51#define DEBUG_TYPE "sanmd"
58constexpr uint32_t kVersionPtrSizeRel = (1u << 16);
59constexpr int kCtorDtorPriority = 2;
68 static const MetadataInfo Covered;
69 static const MetadataInfo Atomics;
73 explicit constexpr MetadataInfo(
StringRef FunctionPrefix,
75 : FunctionPrefix(FunctionPrefix), SectionSuffix(SectionSuffix) {}
77const MetadataInfo MetadataInfo::Covered{
79const MetadataInfo MetadataInfo::Atomics{
90 "sanitizer-metadata-weak-callbacks",
91 cl::desc(
"Declare callbacks extern weak, and only call if non-null."),
94 ClNoSanitize(
"sanitizer-metadata-nosanitize-attr",
95 cl::desc(
"Mark some metadata features uncovered in functions "
96 "with associated no_sanitize attributes."),
100 cl::desc(
"Emit PCs for covered functions."),
103 cl::desc(
"Emit PCs for atomic operations."),
106 cl::desc(
"Emit PCs for start of functions that are "
107 "subject for use-after-return checking"),
112STATISTIC(NumMetadataCovered,
"Metadata attached to covered functions");
113STATISTIC(NumMetadataAtomics,
"Metadata attached to atomics");
114STATISTIC(NumMetadataUAR,
"Metadata attached to UAR functions");
122 Opts.Atomics |= ClEmitAtomics;
123 Opts.UAR |= ClEmitUAR;
124 return std::move(Opts);
127class SanitizerBinaryMetadata {
130 std::unique_ptr<SpecialCaseList> Ignorelist)
131 :
Mod(M),
Options(transformOptionsFromCl(std::move(Opts))),
132 Ignorelist(std::move(Ignorelist)), TargetTriple(M.getTargetTriple()),
133 IRB(M.getContext()) {
135 assert(TargetTriple.isOSBinFormatELF() &&
"ELF only");
136 assert(!(TargetTriple.isNVPTX() || TargetTriple.isAMDGPU()) &&
137 "Device targets are not supported");
147 Version |= kVersionPtrSizeRel;
151 void runOn(
Function &
F, MetadataInfoSet &MIS);
176 bool pretendAtomicAccess(
const Value *
Addr);
180 std::unique_ptr<SpecialCaseList> Ignorelist;
181 const Triple TargetTriple;
187bool SanitizerBinaryMetadata::run() {
201 auto *PtrTy = IRB.getPtrTy();
203 const std::array<Type *, 3> InitTypes = {
Int32Ty, PtrTy, PtrTy};
204 auto *Version = ConstantInt::get(
Int32Ty, getVersion());
206 for (
const MetadataInfo *
MI : MIS) {
207 const std::array<
Value *, InitTypes.size()> InitArgs = {
209 getSectionMarker(getSectionStart(
MI->SectionSuffix), PtrTy),
210 getSectionMarker(getSectionEnd(
MI->SectionSuffix), PtrTy),
218 Mod, (
MI->FunctionPrefix +
".module_ctor").str(),
219 (
MI->FunctionPrefix +
"_add").str(), InitTypes, InitArgs,
224 Mod, (
MI->FunctionPrefix +
".module_dtor").str(),
225 (
MI->FunctionPrefix +
"_del").str(), InitTypes, InitArgs,
230 if (TargetTriple.supportsCOMDAT()) {
240 CtorComdatKey = Ctor;
241 DtorComdatKey = Dtor;
250void SanitizerBinaryMetadata::runOn(
Function &
F, MetadataInfoSet &MIS) {
253 if (
F.hasFnAttribute(Attribute::DisableSanitizerInstrumentation))
255 if (Ignorelist && Ignorelist->inSection(
"metadata",
"fun",
F.getName()))
267 bool RequiresCovered =
false;
272 RequiresCovered |= runOn(
I, MIS, MDB, FeatureMask);
275 if (ClNoSanitize &&
F.hasFnAttribute(
"no_sanitize_thread"))
276 FeatureMask &= ~kSanitizerBinaryMetadataAtomics;
278 FeatureMask &= ~kSanitizerBinaryMetadataUAR;
280 RequiresCovered =
true;
287 if (
Options.Covered || (FeatureMask && RequiresCovered)) {
288 NumMetadataCovered++;
289 const auto *
MI = &MetadataInfo::Covered;
293 Constant *CFM = IRB.getInt64(FeatureMask);
294 F.setMetadata(LLVMContext::MD_pcsections,
307 return F && (
F->isIntrinsic() ||
F->doesNotReturn() ||
308 F->getName().starts_with(
"__asan_") ||
309 F->getName().starts_with(
