1 /* Pointer Bounds Checker insrumentation pass.
2 Copyright (C) 2014-2015 Free Software Foundation, Inc.
3 Contributed by Ilya Enkovich (ilya.enkovich@intel.com)
5 This file is part of GCC.
7 GCC is free software; you can redistribute it and/or modify it under
8 the terms of the GNU General Public License as published by the Free
9 Software Foundation; either version 3, or (at your option) any later
12 GCC is distributed in the hope that it will be useful, but WITHOUT ANY
13 WARRANTY; without even the implied warranty of MERCHANTABILITY or
14 FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
17 You should have received a copy of the GNU General Public License
18 along with GCC; see the file COPYING3. If not see
19 <http://www.gnu.org/licenses/>. */
23 #include "coretypes.h"
27 #include "double-int.h"
35 #include "fold-const.h"
36 #include "stor-layout.h"
39 #include "tree-iterator.h"
41 #include "langhooks.h"
42 #include "tree-pass.h"
43 #include "diagnostic.h"
47 #include "stringpool.h"
48 #include "tree-ssa-alias.h"
49 #include "tree-ssanames.h"
50 #include "tree-ssa-operands.h"
51 #include "tree-ssa-address.h"
54 #include "dominance.h"
56 #include "basic-block.h"
57 #include "tree-ssa-loop-niter.h"
58 #include "gimple-expr.h"
60 #include "tree-phinodes.h"
61 #include "gimple-ssa.h"
62 #include "ssa-iterators.h"
63 #include "gimple-pretty-print.h"
64 #include "gimple-iterator.h"
66 #include "gimplify-me.h"
67 #include "print-tree.h"
70 #include "hard-reg-set.h"
74 #include "statistics.h"
76 #include "fixed-value.h"
77 #include "insn-config.h"
85 #include "tree-ssa-propagate.h"
86 #include "gimple-fold.h"
87 #include "tree-chkp.h"
88 #include "gimple-walk.h"
89 #include "rtl.h" /* For MEM_P, assign_temp. */
92 #include "lto-streamer.h"
97 /* Pointer Bounds Checker instruments code with memory checks to find
98 out-of-bounds memory accesses. Checks are performed by computing
99 bounds for each pointer and then comparing address of accessed
100 memory before pointer dereferencing.
108 There are few things to instrument:
110 a) Memory accesses - add checker calls to check address of accessed memory
111 against bounds of dereferenced pointer. Obviously safe memory
112 accesses like static variable access does not have to be instrumented
119 with 4 bytes access is transformed into:
121 __builtin___chkp_bndcl (__bound_tmp.1_3, p_1);
123 __builtin___chkp_bndcu (__bound_tmp.1_3, D.1_4);
126 where __bound_tmp.1_3 are bounds computed for pointer p_1,
127 __builtin___chkp_bndcl is a lower bound check and
128 __builtin___chkp_bndcu is an upper bound check.
132 When pointer is stored in memory we need to store its bounds. To
133 achieve compatibility of instrumented code with regular codes
134 we have to keep data layout and store bounds in special bound tables
135 via special checker call. Implementation of bounds table may vary for
136 different platforms. It has to associate pointer value and its
137 location (it is required because we may have two equal pointers
138 with different bounds stored in different places) with bounds.
139 Another checker builtin allows to get bounds for specified pointer
140 loaded from specified location.
150 __builtin___chkp_bndstx (D.1_2, &buf2, __bound_tmp.1_2);
152 where __bound_tmp.1_2 are bounds of &buf2.
154 c) Static initialization.
156 The special case of pointer store is static pointer initialization.
157 Bounds initialization is performed in a few steps:
158 - register all static initializations in front-end using
159 chkp_register_var_initializer
160 - when file compilation finishes we create functions with special
161 attribute 'chkp ctor' and put explicit initialization code
162 (assignments) for all statically initialized pointers.
163 - when checker constructor is compiled checker pass adds required
164 bounds initialization for all statically initialized pointers
165 - since we do not actually need excess pointers initialization
166 in checker constructor we remove such assignments from them
170 For each call in the code we add additional arguments to pass
171 bounds for pointer arguments. We determine type of call arguments
172 using arguments list from function declaration; if function
173 declaration is not available we use function type; otherwise
174 (e.g. for unnamed arguments) we use type of passed value. Function
175 declaration/type is replaced with the instrumented one.
179 val_1 = foo (&buf1, &buf2, &buf1, 0);
183 val_1 = foo.chkp (&buf1, __bound_tmp.1_2, &buf2, __bound_tmp.1_3,
184 &buf1, __bound_tmp.1_2, 0);
188 If function returns a pointer value we have to return bounds also.
189 A new operand was added for return statement to hold returned bounds.
197 return &_buf1, __bound_tmp.1_1;
199 3. Bounds computation.
201 Compiler is fully responsible for computing bounds to be used for each
202 memory access. The first step for bounds computation is to find the
203 origin of pointer dereferenced for memory access. Basing on pointer
204 origin we define a way to compute its bounds. There are just few
207 a) Pointer is returned by call.
209 In this case we use corresponding checker builtin method to obtain returned
214 buf_1 = malloc (size_2);
219 buf_1 = malloc (size_2);
220 __bound_tmp.1_3 = __builtin___chkp_bndret (buf_1);
221 foo (buf_1, __bound_tmp.1_3);
223 b) Pointer is an address of an object.
225 In this case compiler tries to compute objects size and create corresponding
226 bounds. If object has incomplete type then special checker builtin is used to
227 obtain its size at runtime.
233 <unnamed type> __bound_tmp.3;
237 __bound_tmp.3_2 = __builtin___chkp_bndmk (&buf, 400);
240 return &buf, __bound_tmp.3_2;
245 Address of an object 'extern int buf[]' with incomplete type is
250 <unnamed type> __bound_tmp.4;
251 long unsigned int __size_tmp.3;
254 __size_tmp.3_4 = __builtin_ia32_sizeof (buf);
255 __bound_tmp.4_3 = __builtin_ia32_bndmk (&buf, __size_tmp.3_4);
258 return &buf, __bound_tmp.4_3;
261 c) Pointer is the result of object narrowing.
263 It happens when we use pointer to an object to compute pointer to a part
264 of an object. E.g. we take pointer to a field of a structure. In this
265 case we perform bounds intersection using bounds of original object and
266 bounds of object's part (which are computed basing on its type).
268 There may be some debatable questions about when narrowing should occur
269 and when it should not. To avoid false bound violations in correct
270 programs we do not perform narrowing when address of an array element is
271 obtained (it has address of the whole array) and when address of the first
272 structure field is obtained (because it is guaranteed to be equal to
273 address of the whole structure and it is legal to cast it back to structure).
275 Default narrowing behavior may be changed using compiler flags.
279 In this example address of the second structure field is returned.
281 foo (struct A * p, __bounds_type __bounds_of_p)
283 <unnamed type> __bound_tmp.3;
288 _5 = &p_1(D)->second_field;
289 __bound_tmp.3_6 = __builtin___chkp_bndmk (_5, 4);
290 __bound_tmp.3_8 = __builtin___chkp_intersect (__bound_tmp.3_6,
292 _2 = &p_1(D)->second_field;
293 return _2, __bound_tmp.3_8;
298 In this example address of the first field of array element is returned.
300 foo (struct A * p, __bounds_type __bounds_of_p, int i)
302 long unsigned int _3;
303 long unsigned int _4;
308 _3 = (long unsigned int) i_1(D);
311 _7 = &_6->first_field;
312 return _7, __bounds_of_p_2(D);
316 d) Pointer is the result of pointer arithmetic or type cast.
318 In this case bounds of the base pointer are used. In case of binary
319 operation producing a pointer we are analyzing data flow further
320 looking for operand's bounds. One operand is considered as a base
321 if it has some valid bounds. If we fall into a case when none of
322 operands (or both of them) has valid bounds, a default bounds value
325 Trying to find out bounds for binary operations we may fall into
326 cyclic dependencies for pointers. To avoid infinite recursion all
327 walked phi nodes instantly obtain corresponding bounds but created
328 bounds are marked as incomplete. It helps us to stop DF walk during
331 When we reach pointer source, some args of incomplete bounds phi obtain
332 valid bounds and those values are propagated further through phi nodes.
333 If no valid bounds were found for phi node then we mark its result as
334 invalid bounds. Process stops when all incomplete bounds become either
335 valid or invalid and we are able to choose a pointer base.
337 e) Pointer is loaded from the memory.
