LLVM  12.0.0git
DataFlowSanitizer.cpp
Go to the documentation of this file.
1 //===- DataFlowSanitizer.cpp - dynamic data flow analysis -----------------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 /// \file
10 /// This file is a part of DataFlowSanitizer, a generalised dynamic data flow
11 /// analysis.
12 ///
13 /// Unlike other Sanitizer tools, this tool is not designed to detect a specific
14 /// class of bugs on its own. Instead, it provides a generic dynamic data flow
15 /// analysis framework to be used by clients to help detect application-specific
16 /// issues within their own code.
17 ///
18 /// The analysis is based on automatic propagation of data flow labels (also
19 /// known as taint labels) through a program as it performs computation. Each
20 /// byte of application memory is backed by two bytes of shadow memory which
21 /// hold the label. On Linux/x86_64, memory is laid out as follows:
22 ///
23 /// +--------------------+ 0x800000000000 (top of memory)
24 /// | application memory |
25 /// +--------------------+ 0x700000008000 (kAppAddr)
26 /// | |
27 /// | unused |
28 /// | |
29 /// +--------------------+ 0x200200000000 (kUnusedAddr)
30 /// | union table |
31 /// +--------------------+ 0x200000000000 (kUnionTableAddr)
32 /// | shadow memory |
33 /// +--------------------+ 0x000000010000 (kShadowAddr)
34 /// | reserved by kernel |
35 /// +--------------------+ 0x000000000000
36 ///
37 /// To derive a shadow memory address from an application memory address,
38 /// bits 44-46 are cleared to bring the address into the range
39 /// [0x000000008000,0x100000000000). Then the address is shifted left by 1 to
40 /// account for the double byte representation of shadow labels and move the
41 /// address into the shadow memory range. See the function
42 /// DataFlowSanitizer::getShadowAddress below.
43 ///
44 /// For more information, please refer to the design document:
45 /// http://clang.llvm.org/docs/DataFlowSanitizerDesign.html
46 //
47 //===----------------------------------------------------------------------===//
48 
50 #include "llvm/ADT/DenseMap.h"
51 #include "llvm/ADT/DenseSet.h"
53 #include "llvm/ADT/None.h"
54 #include "llvm/ADT/SmallPtrSet.h"
55 #include "llvm/ADT/SmallVector.h"
56 #include "llvm/ADT/StringExtras.h"
57 #include "llvm/ADT/StringRef.h"
58 #include "llvm/ADT/Triple.h"
60 #include "llvm/IR/Argument.h"
61 #include "llvm/IR/Attributes.h"
62 #include "llvm/IR/BasicBlock.h"
63 #include "llvm/IR/Constant.h"
64 #include "llvm/IR/Constants.h"
65 #include "llvm/IR/DataLayout.h"
66 #include "llvm/IR/DerivedTypes.h"
67 #include "llvm/IR/Dominators.h"
68 #include "llvm/IR/Function.h"
69 #include "llvm/IR/GlobalAlias.h"
70 #include "llvm/IR/GlobalValue.h"
71 #include "llvm/IR/GlobalVariable.h"
72 #include "llvm/IR/IRBuilder.h"
73 #include "llvm/IR/InlineAsm.h"
74 #include "llvm/IR/InstVisitor.h"
75 #include "llvm/IR/InstrTypes.h"
76 #include "llvm/IR/Instruction.h"
77 #include "llvm/IR/Instructions.h"
78 #include "llvm/IR/IntrinsicInst.h"
79 #include "llvm/IR/LLVMContext.h"
80 #include "llvm/IR/MDBuilder.h"
81 #include "llvm/IR/Module.h"
82 #include "llvm/IR/PassManager.h"
83 #include "llvm/IR/Type.h"
84 #include "llvm/IR/User.h"
85 #include "llvm/IR/Value.h"
86 #include "llvm/InitializePasses.h"
87 #include "llvm/Pass.h"
88 #include "llvm/Support/Casting.h"
96 #include <algorithm>
97 #include <cassert>
98 #include <cstddef>
99 #include <cstdint>
100 #include <iterator>
101 #include <memory>
102 #include <set>
103 #include <string>
104 #include <utility>
105 #include <vector>
106 
107 using namespace llvm;
108 
109 // This must be consistent with ShadowWidthBits.
110 static const Align kShadowTLSAlignment = Align(2);
111 
112 // The size of TLS variables. These constants must be kept in sync with the ones
113 // in dfsan.cpp.
114 static const unsigned kArgTLSSize = 800;
115 static const unsigned kRetvalTLSSize = 800;
116 
117 // External symbol to be used when generating the shadow address for
118 // architectures with multiple VMAs. Instead of using a constant integer
119 // the runtime will set the external mask based on the VMA range.
120 const char kDFSanExternShadowPtrMask[] = "__dfsan_shadow_ptr_mask";
121 
122 // The -dfsan-preserve-alignment flag controls whether this pass assumes that
123 // alignment requirements provided by the input IR are correct. For example,
124 // if the input IR contains a load with alignment 8, this flag will cause
125 // the shadow load to have alignment 16. This flag is disabled by default as
126 // we have unfortunately encountered too much code (including Clang itself;
127 // see PR14291) which performs misaligned access.
129  "dfsan-preserve-alignment",
130  cl::desc("respect alignment requirements provided by input IR"), cl::Hidden,
131  cl::init(false));
132 
133 // The ABI list files control how shadow parameters are passed. The pass treats
134 // every function labelled "uninstrumented" in the ABI list file as conforming
135 // to the "native" (i.e. unsanitized) ABI. Unless the ABI list contains
136 // additional annotations for those functions, a call to one of those functions
137 // will produce a warning message, as the labelling behaviour of the function is
138 // unknown. The other supported annotations are "functional" and "discard",
139 // which are described below under DataFlowSanitizer::WrapperKind.
141  "dfsan-abilist",
142  cl::desc("File listing native ABI functions and how the pass treats them"),
143  cl::Hidden);
144 
145 // Controls whether the pass uses IA_Args or IA_TLS as the ABI for instrumented
146 // functions (see DataFlowSanitizer::InstrumentedABI below).
147 static cl::opt<bool> ClArgsABI(
148  "dfsan-args-abi",
149  cl::desc("Use the argument ABI rather than the TLS ABI"),
150  cl::Hidden);
151 
152 // Controls whether the pass includes or ignores the labels of pointers in load
153 // instructions.
155  "dfsan-combine-pointer-labels-on-load",
156  cl::desc("Combine the label of the pointer with the label of the data when "
157  "loading from memory."),
158  cl::Hidden, cl::init(true));
159 
160 // Controls whether the pass includes or ignores the labels of pointers in
161 // stores instructions.
163  "dfsan-combine-pointer-labels-on-store",
164  cl::desc("Combine the label of the pointer with the label of the data when "
165  "storing in memory."),
166  cl::Hidden, cl::init(false));
167 
169  "dfsan-debug-nonzero-labels",
170  cl::desc("Insert calls to __dfsan_nonzero_label on observing a parameter, "
171  "load or return with a nonzero label"),
172  cl::Hidden);
173 
174 // Experimental feature that inserts callbacks for certain data events.
175 // Currently callbacks are only inserted for loads, stores, memory transfers
176 // (i.e. memcpy and memmove), and comparisons.
177 //
178 // If this flag is set to true, the user must provide definitions for the
179 // following callback functions:
180 // void __dfsan_load_callback(dfsan_label Label, void* addr);
181 // void __dfsan_store_callback(dfsan_label Label, void* addr);
182 // void __dfsan_mem_transfer_callback(dfsan_label *Start, size_t Len);
183 // void __dfsan_cmp_callback(dfsan_label CombinedLabel);
185  "dfsan-event-callbacks",
186  cl::desc("Insert calls to __dfsan_*_callback functions on data events."),
187  cl::Hidden, cl::init(false));
188 
189 // Use a distinct bit for each base label, enabling faster unions with less
190 // instrumentation. Limits the max number of base labels to 16.
192  "dfsan-fast-16-labels",
193  cl::desc("Use more efficient instrumentation, limiting the number of "
194  "labels to 16."),
195  cl::Hidden, cl::init(false));
196 
197 // Controls whether the pass tracks the control flow of select instructions.
199  "dfsan-track-select-control-flow",
200  cl::desc("Propagate labels from condition values of select instructions "
201  "to results."),
202  cl::Hidden, cl::init(true));
203 
205  // Types of GlobalVariables are always pointer types.
206  Type *GType = G.getValueType();
207  // For now we support excluding struct types only.
208  if (StructType *SGType = dyn_cast<StructType>(GType)) {
209  if (!SGType->isLiteral())
210  return SGType->getName();
211  }
212  return "<unknown type>";
213 }
214 
215 namespace {
216 
217 class DFSanABIList {
218  std::unique_ptr<SpecialCaseList> SCL;
219 
220  public:
221  DFSanABIList() = default;
222 
223  void set(std::unique_ptr<SpecialCaseList> List) { SCL = std::move(List); }
224 
225  /// Returns whether either this function or its source file are listed in the
226  /// given category.
227  bool isIn(const Function &F, StringRef Category) const {
228  return isIn(*F.getParent(), Category) ||
229  SCL->inSection("dataflow", "fun", F.getName(), Category);
230  }
231 
232  /// Returns whether this global alias is listed in the given category.
233  ///
234  /// If GA aliases a function, the alias's name is matched as a function name
235  /// would be. Similarly, aliases of globals are matched like globals.
236  bool isIn(const GlobalAlias &GA, StringRef Category) const {
237  if (isIn(*GA.getParent(), Category))
238  return true;
239 
240  if (isa<FunctionType>(GA.getValueType()))
241  return SCL->inSection("dataflow", "fun", GA.getName(), Category);
242 
243  return SCL->inSection("dataflow", "global", GA.getName(), Category) ||
244  SCL->inSection("dataflow", "type", GetGlobalTypeString(GA),
245  Category);
246  }
247 
248  /// Returns whether this module is listed in the given category.
249  bool isIn(const Module &M, StringRef Category) const {
250  return SCL->inSection("dataflow", "src", M.getModuleIdentifier(), Category);
251  }
252 };
253 
254 /// TransformedFunction is used to express the result of transforming one
255 /// function type into another. This struct is immutable. It holds metadata
256 /// useful for updating calls of the old function to the new type.
257 struct TransformedFunction {
258  TransformedFunction(FunctionType* OriginalType,
259  FunctionType* TransformedType,
260  std::vector<unsigned> ArgumentIndexMapping)
261  : OriginalType(OriginalType),
262  TransformedType(TransformedType),
263  ArgumentIndexMapping(ArgumentIndexMapping) {}
264 
265  // Disallow copies.
266  TransformedFunction(const TransformedFunction&) = delete;
267  TransformedFunction& operator=(const TransformedFunction&) = delete;
268 
269  // Allow moves.
270  TransformedFunction(TransformedFunction&&) = default;
271  TransformedFunction& operator=(TransformedFunction&&) = default;
272 
273  /// Type of the function before the transformation.
274  FunctionType *OriginalType;
275 
276  /// Type of the function after the transformation.
277  FunctionType *TransformedType;
278 
279  /// Transforming a function may change the position of arguments. This
280  /// member records the mapping from each argument's old position to its new
281  /// position. Argument positions are zero-indexed. If the transformation
282  /// from F to F' made the first argument of F into the third argument of F',
283  /// then ArgumentIndexMapping[0] will equal 2.
284  std::vector<unsigned> ArgumentIndexMapping;
285 };
286 
287 /// Given function attributes from a call site for the original function,
288 /// return function attributes appropriate for a call to the transformed
289 /// function.
290 AttributeList TransformFunctionAttributes(
291  const TransformedFunction& TransformedFunction,
292  LLVMContext& Ctx, AttributeList CallSiteAttrs) {
293 
294  // Construct a vector of AttributeSet for each function argument.
295  std::vector<llvm::AttributeSet> ArgumentAttributes(
296  TransformedFunction.TransformedType->getNumParams());
297 
298  // Copy attributes from the parameter of the original function to the
299  // transformed version. 'ArgumentIndexMapping' holds the mapping from
300  // old argument position to new.
301  for (unsigned i=0, ie = TransformedFunction.ArgumentIndexMapping.size();
302  i < ie; ++i) {
303  unsigned TransformedIndex = TransformedFunction.ArgumentIndexMapping[i];
304  ArgumentAttributes[TransformedIndex] = CallSiteAttrs.getParamAttributes(i);
305  }
306 
307  // Copy annotations on varargs arguments.
308  for (unsigned i = TransformedFunction.OriginalType->getNumParams(),
309  ie = CallSiteAttrs.getNumAttrSets(); i<ie; ++i) {
310  ArgumentAttributes.push_back(CallSiteAttrs.getParamAttributes(i));
311  }
312 
313  return AttributeList::get(
314  Ctx,
315  CallSiteAttrs.getFnAttributes(),
316  CallSiteAttrs.getRetAttributes(),
317  llvm::makeArrayRef(ArgumentAttributes));
318 }
319 
320 class DataFlowSanitizer {
321  friend struct DFSanFunction;
322  friend class DFSanVisitor;
323 
324  enum { ShadowWidthBits = 16, ShadowWidthBytes = ShadowWidthBits / 8 };
325 
326  /// Which ABI should be used for instrumented functions?
327  enum InstrumentedABI {
328  /// Argument and return value labels are passed through additional
329  /// arguments and by modifying the return type.
330  IA_Args,
331 
332  /// Argument and return value labels are passed through TLS variables
333  /// __dfsan_arg_tls and __dfsan_retval_tls.
334  IA_TLS
335  };
336 
337  /// How should calls to uninstrumented functions be handled?
338  enum WrapperKind {
339  /// This function is present in an uninstrumented form but we don't know
340  /// how it should be handled. Print a warning and call the function anyway.
341  /// Don't label the return value.
342  WK_Warning,
343 
344  /// This function does not write to (user-accessible) memory, and its return
345  /// value is unlabelled.
346  WK_Discard,
347 
348  /// This function does not write to (user-accessible) memory, and the label
349  /// of its return value is the union of the label of its arguments.
350  WK_Functional,
351 
352  /// Instead of calling the function, a custom wrapper __dfsw_F is called,
353  /// where F is the name of the function. This function may wrap the
354  /// original function or provide its own implementation. This is similar to
355  /// the IA_Args ABI, except that IA_Args uses a struct return type to
356  /// pass the return value shadow in a register, while WK_Custom uses an
357  /// extra pointer argument to return the shadow. This allows the wrapped
358  /// form of the function type to be expressed in C.
359  WK_Custom
360  };
361 
362  Module *Mod;
363  LLVMContext *Ctx;
364  Type *Int8Ptr;
365  /// The shadow type for all primitive types and vector types.
366  IntegerType *PrimitiveShadowTy;
367  PointerType *PrimitiveShadowPtrTy;
368  IntegerType *IntptrTy;
369  ConstantInt *ZeroPrimitiveShadow;
370  ConstantInt *ShadowPtrMask;
371  ConstantInt *ShadowPtrMul;
372  Constant *ArgTLS;
373  Constant *RetvalTLS;
374  Constant *ExternalShadowMask;
375  FunctionType *DFSanUnionFnTy;
376  FunctionType *DFSanUnionLoadFnTy;
377  FunctionType *DFSanUnimplementedFnTy;
378  FunctionType *DFSanSetLabelFnTy;
379  FunctionType *DFSanNonzeroLabelFnTy;
380  FunctionType *DFSanVarargWrapperFnTy;
381  FunctionType *DFSanCmpCallbackFnTy;
382  FunctionType *DFSanLoadStoreCallbackFnTy;
383  FunctionType *DFSanMemTransferCallbackFnTy;
384  FunctionCallee DFSanUnionFn;
385  FunctionCallee DFSanCheckedUnionFn;
386  FunctionCallee DFSanUnionLoadFn;
387  FunctionCallee DFSanUnionLoadFast16LabelsFn;
388  FunctionCallee DFSanUnimplementedFn;
389  FunctionCallee DFSanSetLabelFn;
390  FunctionCallee DFSanNonzeroLabelFn;
391  FunctionCallee DFSanVarargWrapperFn;
392  FunctionCallee DFSanLoadCallbackFn;
393  FunctionCallee DFSanStoreCallbackFn;
394  FunctionCallee DFSanMemTransferCallbackFn;
395  FunctionCallee DFSanCmpCallbackFn;
396  MDNode *ColdCallWeights;
397  DFSanABIList ABIList;
398  DenseMap<Value *, Function *> UnwrappedFnMap;
399  AttrBuilder ReadOnlyNoneAttrs;
400  bool DFSanRuntimeShadowMask = false;
401 
402  Value *getShadowAddress(Value *Addr, Instruction *Pos);
403  bool isInstrumented(const Function *F);
404  bool isInstrumented(const GlobalAlias *GA);
405  FunctionType *getArgsFunctionType(FunctionType *T);
406  FunctionType *getTrampolineFunctionType(FunctionType *T);
407  TransformedFunction getCustomFunctionType(FunctionType *T);
408  InstrumentedABI getInstrumentedABI();
409  WrapperKind getWrapperKind(Function *F);
410  void addGlobalNamePrefix(GlobalValue *GV);
411  Function *buildWrapperFunction(Function *F, StringRef NewFName,
412  GlobalValue::LinkageTypes NewFLink,
413  FunctionType *NewFT);
414  Constant *getOrBuildTrampolineFunction(FunctionType *FT, StringRef FName);
415  void initializeCallbackFunctions(Module &M);
416  void initializeRuntimeFunctions(Module &M);
417 
418  bool init(Module &M);
419 
420  /// Returns whether the pass tracks labels for struct fields and array
421  /// indices. Support only fast16 mode in TLS ABI mode.
