LLVM  3.7.0
MemorySanitizer.cpp
Go to the documentation of this file.
1 //===-- MemorySanitizer.cpp - detector of uninitialized reads -------------===//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 /// \file
10 /// This file is a part of MemorySanitizer, a detector of uninitialized
11 /// reads.
12 ///
13 /// The algorithm of the tool is similar to Memcheck
14 /// (http://goo.gl/QKbem). We associate a few shadow bits with every
15 /// byte of the application memory, poison the shadow of the malloc-ed
16 /// or alloca-ed memory, load the shadow bits on every memory read,
17 /// propagate the shadow bits through some of the arithmetic
18 /// instruction (including MOV), store the shadow bits on every memory
19 /// write, report a bug on some other instructions (e.g. JMP) if the
20 /// associated shadow is poisoned.
21 ///
22 /// But there are differences too. The first and the major one:
23 /// compiler instrumentation instead of binary instrumentation. This
24 /// gives us much better register allocation, possible compiler
25 /// optimizations and a fast start-up. But this brings the major issue
26 /// as well: msan needs to see all program events, including system
27 /// calls and reads/writes in system libraries, so we either need to
28 /// compile *everything* with msan or use a binary translation
29 /// component (e.g. DynamoRIO) to instrument pre-built libraries.
30 /// Another difference from Memcheck is that we use 8 shadow bits per
31 /// byte of application memory and use a direct shadow mapping. This
32 /// greatly simplifies the instrumentation code and avoids races on
33 /// shadow updates (Memcheck is single-threaded so races are not a
34 /// concern there. Memcheck uses 2 shadow bits per byte with a slow
35 /// path storage that uses 8 bits per byte).
36 ///
37 /// The default value of shadow is 0, which means "clean" (not poisoned).
38 ///
39 /// Every module initializer should call __msan_init to ensure that the
40 /// shadow memory is ready. On error, __msan_warning is called. Since
41 /// parameters and return values may be passed via registers, we have a
42 /// specialized thread-local shadow for return values
43 /// (__msan_retval_tls) and parameters (__msan_param_tls).
44 ///
45 /// Origin tracking.
46 ///
47 /// MemorySanitizer can track origins (allocation points) of all uninitialized
48 /// values. This behavior is controlled with a flag (msan-track-origins) and is
49 /// disabled by default.
50 ///
51 /// Origins are 4-byte values created and interpreted by the runtime library.
52 /// They are stored in a second shadow mapping, one 4-byte value for 4 bytes
53 /// of application memory. Propagation of origins is basically a bunch of
54 /// "select" instructions that pick the origin of a dirty argument, if an
55 /// instruction has one.
56 ///
57 /// Every 4 aligned, consecutive bytes of application memory have one origin
58 /// value associated with them. If these bytes contain uninitialized data
59 /// coming from 2 different allocations, the last store wins. Because of this,
60 /// MemorySanitizer reports can show unrelated origins, but this is unlikely in
61 /// practice.
62 ///
63 /// Origins are meaningless for fully initialized values, so MemorySanitizer
64 /// avoids storing origin to memory when a fully initialized value is stored.
65 /// This way it avoids needless overwritting origin of the 4-byte region on
66 /// a short (i.e. 1 byte) clean store, and it is also good for performance.
67 ///
68 /// Atomic handling.
69 ///
70 /// Ideally, every atomic store of application value should update the
71 /// corresponding shadow location in an atomic way. Unfortunately, atomic store
72 /// of two disjoint locations can not be done without severe slowdown.
73 ///
74 /// Therefore, we implement an approximation that may err on the safe side.
75 /// In this implementation, every atomically accessed location in the program
76 /// may only change from (partially) uninitialized to fully initialized, but
77 /// not the other way around. We load the shadow _after_ the application load,
78 /// and we store the shadow _before_ the app store. Also, we always store clean
79 /// shadow (if the application store is atomic). This way, if the store-load
80 /// pair constitutes a happens-before arc, shadow store and load are correctly
81 /// ordered such that the load will get either the value that was stored, or
82 /// some later value (which is always clean).
83 ///
84 /// This does not work very well with Compare-And-Swap (CAS) and
85 /// Read-Modify-Write (RMW) operations. To follow the above logic, CAS and RMW
86 /// must store the new shadow before the app operation, and load the shadow
87 /// after the app operation. Computers don't work this way. Current
88 /// implementation ignores the load aspect of CAS/RMW, always returning a clean
89 /// value. It implements the store part as a simple atomic store by storing a
90 /// clean shadow.
91 
92 //===----------------------------------------------------------------------===//
93 
96 #include "llvm/ADT/SmallString.h"
97 #include "llvm/ADT/SmallVector.h"
98 #include "llvm/ADT/StringExtras.h"
99 #include "llvm/ADT/Triple.h"
100 #include "llvm/IR/DataLayout.h"
101 #include "llvm/IR/Function.h"
102 #include "llvm/IR/IRBuilder.h"
103 #include "llvm/IR/InlineAsm.h"
104 #include "llvm/IR/InstVisitor.h"
105 #include "llvm/IR/IntrinsicInst.h"
106 #include "llvm/IR/LLVMContext.h"
107 #include "llvm/IR/MDBuilder.h"
108 #include "llvm/IR/Module.h"
109 #include "llvm/IR/Type.h"
110 #include "llvm/IR/ValueMap.h"
112 #include "llvm/Support/Compiler.h"
113 #include "llvm/Support/Debug.h"
118 
119 using namespace llvm;
120 
121 #define DEBUG_TYPE "msan"
122 
123 static const unsigned kOriginSize = 4;
124 static const unsigned kMinOriginAlignment = 4;
125 static const unsigned kShadowTLSAlignment = 8;
126 
127 // These constants must be kept in sync with the ones in msan.h.
128 static const unsigned kParamTLSSize = 800;
129 static const unsigned kRetvalTLSSize = 800;
130 
131 // Accesses sizes are powers of two: 1, 2, 4, 8.
132 static const size_t kNumberOfAccessSizes = 4;
133 
134 /// \brief Track origins of uninitialized values.
135 ///
136 /// Adds a section to MemorySanitizer report that points to the allocation
137 /// (stack or heap) the uninitialized bits came from originally.
138 static cl::opt<int> ClTrackOrigins("msan-track-origins",
139  cl::desc("Track origins (allocation sites) of poisoned memory"),
140  cl::Hidden, cl::init(0));
141 static cl::opt<bool> ClKeepGoing("msan-keep-going",
142  cl::desc("keep going after reporting a UMR"),
143  cl::Hidden, cl::init(false));
144 static cl::opt<bool> ClPoisonStack("msan-poison-stack",
145  cl::desc("poison uninitialized stack variables"),
146  cl::Hidden, cl::init(true));
147 static cl::opt<bool> ClPoisonStackWithCall("msan-poison-stack-with-call",
148  cl::desc("poison uninitialized stack variables with a call"),
149  cl::Hidden, cl::init(false));
150 static cl::opt<int> ClPoisonStackPattern("msan-poison-stack-pattern",
151  cl::desc("poison uninitialized stack variables with the given patter"),
152  cl::Hidden, cl::init(0xff));
153 static cl::opt<bool> ClPoisonUndef("msan-poison-undef",
154  cl::desc("poison undef temps"),
155  cl::Hidden, cl::init(true));
156 
157 static cl::opt<bool> ClHandleICmp("msan-handle-icmp",
158  cl::desc("propagate shadow through ICmpEQ and ICmpNE"),
159  cl::Hidden, cl::init(true));
160 
161 static cl::opt<bool> ClHandleICmpExact("msan-handle-icmp-exact",
162  cl::desc("exact handling of relational integer ICmp"),
163  cl::Hidden, cl::init(false));
164 
165 // This flag controls whether we check the shadow of the address
166 // operand of load or store. Such bugs are very rare, since load from
167 // a garbage address typically results in SEGV, but still happen
168 // (e.g. only lower bits of address are garbage, or the access happens
169 // early at program startup where malloc-ed memory is more likely to
170 // be zeroed. As of 2012-08-28 this flag adds 20% slowdown.
171 static cl::opt<bool> ClCheckAccessAddress("msan-check-access-address",
172  cl::desc("report accesses through a pointer which has poisoned shadow"),
173  cl::Hidden, cl::init(true));
174 
175 static cl::opt<bool> ClDumpStrictInstructions("msan-dump-strict-instructions",
176  cl::desc("print out instructions with default strict semantics"),
177  cl::Hidden, cl::init(false));
178 
180  "msan-instrumentation-with-call-threshold",
181  cl::desc(
182  "If the function being instrumented requires more than "
183  "this number of checks and origin stores, use callbacks instead of "
184  "inline checks (-1 means never use callbacks)."),
185  cl::Hidden, cl::init(3500));
186 
187 // This is an experiment to enable handling of cases where shadow is a non-zero
188 // compile-time constant. For some unexplainable reason they were silently
189 // ignored in the instrumentation.
190 static cl::opt<bool> ClCheckConstantShadow("msan-check-constant-shadow",
191  cl::desc("Insert checks for constant shadow values"),
192  cl::Hidden, cl::init(false));
193 
194 static const char *const kMsanModuleCtorName = "msan.module_ctor";
195 static const char *const kMsanInitName = "__msan_init";
196 
197 namespace {
198 
199 // Memory map parameters used in application-to-shadow address calculation.
200 // Offset = (Addr & ~AndMask) ^ XorMask
201 // Shadow = ShadowBase + Offset
202 // Origin = OriginBase + Offset
203 struct MemoryMapParams {
204  uint64_t AndMask;
205  uint64_t XorMask;
206  uint64_t ShadowBase;
207  uint64_t OriginBase;
208 };
209 
210 struct PlatformMemoryMapParams {
211  const MemoryMapParams *bits32;
212  const MemoryMapParams *bits64;
213 };
214 
215 // i386 Linux
216 static const MemoryMapParams Linux_I386_MemoryMapParams = {
217  0x000080000000, // AndMask
218  0, // XorMask (not used)
219  0, // ShadowBase (not used)
220  0x000040000000, // OriginBase
221 };
222 
223 // x86_64 Linux
224 static const MemoryMapParams Linux_X86_64_MemoryMapParams = {
225  0x400000000000, // AndMask
226  0, // XorMask (not used)
227  0, // ShadowBase (not used)
228  0x200000000000, // OriginBase
229 };
230 
231 // mips64 Linux
232 static const MemoryMapParams Linux_MIPS64_MemoryMapParams = {
233  0x004000000000, // AndMask
234  0, // XorMask (not used)
235  0, // ShadowBase (not used)
236  0x002000000000, // OriginBase
237 };
238 
239 // ppc64 Linux
240 static const MemoryMapParams Linux_PowerPC64_MemoryMapParams = {
241  0x200000000000, // AndMask
242  0x100000000000, // XorMask
243  0x080000000000, // ShadowBase
244  0x1C0000000000, // OriginBase
245 };
246 
247 // i386 FreeBSD
248 static const MemoryMapParams FreeBSD_I386_MemoryMapParams = {
249  0x000180000000, // AndMask
250  0x000040000000, // XorMask
251  0x000020000000, // ShadowBase
252  0x000700000000, // OriginBase
253 };
254 
255 // x86_64 FreeBSD
256 static const MemoryMapParams FreeBSD_X86_64_MemoryMapParams = {
257  0xc00000000000, // AndMask
258  0x200000000000, // XorMask
259  0x100000000000, // ShadowBase
260  0x380000000000, // OriginBase
261 };
262 
263 static const PlatformMemoryMapParams Linux_X86_MemoryMapParams = {
264  &Linux_I386_MemoryMapParams,
265  &Linux_X86_64_MemoryMapParams,
266 };
267 
268 static const PlatformMemoryMapParams Linux_MIPS_MemoryMapParams = {
269  NULL,
270  &Linux_MIPS64_MemoryMapParams,
271 };
272 
273 static const PlatformMemoryMapParams Linux_PowerPC_MemoryMapParams = {
274  NULL,
275  &Linux_PowerPC64_MemoryMapParams,
276 };
277 
278 static const PlatformMemoryMapParams FreeBSD_X86_MemoryMapParams = {
279  &FreeBSD_I386_MemoryMapParams,
280  &FreeBSD_X86_64_MemoryMapParams,
281 };
282 
283 /// \brief An instrumentation pass implementing detection of uninitialized
284 /// reads.
285 ///
286 /// MemorySanitizer: instrument the code in module to find
287 /// uninitialized reads.
288 class MemorySanitizer : public FunctionPass {
289  public:
290  MemorySanitizer(int TrackOrigins = 0)
291  : FunctionPass(ID),
292  TrackOrigins(std::max(TrackOrigins, (int)ClTrackOrigins)),
293  WarningFn(nullptr) {}
294  const char *getPassName() const override { return "MemorySanitizer"; }
295  bool runOnFunction(Function &F) override;
296  bool doInitialization(Module &M) override;
297  static char ID; // Pass identification, replacement for typeid.
298 
299  private:
300  void initializeCallbacks(Module &M);
301 
302  /// \brief Track origins (allocation points) of uninitialized values.
303  int TrackOrigins;
304 
305  LLVMContext *C;
306  Type *IntptrTy;
307  Type *OriginTy;
308  /// \brief Thread-local shadow storage for function parameters.
309  GlobalVariable *ParamTLS;
310  /// \brief Thread-local origin storage for function parameters.
311  GlobalVariable *ParamOriginTLS;
312  /// \brief Thread-local shadow storage for function return value.
313  GlobalVariable *RetvalTLS;
314  /// \brief Thread-local origin storage for function return value.
315  GlobalVariable *RetvalOriginTLS;
316  /// \brief Thread-local shadow storage for in-register va_arg function
317  /// parameters (x86_64-specific).
318  GlobalVariable *VAArgTLS;
319  /// \brief Thread-local shadow storage for va_arg overflow area
320  /// (x86_64-specific).
321  GlobalVariable *VAArgOverflowSizeTLS;
322  /// \brief Thread-local space used to pass origin value to the UMR reporting
323  /// function.
324  GlobalVariable *OriginTLS;
325 
326  /// \brief The run-time callback to print a warning.
327  Value *WarningFn;
328  // These arrays are indexed by log2(AccessSize).
329  Value *MaybeWarningFn[kNumberOfAccessSizes];
330  Value *MaybeStoreOriginFn[kNumberOfAccessSizes];
331 
332  /// \brief Run-time helper that generates a new origin value for a stack
333  /// allocation.
334  Value *MsanSetAllocaOrigin4Fn;
335  /// \brief Run-time helper that poisons stack on function entry.
336  Value *MsanPoisonStackFn;
337  /// \brief Run-time helper that records a store (or any event) of an
338  /// uninitialized value and returns an updated origin id encoding this info.
339  Value *MsanChainOriginFn;
340  /// \brief MSan runtime replacements for memmove, memcpy and memset.
341  Value *MemmoveFn, *MemcpyFn, *MemsetFn;
342 
343  /// \brief Memory map parameters used in application-to-shadow calculation.
344  const MemoryMapParams *MapParams;
345 
346  MDNode *ColdCallWeights;
347  /// \brief Branch weights for origin store.
348  MDNode *OriginStoreWeights;
349  /// \brief An empty volatile inline asm that prevents callback merge.
350  InlineAsm *EmptyAsm;
351  Function *MsanCtorFunction;
352 
353  friend struct MemorySanitizerVisitor;
354  friend struct VarArgAMD64Helper;
355  friend struct VarArgMIPS64Helper;
356 };
357 } // namespace
358 
359 char MemorySanitizer::ID = 0;
360 INITIALIZE_PASS(MemorySanitizer, "msan",
361  "MemorySanitizer: detects uninitialized reads.",
362  false, false)
363 
364 FunctionPass *llvm::createMemorySanitizerPass(int TrackOrigins) {
365  return new MemorySanitizer(TrackOrigins);
366 }
367 
368 /// \brief Create a non-const global initialized with the given string.
369 ///
370 /// Creates a writable global for Str so that we can pass it to the
371 /// run-time lib. Runtime uses first 4 bytes of the string to store the
372 /// frame ID, so the string needs to be mutable.
374  StringRef Str) {
375  Constant *StrConst = ConstantDataArray::getString(M.getContext(), Str);
376  return new GlobalVariable(M, StrConst->getType(), /*isConstant=*/false,
377  GlobalValue::PrivateLinkage, StrConst, "");
378 }
379 
380 
381 /// \brief Insert extern declaration of runtime-provided functions and globals.
382 void MemorySanitizer::initializeCallbacks(Module &M) {
383  // Only do this once.
384  if (WarningFn)
385  return;
386 
387  IRBuilder<> IRB(*C);
388  // Create the callback.
389  // FIXME: this function should have "Cold" calling conv,
390  // which is not yet implemented.
391  StringRef WarningFnName = ClKeepGoing ? "__msan_warning"
392  : "__msan_warning_noreturn";
393  WarningFn = M.getOrInsertFunction(WarningFnName, IRB.getVoidTy(), nullptr);
394 
395  for (size_t AccessSizeIndex = 0; AccessSizeIndex < kNumberOfAccessSizes;
396  AccessSizeIndex++) {
397  unsigned AccessSize = 1 << AccessSizeIndex;
398  std::string FunctionName = "__msan_maybe_warning_" + itostr(AccessSize);
399  MaybeWarningFn[AccessSizeIndex] = M.getOrInsertFunction(
400  FunctionName, IRB.getVoidTy(), IRB.getIntNTy(AccessSize * 8),
401  IRB.getInt32Ty(), nullptr);
402 
403  FunctionName = "__msan_maybe_store_origin_" + itostr(AccessSize);
404  MaybeStoreOriginFn[AccessSizeIndex] = M.getOrInsertFunction(
405  FunctionName, IRB.getVoidTy(), IRB.getIntNTy(AccessSize * 8),
406  IRB.getInt8PtrTy(), IRB.getInt32Ty(), nullptr);
407  }
408 
409  MsanSetAllocaOrigin4Fn = M.getOrInsertFunction(
410  "__msan_set_alloca_origin4", IRB.getVoidTy(), IRB.getInt8PtrTy(), IntptrTy,
411  IRB.getInt8PtrTy(), IntptrTy, nullptr);
412  MsanPoisonStackFn =
413  M.getOrInsertFunction("__msan_poison_stack", IRB.getVoidTy(),
414  IRB.getInt8PtrTy(), IntptrTy, nullptr);
415  MsanChainOriginFn = M.getOrInsertFunction(
416  "__msan_chain_origin", IRB.getInt32Ty(), IRB.getInt32Ty(), nullptr);
417  MemmoveFn = M.getOrInsertFunction(
418  "__msan_memmove", IRB.getInt8PtrTy(), IRB.getInt8PtrTy(),
419  IRB.getInt8PtrTy(), IntptrTy, nullptr);
420  MemcpyFn = M.getOrInsertFunction(
421  "__msan_memcpy", IRB.getInt8PtrTy(), IRB.getInt8PtrTy(), IRB.getInt8PtrTy(),
422  IntptrTy, nullptr);
423  MemsetFn = M.getOrInsertFunction(
424  "__msan_memset", IRB.getInt8PtrTy(), IRB.getInt8PtrTy(), IRB.getInt32Ty(),
425  IntptrTy, nullptr);
426 
427  // Create globals.
428  RetvalTLS = new GlobalVariable(
429  M, ArrayType::get(IRB.getInt64Ty(), kRetvalTLSSize / 8), false,
430  GlobalVariable::ExternalLinkage, nullptr, "__msan_retval_tls", nullptr,
432  RetvalOriginTLS = new GlobalVariable(
433  M, OriginTy, false, GlobalVariable::ExternalLinkage, nullptr,
434  "__msan_retval_origin_tls", nullptr, GlobalVariable::InitialExecTLSModel);
435 
436  ParamTLS = new GlobalVariable(
437  M, ArrayType::get(IRB.getInt64Ty(), kParamTLSSize / 8), false,
438  GlobalVariable::ExternalLinkage, nullptr, "__msan_param_tls", nullptr,
440  ParamOriginTLS = new GlobalVariable(
441  M, ArrayType::get(OriginTy, kParamTLSSize / 4), false,
442  GlobalVariable::ExternalLinkage, nullptr, "__msan_param_origin_tls",
444 
445  VAArgTLS = new GlobalVariable(
446  M, ArrayType::get(IRB.getInt64Ty(), kParamTLSSize / 8), false,
447  GlobalVariable::ExternalLinkage, nullptr, "__msan_va_arg_tls", nullptr,
449  VAArgOverflowSizeTLS = new GlobalVariable(
450  M, IRB.getInt64Ty(), false, GlobalVariable::ExternalLinkage, nullptr,
451  "__msan_va_arg_overflow_size_tls", nullptr,
453  OriginTLS = new GlobalVariable(
454  M, IRB.getInt32Ty(), false, GlobalVariable::ExternalLinkage, nullptr,
455  "__msan_origin_tls", nullptr, GlobalVariable::InitialExecTLSModel);
456 
457  // We insert an empty inline asm after __msan_report* to avoid callback merge.
458  EmptyAsm = InlineAsm::get(FunctionType::get(IRB.getVoidTy(), false),
459  StringRef(""), StringRef(""),
460  /*hasSideEffects=*/true);
461 }
462 
463 /// \brief Module-level initialization.
464 ///
465 /// inserts a call to __msan_init to the module's constructor list.