339 In this case we just need to load bounds from the bounds table.
345 <unnamed type> __bound_tmp.3;
351 __bound_tmp.3_4 = __builtin___chkp_bndldx (&buf, _2);
352 return _2, __bound_tmp.3_4;
357 typedef void (*assign_handler
)(tree
, tree
, void *);
359 static tree
chkp_get_zero_bounds ();
360 static tree
chkp_find_bounds (tree ptr
, gimple_stmt_iterator
*iter
);
361 static tree
chkp_find_bounds_loaded (tree ptr
, tree ptr_src
,
362 gimple_stmt_iterator
*iter
);
363 static void chkp_parse_array_and_component_ref (tree node
, tree
*ptr
,
364 tree
*elt
, bool *safe
,
367 gimple_stmt_iterator
*iter
,
368 bool innermost_bounds
);
370 #define chkp_bndldx_fndecl \
371 (targetm.builtin_chkp_function (BUILT_IN_CHKP_BNDLDX))
372 #define chkp_bndstx_fndecl \
373 (targetm.builtin_chkp_function (BUILT_IN_CHKP_BNDSTX))
374 #define chkp_checkl_fndecl \
375 (targetm.builtin_chkp_function (BUILT_IN_CHKP_BNDCL))
376 #define chkp_checku_fndecl \
377 (targetm.builtin_chkp_function (BUILT_IN_CHKP_BNDCU))
378 #define chkp_bndmk_fndecl \
379 (targetm.builtin_chkp_function (BUILT_IN_CHKP_BNDMK))
380 #define chkp_ret_bnd_fndecl \
381 (targetm.builtin_chkp_function (BUILT_IN_CHKP_BNDRET))
382 #define chkp_intersect_fndecl \
383 (targetm.builtin_chkp_function (BUILT_IN_CHKP_INTERSECT))
384 #define chkp_narrow_bounds_fndecl \
385 (targetm.builtin_chkp_function (BUILT_IN_CHKP_NARROW))
386 #define chkp_sizeof_fndecl \
387 (targetm.builtin_chkp_function (BUILT_IN_CHKP_SIZEOF))
388 #define chkp_extract_lower_fndecl \
389 (targetm.builtin_chkp_function (BUILT_IN_CHKP_EXTRACT_LOWER))
390 #define chkp_extract_upper_fndecl \
391 (targetm.builtin_chkp_function (BUILT_IN_CHKP_EXTRACT_UPPER))
393 static GTY (()) tree chkp_uintptr_type
;
395 static GTY (()) tree chkp_zero_bounds_var
;
396 static GTY (()) tree chkp_none_bounds_var
;
398 static GTY (()) basic_block entry_block
;
399 static GTY (()) tree zero_bounds
;
400 static GTY (()) tree none_bounds
;
401 static GTY (()) tree incomplete_bounds
;
402 static GTY (()) tree tmp_var
;
403 static GTY (()) tree size_tmp_var
;
404 static GTY (()) bitmap chkp_abnormal_copies
;
406 struct hash_set
<tree
> *chkp_invalid_bounds
;
407 struct hash_set
<tree
> *chkp_completed_bounds_set
;
408 struct hash_map
<tree
, tree
> *chkp_reg_bounds
;
409 struct hash_map
<tree
, tree
> *chkp_bound_vars
;
410 struct hash_map
<tree
, tree
> *chkp_reg_addr_bounds
;
411 struct hash_map
<tree
, tree
> *chkp_incomplete_bounds_map
;
412 struct hash_map
<tree
, tree
> *chkp_bounds_map
;
413 struct hash_map
<tree
, tree
> *chkp_static_var_bounds
;
415 static bool in_chkp_pass
;
417 #define CHKP_BOUND_TMP_NAME "__bound_tmp"
418 #define CHKP_SIZE_TMP_NAME "__size_tmp"
419 #define CHKP_BOUNDS_OF_SYMBOL_PREFIX "__chkp_bounds_of_"
420 #define CHKP_STRING_BOUNDS_PREFIX "__chkp_string_bounds_"
421 #define CHKP_VAR_BOUNDS_PREFIX "__chkp_var_bounds_"
422 #define CHKP_ZERO_BOUNDS_VAR_NAME "__chkp_zero_bounds"
423 #define CHKP_NONE_BOUNDS_VAR_NAME "__chkp_none_bounds"
425 /* Static checker constructors may become very large and their
426 compilation with optimization may take too much time.
427 Therefore we put a limit to number of statements in one
428 constructor. Tests with 100 000 statically initialized
429 pointers showed following compilation times on Sandy Bridge
431 limit 100 => ~18 sec.
432 limit 300 => ~22 sec.
433 limit 1000 => ~30 sec.
434 limit 3000 => ~49 sec.
435 limit 5000 => ~55 sec.
436 limit 10000 => ~76 sec.
437 limit 100000 => ~532 sec. */
438 #define MAX_STMTS_IN_STATIC_CHKP_CTOR (PARAM_VALUE (PARAM_CHKP_MAX_CTOR_SIZE))
440 struct chkp_ctor_stmt_list
446 /* Return 1 if function FNDECL is instrumented by Pointer
449 chkp_function_instrumented_p (tree fndecl
)
452 && lookup_attribute ("chkp instrumented", DECL_ATTRIBUTES (fndecl
));
455 /* Mark function FNDECL as instrumented. */
457 chkp_function_mark_instrumented (tree fndecl
)
459 if (chkp_function_instrumented_p (fndecl
))
462 DECL_ATTRIBUTES (fndecl
)
463 = tree_cons (get_identifier ("chkp instrumented"), NULL
,
464 DECL_ATTRIBUTES (fndecl
));
467 /* Return true when STMT is builtin call to instrumentation function
468 corresponding to CODE. */
471 chkp_gimple_call_builtin_p (gimple call
,
472 enum built_in_function code
)
475 if (is_gimple_call (call
)
476 && (fndecl
= targetm
.builtin_chkp_function (code
))
477 && gimple_call_fndecl (call
) == fndecl
)
482 /* Emit code to store zero bounds for PTR located at MEM. */
484 chkp_expand_bounds_reset_for_mem (tree mem
, tree ptr
)
486 tree zero_bnd
, bnd
, addr
, bndstx
;
488 if (flag_chkp_use_static_const_bounds
)
489 zero_bnd
= chkp_get_zero_bounds_var ();
491 zero_bnd
= chkp_build_make_bounds_call (integer_zero_node
,
493 bnd
= make_tree (pointer_bounds_type_node
,
494 assign_temp (pointer_bounds_type_node
, 0, 1));
495 addr
= build1 (ADDR_EXPR
,
496 build_pointer_type (TREE_TYPE (mem
)), mem
);
497 bndstx
= chkp_build_bndstx_call (addr
, ptr
, bnd
);
499 expand_assignment (bnd
, zero_bnd
, false);
500 expand_normal (bndstx
);
503 /* Build retbnd call for returned value RETVAL.
505 If BNDVAL is not NULL then result is stored
506 in it. Otherwise a temporary is created to
509 GSI points to a position for a retbnd call
510 and is set to created stmt.