422  bool shouldTrackFieldsAndIndices();
423 
424  /// Returns a zero constant with the shadow type of OrigTy.
425  ///
426  /// getZeroShadow({T1,T2,...}) = {getZeroShadow(T1),getZeroShadow(T2,...}
427  /// getZeroShadow([n x T]) = [n x getZeroShadow(T)]
428  /// getZeroShadow(other type) = i16(0)
429  ///
430  /// Note that a zero shadow is always i16(0) when shouldTrackFieldsAndIndices
431  /// returns false.
432  Constant *getZeroShadow(Type *OrigTy);
433  /// Returns a zero constant with the shadow type of V's type.
434  Constant *getZeroShadow(Value *V);
435 
436  /// Checks if V is a zero shadow.
437  bool isZeroShadow(Value *V);
438 
439  /// Returns the shadow type of OrigTy.
440  ///
441  /// getShadowTy({T1,T2,...}) = {getShadowTy(T1),getShadowTy(T2),...}
442  /// getShadowTy([n x T]) = [n x getShadowTy(T)]
443  /// getShadowTy(other type) = i16
444  ///
445  /// Note that a shadow type is always i16 when shouldTrackFieldsAndIndices
446  /// returns false.
447  Type *getShadowTy(Type *OrigTy);
448  /// Returns the shadow type of of V's type.
449  Type *getShadowTy(Value *V);
450 
451 public:
452  DataFlowSanitizer(const std::vector<std::string> &ABIListFiles);
453 
454  bool runImpl(Module &M);
455 };
456 
457 struct DFSanFunction {
458  DataFlowSanitizer &DFS;
459  Function *F;
460  DominatorTree DT;
461  DataFlowSanitizer::InstrumentedABI IA;
462  bool IsNativeABI;
463  AllocaInst *LabelReturnAlloca = nullptr;
464  DenseMap<Value *, Value *> ValShadowMap;
465  DenseMap<AllocaInst *, AllocaInst *> AllocaShadowMap;
466  std::vector<std::pair<PHINode *, PHINode *>> PHIFixups;
467  DenseSet<Instruction *> SkipInsts;
468  std::vector<Value *> NonZeroChecks;
469  bool AvoidNewBlocks;
470 
471  struct CachedShadow {
472  BasicBlock *Block; // The block where Shadow is defined.
473  Value *Shadow;
474  };
475  /// Maps a value to its latest shadow value in terms of domination tree.
476  DenseMap<std::pair<Value *, Value *>, CachedShadow> CachedShadows;
477  /// Maps a value to its latest collapsed shadow value it was converted to in
478  /// terms of domination tree. When ClDebugNonzeroLabels is on, this cache is
479  /// used at a post process where CFG blocks are split. So it does not cache
480  /// BasicBlock like CachedShadows, but uses domination between values.
481  DenseMap<Value *, Value *> CachedCollapsedShadows;
482  DenseMap<Value *, std::set<Value *>> ShadowElements;
483 
484  DFSanFunction(DataFlowSanitizer &DFS, Function *F, bool IsNativeABI)
485  : DFS(DFS), F(F), IA(DFS.getInstrumentedABI()), IsNativeABI(IsNativeABI) {
486  DT.recalculate(*F);
487  // FIXME: Need to track down the register allocator issue which causes poor
488  // performance in pathological cases with large numbers of basic blocks.
489  AvoidNewBlocks = F->size() > 1000;
490  }
491 
492  /// Computes the shadow address for a given function argument.
493  ///
494  /// Shadow = ArgTLS+ArgOffset.
495  Value *getArgTLS(Type *T, unsigned ArgOffset, IRBuilder<> &IRB);
496 
497  /// Computes the shadow address for a retval.
498  Value *getRetvalTLS(Type *T, IRBuilder<> &IRB);
499 
500  Value *getShadow(Value *V);
501  void setShadow(Instruction *I, Value *Shadow);
502  /// Generates IR to compute the union of the two given shadows, inserting it
503  /// before Pos. The combined value is with primitive type.
504  Value *combineShadows(Value *V1, Value *V2, Instruction *Pos);
505  /// Combines the shadow values of V1 and V2, then converts the combined value
506  /// with primitive type into a shadow value with the original type T.
507  Value *combineShadowsThenConvert(Type *T, Value *V1, Value *V2,
508  Instruction *Pos);
509  Value *combineOperandShadows(Instruction *Inst);
510  Value *loadShadow(Value *ShadowAddr, uint64_t Size, uint64_t Align,
511  Instruction *Pos);
512  void storePrimitiveShadow(Value *Addr, uint64_t Size, Align Alignment,
513  Value *PrimitiveShadow, Instruction *Pos);
514  /// Applies PrimitiveShadow to all primitive subtypes of T, returning
515  /// the expanded shadow value.
516  ///
517  /// EFP({T1,T2, ...}, PS) = {EFP(T1,PS),EFP(T2,PS),...}
518  /// EFP([n x T], PS) = [n x EFP(T,PS)]
519  /// EFP(other types, PS) = PS
520  Value *expandFromPrimitiveShadow(Type *T, Value *PrimitiveShadow,
521  Instruction *Pos);
522  /// Collapses Shadow into a single primitive shadow value, unioning all
523  /// primitive shadow values in the process. Returns the final primitive
524  /// shadow value.
525  ///
526  /// CTP({V1,V2, ...}) = UNION(CFP(V1,PS),CFP(V2,PS),...)
527  /// CTP([V1,V2,...]) = UNION(CFP(V1,PS),CFP(V2,PS),...)
528  /// CTP(other types, PS) = PS
529  Value *collapseToPrimitiveShadow(Value *Shadow, Instruction *Pos);
530 
531 private:
532  /// Collapses the shadow with aggregate type into a single primitive shadow
533  /// value.
534  template <class AggregateType>
535  Value *collapseAggregateShadow(AggregateType *AT, Value *Shadow,
536  IRBuilder<> &IRB);
537 
538  Value *collapseToPrimitiveShadow(Value *Shadow, IRBuilder<> &IRB);
539 
540  /// Returns the shadow value of an argument A.
541  Value *getShadowForTLSArgument(Argument *A);
542 };
543 
544 class DFSanVisitor : public InstVisitor<DFSanVisitor> {
545 public:
546  DFSanFunction &DFSF;
547 
548  DFSanVisitor(DFSanFunction &DFSF) : DFSF(DFSF) {}
549 
550  const DataLayout &getDataLayout() const {
551  return DFSF.F->getParent()->getDataLayout();
552  }
553 
554  // Combines shadow values for all of I's operands. Returns the combined shadow
555  // value.
556  Value *visitOperandShadowInst(Instruction &I);
557 
558  void visitUnaryOperator(UnaryOperator &UO);
559  void visitBinaryOperator(BinaryOperator &BO);
560  void visitCastInst(CastInst &CI);
561  void visitCmpInst(CmpInst &CI);
562  void visitGetElementPtrInst(GetElementPtrInst &GEPI);
563  void visitLoadInst(LoadInst &LI);
564  void visitStoreInst(StoreInst &SI);
565  void visitReturnInst(ReturnInst &RI);
566  void visitCallBase(CallBase &CB);
567  void visitPHINode(PHINode &PN);
568  void visitExtractElementInst(ExtractElementInst &I);
569  void visitInsertElementInst(InsertElementInst &I);
570  void visitShuffleVectorInst(ShuffleVectorInst &I);
571  void visitExtractValueInst(ExtractValueInst &I);
572  void visitInsertValueInst(InsertValueInst &I);
573  void visitAllocaInst(AllocaInst &I);
574  void visitSelectInst(SelectInst &I);
575  void visitMemSetInst(MemSetInst &I);
576  void visitMemTransferInst(MemTransferInst &I);
577 };
578 
579 } // end anonymous namespace
580 
581 DataFlowSanitizer::DataFlowSanitizer(
582  const std::vector<std::string> &ABIListFiles) {
583  std::vector<std::string> AllABIListFiles(std::move(ABIListFiles));
584  llvm::append_range(AllABIListFiles, ClABIListFiles);
585  // FIXME: should we propagate vfs::FileSystem to this constructor?
586  ABIList.set(
588 }
589 
590 FunctionType *DataFlowSanitizer::getArgsFunctionType(FunctionType *T) {
591  SmallVector<Type *, 4> ArgTypes(T->param_begin(), T->param_end());
592  ArgTypes.append(T->getNumParams(), PrimitiveShadowTy);
593  if (T->isVarArg())
594  ArgTypes.push_back(PrimitiveShadowPtrTy);
595  Type *RetType = T->getReturnType();
596  if (!RetType->isVoidTy())
597  RetType = StructType::get(RetType, PrimitiveShadowTy);
598  return FunctionType::get(RetType, ArgTypes, T->isVarArg());
599 }
600 
601 FunctionType *DataFlowSanitizer::getTrampolineFunctionType(FunctionType *T) {
602  assert(!T->isVarArg());
603  SmallVector<Type *, 4> ArgTypes;
604  ArgTypes.push_back(T->getPointerTo());
605  ArgTypes.append(T->param_begin(), T->param_end());
606  ArgTypes.append(T->getNumParams(), PrimitiveShadowTy);
607  Type *RetType = T->getReturnType();
608  if (!RetType->isVoidTy())
609  ArgTypes.push_back(PrimitiveShadowPtrTy);
610  return FunctionType::get(T->getReturnType(), ArgTypes, false);
611 }
612 
613 TransformedFunction DataFlowSanitizer::getCustomFunctionType(FunctionType *T) {
614  SmallVector<Type *, 4> ArgTypes;
615 
616  // Some parameters of the custom function being constructed are
617  // parameters of T. Record the mapping from parameters of T to
618  // parameters of the custom function, so that parameter attributes
619  // at call sites can be updated.
620  std::vector<unsigned> ArgumentIndexMapping;
621  for (unsigned i = 0, ie = T->getNumParams(); i != ie; ++i) {
622  Type* param_type = T->getParamType(i);
623  FunctionType *FT;
624  if (isa<PointerType>(param_type) && (FT = dyn_cast<FunctionType>(
625  cast<PointerType>(param_type)->getElementType()))) {
626  ArgumentIndexMapping.push_back(ArgTypes.size());
627  ArgTypes.push_back(getTrampolineFunctionType(FT)->getPointerTo());
628  ArgTypes.push_back(Type::getInt8PtrTy(*Ctx));
629  } else {
630  ArgumentIndexMapping.push_back(ArgTypes.size());
631  ArgTypes.push_back(param_type);
632  }
633  }
634  for (unsigned i = 0, e = T->getNumParams(); i != e; ++i)
635  ArgTypes.push_back(PrimitiveShadowTy);
636  if (T->isVarArg())
637  ArgTypes.push_back(PrimitiveShadowPtrTy);
638  Type *RetType = T->getReturnType();
639  if (!RetType->isVoidTy())
640  ArgTypes.push_back(PrimitiveShadowPtrTy);
641  return TransformedFunction(
642  T, FunctionType::get(T->getReturnType(), ArgTypes, T->isVarArg()),
643  ArgumentIndexMapping);
644 }
645 
646 bool DataFlowSanitizer::isZeroShadow(Value *V) {
647  if (!shouldTrackFieldsAndIndices())
648  return ZeroPrimitiveShadow == V;
649 
650  Type *T = V->getType();
651  if (!isa<ArrayType>(T) && !isa<StructType>(T)) {
652  if (const ConstantInt *CI = dyn_cast<ConstantInt>(V))
653  return CI->isZero();
654  return false;
655  }
656 
657  return isa<ConstantAggregateZero>(V);
658 }
659 
660 bool DataFlowSanitizer::shouldTrackFieldsAndIndices() {
661  return getInstrumentedABI() == DataFlowSanitizer::IA_TLS && ClFast16Labels;
662 }
663 
664 Constant *DataFlowSanitizer::getZeroShadow(Type *OrigTy) {
665  if (!shouldTrackFieldsAndIndices())
666  return ZeroPrimitiveShadow;
667 
668  if (!isa<ArrayType>(OrigTy) && !isa<StructType>(OrigTy))
669  return ZeroPrimitiveShadow;
670  Type *ShadowTy = getShadowTy(OrigTy);
671  return ConstantAggregateZero::get(ShadowTy);
672 }
673 
674 Constant *DataFlowSanitizer::getZeroShadow(Value *V) {
675  return getZeroShadow(V->getType());
676 }
677 
679  Value *Shadow, SmallVector<unsigned, 4> &Indices, Type *SubShadowTy,
680  Value *PrimitiveShadow, IRBuilder<> &IRB) {
681  if (!isa<ArrayType>(SubShadowTy) && !isa<StructType>(SubShadowTy))
682  return IRB.CreateInsertValue(Shadow, PrimitiveShadow, Indices);
683 
684  if (ArrayType *AT = dyn_cast<ArrayType>(SubShadowTy)) {
685  for (unsigned Idx = 0; Idx < AT->getNumElements(); Idx++) {
686  Indices.push_back(Idx);
688  Shadow, Indices, AT->getElementType(), PrimitiveShadow, IRB);
689  Indices.pop_back();
690  }
691  return Shadow;
692  }
693 
694  if (StructType *ST = dyn_cast<StructType>(SubShadowTy)) {
695  for (unsigned Idx = 0; Idx < ST->getNumElements(); Idx++) {
696  Indices.push_back(Idx);
698  Shadow, Indices, ST->getElementType(Idx), PrimitiveShadow, IRB);
699  Indices.pop_back();
700  }
701  return Shadow;
702  }
703  llvm_unreachable("Unexpected shadow type");
704 }
705 
706 Value *DFSanFunction::expandFromPrimitiveShadow(Type *T, Value *PrimitiveShadow,
707  Instruction *Pos) {
708  Type *ShadowTy = DFS.getShadowTy(T);
709 
710  if (!isa<ArrayType>(ShadowTy) && !isa<StructType>(ShadowTy))
711  return PrimitiveShadow;
712 
713  if (DFS.isZeroShadow(PrimitiveShadow))
714  return DFS.getZeroShadow(ShadowTy);
715 
716  IRBuilder<> IRB(Pos);
717  SmallVector<unsigned, 4> Indices;
718  Value *Shadow = UndefValue::get(ShadowTy);
719  Shadow = expandFromPrimitiveShadowRecursive(Shadow, Indices, ShadowTy,
720  PrimitiveShadow, IRB);
721 
722  // Caches the primitive shadow value that built the shadow value.
723  CachedCollapsedShadows[Shadow] = PrimitiveShadow;
724  return Shadow;
725 }
726 
727 template <class AggregateType>
728 Value *DFSanFunction::collapseAggregateShadow(AggregateType *AT, Value *Shadow,
729  IRBuilder<> &IRB) {
730  if (!AT->getNumElements())
731  return DFS.ZeroPrimitiveShadow;
732 
733  Value *FirstItem = IRB.CreateExtractValue(Shadow, 0);
734  Value *Aggregator = collapseToPrimitiveShadow(FirstItem, IRB);
735 
736  for (unsigned Idx = 1; Idx < AT->getNumElements(); Idx++) {
737  Value *ShadowItem = IRB.CreateExtractValue(Shadow, Idx);
738  Value *ShadowInner = collapseToPrimitiveShadow(ShadowItem, IRB);
739  Aggregator = IRB.CreateOr(Aggregator, ShadowInner);
740  }
741  return Aggregator;
742 }
743 
744 Value *DFSanFunction::collapseToPrimitiveShadow(Value *Shadow,
745  IRBuilder<> &IRB) {
746  Type *ShadowTy = Shadow->getType();
747  if (!isa<ArrayType>(ShadowTy) && !isa<StructType>(ShadowTy))
748  return Shadow;
749  if (ArrayType *AT = dyn_cast<ArrayType>(ShadowTy))
750  return collapseAggregateShadow<>(AT, Shadow, IRB);
751  if (StructType *ST = dyn_cast<StructType>(ShadowTy))
752  return collapseAggregateShadow<>(ST, Shadow, IRB);
753  llvm_unreachable("Unexpected shadow type");
754 }
755 
756 Value *DFSanFunction::collapseToPrimitiveShadow(Value *Shadow,
757  Instruction *Pos) {
758  Type *ShadowTy = Shadow->getType();
759  if (!isa<ArrayType>(ShadowTy) && !isa<StructType>(ShadowTy))
760  return Shadow;
761 
762  assert(DFS.shouldTrackFieldsAndIndices());
763 
764  // Checks if the cached collapsed shadow value dominates Pos.
765  Value *&CS = CachedCollapsedShadows[Shadow];
766  if (CS && DT.dominates(CS, Pos))
767  return CS;
768 
769  IRBuilder<> IRB(Pos);
770  Value *PrimitiveShadow = collapseToPrimitiveShadow(Shadow, IRB);
771  // Caches the converted primitive shadow value.