466 bool MemorySanitizer::doInitialization(Module &M) {
467  auto &DL = M.getDataLayout();
468 
469  Triple TargetTriple(M.getTargetTriple());
470  switch (TargetTriple.getOS()) {
471  case Triple::FreeBSD:
472  switch (TargetTriple.getArch()) {
473  case Triple::x86_64:
474  MapParams = FreeBSD_X86_MemoryMapParams.bits64;
475  break;
476  case Triple::x86:
477  MapParams = FreeBSD_X86_MemoryMapParams.bits32;
478  break;
479  default:
480  report_fatal_error("unsupported architecture");
481  }
482  break;
483  case Triple::Linux:
484  switch (TargetTriple.getArch()) {
485  case Triple::x86_64:
486  MapParams = Linux_X86_MemoryMapParams.bits64;
487  break;
488  case Triple::x86:
489  MapParams = Linux_X86_MemoryMapParams.bits32;
490  break;
491  case Triple::mips64:
492  case Triple::mips64el:
493  MapParams = Linux_MIPS_MemoryMapParams.bits64;
494  break;
495  case Triple::ppc64:
496  case Triple::ppc64le:
497  MapParams = Linux_PowerPC_MemoryMapParams.bits64;
498  break;
499  default:
500  report_fatal_error("unsupported architecture");
501  }
502  break;
503  default:
504  report_fatal_error("unsupported operating system");
505  }
506 
507  C = &(M.getContext());
508  IRBuilder<> IRB(*C);
509  IntptrTy = IRB.getIntPtrTy(DL);
510  OriginTy = IRB.getInt32Ty();
511 
512  ColdCallWeights = MDBuilder(*C).createBranchWeights(1, 1000);
513  OriginStoreWeights = MDBuilder(*C).createBranchWeights(1, 1000);
514 
515  std::tie(MsanCtorFunction, std::ignore) =
517  /*InitArgTypes=*/{},
518  /*InitArgs=*/{});
519 
520  appendToGlobalCtors(M, MsanCtorFunction, 0);
521 
522  if (TrackOrigins)
523  new GlobalVariable(M, IRB.getInt32Ty(), true, GlobalValue::WeakODRLinkage,
524  IRB.getInt32(TrackOrigins), "__msan_track_origins");
525 
526  if (ClKeepGoing)
527  new GlobalVariable(M, IRB.getInt32Ty(), true, GlobalValue::WeakODRLinkage,
528  IRB.getInt32(ClKeepGoing), "__msan_keep_going");
529 
530  return true;
531 }
532 
533 namespace {
534 
535 /// \brief A helper class that handles instrumentation of VarArg
536 /// functions on a particular platform.
537 ///
538 /// Implementations are expected to insert the instrumentation
539 /// necessary to propagate argument shadow through VarArg function
540 /// calls. Visit* methods are called during an InstVisitor pass over
541 /// the function, and should avoid creating new basic blocks. A new
542 /// instance of this class is created for each instrumented function.
543 struct VarArgHelper {
544  /// \brief Visit a CallSite.
545  virtual void visitCallSite(CallSite &CS, IRBuilder<> &IRB) = 0;
546 
547  /// \brief Visit a va_start call.
548  virtual void visitVAStartInst(VAStartInst &I) = 0;
549 
550  /// \brief Visit a va_copy call.
551  virtual void visitVACopyInst(VACopyInst &I) = 0;
552 
553  /// \brief Finalize function instrumentation.
554  ///
555  /// This method is called after visiting all interesting (see above)
556  /// instructions in a function.
557  virtual void finalizeInstrumentation() = 0;
558 
559  virtual ~VarArgHelper() {}
560 };
561 
562 struct MemorySanitizerVisitor;
563 
564 VarArgHelper*
565 CreateVarArgHelper(Function &Func, MemorySanitizer &Msan,
566  MemorySanitizerVisitor &Visitor);
567 
568 unsigned TypeSizeToSizeIndex(unsigned TypeSize) {
569  if (TypeSize <= 8) return 0;
570  return Log2_32_Ceil(TypeSize / 8);
571 }
572 
573 /// This class does all the work for a given function. Store and Load
574 /// instructions store and load corresponding shadow and origin
575 /// values. Most instructions propagate shadow from arguments to their
576 /// return values. Certain instructions (most importantly, BranchInst)
577 /// test their argument shadow and print reports (with a runtime call) if it's
578 /// non-zero.
579 struct MemorySanitizerVisitor : public InstVisitor<MemorySanitizerVisitor> {
580  Function &F;
581  MemorySanitizer &MS;
582  SmallVector<PHINode *, 16> ShadowPHINodes, OriginPHINodes;
583  ValueMap<Value*, Value*> ShadowMap, OriginMap;
584  std::unique_ptr<VarArgHelper> VAHelper;
585 
586  // The following flags disable parts of MSan instrumentation based on
587  // blacklist contents and command-line options.
588  bool InsertChecks;
589  bool PropagateShadow;
590  bool PoisonStack;
591  bool PoisonUndef;
592  bool CheckReturnValue;
593 
594  struct ShadowOriginAndInsertPoint {
595  Value *Shadow;
596  Value *Origin;
597  Instruction *OrigIns;
598  ShadowOriginAndInsertPoint(Value *S, Value *O, Instruction *I)
599  : Shadow(S), Origin(O), OrigIns(I) { }
600  };
603 
604  MemorySanitizerVisitor(Function &F, MemorySanitizer &MS)
605  : F(F), MS(MS), VAHelper(CreateVarArgHelper(F, MS, *this)) {
606  bool SanitizeFunction = F.hasFnAttribute(Attribute::SanitizeMemory);
607  InsertChecks = SanitizeFunction;
608  PropagateShadow = SanitizeFunction;
609  PoisonStack = SanitizeFunction && ClPoisonStack;
610  PoisonUndef = SanitizeFunction && ClPoisonUndef;
611  // FIXME: Consider using SpecialCaseList to specify a list of functions that
612  // must always return fully initialized values. For now, we hardcode "main".
613  CheckReturnValue = SanitizeFunction && (F.getName() == "main");
614 
615  DEBUG(if (!InsertChecks)
616  dbgs() << "MemorySanitizer is not inserting checks into '"
617  << F.getName() << "'\n");
618  }
619 
620  Value *updateOrigin(Value *V, IRBuilder<> &IRB) {
621  if (MS.TrackOrigins <= 1) return V;
622  return IRB.CreateCall(MS.MsanChainOriginFn, V);
623  }
624 
625  Value *originToIntptr(IRBuilder<> &IRB, Value *Origin) {
626  const DataLayout &DL = F.getParent()->getDataLayout();
627  unsigned IntptrSize = DL.getTypeStoreSize(MS.IntptrTy);
628  if (IntptrSize == kOriginSize) return Origin;
629  assert(IntptrSize == kOriginSize * 2);
630  Origin = IRB.CreateIntCast(Origin, MS.IntptrTy, /* isSigned */ false);
631  return IRB.CreateOr(Origin, IRB.CreateShl(Origin, kOriginSize * 8));
632  }
633 
634  /// \brief Fill memory range with the given origin value.
635  void paintOrigin(IRBuilder<> &IRB, Value *Origin, Value *OriginPtr,
636  unsigned Size, unsigned Alignment) {
637  const DataLayout &DL = F.getParent()->getDataLayout();
638  unsigned IntptrAlignment = DL.getABITypeAlignment(MS.IntptrTy);
639  unsigned IntptrSize = DL.getTypeStoreSize(MS.IntptrTy);
640  assert(IntptrAlignment >= kMinOriginAlignment);
641  assert(IntptrSize >= kOriginSize);
642 
643  unsigned Ofs = 0;
644  unsigned CurrentAlignment = Alignment;
645  if (Alignment >= IntptrAlignment && IntptrSize > kOriginSize) {
646  Value *IntptrOrigin = originToIntptr(IRB, Origin);
647  Value *IntptrOriginPtr =
648  IRB.CreatePointerCast(OriginPtr, PointerType::get(MS.IntptrTy, 0));
649  for (unsigned i = 0; i < Size / IntptrSize; ++i) {
650  Value *Ptr = i ? IRB.CreateConstGEP1_32(MS.IntptrTy, IntptrOriginPtr, i)
651  : IntptrOriginPtr;
652  IRB.CreateAlignedStore(IntptrOrigin, Ptr, CurrentAlignment);
653  Ofs += IntptrSize / kOriginSize;
654  CurrentAlignment = IntptrAlignment;
655  }
656  }
657 
658  for (unsigned i = Ofs; i < (Size + kOriginSize - 1) / kOriginSize; ++i) {
659  Value *GEP =
660  i ? IRB.CreateConstGEP1_32(nullptr, OriginPtr, i) : OriginPtr;
661  IRB.CreateAlignedStore(Origin, GEP, CurrentAlignment);
662  CurrentAlignment = kMinOriginAlignment;
663  }
664  }
665 
666  void storeOrigin(IRBuilder<> &IRB, Value *Addr, Value *Shadow, Value *Origin,
667  unsigned Alignment, bool AsCall) {
668  const DataLayout &DL = F.getParent()->getDataLayout();
669  unsigned OriginAlignment = std::max(kMinOriginAlignment, Alignment);
670  unsigned StoreSize = DL.getTypeStoreSize(Shadow->getType());
671  if (isa<StructType>(Shadow->getType())) {
672  paintOrigin(IRB, updateOrigin(Origin, IRB),
673  getOriginPtr(Addr, IRB, Alignment), StoreSize,
674  OriginAlignment);
675  } else {
676  Value *ConvertedShadow = convertToShadowTyNoVec(Shadow, IRB);
677  Constant *ConstantShadow = dyn_cast_or_null<Constant>(ConvertedShadow);
678  if (ConstantShadow) {
679  if (ClCheckConstantShadow && !ConstantShadow->isZeroValue())
680  paintOrigin(IRB, updateOrigin(Origin, IRB),
681  getOriginPtr(Addr, IRB, Alignment), StoreSize,
682  OriginAlignment);
683  return;
684  }
685 
686  unsigned TypeSizeInBits =
687  DL.getTypeSizeInBits(ConvertedShadow->getType());
688  unsigned SizeIndex = TypeSizeToSizeIndex(TypeSizeInBits);
689  if (AsCall && SizeIndex < kNumberOfAccessSizes) {
690  Value *Fn = MS.MaybeStoreOriginFn[SizeIndex];
691  Value *ConvertedShadow2 = IRB.CreateZExt(
692  ConvertedShadow, IRB.getIntNTy(8 * (1 << SizeIndex)));
693  IRB.CreateCall(Fn, {ConvertedShadow2,
694  IRB.CreatePointerCast(Addr, IRB.getInt8PtrTy()),
695  Origin});
696  } else {
697  Value *Cmp = IRB.CreateICmpNE(
698  ConvertedShadow, getCleanShadow(ConvertedShadow), "_mscmp");
700  Cmp, IRB.GetInsertPoint(), false, MS.OriginStoreWeights);
701  IRBuilder<> IRBNew(CheckTerm);
702  paintOrigin(IRBNew, updateOrigin(Origin, IRBNew),
703  getOriginPtr(Addr, IRBNew, Alignment), StoreSize,
704  OriginAlignment);
705  }
706  }
707  }
708 
709  void materializeStores(bool InstrumentWithCalls) {
710  for (auto Inst : StoreList) {
711  StoreInst &SI = *dyn_cast<StoreInst>(Inst);
712 
713  IRBuilder<> IRB(&SI);
714  Value *Val = SI.getValueOperand();
715  Value *Addr = SI.getPointerOperand();
716  Value *Shadow = SI.isAtomic() ? getCleanShadow(Val) : getShadow(Val);
717  Value *ShadowPtr = getShadowPtr(Addr, Shadow->getType(), IRB);
718 
719  StoreInst *NewSI =
720  IRB.CreateAlignedStore(Shadow, ShadowPtr, SI.getAlignment());
721  DEBUG(dbgs() << " STORE: " << *NewSI << "\n");
722  (void)NewSI;
723 
724  if (ClCheckAccessAddress) insertShadowCheck(Addr, &SI);
725 
726  if (SI.isAtomic()) SI.setOrdering(addReleaseOrdering(SI.getOrdering()));
727 
728  if (MS.TrackOrigins && !SI.isAtomic())
729  storeOrigin(IRB, Addr, Shadow, getOrigin(Val), SI.getAlignment(),
730  InstrumentWithCalls);
731  }
732  }
733 
734  void materializeOneCheck(Instruction *OrigIns, Value *Shadow, Value *Origin,
735  bool AsCall) {
736  IRBuilder<> IRB(OrigIns);
737  DEBUG(dbgs() << " SHAD0 : " << *Shadow << "\n");
738  Value *ConvertedShadow = convertToShadowTyNoVec(Shadow, IRB);
739  DEBUG(dbgs() << " SHAD1 : " << *ConvertedShadow << "\n");
740 
741  Constant *ConstantShadow = dyn_cast_or_null<Constant>(ConvertedShadow);
742  if (ConstantShadow) {
743  if (ClCheckConstantShadow && !ConstantShadow->isZeroValue()) {
744  if (MS.TrackOrigins) {
745  IRB.CreateStore(Origin ? (Value *)Origin : (Value *)IRB.getInt32(0),
746  MS.OriginTLS);
747  }
748  IRB.CreateCall(MS.WarningFn, {});
749  IRB.CreateCall(MS.EmptyAsm, {});
750  // FIXME: Insert UnreachableInst if !ClKeepGoing?
751  // This may invalidate some of the following checks and needs to be done
752  // at the very end.
753  }
754  return;
755  }
756 
757  const DataLayout &DL = OrigIns->getModule()->getDataLayout();
758 
759  unsigned TypeSizeInBits = DL.getTypeSizeInBits(ConvertedShadow->getType());
760  unsigned SizeIndex = TypeSizeToSizeIndex(TypeSizeInBits);
761  if (AsCall && SizeIndex < kNumberOfAccessSizes) {
762  Value *Fn = MS.MaybeWarningFn[SizeIndex];
763  Value *ConvertedShadow2 =
764  IRB.CreateZExt(ConvertedShadow, IRB.getIntNTy(8 * (1 << SizeIndex)));
765  IRB.CreateCall(Fn, {ConvertedShadow2, MS.TrackOrigins && Origin
766  ? Origin
767  : (Value *)IRB.getInt32(0)});
768  } else {
769  Value *Cmp = IRB.CreateICmpNE(ConvertedShadow,
770  getCleanShadow(ConvertedShadow), "_mscmp");
772  Cmp, OrigIns,
773  /* Unreachable */ !ClKeepGoing, MS.ColdCallWeights);
774 
775  IRB.SetInsertPoint(CheckTerm);
776  if (MS.TrackOrigins) {
777  IRB.CreateStore(Origin ? (Value *)Origin : (Value *)IRB.getInt32(0),
778  MS.OriginTLS);
779  }
780  IRB.CreateCall(MS.WarningFn, {});
781  IRB.CreateCall(MS.EmptyAsm, {});
782  DEBUG(dbgs() << " CHECK: " << *Cmp << "\n");
783  }
784  }
785 
786  void materializeChecks(bool InstrumentWithCalls) {
787  for (const auto &ShadowData : InstrumentationList) {
788  Instruction *OrigIns = ShadowData.OrigIns;
789  Value *Shadow = ShadowData.Shadow;
790  Value *Origin = ShadowData.Origin;
791  materializeOneCheck(OrigIns, Shadow, Origin, InstrumentWithCalls);
792  }
793  DEBUG(dbgs() << "DONE:\n" << F);
794  }
795 
796  /// \brief Add MemorySanitizer instrumentation to a function.
797  bool runOnFunction() {
798  MS.initializeCallbacks(*F.getParent());
799 
800  // In the presence of unreachable blocks, we may see Phi nodes with
801  // incoming nodes from such blocks. Since InstVisitor skips unreachable
802  // blocks, such nodes will not have any shadow value associated with them.
803  // It's easier to remove unreachable blocks than deal with missing shadow.
805 
806  // Iterate all BBs in depth-first order and create shadow instructions
807  // for all instructions (where applicable).
808  // For PHI nodes we create dummy shadow PHIs which will be finalized later.
809  for (BasicBlock *BB : depth_first(&F.getEntryBlock()))
810  visit(*BB);
811 
812 
813  // Finalize PHI nodes.
814  for (PHINode *PN : ShadowPHINodes) {
815  PHINode *PNS = cast<PHINode>(getShadow(PN));
816  PHINode *PNO = MS.TrackOrigins ? cast<PHINode>(getOrigin(PN)) : nullptr;
817  size_t NumValues = PN->getNumIncomingValues();
818  for (size_t v = 0; v < NumValues; v++) {
819  PNS->addIncoming(getShadow(PN, v), PN->getIncomingBlock(v));
820  if (PNO) PNO->addIncoming(getOrigin(PN, v), PN->getIncomingBlock(v));
821  }
822  }
823 
824  VAHelper->finalizeInstrumentation();
825 
826  bool InstrumentWithCalls = ClInstrumentationWithCallThreshold >= 0 &&
827  InstrumentationList.size() + StoreList.size() >
829 
830  // Delayed instrumentation of StoreInst.
831  // This may add new checks to be inserted later.
832  materializeStores(InstrumentWithCalls);
833 
834  // Insert shadow value checks.
835  materializeChecks(InstrumentWithCalls);
836 
837  return true;
838  }
839 
840  /// \brief Compute the shadow type that corresponds to a given Value.
841  Type *getShadowTy(Value *V) {
842  return getShadowTy(V->getType());
843  }
844 
845  /// \brief Compute the shadow type that corresponds to a given Type.
846  Type *getShadowTy(Type *OrigTy) {
847  if (!OrigTy->isSized()) {
848  return nullptr;
849  }
850  // For integer type, shadow is the same as the original type.
851  // This may return weird-sized types like i1.
852  if (IntegerType *IT = dyn_cast<IntegerType>(OrigTy))
853  return IT;
854  const DataLayout &DL = F.getParent()->getDataLayout();
855  if (VectorType *VT = dyn_cast<VectorType>(OrigTy)) {
856  uint32_t EltSize = DL.getTypeSizeInBits(VT->getElementType());
857  return VectorType::get(IntegerType::get(*MS.C, EltSize),
858  VT->getNumElements());
859  }
860  if (ArrayType *AT = dyn_cast<ArrayType>(OrigTy)) {
861  return ArrayType::get(getShadowTy(AT->getElementType()),
862  AT->getNumElements());
863  }
864  if (StructType *ST = dyn_cast<StructType>(OrigTy)) {
865  SmallVector<Type*, 4> Elements;
866  for (unsigned i = 0, n = ST->getNumElements(); i < n; i++)
867  Elements.push_back(getShadowTy(ST->getElementType(i)));
868  StructType *Res = StructType::get(*MS.C, Elements, ST->isPacked());
869  DEBUG(dbgs() << "getShadowTy: " << *ST << " ===> " << *Res << "\n");
870  return Res;
871  }
872  uint32_t TypeSize = DL.getTypeSizeInBits(OrigTy);
873  return IntegerType::get(*MS.C, TypeSize);
874  }
875 
876  /// \brief Flatten a vector type.
877  Type *getShadowTyNoVec(Type *ty) {
878  if (VectorType *vt = dyn_cast<VectorType>(ty))
879  return IntegerType::get(*MS.C, vt->getBitWidth());
880  return ty;
881  }
882 
883  /// \brief Convert a shadow value to it's flattened variant.
884  Value *convertToShadowTyNoVec(Value *V, IRBuilder<> &IRB) {
885  Type *Ty = V->getType();
886  Type *NoVecTy = getShadowTyNoVec(Ty);
887  if (Ty == NoVecTy) return V;
888  return IRB.CreateBitCast(V, NoVecTy);
889  }
890 
891  /// \brief Compute the integer shadow offset that corresponds to a given
892  /// application address.
893  ///
894  /// Offset = (Addr & ~AndMask) ^ XorMask
895  Value *getShadowPtrOffset(Value *Addr, IRBuilder<> &IRB) {
896  uint64_t AndMask = MS.MapParams->AndMask;
897  assert(AndMask != 0 && "AndMask shall be specified");
898  Value *OffsetLong =
899  IRB.CreateAnd(IRB.CreatePointerCast(Addr, MS.IntptrTy),
900  ConstantInt::get(MS.IntptrTy, ~AndMask));
901 
902  uint64_t XorMask = MS.MapParams->XorMask;
903  if (XorMask != 0)
904  OffsetLong = IRB.CreateXor(OffsetLong,
905  ConstantInt::get(MS.IntptrTy, XorMask));
906  return OffsetLong;
907  }
908 
909  /// \brief Compute the shadow address that corresponds to a given application
910  /// address.
911  ///
912  /// Shadow = ShadowBase + Offset
913  Value *getShadowPtr(Value *Addr, Type *ShadowTy,
914  IRBuilder<> &IRB) {
915  Value *ShadowLong = getShadowPtrOffset(Addr, IRB);
916  uint64_t ShadowBase = MS.MapParams->ShadowBase;
917  if (ShadowBase != 0)
918  ShadowLong =
919  IRB.CreateAdd(ShadowLong,
920  ConstantInt::get(MS.IntptrTy, ShadowBase));
921  return IRB.CreateIntToPtr(ShadowLong, PointerType::get(ShadowTy, 0));
922  }
923 
924  /// \brief Compute the origin address that corresponds to a given application
925  /// address.
926  ///
927  /// OriginAddr = (OriginBase + Offset) & ~3ULL
928  Value *getOriginPtr(Value *Addr, IRBuilder<> &IRB, unsigned Alignment) {
929  Value *OriginLong = getShadowPtrOffset(Addr, IRB);
930  uint64_t OriginBase = MS.MapParams->OriginBase;
931  if (OriginBase != 0)
932  OriginLong =
933  IRB.CreateAdd(OriginLong,
934  ConstantInt::get(MS.IntptrTy, OriginBase));
935  if (Alignment < kMinOriginAlignment) {
936  uint64_t Mask = kMinOriginAlignment - 1;
937  OriginLong = IRB.CreateAnd(OriginLong,
938  ConstantInt::get(MS.IntptrTy, ~Mask));
939  }
940  return IRB.CreateIntToPtr(OriginLong,
941  PointerType::get(IRB.getInt32Ty(), 0));
942  }
943 
944  /// \brief Compute the shadow address for a given function argument.
945  ///
946  /// Shadow = ParamTLS+ArgOffset.
947  Value *getShadowPtrForArgument(Value *A, IRBuilder<> &IRB,
948  int ArgOffset) {
949  Value *Base = IRB.CreatePointerCast(MS.ParamTLS, MS.IntptrTy);
950  Base = IRB.CreateAdd(Base, ConstantInt::get(MS.IntptrTy, ArgOffset));
951  return IRB.CreateIntToPtr(Base, PointerType::get(getShadowTy(A), 0),
952  "_msarg");
953  }
954 
955  /// \brief Compute the origin address for a given function argument.
956  Value *getOriginPtrForArgument(Value *A, IRBuilder<> &IRB,
957  int ArgOffset) {
958  if (!MS.TrackOrigins) return nullptr;
959  Value *Base = IRB.CreatePointerCast(MS.ParamOriginTLS, MS.IntptrTy);
960  Base = IRB.CreateAdd(Base, ConstantInt::get(MS.IntptrTy, ArgOffset));
961  return IRB.CreateIntToPtr(Base, PointerType::get(MS.OriginTy, 0),
962  "_msarg_o");
963  }
964 
965  /// \brief Compute the shadow address for a retval.