"__hwsan_") ||
310 F->getName().starts_with(
"__ubsan_") ||
311 F->getName().starts_with(
"__msan_") ||
312 F->getName().starts_with(
"__tsan_"));
315bool hasUseAfterReturnUnsafeUses(
Value &V) {
316 for (
User *U :
V.users()) {
317 if (
auto *
I = dyn_cast<Instruction>(U)) {
318 if (
I->isLifetimeStartOrEnd() ||
I->isDroppable())
320 if (
auto *CI = dyn_cast<CallInst>(U)) {
321 if (isUARSafeCall(CI))
324 if (isa<LoadInst>(U))
326 if (
auto *SI = dyn_cast<StoreInst>(U)) {
328 if (
SI->getOperand(1) == &V)
331 if (
auto *GEPI = dyn_cast<GetElementPtrInst>(U)) {
332 if (!hasUseAfterReturnUnsafeUses(*GEPI))
334 }
else if (
auto *BCI = dyn_cast<BitCastInst>(U)) {
335 if (!hasUseAfterReturnUnsafeUses(*BCI))
345 if (isa<AllocaInst>(
I))
346 return hasUseAfterReturnUnsafeUses(
I);
350 else if (
auto *CI = dyn_cast<CallInst>(&
I))
351 return CI->
isTailCall() && !isUARSafeCall(CI);
355bool SanitizerBinaryMetadata::pretendAtomicAccess(
const Value *
Addr) {
359 Addr =
Addr->stripInBoundsOffsets();
360 auto *GV = dyn_cast<GlobalVariable>(
Addr);
366 if (GV->hasSection()) {
370 if (GV->getSection().ends_with(ProfSec))
373 if (GV->getName().starts_with(
"__llvm_gcov") ||
374 GV->getName().starts_with(
"__llvm_gcda"))
381bool maybeSharedMutable(
const Value *
Addr) {
390 Addr =
Addr->stripInBoundsOffsets();
391 if (
auto *GV = dyn_cast<GlobalVariable>(
Addr)) {
392 if (GV->isConstant())
399bool SanitizerBinaryMetadata::runOn(
Instruction &
I, MetadataInfoSet &MIS,
402 bool RequiresCovered =
false;
408 if (useAfterReturnUnsafe(
I))
414 if (
auto *SI = dyn_cast<StoreInst>(&
I))
415 Addr =
SI->getPointerOperand();
416 else if (
auto *LI = dyn_cast<LoadInst>(&
I))
417 Addr = LI->getPointerOperand();
419 if (
I.mayReadOrWriteMemory() && maybeSharedMutable(
Addr)) {
422 pretendAtomicAccess(
Addr)) {
423 NumMetadataAtomics++;
424 InstMetadata.
push_back(&MetadataInfo::Atomics);
427 RequiresCovered =
true;
432 if (!InstMetadata.
empty()) {
433 MIS.insert(InstMetadata.
begin(), InstMetadata.
end());
435 for (
const auto &
MI : InstMetadata)
440 return RequiresCovered;
444SanitizerBinaryMetadata::getSectionMarker(
const Twine &MarkerName,
Type *Ty) {
448 GlobalVariable::ExternalWeakLinkage,
449 nullptr, MarkerName);
460Twine SanitizerBinaryMetadata::getSectionStart(
StringRef SectionSuffix) {
461 return "__start_" + SectionSuffix;
464Twine SanitizerBinaryMetadata::getSectionEnd(
StringRef SectionSuffix) {
465 return "__stop_" + SectionSuffix;
476 std::unique_ptr<SpecialCaseList> Ignorelist;
477 if (!IgnorelistFiles.
empty()) {
480 if (Ignorelist->inSection(
"metadata",
"src", M.getSourceFileName()))
484 SanitizerBinaryMetadata
Pass(M, Options, std::move(Ignorelist));
This file defines the BumpPtrAllocator interface.
Module.h This file contains the declarations for the Module class.
const char LLVMTargetMachineRef LLVMPassBuilderOptionsRef Options
assert(ImpDefSCC.getReg()==AMDGPU::SCC &&ImpDefSCC.isDef())
This file implements a set that has insertion order iteration characteristics.
This file defines the SmallVector class.
This file defines the 'Statistic' class, which is designed to be an easy way to expose various metric...
#define STATISTIC(VARNAME, DESC)
Defines the virtual file system interface vfs::FileSystem.
A container for analyses that lazily runs them and caches their results.
ArrayRef - Represent a constant reference to an array (0 or more elements consecutively in memory),...
bool empty() const
empty - Check if the array is empty.