772  CS = PrimitiveShadow;
773  return PrimitiveShadow;
774 }
775 
776 Type *DataFlowSanitizer::getShadowTy(Type *OrigTy) {
777  if (!shouldTrackFieldsAndIndices())
778  return PrimitiveShadowTy;
779 
780  if (!OrigTy->isSized())
781  return PrimitiveShadowTy;
782  if (isa<IntegerType>(OrigTy))
783  return PrimitiveShadowTy;
784  if (isa<VectorType>(OrigTy))
785  return PrimitiveShadowTy;
786  if (ArrayType *AT = dyn_cast<ArrayType>(OrigTy))
787  return ArrayType::get(getShadowTy(AT->getElementType()),
788  AT->getNumElements());
789  if (StructType *ST = dyn_cast<StructType>(OrigTy)) {
790  SmallVector<Type *, 4> Elements;
791  for (unsigned I = 0, N = ST->getNumElements(); I < N; ++I)
792  Elements.push_back(getShadowTy(ST->getElementType(I)));
793  return StructType::get(*Ctx, Elements);
794  }
795  return PrimitiveShadowTy;
796 }
797 
798 Type *DataFlowSanitizer::getShadowTy(Value *V) {
799  return getShadowTy(V->getType());
800 }
801 
803  Triple TargetTriple(M.getTargetTriple());
804  bool IsX86_64 = TargetTriple.getArch() == Triple::x86_64;
805  bool IsMIPS64 = TargetTriple.isMIPS64();
806  bool IsAArch64 = TargetTriple.getArch() == Triple::aarch64 ||
807  TargetTriple.getArch() == Triple::aarch64_be;
808 
809  const DataLayout &DL = M.getDataLayout();
810 
811  Mod = &M;
812  Ctx = &M.getContext();
813  Int8Ptr = Type::getInt8PtrTy(*Ctx);
814  PrimitiveShadowTy = IntegerType::get(*Ctx, ShadowWidthBits);
815  PrimitiveShadowPtrTy = PointerType::getUnqual(PrimitiveShadowTy);
816  IntptrTy = DL.getIntPtrType(*Ctx);
817  ZeroPrimitiveShadow = ConstantInt::getSigned(PrimitiveShadowTy, 0);
818  ShadowPtrMul = ConstantInt::getSigned(IntptrTy, ShadowWidthBytes);
819  if (IsX86_64)
820  ShadowPtrMask = ConstantInt::getSigned(IntptrTy, ~0x700000000000LL);
821  else if (IsMIPS64)
822  ShadowPtrMask = ConstantInt::getSigned(IntptrTy, ~0xF000000000LL);
823  // AArch64 supports multiple VMAs and the shadow mask is set at runtime.
824  else if (IsAArch64)
825  DFSanRuntimeShadowMask = true;
826  else
827  report_fatal_error("unsupported triple");
828 
829  Type *DFSanUnionArgs[2] = {PrimitiveShadowTy, PrimitiveShadowTy};
830  DFSanUnionFnTy =
831  FunctionType::get(PrimitiveShadowTy, DFSanUnionArgs, /*isVarArg=*/false);
832  Type *DFSanUnionLoadArgs[2] = {PrimitiveShadowPtrTy, IntptrTy};
833  DFSanUnionLoadFnTy = FunctionType::get(PrimitiveShadowTy, DFSanUnionLoadArgs,
834  /*isVarArg=*/false);
835  DFSanUnimplementedFnTy = FunctionType::get(
836  Type::getVoidTy(*Ctx), Type::getInt8PtrTy(*Ctx), /*isVarArg=*/false);
837  Type *DFSanSetLabelArgs[3] = {PrimitiveShadowTy, Type::getInt8PtrTy(*Ctx),
838  IntptrTy};
839  DFSanSetLabelFnTy = FunctionType::get(Type::getVoidTy(*Ctx),
840  DFSanSetLabelArgs, /*isVarArg=*/false);
841  DFSanNonzeroLabelFnTy =
842  FunctionType::get(Type::getVoidTy(*Ctx), None, /*isVarArg=*/false);
843  DFSanVarargWrapperFnTy = FunctionType::get(
844  Type::getVoidTy(*Ctx), Type::getInt8PtrTy(*Ctx), /*isVarArg=*/false);
845  DFSanCmpCallbackFnTy =
846  FunctionType::get(Type::getVoidTy(*Ctx), PrimitiveShadowTy,
847  /*isVarArg=*/false);
848  Type *DFSanLoadStoreCallbackArgs[2] = {PrimitiveShadowTy, Int8Ptr};
849  DFSanLoadStoreCallbackFnTy =
850  FunctionType::get(Type::getVoidTy(*Ctx), DFSanLoadStoreCallbackArgs,
851  /*isVarArg=*/false);
852  Type *DFSanMemTransferCallbackArgs[2] = {PrimitiveShadowPtrTy, IntptrTy};
853  DFSanMemTransferCallbackFnTy =
854  FunctionType::get(Type::getVoidTy(*Ctx), DFSanMemTransferCallbackArgs,
855  /*isVarArg=*/false);
856 
857  ColdCallWeights = MDBuilder(*Ctx).createBranchWeights(1, 1000);
858  return true;
859 }
860 
861 bool DataFlowSanitizer::isInstrumented(const Function *F) {
862  return !ABIList.isIn(*F, "uninstrumented");
863 }
864 
865 bool DataFlowSanitizer::isInstrumented(const GlobalAlias *GA) {
866  return !ABIList.isIn(*GA, "uninstrumented");
867 }
868 
869 DataFlowSanitizer::InstrumentedABI DataFlowSanitizer::getInstrumentedABI() {
870  return ClArgsABI ? IA_Args : IA_TLS;
871 }
872 
873 DataFlowSanitizer::WrapperKind DataFlowSanitizer::getWrapperKind(Function *F) {
874  if (ABIList.isIn(*F, "functional"))
875  return WK_Functional;
876  if (ABIList.isIn(*F, "discard"))
877  return WK_Discard;
878  if (ABIList.isIn(*F, "custom"))
879  return WK_Custom;
880 
881  return WK_Warning;
882 }
883 
884 void DataFlowSanitizer::addGlobalNamePrefix(GlobalValue *GV) {
885  std::string GVName = std::string(GV->getName()), Prefix = "dfs$";
886  GV->setName(Prefix + GVName);
887 
888  // Try to change the name of the function in module inline asm. We only do
889  // this for specific asm directives, currently only ".symver", to try to avoid
890  // corrupting asm which happens to contain the symbol name as a substring.
891  // Note that the substitution for .symver assumes that the versioned symbol
892  // also has an instrumented name.
893  std::string Asm = GV->getParent()->getModuleInlineAsm();
894  std::string SearchStr = ".symver " + GVName + ",";
895  size_t Pos = Asm.find(SearchStr);
896  if (Pos != std::string::npos) {
897  Asm.replace(Pos, SearchStr.size(),
898  ".symver " + Prefix + GVName + "," + Prefix);
900  }
901 }
902 
903 Function *
904 DataFlowSanitizer::buildWrapperFunction(Function *F, StringRef NewFName,
905  GlobalValue::LinkageTypes NewFLink,
906  FunctionType *NewFT) {
907  FunctionType *FT = F->getFunctionType();
908  Function *NewF = Function::Create(NewFT, NewFLink, F->getAddressSpace(),
909  NewFName, F->getParent());
910  NewF->copyAttributesFrom(F);
911  NewF->removeAttributes(
914 
915  BasicBlock *BB = BasicBlock::Create(*Ctx, "entry", NewF);
916  if (F->isVarArg()) {
918  AttrBuilder().addAttribute("split-stack"));
919  CallInst::Create(DFSanVarargWrapperFn,
920  IRBuilder<>(BB).CreateGlobalStringPtr(F->getName()), "",
921  BB);
922  new UnreachableInst(*Ctx, BB);
923  } else {
924  std::vector<Value *> Args;
925  unsigned n = FT->getNumParams();
926  for (Function::arg_iterator ai = NewF->arg_begin(); n != 0; ++ai, --n)
927  Args.push_back(&*ai);
928  CallInst *CI = CallInst::Create(F, Args, "", BB);
929  if (FT->getReturnType()->isVoidTy())
930  ReturnInst::Create(*Ctx, BB);
931  else
932  ReturnInst::Create(*Ctx, CI, BB);
933  }
934 
935  return NewF;
936 }
937 
938 Constant *DataFlowSanitizer::getOrBuildTrampolineFunction(FunctionType *FT,
939  StringRef FName) {
940  FunctionType *FTT = getTrampolineFunctionType(FT);
941  FunctionCallee C = Mod->getOrInsertFunction(FName, FTT);
942  Function *F = dyn_cast<Function>(C.getCallee());
943  if (F && F->isDeclaration()) {
944  F->setLinkage(GlobalValue::LinkOnceODRLinkage);
945  BasicBlock *BB = BasicBlock::Create(*Ctx, "entry", F);
946  std::vector<Value *> Args;
947  Function::arg_iterator AI = F->arg_begin(); ++AI;
948  for (unsigned N = FT->getNumParams(); N != 0; ++AI, --N)
949  Args.push_back(&*AI);
950  CallInst *CI = CallInst::Create(FT, &*F->arg_begin(), Args, "", BB);
951  ReturnInst *RI;
952  if (FT->getReturnType()->isVoidTy())
953  RI = ReturnInst::Create(*Ctx, BB);
954  else
955  RI = ReturnInst::Create(*Ctx, CI, BB);
956 
957  // F is called by a wrapped custom function with primitive shadows. So
958  // its arguments and return value need conversion.
959  DFSanFunction DFSF(*this, F, /*IsNativeABI=*/true);
960  Function::arg_iterator ValAI = F->arg_begin(), ShadowAI = AI; ++ValAI;
961  for (unsigned N = FT->getNumParams(); N != 0; ++ValAI, ++ShadowAI, --N) {
962  Value *Shadow =
963  DFSF.expandFromPrimitiveShadow(ValAI->getType(), &*ShadowAI, CI);
964  DFSF.ValShadowMap[&*ValAI] = Shadow;
965  }
966  DFSanVisitor(DFSF).visitCallInst(*CI);
967  if (!FT->getReturnType()->isVoidTy()) {
968  Value *PrimitiveShadow = DFSF.collapseToPrimitiveShadow(
969  DFSF.getShadow(RI->getReturnValue()), RI);
970  new StoreInst(PrimitiveShadow, &*std::prev(F->arg_end()), RI);
971  }
972  }
973 
974  return cast<Constant>(C.getCallee());
975 }
976 
977 // Initialize DataFlowSanitizer runtime functions and declare them in the module
978 void DataFlowSanitizer::initializeRuntimeFunctions(Module &M) {
979  {
981  AL = AL.addAttribute(M.getContext(), AttributeList::FunctionIndex,
982  Attribute::NoUnwind);
983  AL = AL.addAttribute(M.getContext(), AttributeList::FunctionIndex,
984  Attribute::ReadNone);
985  AL = AL.addAttribute(M.getContext(), AttributeList::ReturnIndex,
986  Attribute::ZExt);
987  AL = AL.addParamAttribute(M.getContext(), 0, Attribute::ZExt);
988  AL = AL.addParamAttribute(M.getContext(), 1, Attribute::ZExt);
989  DFSanUnionFn =
990  Mod->getOrInsertFunction("__dfsan_union", DFSanUnionFnTy, AL);
991  }
992  {
994  AL = AL.addAttribute(M.getContext(), AttributeList::FunctionIndex,
995  Attribute::NoUnwind);
996  AL = AL.addAttribute(M.getContext(), AttributeList::FunctionIndex,
997  Attribute::ReadNone);
998  AL = AL.addAttribute(M.getContext(), AttributeList::ReturnIndex,
999  Attribute::ZExt);
1000  AL = AL.addParamAttribute(M.getContext(), 0, Attribute::ZExt);
1001  AL = AL.addParamAttribute(M.getContext(), 1, Attribute::ZExt);
1002  DFSanCheckedUnionFn =
1003  Mod->getOrInsertFunction("dfsan_union", DFSanUnionFnTy, AL);
1004  }
1005  {
1006  AttributeList AL;
1007  AL = AL.addAttribute(M.getContext(), AttributeList::FunctionIndex,
1008  Attribute::NoUnwind);
1009  AL = AL.addAttribute(M.getContext(), AttributeList::FunctionIndex,
1010  Attribute::ReadOnly);
1011  AL = AL.addAttribute(M.getContext(), AttributeList::ReturnIndex,
1012  Attribute::ZExt);
1013  DFSanUnionLoadFn =
1014  Mod->getOrInsertFunction("__dfsan_union_load", DFSanUnionLoadFnTy, AL);
1015  }
1016  {
1017  AttributeList AL;
1018  AL = AL.addAttribute(M.getContext(), AttributeList::FunctionIndex,
1019  Attribute::NoUnwind);
1020  AL = AL.addAttribute(M.getContext(), AttributeList::FunctionIndex,
1021  Attribute::ReadOnly);
1022  AL = AL.addAttribute(M.getContext(), AttributeList::ReturnIndex,
1023  Attribute::ZExt);
1024  DFSanUnionLoadFast16LabelsFn = Mod->getOrInsertFunction(
1025  "__dfsan_union_load_fast16labels", DFSanUnionLoadFnTy, AL);
1026  }
1027  DFSanUnimplementedFn =
1028  Mod->getOrInsertFunction("__dfsan_unimplemented", DFSanUnimplementedFnTy);
1029  {
1030  AttributeList AL;
1031  AL = AL.addParamAttribute(M.getContext(), 0, Attribute::ZExt);
1032  DFSanSetLabelFn =
1033  Mod->getOrInsertFunction("__dfsan_set_label", DFSanSetLabelFnTy, AL);
1034  }
1035  DFSanNonzeroLabelFn =
1036  Mod->getOrInsertFunction("__dfsan_nonzero_label", DFSanNonzeroLabelFnTy);
1037  DFSanVarargWrapperFn = Mod->getOrInsertFunction("__dfsan_vararg_wrapper",
1038  DFSanVarargWrapperFnTy);
1039 }
1040 
1041 // Initializes event callback functions and declare them in the module
1042 void DataFlowSanitizer::initializeCallbackFunctions(Module &M) {
1043  DFSanLoadCallbackFn = Mod->getOrInsertFunction("__dfsan_load_callback",
1044  DFSanLoadStoreCallbackFnTy);
1045  DFSanStoreCallbackFn = Mod->getOrInsertFunction("__dfsan_store_callback",
1046  DFSanLoadStoreCallbackFnTy);
1047  DFSanMemTransferCallbackFn = Mod->getOrInsertFunction(
1048  "__dfsan_mem_transfer_callback", DFSanMemTransferCallbackFnTy);
1049  DFSanCmpCallbackFn =
1050  Mod->getOrInsertFunction("__dfsan_cmp_callback", DFSanCmpCallbackFnTy);
1051 }
1052 
1054  init(M);
1055 
1056  if (ABIList.isIn(M, "skip"))
1057  return false;
1058 
1059  const unsigned InitialGlobalSize = M.global_size();
1060  const unsigned InitialModuleSize = M.size();
1061 
1062  bool Changed = false;
1063 
1064  Type *ArgTLSTy = ArrayType::get(Type::getInt64Ty(*Ctx), kArgTLSSize / 8);
1065  ArgTLS = Mod->getOrInsertGlobal("__dfsan_arg_tls", ArgTLSTy);
1066  if (GlobalVariable *G = dyn_cast<GlobalVariable>(ArgTLS)) {
1067  Changed |= G->getThreadLocalMode() != GlobalVariable::InitialExecTLSModel;
1068  G->setThreadLocalMode(GlobalVariable::InitialExecTLSModel);
1069  }
1070  Type *RetvalTLSTy =
1072  RetvalTLS = Mod->getOrInsertGlobal("__dfsan_retval_tls", RetvalTLSTy);
1073  if (GlobalVariable *G = dyn_cast<GlobalVariable>(RetvalTLS)) {
1074  Changed |= G->getThreadLocalMode() != GlobalVariable::InitialExecTLSModel;
1075  G->setThreadLocalMode(GlobalVariable::InitialExecTLSModel);
1076  }
1077 
1078  ExternalShadowMask =
1079  Mod->getOrInsertGlobal(kDFSanExternShadowPtrMask, IntptrTy);
1080 
1081  initializeCallbackFunctions(M);
1082  initializeRuntimeFunctions(M);
1083 
1084  std::vector<Function *> FnsToInstrument;
1085  SmallPtrSet<Function *, 2> FnsWithNativeABI;
1086  for (Function &i : M) {
1087  if (!i.isIntrinsic() &&
1088  &i != DFSanUnionFn.getCallee()->stripPointerCasts() &&
1089  &i != DFSanCheckedUnionFn.getCallee()->stripPointerCasts() &&
1090  &i != DFSanUnionLoadFn.getCallee()->stripPointerCasts() &&
1091  &i != DFSanUnionLoadFast16LabelsFn.getCallee()->stripPointerCasts() &&
1092  &i != DFSanUnimplementedFn.getCallee()->stripPointerCasts() &&
1093  &i != DFSanSetLabelFn.getCallee()->stripPointerCasts() &&
1094  &i != DFSanNonzeroLabelFn.getCallee()->stripPointerCasts() &&
1095  &i != DFSanVarargWrapperFn.getCallee()->stripPointerCasts() &&
1096  &i != DFSanLoadCallbackFn.getCallee()->stripPointerCasts() &&
1097  &i != DFSanStoreCallbackFn.getCallee()->stripPointerCasts() &&
1098  &i != DFSanMemTransferCallbackFn.getCallee()->stripPointerCasts() &&
1099  &i != DFSanCmpCallbackFn.getCallee()->stripPointerCasts())
1100  FnsToInstrument.push_back(&i);
1101  }
1102 
1103  // Give function aliases prefixes when necessary, and build wrappers where the
1104  // instrumentedness is inconsistent.