512 Cgraph edge is created for a new call if
515 Obtained bounds are returned. */
517 chkp_insert_retbnd_call (tree bndval
, tree retval
,
518 gimple_stmt_iterator
*gsi
)
523 bndval
= create_tmp_reg (pointer_bounds_type_node
, "retbnd");
525 call
= gimple_build_call (chkp_ret_bnd_fndecl
, 1, retval
);
526 gimple_call_set_lhs (call
, bndval
);
527 gsi_insert_after (gsi
, call
, GSI_CONTINUE_LINKING
);
532 /* Mark statement S to not be instrumented. */
534 chkp_mark_stmt (gimple s
)
536 gimple_set_plf (s
, GF_PLF_1
, true);
539 /* Mark statement S to be instrumented. */
541 chkp_unmark_stmt (gimple s
)
543 gimple_set_plf (s
, GF_PLF_1
, false);
546 /* Return 1 if statement S should not be instrumented. */
548 chkp_marked_stmt_p (gimple s
)
550 return gimple_plf (s
, GF_PLF_1
);
553 /* Get var to be used for bound temps. */
555 chkp_get_tmp_var (void)
558 tmp_var
= create_tmp_reg (pointer_bounds_type_node
, CHKP_BOUND_TMP_NAME
);
563 /* Get SSA_NAME to be used as temp. */
565 chkp_get_tmp_reg (gimple stmt
)
568 return make_ssa_name (chkp_get_tmp_var (), stmt
);
570 return make_temp_ssa_name (pointer_bounds_type_node
, stmt
,
571 CHKP_BOUND_TMP_NAME
);
574 /* Get var to be used for size temps. */
576 chkp_get_size_tmp_var (void)
579 size_tmp_var
= create_tmp_reg (chkp_uintptr_type
, CHKP_SIZE_TMP_NAME
);
584 /* Register bounds BND for address of OBJ. */
586 chkp_register_addr_bounds (tree obj
, tree bnd
)
588 if (bnd
== incomplete_bounds
)
591 chkp_reg_addr_bounds
->put (obj
, bnd
);
593 if (dump_file
&& (dump_flags
& TDF_DETAILS
))
595 fprintf (dump_file
, "Regsitered bound ");
596 print_generic_expr (dump_file
, bnd
, 0);
597 fprintf (dump_file
, " for address of ");
598 print_generic_expr (dump_file
, obj
, 0);
599 fprintf (dump_file
, "\n");
603 /* Return bounds registered for address of OBJ. */
605 chkp_get_registered_addr_bounds (tree obj
)
607 tree
*slot
= chkp_reg_addr_bounds
->get (obj
);
608 return slot
? *slot
: NULL_TREE
;
611 /* Mark BOUNDS as completed. */
613 chkp_mark_completed_bounds (tree bounds
)
615 chkp_completed_bounds_set
->add (bounds
);
617 if (dump_file
&& (dump_flags
& TDF_DETAILS
))
619 fprintf (dump_file
, "Marked bounds ");
620 print_generic_expr (dump_file
, bounds
, 0);
621 fprintf (dump_file
, " as completed\n");
625 /* Return 1 if BOUNDS were marked as completed and 0 otherwise. */
627 chkp_completed_bounds (tree bounds
)
629 return chkp_completed_bounds_set
->contains (bounds
);
632 /* Clear comleted bound marks. */
634 chkp_erase_completed_bounds (void)
636 delete chkp_completed_bounds_set
;
637 chkp_completed_bounds_set
= new hash_set
<tree
>;
640 /* Mark BOUNDS associated with PTR as incomplete. */
642 chkp_register_incomplete_bounds (tree bounds
, tree ptr
)
644 chkp_incomplete_bounds_map
->put (bounds
, ptr
);
646 if (dump_file
&& (dump_flags
& TDF_DETAILS
))
648 fprintf (dump_file
, "Regsitered incomplete bounds ");
649 print_generic_expr (dump_file
, bounds
, 0);
650 fprintf (dump_file
, " for ");
651 print_generic_expr (dump_file
, ptr
, 0);
652 fprintf (dump_file
, "\n");
656 /* Return 1 if BOUNDS are incomplete and 0 otherwise. */
658 chkp_incomplete_bounds (tree bounds
)
660 if (bounds
== incomplete_bounds
)
663 if (chkp_completed_bounds (bounds
))
666 return chkp_incomplete_bounds_map
->get (bounds
) != NULL
;
669 /* Clear incomleted bound marks. */
671 chkp_erase_incomplete_bounds (void)
673 delete chkp_incomplete_bounds_map
;
674 chkp_incomplete_bounds_map
= new hash_map
<tree
, tree
>;
677 /* Build and return bndmk call which creates bounds for structure
678 pointed by PTR. Structure should have complete type. */
680 chkp_make_bounds_for_struct_addr (tree ptr
)
682 tree type
= TREE_TYPE (ptr
);
685 gcc_assert (POINTER_TYPE_P (type
));
687 size
= TYPE_SIZE (TREE_TYPE (type
));
691 return build_call_nary (pointer_bounds_type_node
,
692 build_fold_addr_expr (chkp_bndmk_fndecl
),
696 /* Traversal function for chkp_may_finish_incomplete_bounds.
697 Set RES to 0 if at least one argument of phi statement
698 defining bounds (passed in KEY arg) is unknown.
699 Traversal stops when first unknown phi argument is found. */
701 chkp_may_complete_phi_bounds (tree
const &bounds
, tree
*slot ATTRIBUTE_UNUSED
,
707 gcc_assert (TREE_CODE (bounds
) == SSA_NAME
);
709 phi
= SSA_NAME_DEF_STMT (bounds
);
711 gcc_assert (phi
&& gimple_code (phi
) == GIMPLE_PHI
);
713 for (i
= 0; i
< gimple_phi_num_args (phi
); i
++)
715 tree phi_arg
= gimple_phi_arg_def (phi
, i
);
719 /* Do not need to traverse further. */
727 /* Return 1 if all phi nodes created for bounds have their
728 arguments computed. */
730 chkp_may_finish_incomplete_bounds (void)
734 chkp_incomplete_bounds_map
735 ->traverse
<bool *, chkp_may_complete_phi_bounds
> (&res
);
740 /* Helper function for chkp_finish_incomplete_bounds.
741 Recompute args for bounds phi node. */
743 chkp_recompute_phi_bounds (tree
const &bounds
, tree
*slot
,
744 void *res ATTRIBUTE_UNUSED
)
751 gcc_assert (TREE_CODE (bounds
) == SSA_NAME
);
752 gcc_assert (TREE_CODE (ptr
) == SSA_NAME
);
754 bounds_phi
= as_a
<gphi
*> (SSA_NAME_DEF_STMT (bounds
));
755 ptr_phi
= as_a
<gphi
*> (SSA_NAME_DEF_STMT (ptr
));
757 for (i
= 0; i
< gimple_phi_num_args (bounds_phi
); i
++)
759 tree ptr_arg
= gimple_phi_arg_def (ptr_phi
, i
);
760 tree bound_arg
= chkp_find_bounds (ptr_arg
, NULL
);
762 add_phi_arg (bounds_phi
, bound_arg
,
763 gimple_phi_arg_edge (ptr_phi
, i
),
770 /* Mark BOUNDS as invalid. */
772 chkp_mark_invalid_bounds (tree bounds
)
774 chkp_invalid_bounds
->add (bounds
);
776 if (dump_file
&& (dump_flags
& TDF_DETAILS
))
778 fprintf (dump_file
, "Marked bounds ");
779 print_generic_expr (dump_file
, bounds
, 0);
780 fprintf (dump_file
, " as invalid\n");
784 /* Return 1 if BOUNDS were marked as invalid and 0 otherwise. */
786 chkp_valid_bounds (tree bounds
)
788 if (bounds
== zero_bounds
|| bounds
== none_bounds
)
791 return !chkp_invalid_bounds
->contains (bounds
);
794 /* Helper function for chkp_finish_incomplete_bounds.
795 Check all arguments of phi nodes trying to find
796 valid completed bounds. If there is at least one
797 such arg then bounds produced by phi node are marked
798 as valid completed bounds and all phi args are
801 chkp_find_valid_phi_bounds (tree
const &bounds
, tree
*slot
, bool *res
)
806 gcc_assert (TREE_CODE (bounds
) == SSA_NAME
);
808 if (chkp_completed_bounds (bounds
))
811 phi
= SSA_NAME_DEF_STMT (bounds
);
813 gcc_assert (phi
&& gimple_code (phi
) == GIMPLE_PHI
);
815 for (i
= 0; i
< gimple_phi_num_args (phi
); i
++)
817 tree phi_arg
= gimple_phi_arg_def (phi
, i
);
819 gcc_assert (phi_arg
);
821 if (chkp_valid_bounds (phi_arg
) && !chkp_incomplete_bounds (phi_arg
))
824 chkp_mark_completed_bounds (bounds
);
825 chkp_recompute_phi_bounds (bounds
, slot
, NULL
);
833 /* Helper function for chkp_finish_incomplete_bounds.
834 Marks all incompleted bounds as invalid. */
836 chkp_mark_invalid_bounds_walker (tree
const &bounds
,
837 tree
*slot ATTRIBUTE_UNUSED
,
838 void *res ATTRIBUTE_UNUSED
)
840 if (!chkp_completed_bounds (bounds
))
842 chkp_mark_invalid_bounds (bounds
);
843 chkp_mark_completed_bounds (bounds
);
848 /* When all bound phi nodes have all their args computed
849 we have enough info to find valid bounds. We iterate
850 through all incompleted bounds searching for valid
851 bounds. Found valid bounds are marked as completed
852 and all remaining incompleted bounds are recomputed.
853 Process continues until no new valid bounds may be
854 found. All remained incompleted bounds are marked as
855 invalid (i.e. have no valid source of bounds). */
857 chkp_finish_incomplete_bounds (void)
865 chkp_incomplete_bounds_map
->
866 traverse
<bool *, chkp_find_valid_phi_bounds
> (&found_valid
);
869 chkp_incomplete_bounds_map
->
870 traverse
<void *, chkp_recompute_phi_bounds
> (NULL
);
873 chkp_incomplete_bounds_map
->
874 traverse
<void *, chkp_mark_invalid_bounds_walker
> (NULL
);
875 chkp_incomplete_bounds_map
->
876 traverse
<void *, chkp_recompute_phi_bounds
> (NULL
);
878 chkp_erase_completed_bounds ();
879 chkp_erase_incomplete_bounds ();
882 /* Return 1 if type TYPE is a pointer type or a
883 structure having a pointer type as one of its fields.