LLVM Basic Block Representation.
Allocate memory in an ever growing pool, as if by bump-pointer.
Function * getCalledFunction() const
Returns the function called, or null if this is an indirect function invocation or the function signa...
This class represents a function call, abstracting a target machine's calling convention.
This is an important base class in LLVM.
void setComdat(Comdat *C)
void setLinkage(LinkageTypes LT)
@ HiddenVisibility
The GV is hidden.
void setVisibility(VisibilityTypes V)
@ ExternalLinkage
Externally visible function.
@ AvailableExternallyLinkage
Available for inspection, not emission.
This provides a uniform API for creating instructions and inserting them into a basic block: either a...
MDNode * createPCSections(ArrayRef< PCSection > Sections)
Return metadata for PC sections.
A Module instance is used to store all the information related to an LLVM module.
const std::string & getTargetTriple() const
Get the target triple which is a string describing the target host.
Comdat * getOrInsertComdat(StringRef Name)
Return the Comdat in the module with the specified name.
std::optional< CodeModel::Model > getCodeModel() const
Returns the code model (tiny, small, kernel, medium or large model)
Pass interface - Implemented by all 'passes'.
A set of analyses that are preserved following a run of a transformation pass.
static PreservedAnalyses none()
Convenience factory function for the empty preserved set.
static PreservedAnalyses all()
Construct a special preserved set that preserves all passes.
A vector that has set insertion semantics.
void push_back(const T &Elt)
This is a 'vector' (really, a variable-sized array), optimized for the case when the array is small.
static std::unique_ptr< SpecialCaseList > createOrDie(const std::vector< std::string > &Paths, llvm::vfs::FileSystem &FS)
Parses the special case list entries from files.
StringRef - Represent a constant reference to a string, i.e.
Triple - Helper class for working with autoconf configuration names.
ObjectFormatType getObjectFormat() const
Get the object format for this triple.
Twine - A lightweight data structure for efficiently representing the concatenation of temporary valu...
The instances of the Type class are immutable: once they are created, they are never changed.
static IntegerType * getInt32Ty(LLVMContext &C)
Saves strings in the provided stable storage and returns a StringRef with a stable character pointer.
LLVM Value Representation.
StringRef getName() const
Return a constant reference to the value's name.
@ SingleThread
Synchronized with respect to signal handlers executing in the same thread.
initializer< Ty > init(const Ty &Val)
static constexpr const StringLiteral & getSectionName(DebugSectionKind SectionKind)
Return the name of the section.
IntrusiveRefCntPtr< FileSystem > getRealFileSystem()
Gets an vfs::FileSystem for the 'real' file system, as seen by the operating system.
This is an optimization pass for GlobalISel generic memory operations.
const Value * getUnderlyingObject(const Value *V, unsigned MaxLookup=6)
This method strips off any GEP address adjustments, pointer casts or llvm.threadlocal....
std::string getInstrProfSectionName(InstrProfSectKind IPSK, Triple::ObjectFormatType OF, bool AddSegmentInfo=true)
Return the name of the profile section corresponding to IPSK.
constexpr uint64_t kSanitizerBinaryMetadataUAR
std::pair< Function *, FunctionCallee > createSanitizerCtorAndInitFunctions(Module &M, StringRef CtorName, StringRef InitName, ArrayRef< Type * > InitArgTypes, ArrayRef< Value * > InitArgs, StringRef VersionCheckName=StringRef(), bool Weak=false)
Creates sanitizer constructor function, and calls sanitizer's init function from it.
std::optional< SyncScope::ID > getAtomicSyncScopeID(const Instruction *I)
A helper function that returns an atomic operation's sync scope; returns std::nullopt if it is not an...
bool PointerMayBeCaptured(const Value *V, bool ReturnCaptures, bool StoreCaptures, unsigned MaxUsesToExplore=0)
PointerMayBeCaptured - Return true if this pointer value may be captured by the enclosing function (w...
constexpr uint64_t kSanitizerBinaryMetadataAtomics
constexpr char kSanitizerBinaryMetadataCoveredSection[]
OutputIt move(R &&Range, OutputIt Out)
Provide wrappers to std::move which take ranges instead of having to pass begin/end explicitly.
void appendToGlobalCtors(Module &M, Function *F, int Priority, Constant *Data=nullptr)
Append F to the list of global ctors of module M with the given Priority.
constexpr char kSanitizerBinaryMetadataAtomicsSection[]
void appendToGlobalDtors(Module &M, Function *F, int Priority, Constant *Data=nullptr)
Same as appendToGlobalCtors(), but for global dtors.
Implement std::hash so that hash_code can be used in STL containers.