1105  for (Module::alias_iterator i = M.alias_begin(), e = M.alias_end(); i != e;) {
1106  GlobalAlias *GA = &*i;
1107  ++i;
1108  // Don't stop on weak. We assume people aren't playing games with the
1109  // instrumentedness of overridden weak aliases.
1110  if (auto F = dyn_cast<Function>(GA->getBaseObject())) {
1111  bool GAInst = isInstrumented(GA), FInst = isInstrumented(F);
1112  if (GAInst && FInst) {
1113  addGlobalNamePrefix(GA);
1114  } else if (GAInst != FInst) {
1115  // Non-instrumented alias of an instrumented function, or vice versa.
1116  // Replace the alias with a native-ABI wrapper of the aliasee. The pass
1117  // below will take care of instrumenting it.
1118  Function *NewF =
1119  buildWrapperFunction(F, "", GA->getLinkage(), F->getFunctionType());
1121  NewF->takeName(GA);
1122  GA->eraseFromParent();
1123  FnsToInstrument.push_back(NewF);
1124  }
1125  }
1126  }
1127 
1128  ReadOnlyNoneAttrs.addAttribute(Attribute::ReadOnly)
1129  .addAttribute(Attribute::ReadNone);
1130 
1131  // First, change the ABI of every function in the module. ABI-listed
1132  // functions keep their original ABI and get a wrapper function.
1133  for (std::vector<Function *>::iterator i = FnsToInstrument.begin(),
1134  e = FnsToInstrument.end();
1135  i != e; ++i) {
1136  Function &F = **i;
1137  FunctionType *FT = F.getFunctionType();
1138 
1139  bool IsZeroArgsVoidRet = (FT->getNumParams() == 0 && !FT->isVarArg() &&
1140  FT->getReturnType()->isVoidTy());
1141 
1142  if (isInstrumented(&F)) {
1143  // Instrumented functions get a 'dfs$' prefix. This allows us to more
1144  // easily identify cases of mismatching ABIs.
1145  if (getInstrumentedABI() == IA_Args && !IsZeroArgsVoidRet) {
1146  FunctionType *NewFT = getArgsFunctionType(FT);
1147  Function *NewF = Function::Create(NewFT, F.getLinkage(),
1148  F.getAddressSpace(), "", &M);
1149  NewF->copyAttributesFrom(&F);
1150  NewF->removeAttributes(
1153  for (Function::arg_iterator FArg = F.arg_begin(),
1154  NewFArg = NewF->arg_begin(),
1155  FArgEnd = F.arg_end();
1156  FArg != FArgEnd; ++FArg, ++NewFArg) {
1157  FArg->replaceAllUsesWith(&*NewFArg);
1158  }
1159  NewF->getBasicBlockList().splice(NewF->begin(), F.getBasicBlockList());
1160 
1161  for (Function::user_iterator UI = F.user_begin(), UE = F.user_end();
1162  UI != UE;) {
1163  BlockAddress *BA = dyn_cast<BlockAddress>(*UI);
1164  ++UI;
1165  if (BA) {
1166  BA->replaceAllUsesWith(
1167  BlockAddress::get(NewF, BA->getBasicBlock()));
1168  delete BA;
1169  }
1170  }
1171  F.replaceAllUsesWith(
1173  NewF->takeName(&F);
1174  F.eraseFromParent();
1175  *i = NewF;
1176  addGlobalNamePrefix(NewF);
1177  } else {
1178  addGlobalNamePrefix(&F);
1179  }
1180  } else if (!IsZeroArgsVoidRet || getWrapperKind(&F) == WK_Custom) {
1181  // Build a wrapper function for F. The wrapper simply calls F, and is
1182  // added to FnsToInstrument so that any instrumentation according to its
1183  // WrapperKind is done in the second pass below.
1184  FunctionType *NewFT = getInstrumentedABI() == IA_Args
1185  ? getArgsFunctionType(FT)
1186  : FT;
1187 
1188  // If the function being wrapped has local linkage, then preserve the
1189  // function's linkage in the wrapper function.
1190  GlobalValue::LinkageTypes wrapperLinkage =
1191  F.hasLocalLinkage()
1192  ? F.getLinkage()
1194 
1195  Function *NewF = buildWrapperFunction(
1196  &F, std::string("dfsw$") + std::string(F.getName()),
1197  wrapperLinkage, NewFT);
1198  if (getInstrumentedABI() == IA_TLS)
1199  NewF->removeAttributes(AttributeList::FunctionIndex, ReadOnlyNoneAttrs);
1200 
1201  Value *WrappedFnCst =
1203  F.replaceAllUsesWith(WrappedFnCst);
1204 
1205  UnwrappedFnMap[WrappedFnCst] = &F;
1206  *i = NewF;
1207 
1208  if (!F.isDeclaration()) {
1209  // This function is probably defining an interposition of an
1210  // uninstrumented function and hence needs to keep the original ABI.
1211  // But any functions it may call need to use the instrumented ABI, so
1212  // we instrument it in a mode which preserves the original ABI.
1213  FnsWithNativeABI.insert(&F);
1214 
1215  // This code needs to rebuild the iterators, as they may be invalidated
1216  // by the push_back, taking care that the new range does not include
1217  // any functions added by this code.
1218  size_t N = i - FnsToInstrument.begin(),
1219  Count = e - FnsToInstrument.begin();
1220  FnsToInstrument.push_back(&F);
1221  i = FnsToInstrument.begin() + N;
1222  e = FnsToInstrument.begin() + Count;
1223  }
1224  // Hopefully, nobody will try to indirectly call a vararg
1225  // function... yet.
1226  } else if (FT->isVarArg()) {
1227  UnwrappedFnMap[&F] = &F;
1228  *i = nullptr;
1229  }
1230  }
1231 
1232  for (Function *i : FnsToInstrument) {
1233  if (!i || i->isDeclaration())
1234  continue;
1235 
1237 
1238  DFSanFunction DFSF(*this, i, FnsWithNativeABI.count(i));
1239 
1240  // DFSanVisitor may create new basic blocks, which confuses df_iterator.
1241  // Build a copy of the list before iterating over it.
1242  SmallVector<BasicBlock *, 4> BBList(depth_first(&i->getEntryBlock()));
1243 
1244  for (BasicBlock *i : BBList) {
1245  Instruction *Inst = &i->front();
1246  while (true) {
1247  // DFSanVisitor may split the current basic block, changing the current
1248  // instruction's next pointer and moving the next instruction to the
1249  // tail block from which we should continue.
1250  Instruction *Next = Inst->getNextNode();
1251  // DFSanVisitor may delete Inst, so keep track of whether it was a
1252  // terminator.
1253  bool IsTerminator = Inst->isTerminator();
1254  if (!DFSF.SkipInsts.count(Inst))
1255  DFSanVisitor(DFSF).visit(Inst);
1256  if (IsTerminator)
1257  break;
1258  Inst = Next;
1259  }
1260  }
1261 
1262  // We will not necessarily be able to compute the shadow for every phi node
1263  // until we have visited every block. Therefore, the code that handles phi
1264  // nodes adds them to the PHIFixups list so that they can be properly
1265  // handled here.
1266  for (std::vector<std::pair<PHINode *, PHINode *>>::iterator
1267  i = DFSF.PHIFixups.begin(),
1268  e = DFSF.PHIFixups.end();
1269  i != e; ++i) {
1270  for (unsigned val = 0, n = i->first->getNumIncomingValues(); val != n;
1271  ++val) {
1272  i->second->setIncomingValue(
1273  val, DFSF.getShadow(i->first->getIncomingValue(val)));
1274  }
1275  }
1276 
1277  // -dfsan-debug-nonzero-labels will split the CFG in all kinds of crazy
1278  // places (i.e. instructions in basic blocks we haven't even begun visiting
1279  // yet). To make our life easier, do this work in a pass after the main
1280  // instrumentation.
1281  if (ClDebugNonzeroLabels) {
1282  for (Value *V : DFSF.NonZeroChecks) {
1283  Instruction *Pos;
1284  if (Instruction *I = dyn_cast<Instruction>(V))
1285  Pos = I->getNextNode();
1286  else
1287  Pos = &DFSF.F->getEntryBlock().front();
1288  while (isa<PHINode>(Pos) || isa<AllocaInst>(Pos))
1289  Pos = Pos->getNextNode();
1290  IRBuilder<> IRB(Pos);
1291  Value *PrimitiveShadow = DFSF.collapseToPrimitiveShadow(V, Pos);
1292  Value *Ne =
1293  IRB.CreateICmpNE(PrimitiveShadow, DFSF.DFS.ZeroPrimitiveShadow);
1294  BranchInst *BI = cast<BranchInst>(SplitBlockAndInsertIfThen(
1295  Ne, Pos, /*Unreachable=*/false, ColdCallWeights));
1296  IRBuilder<> ThenIRB(BI);
1297  ThenIRB.CreateCall(DFSF.DFS.DFSanNonzeroLabelFn, {});
1298  }
1299  }
1300  }
1301 
1302  return Changed || !FnsToInstrument.empty() ||
1303  M.global_size() != InitialGlobalSize || M.size() != InitialModuleSize;
1304 }
1305 
1306 Value *DFSanFunction::getArgTLS(Type *T, unsigned ArgOffset, IRBuilder<> &IRB) {
1307  Value *Base = IRB.CreatePointerCast(DFS.ArgTLS, DFS.IntptrTy);
1308  if (ArgOffset)
1309  Base = IRB.CreateAdd(Base, ConstantInt::get(DFS.IntptrTy, ArgOffset));
1310  return IRB.CreateIntToPtr(Base, PointerType::get(DFS.getShadowTy(T), 0),
1311  "_dfsarg");
1312 }
1313 
1314 Value *DFSanFunction::getRetvalTLS(Type *T, IRBuilder<> &IRB) {
1315  return IRB.CreatePointerCast(
1316  DFS.RetvalTLS, PointerType::get(DFS.getShadowTy(T), 0), "_dfsret");
1317 }
1318 
1319 Value *DFSanFunction::getShadowForTLSArgument(Argument *A) {
1320  unsigned ArgOffset = 0;
1321  const DataLayout &DL = F->getParent()->getDataLayout();
1322  for (auto &FArg : F->args()) {
1323  if (!FArg.getType()->isSized()) {
1324  if (A == &FArg)
1325  break;
1326  continue;
1327  }
1328 
1329  unsigned Size = DL.getTypeAllocSize(DFS.getShadowTy(&FArg));
1330  if (A != &FArg) {
1331  ArgOffset += alignTo(Size, kShadowTLSAlignment);
1332  if (ArgOffset > kArgTLSSize)
1333  break; // ArgTLS overflows, uses a zero shadow.
1334  continue;
1335  }
1336 
1337  if (ArgOffset + Size > kArgTLSSize)
1338  break; // ArgTLS overflows, uses a zero shadow.
1339 
1340  Instruction *ArgTLSPos = &*F->getEntryBlock().begin();
1341  IRBuilder<> IRB(ArgTLSPos);
1342  Value *ArgShadowPtr = getArgTLS(FArg.getType(), ArgOffset, IRB);
1343  return IRB.CreateAlignedLoad(DFS.getShadowTy(&FArg), ArgShadowPtr,
1345  }
1346 
1347  return DFS.getZeroShadow(A);
1348 }
1349 
1350 Value *DFSanFunction::getShadow(Value *V) {
1351  if (!isa<Argument>(V) && !isa<Instruction>(V))
1352  return DFS.getZeroShadow(V);
1353  Value *&Shadow = ValShadowMap[V];
1354  if (!Shadow) {
1355  if (Argument *A = dyn_cast<Argument>(V)) {
1356  if (IsNativeABI)
1357  return DFS.getZeroShadow(V);
1358  switch (IA) {
1359  case DataFlowSanitizer::IA_TLS: {
1360  Shadow = getShadowForTLSArgument(A);
1361  break;
1362  }
1363  case DataFlowSanitizer::IA_Args: {
1364  unsigned ArgIdx = A->getArgNo() + F->arg_size() / 2;
1365  Function::arg_iterator i = F->arg_begin();
1366  while (ArgIdx--)
1367  ++i;
1368  Shadow = &*i;
1369  assert(Shadow->getType() == DFS.PrimitiveShadowTy);
1370  break;
1371  }
1372  }
1373  NonZeroChecks.push_back(Shadow);
1374  } else {
1375  Shadow = DFS.getZeroShadow(V);
1376  }
1377  }
1378  return Shadow;
1379 }
1380 
1381 void DFSanFunction::setShadow(Instruction *I, Value *Shadow) {
1382  assert(!ValShadowMap.count(I));
1383  assert(DFS.shouldTrackFieldsAndIndices() ||
1384  Shadow->getType() == DFS.PrimitiveShadowTy);
1385  ValShadowMap[I] = Shadow;
1386 }
1387 
1388 Value *DataFlowSanitizer::getShadowAddress(Value *Addr, Instruction *Pos) {
1389  assert(Addr != RetvalTLS && "Reinstrumenting?");
1390  IRBuilder<> IRB(Pos);
1391  Value *ShadowPtrMaskValue;
1392  if (DFSanRuntimeShadowMask)
1393  ShadowPtrMaskValue = IRB.CreateLoad(IntptrTy, ExternalShadowMask);
1394  else
1395  ShadowPtrMaskValue = ShadowPtrMask;
1396  return IRB.CreateIntToPtr(
1397  IRB.CreateMul(
1398  IRB.CreateAnd(IRB.CreatePtrToInt(Addr, IntptrTy),
1399  IRB.CreatePtrToInt(ShadowPtrMaskValue, IntptrTy)),
1400  ShadowPtrMul),
1401  PrimitiveShadowPtrTy);
1402 }
1403 
1404 Value *DFSanFunction::combineShadowsThenConvert(Type *T, Value *V1, Value *V2,
1405  Instruction *Pos) {
1406  Value *PrimitiveValue = combineShadows(V1, V2, Pos);
1407  return expandFromPrimitiveShadow(T, PrimitiveValue, Pos);
1408 }
1409 
1410 // Generates IR to compute the union of the two given shadows, inserting it
1411 // before Pos. The combined value is with primitive type.
1412 Value *DFSanFunction::combineShadows(Value *V1, Value *V2, Instruction *Pos) {
1413  if (DFS.isZeroShadow(V1))
1414  return collapseToPrimitiveShadow(V2, Pos);
1415  if (DFS.isZeroShadow(V2))
1416  return collapseToPrimitiveShadow(V1, Pos);
1417  if (V1 == V2)
1418  return collapseToPrimitiveShadow(V1, Pos);
1419 
1420  auto V1Elems = ShadowElements.find(V1);
1421  auto V2Elems = ShadowElements.find(V2);
1422  if (V1Elems != ShadowElements.end() && V2Elems != ShadowElements.end()) {
1423  if (std::includes(V1Elems->second.begin(), V1Elems->second.end(),
1424  V2Elems->second.begin(), V2Elems->second.end())) {
1425  return collapseToPrimitiveShadow(V1, Pos);
1426  } else if (std::includes(V2Elems->second.begin(), V2Elems->second.end(),
1427  V1Elems->second.begin(), V1Elems->second.end())) {
1428  return collapseToPrimitiveShadow(V2, Pos);
1429  }
1430  } else if (V1Elems != ShadowElements.end()) {
1431  if (V1Elems->second.count(V2))
1432  return collapseToPrimitiveShadow(V1, Pos);
1433  } else if (V2Elems != ShadowElements.end()) {
1434  if (V2Elems->second.count(V1))
1435  return collapseToPrimitiveShadow(V2, Pos);
1436  }
1437 
1438  auto Key = std::make_pair(V1, V2);
1439  if (V1 > V2)
1440  std::swap(Key.first, Key.second);
1441  CachedShadow &CCS = CachedShadows[Key];
1442  if (CCS.Block && DT.dominates(CCS.Block, Pos->getParent()))
1443  return CCS.Shadow;
1444 
1445  // Converts inputs shadows to shadows with primitive types.
