LLVM  12.0.0git
Functions | Variables
DataFlowSanitizer.cpp File Reference

This file is a part of DataFlowSanitizer, a generalised dynamic data flow analysis. More...

#include "llvm/Transforms/Instrumentation/DataFlowSanitizer.h"
#include "llvm/ADT/DenseMap.h"
#include "llvm/ADT/DenseSet.h"
#include "llvm/ADT/DepthFirstIterator.h"
#include "llvm/ADT/None.h"
#include "llvm/ADT/SmallPtrSet.h"
#include "llvm/ADT/SmallVector.h"
#include "llvm/ADT/StringExtras.h"
#include "llvm/ADT/StringRef.h"
#include "llvm/ADT/Triple.h"
#include "llvm/Analysis/ValueTracking.h"
#include "llvm/IR/Argument.h"
#include "llvm/IR/Attributes.h"
#include "llvm/IR/BasicBlock.h"
#include "llvm/IR/Constant.h"
#include "llvm/IR/Constants.h"
#include "llvm/IR/DataLayout.h"
#include "llvm/IR/DerivedTypes.h"
#include "llvm/IR/Dominators.h"
#include "llvm/IR/Function.h"
#include "llvm/IR/GlobalAlias.h"
#include "llvm/IR/GlobalValue.h"
#include "llvm/IR/GlobalVariable.h"
#include "llvm/IR/IRBuilder.h"
#include "llvm/IR/InlineAsm.h"
#include "llvm/IR/InstVisitor.h"
#include "llvm/IR/InstrTypes.h"
#include "llvm/IR/Instruction.h"
#include "llvm/IR/Instructions.h"
#include "llvm/IR/IntrinsicInst.h"
#include "llvm/IR/LLVMContext.h"
#include "llvm/IR/MDBuilder.h"
#include "llvm/IR/Module.h"
#include "llvm/IR/PassManager.h"
#include "llvm/IR/Type.h"
#include "llvm/IR/User.h"
#include "llvm/IR/Value.h"
#include "llvm/InitializePasses.h"
#include "llvm/Pass.h"
#include "llvm/Support/Casting.h"
#include "llvm/Support/CommandLine.h"
#include "llvm/Support/ErrorHandling.h"
#include "llvm/Support/SpecialCaseList.h"
#include "llvm/Support/VirtualFileSystem.h"
#include "llvm/Transforms/Instrumentation.h"
#include "llvm/Transforms/Utils/BasicBlockUtils.h"
#include "llvm/Transforms/Utils/Local.h"
#include <algorithm>
#include <cassert>
#include <cstddef>
#include <cstdint>
#include <iterator>
#include <memory>
#include <set>
#include <string>
#include <utility>
#include <vector>

Go to the source code of this file.

Functions

static StringRef GetGlobalTypeString (const GlobalValue &G)
 
static ValueexpandFromPrimitiveShadowRecursive (Value *Shadow, SmallVector< unsigned, 4 > &Indices, Type *SubShadowTy, Value *PrimitiveShadow, IRBuilder<> &IRB)
 
 INITIALIZE_PASS (DataFlowSanitizerLegacyPass, "dfsan", "DataFlowSanitizer: dynamic data flow analysis.", false, false) ModulePass *llvm
 

Variables

static const Align kShadowTLSAlignment = Align(2)
 
static const unsigned kArgTLSSize = 800
 
static const unsigned kRetvalTLSSize = 800
 
const char kDFSanExternShadowPtrMask [] = "__dfsan_shadow_ptr_mask"
 
static cl::opt< boolClPreserveAlignment ("dfsan-preserve-alignment", cl::desc("respect alignment requirements provided by input IR"), cl::Hidden, cl::init(false))
 
static cl::list< std::string > ClABIListFiles ("dfsan-abilist", cl::desc("File listing native ABI functions and how the pass treats them"), cl::Hidden)
 
static cl::opt< boolClArgsABI ("dfsan-args-abi", cl::desc("Use the argument ABI rather than the TLS ABI"), cl::Hidden)
 
static cl::opt< boolClCombinePointerLabelsOnLoad ("dfsan-combine-pointer-labels-on-load", cl::desc("Combine the label of the pointer with the label of the data when " "loading from memory."), cl::Hidden, cl::init(true))
 
static cl::opt< boolClCombinePointerLabelsOnStore ("dfsan-combine-pointer-labels-on-store", cl::desc("Combine the label of the pointer with the label of the data when " "storing in memory."), cl::Hidden, cl::init(false))
 
static cl::opt< boolClDebugNonzeroLabels ("dfsan-debug-nonzero-labels", cl::desc("Insert calls to __dfsan_nonzero_label on observing a parameter, " "load or return with a nonzero label"), cl::Hidden)
 
static cl::opt< boolClEventCallbacks ("dfsan-event-callbacks", cl::desc("Insert calls to __dfsan_*_callback functions on data events."), cl::Hidden, cl::init(false))
 
static cl::opt< boolClFast16Labels ("dfsan-fast-16-labels", cl::desc("Use more efficient instrumentation, limiting the number of " "labels to 16."), cl::Hidden, cl::init(false))
 
static cl::opt< boolClTrackSelectControlFlow ("dfsan-track-select-control-flow", cl::desc("Propagate labels from condition values of select instructions " "to results."), cl::Hidden, cl::init(true))
 

Detailed Description

This file is a part of DataFlowSanitizer, a generalised dynamic data flow analysis.