884 Otherwise return 0. */
886 chkp_type_has_pointer (const_tree type
)
890 if (BOUNDED_TYPE_P (type
))
892 else if (RECORD_OR_UNION_TYPE_P (type
))
896 for (field
= TYPE_FIELDS (type
); field
; field
= DECL_CHAIN (field
))
897 if (TREE_CODE (field
) == FIELD_DECL
)
898 res
= res
|| chkp_type_has_pointer (TREE_TYPE (field
));
900 else if (TREE_CODE (type
) == ARRAY_TYPE
)
901 res
= chkp_type_has_pointer (TREE_TYPE (type
));
907 chkp_type_bounds_count (const_tree type
)
913 else if (BOUNDED_TYPE_P (type
))
915 else if (RECORD_OR_UNION_TYPE_P (type
))
919 bitmap_obstack_initialize (NULL
);
920 have_bound
= BITMAP_ALLOC (NULL
);
921 chkp_find_bound_slots (type
, have_bound
);
922 res
= bitmap_count_bits (have_bound
);
923 BITMAP_FREE (have_bound
);
924 bitmap_obstack_release (NULL
);
930 /* Get bounds associated with NODE via
931 chkp_set_bounds call. */
933 chkp_get_bounds (tree node
)
937 if (!chkp_bounds_map
)
940 slot
= chkp_bounds_map
->get (node
);
941 return slot
? *slot
: NULL_TREE
;
944 /* Associate bounds VAL with NODE. */
946 chkp_set_bounds (tree node
, tree val
)
948 if (!chkp_bounds_map
)
949 chkp_bounds_map
= new hash_map
<tree
, tree
>;
951 chkp_bounds_map
->put (node
, val
);
954 /* Check if statically initialized variable VAR require
955 static bounds initialization. If VAR is added into
956 bounds initlization list then 1 is returned. Otherwise
959 chkp_register_var_initializer (tree var
)
961 if (!flag_check_pointer_bounds
962 || DECL_INITIAL (var
) == error_mark_node
)
965 gcc_assert (TREE_CODE (var
) == VAR_DECL
);
966 gcc_assert (DECL_INITIAL (var
));
968 if (TREE_STATIC (var
)
969 && chkp_type_has_pointer (TREE_TYPE (var
)))
971 varpool_node::get_create (var
)->need_bounds_init
= 1;
978 /* Helper function for chkp_finish_file.
980 Add new modification statement (RHS is assigned to LHS)
981 into list of static initializer statementes (passed in ARG).
982 If statements list becomes too big, emit checker constructor
983 and start the new one. */
985 chkp_add_modification_to_stmt_list (tree lhs
,
989 struct chkp_ctor_stmt_list
*stmts
= (struct chkp_ctor_stmt_list
*)arg
;
992 if (!useless_type_conversion_p (TREE_TYPE (lhs
), TREE_TYPE (rhs
)))
993 rhs
= build1 (CONVERT_EXPR
, TREE_TYPE (lhs
), rhs
);
995 modify
= build2 (MODIFY_EXPR
, TREE_TYPE (lhs
), lhs
, rhs
);
996 append_to_statement_list (modify
, &stmts
->stmts
);
1001 /* Build and return ADDR_EXPR for specified object OBJ. */
1003 chkp_build_addr_expr (tree obj
)
1005 return TREE_CODE (obj
) == TARGET_MEM_REF
1006 ? tree_mem_ref_addr (ptr_type_node
, obj
)
1007 : build_fold_addr_expr (obj
);
1010 /* Helper function for chkp_finish_file.
1011 Initialize bound variable BND_VAR with bounds of variable
1012 VAR to statements list STMTS. If statements list becomes
1013 too big, emit checker constructor and start the new one. */
1015 chkp_output_static_bounds (tree bnd_var
, tree var
,
1016 struct chkp_ctor_stmt_list
*stmts
)
1020 if (TREE_CODE (var
) == STRING_CST
)
1022 lb
= build1 (CONVERT_EXPR
, size_type_node
, chkp_build_addr_expr (var
));
1023 size
= build_int_cst (size_type_node
, TREE_STRING_LENGTH (var
) - 1);
1025 else if (DECL_SIZE (var
)
1026 && !chkp_variable_size_type (TREE_TYPE (var
)))
1028 /* Compute bounds using statically known size. */
1029 lb
= build1 (CONVERT_EXPR
, size_type_node
, chkp_build_addr_expr (var
));
1030 size
= size_binop (MINUS_EXPR
, DECL_SIZE_UNIT (var
), size_one_node
);
1034 /* Compute bounds using dynamic size. */
1037 lb
= build1 (CONVERT_EXPR
, size_type_node
, chkp_build_addr_expr (var
));
1038 call
= build1 (ADDR_EXPR
,
1039 build_pointer_type (TREE_TYPE (chkp_sizeof_fndecl
)),
1040 chkp_sizeof_fndecl
);
1041 size
= build_call_nary (TREE_TYPE (TREE_TYPE (chkp_sizeof_fndecl
)),
1044 if (flag_chkp_zero_dynamic_size_as_infinite
)
1046 tree max_size
, cond
;
1048 max_size
= build2 (MINUS_EXPR
, size_type_node
, size_zero_node
, lb
);
1049 cond
= build2 (NE_EXPR
, boolean_type_node
, size
, size_zero_node
);
1050 size
= build3 (COND_EXPR
, size_type_node
, cond
, size
, max_size
);
1053 size
= size_binop (MINUS_EXPR
, size
, size_one_node
);
1056 ub
= size_binop (PLUS_EXPR
, lb
, size
);
1057 stmts
->avail
-= targetm
.chkp_initialize_bounds (bnd_var
, lb
, ub
,
1059 if (stmts
->avail
<= 0)
1061 cgraph_build_static_cdtor ('B', stmts
->stmts
,
1062 MAX_RESERVED_INIT_PRIORITY
+ 2);
1063 stmts
->avail
= MAX_STMTS_IN_STATIC_CHKP_CTOR
;
1064 stmts
->stmts
= NULL
;
1068 /* Return entry block to be used for checker initilization code.
1069 Create new block if required. */
1071 chkp_get_entry_block (void)
1075 = split_block_after_labels (ENTRY_BLOCK_PTR_FOR_FN (cfun
))->dest
;
1080 /* Return a bounds var to be used for pointer var PTR_VAR. */
1082 chkp_get_bounds_var (tree ptr_var
)
1087 slot
= chkp_bound_vars
->get (ptr_var
);
1092 bnd_var
= create_tmp_reg (pointer_bounds_type_node
,
1093 CHKP_BOUND_TMP_NAME
);
1094 chkp_bound_vars
->put (ptr_var
, bnd_var
);
1102 /* Register bounds BND for object PTR in global bounds table.
1103 A copy of bounds may be created for abnormal ssa names.
1104 Returns bounds to use for PTR. */
1106 chkp_maybe_copy_and_register_bounds (tree ptr
, tree bnd
)
1110 if (!chkp_reg_bounds
)
1113 /* Do nothing if bounds are incomplete_bounds
1114 because it means bounds will be recomputed. */
1115 if (bnd
== incomplete_bounds
)
1118 abnormal_ptr
= (TREE_CODE (ptr
) == SSA_NAME
1119 && SSA_NAME_OCCURS_IN_ABNORMAL_PHI (ptr
)
1120 && gimple_code (SSA_NAME_DEF_STMT (ptr
)) != GIMPLE_PHI
);
1122 /* A single bounds value may be reused multiple times for
1123 different pointer values. It may cause coalescing issues
1124 for abnormal SSA names. To avoid it we create a bounds
1125 copy in case it is computed for abnormal SSA name.