1446  Value *PV1 = collapseToPrimitiveShadow(V1, Pos);
1447  Value *PV2 = collapseToPrimitiveShadow(V2, Pos);
1448 
1449  IRBuilder<> IRB(Pos);
1450  if (ClFast16Labels) {
1451  CCS.Block = Pos->getParent();
1452  CCS.Shadow = IRB.CreateOr(PV1, PV2);
1453  } else if (AvoidNewBlocks) {
1454  CallInst *Call = IRB.CreateCall(DFS.DFSanCheckedUnionFn, {PV1, PV2});
1455  Call->addAttribute(AttributeList::ReturnIndex, Attribute::ZExt);
1456  Call->addParamAttr(0, Attribute::ZExt);
1457  Call->addParamAttr(1, Attribute::ZExt);
1458 
1459  CCS.Block = Pos->getParent();
1460  CCS.Shadow = Call;
1461  } else {
1462  BasicBlock *Head = Pos->getParent();
1463  Value *Ne = IRB.CreateICmpNE(PV1, PV2);
1464  BranchInst *BI = cast<BranchInst>(SplitBlockAndInsertIfThen(
1465  Ne, Pos, /*Unreachable=*/false, DFS.ColdCallWeights, &DT));
1466  IRBuilder<> ThenIRB(BI);
1467  CallInst *Call = ThenIRB.CreateCall(DFS.DFSanUnionFn, {PV1, PV2});
1468  Call->addAttribute(AttributeList::ReturnIndex, Attribute::ZExt);
1469  Call->addParamAttr(0, Attribute::ZExt);
1470  Call->addParamAttr(1, Attribute::ZExt);
1471 
1472  BasicBlock *Tail = BI->getSuccessor(0);
1473  PHINode *Phi =
1474  PHINode::Create(DFS.PrimitiveShadowTy, 2, "", &Tail->front());
1475  Phi->addIncoming(Call, Call->getParent());
1476  Phi->addIncoming(PV1, Head);
1477 
1478  CCS.Block = Tail;
1479  CCS.Shadow = Phi;
1480  }
1481 
1482  std::set<Value *> UnionElems;
1483  if (V1Elems != ShadowElements.end()) {
1484  UnionElems = V1Elems->second;
1485  } else {
1486  UnionElems.insert(V1);
1487  }
1488  if (V2Elems != ShadowElements.end()) {
1489  UnionElems.insert(V2Elems->second.begin(), V2Elems->second.end());
1490  } else {
1491  UnionElems.insert(V2);
1492  }
1493  ShadowElements[CCS.Shadow] = std::move(UnionElems);
1494 
1495  return CCS.Shadow;
1496 }
1497 
1498 // A convenience function which folds the shadows of each of the operands
1499 // of the provided instruction Inst, inserting the IR before Inst. Returns
1500 // the computed union Value.
1501 Value *DFSanFunction::combineOperandShadows(Instruction *Inst) {
1502  if (Inst->getNumOperands() == 0)
1503  return DFS.getZeroShadow(Inst);
1504 
1505  Value *Shadow = getShadow(Inst->getOperand(0));
1506  for (unsigned i = 1, n = Inst->getNumOperands(); i != n; ++i) {
1507  Shadow = combineShadows(Shadow, getShadow(Inst->getOperand(i)), Inst);
1508  }
1509  return expandFromPrimitiveShadow(Inst->getType(), Shadow, Inst);
1510 }
1511 
1512 Value *DFSanVisitor::visitOperandShadowInst(Instruction &I) {
1513  Value *CombinedShadow = DFSF.combineOperandShadows(&I);
1514  DFSF.setShadow(&I, CombinedShadow);
1515  return CombinedShadow;
1516 }
1517 
1518 // Generates IR to load shadow corresponding to bytes [Addr, Addr+Size), where
1519 // Addr has alignment Align, and take the union of each of those shadows. The
1520 // returned shadow always has primitive type.
1521 Value *DFSanFunction::loadShadow(Value *Addr, uint64_t Size, uint64_t Align,
1522  Instruction *Pos) {
1523  if (AllocaInst *AI = dyn_cast<AllocaInst>(Addr)) {
1524  const auto i = AllocaShadowMap.find(AI);
1525  if (i != AllocaShadowMap.end()) {
1526  IRBuilder<> IRB(Pos);
1527  return IRB.CreateLoad(DFS.PrimitiveShadowTy, i->second);
1528  }
1529  }
1530 
1531  const llvm::Align ShadowAlign(Align * DFS.ShadowWidthBytes);
1533  getUnderlyingObjects(Addr, Objs);
1534  bool AllConstants = true;
1535  for (const Value *Obj : Objs) {
1536  if (isa<Function>(Obj) || isa<BlockAddress>(Obj))
1537  continue;
1538  if (isa<GlobalVariable>(Obj) && cast<GlobalVariable>(Obj)->isConstant())
1539  continue;
1540 
1541  AllConstants = false;
1542  break;
1543  }
1544  if (AllConstants)
1545  return DFS.ZeroPrimitiveShadow;
1546 
1547  Value *ShadowAddr = DFS.getShadowAddress(Addr, Pos);
1548  switch (Size) {
1549  case 0:
1550  return DFS.ZeroPrimitiveShadow;
1551  case 1: {
1552  LoadInst *LI = new LoadInst(DFS.PrimitiveShadowTy, ShadowAddr, "", Pos);
1553  LI->setAlignment(ShadowAlign);
1554  return LI;
1555  }
1556  case 2: {
1557  IRBuilder<> IRB(Pos);
1558  Value *ShadowAddr1 = IRB.CreateGEP(DFS.PrimitiveShadowTy, ShadowAddr,
1559  ConstantInt::get(DFS.IntptrTy, 1));
1560  return combineShadows(
1561  IRB.CreateAlignedLoad(DFS.PrimitiveShadowTy, ShadowAddr, ShadowAlign),
1562  IRB.CreateAlignedLoad(DFS.PrimitiveShadowTy, ShadowAddr1, ShadowAlign),
1563  Pos);
1564  }
1565  }
1566 
1567  if (ClFast16Labels && Size % (64 / DFS.ShadowWidthBits) == 0) {
1568  // First OR all the WideShadows, then OR individual shadows within the
1569  // combined WideShadow. This is fewer instructions than ORing shadows
1570  // individually.
1571  IRBuilder<> IRB(Pos);
1572  Value *WideAddr =
1573  IRB.CreateBitCast(ShadowAddr, Type::getInt64PtrTy(*DFS.Ctx));
1574  Value *CombinedWideShadow =
1575  IRB.CreateAlignedLoad(IRB.getInt64Ty(), WideAddr, ShadowAlign);
1576  for (uint64_t Ofs = 64 / DFS.ShadowWidthBits; Ofs != Size;
1577  Ofs += 64 / DFS.ShadowWidthBits) {
1578  WideAddr = IRB.CreateGEP(Type::getInt64Ty(*DFS.Ctx), WideAddr,
1579  ConstantInt::get(DFS.IntptrTy, 1));
1580  Value *NextWideShadow =
1581  IRB.CreateAlignedLoad(IRB.getInt64Ty(), WideAddr, ShadowAlign);
1582  CombinedWideShadow = IRB.CreateOr(CombinedWideShadow, NextWideShadow);
1583  }
1584  for (unsigned Width = 32; Width >= DFS.ShadowWidthBits; Width >>= 1) {
1585  Value *ShrShadow = IRB.CreateLShr(CombinedWideShadow, Width);
1586  CombinedWideShadow = IRB.CreateOr(CombinedWideShadow, ShrShadow);
1587  }
1588  return IRB.CreateTrunc(CombinedWideShadow, DFS.PrimitiveShadowTy);
1589  }
1590  if (!AvoidNewBlocks && Size % (64 / DFS.ShadowWidthBits) == 0) {
1591  // Fast path for the common case where each byte has identical shadow: load
1592  // shadow 64 bits at a time, fall out to a __dfsan_union_load call if any
1593  // shadow is non-equal.
1594  BasicBlock *FallbackBB = BasicBlock::Create(*DFS.Ctx, "", F);
1595  IRBuilder<> FallbackIRB(FallbackBB);
1596  CallInst *FallbackCall = FallbackIRB.CreateCall(
1597  DFS.DFSanUnionLoadFn,
1598  {ShadowAddr, ConstantInt::get(DFS.IntptrTy, Size)});
1599  FallbackCall->addAttribute(AttributeList::ReturnIndex, Attribute::ZExt);
1600 
1601  // Compare each of the shadows stored in the loaded 64 bits to each other,
1602  // by computing (WideShadow rotl ShadowWidthBits) == WideShadow.
1603  IRBuilder<> IRB(Pos);
1604  Value *WideAddr =
1605  IRB.CreateBitCast(ShadowAddr, Type::getInt64PtrTy(*DFS.Ctx));
1606  Value *WideShadow =
1607  IRB.CreateAlignedLoad(IRB.getInt64Ty(), WideAddr, ShadowAlign);
1608  Value *TruncShadow = IRB.CreateTrunc(WideShadow, DFS.PrimitiveShadowTy);
1609  Value *ShlShadow = IRB.CreateShl(WideShadow, DFS.ShadowWidthBits);
1610  Value *ShrShadow = IRB.CreateLShr(WideShadow, 64 - DFS.ShadowWidthBits);
1611  Value *RotShadow = IRB.CreateOr(ShlShadow, ShrShadow);
1612  Value *ShadowsEq = IRB.CreateICmpEQ(WideShadow, RotShadow);
1613 
1614  BasicBlock *Head = Pos->getParent();
1615  BasicBlock *Tail = Head->splitBasicBlock(Pos->getIterator());
1616 
1617  if (DomTreeNode *OldNode = DT.getNode(Head)) {
1618  std::vector<DomTreeNode *> Children(OldNode->begin(), OldNode->end());
1619 
1620  DomTreeNode *NewNode = DT.addNewBlock(Tail, Head);
1621  for (auto Child : Children)
1622  DT.changeImmediateDominator(Child, NewNode);
1623  }
1624 
1625  // In the following code LastBr will refer to the previous basic block's
1626  // conditional branch instruction, whose true successor is fixed up to point
1627  // to the next block during the loop below or to the tail after the final
1628  // iteration.
1629  BranchInst *LastBr = BranchInst::Create(FallbackBB, FallbackBB, ShadowsEq);
1630  ReplaceInstWithInst(Head->getTerminator(), LastBr);
1631  DT.addNewBlock(FallbackBB, Head);
1632 
1633  for (uint64_t Ofs = 64 / DFS.ShadowWidthBits; Ofs != Size;
1634  Ofs += 64 / DFS.ShadowWidthBits) {
1635  BasicBlock *NextBB = BasicBlock::Create(*DFS.Ctx, "", F);
1636  DT.addNewBlock(NextBB, LastBr->getParent());
1637  IRBuilder<> NextIRB(NextBB);
1638  WideAddr = NextIRB.CreateGEP(Type::getInt64Ty(*DFS.Ctx), WideAddr,
1639  ConstantInt::get(DFS.IntptrTy, 1));
1640  Value *NextWideShadow = NextIRB.CreateAlignedLoad(NextIRB.getInt64Ty(),
1641  WideAddr, ShadowAlign);
1642  ShadowsEq = NextIRB.CreateICmpEQ(WideShadow, NextWideShadow);
1643  LastBr->setSuccessor(0, NextBB);
1644  LastBr = NextIRB.CreateCondBr(ShadowsEq, FallbackBB, FallbackBB);
1645  }
1646 
1647  LastBr->setSuccessor(0, Tail);
1648  FallbackIRB.CreateBr(Tail);
1649  PHINode *Shadow =
1650  PHINode::Create(DFS.PrimitiveShadowTy, 2, "", &Tail->front());
1651  Shadow->addIncoming(FallbackCall, FallbackBB);
1652  Shadow->addIncoming(TruncShadow, LastBr->getParent());
1653  return Shadow;
1654  }
1655 
1656  IRBuilder<> IRB(Pos);
1657  FunctionCallee &UnionLoadFn =
1658  ClFast16Labels ? DFS.DFSanUnionLoadFast16LabelsFn : DFS.DFSanUnionLoadFn;
1659  CallInst *FallbackCall = IRB.CreateCall(
1660  UnionLoadFn, {ShadowAddr, ConstantInt::get(DFS.IntptrTy, Size)});
1661  FallbackCall->addAttribute(AttributeList::ReturnIndex, Attribute::ZExt);
1662  return FallbackCall;
1663 }
1664 
1665 void DFSanVisitor::visitLoadInst(LoadInst &LI) {
1666  auto &DL = LI.getModule()->getDataLayout();
1667  uint64_t Size = DL.getTypeStoreSize(LI.getType());
1668  if (Size == 0) {
1669  DFSF.setShadow(&LI, DFSF.DFS.getZeroShadow(&LI));
1670  return;
1671  }
1672 
1673  Align Alignment = ClPreserveAlignment ? LI.getAlign() : Align(1);
1674  Value *PrimitiveShadow =
1675  DFSF.loadShadow(LI.getPointerOperand(), Size, Alignment.value(), &LI);
1677  Value *PtrShadow = DFSF.getShadow(LI.getPointerOperand());
1678  PrimitiveShadow = DFSF.combineShadows(PrimitiveShadow, PtrShadow, &LI);
1679  }
1680  if (!DFSF.DFS.isZeroShadow(PrimitiveShadow))
1681  DFSF.NonZeroChecks.push_back(PrimitiveShadow);
1682 
1683  Value *Shadow =
1684  DFSF.expandFromPrimitiveShadow(LI.getType(), PrimitiveShadow, &LI);
1685  DFSF.setShadow(&LI, Shadow);
1686  if (ClEventCallbacks) {
1687  IRBuilder<> IRB(&LI);
1688  Value *Addr8 = IRB.CreateBitCast(LI.getPointerOperand(), DFSF.DFS.Int8Ptr);
1689  IRB.CreateCall(DFSF.DFS.DFSanLoadCallbackFn, {PrimitiveShadow, Addr8});
1690  }
1691 }
1692 
1693 void DFSanFunction::storePrimitiveShadow(Value *Addr, uint64_t Size,
1694  Align Alignment,
1695  Value *PrimitiveShadow,
1696  Instruction *Pos) {
1697  if (AllocaInst *AI = dyn_cast<AllocaInst>(Addr)) {
1698  const auto i = AllocaShadowMap.find(AI);
1699  if (i != AllocaShadowMap.end()) {
1700  IRBuilder<> IRB(Pos);
1701  IRB.CreateStore(PrimitiveShadow, i->second);
1702  return;
1703  }
1704  }
1705 
1706  const Align ShadowAlign(Alignment.value() * DFS.ShadowWidthBytes);
1707  IRBuilder<> IRB(Pos);
1708  Value *ShadowAddr = DFS.getShadowAddress(Addr, Pos);
1709  if (DFS.isZeroShadow(PrimitiveShadow)) {
1710  IntegerType *ShadowTy =
1711  IntegerType::get(*DFS.Ctx, Size * DFS.ShadowWidthBits);
1712  Value *ExtZeroShadow = ConstantInt::get(ShadowTy, 0);
1713  Value *ExtShadowAddr =
1714  IRB.CreateBitCast(ShadowAddr, PointerType::getUnqual(ShadowTy));
1715  IRB.CreateAlignedStore(ExtZeroShadow, ExtShadowAddr, ShadowAlign);
1716  return;
1717  }
1718 
1719  const unsigned ShadowVecSize = 128 / DFS.ShadowWidthBits;
1720  uint64_t Offset = 0;
1721  if (Size >= ShadowVecSize) {
1722  auto *ShadowVecTy =
1723  FixedVectorType::get(DFS.PrimitiveShadowTy, ShadowVecSize);
1724  Value *ShadowVec = UndefValue::get(ShadowVecTy);
1725  for (unsigned i = 0; i != ShadowVecSize; ++i) {
1726  ShadowVec = IRB.CreateInsertElement(
1727  ShadowVec, PrimitiveShadow,
1729  }
1730  Value *ShadowVecAddr =
1731  IRB.CreateBitCast(ShadowAddr, PointerType::getUnqual(ShadowVecTy));
1732  do {
1733  Value *CurShadowVecAddr =
1734  IRB.CreateConstGEP1_32(ShadowVecTy, ShadowVecAddr, Offset);
1735  IRB.CreateAlignedStore(ShadowVec, CurShadowVecAddr, ShadowAlign);
1736  Size -= ShadowVecSize;
1737  ++Offset;
1738  } while (Size >= ShadowVecSize);
1739  Offset *= ShadowVecSize;
1740  }
1741  while (Size > 0) {
1742  Value *CurShadowAddr =
1743  IRB.CreateConstGEP1_32(DFS.PrimitiveShadowTy, ShadowAddr, Offset);
1744  IRB.CreateAlignedStore(PrimitiveShadow, CurShadowAddr, ShadowAlign);
1745  --Size;
1746  ++Offset;
1747  }
1748 }
1749 
1750 void DFSanVisitor::visitStoreInst(StoreInst &SI) {
1751  auto &DL = SI.getModule()->getDataLayout();
