51#define DEBUG_TYPE "sanmd"
58constexpr uint32_t kVersionPtrSizeRel = (1u << 16);
59constexpr int kCtorDtorPriority = 2;
68 static const MetadataInfo Covered;
69 static const MetadataInfo Atomics;
73 explicit constexpr MetadataInfo(
StringRef FunctionPrefix,
75 : FunctionPrefix(FunctionPrefix), SectionSuffix(SectionSuffix) {}
77const MetadataInfo MetadataInfo::Covered{
79const MetadataInfo MetadataInfo::Atomics{
90 "sanitizer-metadata-weak-callbacks",
91 cl::desc(
"Declare callbacks extern weak, and only call if non-null."),
94 ClNoSanitize(
"sanitizer-metadata-nosanitize-attr",
95 cl::desc(
"Mark some metadata features uncovered in functions "
96 "with associated no_sanitize attributes."),
100 cl::desc(
"Emit PCs for covered functions."),
103 cl::desc(
"Emit PCs for atomic operations."),
106 cl::desc(
"Emit PCs for start of functions that are "
107 "subject for use-after-return checking"),
112STATISTIC(NumMetadataCovered,
"Metadata attached to covered functions");
113STATISTIC(NumMetadataAtomics,
"Metadata attached to atomics");
114STATISTIC(NumMetadataUAR,
"Metadata attached to UAR functions");
122 Opts.Atomics |= ClEmitAtomics;
123 Opts.UAR |= ClEmitUAR;
124 return std::move(Opts);
127class SanitizerBinaryMetadata {
130 std::unique_ptr<SpecialCaseList> Ignorelist)
131 :
Mod(M),
Options(transformOptionsFromCl(std::move(Opts))),
132 Ignorelist(std::move(Ignorelist)), TargetTriple(M.getTargetTriple()),
133 IRB(M.getContext()) {
135 assert(TargetTriple.isOSBinFormatELF() &&
"ELF only");
136 assert(!(TargetTriple.isNVPTX() || TargetTriple.isAMDGPU()) &&
137 "Device targets are not supported");
147 Version |= kVersionPtrSizeRel;
151 void runOn(
Function &
F, MetadataInfoSet &MIS);
176 bool pretendAtomicAccess(
const Value *
Addr);
180 std::unique_ptr<SpecialCaseList> Ignorelist;
181 const Triple TargetTriple;
187bool SanitizerBinaryMetadata::run() {
201 auto *Int8PtrTy = IRB.getInt8PtrTy();
202 auto *Int8PtrPtrTy = PointerType::getUnqual(Int8PtrTy);
204 const std::array<Type *, 3> InitTypes = {
Int32Ty, Int8PtrPtrTy, Int8PtrPtrTy};
207 for (
const MetadataInfo *
MI : MIS) {
208 const std::array<
Value *, InitTypes.size()> InitArgs = {
210 getSectionMarker(getSectionStart(
MI->SectionSuffix), Int8PtrTy),
211 getSectionMarker(getSectionEnd(
MI->SectionSuffix), Int8PtrTy),
219 Mod, (
MI->FunctionPrefix +
".module_ctor").str(),
220 (
MI->FunctionPrefix +
"_add").str(), InitTypes, InitArgs,
225 Mod, (
MI->FunctionPrefix +
".module_dtor").str(),
226 (
MI->FunctionPrefix +
"_del").str(), InitTypes, InitArgs,
231 if (TargetTriple.supportsCOMDAT()) {
241 CtorComdatKey = Ctor;
242 DtorComdatKey = Dtor;
251void SanitizerBinaryMetadata::runOn(
Function &
F, MetadataInfoSet &MIS) {
254 if (
F.hasFnAttribute(Attribute::DisableSanitizerInstrumentation))
256 if (Ignorelist && Ignorelist->inSection(
"metadata",
"fun",
F.getName()))
268 bool RequiresCovered =
false;
273 RequiresCovered |= runOn(
I, MIS, MDB, FeatureMask);
276 if (ClNoSanitize &&
F.hasFnAttribute(
"no_sanitize_thread"))
277 FeatureMask &= ~kSanitizerBinaryMetadataAtomics;
279 FeatureMask &= ~kSanitizerBinaryMetadataUAR;
281 RequiresCovered =
true;
288 if (
Options.Covered || (FeatureMask && RequiresCovered)) {
289 NumMetadataCovered++;
290 const auto *
MI = &MetadataInfo::Covered;
292 const StringRef Section = getSectionName(
MI->SectionSuffix);
294 Constant *CFM = IRB.getInt64(FeatureMask);
295 F.setMetadata(LLVMContext::MD_pcsections,
308 return F && (
F->isIntrinsic() ||
F->doesNotReturn() ||
309 F->getName().startswith(
"__asan_") ||
310 F->getName().startswith(
