type system and should not be abused.
Definition: Alignment.h:85
isAMustTailRetVal
static bool isAMustTailRetVal(Value *RetVal)
Definition: DataFlowSanitizer.cpp:2828
llvm::CallBase::arg_size
unsigned arg_size() const
Definition: InstrTypes.h:1340
llvm::SPII::Load
@ Load
Definition: SparcInstrInfo.h:32
GlobalVariable.h
llvm::ExtractValueInst
This instruction extracts a struct member or array element value from an aggregate value.
Definition: Instructions.h:2446
llvm::ConstantInt::getSigned
static ConstantInt * getSigned(IntegerType *Ty, int64_t V)
Return a ConstantInt with the specified value for the specified type.
Definition: Constants.cpp:893
Casting.h
Function.h
ShadowTLSAlignment
static const Align ShadowTLSAlignment
Definition: DataFlowSanitizer.cpp:124
PassManager.h
llvm::Type::getPointerTo
PointerType * getPointerTo(unsigned AddrSpace=0) const
Return a pointer to the current type.
Definition: Type.cpp:774
llvm::TargetLibraryInfo
Provides information about what library functions are available for the current target.
Definition: TargetLibraryInfo.h:226
llvm::ReturnInst::Create
static ReturnInst * Create(LLVMContext &C, Value *retVal=nullptr, Instruction *InsertBefore=nullptr)
Definition: Instructions.h:3079
llvm::AttributeList::getNumAttrSets
unsigned getNumAttrSets() const
Definition: Attributes.cpp:1613
llvm::AttributeFuncs::typeIncompatible
AttributeMask typeIncompatible(Type *Ty, AttributeSafetyKind ASK=ASK_ALL)
Which attributes cannot be applied to a type.
Definition: Attributes.cpp:1894
SpecialCaseList.h
Unordered
QP Compare Ordered Unordered
Definition: README_P9.txt:299
runImpl
static bool runImpl(Function &F, const TargetLowering &TLI)
Definition: ExpandLargeDivRem.cpp:56
llvm::CallBase::getCalledOperand
Value * getCalledOperand() const
Definition: InstrTypes.h:1390
llvm::Function::arg_begin
arg_iterator arg_begin()
Definition: Function.h:722
GlobalAlias.h
llvm::AMDGPU::Hwreg::Width
Width
Definition: SIDefines.h:439
ClCombineTaintLookupTables
static cl::list< std::string > ClCombineTaintLookupTables("dfsan-combine-taint-lookup-table", cl::desc("When dfsan-combine-offset-labels-on-gep and/or " "dfsan-combine-pointer-labels-on-load are false, this flag can " "be used to re-enable combining offset and/or pointer taint when " "loading specific constant global variables (i.e. lookup tables)."), cl::Hidden)
llvm::makeArrayRef
ArrayRef< T > makeArrayRef(const T &OneElt)
Construct an ArrayRef from a single element.
Definition: ArrayRef.h:475
llvm::MDBuilder
Definition: MDBuilder.h:36
llvm::Type::getVoidTy
static Type * getVoidTy(LLVMContext &C)
Definition: Type.cpp:222
llvm::ShuffleVectorInst
This instruction constructs a fixed permutation of two input vectors.
Definition: Instructions.h:2008
Instructions.h
ClCombineOffsetLabelsOnGEP
static cl::opt< bool > ClCombineOffsetLabelsOnGEP("dfsan-combine-offset-labels-on-gep", cl::desc("Combine the label of the offset with the label of the pointer when " "doing pointer arithmetic."), cl::Hidden, cl::init(true))
llvm::User::getNumOperands
unsigned getNumOperands() const
Definition: User.h:191
llvm::GlobalAlias::getAliaseeObject
const GlobalObject * getAliaseeObject() const
Definition: Globals.cpp:553
SmallVector.h
llvm::Instruction::getDebugLoc
const DebugLoc & getDebugLoc() const
Return the debug location for this node as a DebugLoc.