1752  uint64_t Size = DL.getTypeStoreSize(SI.getValueOperand()->getType());
1753  if (Size == 0)
1754  return;
1755 
1756  const Align Alignment = ClPreserveAlignment ? SI.getAlign() : Align(1);
1757 
1758  Value* Shadow = DFSF.getShadow(SI.getValueOperand());
1759  Value *PrimitiveShadow;
1761  Value *PtrShadow = DFSF.getShadow(SI.getPointerOperand());
1762  PrimitiveShadow = DFSF.combineShadows(Shadow, PtrShadow, &SI);
1763  } else {
1764  PrimitiveShadow = DFSF.collapseToPrimitiveShadow(Shadow, &SI);
1765  }
1766  DFSF.storePrimitiveShadow(SI.getPointerOperand(), Size, Alignment,
1767  PrimitiveShadow, &SI);
1768  if (ClEventCallbacks) {
1769  IRBuilder<> IRB(&SI);
1770  Value *Addr8 = IRB.CreateBitCast(SI.getPointerOperand(), DFSF.DFS.Int8Ptr);
1771  IRB.CreateCall(DFSF.DFS.DFSanStoreCallbackFn, {PrimitiveShadow, Addr8});
1772  }
1773 }
1774 
1775 void DFSanVisitor::visitUnaryOperator(UnaryOperator &UO) {
1776  visitOperandShadowInst(UO);
1777 }
1778 
1779 void DFSanVisitor::visitBinaryOperator(BinaryOperator &BO) {
1780  visitOperandShadowInst(BO);
1781 }
1782 
1783 void DFSanVisitor::visitCastInst(CastInst &CI) { visitOperandShadowInst(CI); }
1784 
1785 void DFSanVisitor::visitCmpInst(CmpInst &CI) {
1786  Value *CombinedShadow = visitOperandShadowInst(CI);
1787  if (ClEventCallbacks) {
1788  IRBuilder<> IRB(&CI);
1789  IRB.CreateCall(DFSF.DFS.DFSanCmpCallbackFn, CombinedShadow);
1790  }
1791 }
1792 
1793 void DFSanVisitor::visitGetElementPtrInst(GetElementPtrInst &GEPI) {
1794  visitOperandShadowInst(GEPI);
1795 }
1796 
1797 void DFSanVisitor::visitExtractElementInst(ExtractElementInst &I) {
1798  visitOperandShadowInst(I);
1799 }
1800 
1801 void DFSanVisitor::visitInsertElementInst(InsertElementInst &I) {
1802  visitOperandShadowInst(I);
1803 }
1804 
1805 void DFSanVisitor::visitShuffleVectorInst(ShuffleVectorInst &I) {
1806  visitOperandShadowInst(I);
1807 }
1808 
1809 void DFSanVisitor::visitExtractValueInst(ExtractValueInst &I) {
1810  if (!DFSF.DFS.shouldTrackFieldsAndIndices()) {
1811  visitOperandShadowInst(I);
1812  return;
1813  }
1814 
1815  IRBuilder<> IRB(&I);
1816  Value *Agg = I.getAggregateOperand();
1817  Value *AggShadow = DFSF.getShadow(Agg);
1818  Value *ResShadow = IRB.CreateExtractValue(AggShadow, I.getIndices());
1819  DFSF.setShadow(&I, ResShadow);
1820 }
1821 
1822 void DFSanVisitor::visitInsertValueInst(InsertValueInst &I) {
1823  if (!DFSF.DFS.shouldTrackFieldsAndIndices()) {
1824  visitOperandShadowInst(I);
1825  return;
1826  }
1827 
1828  IRBuilder<> IRB(&I);
1829  Value *AggShadow = DFSF.getShadow(I.getAggregateOperand());
1830  Value *InsShadow = DFSF.getShadow(I.getInsertedValueOperand());
1831  Value *Res = IRB.CreateInsertValue(AggShadow, InsShadow, I.getIndices());
1832  DFSF.setShadow(&I, Res);
1833 }
1834 
1835 void DFSanVisitor::visitAllocaInst(AllocaInst &I) {
1836  bool AllLoadsStores = true;
1837  for (User *U : I.users()) {
1838  if (isa<LoadInst>(U))
1839  continue;
1840 
1841  if (StoreInst *SI = dyn_cast<StoreInst>(U)) {
1842  if (SI->getPointerOperand() == &I)
1843  continue;
1844  }
1845 
1846  AllLoadsStores = false;
1847  break;
1848  }
1849  if (AllLoadsStores) {
1850  IRBuilder<> IRB(&I);
1851  DFSF.AllocaShadowMap[&I] = IRB.CreateAlloca(DFSF.DFS.PrimitiveShadowTy);
1852  }
1853  DFSF.setShadow(&I, DFSF.DFS.ZeroPrimitiveShadow);
1854 }
1855 
1856 void DFSanVisitor::visitSelectInst(SelectInst &I) {
1857  Value *CondShadow = DFSF.getShadow(I.getCondition());
1858  Value *TrueShadow = DFSF.getShadow(I.getTrueValue());
1859  Value *FalseShadow = DFSF.getShadow(I.getFalseValue());
1860  Value *ShadowSel = nullptr;
1861 
1862  if (isa<VectorType>(I.getCondition()->getType())) {
1863  ShadowSel = DFSF.combineShadowsThenConvert(I.getType(), TrueShadow,
1864  FalseShadow, &I);
1865  } else {
1866  if (TrueShadow == FalseShadow) {
1867  ShadowSel = TrueShadow;
1868  } else {
1869  ShadowSel =
1870  SelectInst::Create(I.getCondition(), TrueShadow, FalseShadow, "", &I);
1871  }
1872  }
1873  DFSF.setShadow(&I, ClTrackSelectControlFlow
1874  ? DFSF.combineShadowsThenConvert(
1875  I.getType(), CondShadow, ShadowSel, &I)
1876  : ShadowSel);
1877 }
1878 
1879 void DFSanVisitor::visitMemSetInst(MemSetInst &I) {
1880  IRBuilder<> IRB(&I);
1881  Value *ValShadow = DFSF.getShadow(I.getValue());
1882  IRB.CreateCall(DFSF.DFS.DFSanSetLabelFn,
1883  {ValShadow, IRB.CreateBitCast(I.getDest(), Type::getInt8PtrTy(
1884  *DFSF.DFS.Ctx)),
1885  IRB.CreateZExtOrTrunc(I.getLength(), DFSF.DFS.IntptrTy)});
1886 }
1887 
1888 void DFSanVisitor::visitMemTransferInst(MemTransferInst &I) {
1889  IRBuilder<> IRB(&I);
1890  Value *RawDestShadow = DFSF.DFS.getShadowAddress(I.getDest(), &I);
1891  Value *SrcShadow = DFSF.DFS.getShadowAddress(I.getSource(), &I);
1892  Value *LenShadow =
1893  IRB.CreateMul(I.getLength(), ConstantInt::get(I.getLength()->getType(),
1894  DFSF.DFS.ShadowWidthBytes));
1895  Type *Int8Ptr = Type::getInt8PtrTy(*DFSF.DFS.Ctx);
1896  Value *DestShadow = IRB.CreateBitCast(RawDestShadow, Int8Ptr);
1897  SrcShadow = IRB.CreateBitCast(SrcShadow, Int8Ptr);
1898  auto *MTI = cast<MemTransferInst>(
1899  IRB.CreateCall(I.getFunctionType(), I.getCalledOperand(),
1900  {DestShadow, SrcShadow, LenShadow, I.getVolatileCst()}));
1901  if (ClPreserveAlignment) {
1902  MTI->setDestAlignment(I.getDestAlign() * DFSF.DFS.ShadowWidthBytes);
1903  MTI->setSourceAlignment(I.getSourceAlign() * DFSF.DFS.ShadowWidthBytes);
1904  } else {
1905  MTI->setDestAlignment(Align(DFSF.DFS.ShadowWidthBytes));
1906  MTI->setSourceAlignment(Align(DFSF.DFS.ShadowWidthBytes));
1907  }
1908  if (ClEventCallbacks) {
1909  IRB.CreateCall(DFSF.DFS.DFSanMemTransferCallbackFn,
1910  {RawDestShadow, I.getLength()});
1911  }
1912 }
1913 
1914 void DFSanVisitor::visitReturnInst(ReturnInst &RI) {
1915  if (!DFSF.IsNativeABI && RI.getReturnValue()) {
1916  switch (DFSF.IA) {
1917  case DataFlowSanitizer::IA_TLS: {
1918  Value *S = DFSF.getShadow(RI.getReturnValue());
1919  IRBuilder<> IRB(&RI);
1920  Type *RT = DFSF.F->getFunctionType()->getReturnType();
1921  unsigned Size =
1922  getDataLayout().getTypeAllocSize(DFSF.DFS.getShadowTy(RT));
1923  if (Size <= kRetvalTLSSize) {
1924  // If the size overflows, stores nothing. At callsite, oversized return
1925  // shadows are set to zero.
1926  IRB.CreateAlignedStore(S, DFSF.getRetvalTLS(RT, IRB),
1928  }
1929  break;
1930  }
1931  case DataFlowSanitizer::IA_Args: {
1932  IRBuilder<> IRB(&RI);
1933  Type *RT = DFSF.F->getFunctionType()->getReturnType();
1934  Value *InsVal =
1936  Value *InsShadow =
1937  IRB.CreateInsertValue(InsVal, DFSF.getShadow(RI.getReturnValue()), 1);
1938  RI.setOperand(0, InsShadow);
1939  break;
1940  }
1941  }
1942  }
1943 }
1944 
1945 void DFSanVisitor::visitCallBase(CallBase &CB) {
1946  Function *F = CB.getCalledFunction();
1947  if ((F && F->isIntrinsic()) || CB.isInlineAsm()) {
1948  visitOperandShadowInst(CB);
1949  return;
1950  }
1951 
1952  // Calls to this function are synthesized in wrappers, and we shouldn't
1953  // instrument them.
1954  if (F == DFSF.DFS.DFSanVarargWrapperFn.getCallee()->stripPointerCasts())
1955  return;
1956 
1957  IRBuilder<> IRB(&CB);
1958 
1960  DFSF.DFS.UnwrappedFnMap.find(CB.getCalledOperand());
1961  if (i != DFSF.DFS.UnwrappedFnMap.end()) {
1962  Function *F = i->second;
1963  switch (DFSF.DFS.getWrapperKind(F)) {
1964  case DataFlowSanitizer::WK_Warning:
1965  CB.setCalledFunction(F);
1966  IRB.CreateCall(DFSF.DFS.DFSanUnimplementedFn,
1967  IRB.CreateGlobalStringPtr(F->getName()));
1968  DFSF.setShadow(&CB, DFSF.DFS.getZeroShadow(&CB));
1969  return;
1970  case DataFlowSanitizer::WK_Discard:
1971  CB.setCalledFunction(F);
1972  DFSF.setShadow(&CB, DFSF.DFS.getZeroShadow(&CB));
1973  return;
1974  case DataFlowSanitizer::WK_Functional:
1975  CB.setCalledFunction(F);
1976  visitOperandShadowInst(CB);
1977  return;
1978  case DataFlowSanitizer::WK_Custom:
1979  // Don't try to handle invokes of custom functions, it's too complicated.
1980  // Instead, invoke the dfsw$ wrapper, which will in turn call the __dfsw_
1981  // wrapper.
1982  if (CallInst *CI = dyn_cast<CallInst>(&CB)) {
1983  FunctionType *FT = F->getFunctionType();
1984  TransformedFunction CustomFn = DFSF.DFS.getCustomFunctionType(FT);
1985  std::string CustomFName = "__dfsw_";
1986  CustomFName += F->getName();
1987  FunctionCallee CustomF = DFSF.DFS.Mod->getOrInsertFunction(
1988  CustomFName, CustomFn.TransformedType);
1989  if (Function *CustomFn = dyn_cast<Function>(CustomF.getCallee())) {
1990  CustomFn->copyAttributesFrom(F);
1991 
1992  // Custom functions returning non-void will write to the return label.
1993  if (!FT->getReturnType()->isVoidTy()) {
1994  CustomFn->removeAttributes(AttributeList::FunctionIndex,
1995  DFSF.DFS.ReadOnlyNoneAttrs);
1996  }
1997  }
1998 
1999  std::vector<Value *> Args;
2000 
2001  auto i = CB.arg_begin();
2002  for (unsigned n = FT->getNumParams(); n != 0; ++i, --n) {
2003  Type *T = (*i)->getType();
2004  FunctionType *ParamFT;
2005  if (isa<PointerType>(T) &&
2006  (ParamFT = dyn_cast<FunctionType>(
2007  cast<PointerType>(T)->getElementType()))) {
2008  std::string TName = "dfst";
2009  TName += utostr(FT->getNumParams() - n);
2010  TName += "$";
2011  TName += F->getName();
2012  Constant *T = DFSF.DFS.getOrBuildTrampolineFunction(ParamFT, TName);
2013  Args.push_back(T);
2014  Args.push_back(
2015  IRB.CreateBitCast(*i, Type::getInt8PtrTy(*DFSF.DFS.Ctx)));
2016  } else {
2017  Args.push_back(*i);
2018  }
2019  }
2020 
2021  i = CB.arg_begin();
2022  const unsigned ShadowArgStart = Args.size();
2023  for (unsigned n = FT->getNumParams(); n != 0; ++i, --n)
2024  Args.push_back(
2025  DFSF.collapseToPrimitiveShadow(DFSF.getShadow(*i), &CB));
2026 
2027  if (FT->isVarArg()) {
2028  auto *LabelVATy = ArrayType::get(DFSF.DFS.PrimitiveShadowTy,
2029  CB.arg_size() - FT->getNumParams());
2030  auto *LabelVAAlloca = new AllocaInst(
2031  LabelVATy, getDataLayout().getAllocaAddrSpace(),
2032  "labelva", &DFSF.F->getEntryBlock().front());
2033 
2034  for (unsigned n = 0; i != CB.arg_end(); ++i, ++n) {
2035  auto LabelVAPtr = IRB.CreateStructGEP(LabelVATy, LabelVAAlloca, n);
2036  IRB.CreateStore(
2037  DFSF.collapseToPrimitiveShadow(DFSF.getShadow(*i), &CB),
2038  LabelVAPtr);
2039  }
2040 
2041  Args.push_back(IRB.CreateStructGEP(LabelVATy, LabelVAAlloca, 0));
2042  }
2043 
2044  if (!FT->getReturnType()->isVoidTy()) {
2045  if (!DFSF.LabelReturnAlloca) {
2046  DFSF.LabelReturnAlloca =
2047  new AllocaInst(DFSF.DFS.PrimitiveShadowTy,
2048  getDataLayout().getAllocaAddrSpace(),
2049  "labelreturn", &DFSF.F->getEntryBlock().front());
2050  }
2051  Args.push_back(DFSF.LabelReturnAlloca);
2052  }
2053 
2054  for (i = CB.arg_begin() + FT->getNumParams(); i != CB.arg_end(); ++i)
2055  Args.push_back(*i);
2056 
2057  CallInst *CustomCI = IRB.CreateCall(CustomF, Args);
2058  CustomCI->setCallingConv(CI->getCallingConv());
2059  CustomCI->setAttributes(TransformFunctionAttributes(CustomFn,
2060  CI->getContext(), CI->getAttributes()));
2061 
2062  // Update the parameter attributes of the custom call instruction to
2063  // zero extend the shadow parameters. This is required for targets
2064  // which consider PrimitiveShadowTy an illegal type.
2065  for (unsigned n = 0; n < FT->getNumParams(); n++) {
2066  const unsigned ArgNo = ShadowArgStart + n;
2067  if (CustomCI->getArgOperand(ArgNo)->getType() ==
2068  DFSF.DFS.PrimitiveShadowTy)
2069  CustomCI->addParamAttr(ArgNo, Attribute::ZExt);
2070  }
2071 
2072  if (!FT->getReturnType()->isVoidTy()) {
2073  LoadInst *LabelLoad = IRB.CreateLoad(DFSF.DFS.PrimitiveShadowTy,
2074  DFSF.LabelReturnAlloca);
2075  DFSF.setShadow(CustomCI, DFSF.expandFromPrimitiveShadow(
2076  FT->getReturnType(), LabelLoad, &CB));
2077  }
2078 
2079  CI->replaceAllUsesWith(CustomCI);
2080  CI->eraseFromParent();
2081  return;
2082  }
2083  break;
2084  }
2085  }
2086 
2087  FunctionType *FT = CB.getFunctionType();
2088  if (DFSF.DFS.getInstrumentedABI() == DataFlowSanitizer::IA_TLS) {
2089  unsigned ArgOffset = 0;
2090  const DataLayout &DL = getDataLayout();
2091  for (unsigned I = 0, N = FT->getNumParams(); I != N; ++I) {
2092  unsigned Size =
2093  DL.getTypeAllocSize(DFSF.DFS.getShadowTy(FT->getParamType(I)));
2094  // Stop storing if arguments' size overflows. Inside a function, arguments
2095  // after overflow have zero shadow values.