"__hwsan_") ||
311 F->getName().startswith(
"__ubsan_") ||
312 F->getName().startswith(
"__msan_") ||
313 F->getName().startswith(
"__tsan_"));
316bool hasUseAfterReturnUnsafeUses(
Value &V) {
317 for (
User *U :
V.users()) {
318 if (
auto *
I = dyn_cast<Instruction>(U)) {
319 if (
I->isLifetimeStartOrEnd() ||
I->isDroppable())
321 if (
auto *CI = dyn_cast<CallInst>(U)) {
322 if (isUARSafeCall(CI))
325 if (isa<LoadInst>(U))
327 if (
auto *SI = dyn_cast<StoreInst>(U)) {
329 if (
SI->getOperand(1) == &V)
332 if (
auto *GEPI = dyn_cast<GetElementPtrInst>(U)) {
333 if (!hasUseAfterReturnUnsafeUses(*GEPI))
335 }
else if (
auto *BCI = dyn_cast<BitCastInst>(U)) {
336 if (!hasUseAfterReturnUnsafeUses(*BCI))
346 if (isa<AllocaInst>(
I))
347 return hasUseAfterReturnUnsafeUses(
I);
351 else if (
auto *CI = dyn_cast<CallInst>(&
I))
352 return CI->
isTailCall() && !isUARSafeCall(CI);
356bool SanitizerBinaryMetadata::pretendAtomicAccess(
const Value *
Addr) {
360 Addr =
Addr->stripInBoundsOffsets();
361 auto *GV = dyn_cast<GlobalVariable>(
Addr);
367 if (GV->hasSection()) {
371 if (GV->getSection().endswith(ProfSec))
374 if (GV->getName().startswith(
"__llvm_gcov") ||
375 GV->getName().startswith(
"__llvm_gcda"))
382bool maybeSharedMutable(
const Value *
Addr) {
391 Addr =
Addr->stripInBoundsOffsets();
392 if (
auto *GV = dyn_cast<GlobalVariable>(
Addr)) {
393 if (GV->isConstant())
400bool SanitizerBinaryMetadata::runOn(
Instruction &
I, MetadataInfoSet &MIS,
403 bool RequiresCovered =
false;
409 if (useAfterReturnUnsafe(
I))
415 if (
auto *SI = dyn_cast<StoreInst>(&
I))
416 Addr =
SI->getPointerOperand();
417 else if (
auto *LI = dyn_cast<LoadInst>(&
I))
418 Addr = LI->getPointerOperand();
420 if (
I.mayReadOrWriteMemory() && maybeSharedMutable(
Addr)) {
423 pretendAtomicAccess(
Addr)) {
424 NumMetadataAtomics++;
425 InstMetadata.
push_back(&MetadataInfo::Atomics);
428 RequiresCovered =
true;
433 if (!InstMetadata.
empty()) {
434 MIS.insert(InstMetadata.
begin(), InstMetadata.
end());
436 for (
const auto &
MI : InstMetadata)
441 return RequiresCovered;
445SanitizerBinaryMetadata::getSectionMarker(
const Twine &MarkerName,
Type *Ty) {
449 GlobalVariable::ExternalWeakLinkage,
450 nullptr, MarkerName);
458 return StringPool.save(SectionSuffix +
"!C");
461Twine SanitizerBinaryMetadata::getSectionStart(
StringRef SectionSuffix) {
462 return "__start_" + SectionSuffix;
465Twine SanitizerBinaryMetadata::getSectionEnd(
StringRef SectionSuffix) {
466 return "__stop_" + SectionSuffix;
477 std::unique_ptr<SpecialCaseList> Ignorelist;
478 if (!IgnorelistFiles.
empty()) {
481 if (Ignorelist->inSection(
"metadata",
"src", M.getSourceFileName()))
485 SanitizerBinaryMetadata
Pass(M, Options, std::move(Ignorelist));
This file defines the BumpPtrAllocator interface.
Module.h This file contains the declarations for the Module class.
const char LLVMTargetMachineRef LLVMPassBuilderOptionsRef Options
assert(ImpDefSCC.getReg()==AMDGPU::SCC &&ImpDefSCC.isDef())
This file implements a set that has insertion order iteration characteristics.
This file defines the SmallVector class.
This file defines the 'Statistic' class, which is designed to be an easy way to expose various metric...
#define STATISTIC(VARNAME, DESC)
Defines the virtual file system interface vfs::FileSystem.
A container for analyses that lazily runs them and caches their results.
ArrayRef - Represent a constant reference to an array (0 or more elements consecutively in memory),...
bool empty() const
empty - Check if the array is empty.
LLVM Basic Block Representation.