1127 We also cannot reuse such created copies for other pointers */
1129 || bitmap_bit_p (chkp_abnormal_copies
, SSA_NAME_VERSION (bnd
)))
1131 tree bnd_var
= NULL_TREE
;
1135 if (SSA_NAME_VAR (ptr
))
1136 bnd_var
= chkp_get_bounds_var (SSA_NAME_VAR (ptr
));
1139 bnd_var
= chkp_get_tmp_var ();
1141 /* For abnormal copies we may just find original
1142 bounds and use them. */
1143 if (!abnormal_ptr
&& !SSA_NAME_IS_DEFAULT_DEF (bnd
))
1145 gimple bnd_def
= SSA_NAME_DEF_STMT (bnd
);
1146 gcc_checking_assert (gimple_code (bnd_def
) == GIMPLE_ASSIGN
);
1147 bnd
= gimple_assign_rhs1 (bnd_def
);
1149 /* For undefined values we usually use none bounds
1150 value but in case of abnormal edge it may cause
1151 coalescing failures. Use default definition of
1152 bounds variable instead to avoid it. */
1153 else if (SSA_NAME_IS_DEFAULT_DEF (ptr
)
1154 && TREE_CODE (SSA_NAME_VAR (ptr
)) != PARM_DECL
)
1156 bnd
= get_or_create_ssa_default_def (cfun
, bnd_var
);
1158 if (dump_file
&& (dump_flags
& TDF_DETAILS
))
1160 fprintf (dump_file
, "Using default def bounds ");
1161 print_generic_expr (dump_file
, bnd
, 0);
1162 fprintf (dump_file
, " for abnormal default def SSA name ");
1163 print_generic_expr (dump_file
, ptr
, 0);
1164 fprintf (dump_file
, "\n");
1170 gimple def
= SSA_NAME_DEF_STMT (ptr
);
1172 gimple_stmt_iterator gsi
;
1175 copy
= make_ssa_name (bnd_var
, gimple_build_nop ());
1177 copy
= make_temp_ssa_name (pointer_bounds_type_node
,
1178 gimple_build_nop (),
1179 CHKP_BOUND_TMP_NAME
);
1180 assign
= gimple_build_assign (copy
, bnd
);
1182 if (dump_file
&& (dump_flags
& TDF_DETAILS
))
1184 fprintf (dump_file
, "Creating a copy of bounds ");
1185 print_generic_expr (dump_file
, bnd
, 0);
1186 fprintf (dump_file
, " for abnormal SSA name ");
1187 print_generic_expr (dump_file
, ptr
, 0);
1188 fprintf (dump_file
, "\n");
1191 if (gimple_code (def
) == GIMPLE_NOP
)
1193 gsi
= gsi_last_bb (chkp_get_entry_block ());
1194 if (!gsi_end_p (gsi
) && is_ctrl_stmt (gsi_stmt (gsi
)))
1195 gsi_insert_before (&gsi
, assign
, GSI_CONTINUE_LINKING
);
1197 gsi_insert_after (&gsi
, assign
, GSI_CONTINUE_LINKING
);
1201 gimple bnd_def
= SSA_NAME_DEF_STMT (bnd
);
1202 /* Sometimes (e.g. when we load a pointer from a
1203 memory) bounds are produced later than a pointer.
1204 We need to insert bounds copy appropriately. */
1205 if (gimple_code (bnd_def
) != GIMPLE_NOP
1206 && stmt_dominates_stmt_p (def
, bnd_def
))
1207 gsi
= gsi_for_stmt (bnd_def
);
1209 gsi
= gsi_for_stmt (def
);
1210 gsi_insert_after (&gsi
, assign
, GSI_CONTINUE_LINKING
);
1217 bitmap_set_bit (chkp_abnormal_copies
, SSA_NAME_VERSION (bnd
));
1220 chkp_reg_bounds
->put (ptr
, bnd
);
1222 if (dump_file
&& (dump_flags
& TDF_DETAILS
))
1224 fprintf (dump_file
, "Regsitered bound ");
1225 print_generic_expr (dump_file
, bnd
, 0);
1226 fprintf (dump_file
, " for pointer ");
1227 print_generic_expr (dump_file
, ptr
, 0);
1228 fprintf (dump_file
, "\n");
1234 /* Get bounds registered for object PTR in global bounds table. */
1236 chkp_get_registered_bounds (tree ptr
)
1240 if (!chkp_reg_bounds
)
1243 slot
= chkp_reg_bounds
->get (ptr
);
1244 return slot
? *slot
: NULL_TREE
;
1247 /* Add bound retvals to return statement pointed by GSI. */
1250 chkp_add_bounds_to_ret_stmt (gimple_stmt_iterator
*gsi
)
1252 greturn
*ret
= as_a
<greturn
*> (gsi_stmt (*gsi
));
1253 tree retval
= gimple_return_retval (ret
);
1254 tree ret_decl
= DECL_RESULT (cfun
->decl
);
1260 if (BOUNDED_P (ret_decl
))
1262 bounds
= chkp_find_bounds (retval
, gsi
);
1263 bounds
= chkp_maybe_copy_and_register_bounds (ret_decl
, bounds
);
1264 gimple_return_set_retbnd (ret
, bounds
);
1270 /* Force OP to be suitable for using as an argument for call.
1271 New statements (if any) go to SEQ. */
1273 chkp_force_gimple_call_op (tree op
, gimple_seq
*seq
)
1276 gimple_stmt_iterator si
;
1278 op
= force_gimple_operand (unshare_expr (op
), &stmts
, true, NULL_TREE
);
1280 for (si
= gsi_start (stmts
); !gsi_end_p (si
); gsi_next (&si
))
1281 chkp_mark_stmt (gsi_stmt (si
));
1283 gimple_seq_add_seq (seq
, stmts
);
1288 /* Generate lower bound check for memory access by ADDR.
1289 Check is inserted before the position pointed by ITER.
1290 DIRFLAG indicates whether memory access is load or store. */
1292 chkp_check_lower (tree addr
, tree bounds
,
1293 gimple_stmt_iterator iter
,
1294 location_t location
,
1301 if (!chkp_function_instrumented_p (current_function_decl
)
1302 && bounds
== chkp_get_zero_bounds ())
1305 if (dirflag
== integer_zero_node
1306 && !flag_chkp_check_read
)
1309 if (dirflag
== integer_one_node
1310 && !flag_chkp_check_write
)
1315 node
= chkp_force_gimple_call_op (addr
, &seq
);
1317 check
= gimple_build_call (chkp_checkl_fndecl
, 2, node
, bounds
);
1318 chkp_mark_stmt (check
);
1319 gimple_call_set_with_bounds (check
, true);
1320 gimple_set_location (check
, location
);
1321 gimple_seq_add_stmt (&seq
, check
);
1323 gsi_insert_seq_before (&iter
, seq
, GSI_SAME_STMT
);
1325 if (dump_file
&& (dump_flags
& TDF_DETAILS
))
1327 gimple before
= gsi_stmt (iter
);
1328 fprintf (dump_file
, "Generated lower bound check for statement ");
1329 print_gimple_stmt (dump_file
, before
, 0, TDF_VOPS
|TDF_MEMSYMS
);
1330 fprintf (dump_file
, " ");
1331 print_gimple_stmt (dump_file
, check
, 0, TDF_VOPS
|TDF_MEMSYMS
);
1335 /* Generate upper bound check for memory access by ADDR.
1336 Check is inserted before the position pointed by ITER.
1337 DIRFLAG indicates whether memory access is load or store. */
1339 chkp_check_upper (tree addr
, tree bounds
,
1340 gimple_stmt_iterator iter
,
1341 location_t location
,
1348 if (!chkp_function_instrumented_p (current_function_decl
)
1349 && bounds
== chkp_get_zero_bounds ())
1352 if (dirflag
== integer_zero_node
1353 && !flag_chkp_check_read
)
1356 if (dirflag
== integer_one_node
1357 && !flag_chkp_check_write
)
1362 node
= chkp_force_gimple_call_op (addr
, &seq
);
1364 check
= gimple_build_call (chkp_checku_fndecl
, 2, node
, bounds
);
1365 chkp_mark_stmt (check
);
1366 gimple_call_set_with_bounds (check
, true);
1367 gimple_set_location (check
, location
);
1368 gimple_seq_add_stmt (&seq
, check
);
1370 gsi_insert_seq_before (&iter
, seq
, GSI_SAME_STMT
);
1372 if (dump_file
&& (dump_flags
& TDF_DETAILS
))
1374 gimple before
= gsi_stmt (iter
);
1375 fprintf (dump_file
, "Generated upper bound check for statement ");
1376 print_gimple_stmt (dump_file
, before
, 0, TDF_VOPS
|TDF_MEMSYMS
);
1377 fprintf (dump_file
, " ");
1378 print_gimple_stmt (dump_file
, check
, 0, TDF_VOPS
|TDF_MEMSYMS
);
1382 /* Generate lower and upper bound checks for memory access
1383 to memory slot [FIRST, LAST] againsr BOUNDS. Checks
1384 are inserted before the position pointed by ITER.