2096  if (ArgOffset + Size > kArgTLSSize)
2097  break;
2098  IRB.CreateAlignedStore(
2099  DFSF.getShadow(CB.getArgOperand(I)),
2100  DFSF.getArgTLS(FT->getParamType(I), ArgOffset, IRB),
2102  ArgOffset += alignTo(Size, kShadowTLSAlignment);
2103  }
2104  }
2105 
2106  Instruction *Next = nullptr;
2107  if (!CB.getType()->isVoidTy()) {
2108  if (InvokeInst *II = dyn_cast<InvokeInst>(&CB)) {
2109  if (II->getNormalDest()->getSinglePredecessor()) {
2110  Next = &II->getNormalDest()->front();
2111  } else {
2112  BasicBlock *NewBB =
2113  SplitEdge(II->getParent(), II->getNormalDest(), &DFSF.DT);
2114  Next = &NewBB->front();
2115  }
2116  } else {
2117  assert(CB.getIterator() != CB.getParent()->end());
2118  Next = CB.getNextNode();
2119  }
2120 
2121  if (DFSF.DFS.getInstrumentedABI() == DataFlowSanitizer::IA_TLS) {
2122  IRBuilder<> NextIRB(Next);
2123  const DataLayout &DL = getDataLayout();
2124  unsigned Size = DL.getTypeAllocSize(DFSF.DFS.getShadowTy(&CB));
2125  if (Size > kRetvalTLSSize) {
2126  // Set overflowed return shadow to be zero.
2127  DFSF.setShadow(&CB, DFSF.DFS.getZeroShadow(&CB));
2128  } else {
2129  LoadInst *LI = NextIRB.CreateAlignedLoad(
2130  DFSF.DFS.getShadowTy(&CB), DFSF.getRetvalTLS(CB.getType(), NextIRB),
2131  kShadowTLSAlignment, "_dfsret");
2132  DFSF.SkipInsts.insert(LI);
2133  DFSF.setShadow(&CB, LI);
2134  DFSF.NonZeroChecks.push_back(LI);
2135  }
2136  }
2137  }
2138 
2139  // Do all instrumentation for IA_Args down here to defer tampering with the
2140  // CFG in a way that SplitEdge may be able to detect.
2141  if (DFSF.DFS.getInstrumentedABI() == DataFlowSanitizer::IA_Args) {
2142  FunctionType *NewFT = DFSF.DFS.getArgsFunctionType(FT);
2143  Value *Func =
2145  std::vector<Value *> Args;
2146 
2147  auto i = CB.arg_begin(), E = CB.arg_end();
2148  for (unsigned n = FT->getNumParams(); n != 0; ++i, --n)
2149  Args.push_back(*i);
2150 
2151  i = CB.arg_begin();
2152  for (unsigned n = FT->getNumParams(); n != 0; ++i, --n)
2153  Args.push_back(DFSF.getShadow(*i));
2154 
2155  if (FT->isVarArg()) {
2156  unsigned VarArgSize = CB.arg_size() - FT->getNumParams();
2157  ArrayType *VarArgArrayTy =
2158  ArrayType::get(DFSF.DFS.PrimitiveShadowTy, VarArgSize);
2159  AllocaInst *VarArgShadow =
2160  new AllocaInst(VarArgArrayTy, getDataLayout().getAllocaAddrSpace(),
2161  "", &DFSF.F->getEntryBlock().front());
2162  Args.push_back(IRB.CreateConstGEP2_32(VarArgArrayTy, VarArgShadow, 0, 0));
2163  for (unsigned n = 0; i != E; ++i, ++n) {
2164  IRB.CreateStore(
2165  DFSF.getShadow(*i),
2166  IRB.CreateConstGEP2_32(VarArgArrayTy, VarArgShadow, 0, n));
2167  Args.push_back(*i);
2168  }
2169  }
2170 
2171  CallBase *NewCB;
2172  if (InvokeInst *II = dyn_cast<InvokeInst>(&CB)) {
2173  NewCB = IRB.CreateInvoke(NewFT, Func, II->getNormalDest(),
2174  II->getUnwindDest(), Args);
2175  } else {
2176  NewCB = IRB.CreateCall(NewFT, Func, Args);
2177  }
2178  NewCB->setCallingConv(CB.getCallingConv());
2180  *DFSF.DFS.Ctx, AttributeList::ReturnIndex,
2182 
2183  if (Next) {
2184  ExtractValueInst *ExVal = ExtractValueInst::Create(NewCB, 0, "", Next);
2185  DFSF.SkipInsts.insert(ExVal);
2186  ExtractValueInst *ExShadow = ExtractValueInst::Create(NewCB, 1, "", Next);
2187  DFSF.SkipInsts.insert(ExShadow);
2188  DFSF.setShadow(ExVal, ExShadow);
2189  DFSF.NonZeroChecks.push_back(ExShadow);
2190 
2191  CB.replaceAllUsesWith(ExVal);
2192  }
2193 
2194  CB.eraseFromParent();
2195  }
2196 }
2197 
2198 void DFSanVisitor::visitPHINode(PHINode &PN) {
2199  Type *ShadowTy = DFSF.DFS.getShadowTy(&PN);
2200  PHINode *ShadowPN =
2201  PHINode::Create(ShadowTy, PN.getNumIncomingValues(), "", &PN);
2202 
2203  // Give the shadow phi node valid predecessors to fool SplitEdge into working.
2204  Value *UndefShadow = UndefValue::get(ShadowTy);
2205  for (PHINode::block_iterator i = PN.block_begin(), e = PN.block_end(); i != e;
2206  ++i) {
2207  ShadowPN->addIncoming(UndefShadow, *i);
2208  }
2209 
2210  DFSF.PHIFixups.push_back(std::make_pair(&PN, ShadowPN));
2211  DFSF.setShadow(&PN, ShadowPN);
2212 }
2213 
2214 namespace {
2215 class DataFlowSanitizerLegacyPass : public ModulePass {
2216 private:
2217  std::vector<std::string> ABIListFiles;
2218 
2219 public:
2220  static char ID;
2221 
2222  DataFlowSanitizerLegacyPass(
2223  const std::vector<std::string> &ABIListFiles = std::vector<std::string>())
2224  : ModulePass(ID), ABIListFiles(ABIListFiles) {}
2225 
2226  bool runOnModule(Module &M) override {
2227  return DataFlowSanitizer(ABIListFiles).runImpl(M);
2228  }
2229 };
2230 } // namespace
2231 
2233 
2234 INITIALIZE_PASS(DataFlowSanitizerLegacyPass, "dfsan",
2235  "DataFlowSanitizer: dynamic data flow analysis.", false, false)
2236 
2238  const std::vector<std::string> &ABIListFiles) {
2239  return new DataFlowSanitizerLegacyPass(ABIListFiles);
2240 }
2241 
2243  ModuleAnalysisManager &AM) {
2244  if (DataFlowSanitizer(ABIListFiles).runImpl(M)) {
2245  return PreservedAnalyses::none();
2246  }
2247  return PreservedAnalyses::all();
2248 }
const NoneType None
Definition: None.h:23
uint64_t CallInst * C
Return a value (possibly void), from a function.
void append_range(Container &C, Range &&R)
Wrapper function to append a range to a container.
Definition: STLExtras.h:1683
SymbolTableList< Instruction >::iterator eraseFromParent()
This method unlinks 'this' from the containing basic block and deletes it.
Definition: Instruction.cpp:77
static cl::list< std::string > ClABIListFiles("dfsan-abilist", cl::desc("File listing native ABI functions and how the pass treats them"), cl::Hidden)
InvokeInst * CreateInvoke(FunctionType *Ty, Value *Callee, BasicBlock *NormalDest, BasicBlock *UnwindDest, ArrayRef< Value * > Args, ArrayRef< OperandBundleDef > OpBundles, const Twine &Name="")
Create an invoke instruction.
Definition: IRBuilder.h:1086
static const unsigned kArgTLSSize
A parsed version of the target data layout string in and methods for querying it.
Definition: DataLayout.h:111
static Value * expandFromPrimitiveShadowRecursive(Value *Shadow, SmallVector< unsigned, 4 > &Indices, Type *SubShadowTy, Value *PrimitiveShadow, IRBuilder<> &IRB)
void ReplaceInstWithInst(BasicBlock::InstListType &BIL, BasicBlock::iterator &BI, Instruction *I)
Replace the instruction specified by BI with the instruction specified by I.
This class is the base class for the comparison instructions.
Definition: InstrTypes.h:712
static bool runImpl(Function &F, TargetLibraryInfo &TLI, DominatorTree &DT)
This is the entry point for all transforms.
static bool isConstant(const MachineInstr &MI)
void addIncoming(Value *V, BasicBlock *BB)
Add an incoming value to the end of the PHI list.
This instruction extracts a struct member or array element value from an aggregate value.
This class represents an incoming formal argument to a Function.
Definition: Argument.h:29
Base class for instruction visitors.
Definition: InstVisitor.h:79
IntrusiveRefCntPtr< FileSystem > getRealFileSystem()
Gets an vfs::FileSystem for the 'real' file system, as seen by the operating system.
NodeTy * getNextNode()
Get the next node, or nullptr for the list tail.
Definition: ilist_node.h:288
LLVM_ATTRIBUTE_NORETURN void report_fatal_error(Error Err, bool gen_crash_diag=true)
Report a serious error, calling any installed error handler.
Definition: Error.cpp:140
This class represents lattice values for constants.
Definition: AllocatorList.h:23
CallInst * CreateCall(FunctionType *FTy, Value *Callee, ArrayRef< Value * > Args=None, const Twine &Name="", MDNode *FPMathTag=nullptr)
Definition: IRBuilder.h:2427
DEBUG_TYPE to vector
void setAlignment(Align Align)
Definition: Instructions.h:226
Type * getParamType(unsigned i) const
Parameter type accessors.
Definition: DerivedTypes.h:134
Value * CreateICmpEQ(Value *LHS, Value *RHS, const Twine &Name="")
Definition: IRBuilder.h:2263
A Module instance is used to store all the information related to an LLVM module.
Definition: Module.h:67
const char kDFSanExternShadowPtrMask[]
static CallInst * Create(FunctionType *Ty, Value *F, const Twine &NameStr="", Instruction *InsertBefore=nullptr)
Value * CreateLShr(Value *LHS, Value *RHS, const Twine &Name="", bool isExact=false)
Definition: IRBuilder.h:1375
A handy container for a FunctionType+Callee-pointer pair, which can be passed around as a single enti...
Definition: DerivedTypes.h:164
Implements a dense probed hash-table based set.
Definition: DenseSet.h:268
void push_back(const T &Elt)
Definition: SmallVector.h:379
static ConstantAggregateZero * get(Type *Ty)
Definition: Constants.cpp:1621
void recalculate(ParentType &Func)
recalculate - compute a dominator tree for the given function
This class represents a function call, abstracting a target machine's calling convention.
static FixedVectorType * get(Type *ElementType, unsigned NumElts)
Definition: Type.cpp:626
Value * CreateICmpNE(Value *LHS, Value *RHS, const Twine &Name="")
Definition: IRBuilder.h:2267
static PointerType * get(Type *ElementType, unsigned AddressSpace)
This constructs a pointer to an object of the specified type in a numbered address space.
Definition: Type.cpp:669
This instruction constructs a fixed permutation of two input vectors.
static SelectInst * Create(Value *C, Value *S1, Value *S2, const Twine &NameStr="", Instruction *InsertBefore=nullptr, Instruction *MDFrom=nullptr)
LLVMContext & getContext() const
All values hold a context through their type.
Definition: Value.cpp:868
bool isTerminator() const
Definition: Instruction.h:163
Value * CreateMul(Value *LHS, Value *RHS, const Twine &Name="", bool HasNUW=false, bool HasNSW=false)
Definition: IRBuilder.h:1299
This class wraps the llvm.memset intrinsic.
BasicBlock * getSuccessor(unsigned i) const
static cl::opt< bool > ClCombinePointerLabelsOnStore("dfsan-combine-pointer-labels-on-store", cl::desc("Combine the label of the pointer with the label of the data when " "storing in memory."), cl::Hidden, cl::init(false))
Metadata node.
Definition: Metadata.h:870
Base class for all callable instructions (InvokeInst and CallInst) Holds everything related to callin...
Definition: InstrTypes.h:1164
F(f)
Value * CreateIntToPtr(Value *V, Type *DestTy, const Twine &Name="")
Definition: IRBuilder.h:2144
User::op_iterator arg_end()
Return the iterator pointing to the end of the argument list.
Definition: InstrTypes.h:1294
An instruction for reading from memory.
Definition: Instructions.h:174
static IntegerType * getInt64Ty(LLVMContext &C)
Definition: Type.cpp:198
const Instruction * getTerminator() const LLVM_READONLY
Returns the terminator instruction if the block is well formed or null if the block is not well forme...
Definition: BasicBlock.cpp:148
ModulePass * createDataFlowSanitizerLegacyPassPass(const std::vector< std::string > &ABIListFiles=std::vector< std::string >())
void addAttribute(unsigned i, Attribute::AttrKind Kind)
adds the attribute to the list of attributes.
Definition: InstrTypes.h:1475
static PointerType * getInt64PtrTy(LLVMContext &C, unsigned AS=0)
Definition: Type.cpp:261
void eraseFromParent()
eraseFromParent - This method unlinks 'this' from the containing module and deletes it.
Definition: Globals.cpp:518
Value * CreateAnd(Value *LHS, Value *RHS, const Twine &Name="")
Definition: IRBuilder.h:1415
LoadInst * CreateAlignedLoad(Type *Ty, Value *Ptr, MaybeAlign Align, const char *Name)
Definition: IRBuilder.h:1740
block_iterator block_end()
static ReturnInst * Create(LLVMContext &C, Value *retVal=nullptr, Instruction *InsertBefore=nullptr)
Value * getArgOperand(unsigned i) const
Definition: InstrTypes.h:1323
static cl::opt< bool > ClArgsABI("dfsan-args-abi", cl::desc("Use the argument ABI rather than the TLS ABI"), cl::Hidden)
AllocaInst * CreateAlloca(Type *Ty, unsigned AddrSpace, Value *ArraySize=nullptr, const Twine &Name="")
Definition: IRBuilder.h:1684
The address of a basic block.
Definition: Constants.h:851
StoreInst * CreateStore(Value *Val, Value *Ptr, bool isVolatile=false)
Definition: IRBuilder.h:1730
Definition: BitVector.h:941
This class represents the LLVM 'select' instruction.
const DataLayout & getDataLayout() const
Get the data layout for the module's target platform.
Definition: Module.cpp:397
Instruction * SplitBlockAndInsertIfThen(Value *Cond, Instruction *SplitBefore, bool Unreachable, MDNode *BranchWeights, DominatorTree *DT, LoopInfo *LI=nullptr, BasicBlock *ThenBlock=nullptr)
Split the containing block at the specified instruction - everything before SplitBefore stays in the ...
IntegerType * getInt64Ty()
Fetch the type representing a 64-bit integer.
Definition: IRBuilder.h:523
This is the base class for all instructions that perform data casts.
Definition: InstrTypes.h:432
ArrayRef< T > makeArrayRef(const T &OneElt)
Construct an ArrayRef from a single element.
Definition: ArrayRef.h:458
Class to represent struct types.
Definition: DerivedTypes.h:212
uint64_t Addr
This file contains the simple types necessary to represent the attributes associated with functions a...
AttributeSet getRetAttributes() const
The attributes for the ret value are returned.
static cl::opt< bool > ClFast16Labels("dfsan-fast-16-labels", cl::desc("Use more efficient instrumentation, limiting the number of " "labels to 16."), cl::Hidden, cl::init(false))
void setModuleInlineAsm(StringRef Asm)
Set the module-scope inline assembly blocks.
Definition: Module.h:296
void setName(const Twine &Name)
Change the name of the value.
Definition: Value.cpp:367
block_iterator block_begin()
Key
PAL metadata keys.
Class to represent function types.
Definition: DerivedTypes.h:102
Type * getType() const
All values are typed, get the type of this value.
Definition: Value.h:246
LLVM_NODISCARD AttributeList removeAttributes(LLVMContext &C, unsigned Index, const AttrBuilder &AttrsToRemove) const
Remove the specified attributes at the specified index from this attribute list.
ArchType getArch() const
getArch - Get the parsed architecture type of this triple.
Definition: Triple.h:304
void setCalledFunction(Function *Fn)
Sets the function called, including updating the function type.
Definition: InstrTypes.h:1414
Value * getCalledOperand() const
Definition: InstrTypes.h:1371
PreservedAnalyses run(Module &M, ModuleAnalysisManager &AM)
Class to represent array types.
Definition: DerivedTypes.h:356
AttributeSet getParamAttributes(unsigned ArgNo) const
The attributes for the argument or parameter at the given index are returned.
void getUnderlyingObjects(const Value *V, SmallVectorImpl< const Value * > &Objects, LoopInfo *LI=nullptr, unsigned MaxLookup=6)
This method is similar to getUnderlyingObject except that it can look through phi and select instruct...
bool isVarArg() const
Definition: DerivedTypes.h:122
static FunctionType * get(Type *Result, ArrayRef< Type * > Params, bool isVarArg)
This static method is the primary way of constructing a FunctionType.
Definition: Type.cpp:321
Value * CreateInsertValue(Value *Agg, Value *Val, ArrayRef< unsigned > Idxs, const Twine &Name="")
Definition: IRBuilder.h:2541
BasicBlock * getBasicBlock() const
Definition: Constants.h:878
const GlobalObject * getBaseObject() const
Definition: Globals.cpp:467
An instruction for storing to memory.