Allocate memory in an ever growing pool, as if by bump-pointer.
Function * getCalledFunction() const
Returns the function called, or null if this is an indirect function invocation or the function signa...
This class represents a function call, abstracting a target machine's calling convention.
static Constant * get(Type *Ty, uint64_t V, bool IsSigned=false)
If Ty is a vector type, return a Constant with a splat of the given value.
This is an important base class in LLVM.
void setComdat(Comdat *C)
void setLinkage(LinkageTypes LT)
@ HiddenVisibility
The GV is hidden.
void setVisibility(VisibilityTypes V)
@ ExternalLinkage
Externally visible function.
@ AvailableExternallyLinkage
Available for inspection, not emission.
This provides a uniform API for creating instructions and inserting them into a basic block: either a...
MDNode * createPCSections(ArrayRef< PCSection > Sections)
Return metadata for PC sections.
A Module instance is used to store all the information related to an LLVM module.
const std::string & getTargetTriple() const
Get the target triple which is a string describing the target host.
Comdat * getOrInsertComdat(StringRef Name)
Return the Comdat in the module with the specified name.
std::optional< CodeModel::Model > getCodeModel() const
Returns the code model (tiny, small, kernel, medium or large model)
Pass interface - Implemented by all 'passes'.
A set of analyses that are preserved following a run of a transformation pass.
static PreservedAnalyses none()
Convenience factory function for the empty preserved set.
static PreservedAnalyses all()
Construct a special preserved set that preserves all passes.
A vector that has set insertion semantics.
void push_back(const T &Elt)
This is a 'vector' (really, a variable-sized array), optimized for the case when the array is small.
static std::unique_ptr< SpecialCaseList > createOrDie(const std::vector< std::string > &Paths, llvm::vfs::FileSystem &FS)
Parses the special case list entries from files.
StringRef - Represent a constant reference to a string, i.e.
Triple - Helper class for working with autoconf configuration names.
ObjectFormatType getObjectFormat() const
Get the object format for this triple.
Twine - A lightweight data structure for efficiently representing the concatenation of temporary valu...
The instances of the Type class are immutable: once they are created, they are never changed.
static IntegerType * getInt32Ty(LLVMContext &C)
Saves strings in the provided stable storage and returns a StringRef with a stable character pointer.
LLVM Value Representation.
StringRef getName() const
Return a constant reference to the value's name.
@ SingleThread
Synchronized with respect to signal handlers executing in the same thread.
initializer< Ty > init(const Ty &Val)
const StringLiteral & getSectionName(DebugSectionKind SectionKind)
Return the name of the section.
IntrusiveRefCntPtr< FileSystem > getRealFileSystem()
Gets an vfs::FileSystem for the 'real' file system, as seen by the operating system.
This is an optimization pass for GlobalISel generic memory operations.
const Value * getUnderlyingObject(const Value *V, unsigned MaxLookup=6)
This method strips off any GEP address adjustments and pointer casts from the specified value,...
std::string getInstrProfSectionName(InstrProfSectKind IPSK, Triple::ObjectFormatType OF, bool AddSegmentInfo=true)
Return the name of the profile section corresponding to IPSK.
constexpr uint64_t kSanitizerBinaryMetadataUAR
std::pair< Function *, FunctionCallee > createSanitizerCtorAndInitFunctions(Module &M, StringRef CtorName, StringRef InitName, ArrayRef< Type * > InitArgTypes, ArrayRef< Value * > InitArgs, StringRef VersionCheckName=StringRef(), bool Weak=false)
Creates sanitizer constructor function, and calls sanitizer's init function from it.
std::optional< SyncScope::ID > getAtomicSyncScopeID(const Instruction *I)
A helper function that returns an atomic operation's sync scope; returns std::nullopt if it is not an...
bool PointerMayBeCaptured(const Value *V, bool ReturnCaptures, bool StoreCaptures, unsigned MaxUsesToExplore=0)
PointerMayBeCaptured - Return true if this pointer value may be captured by the enclosing function (w...
constexpr uint64_t kSanitizerBinaryMetadataAtomics
constexpr char kSanitizerBinaryMetadataCoveredSection[]
OutputIt move(R &&Range, OutputIt Out)
Provide wrappers to std::move which take ranges instead of having to pass begin/end explicitly.
void appendToGlobalCtors(Module &M, Function *F, int Priority, Constant *Data=nullptr)
Append F to the list of global ctors of module M with the given Priority.
constexpr char kSanitizerBinaryMetadataAtomicsSection[]
void appendToGlobalDtors(Module &M, Function *F, int Priority, Constant *Data=nullptr)
Same as appendToGlobalCtors(), but for global dtors.
Implement std::hash so that hash_code can be used in STL containers.