Definition: Instruction.h:354
StripPointerGEPsAndCasts
Value * StripPointerGEPsAndCasts(Value *V)
Definition: DataFlowSanitizer.cpp:2231
User.h
llvm::IRBuilderBase::CreateLShr
Value * CreateLShr(Value *LHS, Value *RHS, const Twine &Name="", bool isExact=false)
Definition: IRBuilder.h:1343
Dominators.h
llvm::CallBase::getArgOperand
Value * getArgOperand(unsigned i) const
Definition: InstrTypes.h:1342
N
#define N
llvm::IRBuilderBase::CreateShl
Value * CreateShl(Value *LHS, Value *RHS, const Twine &Name="", bool HasNUW=false, bool HasNSW=false)
Definition: IRBuilder.h:1322
llvm::Function::removeFnAttr
void removeFnAttr(Attribute::AttrKind Kind)
Remove function attributes from this function.
Definition: Function.cpp:587
llvm::Instruction::getParent
const BasicBlock * getParent() const
Definition: Instruction.h:91
llvm::FunctionCallee
A handy container for a FunctionType+Callee-pointer pair, which can be passed around as a single enti...
Definition: DerivedTypes.h:165
llvm::PHINode
Definition: Instructions.h:2699
llvm::CallBase
Base class for all callable instructions (InvokeInst and CallInst) Holds everything related to callin...
Definition: InstrTypes.h:1175
llvm::GlobalValue::getType
PointerType * getType() const
Global values are always pointers.
Definition: GlobalValue.h:290
llvm::Module::getDataLayout
const DataLayout & getDataLayout() const
Get the data layout for the module's target platform.
Definition: Module.cpp:399
DerivedTypes.h
consume
static bool consume(InternalInstruction *insn, T &ptr)
Definition: X86Disassembler.cpp:192
llvm::IRBuilderBase::CreateConstGEP2_64
Value * CreateConstGEP2_64(Type *Ty, Value *Ptr, uint64_t Idx0, uint64_t Idx1, const Twine &Name="")
Definition: IRBuilder.h:1839
llvm::AnalysisManager
A container for analyses that lazily runs them and caches their results.
Definition: InstructionSimplify.h:42
llvm::HexStyle::Asm
@ Asm
0ffh
Definition: MCInstPrinter.h:34
llvm::GlobalValue::getValueType
Type * getValueType() const
Definition: GlobalValue.h:292
llvm::InnerAnalysisManagerProxy
An analysis over an "outer" IR unit that provides access to an analysis manager over an "inner" IR un...
Definition: PassManager.h:931
llvm::IntegerType::get
static IntegerType * get(LLVMContext &C, unsigned NumBits)
This static method is the primary way of constructing an IntegerType.
Definition: Type.cpp:311
getUnderlyingObjects
static void getUnderlyingObjects(const MachineInstr *MI, SmallVectorImpl< const Value * > &Objs)
Return the underlying objects for the memory references of an instruction.
Definition: MachinePipeliner.cpp:739
llvm::CallInst
This class represents a function call, abstracting a target machine's calling convention.
Definition: Instructions.h:1474
BB
Common register allocation spilling lr str ldr sxth r3 ldr mla r4 can lr mov lr str ldr sxth r3 mla r4 and then merge mul and lr str ldr sxth r3 mla r4 It also increase the likelihood the store may become dead bb27 Successors according to LLVM BB
Definition: README.txt:39
GEP
Hexagon Common GEP
Definition: HexagonCommonGEP.cpp:171
llvm::UnreachableInst
This function has undefined behavior.
Definition: Instructions.h:4771
llvm::IRBuilderBase::CreateICmpNE
Value * CreateICmpNE(Value *LHS, Value *RHS, const Twine &Name="")
Definition: IRBuilder.h:2103
InlinePriorityMode::Size
@ Size
llvm::GlobalAlias::eraseFromParent
void eraseFromParent()
eraseFromParent - This method unlinks 'this' from the containing module and deletes it.
Definition: Globals.cpp:543
llvm::SwitchInst
Multiway switch.
Definition: Instructions.h:3278
llvm::Value::takeName
void takeName(Value *V)
Transfer the name from V to this value.
Definition: Value.cpp:381
llvm::SplitBlockAndInsertIfThen
Instruction * SplitBlockAndInsertIfThen(Value *Cond, Instruction *SplitBefore, bool Unreachable, MDNode *BranchWeights, DominatorTree *DT, LoopInfo *LI=nullptr, BasicBlock *ThenBlock=nullptr)
Split the containing block at the specified instruction - everything before SplitBefore stays in the ...