Unlike other Sanitizer tools, this tool is not designed to detect a specific class of bugs on its own. Instead, it provides a generic dynamic data flow analysis framework to be used by clients to help detect application-specific issues within their own code.

The analysis is based on automatic propagation of data flow labels (also known as taint labels) through a program as it performs computation. Each byte of application memory is backed by two bytes of shadow memory which hold the label. On Linux/x86_64, memory is laid out as follows:

+-----------------—+ 0x800000000000 (top of memory) | application memory | +-----------------—+ 0x700000008000 (kAppAddr) | | | unused | | | +-----------------—+ 0x200200000000 (kUnusedAddr) | union table | +-----------------—+ 0x200000000000 (kUnionTableAddr) | shadow memory | +-----------------—+ 0x000000010000 (kShadowAddr) | reserved by kernel | +-----------------—+ 0x000000000000

To derive a shadow memory address from an application memory address, bits 44-46 are cleared to bring the address into the range [0x000000008000,0x100000000000). Then the address is shifted left by 1 to account for the double byte representation of shadow labels and move the address into the shadow memory range. See the function DataFlowSanitizer::getShadowAddress below.

For more information, please refer to the design document: http://clang.llvm.org/docs/DataFlowSanitizerDesign.html

Definition in file DataFlowSanitizer.cpp.

Function Documentation

◆ expandFromPrimitiveShadowRecursive()

static Value* expandFromPrimitiveShadowRecursive ( Value Shadow,
SmallVector< unsigned, 4 > &  Indices,
Type SubShadowTy,
Value PrimitiveShadow,
IRBuilder<> &  IRB 
)
static

◆ GetGlobalTypeString()

static StringRef GetGlobalTypeString ( const GlobalValue G)
static

Definition at line 204 of file DataFlowSanitizer.cpp.

References G.

◆ INITIALIZE_PASS()

INITIALIZE_PASS ( DataFlowSanitizerLegacyPass  ,
"dfsan"  ,
"DataFlowSanitizer: dynamic data flow analysis."  ,
false  ,
false   
)

Definition at line 2234 of file DataFlowSanitizer.cpp.

Variable Documentation

◆ ClABIListFiles

cl::list<std::string> ClABIListFiles("dfsan-abilist", cl::desc("File listing native ABI functions and how the pass treats them"), cl::Hidden)
static

◆ ClArgsABI

cl::opt<bool> ClArgsABI("dfsan-args-abi", cl::desc("Use the argument ABI rather than the TLS ABI"), cl::Hidden)
static

◆ ClCombinePointerLabelsOnLoad

cl::opt<bool> ClCombinePointerLabelsOnLoad("dfsan-combine-pointer-labels-on-load", cl::desc("Combine the label of the pointer with the label of the data when " "loading from memory."), cl::Hidden, cl::init(true))
static

◆ ClCombinePointerLabelsOnStore

cl::opt<bool> ClCombinePointerLabelsOnStore("dfsan-combine-pointer-labels-on-store", cl::desc("Combine the label of the pointer with the label of the data when " "storing in memory."), cl::Hidden, cl::init(false))
static

◆ ClDebugNonzeroLabels

cl::opt<bool> ClDebugNonzeroLabels("dfsan-debug-nonzero-labels", cl::desc("Insert calls to __dfsan_nonzero_label on observing a parameter, " "load or return with a nonzero label"), cl::Hidden)
static

◆ ClEventCallbacks

cl::opt<bool> ClEventCallbacks("dfsan-event-callbacks", cl::desc("Insert calls to __dfsan_*_callback functions on data events."), cl::Hidden, cl::init(false))
static

◆ ClFast16Labels

cl::opt<bool> ClFast16Labels("dfsan-fast-16-labels", cl::desc("Use more efficient instrumentation, limiting the number of " "labels to 16."), cl::Hidden, cl::init(false))
static

◆ ClPreserveAlignment

cl::opt<bool> ClPreserveAlignment("dfsan-preserve-alignment", cl::desc("respect alignment requirements provided by input IR"), cl::Hidden, cl::init(false))
static

◆ ClTrackSelectControlFlow

cl::opt<bool> ClTrackSelectControlFlow("dfsan-track-select-control-flow", cl::desc("Propagate labels from condition values of select instructions " "to results."), cl::Hidden, cl::init(true))
static

◆ kArgTLSSize

const unsigned kArgTLSSize = 800
static

Definition at line 114 of file DataFlowSanitizer.cpp.

◆ kDFSanExternShadowPtrMask

const char kDFSanExternShadowPtrMask[] = "__dfsan_shadow_ptr_mask"

Definition at line 120 of file DataFlowSanitizer.cpp.

◆ kRetvalTLSSize

const unsigned kRetvalTLSSize = 800
static

Definition at line 115 of file DataFlowSanitizer.cpp.

◆ kShadowTLSAlignment

const Align kShadowTLSAlignment = Align(2)
static

Definition at line 110 of file DataFlowSanitizer.cpp.