966  Value *getShadowPtrForRetval(Value *A, IRBuilder<> &IRB) {
967  Value *Base = IRB.CreatePointerCast(MS.RetvalTLS, MS.IntptrTy);
968  return IRB.CreateIntToPtr(Base, PointerType::get(getShadowTy(A), 0),
969  "_msret");
970  }
971 
972  /// \brief Compute the origin address for a retval.
973  Value *getOriginPtrForRetval(IRBuilder<> &IRB) {
974  // We keep a single origin for the entire retval. Might be too optimistic.
975  return MS.RetvalOriginTLS;
976  }
977 
978  /// \brief Set SV to be the shadow value for V.
979  void setShadow(Value *V, Value *SV) {
980  assert(!ShadowMap.count(V) && "Values may only have one shadow");
981  ShadowMap[V] = PropagateShadow ? SV : getCleanShadow(V);
982  }
983 
984  /// \brief Set Origin to be the origin value for V.
985  void setOrigin(Value *V, Value *Origin) {
986  if (!MS.TrackOrigins) return;
987  assert(!OriginMap.count(V) && "Values may only have one origin");
988  DEBUG(dbgs() << "ORIGIN: " << *V << " ==> " << *Origin << "\n");
989  OriginMap[V] = Origin;
990  }
991 
992  /// \brief Create a clean shadow value for a given value.
993  ///
994  /// Clean shadow (all zeroes) means all bits of the value are defined
995  /// (initialized).
996  Constant *getCleanShadow(Value *V) {
997  Type *ShadowTy = getShadowTy(V);
998  if (!ShadowTy)
999  return nullptr;
1000  return Constant::getNullValue(ShadowTy);
1001  }
1002 
1003  /// \brief Create a dirty shadow of a given shadow type.
1004  Constant *getPoisonedShadow(Type *ShadowTy) {
1005  assert(ShadowTy);
1006  if (isa<IntegerType>(ShadowTy) || isa<VectorType>(ShadowTy))
1007  return Constant::getAllOnesValue(ShadowTy);
1008  if (ArrayType *AT = dyn_cast<ArrayType>(ShadowTy)) {
1009  SmallVector<Constant *, 4> Vals(AT->getNumElements(),
1010  getPoisonedShadow(AT->getElementType()));
1011  return ConstantArray::get(AT, Vals);
1012  }
1013  if (StructType *ST = dyn_cast<StructType>(ShadowTy)) {
1015  for (unsigned i = 0, n = ST->getNumElements(); i < n; i++)
1016  Vals.push_back(getPoisonedShadow(ST->getElementType(i)));
1017  return ConstantStruct::get(ST, Vals);
1018  }
1019  llvm_unreachable("Unexpected shadow type");
1020  }
1021 
1022  /// \brief Create a dirty shadow for a given value.
1023  Constant *getPoisonedShadow(Value *V) {
1024  Type *ShadowTy = getShadowTy(V);
1025  if (!ShadowTy)
1026  return nullptr;
1027  return getPoisonedShadow(ShadowTy);
1028  }
1029 
1030  /// \brief Create a clean (zero) origin.
1031  Value *getCleanOrigin() {
1032  return Constant::getNullValue(MS.OriginTy);
1033  }
1034 
1035  /// \brief Get the shadow value for a given Value.
1036  ///
1037  /// This function either returns the value set earlier with setShadow,
1038  /// or extracts if from ParamTLS (for function arguments).
1039  Value *getShadow(Value *V) {
1040  if (!PropagateShadow) return getCleanShadow(V);
1041  if (Instruction *I = dyn_cast<Instruction>(V)) {
1042  // For instructions the shadow is already stored in the map.
1043  Value *Shadow = ShadowMap[V];
1044  if (!Shadow) {
1045  DEBUG(dbgs() << "No shadow: " << *V << "\n" << *(I->getParent()));
1046  (void)I;
1047  assert(Shadow && "No shadow for a value");
1048  }
1049  return Shadow;
1050  }
1051  if (UndefValue *U = dyn_cast<UndefValue>(V)) {
1052  Value *AllOnes = PoisonUndef ? getPoisonedShadow(V) : getCleanShadow(V);
1053  DEBUG(dbgs() << "Undef: " << *U << " ==> " << *AllOnes << "\n");
1054  (void)U;
1055  return AllOnes;
1056  }
1057  if (Argument *A = dyn_cast<Argument>(V)) {
1058  // For arguments we compute the shadow on demand and store it in the map.
1059  Value **ShadowPtr = &ShadowMap[V];
1060  if (*ShadowPtr)
1061  return *ShadowPtr;
1062  Function *F = A->getParent();
1063  IRBuilder<> EntryIRB(F->getEntryBlock().getFirstNonPHI());
1064  unsigned ArgOffset = 0;
1065  const DataLayout &DL = F->getParent()->getDataLayout();
1066  for (auto &FArg : F->args()) {
1067  if (!FArg.getType()->isSized()) {
1068  DEBUG(dbgs() << "Arg is not sized\n");
1069  continue;
1070  }
1071  unsigned Size =
1072  FArg.hasByValAttr()
1073  ? DL.getTypeAllocSize(FArg.getType()->getPointerElementType())
1074  : DL.getTypeAllocSize(FArg.getType());
1075  if (A == &FArg) {
1076  bool Overflow = ArgOffset + Size > kParamTLSSize;
1077  Value *Base = getShadowPtrForArgument(&FArg, EntryIRB, ArgOffset);
1078  if (FArg.hasByValAttr()) {
1079  // ByVal pointer itself has clean shadow. We copy the actual
1080  // argument shadow to the underlying memory.
1081  // Figure out maximal valid memcpy alignment.
1082  unsigned ArgAlign = FArg.getParamAlignment();
1083  if (ArgAlign == 0) {
1084  Type *EltType = A->getType()->getPointerElementType();
1085  ArgAlign = DL.getABITypeAlignment(EltType);
1086  }
1087  if (Overflow) {
1088  // ParamTLS overflow.
1089  EntryIRB.CreateMemSet(
1090  getShadowPtr(V, EntryIRB.getInt8Ty(), EntryIRB),
1091  Constant::getNullValue(EntryIRB.getInt8Ty()), Size, ArgAlign);
1092  } else {
1093  unsigned CopyAlign = std::min(ArgAlign, kShadowTLSAlignment);
1094  Value *Cpy = EntryIRB.CreateMemCpy(
1095  getShadowPtr(V, EntryIRB.getInt8Ty(), EntryIRB), Base, Size,
1096  CopyAlign);
1097  DEBUG(dbgs() << " ByValCpy: " << *Cpy << "\n");
1098  (void)Cpy;
1099  }
1100  *ShadowPtr = getCleanShadow(V);
1101  } else {
1102  if (Overflow) {
1103  // ParamTLS overflow.
1104  *ShadowPtr = getCleanShadow(V);
1105  } else {
1106  *ShadowPtr =
1107  EntryIRB.CreateAlignedLoad(Base, kShadowTLSAlignment);
1108  }
1109  }
1110  DEBUG(dbgs() << " ARG: " << FArg << " ==> " <<
1111  **ShadowPtr << "\n");
1112  if (MS.TrackOrigins && !Overflow) {
1113  Value *OriginPtr =
1114  getOriginPtrForArgument(&FArg, EntryIRB, ArgOffset);
1115  setOrigin(A, EntryIRB.CreateLoad(OriginPtr));
1116  } else {
1117  setOrigin(A, getCleanOrigin());
1118  }
1119  }
1120  ArgOffset += RoundUpToAlignment(Size, kShadowTLSAlignment);
1121  }
1122  assert(*ShadowPtr && "Could not find shadow for an argument");
1123  return *ShadowPtr;
1124  }
1125  // For everything else the shadow is zero.
1126  return getCleanShadow(V);
1127  }
1128 
1129  /// \brief Get the shadow for i-th argument of the instruction I.
1130  Value *getShadow(Instruction *I, int i) {
1131  return getShadow(I->getOperand(i));
1132  }
1133 
1134  /// \brief Get the origin for a value.
1135  Value *getOrigin(Value *V) {
1136  if (!MS.TrackOrigins) return nullptr;
1137  if (!PropagateShadow) return getCleanOrigin();
1138  if (isa<Constant>(V)) return getCleanOrigin();
1139  assert((isa<Instruction>(V) || isa<Argument>(V)) &&
1140  "Unexpected value type in getOrigin()");
1141  Value *Origin = OriginMap[V];
1142  assert(Origin && "Missing origin");
1143  return Origin;
1144  }
1145 
1146  /// \brief Get the origin for i-th argument of the instruction I.
1147  Value *getOrigin(Instruction *I, int i) {
1148  return getOrigin(I->getOperand(i));
1149  }
1150 
1151  /// \brief Remember the place where a shadow check should be inserted.
1152  ///
1153  /// This location will be later instrumented with a check that will print a
1154  /// UMR warning in runtime if the shadow value is not 0.
1155  void insertShadowCheck(Value *Shadow, Value *Origin, Instruction *OrigIns) {
1156  assert(Shadow);
1157  if (!InsertChecks) return;
1158 #ifndef NDEBUG
1159  Type *ShadowTy = Shadow->getType();
1160  assert((isa<IntegerType>(ShadowTy) || isa<VectorType>(ShadowTy)) &&
1161  "Can only insert checks for integer and vector shadow types");
1162 #endif
1163  InstrumentationList.push_back(
1164  ShadowOriginAndInsertPoint(Shadow, Origin, OrigIns));
1165  }
1166 
1167  /// \brief Remember the place where a shadow check should be inserted.
1168  ///
1169  /// This location will be later instrumented with a check that will print a
1170  /// UMR warning in runtime if the value is not fully defined.
1171  void insertShadowCheck(Value *Val, Instruction *OrigIns) {
1172  assert(Val);
1173  Value *Shadow, *Origin;
1174  if (ClCheckConstantShadow) {
1175  Shadow = getShadow(Val);
1176  if (!Shadow) return;
1177  Origin = getOrigin(Val);
1178  } else {
1179  Shadow = dyn_cast_or_null<Instruction>(getShadow(Val));
1180  if (!Shadow) return;
1181  Origin = dyn_cast_or_null<Instruction>(getOrigin(Val));
1182  }
1183  insertShadowCheck(Shadow, Origin, OrigIns);
1184  }
1185 
1186  AtomicOrdering addReleaseOrdering(AtomicOrdering a) {
1187  switch (a) {
1188  case NotAtomic:
1189  return NotAtomic;
1190  case Unordered:
1191  case Monotonic:
1192  case Release:
1193  return Release;
1194  case Acquire:
1195  case AcquireRelease:
1196  return AcquireRelease;
1198  return SequentiallyConsistent;
1199  }
1200  llvm_unreachable("Unknown ordering");
1201  }
1202 
1203  AtomicOrdering addAcquireOrdering(AtomicOrdering a) {
1204  switch (a) {
1205  case NotAtomic:
1206  return NotAtomic;
1207  case Unordered:
1208  case Monotonic:
1209  case Acquire:
1210  return Acquire;
1211  case Release:
1212  case AcquireRelease:
1213  return AcquireRelease;
1215  return SequentiallyConsistent;
1216  }
1217  llvm_unreachable("Unknown ordering");
1218  }
1219 
1220  // ------------------- Visitors.
1221 
1222  /// \brief Instrument LoadInst
1223  ///
1224  /// Loads the corresponding shadow and (optionally) origin.
1225  /// Optionally, checks that the load address is fully defined.
1226  void visitLoadInst(LoadInst &I) {
1227  assert(I.getType()->isSized() && "Load type must have size");
1228  IRBuilder<> IRB(I.getNextNode());
1229  Type *ShadowTy = getShadowTy(&I);
1230  Value *Addr = I.getPointerOperand();
1231  if (PropagateShadow && !I.getMetadata("nosanitize")) {
1232  Value *ShadowPtr = getShadowPtr(Addr, ShadowTy, IRB);
1233  setShadow(&I,
1234  IRB.CreateAlignedLoad(ShadowPtr, I.getAlignment(), "_msld"));
1235  } else {
1236  setShadow(&I, getCleanShadow(&I));
1237  }
1238 
1240  insertShadowCheck(I.getPointerOperand(), &I);
1241 
1242  if (I.isAtomic())
1243  I.setOrdering(addAcquireOrdering(I.getOrdering()));
1244 
1245  if (MS.TrackOrigins) {
1246  if (PropagateShadow) {
1247  unsigned Alignment = I.getAlignment();
1248  unsigned OriginAlignment = std::max(kMinOriginAlignment, Alignment);
1249  setOrigin(&I, IRB.CreateAlignedLoad(getOriginPtr(Addr, IRB, Alignment),
1250  OriginAlignment));
1251  } else {
1252  setOrigin(&I, getCleanOrigin());
1253  }
1254  }
1255  }
1256 
1257  /// \brief Instrument StoreInst
1258  ///
1259  /// Stores the corresponding shadow and (optionally) origin.
1260  /// Optionally, checks that the store address is fully defined.
1261  void visitStoreInst(StoreInst &I) {
1262  StoreList.push_back(&I);
1263  }
1264 
1265  void handleCASOrRMW(Instruction &I) {
1266  assert(isa<AtomicRMWInst>(I) || isa<AtomicCmpXchgInst>(I));
1267 
1268  IRBuilder<> IRB(&I);
1269  Value *Addr = I.getOperand(0);
1270  Value *ShadowPtr = getShadowPtr(Addr, I.getType(), IRB);
1271 
1273  insertShadowCheck(Addr, &I);
1274 
1275  // Only test the conditional argument of cmpxchg instruction.
1276  // The other argument can potentially be uninitialized, but we can not
1277  // detect this situation reliably without possible false positives.
1278  if (isa<AtomicCmpXchgInst>(I))
1279  insertShadowCheck(I.getOperand(1), &I);
1280 
1281  IRB.CreateStore(getCleanShadow(&I), ShadowPtr);
1282 
1283  setShadow(&I, getCleanShadow(&I));
1284  setOrigin(&I, getCleanOrigin());
1285  }
1286 
1287  void visitAtomicRMWInst(AtomicRMWInst &I) {
1288  handleCASOrRMW(I);
1289  I.setOrdering(addReleaseOrdering(I.getOrdering()));
1290  }
1291 
1292  void visitAtomicCmpXchgInst(AtomicCmpXchgInst &I) {
1293  handleCASOrRMW(I);
1294  I.setSuccessOrdering(addReleaseOrdering(I.getSuccessOrdering()));
1295  }
1296 
1297  // Vector manipulation.
1298  void visitExtractElementInst(ExtractElementInst &I) {
1299  insertShadowCheck(I.getOperand(1), &I);
1300  IRBuilder<> IRB(&I);
1301  setShadow(&I, IRB.CreateExtractElement(getShadow(&I, 0), I.getOperand(1),
1302  "_msprop"));
1303  setOrigin(&I, getOrigin(&I, 0));
1304  }
1305 
1306  void visitInsertElementInst(InsertElementInst &I) {
1307  insertShadowCheck(I.getOperand(2), &I);
1308  IRBuilder<> IRB(&I);
1309  setShadow(&I, IRB.CreateInsertElement(getShadow(&I, 0), getShadow(&I, 1),
1310  I.getOperand(2), "_msprop"));
1311  setOriginForNaryOp(I);
1312  }
1313 
1314  void visitShuffleVectorInst(ShuffleVectorInst &I) {
1315  insertShadowCheck(I.getOperand(2), &I);
1316  IRBuilder<> IRB(&I);
1317  setShadow(&I, IRB.CreateShuffleVector(getShadow(&I, 0), getShadow(&I, 1),
1318  I.getOperand(2), "_msprop"));
1319  setOriginForNaryOp(I);
1320  }
1321 
1322  // Casts.
1323  void visitSExtInst(SExtInst &I) {
1324  IRBuilder<> IRB(&I);
1325  setShadow(&I, IRB.CreateSExt(getShadow(&I, 0), I.getType(), "_msprop"));
1326  setOrigin(&I, getOrigin(&I, 0));
1327  }
1328 
1329  void visitZExtInst(ZExtInst &I) {
1330  IRBuilder<> IRB(&I);
1331  setShadow(&I, IRB.CreateZExt(getShadow(&I, 0), I.getType(), "_msprop"));
1332  setOrigin(&I, getOrigin(&I, 0));
1333  }
1334 
1335  void visitTruncInst(TruncInst &I) {
1336  IRBuilder<> IRB(&I);
1337  setShadow(&I, IRB.CreateTrunc(getShadow(&I, 0), I.getType(), "_msprop"));
1338  setOrigin(&I, getOrigin(&I, 0));
1339  }
1340 
1341  void visitBitCastInst(BitCastInst &I) {
1342  IRBuilder<> IRB(&I);
1343  setShadow(&I, IRB.CreateBitCast(getShadow(&I, 0), getShadowTy(&I)));
1344  setOrigin(&I, getOrigin(&I, 0));
1345  }
1346 
1347  void visitPtrToIntInst(PtrToIntInst &I) {
1348  IRBuilder<> IRB(&I);
1349  setShadow(&I, IRB.CreateIntCast(getShadow(&I, 0), getShadowTy(&I), false,
1350  "_msprop_ptrtoint"));
1351  setOrigin(&I, getOrigin(&I, 0));
1352  }
1353 
1354  void visitIntToPtrInst(IntToPtrInst &I) {
1355  IRBuilder<> IRB(&I);
1356  setShadow(&I, IRB.CreateIntCast(getShadow(&I, 0), getShadowTy(&I), false,
1357  "_msprop_inttoptr"));
1358  setOrigin(&I, getOrigin(&I, 0));
1359  }
1360 
1361  void visitFPToSIInst(CastInst& I) { handleShadowOr(I); }
1362  void visitFPToUIInst(CastInst& I) { handleShadowOr(I); }
1363  void visitSIToFPInst(CastInst& I) { handleShadowOr(I); }
1364  void visitUIToFPInst(CastInst& I) { handleShadowOr(I); }
1365  void visitFPExtInst(CastInst& I) { handleShadowOr(I); }
1366  void visitFPTruncInst(CastInst& I) { handleShadowOr(I); }
1367 
1368  /// \brief Propagate shadow for bitwise AND.
1369  ///
1370  /// This code is exact, i.e. if, for example, a bit in the left argument
1371  /// is defined and 0, then neither the value not definedness of the
1372  /// corresponding bit in B don't affect the resulting shadow.
1373  void visitAnd(BinaryOperator &I) {
1374  IRBuilder<> IRB(&I);
1375  // "And" of 0 and a poisoned value results in unpoisoned value.
1376  // 1&1 => 1; 0&1 => 0; p&1 => p;
1377  // 1&0 => 0; 0&0 => 0; p&0 => 0;
1378  // 1&p => p; 0&p => 0; p&p => p;
1379  // S = (S1 & S2) | (V1 & S2) | (S1 & V2)
1380  Value *S1 = getShadow(&I, 0);
1381  Value *S2 = getShadow(&I, 1);
1382  Value *V1 = I.getOperand(0);
1383  Value *V2 = I.getOperand(1);
1384  if (V1->getType() != S1->getType()) {
1385  V1 = IRB.CreateIntCast(V1, S1->getType(), false);
1386  V2 = IRB.CreateIntCast(V2, S2->getType(), false);
1387  }
1388  Value *S1S2 = IRB.CreateAnd(S1, S2);
1389  Value *V1S2 = IRB.CreateAnd(V1, S2);
1390  Value *S1V2 = IRB.CreateAnd(S1, V2);
1391  setShadow(&I, IRB.CreateOr(S1S2, IRB.CreateOr(V1S2, S1V2)));
1392  setOriginForNaryOp(I);
1393  }
1394 
1395  void visitOr(BinaryOperator &I) {
1396  IRBuilder<> IRB(&I);
1397  // "Or" of 1 and a poisoned value results in unpoisoned value.
1398  // 1|1 => 1; 0|1 => 1; p|1 => 1;
1399  // 1|0 => 1; 0|0 => 0; p|0 => p;
1400  // 1|p => 1; 0|p => p; p|p => p;
1401  // S = (S1 & S2) | (~V1 & S2) | (S1 & ~V2)
1402  Value *S1 = getShadow(&I, 0);
1403  Value *S2 = getShadow(&I, 1);
1404  Value *V1 = IRB.CreateNot(I.getOperand(0));
1405  Value *V2 = IRB.CreateNot(I.getOperand(1));
1406  if (V1->getType() != S1->getType()) {
1407  V1 = IRB.CreateIntCast(V1, S1->getType(), false);
1408  V2 = IRB.CreateIntCast(V2, S2->getType(), false);
1409  }
1410  Value *S1S2 = IRB.CreateAnd(S1, S2);
1411  Value *V1S2 = IRB.CreateAnd(V1, S2);
1412  Value *S1V2 = IRB.CreateAnd(S1, V2);
1413  setShadow(&I, IRB.CreateOr(S1S2, IRB.CreateOr(V1S2, S1V2)));
1414  setOriginForNaryOp(I);
1415  }
1416 
1417  /// \brief Default propagation of shadow and/or origin.
1418  ///
1419  /// This class implements the general case of shadow propagation, used in all
1420  /// cases where we don't know and/or don't care about what the operation
1421  /// actually does. It converts all input shadow values to a common type
1422  /// (extending or truncating as necessary), and bitwise OR's them.
1423  ///
1424  /// This is much cheaper than inserting checks (i.e. requiring inputs to be
1425  /// fully initialized), and less prone to false positives.
1426  ///
1427  /// This class also implements the general case of origin propagation. For a
1428  /// Nary operation, result origin is set to the origin of an argument that is
1429  /// not entirely initialized. If there is more than one such arguments, the
1430  /// rightmost of them is picked. It does not matter which one is picked if all
1431  /// arguments are initialized.
1432  template <bool CombineShadow>
1433  class Combiner {
1434  Value *Shadow;
1435  Value *Origin;
1436  IRBuilder<> &IRB;
1437  MemorySanitizerVisitor *MSV;
1438 
1439  public:
1440  Combiner(MemorySanitizerVisitor *MSV, IRBuilder<> &IRB) :
1441  Shadow(nullptr), Origin(nullptr), IRB(IRB), MSV(MSV) {}
1442 
1443  /// \brief Add a pair of shadow and origin values to the mix.