1385 DIRFLAG indicates whether memory access is load or store. */
1387 chkp_check_mem_access (tree first
, tree last
, tree bounds
,
1388 gimple_stmt_iterator iter
,
1389 location_t location
,
1392 chkp_check_lower (first
, bounds
, iter
, location
, dirflag
);
1393 chkp_check_upper (last
, bounds
, iter
, location
, dirflag
);
1396 /* Replace call to _bnd_chk_* pointed by GSI with
1397 bndcu and bndcl calls. DIRFLAG determines whether
1398 check is for read or write. */
1401 chkp_replace_address_check_builtin (gimple_stmt_iterator
*gsi
,
1404 gimple_stmt_iterator call_iter
= *gsi
;
1405 gimple call
= gsi_stmt (*gsi
);
1406 tree fndecl
= gimple_call_fndecl (call
);
1407 tree addr
= gimple_call_arg (call
, 0);
1408 tree bounds
= chkp_find_bounds (addr
, gsi
);
1410 if (DECL_FUNCTION_CODE (fndecl
) == BUILT_IN_CHKP_CHECK_PTR_LBOUNDS
1411 || DECL_FUNCTION_CODE (fndecl
) == BUILT_IN_CHKP_CHECK_PTR_BOUNDS
)
1412 chkp_check_lower (addr
, bounds
, *gsi
, gimple_location (call
), dirflag
);
1414 if (DECL_FUNCTION_CODE (fndecl
) == BUILT_IN_CHKP_CHECK_PTR_UBOUNDS
)
1415 chkp_check_upper (addr
, bounds
, *gsi
, gimple_location (call
), dirflag
);
1417 if (DECL_FUNCTION_CODE (fndecl
) == BUILT_IN_CHKP_CHECK_PTR_BOUNDS
)
1419 tree size
= gimple_call_arg (call
, 1);
1420 addr
= fold_build_pointer_plus (addr
, size
);
1421 addr
= fold_build_pointer_plus_hwi (addr
, -1);
1422 chkp_check_upper (addr
, bounds
, *gsi
, gimple_location (call
), dirflag
);
1425 gsi_remove (&call_iter
, true);
1428 /* Replace call to _bnd_get_ptr_* pointed by GSI with
1429 corresponding bounds extract call. */
1432 chkp_replace_extract_builtin (gimple_stmt_iterator
*gsi
)
1434 gimple call
= gsi_stmt (*gsi
);
1435 tree fndecl
= gimple_call_fndecl (call
);
1436 tree addr
= gimple_call_arg (call
, 0);
1437 tree bounds
= chkp_find_bounds (addr
, gsi
);
1440 if (DECL_FUNCTION_CODE (fndecl
) == BUILT_IN_CHKP_GET_PTR_LBOUND
)
1441 fndecl
= chkp_extract_lower_fndecl
;
1442 else if (DECL_FUNCTION_CODE (fndecl
) == BUILT_IN_CHKP_GET_PTR_UBOUND
)
1443 fndecl
= chkp_extract_upper_fndecl
;
1447 extract
= gimple_build_call (fndecl
, 1, bounds
);
1448 gimple_call_set_lhs (extract
, gimple_call_lhs (call
));
1449 chkp_mark_stmt (extract
);
1451 gsi_replace (gsi
, extract
, false);
1454 /* Return COMPONENT_REF accessing FIELD in OBJ. */
1456 chkp_build_component_ref (tree obj
, tree field
)
1460 /* If object is TMR then we do not use component_ref but
1461 add offset instead. We need it to be able to get addr
1462 of the reasult later. */
1463 if (TREE_CODE (obj
) == TARGET_MEM_REF
)
1465 tree offs
= TMR_OFFSET (obj
);
1466 offs
= fold_binary_to_constant (PLUS_EXPR
, TREE_TYPE (offs
),
1467 offs
, DECL_FIELD_OFFSET (field
));
1471 res
= copy_node (obj
);
1472 TREE_TYPE (res
) = TREE_TYPE (field
);
1473 TMR_OFFSET (res
) = offs
;
1476 res
= build3 (COMPONENT_REF
, TREE_TYPE (field
), obj
, field
, NULL_TREE
);
1481 /* Return ARRAY_REF for array ARR and index IDX with
1482 specified element type ETYPE and element size ESIZE. */
1484 chkp_build_array_ref (tree arr
, tree etype
, tree esize
,
1485 unsigned HOST_WIDE_INT idx
)
1487 tree index
= build_int_cst (size_type_node
, idx
);
1490 /* If object is TMR then we do not use array_ref but
1491 add offset instead. We need it to be able to get addr
1492 of the reasult later. */
1493 if (TREE_CODE (arr
) == TARGET_MEM_REF
)
1495 tree offs
= TMR_OFFSET (arr
);
1497 esize
= fold_binary_to_constant (MULT_EXPR
, TREE_TYPE (esize
),
1501 offs
= fold_binary_to_constant (PLUS_EXPR
, TREE_TYPE (offs
),
1505 res
= copy_node (arr
);
1506 TREE_TYPE (res
) = etype
;
1507 TMR_OFFSET (res
) = offs
;
1510 res
= build4 (ARRAY_REF
, etype
, arr
, index
, NULL_TREE
, NULL_TREE
);
1515 /* Helper function for chkp_add_bounds_to_call_stmt.
1516 Fill ALL_BOUNDS output array with created bounds.
1518 OFFS is used for recursive calls and holds basic
1519 offset of TYPE in outer structure in bits.
1521 ITER points a position where bounds are searched.
1523 ALL_BOUNDS[i] is filled with elem bounds if there
1524 is a field in TYPE which has pointer type and offset
1525 equal to i * POINTER_SIZE in bits. */
1527 chkp_find_bounds_for_elem (tree elem
, tree
*all_bounds
,
1529 gimple_stmt_iterator
*iter
)
1531 tree type
= TREE_TYPE (elem
);
1533 if (BOUNDED_TYPE_P (type
))
1535 if (!all_bounds
[offs
/ POINTER_SIZE
])
1537 tree temp
= make_temp_ssa_name (type
, gimple_build_nop (), "");
1538 gimple assign
= gimple_build_assign (temp
, elem
);
1539 gimple_stmt_iterator gsi
;
1541 gsi_insert_before (iter
, assign
, GSI_SAME_STMT
);
1542 gsi
= gsi_for_stmt (assign
);
1544 all_bounds
[offs
/ POINTER_SIZE
] = chkp_find_bounds (temp
, &gsi
);
1547 else if (RECORD_OR_UNION_TYPE_P (type
))
1551 for (field
= TYPE_FIELDS (type
); field
; field
= DECL_CHAIN (field
))
1552 if (TREE_CODE (field
) == FIELD_DECL
)
1554 tree base
= unshare_expr (elem
);
1555 tree field_ref
= chkp_build_component_ref (base
, field
);
1556 HOST_WIDE_INT field_offs
1557 = TREE_INT_CST_LOW (DECL_FIELD_BIT_OFFSET (field
));
1558 if (DECL_FIELD_OFFSET (field
))
1559 field_offs
+= TREE_INT_CST_LOW (DECL_FIELD_OFFSET (field
)) * 8;
1561 chkp_find_bounds_for_elem (field_ref
, all_bounds
,
1562 offs
+ field_offs
, iter
);
1565 else if (TREE_CODE (type
) == ARRAY_TYPE
)
1567 tree maxval
= TYPE_MAX_VALUE (TYPE_DOMAIN (type
));
1568 tree etype
= TREE_TYPE (type
);
1569 HOST_WIDE_INT esize
= TREE_INT_CST_LOW (TYPE_SIZE (etype
));
1570 unsigned HOST_WIDE_INT cur
;
1572 if (!maxval
|| integer_minus_onep (maxval
))
1575 for (cur
= 0; cur
<= TREE_INT_CST_LOW (maxval
); cur
++)
1577 tree base
= unshare_expr (elem
);
1578 tree arr_elem
= chkp_build_array_ref (base
, etype
,
1581 chkp_find_bounds_for_elem (arr_elem
, all_bounds
, offs
+ cur
* esize
,
1587 /* Fill HAVE_BOUND output bitmap with information about
1588 bounds requred for object of type TYPE.
1590 OFFS is used for recursive calls and holds basic
1591 offset of TYPE in outer structure in bits.