Definition: Instructions.h:303
LinkageTypes getLinkage() const
Definition: GlobalValue.h:461
void replaceAllUsesWith(Value *V)
Change all uses of this to point to a new Value.
Definition: Value.cpp:523
uint64_t value() const
This is a hole in the type system and should not be abused.
Definition: Alignment.h:85
void takeName(Value *V)
Transfer the name from V to this value.
Definition: Value.cpp:373
iterator begin()
Definition: Function.h:747
Concrete subclass of DominatorTreeBase that is used to compute a normal dominator tree.
Definition: Dominators.h:151
Value * getOperand(unsigned i) const
Definition: User.h:169
Class to represent pointers.
Definition: DerivedTypes.h:655
static const Align kShadowTLSAlignment
static PreservedAnalyses none()
Convenience factory function for the empty preserved set.
Definition: PassManager.h:158
static const unsigned kRetvalTLSSize
bool isSized(SmallPtrSetImpl< Type * > *Visited=nullptr) const
Return true if it makes sense to take the size of this type.
Definition: Type.h:272
static Constant * getBitCast(Constant *C, Type *Ty, bool OnlyIfReduced=false)
Definition: Constants.cpp:2173
bool isVoidTy() const
Return true if this is 'void'.
Definition: Type.h:139
Constant * CreateGlobalStringPtr(StringRef Str, const Twine &Name="", unsigned AddressSpace=0, Module *M=nullptr)
Same as CreateGlobalString, but return a pointer with "i8*" type instead of a pointer to array of i8.
Definition: IRBuilder.h:2039
Value * CreateInsertElement(Value *Vec, Value *NewElt, Value *Idx, const Twine &Name="")
Definition: IRBuilder.h:2487
an instruction for type-safe pointer arithmetic to access elements of arrays and structs
Definition: Instructions.h:905
Same, but only replaced by something equivalent.
Definition: GlobalValue.h:51
initializer< Ty > init(const Ty &Val)
Definition: CommandLine.h:427
This instruction inserts a single (scalar) element into a VectorType value.
static Function * Create(FunctionType *Ty, LinkageTypes Linkage, unsigned AddrSpace, const Twine &N="", Module *M=nullptr)
Definition: Function.h:137
A set of analyses that are preserved following a run of a transformation pass.
Definition: PassManager.h:155
Value * CreateExtractValue(Value *Agg, ArrayRef< unsigned > Idxs, const Twine &Name="")
Definition: IRBuilder.h:2533
unsigned arg_size() const
Definition: InstrTypes.h:1311
LLVM Basic Block Representation.
Definition: BasicBlock.h:58
Value * CreateConstGEP1_32(Value *Ptr, unsigned Idx0, const Twine &Name="")
Definition: IRBuilder.h:1910
The instances of the Type class are immutable: once they are created, they are never changed.
Definition: Type.h:46
This is an important class for using LLVM in a threaded context.
Definition: LLVMContext.h:68
Conditional or Unconditional Branch instruction.
static ExtractValueInst * Create(Value *Agg, ArrayRef< unsigned > Idxs, const Twine &NameStr="", Instruction *InsertBefore=nullptr)
static BlockAddress * get(Function *F, BasicBlock *BB)
Return a BlockAddress for the specified function and basic block.
Definition: Constants.cpp:1780
StoreInst * CreateAlignedStore(Value *Val, Value *Ptr, MaybeAlign Align, bool isVolatile=false)
Definition: IRBuilder.h:1821
void changeImmediateDominator(DomTreeNodeBase< NodeT > *N, DomTreeNodeBase< NodeT > *NewIDom)
changeImmediateDominator - This method is used to update the dominator tree information when a node's...
This function has undefined behavior.
static GCRegistry::Add< CoreCLRGC > E("coreclr", "CoreCLR-compatible GC")
This is an important base class in LLVM.
Definition: Constant.h:41
bool isInlineAsm() const
Check if this call is an inline asm statement.
Definition: InstrTypes.h:1444
Value * CreateBitCast(Value *V, Type *DestTy, const Twine &Name="")
Definition: IRBuilder.h:2149
Value * CreateTrunc(Value *V, Type *DestTy, const Twine &Name="")
Definition: IRBuilder.h:2053
void copyAttributesFrom(const Function *Src)
copyAttributesFrom - copy all additional attributes (those not needed to create a Function) from the ...
Definition: Function.cpp:621
This file contains the declarations for the subclasses of Constant, which represent the different fla...
static cl::opt< bool > ClEventCallbacks("dfsan-event-callbacks", cl::desc("Insert calls to __dfsan_*_callback functions on data events."), cl::Hidden, cl::init(false))
const Instruction & front() const
Definition: BasicBlock.h:308
FunctionType * getFunctionType() const
Definition: InstrTypes.h:1226
unsigned getNumParams() const
Return the number of fixed parameters this function type requires.
Definition: DerivedTypes.h:138
std::pair< iterator, bool > insert(PtrType Ptr)
Inserts Ptr if and only if there is no element in the container equal to Ptr.
Definition: SmallPtrSet.h:364
static Type * getVoidTy(LLVMContext &C)
Definition: Type.cpp:180
void splice(iterator where, iplist_impl &L2)
Definition: ilist.h:329
static cl::opt< bool > ClDebugNonzeroLabels("dfsan-debug-nonzero-labels", cl::desc("Insert calls to __dfsan_nonzero_label on observing a parameter, " "load or return with a nonzero label"), cl::Hidden)
bool dominates(const Value *Def, const Use &U) const
Return true if value Def dominates use U, in the sense that Def is available at U,...
Definition: Dominators.cpp:260
constexpr double e
Definition: MathExtras.h:58
void setCallingConv(CallingConv::ID CC)
Definition: InstrTypes.h:1439
Value * getPointerOperand()
Definition: Instructions.h:266
Value * CreateAdd(Value *LHS, Value *RHS, const Twine &Name="", bool HasNUW=false, bool HasNSW=false)
Definition: IRBuilder.h:1265
static BasicBlock * Create(LLVMContext &Context, const Twine &Name="", Function *Parent=nullptr, BasicBlock *InsertBefore=nullptr)
Creates a new BasicBlock.
Definition: BasicBlock.h:100
arg_iterator arg_begin()
Definition: Function.h:762
size_type count(ConstPtrType Ptr) const
count - Return 1 if the specified pointer is in the set, 0 otherwise.
Definition: SmallPtrSet.h:375
self_iterator getIterator()
Definition: ilist_node.h:81
static std::unique_ptr< SpecialCaseList > createOrDie(const std::vector< std::string > &Paths, llvm::vfs::FileSystem &FS)
Parses the special case list entries from files.
Class to represent integer types.
Definition: DerivedTypes.h:40
BasicBlock * splitBasicBlock(iterator I, const Twine &BBName="", bool Before=false)
Split the basic block into two basic blocks at the specified instruction.
Definition: BasicBlock.cpp:375
uint64_t Align
LoadInst * CreateLoad(Type *Ty, Value *Ptr, const char *Name)
Provided to resolve 'CreateLoad(Ty, Ptr, "...")' correctly, instead of converting the string to 'bool...
Definition: IRBuilder.h:1701
static UndefValue * get(Type *T)
Static factory methods - Return an 'undef' object of the specified type.
Definition: Constants.cpp:1742
static PreservedAnalyses all()
Construct a special preserved set that preserves all passes.
Definition: PassManager.h:161
DomTreeNodeBase< NodeT > * getNode(const NodeT *BB) const
getNode - return the (Post)DominatorTree node for the specified basic block.
static PointerType * getInt8PtrTy(LLVMContext &C, unsigned AS=0)
Definition: Type.cpp:249
MDNode * createBranchWeights(uint32_t TrueWeight, uint32_t FalseWeight)
Return metadata containing two branch weights.
Definition: MDBuilder.cpp:37
Tail - This calling convention attemps to make calls as fast as possible while guaranteeing that tail...
Definition: CallingConv.h:81
#define llvm_unreachable(msg)
Marks that the current location is not supposed to be reachable.
This struct is a compact representation of a valid (non-zero power of two) alignment.
Definition: Alignment.h:39
Triple - Helper class for working with autoconf configuration names.
Definition: Triple.h:45
void setSuccessor(unsigned idx, BasicBlock *NewSucc)
static void DFS(BasicBlock *Root, SetVector< BasicBlock * > &Set)
static IntegerType * get(LLVMContext &C, unsigned NumBits)
This static method is the primary way of constructing an IntegerType.
Definition: Type.cpp:269
void addParamAttr(unsigned ArgNo, Attribute::AttrKind Kind)
Adds the attribute to the indicated argument.
Definition: InstrTypes.h:1489
uint64_t Offset
Iterator for intrusive lists based on ilist_node.
unsigned getNumOperands() const
Definition: User.h:191
SmallPtrSet - This class implements a set which is optimized for holding SmallSize or less elements.
Definition: SmallPtrSet.h:442
static PointerType * getUnqual(Type *ElementType)
This constructs a pointer to an object of the specified type in the generic address space (address sp...
Definition: DerivedTypes.h:670
This is the shared class of boolean and integer constants.
Definition: Constants.h:77
static StructType * get(LLVMContext &Context, ArrayRef< Type * > Elements, bool isPacked=false)
This static method is the primary way to create a literal StructType.
Definition: Type.cpp:366
iterator end()
Definition: BasicBlock.h:298
This is a 'vector' (really, a variable-sized array), optimized for the case when the array is small.
Definition: SmallVector.h:1116
Module.h This file contains the declarations for the Module class.
const DataFlowGraph & G
Definition: RDFGraph.cpp:202
Type * getReturnType() const
Definition: DerivedTypes.h:123
static Constant * get(Type *Ty, uint64_t V, bool isSigned=false)
If Ty is a vector type, return a Constant with a splat of the given value.
Definition: Constants.cpp:867
static ConstantInt * getSigned(IntegerType *Ty, int64_t V)
Return a ConstantInt with the specified value for the specified type.
Definition: Constants.cpp:881
static BranchInst * Create(BasicBlock *IfTrue, Instruction *InsertBefore=nullptr)
static PHINode * Create(Type *Ty, unsigned NumReservedValues, const Twine &NameStr="", Instruction *InsertBefore=nullptr)
Constructors - NumReservedValues is a hint for the number of incoming edges that this phi node will h...
unsigned getNumIncomingValues() const
Return the number of incoming edges.
AttributeList getAttributes() const
Return the parameter attributes for this call.
Definition: InstrTypes.h:1454
void setOperand(unsigned i, Value *Val)
Definition: User.h:174
The access may modify the value stored in memory.
void swap(llvm::BitVector &LHS, llvm::BitVector &RHS)
Implement std::swap in terms of BitVector swap.
Definition: BitVector.h:944
static cl::opt< bool > ClPreserveAlignment("dfsan-preserve-alignment", cl::desc("respect alignment requirements provided by input IR"), cl::Hidden, cl::init(false))
const Module * getModule() const
Return the module owning the function this instruction belongs to or nullptr it the function does not...
Definition: Instruction.cpp:65
unsigned getNumAttrSets() const
LinkageTypes
An enumeration for the kinds of linkage for global values.
Definition: GlobalValue.h:47
void append(in_iter in_start, in_iter in_end)
Add the specified range to the end of the SmallVector.
Definition: SmallVector.h:608
User::op_iterator arg_begin()
Return the iterator pointing to the beginning of the argument list.
Definition: InstrTypes.h:1288
Defines the virtual file system interface vfs::FileSystem.
void removeAttributes(unsigned i, const AttrBuilder &Attrs)
removes the attributes from the list of attributes.
Definition: Function.cpp:532
This class wraps the llvm.memcpy/memmove intrinsics.
uint64_t alignTo(uint64_t Size, Align A)
Returns a multiple of A needed to store Size bytes.
Definition: Alignment.h:158
static IntegerType * getInt32Ty(LLVMContext &C)
Definition: Type.cpp:197
static cl::opt< bool > ClCombinePointerLabelsOnLoad("dfsan-combine-pointer-labels-on-load", cl::desc("Combine the label of the pointer with the label of the data when " "loading from memory."), cl::Hidden, cl::init(true))
Value * CreateGEP(Value *Ptr, ArrayRef< Value * > IdxList, const Twine &Name="")
Definition: IRBuilder.h:1852
CallingConv::ID getCallingConv() const
Definition: InstrTypes.h:1435
Value * CreateOr(Value *LHS, Value *RHS, const Twine &Name="")
Definition: IRBuilder.h:1441
StringRef getName() const
Return a constant reference to the value's name.
Definition: Value.cpp:295
Function * getCalledFunction() const
Returns the function called, or null if this is an indirect function invocation.
Definition: InstrTypes.h:1378
static cl::opt< bool > ClTrackSelectControlFlow("dfsan-track-select-control-flow", cl::desc("Propagate labels from condition values of select instructions " "to results."), cl::Hidden, cl::init(true))
#define I(x, y, z)
Definition: MD5.cpp:59
#define N
DomTreeNodeBase< NodeT > * addNewBlock(NodeT *BB, NodeT *DomBB)
Add a new node to the dominator tree information.
user_iterator_impl< User > user_iterator
Definition: Value.h:393
ModulePass class - This class is used to implement unstructured interprocedural optimizations and ana...
Definition: Pass.h:238
static ArrayType * get(Type *ElementType, uint64_t NumElements)
This static method is the primary way to construct an ArrayType.
Definition: Type.cpp:581
void setAttributes(AttributeList A)
Set the parameter attributes for this call.
Definition: InstrTypes.h:1458
Type * getValueType() const
Definition: GlobalValue.h:273
This instruction extracts a single (scalar) element from a VectorType value.
const BasicBlockListType & getBasicBlockList() const
Get the underlying elements of the Function...
Definition: Function.h:724
Value * getReturnValue() const
Convenience accessor. Returns null if there is no return value.
bool removeUnreachableBlocks(Function &F, DomTreeUpdater *DTU=nullptr, MemorySSAUpdater *MSSAU=nullptr)
Remove all blocks that can not be reached from the function's entry.
Definition: Local.cpp:2355
size_type count(const_arg_type_t< KeyT > Val) const
Return 1 if the specified key is in the map, 0 otherwise.
Definition: DenseMap.h:145
Align getAlign() const
Return the alignment of the access that is being performed.
Definition: Instructions.h:222
static StringRef GetGlobalTypeString(const GlobalValue &G)
const std::string & getModuleInlineAsm() const
Get any module-scope inline assembly blocks.
Definition: Module.h:257
Value * CreateShl(Value *LHS, Value *RHS, const Twine &Name="", bool HasNUW=false, bool HasNSW=false)
Definition: IRBuilder.h:1354
iterator_range< df_iterator< T > > depth_first(const T &G)
Value * CreatePtrToInt(Value *V, Type *DestTy, const Twine &Name="")
Definition: IRBuilder.h:2139
Root & operator=(Root &&)=delete
assert(ImpDefSCC.getReg()==AMDGPU::SCC &&ImpDefSCC.isDef())
Value * CreateConstGEP2_32(Type *Ty, Value *Ptr, unsigned Idx0, unsigned Idx1, const Twine &Name="")
Definition: IRBuilder.h:1934
BasicBlock * SplitEdge(BasicBlock *From, BasicBlock *To, DominatorTree *DT=nullptr, LoopInfo *LI=nullptr, MemorySSAUpdater *MSSAU=nullptr, const Twine &BBName="")
Split the edge connecting the specified blocks, and return the newly created basic block between From...
aarch64 promote const
Module * getParent()
Get the module that this global value is contained inside of...
Definition: GlobalValue.h:572
LLVM Value Representation.
Definition: Value.h:75
AttrBuilder typeIncompatible(Type *Ty)
Which attributes cannot be applied to a type.
AttributeSet getFnAttributes() const
The function attributes are returned.
Value * CreatePointerCast(Value *V, Type *DestTy, const Twine &Name="")
Definition: IRBuilder.h:2195
Invoke instruction.
OutputIt move(R &&Range, OutputIt Out)
Provide wrappers to std::move which take ranges instead of having to pass begin/end explicitly.
Definition: STLExtras.h:1556
StringRef - Represent a constant reference to a string, i.e.
Definition: StringRef.h:57
INITIALIZE_PASS(DataFlowSanitizerLegacyPass, "dfsan", "DataFlowSanitizer: dynamic data flow analysis.", false, false) ModulePass *llvm
A container for analyses that lazily runs them and caches their results.
Value * CreateStructGEP(Type *Ty, Value *Ptr, unsigned Idx, const Twine &Name="")
Definition: IRBuilder.h:2025
This header defines various interfaces for pass management in LLVM.
constexpr char Args[]
Key for Kernel::Metadata::mArgs.
PointerType * getType() const
Global values are always pointers.
Definition: GlobalValue.h:271
static AttributeList get(LLVMContext &C, ArrayRef< std::pair< unsigned, Attribute >> Attrs)
Create an AttributeList with the specified parameters in it.
const BasicBlock * getParent() const
Definition: Instruction.h:94
an instruction to allocate memory on the stack
Definition: Instructions.h:61
This instruction inserts a struct field of array element value into an aggregate value.
MachineBasicBlock MachineBasicBlock::iterator DebugLoc DL