1444  Combiner &Add(Value *OpShadow, Value *OpOrigin) {
1445  if (CombineShadow) {
1446  assert(OpShadow);
1447  if (!Shadow)
1448  Shadow = OpShadow;
1449  else {
1450  OpShadow = MSV->CreateShadowCast(IRB, OpShadow, Shadow->getType());
1451  Shadow = IRB.CreateOr(Shadow, OpShadow, "_msprop");
1452  }
1453  }
1454 
1455  if (MSV->MS.TrackOrigins) {
1456  assert(OpOrigin);
1457  if (!Origin) {
1458  Origin = OpOrigin;
1459  } else {
1460  Constant *ConstOrigin = dyn_cast<Constant>(OpOrigin);
1461  // No point in adding something that might result in 0 origin value.
1462  if (!ConstOrigin || !ConstOrigin->isNullValue()) {
1463  Value *FlatShadow = MSV->convertToShadowTyNoVec(OpShadow, IRB);
1464  Value *Cond =
1465  IRB.CreateICmpNE(FlatShadow, MSV->getCleanShadow(FlatShadow));
1466  Origin = IRB.CreateSelect(Cond, OpOrigin, Origin);
1467  }
1468  }
1469  }
1470  return *this;
1471  }
1472 
1473  /// \brief Add an application value to the mix.
1474  Combiner &Add(Value *V) {
1475  Value *OpShadow = MSV->getShadow(V);
1476  Value *OpOrigin = MSV->MS.TrackOrigins ? MSV->getOrigin(V) : nullptr;
1477  return Add(OpShadow, OpOrigin);
1478  }
1479 
1480  /// \brief Set the current combined values as the given instruction's shadow
1481  /// and origin.
1482  void Done(Instruction *I) {
1483  if (CombineShadow) {
1484  assert(Shadow);
1485  Shadow = MSV->CreateShadowCast(IRB, Shadow, MSV->getShadowTy(I));
1486  MSV->setShadow(I, Shadow);
1487  }
1488  if (MSV->MS.TrackOrigins) {
1489  assert(Origin);
1490  MSV->setOrigin(I, Origin);
1491  }
1492  }
1493  };
1494 
1495  typedef Combiner<true> ShadowAndOriginCombiner;
1496  typedef Combiner<false> OriginCombiner;
1497 
1498  /// \brief Propagate origin for arbitrary operation.
1499  void setOriginForNaryOp(Instruction &I) {
1500  if (!MS.TrackOrigins) return;
1501  IRBuilder<> IRB(&I);
1502  OriginCombiner OC(this, IRB);
1503  for (Instruction::op_iterator OI = I.op_begin(); OI != I.op_end(); ++OI)
1504  OC.Add(OI->get());
1505  OC.Done(&I);
1506  }
1507 
1508  size_t VectorOrPrimitiveTypeSizeInBits(Type *Ty) {
1509  assert(!(Ty->isVectorTy() && Ty->getScalarType()->isPointerTy()) &&
1510  "Vector of pointers is not a valid shadow type");
1511  return Ty->isVectorTy() ?
1513  Ty->getPrimitiveSizeInBits();
1514  }
1515 
1516  /// \brief Cast between two shadow types, extending or truncating as
1517  /// necessary.
1518  Value *CreateShadowCast(IRBuilder<> &IRB, Value *V, Type *dstTy,
1519  bool Signed = false) {
1520  Type *srcTy = V->getType();
1521  if (dstTy->isIntegerTy() && srcTy->isIntegerTy())
1522  return IRB.CreateIntCast(V, dstTy, Signed);
1523  if (dstTy->isVectorTy() && srcTy->isVectorTy() &&
1524  dstTy->getVectorNumElements() == srcTy->getVectorNumElements())
1525  return IRB.CreateIntCast(V, dstTy, Signed);
1526  size_t srcSizeInBits = VectorOrPrimitiveTypeSizeInBits(srcTy);
1527  size_t dstSizeInBits = VectorOrPrimitiveTypeSizeInBits(dstTy);
1528  Value *V1 = IRB.CreateBitCast(V, Type::getIntNTy(*MS.C, srcSizeInBits));
1529  Value *V2 =
1530  IRB.CreateIntCast(V1, Type::getIntNTy(*MS.C, dstSizeInBits), Signed);
1531  return IRB.CreateBitCast(V2, dstTy);
1532  // TODO: handle struct types.
1533  }
1534 
1535  /// \brief Cast an application value to the type of its own shadow.
1536  Value *CreateAppToShadowCast(IRBuilder<> &IRB, Value *V) {
1537  Type *ShadowTy = getShadowTy(V);
1538  if (V->getType() == ShadowTy)
1539  return V;
1540  if (V->getType()->isPtrOrPtrVectorTy())
1541  return IRB.CreatePtrToInt(V, ShadowTy);
1542  else
1543  return IRB.CreateBitCast(V, ShadowTy);
1544  }
1545 
1546  /// \brief Propagate shadow for arbitrary operation.
1547  void handleShadowOr(Instruction &I) {
1548  IRBuilder<> IRB(&I);
1549  ShadowAndOriginCombiner SC(this, IRB);
1550  for (Instruction::op_iterator OI = I.op_begin(); OI != I.op_end(); ++OI)
1551  SC.Add(OI->get());
1552  SC.Done(&I);
1553  }
1554 
1555  // \brief Handle multiplication by constant.
1556  //
1557  // Handle a special case of multiplication by constant that may have one or
1558  // more zeros in the lower bits. This makes corresponding number of lower bits
1559  // of the result zero as well. We model it by shifting the other operand
1560  // shadow left by the required number of bits. Effectively, we transform
1561  // (X * (A * 2**B)) to ((X << B) * A) and instrument (X << B) as (Sx << B).
1562  // We use multiplication by 2**N instead of shift to cover the case of
1563  // multiplication by 0, which may occur in some elements of a vector operand.
1564  void handleMulByConstant(BinaryOperator &I, Constant *ConstArg,
1565  Value *OtherArg) {
1566  Constant *ShadowMul;
1567  Type *Ty = ConstArg->getType();
1568  if (Ty->isVectorTy()) {
1569  unsigned NumElements = Ty->getVectorNumElements();
1570  Type *EltTy = Ty->getSequentialElementType();
1571  SmallVector<Constant *, 16> Elements;
1572  for (unsigned Idx = 0; Idx < NumElements; ++Idx) {
1573  ConstantInt *Elt =
1574  dyn_cast<ConstantInt>(ConstArg->getAggregateElement(Idx));
1575  APInt V = Elt->getValue();
1576  APInt V2 = APInt(V.getBitWidth(), 1) << V.countTrailingZeros();
1577  Elements.push_back(ConstantInt::get(EltTy, V2));
1578  }
1579  ShadowMul = ConstantVector::get(Elements);
1580  } else {
1581  ConstantInt *Elt = dyn_cast<ConstantInt>(ConstArg);
1582  APInt V = Elt->getValue();
1583  APInt V2 = APInt(V.getBitWidth(), 1) << V.countTrailingZeros();
1584  ShadowMul = ConstantInt::get(Elt->getType(), V2);
1585  }
1586 
1587  IRBuilder<> IRB(&I);
1588  setShadow(&I,
1589  IRB.CreateMul(getShadow(OtherArg), ShadowMul, "msprop_mul_cst"));
1590  setOrigin(&I, getOrigin(OtherArg));
1591  }
1592 
1593  void visitMul(BinaryOperator &I) {
1594  Constant *constOp0 = dyn_cast<Constant>(I.getOperand(0));
1595  Constant *constOp1 = dyn_cast<Constant>(I.getOperand(1));
1596  if (constOp0 && !constOp1)
1597  handleMulByConstant(I, constOp0, I.getOperand(1));
1598  else if (constOp1 && !constOp0)
1599  handleMulByConstant(I, constOp1, I.getOperand(0));
1600  else
1601  handleShadowOr(I);
1602  }
1603 
1604  void visitFAdd(BinaryOperator &I) { handleShadowOr(I); }
1605  void visitFSub(BinaryOperator &I) { handleShadowOr(I); }
1606  void visitFMul(BinaryOperator &I) { handleShadowOr(I); }
1607  void visitAdd(BinaryOperator &I) { handleShadowOr(I); }
1608  void visitSub(BinaryOperator &I) { handleShadowOr(I); }
1609  void visitXor(BinaryOperator &I) { handleShadowOr(I); }
1610 
1611  void handleDiv(Instruction &I) {
1612  IRBuilder<> IRB(&I);
1613  // Strict on the second argument.
1614  insertShadowCheck(I.getOperand(1), &I);
1615  setShadow(&I, getShadow(&I, 0));
1616  setOrigin(&I, getOrigin(&I, 0));
1617  }
1618 
1619  void visitUDiv(BinaryOperator &I) { handleDiv(I); }
1620  void visitSDiv(BinaryOperator &I) { handleDiv(I); }
1621  void visitFDiv(BinaryOperator &I) { handleDiv(I); }
1622  void visitURem(BinaryOperator &I) { handleDiv(I); }
1623  void visitSRem(BinaryOperator &I) { handleDiv(I); }
1624  void visitFRem(BinaryOperator &I) { handleDiv(I); }
1625 
1626  /// \brief Instrument == and != comparisons.
1627  ///
1628  /// Sometimes the comparison result is known even if some of the bits of the
1629  /// arguments are not.
1630  void handleEqualityComparison(ICmpInst &I) {
1631  IRBuilder<> IRB(&I);
1632  Value *A = I.getOperand(0);
1633  Value *B = I.getOperand(1);
1634  Value *Sa = getShadow(A);
1635  Value *Sb = getShadow(B);
1636 
1637  // Get rid of pointers and vectors of pointers.
1638  // For ints (and vectors of ints), types of A and Sa match,
1639  // and this is a no-op.
1640  A = IRB.CreatePointerCast(A, Sa->getType());
1641  B = IRB.CreatePointerCast(B, Sb->getType());
1642 
1643  // A == B <==> (C = A^B) == 0
1644  // A != B <==> (C = A^B) != 0
1645  // Sc = Sa | Sb
1646  Value *C = IRB.CreateXor(A, B);
1647  Value *Sc = IRB.CreateOr(Sa, Sb);
1648  // Now dealing with i = (C == 0) comparison (or C != 0, does not matter now)
1649  // Result is defined if one of the following is true
1650  // * there is a defined 1 bit in C
1651  // * C is fully defined
1652  // Si = !(C & ~Sc) && Sc
1653  Value *Zero = Constant::getNullValue(Sc->getType());
1654  Value *MinusOne = Constant::getAllOnesValue(Sc->getType());
1655  Value *Si =
1656  IRB.CreateAnd(IRB.CreateICmpNE(Sc, Zero),
1657  IRB.CreateICmpEQ(
1658  IRB.CreateAnd(IRB.CreateXor(Sc, MinusOne), C), Zero));
1659  Si->setName("_msprop_icmp");
1660  setShadow(&I, Si);
1661  setOriginForNaryOp(I);
1662  }
1663 
1664  /// \brief Build the lowest possible value of V, taking into account V's
1665  /// uninitialized bits.
1666  Value *getLowestPossibleValue(IRBuilder<> &IRB, Value *A, Value *Sa,
1667  bool isSigned) {
1668  if (isSigned) {
1669  // Split shadow into sign bit and other bits.
1670  Value *SaOtherBits = IRB.CreateLShr(IRB.CreateShl(Sa, 1), 1);
1671  Value *SaSignBit = IRB.CreateXor(Sa, SaOtherBits);
1672  // Maximise the undefined shadow bit, minimize other undefined bits.
1673  return
1674  IRB.CreateOr(IRB.CreateAnd(A, IRB.CreateNot(SaOtherBits)), SaSignBit);
1675  } else {
1676  // Minimize undefined bits.
1677  return IRB.CreateAnd(A, IRB.CreateNot(Sa));
1678  }
1679  }
1680 
1681  /// \brief Build the highest possible value of V, taking into account V's
1682  /// uninitialized bits.
1683  Value *getHighestPossibleValue(IRBuilder<> &IRB, Value *A, Value *Sa,
1684  bool isSigned) {
1685  if (isSigned) {
1686  // Split shadow into sign bit and other bits.
1687  Value *SaOtherBits = IRB.CreateLShr(IRB.CreateShl(Sa, 1), 1);
1688  Value *SaSignBit = IRB.CreateXor(Sa, SaOtherBits);
1689  // Minimise the undefined shadow bit, maximise other undefined bits.
1690  return
1691  IRB.CreateOr(IRB.CreateAnd(A, IRB.CreateNot(SaSignBit)), SaOtherBits);
1692  } else {
1693  // Maximize undefined bits.
1694  return IRB.CreateOr(A, Sa);
1695  }
1696  }
1697 
1698  /// \brief Instrument relational comparisons.
1699  ///
1700  /// This function does exact shadow propagation for all relational
1701  /// comparisons of integers, pointers and vectors of those.
1702  /// FIXME: output seems suboptimal when one of the operands is a constant
1703  void handleRelationalComparisonExact(ICmpInst &I) {
1704  IRBuilder<> IRB(&I);
1705  Value *A = I.getOperand(0);
1706  Value *B = I.getOperand(1);
1707  Value *Sa = getShadow(A);
1708  Value *Sb = getShadow(B);
1709 
1710  // Get rid of pointers and vectors of pointers.
1711  // For ints (and vectors of ints), types of A and Sa match,
1712  // and this is a no-op.
1713  A = IRB.CreatePointerCast(A, Sa->getType());
1714  B = IRB.CreatePointerCast(B, Sb->getType());
1715 
1716  // Let [a0, a1] be the interval of possible values of A, taking into account
1717  // its undefined bits. Let [b0, b1] be the interval of possible values of B.
1718  // Then (A cmp B) is defined iff (a0 cmp b1) == (a1 cmp b0).
1719  bool IsSigned = I.isSigned();
1720  Value *S1 = IRB.CreateICmp(I.getPredicate(),
1721  getLowestPossibleValue(IRB, A, Sa, IsSigned),
1722  getHighestPossibleValue(IRB, B, Sb, IsSigned));
1723  Value *S2 = IRB.CreateICmp(I.getPredicate(),
1724  getHighestPossibleValue(IRB, A, Sa, IsSigned),
1725  getLowestPossibleValue(IRB, B, Sb, IsSigned));
1726  Value *Si = IRB.CreateXor(S1, S2);
1727  setShadow(&I, Si);
1728  setOriginForNaryOp(I);
1729  }
1730 
1731  /// \brief Instrument signed relational comparisons.
1732  ///
1733  /// Handle (x<0) and (x>=0) comparisons (essentially, sign bit tests) by
1734  /// propagating the highest bit of the shadow. Everything else is delegated
1735  /// to handleShadowOr().
1736  void handleSignedRelationalComparison(ICmpInst &I) {
1737  Constant *constOp0 = dyn_cast<Constant>(I.getOperand(0));
1738  Constant *constOp1 = dyn_cast<Constant>(I.getOperand(1));
1739  Value* op = nullptr;
1740  CmpInst::Predicate pre = I.getPredicate();
1741  if (constOp0 && constOp0->isNullValue() &&
1742  (pre == CmpInst::ICMP_SGT || pre == CmpInst::ICMP_SLE)) {
1743  op = I.getOperand(1);
1744  } else if (constOp1 && constOp1->isNullValue() &&
1745  (pre == CmpInst::ICMP_SLT || pre == CmpInst::ICMP_SGE)) {
1746  op = I.getOperand(0);
1747  }
1748  if (op) {
1749  IRBuilder<> IRB(&I);
1750  Value* Shadow =
1751  IRB.CreateICmpSLT(getShadow(op), getCleanShadow(op), "_msprop_icmpslt");
1752  setShadow(&I, Shadow);
1753  setOrigin(&I, getOrigin(op));
1754  } else {
1755  handleShadowOr(I);
1756  }
1757  }
1758 
1759  void visitICmpInst(ICmpInst &I) {
1760  if (!ClHandleICmp) {
1761  handleShadowOr(I);
1762  return;
1763  }
1764  if (I.isEquality()) {
1765  handleEqualityComparison(I);
1766  return;
1767  }
1768 
1769  assert(I.isRelational());
1770  if (ClHandleICmpExact) {
1771  handleRelationalComparisonExact(I);
1772  return;
1773  }
1774  if (I.isSigned()) {
1775  handleSignedRelationalComparison(I);
1776  return;
1777  }
1778 
1779  assert(I.isUnsigned());
1780  if ((isa<Constant>(I.getOperand(0)) || isa<Constant>(I.getOperand(1)))) {
1781  handleRelationalComparisonExact(I);
1782  return;
1783  }
1784 
1785  handleShadowOr(I);
1786  }
1787 
1788  void visitFCmpInst(FCmpInst &I) {
1789  handleShadowOr(I);
1790  }
1791 
1792  void handleShift(BinaryOperator &I) {
1793  IRBuilder<> IRB(&I);
1794  // If any of the S2 bits are poisoned, the whole thing is poisoned.
1795  // Otherwise perform the same shift on S1.
1796  Value *S1 = getShadow(&I, 0);
1797  Value *S2 = getShadow(&I, 1);
1798  Value *S2Conv = IRB.CreateSExt(IRB.CreateICmpNE(S2, getCleanShadow(S2)),
1799  S2->getType());
1800  Value *V2 = I.getOperand(1);
1801  Value *Shift = IRB.CreateBinOp(I.getOpcode(), S1, V2);
1802  setShadow(&I, IRB.CreateOr(Shift, S2Conv));
1803  setOriginForNaryOp(I);
1804  }
1805 
1806  void visitShl(BinaryOperator &I) { handleShift(I); }
1807  void visitAShr(BinaryOperator &I) { handleShift(I); }
1808  void visitLShr(BinaryOperator &I) { handleShift(I); }
1809 
1810  /// \brief Instrument llvm.memmove
1811  ///
1812  /// At this point we don't know if llvm.memmove will be inlined or not.
1813  /// If we don't instrument it and it gets inlined,
1814  /// our interceptor will not kick in and we will lose the memmove.
1815  /// If we instrument the call here, but it does not get inlined,
1816  /// we will memove the shadow twice: which is bad in case
1817  /// of overlapping regions. So, we simply lower the intrinsic to a call.
1818  ///
1819  /// Similar situation exists for memcpy and memset.
1820  void visitMemMoveInst(MemMoveInst &I) {
1821  IRBuilder<> IRB(&I);
1822  IRB.CreateCall(
1823  MS.MemmoveFn,
1824  {IRB.CreatePointerCast(I.getArgOperand(0), IRB.getInt8PtrTy()),
1825  IRB.CreatePointerCast(I.getArgOperand(1), IRB.getInt8PtrTy()),
1826  IRB.CreateIntCast(I.getArgOperand(2), MS.IntptrTy, false)});
1827  I.eraseFromParent();
1828  }
1829 
1830  // Similar to memmove: avoid copying shadow twice.
1831  // This is somewhat unfortunate as it may slowdown small constant memcpys.
1832  // FIXME: consider doing manual inline for small constant sizes and proper
1833  // alignment.
1834  void visitMemCpyInst(MemCpyInst &I) {
1835  IRBuilder<> IRB(&I);
1836  IRB.CreateCall(
1837  MS.MemcpyFn,
1838  {IRB.CreatePointerCast(I.getArgOperand(0), IRB.getInt8PtrTy()),
1839  IRB.CreatePointerCast(I.getArgOperand(1), IRB.getInt8PtrTy()),
1840  IRB.CreateIntCast(I.getArgOperand(2), MS.IntptrTy, false)});
1841  I.eraseFromParent();
1842  }
1843 
1844  // Same as memcpy.
1845  void visitMemSetInst(MemSetInst &I) {
1846  IRBuilder<> IRB(&I);
1847  IRB.CreateCall(
1848  MS.MemsetFn,
1849  {IRB.CreatePointerCast(I.getArgOperand(0), IRB.getInt8PtrTy()),
1850  IRB.CreateIntCast(I.getArgOperand(1), IRB.getInt32Ty(), false),
1851  IRB.CreateIntCast(I.getArgOperand(2), MS.IntptrTy, false)});
1852  I.eraseFromParent();
1853  }
1854 
1855  void visitVAStartInst(VAStartInst &I) {
1856  VAHelper->visitVAStartInst(I);
1857  }
1858 
1859  void visitVACopyInst(VACopyInst &I) {
1860  VAHelper->visitVACopyInst(I);
1861  }
1862 
1863  enum IntrinsicKind {
1864  IK_DoesNotAccessMemory,
1865  IK_OnlyReadsMemory,
1866  IK_WritesMemory
1867  };
1868 
1869  static IntrinsicKind getIntrinsicKind(Intrinsic::ID iid) {
1870  const int DoesNotAccessMemory = IK_DoesNotAccessMemory;
1871  const int OnlyReadsArgumentPointees = IK_OnlyReadsMemory;
1872  const int OnlyReadsMemory = IK_OnlyReadsMemory;
1873  const int OnlyAccessesArgumentPointees = IK_WritesMemory;
1874  const int UnknownModRefBehavior = IK_WritesMemory;
1875 #define GET_INTRINSIC_MODREF_BEHAVIOR
1876 #define ModRefBehavior IntrinsicKind
1877 #include "llvm/IR/Intrinsics.gen"
1878 #undef ModRefBehavior
1879 #undef GET_INTRINSIC_MODREF_BEHAVIOR
1880  }
1881 
1882  /// \brief Handle vector store-like intrinsics.
1883  ///
1884  /// Instrument intrinsics that look like a simple SIMD store: writes memory,
1885  /// has 1 pointer argument and 1 vector argument, returns void.
1886  bool handleVectorStoreIntrinsic(IntrinsicInst &I) {
1887  IRBuilder<> IRB(&I);
1888  Value* Addr = I.getArgOperand(0);
1889  Value *Shadow = getShadow(&I, 1);
1890  Value *ShadowPtr = getShadowPtr(Addr, Shadow->getType(), IRB);
1891 
1892  // We don't know the pointer alignment (could be unaligned SSE store!).
1893  // Have to assume to worst case.
1894  IRB.CreateAlignedStore(Shadow, ShadowPtr, 1);
1895 
1897  insertShadowCheck(Addr, &I);
1898 
1899  // FIXME: use ClStoreCleanOrigin
1900  // FIXME: factor out common code from materializeStores
1901  if (MS.TrackOrigins)
1902  IRB.CreateStore(getOrigin(&I, 1), getOriginPtr(Addr, IRB, 1));
1903  return true;
1904  }
1905 
1906  /// \brief Handle vector load-like intrinsics.
1907  ///
1908  /// Instrument intrinsics that look like a simple SIMD load: reads memory,
1909  /// has 1 pointer argument, returns a vector.