1593 HAVE_BOUND[i] is set to 1 if there is a field
1594 in TYPE which has pointer type and offset
1595 equal to i * POINTER_SIZE - OFFS in bits. */
1597 chkp_find_bound_slots_1 (const_tree type
, bitmap have_bound
,
1600 if (BOUNDED_TYPE_P (type
))
1601 bitmap_set_bit (have_bound
, offs
/ POINTER_SIZE
);
1602 else if (RECORD_OR_UNION_TYPE_P (type
))
1606 for (field
= TYPE_FIELDS (type
); field
; field
= DECL_CHAIN (field
))
1607 if (TREE_CODE (field
) == FIELD_DECL
)
1609 HOST_WIDE_INT field_offs
1610 = TREE_INT_CST_LOW (DECL_FIELD_BIT_OFFSET (field
));
1611 if (DECL_FIELD_OFFSET (field
))
1612 field_offs
+= TREE_INT_CST_LOW (DECL_FIELD_OFFSET (field
)) * 8;
1613 chkp_find_bound_slots_1 (TREE_TYPE (field
), have_bound
,
1617 else if (TREE_CODE (type
) == ARRAY_TYPE
)
1619 tree maxval
= TYPE_MAX_VALUE (TYPE_DOMAIN (type
));
1620 tree etype
= TREE_TYPE (type
);
1621 HOST_WIDE_INT esize
= TREE_INT_CST_LOW (TYPE_SIZE (etype
));
1622 unsigned HOST_WIDE_INT cur
;
1625 || TREE_CODE (maxval
) != INTEGER_CST
1626 || integer_minus_onep (maxval
))
1629 for (cur
= 0; cur
<= TREE_INT_CST_LOW (maxval
); cur
++)
1630 chkp_find_bound_slots_1 (etype
, have_bound
, offs
+ cur
* esize
);
1634 /* Fill bitmap RES with information about bounds for
1635 type TYPE. See chkp_find_bound_slots_1 for more
1638 chkp_find_bound_slots (const_tree type
, bitmap res
)
1641 chkp_find_bound_slots_1 (type
, res
, 0);
1644 /* Return 1 if call to FNDECL should be instrumented
1648 chkp_instrument_normal_builtin (tree fndecl
)
1650 switch (DECL_FUNCTION_CODE (fndecl
))
1652 case BUILT_IN_STRLEN
:
1653 case BUILT_IN_STRCPY
:
1654 case BUILT_IN_STRNCPY
:
1655 case BUILT_IN_STPCPY
:
1656 case BUILT_IN_STPNCPY
:
1657 case BUILT_IN_STRCAT
:
1658 case BUILT_IN_STRNCAT
:
1659 case BUILT_IN_MEMCPY
:
1660 case BUILT_IN_MEMPCPY
:
1661 case BUILT_IN_MEMSET
:
1662 case BUILT_IN_MEMMOVE
:
1663 case BUILT_IN_BZERO
:
1664 case BUILT_IN_STRCMP
:
1665 case BUILT_IN_STRNCMP
:
1667 case BUILT_IN_MEMCMP
:
1668 case BUILT_IN_MEMCPY_CHK
:
1669 case BUILT_IN_MEMPCPY_CHK
:
1670 case BUILT_IN_MEMMOVE_CHK
:
1671 case BUILT_IN_MEMSET_CHK
:
1672 case BUILT_IN_STRCPY_CHK
:
1673 case BUILT_IN_STRNCPY_CHK
:
1674 case BUILT_IN_STPCPY_CHK
:
1675 case BUILT_IN_STPNCPY_CHK
:
1676 case BUILT_IN_STRCAT_CHK
:
1677 case BUILT_IN_STRNCAT_CHK
:
1678 case BUILT_IN_MALLOC
:
1679 case BUILT_IN_CALLOC
:
1680 case BUILT_IN_REALLOC
:
1688 /* Add bound arguments to call statement pointed by GSI.
1689 Also performs a replacement of user checker builtins calls
1690 with internal ones. */
1693 chkp_add_bounds_to_call_stmt (gimple_stmt_iterator
*gsi
)
1695 gcall
*call
= as_a
<gcall
*> (gsi_stmt (*gsi
));
1696 unsigned arg_no
= 0;
1697 tree fndecl
= gimple_call_fndecl (call
);
1699 tree first_formal_arg
;
1701 bool use_fntype
= false;
1706 /* Do nothing for internal functions. */
1707 if (gimple_call_internal_p (call
))
1710 fntype
= TREE_TYPE (TREE_TYPE (gimple_call_fn (call
)));
1712 /* Do nothing if back-end builtin is called. */
1713 if (fndecl
&& DECL_BUILT_IN_CLASS (fndecl
) == BUILT_IN_MD
)
1716 /* Do nothing for some middle-end builtins. */
1717 if (fndecl
&& DECL_BUILT_IN_CLASS (fndecl
) == BUILT_IN_NORMAL
1718 && DECL_FUNCTION_CODE (fndecl
) == BUILT_IN_OBJECT_SIZE
)
1721 /* Do nothing for calls to not instrumentable functions. */
1722 if (fndecl
&& !chkp_instrumentable_p (fndecl
))
1725 /* Ignore CHKP_INIT_PTR_BOUNDS, CHKP_NULL_PTR_BOUNDS
1726 and CHKP_COPY_PTR_BOUNDS. */
1727 if (fndecl
&& DECL_BUILT_IN_CLASS (fndecl
) == BUILT_IN_NORMAL
1728 && (DECL_FUNCTION_CODE (fndecl
) == BUILT_IN_CHKP_INIT_PTR_BOUNDS
1729 || DECL_FUNCTION_CODE (fndecl
) == BUILT_IN_CHKP_NULL_PTR_BOUNDS
1730 || DECL_FUNCTION_CODE (fndecl
) == BUILT_IN_CHKP_COPY_PTR_BOUNDS
1731 || DECL_FUNCTION_CODE (fndecl
) == BUILT_IN_CHKP_SET_PTR_BOUNDS
))
1734 /* Check user builtins are replaced with checks. */
1735 if (fndecl
&& DECL_BUILT_IN_CLASS (fndecl
) == BUILT_IN_NORMAL
1736 && (DECL_FUNCTION_CODE (fndecl
) == BUILT_IN_CHKP_CHECK_PTR_LBOUNDS
1737 || DECL_FUNCTION_CODE (fndecl
) == BUILT_IN_CHKP_CHECK_PTR_UBOUNDS
1738 || DECL_FUNCTION_CODE (fndecl
) == BUILT_IN_CHKP_CHECK_PTR_BOUNDS
))
1740 chkp_replace_address_check_builtin (gsi
, integer_minus_one_node
);
1744 /* Check user builtins are replaced with bound extract. */
1745 if (fndecl
&& DECL_BUILT_IN_CLASS (fndecl
) == BUILT_IN_NORMAL
1746 && (DECL_FUNCTION_CODE (fndecl
) == BUILT_IN_CHKP_GET_PTR_LBOUND
1747 || DECL_FUNCTION_CODE (fndecl
) == BUILT_IN_CHKP_GET_PTR_UBOUND
))
1749 chkp_replace_extract_builtin (gsi
);
1753 /* BUILT_IN_CHKP_NARROW_PTR_BOUNDS call is replaced with
1754 target narrow bounds call. */
1755 if (fndecl
&& DECL_BUILT_IN_CLASS (fndecl
) == BUILT_IN_NORMAL
1756 && DECL_FUNCTION_CODE (fndecl
) == BUILT_IN_CHKP_NARROW_PTR_BOUNDS
)
1758 tree arg
= gimple_call_arg (call
, 1);
1759 tree bounds
= chkp_find_bounds (arg
, gsi
);
1761 gimple_call_set_fndecl (call
, chkp_narrow_bounds_fndecl
);
1762 gimple_call_set_arg (call
, 1, bounds
);
1768 /* BUILT_IN_CHKP_STORE_PTR_BOUNDS call is replaced with
1770 if (fndecl
&& DECL_BUILT_IN_CLASS (fndecl
) == BUILT_IN_NORMAL
1771 && DECL_FUNCTION_CODE (fndecl
) == BUILT_IN_CHKP_STORE_PTR_BOUNDS
)
1773 tree addr
= gimple_call_arg (call
, 0);
1774 tree ptr
= gimple_call_arg (call
, 1);
1775 tree bounds
= chkp_find_bounds (ptr
, gsi
);
1776 gimple_stmt_iterator iter
= gsi_for_stmt (call
);
1778 chkp_build_bndstx (addr
, ptr
, bounds
, gsi
);
1779 gsi_remove (&iter
, true);
1784 if (!flag_chkp_instrument_calls
)
1787 /* We instrument only some subset of builtins. We also instrument
1788 builtin calls to be inlined. */
1790 && DECL_BUILT_IN_CLASS (fndecl
) == BUILT_IN_NORMAL
1791 && !chkp_instrument_normal_builtin (fndecl
))
1793 if (!lookup_attribute ("always_inline", DECL_ATTRIBUTES (fndecl
)))
1796 struct cgraph_node
*clone
= chkp_maybe_create_clone (fndecl
);
1798 || !gimple_has_body_p (clone
->decl
))
1802 /* If function decl is available then use it for
1803 formal arguments list. Otherwise use function type. */
1804 if (fndecl
&& DECL_ARGUMENTS (fndecl
))
1805 first_formal_arg
= DECL_ARGUMENTS (fndecl
);
1808 first_formal_arg
= TYPE_ARG_TYPES (fntype
);
1812 /* Fill vector of new call args. */
1813 vec
<tree
> new_args
= vNULL
;
1814 new_args
.create (gimple_call_num_args (call
));
1815 arg
= first_formal_arg
;
1816 for (arg_no
= 0; arg_no
< gimple_call_num_args (call
); arg_no
++)
1818 tree call_arg
= gimple_call_arg (call
, arg_no
);
1821 /* Get arg type using formal argument description
1822 or actual argument type. */
1825 if (TREE_VALUE (arg
) != void_type_node
)
1827 type