Definition: BasicBlockUtils.cpp:1525
llvm::AMDGPU::HSAMD::Kernel::Key::Args
constexpr char Args[]
Key for Kernel::Metadata::mArgs.
Definition: AMDGPUMetadata.h:394
llvm::AllocaInst
an instruction to allocate memory on the stack
Definition: Instructions.h:59
llvm::User::getOperand
Value * getOperand(unsigned i) const
Definition: User.h:169
llvm::cl::desc
Definition: CommandLine.h:413
Mod
Module * Mod
Definition: PassBuilderBindings.cpp:54
llvm::AttributeMask::addAttribute
AttributeMask & addAttribute(Attribute::AttrKind Val)
Add an attribute to the mask.
Definition: Attributes.h:992
llvm::BranchInst
Conditional or Unconditional Branch instruction.
Definition: Instructions.h:3134
llvm::SmallPtrSetImpl::contains
bool contains(ConstPtrType Ptr) const
Definition: SmallPtrSet.h:389
llvm::ConstantAggregateZero::get
static ConstantAggregateZero * get(Type *Ty)
Definition: Constants.cpp:1587
llvm::AttributeList::getParamAttrs
AttributeSet getParamAttrs(unsigned ArgNo) const
The attributes for the argument or parameter at the given index are returned.
Definition: Attributes.cpp:1461
llvm::InsertValueInst
This instruction inserts a struct field of array element value into an aggregate value.
Definition: Instructions.h:2557
BasicBlockUtils.h
Value.h
llvm::pdb::PDB_SymType::Block
@ Block
InitializePasses.h
llvm::GetElementPtrInst::getPointerOperand
Value * getPointerOperand()
Definition: Instructions.h:1052
llvm::FunctionType::getReturnType
Type * getReturnType() const
Definition: DerivedTypes.h:124
expandFromPrimitiveShadowRecursive
static Value * expandFromPrimitiveShadowRecursive(Value *Shadow, SmallVector< unsigned, 4 > &Indices, Type *SubShadowTy, Value *PrimitiveShadow, IRBuilder<> &IRB)
Definition: DataFlowSanitizer.cpp:912
llvm::Value
LLVM Value Representation.
Definition: Value.h:74
llvm::AtomicCmpXchgInst
An instruction that atomically checks whether a specified value is in a memory location,...
Definition: Instructions.h:510
llvm::GlobalValue::isExternalWeakLinkage
static bool isExternalWeakLinkage(LinkageTypes Linkage)
Definition: GlobalValue.h:407
llvm::TargetLibraryAnalysis
Analysis pass providing the TargetLibraryInfo.
Definition: TargetLibraryInfo.h:450
llvm::IRBuilderBase::CreateCall
CallInst * CreateCall(FunctionType *FTy, Value *Callee, ArrayRef< Value * > Args=None, const Twine &Name="", MDNode *FPMathTag=nullptr)
Definition: IRBuilder.h:2269
llvm::CallBase::args
iterator_range< User::op_iterator > args()
Iteration adapter for range-for loops.
Definition: InstrTypes.h:1333
ClCombinePointerLabelsOnStore
static cl::opt< bool > ClCombinePointerLabelsOnStore("dfsan-combine-pointer-labels-on-store", cl::desc("Combine the label of the pointer with the label of the data when " "storing in memory."), cl::Hidden, cl::init(false))
llvm::sampleprof::Base
@ Base
Definition: Discriminator.h:58
llvm::CallBase::setCallingConv
void setCallingConv(CallingConv::ID CC)
Definition: InstrTypes.h:1460
llvm::FunctionType
Class to represent function types.
Definition: DerivedTypes.h:103
llvm::Use
A Use represents the edge between a Value definition and its users.
Definition: Use.h:43
llvm::SmallPtrSetImpl::insert
std::pair< iterator, bool > insert(PtrType Ptr)
Inserts Ptr if and only if there is no element in the container equal to Ptr.
Definition: SmallPtrSet.h:365
llvm::cl::list
Definition: CommandLine.h:1648