1910  bool handleVectorLoadIntrinsic(IntrinsicInst &I) {
1911  IRBuilder<> IRB(&I);
1912  Value *Addr = I.getArgOperand(0);
1913 
1914  Type *ShadowTy = getShadowTy(&I);
1915  if (PropagateShadow) {
1916  Value *ShadowPtr = getShadowPtr(Addr, ShadowTy, IRB);
1917  // We don't know the pointer alignment (could be unaligned SSE load!).
1918  // Have to assume to worst case.
1919  setShadow(&I, IRB.CreateAlignedLoad(ShadowPtr, 1, "_msld"));
1920  } else {
1921  setShadow(&I, getCleanShadow(&I));
1922  }
1923 
1925  insertShadowCheck(Addr, &I);
1926 
1927  if (MS.TrackOrigins) {
1928  if (PropagateShadow)
1929  setOrigin(&I, IRB.CreateLoad(getOriginPtr(Addr, IRB, 1)));
1930  else
1931  setOrigin(&I, getCleanOrigin());
1932  }
1933  return true;
1934  }
1935 
1936  /// \brief Handle (SIMD arithmetic)-like intrinsics.
1937  ///
1938  /// Instrument intrinsics with any number of arguments of the same type,
1939  /// equal to the return type. The type should be simple (no aggregates or
1940  /// pointers; vectors are fine).
1941  /// Caller guarantees that this intrinsic does not access memory.
1942  bool maybeHandleSimpleNomemIntrinsic(IntrinsicInst &I) {
1943  Type *RetTy = I.getType();
1944  if (!(RetTy->isIntOrIntVectorTy() ||
1945  RetTy->isFPOrFPVectorTy() ||
1946  RetTy->isX86_MMXTy()))
1947  return false;
1948 
1949  unsigned NumArgOperands = I.getNumArgOperands();
1950 
1951  for (unsigned i = 0; i < NumArgOperands; ++i) {
1952  Type *Ty = I.getArgOperand(i)->getType();
1953  if (Ty != RetTy)
1954  return false;
1955  }
1956 
1957  IRBuilder<> IRB(&I);
1958  ShadowAndOriginCombiner SC(this, IRB);
1959  for (unsigned i = 0; i < NumArgOperands; ++i)
1960  SC.Add(I.getArgOperand(i));
1961  SC.Done(&I);
1962 
1963  return true;
1964  }
1965 
1966  /// \brief Heuristically instrument unknown intrinsics.
1967  ///
1968  /// The main purpose of this code is to do something reasonable with all
1969  /// random intrinsics we might encounter, most importantly - SIMD intrinsics.
1970  /// We recognize several classes of intrinsics by their argument types and
1971  /// ModRefBehaviour and apply special intrumentation when we are reasonably
1972  /// sure that we know what the intrinsic does.
1973  ///
1974  /// We special-case intrinsics where this approach fails. See llvm.bswap
1975  /// handling as an example of that.
1976  bool handleUnknownIntrinsic(IntrinsicInst &I) {
1977  unsigned NumArgOperands = I.getNumArgOperands();
1978  if (NumArgOperands == 0)
1979  return false;
1980 
1981  Intrinsic::ID iid = I.getIntrinsicID();
1982  IntrinsicKind IK = getIntrinsicKind(iid);
1983  bool OnlyReadsMemory = IK == IK_OnlyReadsMemory;
1984  bool WritesMemory = IK == IK_WritesMemory;
1985  assert(!(OnlyReadsMemory && WritesMemory));
1986 
1987  if (NumArgOperands == 2 &&
1988  I.getArgOperand(0)->getType()->isPointerTy() &&
1989  I.getArgOperand(1)->getType()->isVectorTy() &&
1990  I.getType()->isVoidTy() &&
1991  WritesMemory) {
1992  // This looks like a vector store.
1993  return handleVectorStoreIntrinsic(I);
1994  }
1995 
1996  if (NumArgOperands == 1 &&
1997  I.getArgOperand(0)->getType()->isPointerTy() &&
1998  I.getType()->isVectorTy() &&
1999  OnlyReadsMemory) {
2000  // This looks like a vector load.
2001  return handleVectorLoadIntrinsic(I);
2002  }
2003 
2004  if (!OnlyReadsMemory && !WritesMemory)
2005  if (maybeHandleSimpleNomemIntrinsic(I))
2006  return true;
2007 
2008  // FIXME: detect and handle SSE maskstore/maskload
2009  return false;
2010  }
2011 
2012  void handleBswap(IntrinsicInst &I) {
2013  IRBuilder<> IRB(&I);
2014  Value *Op = I.getArgOperand(0);
2015  Type *OpType = Op->getType();
2016  Function *BswapFunc = Intrinsic::getDeclaration(
2017  F.getParent(), Intrinsic::bswap, makeArrayRef(&OpType, 1));
2018  setShadow(&I, IRB.CreateCall(BswapFunc, getShadow(Op)));
2019  setOrigin(&I, getOrigin(Op));
2020  }
2021 
2022  // \brief Instrument vector convert instrinsic.
2023  //
2024  // This function instruments intrinsics like cvtsi2ss:
2025  // %Out = int_xxx_cvtyyy(%ConvertOp)
2026  // or
2027  // %Out = int_xxx_cvtyyy(%CopyOp, %ConvertOp)
2028  // Intrinsic converts \p NumUsedElements elements of \p ConvertOp to the same
2029  // number \p Out elements, and (if has 2 arguments) copies the rest of the
2030  // elements from \p CopyOp.
2031  // In most cases conversion involves floating-point value which may trigger a
2032  // hardware exception when not fully initialized. For this reason we require
2033  // \p ConvertOp[0:NumUsedElements] to be fully initialized and trap otherwise.
2034  // We copy the shadow of \p CopyOp[NumUsedElements:] to \p
2035  // Out[NumUsedElements:]. This means that intrinsics without \p CopyOp always
2036  // return a fully initialized value.
2037  void handleVectorConvertIntrinsic(IntrinsicInst &I, int NumUsedElements) {
2038  IRBuilder<> IRB(&I);
2039  Value *CopyOp, *ConvertOp;
2040 
2041  switch (I.getNumArgOperands()) {
2042  case 3:
2043  assert(isa<ConstantInt>(I.getArgOperand(2)) && "Invalid rounding mode");
2044  case 2:
2045  CopyOp = I.getArgOperand(0);
2046  ConvertOp = I.getArgOperand(1);
2047  break;
2048  case 1:
2049  ConvertOp = I.getArgOperand(0);
2050  CopyOp = nullptr;
2051  break;
2052  default:
2053  llvm_unreachable("Cvt intrinsic with unsupported number of arguments.");
2054  }
2055 
2056  // The first *NumUsedElements* elements of ConvertOp are converted to the
2057  // same number of output elements. The rest of the output is copied from
2058  // CopyOp, or (if not available) filled with zeroes.
2059  // Combine shadow for elements of ConvertOp that are used in this operation,
2060  // and insert a check.
2061  // FIXME: consider propagating shadow of ConvertOp, at least in the case of
2062  // int->any conversion.
2063  Value *ConvertShadow = getShadow(ConvertOp);
2064  Value *AggShadow = nullptr;
2065  if (ConvertOp->getType()->isVectorTy()) {
2066  AggShadow = IRB.CreateExtractElement(
2067  ConvertShadow, ConstantInt::get(IRB.getInt32Ty(), 0));
2068  for (int i = 1; i < NumUsedElements; ++i) {
2069  Value *MoreShadow = IRB.CreateExtractElement(
2070  ConvertShadow, ConstantInt::get(IRB.getInt32Ty(), i));
2071  AggShadow = IRB.CreateOr(AggShadow, MoreShadow);
2072  }
2073  } else {
2074  AggShadow = ConvertShadow;
2075  }
2076  assert(AggShadow->getType()->isIntegerTy());
2077  insertShadowCheck(AggShadow, getOrigin(ConvertOp), &I);
2078 
2079  // Build result shadow by zero-filling parts of CopyOp shadow that come from
2080  // ConvertOp.
2081  if (CopyOp) {
2082  assert(CopyOp->getType() == I.getType());
2083  assert(CopyOp->getType()->isVectorTy());
2084  Value *ResultShadow = getShadow(CopyOp);
2085  Type *EltTy = ResultShadow->getType()->getVectorElementType();
2086  for (int i = 0; i < NumUsedElements; ++i) {
2087  ResultShadow = IRB.CreateInsertElement(
2088  ResultShadow, ConstantInt::getNullValue(EltTy),
2089  ConstantInt::get(IRB.getInt32Ty(), i));
2090  }
2091  setShadow(&I, ResultShadow);
2092  setOrigin(&I, getOrigin(CopyOp));
2093  } else {
2094  setShadow(&I, getCleanShadow(&I));
2095  setOrigin(&I, getCleanOrigin());
2096  }
2097  }
2098 
2099  // Given a scalar or vector, extract lower 64 bits (or less), and return all
2100  // zeroes if it is zero, and all ones otherwise.
2101  Value *Lower64ShadowExtend(IRBuilder<> &IRB, Value *S, Type *T) {
2102  if (S->getType()->isVectorTy())
2103  S = CreateShadowCast(IRB, S, IRB.getInt64Ty(), /* Signed */ true);
2104  assert(S->getType()->getPrimitiveSizeInBits() <= 64);
2105  Value *S2 = IRB.CreateICmpNE(S, getCleanShadow(S));
2106  return CreateShadowCast(IRB, S2, T, /* Signed */ true);
2107  }
2108 
2109  Value *VariableShadowExtend(IRBuilder<> &IRB, Value *S) {
2110  Type *T = S->getType();
2111  assert(T->isVectorTy());
2112  Value *S2 = IRB.CreateICmpNE(S, getCleanShadow(S));
2113  return IRB.CreateSExt(S2, T);
2114  }
2115 
2116  // \brief Instrument vector shift instrinsic.
2117  //
2118  // This function instruments intrinsics like int_x86_avx2_psll_w.
2119  // Intrinsic shifts %In by %ShiftSize bits.
2120  // %ShiftSize may be a vector. In that case the lower 64 bits determine shift
2121  // size, and the rest is ignored. Behavior is defined even if shift size is
2122  // greater than register (or field) width.
2123  void handleVectorShiftIntrinsic(IntrinsicInst &I, bool Variable) {
2124  assert(I.getNumArgOperands() == 2);
2125  IRBuilder<> IRB(&I);
2126  // If any of the S2 bits are poisoned, the whole thing is poisoned.
2127  // Otherwise perform the same shift on S1.
2128  Value *S1 = getShadow(&I, 0);
2129  Value *S2 = getShadow(&I, 1);
2130  Value *S2Conv = Variable ? VariableShadowExtend(IRB, S2)
2131  : Lower64ShadowExtend(IRB, S2, getShadowTy(&I));
2132  Value *V1 = I.getOperand(0);
2133  Value *V2 = I.getOperand(1);
2134  Value *Shift = IRB.CreateCall(I.getCalledValue(),
2135  {IRB.CreateBitCast(S1, V1->getType()), V2});
2136  Shift = IRB.CreateBitCast(Shift, getShadowTy(&I));
2137  setShadow(&I, IRB.CreateOr(Shift, S2Conv));
2138  setOriginForNaryOp(I);
2139  }
2140 
2141  // \brief Get an X86_MMX-sized vector type.
2142  Type *getMMXVectorTy(unsigned EltSizeInBits) {
2143  const unsigned X86_MMXSizeInBits = 64;
2144  return VectorType::get(IntegerType::get(*MS.C, EltSizeInBits),
2145  X86_MMXSizeInBits / EltSizeInBits);
2146  }
2147 
2148  // \brief Returns a signed counterpart for an (un)signed-saturate-and-pack
2149  // intrinsic.
2150  Intrinsic::ID getSignedPackIntrinsic(Intrinsic::ID id) {
2151  switch (id) {
2152  case llvm::Intrinsic::x86_sse2_packsswb_128:
2153  case llvm::Intrinsic::x86_sse2_packuswb_128:
2154  return llvm::Intrinsic::x86_sse2_packsswb_128;
2155 
2156  case llvm::Intrinsic::x86_sse2_packssdw_128:
2157  case llvm::Intrinsic::x86_sse41_packusdw:
2158  return llvm::Intrinsic::x86_sse2_packssdw_128;
2159 
2160  case llvm::Intrinsic::x86_avx2_packsswb:
2161  case llvm::Intrinsic::x86_avx2_packuswb:
2162  return llvm::Intrinsic::x86_avx2_packsswb;
2163 
2164  case llvm::Intrinsic::x86_avx2_packssdw:
2165  case llvm::Intrinsic::x86_avx2_packusdw:
2166  return llvm::Intrinsic::x86_avx2_packssdw;
2167 
2168  case llvm::Intrinsic::x86_mmx_packsswb:
2169  case llvm::Intrinsic::x86_mmx_packuswb:
2170  return llvm::Intrinsic::x86_mmx_packsswb;
2171 
2172  case llvm::Intrinsic::x86_mmx_packssdw:
2173  return llvm::Intrinsic::x86_mmx_packssdw;
2174  default:
2175  llvm_unreachable("unexpected intrinsic id");
2176  }
2177  }
2178 
2179  // \brief Instrument vector pack instrinsic.
2180  //
2181  // This function instruments intrinsics like x86_mmx_packsswb, that
2182  // packs elements of 2 input vectors into half as many bits with saturation.
2183  // Shadow is propagated with the signed variant of the same intrinsic applied
2184  // to sext(Sa != zeroinitializer), sext(Sb != zeroinitializer).
2185  // EltSizeInBits is used only for x86mmx arguments.
2186  void handleVectorPackIntrinsic(IntrinsicInst &I, unsigned EltSizeInBits = 0) {
2187  assert(I.getNumArgOperands() == 2);
2188  bool isX86_MMX = I.getOperand(0)->getType()->isX86_MMXTy();
2189  IRBuilder<> IRB(&I);
2190  Value *S1 = getShadow(&I, 0);
2191  Value *S2 = getShadow(&I, 1);
2192  assert(isX86_MMX || S1->getType()->isVectorTy());
2193 
2194  // SExt and ICmpNE below must apply to individual elements of input vectors.
2195  // In case of x86mmx arguments, cast them to appropriate vector types and
2196  // back.
2197  Type *T = isX86_MMX ? getMMXVectorTy(EltSizeInBits) : S1->getType();
2198  if (isX86_MMX) {
2199  S1 = IRB.CreateBitCast(S1, T);
2200  S2 = IRB.CreateBitCast(S2, T);
2201  }
2202  Value *S1_ext = IRB.CreateSExt(
2204  Value *S2_ext = IRB.CreateSExt(
2206  if (isX86_MMX) {
2207  Type *X86_MMXTy = Type::getX86_MMXTy(*MS.C);
2208  S1_ext = IRB.CreateBitCast(S1_ext, X86_MMXTy);
2209  S2_ext = IRB.CreateBitCast(S2_ext, X86_MMXTy);
2210  }
2211 
2212  Function *ShadowFn = Intrinsic::getDeclaration(
2213  F.getParent(), getSignedPackIntrinsic(I.getIntrinsicID()));
2214 
2215  Value *S =
2216  IRB.CreateCall(ShadowFn, {S1_ext, S2_ext}, "_msprop_vector_pack");
2217  if (isX86_MMX) S = IRB.CreateBitCast(S, getShadowTy(&I));
2218  setShadow(&I, S);
2219  setOriginForNaryOp(I);
2220  }
2221 
2222  // \brief Instrument sum-of-absolute-differencies intrinsic.
2223  void handleVectorSadIntrinsic(IntrinsicInst &I) {
2224  const unsigned SignificantBitsPerResultElement = 16;
2225  bool isX86_MMX = I.getOperand(0)->getType()->isX86_MMXTy();
2226  Type *ResTy = isX86_MMX ? IntegerType::get(*MS.C, 64) : I.getType();
2227  unsigned ZeroBitsPerResultElement =
2228  ResTy->getScalarSizeInBits() - SignificantBitsPerResultElement;
2229 
2230  IRBuilder<> IRB(&I);
2231  Value *S = IRB.CreateOr(getShadow(&I, 0), getShadow(&I, 1));
2232  S = IRB.CreateBitCast(S, ResTy);
2233  S = IRB.CreateSExt(IRB.CreateICmpNE(S, Constant::getNullValue(ResTy)),
2234  ResTy);
2235  S = IRB.CreateLShr(S, ZeroBitsPerResultElement);
2236  S = IRB.CreateBitCast(S, getShadowTy(&I));
2237  setShadow(&I, S);
2238  setOriginForNaryOp(I);
2239  }
2240 
2241  // \brief Instrument multiply-add intrinsic.
2242  void handleVectorPmaddIntrinsic(IntrinsicInst &I,
2243  unsigned EltSizeInBits = 0) {
2244  bool isX86_MMX = I.getOperand(0)->getType()->isX86_MMXTy();
2245  Type *ResTy = isX86_MMX ? getMMXVectorTy(EltSizeInBits * 2) : I.getType();
2246  IRBuilder<> IRB(&I);
2247  Value *S = IRB.CreateOr(getShadow(&I, 0), getShadow(&I, 1));
2248  S = IRB.CreateBitCast(S, ResTy);
2249  S = IRB.CreateSExt(IRB.CreateICmpNE(S, Constant::getNullValue(ResTy)),
2250  ResTy);
2251  S = IRB.CreateBitCast(S, getShadowTy(&I));
2252  setShadow(&I, S);
2253  setOriginForNaryOp(I);
2254  }
2255 
2256  void visitIntrinsicInst(IntrinsicInst &I) {
2257  switch (I.getIntrinsicID()) {
2258  case llvm::Intrinsic::bswap:
2259  handleBswap(I);
2260  break;
2261  case llvm::Intrinsic::x86_avx512_cvtsd2usi64:
2262  case llvm::Intrinsic::x86_avx512_cvtsd2usi:
2263  case llvm::Intrinsic::x86_avx512_cvtss2usi64:
2264  case llvm::Intrinsic::x86_avx512_cvtss2usi:
2265  case llvm::Intrinsic::x86_avx512_cvttss2usi64:
2266  case llvm::Intrinsic::x86_avx512_cvttss2usi:
2267  case llvm::Intrinsic::x86_avx512_cvttsd2usi64:
2268  case llvm::Intrinsic::x86_avx512_cvttsd2usi:
2269  case llvm::Intrinsic::x86_avx512_cvtusi2sd:
2270  case llvm::Intrinsic::x86_avx512_cvtusi2ss:
2271  case llvm::Intrinsic::x86_avx512_cvtusi642sd:
2272  case llvm::Intrinsic::x86_avx512_cvtusi642ss:
2273  case llvm::Intrinsic::x86_sse2_cvtsd2si64:
2274  case llvm::Intrinsic::x86_sse2_cvtsd2si:
2275  case llvm::Intrinsic::x86_sse2_cvtsd2ss:
2276  case llvm::Intrinsic::x86_sse2_cvtsi2sd:
2277  case llvm::Intrinsic::x86_sse2_cvtsi642sd:
2278  case llvm::Intrinsic::x86_sse2_cvtss2sd:
2279  case llvm::Intrinsic::x86_sse2_cvttsd2si64:
2280  case llvm::Intrinsic::x86_sse2_cvttsd2si:
2281  case llvm::Intrinsic::x86_sse_cvtsi2ss:
2282  case llvm::Intrinsic::x86_sse_cvtsi642ss:
2283  case llvm::Intrinsic::x86_sse_cvtss2si64:
2284  case llvm::Intrinsic::x86_sse_cvtss2si:
2285  case llvm::Intrinsic::x86_sse_cvttss2si64:
2286  case llvm::Intrinsic::x86_sse_cvttss2si:
2287  handleVectorConvertIntrinsic(I, 1);
2288  break;
2289  case llvm::Intrinsic::x86_sse2_cvtdq2pd:
2290  case llvm::Intrinsic::x86_sse2_cvtps2pd:
2291  case llvm::Intrinsic::x86_sse_cvtps2pi:
2292  case llvm::Intrinsic::x86_sse_cvttps2pi:
2293  handleVectorConvertIntrinsic(I, 2);
2294  break;
2295  case llvm::Intrinsic::x86_avx2_psll_w:
2296  case llvm::Intrinsic::x86_avx2_psll_d:
2297  case llvm::Intrinsic::x86_avx2_psll_q:
2298  case llvm::Intrinsic::x86_avx2_pslli_w:
2299  case llvm::Intrinsic::x86_avx2_pslli_d:
2300  case llvm::Intrinsic::x86_avx2_pslli_q:
2301  case llvm::Intrinsic::x86_avx2_psrl_w:
2302  case llvm::Intrinsic::x86_avx2_psrl_d:
2303  case llvm::Intrinsic::x86_avx2_psrl_q:
2304  case llvm::Intrinsic::x86_avx2_psra_w:
2305  case llvm::Intrinsic::x86_avx2_psra_d:
2306  case llvm::Intrinsic::x86_avx2_psrli_w:
2307  case llvm::Intrinsic::x86_avx2_psrli_d:
2308  case llvm::Intrinsic::x86_avx2_psrli_q:
2309  case llvm::Intrinsic::x86_avx2_psrai_w:
2310  case llvm::Intrinsic::x86_avx2_psrai_d:
2311  case llvm::Intrinsic::x86_sse2_psll_w:
2312  case llvm::Intrinsic::x86_sse2_psll_d:
2313  case llvm::Intrinsic::x86_sse2_psll_q:
2314  case llvm::Intrinsic::x86_sse2_pslli_w:
2315  case llvm::Intrinsic::x86_sse2_pslli_d:
2316  case llvm::Intrinsic::x86_sse2_pslli_q:
2317  case llvm::Intrinsic::x86_sse2_psrl_w:
2318  case llvm::Intrinsic::x86_sse2_psrl_d:
2319  case llvm::Intrinsic::x86_sse2_psrl_q:
2320  case llvm::Intrinsic::x86_sse2_psra_w:
2321  case llvm::Intrinsic::x86_sse2_psra_d:
2322  case llvm::Intrinsic::x86_sse2_psrli_w:
2323  case llvm::Intrinsic::x86_sse2_psrli_d:
2324  case llvm::Intrinsic::x86_sse2_psrli_q:
2325  case llvm::Intrinsic::x86_sse2_psrai_w:
2326  case llvm::Intrinsic::x86_sse2_psrai_d:
2327  case llvm::Intrinsic::x86_mmx_psll_w:
2328  case llvm::Intrinsic::x86_mmx_psll_d:
2329  case llvm::Intrinsic::x86_mmx_psll_q:
2330  case llvm::Intrinsic::x86_mmx_pslli_w:
2331  case llvm::Intrinsic::x86_mmx_pslli_d:
2332  case llvm::Intrinsic::x86_mmx_pslli_q:
2333  case llvm::Intrinsic::x86_mmx_psrl_w:
2334  case llvm::Intrinsic::x86_mmx_psrl_d:
2335  case llvm::Intrinsic::x86_mmx_psrl_q:
2336  case llvm::Intrinsic::x86_mmx_psra_w:
2337  case llvm::Intrinsic::x86_mmx_psra_d:
2338  case llvm::Intrinsic::x86_mmx_psrli_w:
2339  case llvm::Intrinsic::x86_mmx_psrli_d:
2340  case llvm::Intrinsic::x86_mmx_psrli_q:
2341  case llvm::Intrinsic::x86_mmx_psrai_w:
2342  case llvm::Intrinsic::x86_mmx_psrai_d:
2343  handleVectorShiftIntrinsic(I, /* Variable */ false);
2344  break;
2345  case llvm::Intrinsic::x86_avx2_psllv_d:
2346  case llvm::Intrinsic::x86_avx2_psllv_d_256:
2347  case llvm::Intrinsic::x86_avx2_psllv_q:
2348  case llvm::Intrinsic::x86_avx2_psllv_q_256:
2349  case llvm::Intrinsic::x86_avx2_psrlv_d:
2350  case llvm::Intrinsic::x86_avx2_psrlv_d_256:
2351  case llvm::Intrinsic::x86_avx2_psrlv_q:
2352  case llvm::Intrinsic::x86_avx2_psrlv_q_256:
2353  case llvm::Intrinsic::x86_avx2_psrav_d:
2354  case llvm::Intrinsic::x86_avx2_psrav_d_256:
2355  handleVectorShiftIntrinsic(I, /* Variable */ true);
2356  break;
2357 
2358  case llvm::Intrinsic::x86_sse2_packsswb_128:
2359  case llvm::Intrinsic::x86_sse2_packssdw_128:
2360  case llvm::Intrinsic::x86_sse2_packuswb_128:
2361  case llvm::Intrinsic::x86_sse41_packusdw:
2362  case llvm::Intrinsic::x86_avx2_packsswb:
2363  case llvm::Intrinsic::x86_avx2_packssdw:
2364  case llvm::Intrinsic::x86_avx2_packuswb:
2365  case llvm::Intrinsic::x86_avx2_packusdw:
2366  handleVectorPackIntrinsic(I);
2367  break;
2368 
2369  case llvm::Intrinsic::x86_mmx_packsswb:
2370  case llvm::Intrinsic::x86_mmx_packuswb:
2371  handleVectorPackIntrinsic(I, 16);
2372  break;
2373 
2374  case llvm::Intrinsic::x86_mmx_packssdw:
2375  handleVectorPackIntrinsic(I, 32);
2376  break;
2377 
2378  case llvm::Intrinsic::x86_mmx_psad_bw:
2379  case llvm::Intrinsic::x86_sse2_psad_bw:
2380  case llvm::Intrinsic::x86_avx2_psad_bw:
2381  handleVectorSadIntrinsic(I);
2382  break;
2383 
2384  case llvm::Intrinsic::x86_sse2_pmadd_wd:
2385  case llvm::Intrinsic::x86_avx2_pmadd_wd:
2386  case llvm::Intrinsic::x86_ssse3_pmadd_ub_sw_128:
2387  case llvm::Intrinsic::x86_avx2_pmadd_ub_sw:
2388  handleVectorPmaddIntrinsic(I);
2389  break;
2390 
2391  case llvm::Intrinsic::x86_ssse3_pmadd_ub_sw:
2392  handleVectorPmaddIntrinsic(I, 8);
2393  break;
2394 
2395  case llvm::Intrinsic::x86_mmx_pmadd_wd:
2396  handleVectorPmaddIntrinsic(I, 16);
2397  break;
2398 
2399  default:
2400  if (!handleUnknownIntrinsic(I))
2401  visitInstruction(I);
2402  break;
2403  }
2404  }
2405 
2406  void visitCallSite(CallSite CS) {
2407  Instruction &I = *CS.getInstruction();
2408  assert((CS.isCall() || CS.isInvoke()) && "Unknown type of CallSite");
2409  if (CS.isCall()) {
2410  CallInst *Call = cast<CallInst>(&I);
2411 
2412  // For inline asm, do the usual thing: check argument shadow and mark all
2413  // outputs as clean. Note that any side effects of the inline asm that are
2414  // not immediately visible in its constraints are not handled.
2415  if (Call->isInlineAsm()) {
2416  visitInstruction(I);
2417  return;
2418  }
2419 
2420  assert(!isa<IntrinsicInst>(&I) && "intrinsics are handled elsewhere");
2421 
2422  // We are going to insert code that relies on the fact that the callee
2423  // will become a non-readonly function after it is instrumented by us. To
2424  // prevent this code from being optimized out, mark that function
2425  // non-readonly in advance.
2426  if (Function *Func = Call->getCalledFunction()) {
2427  // Clear out readonly/readnone attributes.
2428  AttrBuilder B;
2429  B.addAttribute(Attribute::ReadOnly)
2430  .addAttribute(Attribute::ReadNone);
2431  Func->removeAttributes(AttributeSet::FunctionIndex,
2432  AttributeSet::get(Func->getContext(),
2433  AttributeSet::FunctionIndex,
2434  B));
2435  }
2436  }
2437  IRBuilder<> IRB(&I);
2438 
2439  unsigned ArgOffset = 0;
2440  DEBUG(dbgs() << " CallSite: " << I << "\n");
2441  for (CallSite::arg_iterator ArgIt = CS.arg_begin(), End = CS.arg_end();
2442  ArgIt != End; ++ArgIt) {
2443  Value *A = *ArgIt;
2444  unsigned i = ArgIt - CS.arg_begin();
2445  if (!A->getType()->isSized()) {
2446  DEBUG(dbgs() << "Arg " << i << " is not sized: " << I << "\n");
2447  continue;
2448  }
2449  unsigned Size = 0;
2450  Value *Store = nullptr;
2451  // Compute the Shadow for arg even if it is ByVal, because
2452  // in that case getShadow() will copy the actual arg shadow to
2453  // __msan_param_tls.
2454  Value *ArgShadow = getShadow(A);
2455  Value *ArgShadowBase = getShadowPtrForArgument(A, IRB, ArgOffset);
2456  DEBUG(dbgs() << " Arg#" << i << ": " << *A <<
2457  " Shadow: " << *ArgShadow << "\n");
2458  bool ArgIsInitialized = false;
2459  const DataLayout &DL = F.getParent()->getDataLayout();
2460  if (CS.paramHasAttr(i + 1, Attribute::ByVal)) {
2461  assert(A->getType()->isPointerTy() &&
2462  "ByVal argument is not a pointer!");
2463  Size = DL.getTypeAllocSize(A->getType()->getPointerElementType());
2464  if (ArgOffset + Size > kParamTLSSize) break;
2465  unsigned ParamAlignment = CS.getParamAlignment(i + 1);
2466  unsigned Alignment = std::min(ParamAlignment, kShadowTLSAlignment);
2467  Store = IRB.CreateMemCpy(ArgShadowBase,
2468  getShadowPtr(A, Type::getInt8Ty(*MS.C), IRB),
2469  Size, Alignment);
2470  } else {
2471  Size = DL.getTypeAllocSize(A->getType());
2472  if (ArgOffset + Size > kParamTLSSize) break;
2473  Store = IRB.CreateAlignedStore(ArgShadow, ArgShadowBase,
2475  Constant *Cst = dyn_cast<Constant>(ArgShadow);
2476  if (Cst && Cst->isNullValue()) ArgIsInitialized = true;
2477  }
2478  if (MS.TrackOrigins && !ArgIsInitialized)
2479  IRB.CreateStore(getOrigin(A),
2480  getOriginPtrForArgument(A, IRB, ArgOffset));
2481  (void)Store;
2482  assert(Size != 0 && Store != nullptr);
2483  DEBUG(dbgs() << " Param:" << *Store << "\n");
2484  ArgOffset += RoundUpToAlignment(Size, 8);
2485  }
2486  DEBUG(dbgs() << " done with call args\n");
2487 
2488  FunctionType *FT =
2489  cast<FunctionType>(CS.getCalledValue()->getType()->getContainedType(0));
2490  if (FT->isVarArg()) {
2491  VAHelper->visitCallSite(CS, IRB);
2492  }
2493 
2494  // Now, get the shadow for the RetVal.
2495  if (!I.getType()->isSized()) return;
2496  IRBuilder<> IRBBefore(&I);
2497  // Until we have full dynamic coverage, make sure the retval shadow is 0.
2498  Value *Base = getShadowPtrForRetval(&I, IRBBefore);
2499  IRBBefore.CreateAlignedStore(getCleanShadow(&I), Base, kShadowTLSAlignment);
2500  Instruction *NextInsn = nullptr;
2501  if (CS.isCall()) {
2502  NextInsn = I.getNextNode();
2503  } else {
2504  BasicBlock *NormalDest = cast<InvokeInst>(&I)->getNormalDest();
2505  if (!NormalDest->getSinglePredecessor()) {
2506  // FIXME: this case is tricky, so we are just conservative here.
2507  // Perhaps we need to split the edge between this BB and NormalDest,
2508  // but a naive attempt to use SplitEdge leads to a crash.
2509  setShadow(&I, getCleanShadow(&I));
2510  setOrigin(&I, getCleanOrigin());
2511  return;
2512  }
2513  NextInsn = NormalDest->getFirstInsertionPt();
2514  assert(NextInsn &&
2515  "Could not find insertion point for retval shadow load");
2516  }
2517  IRBuilder<> IRBAfter(NextInsn);
2518  Value *RetvalShadow =
2519  IRBAfter.CreateAlignedLoad(getShadowPtrForRetval(&I, IRBAfter),
2520  kShadowTLSAlignment, "_msret");
2521  setShadow(&I, RetvalShadow);
2522  if (MS.TrackOrigins)
2523  setOrigin(&I, IRBAfter.CreateLoad(getOriginPtrForRetval(IRBAfter)));
2524  }
2525 
2526  void visitReturnInst(ReturnInst &I) {
2527  IRBuilder<> IRB(&I);
2528  Value *RetVal = I.getReturnValue();
2529  if (!RetVal) return;
2530  Value *ShadowPtr = getShadowPtrForRetval(RetVal, IRB);
2531  if (CheckReturnValue) {
2532  insertShadowCheck(RetVal, &I);
2533  Value *Shadow = getCleanShadow(RetVal);
2534  IRB.CreateAlignedStore(Shadow, ShadowPtr, kShadowTLSAlignment);
2535  } else {
2536  Value *Shadow = getShadow(RetVal);
2537  IRB.CreateAlignedStore(Shadow, ShadowPtr, kShadowTLSAlignment);
2538  // FIXME: make it conditional if ClStoreCleanOrigin==0
2539  if (MS.TrackOrigins)
2540  IRB.CreateStore(getOrigin(RetVal), getOriginPtrForRetval(IRB));
2541  }
2542  }
2543 
2544  void visitPHINode(PHINode &I) {
2545  IRBuilder<> IRB(&I);
2546  if (!PropagateShadow) {
2547  setShadow(&I, getCleanShadow(&I));
2548  setOrigin(&I, getCleanOrigin());
2549  return;
2550  }
2551 
2552  ShadowPHINodes.push_back(&I);
2553  setShadow(&I, IRB.CreatePHI(getShadowTy(&I), I.getNumIncomingValues(),
2554  "_msphi_s"));
2555  if (MS.TrackOrigins)
2556  setOrigin(&I, IRB.CreatePHI(MS.OriginTy, I.getNumIncomingValues(),
2557  "_msphi_o"));
2558  }
2559 
2560  void visitAllocaInst(AllocaInst &I) {
2561  setShadow(&I, getCleanShadow(&I));
2562  setOrigin(&I, getCleanOrigin());
2563  IRBuilder<> IRB(I.getNextNode());
2564  const DataLayout &DL = F.getParent()->getDataLayout();
2565  uint64_t Size = DL.getTypeAllocSize(I.getAllocatedType());
2566  if (PoisonStack && ClPoisonStackWithCall) {
2567  IRB.CreateCall(MS.MsanPoisonStackFn,
2568  {IRB.CreatePointerCast(&I, IRB.getInt8PtrTy()),
2569  ConstantInt::get(MS.IntptrTy, Size)});
2570  } else {
2571  Value *ShadowBase = getShadowPtr(&I, Type::getInt8PtrTy(*MS.C), IRB);
2572  Value *PoisonValue = IRB.getInt8(PoisonStack ? ClPoisonStackPattern : 0);
2573  IRB.CreateMemSet(ShadowBase, PoisonValue, Size, I.getAlignment());
2574  }
2575 
2576  if (PoisonStack && MS.TrackOrigins) {
2577  SmallString<2048> StackDescriptionStorage;
2578  raw_svector_ostream StackDescription(StackDescriptionStorage);
2579  // We create a string with a description of the stack allocation and
2580  // pass it into __msan_set_alloca_origin.
2581  // It will be printed by the run-time if stack-originated UMR is found.
2582  // The first 4 bytes of the string are set to '----' and will be replaced
2583  // by __msan_va_arg_overflow_size_tls at the first call.
2584  StackDescription << "----" << I.getName() << "@" << F.getName();
2585  Value *Descr =
2587  StackDescription.str());
2588 
2589  IRB.CreateCall(MS.MsanSetAllocaOrigin4Fn,
2590  {IRB.CreatePointerCast(&I, IRB.getInt8PtrTy()),
2591  ConstantInt::get(MS.IntptrTy, Size),
2592  IRB.CreatePointerCast(Descr, IRB.getInt8PtrTy()),
2593  IRB.CreatePointerCast(&F, MS.IntptrTy)});
2594  }
2595  }
2596 
2597  void visitSelectInst(SelectInst& I) {
2598  IRBuilder<> IRB(&I);
2599  // a = select b, c, d
2600  Value *B = I.getCondition();
2601  Value *C = I.getTrueValue();
2602  Value *D = I.getFalseValue();
2603  Value *Sb = getShadow(B);
2604  Value *Sc = getShadow(C);
2605  Value *Sd = getShadow(D);
2606 
2607  // Result shadow if condition shadow is 0.
2608  Value *Sa0 = IRB.CreateSelect(B, Sc, Sd);
2609  Value *Sa1;
2610  if (I.getType()->isAggregateType()) {
2611  // To avoid "sign extending" i1 to an arbitrary aggregate type, we just do
2612  // an extra "select". This results in much more compact IR.
2613  // Sa = select Sb, poisoned, (select b, Sc, Sd)
2614  Sa1 = getPoisonedShadow(getShadowTy(I.getType()));
2615  } else {
2616  // Sa = select Sb, [ (c^d) | Sc | Sd ], [ b ? Sc : Sd ]
2617  // If Sb (condition is poisoned), look for bits in c and d that are equal
2618  // and both unpoisoned.
2619  // If !Sb (condition is unpoisoned), simply pick one of Sc and Sd.
2620 
2621  // Cast arguments to shadow-compatible type.
2622  C = CreateAppToShadowCast(IRB, C);
2623  D = CreateAppToShadowCast(IRB, D);
2624 
2625  // Result shadow if condition shadow is 1.
2626  Sa1 = IRB.CreateOr(IRB.CreateXor(C, D), IRB.CreateOr(Sc, Sd));
2627  }
2628  Value *Sa = IRB.CreateSelect(Sb, Sa1, Sa0, "_msprop_select");
2629  setShadow(&I, Sa);
2630  if (MS.TrackOrigins) {
2631  // Origins are always i32, so any vector conditions must be flattened.
2632  // FIXME: consider tracking vector origins for app vectors?
2633  if (B->getType()->isVectorTy()) {
2634  Type *FlatTy = getShadowTyNoVec(B->getType());
2635  B = IRB.CreateICmpNE(IRB.CreateBitCast(B, FlatTy),
2636  ConstantInt::getNullValue(FlatTy));
2637  Sb = IRB.CreateICmpNE(IRB.CreateBitCast(Sb, FlatTy),
2638  ConstantInt::getNullValue(FlatTy));
2639  }
2640  // a = select b, c, d
2641  // Oa = Sb ? Ob : (b ? Oc : Od)
2642  setOrigin(
2643  &I, IRB.CreateSelect(Sb, getOrigin(I.getCondition()),
2644  IRB.CreateSelect(B, getOrigin(I.getTrueValue()),
2645  getOrigin(I.getFalseValue()))));
2646  }
2647  }
2648 
2649  void visitLandingPadInst(LandingPadInst &I) {
2650  // Do nothing.
2651  // See http://code.google.com/p/memory-sanitizer/issues/detail?id=1
2652  setShadow(&I, getCleanShadow(&I));
2653  setOrigin(&I, getCleanOrigin());
2654  }
2655 
2656  void visitGetElementPtrInst(GetElementPtrInst &I) {
2657  handleShadowOr(I);
2658  }
2659 
2660  void visitExtractValueInst(ExtractValueInst &I) {
2661  IRBuilder<> IRB(&I);
2662  Value *Agg = I.getAggregateOperand();
2663  DEBUG(dbgs() << "ExtractValue: " << I << "\n");
2664  Value *AggShadow = getShadow(Agg);
2665  DEBUG(dbgs() << " AggShadow: " << *AggShadow << "\n");
2666  Value *ResShadow = IRB.CreateExtractValue(AggShadow, I.getIndices());
2667  DEBUG(dbgs() << " ResShadow: " << *ResShadow << "\n");
2668  setShadow(&I, ResShadow);
2669  setOriginForNaryOp(I);
2670  }
2671 
2672  void visitInsertValueInst(InsertValueInst &I) {
2673  IRBuilder<> IRB(&I);
2674  DEBUG(dbgs() << "InsertValue: " << I << "\n");
2675  Value *AggShadow = getShadow(I.getAggregateOperand());
2676  Value *InsShadow = getShadow(I.getInsertedValueOperand());
2677  DEBUG(dbgs() << " AggShadow: " << *AggShadow << "\n");
2678  DEBUG(dbgs() << " InsShadow: " << *InsShadow << "\n");
2679  Value *Res = IRB.CreateInsertValue(AggShadow, InsShadow, I.getIndices());
2680  DEBUG(dbgs() << " Res: " << *Res << "\n");
2681  setShadow(&I, Res);
2682  setOriginForNaryOp(I);
2683  }
2684 
2685  void dumpInst(Instruction &I) {
2686  if (CallInst *CI = dyn_cast<CallInst>(&I)) {
2687  errs() << "ZZZ call " << CI->getCalledFunction()->getName() << "\n";
2688  } else {
2689  errs() << "ZZZ " << I.getOpcodeName() << "\n";
2690  }
2691  errs() << "QQQ " << I << "\n";
2692  }
2693 
2694  void visitResumeInst(ResumeInst &I) {
2695  DEBUG(dbgs() << "Resume: " << I << "\n");
2696  // Nothing to do here.
2697  }
2698 
2699  void visitInstruction(Instruction &I) {
2700  // Everything else: stop propagating and check for poisoned shadow.
2702  dumpInst(I);
2703  DEBUG(dbgs() << "DEFAULT: " << I << "\n");
2704  for (size_t i = 0, n = I.getNumOperands(); i < n; i++)
2705  insertShadowCheck(I.getOperand(i), &I);
2706  setShadow(&I, getCleanShadow(&I));
2707  setOrigin(&I, getCleanOrigin());
2708  }
2709 };
2710 
2711 /// \brief AMD64-specific implementation of VarArgHelper.
2712 struct VarArgAMD64Helper : public VarArgHelper {
2713  // An unfortunate workaround for asymmetric lowering of va_arg stuff.
2714  // See a comment in visitCallSite for more details.
2715  static const unsigned AMD64GpEndOffset = 48; // AMD64 ABI Draft 0.99.6 p3.5.7
2716  static const unsigned AMD64FpEndOffset = 176;
2717 
2718  Function &F;
2719  MemorySanitizer &MS;
2720  MemorySanitizerVisitor &MSV;
2721  Value *VAArgTLSCopy;
2722  Value *VAArgOverflowSize;
2723 
2724  SmallVector<CallInst*, 16> VAStartInstrumentationList;
2725 
2726  VarArgAMD64Helper(Function &F, MemorySanitizer &MS,
2727  MemorySanitizerVisitor &MSV)
2728  : F(F), MS(MS), MSV(MSV), VAArgTLSCopy(nullptr),
2729  VAArgOverflowSize(nullptr) {}
2730 
2731  enum ArgKind { AK_GeneralPurpose, AK_FloatingPoint, AK_Memory };
2732 
2733  ArgKind classifyArgument(Value* arg) {
2734  // A very rough approximation of X86_64 argument classification rules.
2735  Type *T = arg->getType();
2736  if (T->isFPOrFPVectorTy() || T->isX86_MMXTy())
2737  return AK_FloatingPoint;
2738  if (T->isIntegerTy() && T->getPrimitiveSizeInBits() <= 64)
2739  return AK_GeneralPurpose;
2740  if (T->isPointerTy())
2741  return AK_GeneralPurpose;
2742  return AK_Memory;
2743  }
2744 
2745  // For VarArg functions, store the argument shadow in an ABI-specific format
2746  // that corresponds to va_list layout.
2747  // We do this because Clang lowers va_arg in the frontend, and this pass
2748  // only sees the low level code that deals with va_list internals.
2749  // A much easier alternative (provided that Clang emits va_arg instructions)
2750  // would have been to associate each live instance of va_list with a copy of
2751  // MSanParamTLS, and extract shadow on va_arg() call in the argument list
2752  // order.
2753  void visitCallSite(CallSite &CS, IRBuilder<> &IRB) override {
2754  unsigned GpOffset = 0;
2755  unsigned FpOffset = AMD64GpEndOffset;
2756  unsigned OverflowOffset = AMD64FpEndOffset;
2757  const DataLayout &DL = F.getParent()->getDataLayout();
2758  for (CallSite::arg_iterator ArgIt = CS.arg_begin(), End = CS.arg_end();
2759  ArgIt != End; ++ArgIt) {
2760  Value *A = *ArgIt;
2761  unsigned ArgNo = CS.getArgumentNo(ArgIt);
2762  bool IsByVal = CS.paramHasAttr(ArgNo + 1, Attribute::ByVal);
2763  if (IsByVal) {
2764  // ByVal arguments always go to the overflow area.
2765  assert(A->getType()->isPointerTy());
2766  Type *RealTy = A->getType()->getPointerElementType();
2767  uint64_t ArgSize = DL.getTypeAllocSize(RealTy);
2768  Value *Base = getShadowPtrForVAArgument(RealTy, IRB, OverflowOffset);
2769  OverflowOffset += RoundUpToAlignment(ArgSize, 8);
2770  IRB.CreateMemCpy(Base, MSV.getShadowPtr(A, IRB.getInt8Ty(), IRB),
2771  ArgSize, kShadowTLSAlignment);
2772  } else {
2773  ArgKind AK = classifyArgument(A);
2774  if (AK == AK_GeneralPurpose && GpOffset >= AMD64GpEndOffset)
2775  AK = AK_Memory;
2776  if (AK == AK_FloatingPoint && FpOffset >= AMD64FpEndOffset)
2777  AK = AK_Memory;
2778  Value *Base;
2779  switch (AK) {
2780  case AK_GeneralPurpose:
2781  Base = getShadowPtrForVAArgument(A->getType(), IRB, GpOffset);
2782  GpOffset += 8;
2783  break;
2784  case AK_FloatingPoint:
2785  Base = getShadowPtrForVAArgument(A->getType(), IRB, FpOffset);
2786  FpOffset += 16;
2787  break;
2788  case AK_Memory:
2789  uint64_t ArgSize = DL.getTypeAllocSize(A->getType());
2790  Base = getShadowPtrForVAArgument(A->getType(), IRB, OverflowOffset);
2791  OverflowOffset += RoundUpToAlignment(ArgSize, 8);
2792  }
2793  IRB.CreateAlignedStore(MSV.getShadow(A), Base, kShadowTLSAlignment);
2794  }
2795  }
2796  Constant *OverflowSize =
2797  ConstantInt::get(IRB.getInt64Ty(), OverflowOffset - AMD64FpEndOffset);
2798  IRB.CreateStore(OverflowSize, MS.VAArgOverflowSizeTLS);
2799  }
2800 
2801  /// \brief Compute the shadow address for a given va_arg.
2802  Value *getShadowPtrForVAArgument(Type *Ty, IRBuilder<> &IRB,
2803  int ArgOffset) {
2804  Value *Base = IRB.CreatePointerCast(MS.VAArgTLS, MS.IntptrTy);
2805  Base = IRB.CreateAdd(Base, ConstantInt::get(MS.IntptrTy, ArgOffset));
2806  return IRB.CreateIntToPtr(Base, PointerType::get(MSV.getShadowTy(Ty), 0),
2807  "_msarg");
2808  }
2809 
2810  void visitVAStartInst(VAStartInst &I) override {
2811  IRBuilder<> IRB(&I);
2812  VAStartInstrumentationList.push_back(&I);
2813  Value *VAListTag = I.getArgOperand(0);
2814  Value *ShadowPtr = MSV.getShadowPtr(VAListTag, IRB.getInt8Ty(), IRB);
2815 
2816  // Unpoison the whole __va_list_tag.
2817  // FIXME: magic ABI constants.
2818  IRB.CreateMemSet(ShadowPtr, Constant::getNullValue(IRB.getInt8Ty()),
2819  /* size */24, /* alignment */8, false);
2820  }
2821 
2822  void visitVACopyInst(VACopyInst &I) override {
2823  IRBuilder<> IRB(&I);
2824  Value *VAListTag = I.getArgOperand(0);
2825  Value *ShadowPtr = MSV.getShadowPtr(VAListTag, IRB.getInt8Ty(), IRB);
2826 
2827  // Unpoison the whole __va_list_tag.
2828  // FIXME: magic ABI constants.
2829  IRB.CreateMemSet(ShadowPtr, Constant::getNullValue(IRB.getInt8Ty()),
2830  /* size */24, /* alignment */8, false);
2831  }
2832 
2833  void finalizeInstrumentation() override {
2834  assert(!VAArgOverflowSize && !VAArgTLSCopy &&
2835  "finalizeInstrumentation called twice");
2836  if (!VAStartInstrumentationList.empty()) {
2837  // If there is a va_start in this function, make a backup copy of
2838  // va_arg_tls somewhere in the function entry block.
2840  VAArgOverflowSize = IRB.CreateLoad(MS.VAArgOverflowSizeTLS);
2841  Value *CopySize =
2842  IRB.CreateAdd(ConstantInt::get(MS.IntptrTy, AMD64FpEndOffset),
2843  VAArgOverflowSize);
2844  VAArgTLSCopy = IRB.CreateAlloca(Type::getInt8Ty(*MS.C), CopySize);
2845  IRB.CreateMemCpy(VAArgTLSCopy, MS.VAArgTLS, CopySize, 8);
2846  }
2847 
2848  // Instrument va_start.
2849  // Copy va_list shadow from the backup copy of the TLS contents.
2850  for (size_t i = 0, n = VAStartInstrumentationList.size(); i < n; i++) {
2851  CallInst *OrigInst = VAStartInstrumentationList[i];
2852  IRBuilder<> IRB(OrigInst->getNextNode());
2853  Value *VAListTag = OrigInst->getArgOperand(0);
2854 
2855  Value *RegSaveAreaPtrPtr =
2856  IRB.CreateIntToPtr(
2857  IRB.CreateAdd(IRB.CreatePtrToInt(VAListTag, MS.IntptrTy),
2858  ConstantInt::get(MS.IntptrTy, 16)),
2859  Type::getInt64PtrTy(*MS.C));
2860  Value *RegSaveAreaPtr = IRB.CreateLoad(RegSaveAreaPtrPtr);
2861  Value *RegSaveAreaShadowPtr =
2862  MSV.getShadowPtr(RegSaveAreaPtr, IRB.getInt8Ty(), IRB);
2863  IRB.CreateMemCpy(RegSaveAreaShadowPtr, VAArgTLSCopy,
2864  AMD64FpEndOffset, 16);
2865 
2866  Value *OverflowArgAreaPtrPtr =
2867  IRB.CreateIntToPtr(
2868  IRB.CreateAdd(IRB.CreatePtrToInt(VAListTag, MS.IntptrTy),
2869  ConstantInt::get(MS.IntptrTy, 8)),
2870  Type::getInt64PtrTy(*MS.C));
2871  Value *OverflowArgAreaPtr = IRB.CreateLoad(OverflowArgAreaPtrPtr);
2872  Value *OverflowArgAreaShadowPtr =
2873  MSV.getShadowPtr(OverflowArgAreaPtr, IRB.getInt8Ty(), IRB);
2874  Value *SrcPtr = IRB.CreateConstGEP1_32(IRB.getInt8Ty(), VAArgTLSCopy,
2875  AMD64FpEndOffset);
2876  IRB.CreateMemCpy(OverflowArgAreaShadowPtr, SrcPtr, VAArgOverflowSize, 16);
2877  }
2878  }
2879 };
2880 
2881 /// \brief MIPS64-specific implementation of VarArgHelper.
2882 struct VarArgMIPS64Helper : public VarArgHelper {
2883  Function &F;
2884  MemorySanitizer &MS;
2885  MemorySanitizerVisitor &MSV;
2886  Value *VAArgTLSCopy;
2887  Value *VAArgSize;
2888 
2889  SmallVector<CallInst*, 16> VAStartInstrumentationList;
2890 
2891  VarArgMIPS64Helper(Function &F, MemorySanitizer &MS,
2892  MemorySanitizerVisitor &MSV)
2893  : F(F), MS(MS), MSV(MSV), VAArgTLSCopy(nullptr),
2894  VAArgSize(nullptr) {}
2895 
2896  void visitCallSite(CallSite &CS, IRBuilder<> &IRB) override {
2897  unsigned VAArgOffset = 0;
2898  const DataLayout &DL = F.getParent()->getDataLayout();
2899  for (CallSite::arg_iterator ArgIt = CS.arg_begin() + 1, End = CS.arg_end();
2900  ArgIt != End; ++ArgIt) {
2901  Value *A = *ArgIt;
2902  Value *Base;
2903  uint64_t ArgSize = DL.getTypeAllocSize(A->getType());
2904 #if defined(__MIPSEB__) || defined(MIPSEB)
2905  // Adjusting the shadow for argument with size < 8 to match the placement
2906  // of bits in big endian system
2907  if (ArgSize < 8)
2908  VAArgOffset += (8 - ArgSize);
2909 #endif
2910  Base = getShadowPtrForVAArgument(A->getType(), IRB, VAArgOffset);
2911  VAArgOffset += ArgSize;
2912  VAArgOffset = RoundUpToAlignment(VAArgOffset, 8);
2913  IRB.CreateAlignedStore(MSV.getShadow(A), Base, kShadowTLSAlignment);
2914  }
2915 
2916  Constant *TotalVAArgSize = ConstantInt::get(IRB.getInt64Ty(), VAArgOffset);
2917  // Here using VAArgOverflowSizeTLS as VAArgSizeTLS to avoid creation of
2918  // a new class member i.e. it is the total size of all VarArgs.
2919  IRB.CreateStore(TotalVAArgSize, MS.VAArgOverflowSizeTLS);
2920  }
2921 
2922  /// \brief Compute the shadow address for a given va_arg.
2923  Value *getShadowPtrForVAArgument(Type *Ty, IRBuilder<> &IRB,
2924  int ArgOffset) {
2925  Value *Base = IRB.CreatePointerCast(MS.VAArgTLS, MS.IntptrTy);
2926  Base = IRB.CreateAdd(Base, ConstantInt::get(MS.IntptrTy, ArgOffset));
2927  return IRB.CreateIntToPtr(Base, PointerType::get(MSV.getShadowTy(Ty), 0),
2928  "_msarg");
2929  }
2930 
2931  void visitVAStartInst(VAStartInst &I) override {
2932  IRBuilder<> IRB(&I);
2933  VAStartInstrumentationList.push_back(&I);
2934  Value *VAListTag = I.getArgOperand(0);
2935  Value *ShadowPtr = MSV.getShadowPtr(VAListTag, IRB.getInt8Ty(), IRB);
2936  IRB.CreateMemSet(ShadowPtr, Constant::getNullValue(IRB.getInt8Ty()),
2937  /* size */8, /* alignment */8, false);
2938  }
2939 
2940  void visitVACopyInst(VACopyInst &I) override {
2941  IRBuilder<> IRB(&I);
2942  Value *VAListTag = I.getArgOperand(0);
2943  Value *ShadowPtr = MSV.getShadowPtr(VAListTag, IRB.getInt8Ty(), IRB);
2944  // Unpoison the whole __va_list_tag.
2945  // FIXME: magic ABI constants.
2946  IRB.CreateMemSet(ShadowPtr, Constant::getNullValue(IRB.getInt8Ty()),
2947  /* size */8, /* alignment */8, false);
2948  }
2949 
2950  void finalizeInstrumentation() override {
2951  assert(!VAArgSize && !VAArgTLSCopy &&
2952  "finalizeInstrumentation called twice");
2954  VAArgSize = IRB.CreateLoad(MS.VAArgOverflowSizeTLS);
2955  Value *CopySize = IRB.CreateAdd(ConstantInt::get(MS.IntptrTy, 0),
2956  VAArgSize);
2957 
2958  if (!VAStartInstrumentationList.empty()) {
2959  // If there is a va_start in this function, make a backup copy of
2960  // va_arg_tls somewhere in the function entry block.
2961  VAArgTLSCopy = IRB.CreateAlloca(Type::getInt8Ty(*MS.C), CopySize);
2962  IRB.CreateMemCpy(VAArgTLSCopy, MS.VAArgTLS, CopySize, 8);
2963  }
2964 
2965  // Instrument va_start.
2966  // Copy va_list shadow from the backup copy of the TLS contents.
2967  for (size_t i = 0, n = VAStartInstrumentationList.size(); i < n; i++) {
2968  CallInst *OrigInst = VAStartInstrumentationList[i];
2969  IRBuilder<> IRB(OrigInst->getNextNode());
2970  Value *VAListTag = OrigInst->getArgOperand(0);
2971  Value *RegSaveAreaPtrPtr =
2972  IRB.CreateIntToPtr(IRB.CreatePtrToInt(VAListTag, MS.IntptrTy),
2973  Type::getInt64PtrTy(*MS.C));
2974  Value *RegSaveAreaPtr = IRB.CreateLoad(RegSaveAreaPtrPtr);
2975  Value *RegSaveAreaShadowPtr =
2976  MSV.getShadowPtr(RegSaveAreaPtr, IRB.getInt8Ty(), IRB);
2977  IRB.CreateMemCpy(RegSaveAreaShadowPtr, VAArgTLSCopy, CopySize, 8);
2978  }
2979  }
2980 };
2981 
2982 /// \brief A no-op implementation of VarArgHelper.
2983 struct VarArgNoOpHelper : public VarArgHelper {
2984  VarArgNoOpHelper(Function &F, MemorySanitizer &MS,
2985  MemorySanitizerVisitor &MSV) {}
2986 
2987  void visitCallSite(CallSite &CS, IRBuilder<> &IRB) override {}
2988 
2989  void visitVAStartInst(VAStartInst &I) override {}
2990 
2991  void visitVACopyInst(VACopyInst &I) override {}
2992 
2993  void finalizeInstrumentation() override {}
2994 };
2995 
2996 VarArgHelper *CreateVarArgHelper(Function &Func, MemorySanitizer &Msan,
2997  MemorySanitizerVisitor &Visitor) {
2998  // VarArg handling is only implemented on AMD64. False positives are possible
2999  // on other platforms.
3000  llvm::Triple TargetTriple(Func.getParent()->getTargetTriple());
3001  if (TargetTriple.getArch() == llvm::Triple::x86_64)
3002  return new VarArgAMD64Helper(Func, Msan, Visitor);
3003  else if (TargetTriple.getArch() == llvm::Triple::mips64 ||
3004  TargetTriple.getArch() == llvm::Triple::mips64el)
3005  return new VarArgMIPS64Helper(Func, Msan, Visitor);
3006  else
3007  return new VarArgNoOpHelper(Func, Msan, Visitor);
3008 }
3009 
3010 } // namespace
3011 
3012 bool MemorySanitizer::runOnFunction(Function &F) {
3013  if (&F == MsanCtorFunction)
3014  return false;
3015  MemorySanitizerVisitor Visitor(F, *this);
3016 
3017  // Clear out readonly/readnone attributes.
3018  AttrBuilder B;
3019  B.addAttribute(Attribute::ReadOnly)
3020  .addAttribute(Attribute::ReadNone);
3021  F.removeAttributes(AttributeSet::FunctionIndex,
3022  AttributeSet::get(F.getContext(),
3023  AttributeSet::FunctionIndex, B));
3024 
3025  return Visitor.runOnFunction();
3026 }
Value * CreateLShr(Value *LHS, Value *RHS, const Twine &Name="", bool isExact=false)
Definition: IRBuilder.h:842
ReturnInst - Return a value (possibly void), from a function.
Value * getValueOperand()
Definition: Instructions.h:406
const Value * getCalledValue() const
getCalledValue - Get a pointer to the function that is invoked by this instruction.
iplist< Instruction >::iterator eraseFromParent()
eraseFromParent - This method unlinks 'this' from the containing basic block and deletes it...
Definition: Instruction.cpp:70
unsigned Log2_32_Ceil(uint32_t Value)
Log2_32_Ceil - This function returns the ceil log base 2 of the specified value, 32 if the value is z...
Definition: MathExtras.h:481
A parsed version of the target data layout string in and methods for querying it. ...
Definition: DataLayout.h:104
IntegerType * getType() const
getType - Specialize the getType() method to always return an IntegerType, which reduces the amount o...
Definition: Constants.h:140
AllocaInst * CreateAlloca(Type *Ty, Value *ArraySize=nullptr, const Twine &Name="")
Definition: IRBuilder.h:967
static Constant * getString(LLVMContext &Context, StringRef Initializer, bool AddNull=true)
getString - This method constructs a CDS and initializes it with a text string.
Definition: Constants.cpp:2612
raw_ostream & errs()
This returns a reference to a raw_ostream for standard error.
BasicBlock::iterator GetInsertPoint() const
Definition: IRBuilder.h:80
LoadInst * CreateLoad(Value *Ptr, const char *Name)
Definition: IRBuilder.h:973
void addIncoming(Value *V, BasicBlock *BB)
addIncoming - Add an incoming value to the end of the PHI list
ExtractValueInst - This instruction extracts a struct member or array element value from an aggregate...
LLVMContext & getContext() const
getContext - Return a reference to the LLVMContext associated with this function. ...
Definition: Function.cpp:223
LLVM Argument representation.
Definition: Argument.h:35
Base class for instruction visitors.
Definition: InstVisitor.h:81
Value * getAggregateOperand()
Value * CreateICmp(CmpInst::Predicate P, Value *LHS, Value *RHS, const Twine &Name="")
Definition: IRBuilder.h:1442
Type * getSequentialElementType() const
Definition: Type.cpp:204
ArrayRef< unsigned > getIndices() const
Value * CreateIntCast(Value *V, Type *DestTy, bool isSigned, const Twine &Name="")
Definition: IRBuilder.h:1316
A Module instance is used to store all the information related to an LLVM module. ...
Definition: Module.h:114
void setOrdering(AtomicOrdering Ordering)
Set the ordering constraint on this RMW.
Definition: Instructions.h:753
AtomicOrdering getSuccessOrdering() const
Returns the ordering constraint on this cmpxchg.
Definition: Instructions.h:592
InstrTy * getInstruction() const
Definition: CallSite.h:82
Same, but only replaced by something equivalent.
Definition: GlobalValue.h:45
Intrinsic::ID getIntrinsicID() const
getIntrinsicID - Return the intrinsic ID of this intrinsic.
Definition: IntrinsicInst.h:44
Value * CreateICmpSLT(Value *LHS, Value *RHS, const Twine &Name="")
Definition: IRBuilder.h:1378
AtomicCmpXchgInst - an instruction that atomically checks whether a specified value is in a memory lo...
Definition: Instructions.h:515
static cl::opt< int > ClPoisonStackPattern("msan-poison-stack-pattern", cl::desc("poison uninitialized stack variables with the given patter"), cl::Hidden, cl::init(0xff))
static cl::opt< bool > ClPoisonStackWithCall("msan-poison-stack-with-call", cl::desc("poison uninitialized stack variables with a call"), cl::Hidden, cl::init(false))
This class represents zero extension of integer types.
unsigned getNumOperands() const
Definition: User.h:138
static const unsigned kRetvalTLSSize
void appendToGlobalCtors(Module &M, Function *F, int Priority)
Append F to the list of global ctors of module M with the given Priority.
Definition: ModuleUtils.cpp:73
CallInst - This class represents a function call, abstracting a target machine's calling convention...
void setOrdering(AtomicOrdering Ordering)
Set the ordering constraint on this load.
Definition: Instructions.h:256
TerminatorInst * SplitBlockAndInsertIfThen(Value *Cond, Instruction *SplitBefore, bool Unreachable, MDNode *BranchWeights=nullptr, DominatorTree *DT=nullptr)
SplitBlockAndInsertIfThen - Split the containing block at the specified instruction - everything befo...
static PointerType * get(Type *ElementType, unsigned AddressSpace)
PointerType::get - This constructs a pointer to an object of the specified type in a numbered address...
Definition: Type.cpp:738
Value * CreatePointerCast(Value *V, Type *DestTy, const Twine &Name="")
Definition: IRBuilder.h:1293
bool isSigned() const
Determine if this instruction is using a signed comparison.
Definition: InstrTypes.h:826
Like Internal, but omit from symbol table.
Definition: GlobalValue.h:48
ShuffleVectorInst - This instruction constructs a fixed permutation of two input vectors.
Externally visible function.
Definition: GlobalValue.h:40
A raw_ostream that writes to an SmallVector or SmallString.
Definition: raw_ostream.h:488
bool isPtrOrPtrVectorTy() const
isPtrOrPtrVectorTy - Return true if this is a pointer type or a vector of pointer types...
Definition: Type.h:222
MemSetInst - This class wraps the llvm.memset intrinsic.
static bool isEquality(Predicate P)
isEquality - Return true if this predicate is either EQ or NE.
Metadata node.
Definition: Metadata.h:740
F(f)
This class represents a sign extension of integer types.
CallInst * CreateMemSet(Value *Ptr, Value *Val, uint64_t Size, unsigned Align, bool isVolatile=false, MDNode *TBAATag=nullptr, MDNode *ScopeTag=nullptr, MDNode *NoAliasTag=nullptr)
Create and insert a memset to the specified pointer and the specified value.
Definition: IRBuilder.h:365
LoadInst - an instruction for reading from memory.
Definition: Instructions.h:177
FunctionType * getType(LLVMContext &Context, ID id, ArrayRef< Type * > Tys=None)
Return the function type for an intrinsic.
Definition: Function.cpp:822
AttrBuilder & addAttribute(Attribute::AttrKind Val)
Add an attribute to the builder.
AtomicRMWInst - an instruction that atomically reads a memory location, combines it with another valu...
Definition: Instructions.h:674
Hexagon Common GEP
Value * CreateICmpEQ(Value *LHS, Value *RHS, const Twine &Name="")
Definition: IRBuilder.h:1354
#define op(i)
Value * CreateShuffleVector(Value *V1, Value *V2, Value *Mask, const Twine &Name="")
Definition: IRBuilder.h:1522
const std::string & getTargetTriple() const
Get the target triple which is a string describing the target host.
Definition: Module.h:261
static cl::opt< bool > ClHandleICmp("msan-handle-icmp", cl::desc("propagate shadow through ICmpEQ and ICmpNE"), cl::Hidden, cl::init(true))
op_iterator op_begin()
Definition: User.h:183
LLVM_ATTRIBUTE_NORETURN void report_fatal_error(const char *reason, bool gen_crash_diag=true)
Reports a serious error, calling any installed error handler.
Type * getPointerElementType() const
Definition: Type.h:366
Value * CreateBinOp(Instruction::BinaryOps Opc, Value *LHS, Value *RHS, const Twine &Name="", MDNode *FPMathTag=nullptr)
Definition: IRBuilder.h:923
Value * CreateInsertElement(Value *Vec, Value *NewElt, Value *Idx, const Twine &Name="")
Definition: IRBuilder.h:1508
static Constant * getNullValue(Type *Ty)
Definition: Constants.cpp:178
StringRef getName() const
Return a constant reference to the value's name.
Definition: Value.cpp:188
IntegerType * getInt32Ty()
Fetch the type representing a 32-bit integer.
Definition: IRBuilder.h:306
ArrayRef< unsigned > getIndices() const
IterTy arg_end() const
Definition: CallSite.h:157
Value * CreateExtractValue(Value *Agg, ArrayRef< unsigned > Idxs, const Twine &Name="")
Definition: IRBuilder.h:1541
PHINode * CreatePHI(Type *Ty, unsigned NumReservedValues, const Twine &Name="")
Definition: IRBuilder.h:1462
Value * CreateXor(Value *LHS, Value *RHS, const Twine &Name="")
Definition: IRBuilder.h:910
static cl::opt< bool > ClDumpStrictInstructions("msan-dump-strict-instructions", cl::desc("print out instructions with default strict semantics"), cl::Hidden, cl::init(false))
SelectInst - This class represents the LLVM 'select' instruction.
Value * getReturnValue() const
Convenience accessor. Returns null if there is no return value.
static cl::opt< ITMode > IT(cl::desc("IT block support"), cl::Hidden, cl::init(DefaultIT), cl::ZeroOrMore, cl::values(clEnumValN(DefaultIT,"arm-default-it","Generate IT block based on arch"), clEnumValN(RestrictedIT,"arm-restrict-it","Disallow deprecated IT based on ARMv8"), clEnumValN(NoRestrictedIT,"arm-no-restrict-it","Allow IT blocks based on ARMv7"), clEnumValEnd))
IntegerType * getInt64Ty()
Fetch the type representing a 64-bit integer.
Definition: IRBuilder.h:311
This is the base class for all instructions that perform data casts.
Definition: InstrTypes.h:389
const APInt & getValue() const
Return the constant as an APInt value reference.
Definition: Constants.h:106
NodeTy * getNextNode()
Get the next node, or 0 for the list tail.
Definition: ilist_node.h:80
ArrayRef< T > makeArrayRef(const T &OneElt)
Construct an ArrayRef from a single element.
Definition: ArrayRef.h:308
UndefValue - 'undef' values are things that do not have specified contents.
Definition: Constants.h:1220
MemMoveInst - This class wraps the llvm.memmove intrinsic.
StructType - Class to represent struct types.
Definition: DerivedTypes.h:191
#define llvm_unreachable(msg)
Marks that the current location is not supposed to be reachable.
Definition: ErrorHandling.h:98
Value * CreateIntToPtr(Value *V, Type *DestTy, const Twine &Name="")
Definition: IRBuilder.h:1249
static cl::opt< bool > ClCheckAccessAddress("msan-check-access-address", cl::desc("report accesses through a pointer which has poisoned shadow"), cl::Hidden, cl::init(true))
unsigned getNumArgOperands() const
getNumArgOperands - Return the number of call arguments.
Instruction * getFirstNonPHI()
Returns a pointer to the first instruction in this block that is not a PHINode instruction.
Definition: BasicBlock.cpp:165
This provides a uniform API for creating instructions and inserting them into a basic block: either a...
Definition: IRBuilder.h:517
bool isSized(SmallPtrSetImpl< const Type * > *Visited=nullptr) const
isSized - Return true if it makes sense to take the size of this type.
Definition: Type.h:268
Number of individual test Apply this number of consecutive mutations to each input exit after the first new interesting input is found the minimized corpus is saved into the first input directory Number of jobs to run If min(jobs, NumberOfCpuCores()/2)\" is used.") FUZZER_FLAG_INT(reload
void setName(const Twine &Name)
Change the name of the value.
Definition: Value.cpp:250
Type * getVectorElementType() const
Definition: Type.h:364
uint16_t getParamAlignment(uint16_t i) const
Extract the alignment for a call or parameter (0=unknown).
Definition: CallSite.h:247
This class represents a cast from a pointer to an integer.
AtomicOrdering
Definition: Instructions.h:38
FunctionType - Class to represent function types.
Definition: DerivedTypes.h:96
void dumpInst(Value *base, char *instName)
AtomicOrdering getOrdering() const
Returns the ordering constraint on this RMW.
Definition: Instructions.h:769
Value * CreateAnd(Value *LHS, Value *RHS, const Twine &Name="")
Definition: IRBuilder.h:878
VAStartInst - This represents the llvm.va_start intrinsic.
Value * CreateOr(Value *LHS, Value *RHS, const Twine &Name="")
Definition: IRBuilder.h:894
static const char *const kMsanInitName
ValTy * getCalledValue() const
getCalledValue - Return the pointer to function that is being called.
Definition: CallSite.h:91
#define T
static cl::opt< int > ClTrackOrigins("msan-track-origins", cl::desc("Track origins (allocation sites) of poisoned memory"), cl::Hidden, cl::init(0))
Track origins of uninitialized values.
ArrayType - Class to represent array types.
Definition: DerivedTypes.h:336
This instruction compares its operands according to the predicate given to the constructor.
This class represents a no-op cast from one type to another.
static FunctionType * get(Type *Result, ArrayRef< Type * > Params, bool isVarArg)
FunctionType::get - This static method is the primary way of constructing a FunctionType.
Definition: Type.cpp:361
Value * getInsertedValueOperand()
SmallString - A SmallString is just a SmallVector with methods and accessors that make it work better...
Definition: SmallString.h:25
Function * getDeclaration(Module *M, ID id, ArrayRef< Type * > Tys=None)
Create or insert an LLVM Function declaration for an intrinsic, and return it.
Definition: Function.cpp:866
StoreInst - an instruction for storing to memory.
Definition: Instructions.h:316
signed greater than
static const unsigned kParamTLSSize
Value * CreateConstGEP1_32(Value *Ptr, unsigned Idx0, const Twine &Name="")
Definition: IRBuilder.h:1083
static cl::opt< bool > ClPoisonStack("msan-poison-stack", cl::desc("poison uninitialized stack variables"), cl::Hidden, cl::init(true))
void removeAttributes(unsigned i, AttributeSet attr)
removes the attributes from the list of attributes.
Definition: Function.cpp:353
StoreInst * CreateStore(Value *Val, Value *Ptr, bool isVolatile=false)
Definition: IRBuilder.h:985
const char * getOpcodeName() const
Definition: Instruction.h:114
This class represents a truncation of integer types.
bool isAtomic() const
isAtomic - Return true if this instruction has an AtomicOrdering of unordered or higher.
void SetInsertPoint(BasicBlock *TheBB)
This specifies that created instructions should be appended to the end of the specified block...
Definition: IRBuilder.h:85
FunctionPass * createMemorySanitizerPass(int TrackOrigins=0)
unsigned getNumIncomingValues() const
getNumIncomingValues - Return the number of incoming edges
static const unsigned kMinOriginAlignment
GetElementPtrInst - an instruction for type-safe pointer arithmetic to access elements of arrays and ...
Definition: Instructions.h:830
bool isX86_MMXTy() const
isX86_MMXTy - Return true if this is X86 MMX.
Definition: Type.h:179
bool isIntOrIntVectorTy() const
isIntOrIntVectorTy - Return true if this is an integer type or a vector of integer types...
Definition: Type.h:201
initializer< Ty > init(const Ty &Val)
Definition: CommandLine.h:325
InsertElementInst - This instruction inserts a single (scalar) element into a VectorType value...
LandingPadInst - The landingpad instruction holds all of the information necessary to generate correc...
unsigned getAlignment() const
getAlignment - Return the alignment of the access that is being performed
Definition: Instructions.h:365
Constant * getOrInsertFunction(StringRef Name, FunctionType *T, AttributeSet AttributeList)
Look up the specified function in the module symbol table.
Definition: Module.cpp:115
LLVM Basic Block Representation.
Definition: BasicBlock.h:65
The instances of the Type class are immutable: once they are created, they are never changed...
Definition: Type.h:45
This is an important class for using LLVM in a threaded context.
Definition: LLVMContext.h:41
unsigned getArgumentNo(Value::const_user_iterator I) const
Given a value use iterator, returns the argument that corresponds to it.
Definition: CallSite.h:132
bool isVectorTy() const
isVectorTy - True if this is an instance of VectorType.
Definition: Type.h:226
Value * CreateNot(Value *V, const Twine &Name="")
Definition: IRBuilder.h:957
Value * CreateAdd(Value *LHS, Value *RHS, const Twine &Name="", bool HasNUW=false, bool HasNSW=false)
Definition: IRBuilder.h:704
Type * getContainedType(unsigned i) const
getContainedType - This method is used to implement the type iterator (defined at the end of the file...
Definition: Type.h:332
Value * CreatePtrToInt(Value *V, Type *DestTy, const Twine &Name="")
Definition: IRBuilder.h:1245
This is an important base class in LLVM.
Definition: Constant.h:41
const Value * getCondition() const
ResumeInst - Resume the propagation of an exception.
unsigned getAlignment() const
getAlignment - Return the alignment of the memory that is being allocated by the instruction.
Definition: Instructions.h:130
bool isZeroValue() const
Return true if the value is negative zero or null value.
Definition: Constants.cpp:66
op_iterator op_end()
Definition: User.h:185
This instruction compares its operands according to the predicate given to the constructor.
Predicate
This enumeration lists the possible predicates for CmpInst subclasses.
Definition: InstrTypes.h:697
FunctionPass class - This class is used to implement most global optimizations.
Definition: Pass.h:294
static const unsigned kShadowTLSAlignment
Value * getOperand(unsigned i) const
Definition: User.h:118
Value * getPointerOperand()
Definition: Instructions.h:284
Class to represent integer types.
Definition: DerivedTypes.h:37
Predicate getPredicate() const
Return the predicate for this instruction.
Definition: InstrTypes.h:760
IntegerType * getIntNTy(unsigned N)
Fetch the type representing an N-bit integer.
Definition: IRBuilder.h:321
Constant * getAggregateElement(unsigned Elt) const
getAggregateElement - For aggregates (struct/array/vector) return the constant that corresponds to th...
Definition: Constants.cpp:250
This class represents a cast from an integer to a pointer.
bool isPointerTy() const
isPointerTy - True if this is an instance of PointerType.
Definition: Type.h:217
static std::string itostr(int64_t X)
Definition: StringExtras.h:109
CallInst * CreateCall(Value *Callee, ArrayRef< Value * > Args=None, const Twine &Name="")
Definition: IRBuilder.h:1467
bool isFPOrFPVectorTy() const
isFPOrFPVectorTy - Return true if this is a FP type or a vector of FP.
Definition: Type.h:183
PointerType * getInt8PtrTy(unsigned AddrSpace=0)
Fetch the type representing a pointer to an 8-bit integer value.
Definition: IRBuilder.h:346
StoreInst * CreateAlignedStore(Value *Val, Value *Ptr, unsigned Align, bool isVolatile=false)
Definition: IRBuilder.h:1008
MDNode * createBranchWeights(uint32_t TrueWeight, uint32_t FalseWeight)
Return metadata containing two branch weights.
Definition: MDBuilder.cpp:37
LoadInst * CreateAlignedLoad(Value *Ptr, unsigned Align, const char *Name)
Definition: IRBuilder.h:991
const Value * getTrueValue() const
Triple - Helper class for working with autoconf configuration names.
Definition: Triple.h:44
bool isRelational() const
isRelational - Return true if the predicate is relational (not EQ or NE).
unsigned countTrailingZeros() const
Count the number of trailing zero bits.
Definition: APInt.cpp:749
signed less than
BinaryOps getOpcode() const
Definition: InstrTypes.h:323
unsigned getABITypeAlignment(Type *Ty) const
Returns the minimum ABI-required alignment for the specified type.
Definition: DataLayout.cpp:674
See the file comment.
Definition: ValueMap.h:80
AtomicOrdering getOrdering() const
Returns the ordering effect of this store.
Definition: Instructions.h:372
This is the shared class of boolean and integer constants.
Definition: Constants.h:47
Value * CreateExtractElement(Value *Vec, Value *Idx, const Twine &Name="")
Definition: IRBuilder.h:1495
Value * CreateZExt(Value *V, Type *DestTy, const Twine &Name="")
Definition: IRBuilder.h:1192
uint64_t getTypeAllocSize(Type *Ty) const
Returns the offset in bytes between successive objects of the specified type, including alignment pad...
Definition: DataLayout.h:388
unsigned getVectorNumElements() const
Definition: Type.cpp:212
bool paramHasAttr(unsigned i, Attribute::AttrKind A) const
Return true if the call or the callee has the given attribute.
Definition: CallSite.h:242
unsigned getScalarSizeInBits() const LLVM_READONLY
getScalarSizeInBits - If this is a vector type, return the getPrimitiveSizeInBits value for the eleme...
Definition: Type.cpp:139
const Module * getModule() const
Return the module owning the function this instruction belongs to or nullptr it the function does not...
Definition: Instruction.cpp:57
Value * CreateBitCast(Value *V, Type *DestTy, const Twine &Name="")
Definition: IRBuilder.h:1253
This is a 'vector' (really, a variable-sized array), optimized for the case when the array is small...
Definition: SmallVector.h:861
static size_t TypeSizeToSizeIndex(uint32_t TypeSize)
Module.h This file contains the declarations for the Module class.
Type * getType() const
All values are typed, get the type of this value.
Definition: Value.h:222
MDNode * getMetadata(unsigned KindID) const
getMetadata - Get the metadata of given kind attached to this Instruction.
Definition: Instruction.h:167
static cl::opt< int > ClInstrumentationWithCallThreshold("msan-instrumentation-with-call-threshold", cl::desc("If the function being instrumented requires more than ""this number of checks and origin stores, use callbacks instead of ""inline checks (-1 means never use callbacks)."), cl::Hidden, cl::init(3500))
CHAIN = SC CHAIN, Imm128 - System call.
ConstantInt * getInt32(uint32_t C)
Get a constant 32-bit value.
Definition: IRBuilder.h:266
Value * CreateMul(Value *LHS, Value *RHS, const Twine &Name="", bool HasNUW=false, bool HasNSW=false)
Definition: IRBuilder.h:748
MemCpyInst - This class wraps the llvm.memcpy intrinsic.
Function * getCalledFunction() const
getCalledFunction - Return the function called, or null if this is an indirect function invocation...
AtomicOrdering getOrdering() const
Returns the ordering effect of this fence.
Definition: Instructions.h:250
const BasicBlock & getEntryBlock() const
Definition: Function.h:442
bool isNullValue() const
isNullValue - Return true if this is the value that would be returned by getNullValue.
Definition: Constants.cpp:75
static const size_t kNumberOfAccessSizes
static GlobalVariable * createPrivateNonConstGlobalForString(Module &M, StringRef Str)
Create a non-const global initialized with the given string.
static cl::opt< bool > ClKeepGoing("msan-keep-going", cl::desc("keep going after reporting a UMR"), cl::Hidden, cl::init(false))
raw_ostream & dbgs()
dbgs() - This returns a reference to a raw_ostream for debugging messages.
Definition: Debug.cpp:123
Value * getArgOperand(unsigned i) const
getArgOperand/setArgOperand - Return/set the i-th call argument.
VectorType - Class to represent vector types.
Definition: DerivedTypes.h:362
Class for arbitrary precision integers.
Definition: APInt.h:73
bool isIntegerTy() const
isIntegerTy - True if this is an instance of IntegerType.
Definition: Type.h:193
Value * CreateSelect(Value *C, Value *True, Value *False, const Twine &Name="")
Definition: IRBuilder.h:1482
BasicBlock * getSinglePredecessor()
Return the predecessor of this block if it has a single predecessor block.
Definition: BasicBlock.cpp:211
IntegerType * getInt8Ty()
Fetch the type representing an 8-bit integer.
Definition: IRBuilder.h:296
LLVM_ATTRIBUTE_UNUSED_RESULT std::enable_if< !is_simple_type< Y >::value, typename cast_retty< X, const Y >::ret_type >::type dyn_cast(const Y &Val)
Definition: Casting.h:285
bool isInlineAsm() const
isInlineAsm - Check if this call is an inline asm statement.
uint64_t RoundUpToAlignment(uint64_t Value, uint64_t Align)
Returns the next integer (mod 2**64) that is greater than or equal to Value and is a multiple of Alig...
Definition: MathExtras.h:609
Value * CreateInsertValue(Value *Agg, Value *Val, ArrayRef< unsigned > Idxs, const Twine &Name="")
Definition: IRBuilder.h:1549
const Type * getScalarType() const LLVM_READONLY
getScalarType - If this is a vector type, return the element type, otherwise return 'this'...
Definition: Type.cpp:51
Value * CreateShl(Value *LHS, Value *RHS, const Twine &Name="", bool HasNUW=false, bool HasNSW=false)
Definition: IRBuilder.h:823
void setOrdering(AtomicOrdering Ordering)
Set the ordering constraint on this store.
Definition: Instructions.h:378
const DataLayout & getDataLayout() const
Get the data layout for the module's target platform.
Definition: Module.cpp:372
static cl::opt< bool > ClHandleICmpExact("msan-handle-icmp-exact", cl::desc("exact handling of relational integer ICmp"), cl::Hidden, cl::init(false))
bool hasFnAttribute(Attribute::AttrKind Kind) const
Return true if the function has the attribute.
Definition: Function.h:217
bool isAggregateType() const
isAggregateType - Return true if the type is an aggregate type.
Definition: Type.h:260
CallInst * CreateMemCpy(Value *Dst, Value *Src, uint64_t Size, unsigned Align, bool isVolatile=false, MDNode *TBAATag=nullptr, MDNode *TBAAStructTag=nullptr, MDNode *ScopeTag=nullptr, MDNode *NoAliasTag=nullptr)
Create and insert a memcpy between the specified pointers.
Definition: IRBuilder.h:383
INITIALIZE_PASS(MemorySanitizer,"msan","MemorySanitizer: detects uninitialized reads.", false, false) FunctionPass *llvm
unsigned getAlignment() const
getAlignment - Return the alignment of the access that is being performed
Definition: Instructions.h:243
Value * CreateSExt(Value *V, Type *DestTy, const Twine &Name="")
Definition: IRBuilder.h:1195
#define I(x, y, z)
Definition: MD5.cpp:54
static ArrayType * get(Type *ElementType, uint64_t NumElements)
ArrayType::get - This static method is the primary way to construct an ArrayType. ...
Definition: Type.cpp:686
std::pair< Function *, Function * > createSanitizerCtorAndInitFunctions(Module &M, StringRef CtorName, StringRef InitName, ArrayRef< Type * > InitArgTypes, ArrayRef< Value * > InitArgs)
Creates sanitizer constructor function, and calls sanitizer's init function from it.
ExtractElementInst - This instruction extracts a single (scalar) element from a VectorType value...
Value * CreateICmpNE(Value *LHS, Value *RHS, const Twine &Name="")
Definition: IRBuilder.h:1357
static InlineAsm * get(FunctionType *Ty, StringRef AsmString, StringRef Constraints, bool hasSideEffects, bool isAlignStack=false, AsmDialect asmDialect=AD_ATT)
InlineAsm::get - Return the specified uniqued inline asm string.
Definition: InlineAsm.cpp:28
uint64_t getTypeStoreSize(Type *Ty) const
Returns the maximum number of bytes that may be overwritten by storing the specified type...
Definition: DataLayout.h:371
static cl::opt< bool > ClCheckConstantShadow("msan-check-constant-shadow", cl::desc("Insert checks for constant shadow values"), cl::Hidden, cl::init(false))
static const unsigned kOriginSize
bool isVarArg() const
Definition: DerivedTypes.h:120
iterator_range< df_iterator< T > > depth_first(const T &G)
signed less or equal
bool isUnsigned() const
Determine if this instruction is using an unsigned comparison.
Definition: InstrTypes.h:832
VACopyInst - This represents the llvm.va_copy intrinsic.
unsigned getPrimitiveSizeInBits() const LLVM_READONLY
getPrimitiveSizeInBits - Return the basic size of this type if it is a primitive type.
Definition: Type.cpp:121
void setSuccessOrdering(AtomicOrdering Ordering)
Set the ordering constraint on this cmpxchg.
Definition: Instructions.h:569
Module * getParent()
Get the module that this global value is contained inside of...
Definition: GlobalValue.h:365
Value * CreateTrunc(Value *V, Type *DestTy, const Twine &Name="")
Definition: IRBuilder.h:1189
LLVM Value Representation.
Definition: Value.h:69
uint64_t getTypeSizeInBits(Type *Ty) const
Size examples:
Definition: DataLayout.h:507
static cl::opt< bool > ClPoisonUndef("msan-poison-undef", cl::desc("poison undef temps"), cl::Hidden, cl::init(true))
#define DEBUG(X)
Definition: Debug.h:92
IterTy arg_begin() const
arg_begin/arg_end - Return iterators corresponding to the actual argument list for a call site...
Definition: CallSite.h:151
ConstantInt * getInt8(uint8_t C)
Get a constant 8-bit value.
Definition: IRBuilder.h:256
C - The default llvm calling convention, compatible with C.
Definition: CallingConv.h:34
const Value * getFalseValue() const
StringRef - Represent a constant reference to a string, i.e.
Definition: StringRef.h:40
bool removeUnreachableBlocks(Function &F)
Remove all blocks that can not be reached from the function's entry.
Definition: Local.cpp:1254
iterator getFirstInsertionPt()
Returns an iterator to the first instruction in this block that is suitable for inserting a non-PHI i...
Definition: BasicBlock.cpp:194
bool isInvoke() const
isInvoke - true if a InvokeInst is enclosed.
Definition: CallSite.h:80
Type * getAllocatedType() const
getAllocatedType - Return the type that is being allocated by the instruction.
Definition: Instructions.h:122
bool isCall() const
isCall - true if a CallInst is enclosed.
Definition: CallSite.h:76
Value * getPointerOperand()
Definition: Instructions.h:409
MemorySanitizer is on.
Definition: Attributes.h:117
static const char *const kMsanModuleCtorName
iterator_range< arg_iterator > args()
Definition: Function.h:489
IntrinsicInst - A useful wrapper class for inspecting calls to intrinsic functions.
Definition: IntrinsicInst.h:37
signed greater or equal
LLVMContext & getContext() const
Get the global data context.
Definition: Module.h:265
bool isVoidTy() const
isVoidTy - Return true if this is 'void'.
Definition: Type.h:137
AllocaInst - an instruction to allocate memory on the stack.
Definition: Instructions.h:76
InsertValueInst - This instruction inserts a struct field of array element value into an aggregate va...