= TREE_VALUE (arg
);
1828 arg
= TREE_CHAIN (arg
);
1831 type
= TREE_TYPE (call_arg
);
1834 type
= TREE_TYPE (arg
);
1835 arg
= TREE_CHAIN (arg
);
1838 type
= TREE_TYPE (call_arg
);
1840 new_args
.safe_push (call_arg
);
1842 if (BOUNDED_TYPE_P (type
)
1843 || pass_by_reference (NULL
, TYPE_MODE (type
), type
, true))
1844 new_args
.safe_push (chkp_find_bounds (call_arg
, gsi
));
1845 else if (chkp_type_has_pointer (type
))
1847 HOST_WIDE_INT max_bounds
1848 = TREE_INT_CST_LOW (TYPE_SIZE (type
)) / POINTER_SIZE
;
1849 tree
*all_bounds
= (tree
*)xmalloc (sizeof (tree
) * max_bounds
);
1850 HOST_WIDE_INT bnd_no
;
1852 memset (all_bounds
, 0, sizeof (tree
) * max_bounds
);
1854 chkp_find_bounds_for_elem (call_arg
, all_bounds
, 0, gsi
);
1856 for (bnd_no
= 0; bnd_no
< max_bounds
; bnd_no
++)
1857 if (all_bounds
[bnd_no
])
1858 new_args
.safe_push (all_bounds
[bnd_no
]);
1864 if (new_args
.length () == gimple_call_num_args (call
))
1868 new_call
= gimple_build_call_vec (gimple_op (call
, 1), new_args
);
1869 gimple_call_set_lhs (new_call
, gimple_call_lhs (call
));
1870 gimple_call_copy_flags (new_call
, call
);
1871 gimple_call_set_chain (new_call
, gimple_call_chain (call
));
1873 new_args
.release ();
1875 /* For direct calls fndecl is replaced with instrumented version. */
1878 tree new_decl
= chkp_maybe_create_clone (fndecl
)->decl
;
1879 gimple_call_set_fndecl (new_call
, new_decl
);
1880 gimple_call_set_fntype (new_call
, TREE_TYPE (new_decl
));
1882 /* For indirect call we should fix function pointer type if
1883 pass some bounds. */
1884 else if (new_call
!= call
)
1886 tree type
= gimple_call_fntype (call
);
1887 type
= chkp_copy_function_type_adding_bounds (type
);
1888 gimple_call_set_fntype (new_call
, type
);
1891 /* replace old call statement with the new one. */
1892 if (call
!= new_call
)
1894 FOR_EACH_SSA_TREE_OPERAND (op
, call
, iter
, SSA_OP_ALL_DEFS
)
1896 SSA_NAME_DEF_STMT (op
) = new_call
;
1898 gsi_replace (gsi
, new_call
, true);
1901 update_stmt (new_call
);
1903 gimple_call_set_with_bounds (new_call
, true);
1906 /* Return constant static bounds var with specified bounds LB and UB.
1907 If such var does not exists then new var is created with specified NAME. */
1909 chkp_make_static_const_bounds (HOST_WIDE_INT lb
,
1913 tree id
= get_identifier (name
);
1918 var
= build_decl (UNKNOWN_LOCATION
, VAR_DECL
, id
,
1919 pointer_bounds_type_node
);
1920 TREE_STATIC (var
) = 1;
1921 TREE_PUBLIC (var
) = 1;
1923 /* With LTO we may have constant bounds already in varpool.
1925 if ((snode
= symtab_node::get_for_asmname (DECL_ASSEMBLER_NAME (var
))))
1927 /* We don't allow this symbol usage for non bounds. */
1928 if (snode
->type
!= SYMTAB_VARIABLE
1929 || !POINTER_BOUNDS_P (snode
->decl
))
1930 sorry ("-fcheck-pointer-bounds requires '%s' "
1931 "name for internal usage",
1932 IDENTIFIER_POINTER (DECL_ASSEMBLER_NAME (var
)));
1937 TREE_USED (var
) = 1;
1938 TREE_READONLY (var
) = 1;
1939 TREE_ADDRESSABLE (var
) = 0;
1940 DECL_ARTIFICIAL (var
) = 1;
1941 DECL_READ_P (var
) = 1;
1942 DECL_INITIAL (var
) = targetm
.chkp_make_bounds_constant (lb
, ub
);
1943 make_decl_one_only (var
, DECL_ASSEMBLER_NAME (var
));
1944 /* We may use this symbol during ctors generation in chkp_finish_file
1945 when all symbols are emitted. Force output to avoid undefined
1946 symbols in ctors. */
1947 node
= varpool_node::get_create (var
);
1948 node
->force_output
= 1;
1950 varpool_node::finalize_decl (var
);
1955 /* Generate code to make bounds with specified lower bound LB and SIZE.
1956 if AFTER is 1 then code is inserted after position pointed by ITER
1957 otherwise code is inserted before position pointed by ITER.
1958 If ITER is NULL then code is added to entry block. */
1960 chkp_make_bounds (tree lb
, tree size
, gimple_stmt_iterator
*iter
, bool after
)
1963 gimple_stmt_iterator gsi
;
1970 gsi
= gsi_start_bb (chkp_get_entry_block ());
1974 lb
= chkp_force_gimple_call_op (lb
, &seq
);
1975 size
= chkp_force_gimple_call_op (size
, &seq
);
1977 stmt
= gimple_build_call (chkp_bndmk_fndecl
, 2, lb
, size
);
1978 chkp_mark_stmt (stmt
);
1980 bounds
= chkp_get_tmp_reg (stmt
);
1981 gimple_call_set_lhs (stmt
, bounds
);
1983 gimple_seq_add_stmt (&seq
, stmt
);
1986 gsi_insert_seq_after (&gsi
, seq
, GSI_SAME_STMT
);
1988 gsi_insert_seq_before (&gsi
, seq
, GSI_SAME_STMT
);
1990 if (dump_file
&& (dump_flags
& TDF_DETAILS
))
1992 fprintf (dump_file
, "Made bounds: ");
1993 print_gimple_stmt (dump_file
, stmt
, 0, TDF_VOPS
|TDF_MEMSYMS
);
1996 fprintf (dump_file
, " inserted before statement: ");
1997 print_gimple_stmt (dump_file
, gsi_stmt (*iter
), 0, TDF_VOPS
|TDF_MEMSYMS
);
2000 fprintf (dump_file
, " at function entry\n");
2003 /* update_stmt (stmt); */
2008 /* Return var holding zero bounds. */
2010 chkp_get_zero_bounds_var (void)
2012 if (!chkp_zero_bounds_var
)
2013 chkp_zero_bounds_var
2014 = chkp_make_static_const_bounds (0, -1,
2015 CHKP_ZERO_BOUNDS_VAR_NAME
);
2016 return chkp_zero_bounds_var
;
2019 /* Return var holding none bounds. */
2021 chkp_get_none_bounds_var (void)
2023 if (!chkp_none_bounds_var
)
2024 chkp_none_bounds_var
2025 = chkp_make_static_const_bounds (-1, 0,
2026 CHKP_NONE_BOUNDS_VAR_NAME
);
2027 return chkp_none_bounds_var
;
2030 /* Return SSA_NAME used to represent zero bounds. */
2032 chkp_get_zero_bounds (void)
2037 if (dump_file
&& (dump_flags
& TDF_DETAILS
))
2038 fprintf (dump_file
, "Creating zero bounds...");
2040 if ((flag_chkp_use_static_bounds
&& flag_chkp_use_static_const_bounds
)
2041 || flag_chkp_use_static_const_bounds
> 0)
2043 gimple_stmt_iterator gsi
= gsi_start_bb (chkp_get_entry_block ());
2046 zero_bounds
= chkp_get_tmp_reg (gimple_build_nop ());
2047 stmt
= gimple_build_assign (zero_bounds
, chkp_get_zero_bounds_var ());
2048 gsi_insert_before (&gsi
, stmt
, GSI_SAME_STMT
);
2051 zero_bounds
= chkp_make_bounds (integer_zero_node
,
2059 /* Return SSA_NAME used to represent none bounds. */
2061 chkp_get_none_bounds (void)
2066 if (dump_file
&& (dump_flags
& TDF_DETAILS
))
2067 fprintf (dump_file
, "Creating none bounds...");
2070 if ((flag_chkp_use_static_bounds
&& flag_chkp_use_static_const_bounds
)
2071 || flag_chkp_use_static_const_bounds
> 0)
2073 gimple_stmt_iterator gsi
= gsi_start_bb (chkp_get_entry_block ());
2076 none_bounds
= chkp_get_tmp_reg (gimple_build_nop ());
2077 stmt
= gimple_build_assign (none_bounds
, chkp_get_none_bounds_var ());
2078 gsi_insert_before (&gsi
, stmt
, GSI_SAME_STMT
);
2081 none_bounds
= chkp_make_bounds (integer_minus_one_node
,
2082 build_int_cst (size_type_node
, 2),
2089 /* Return bounds to be used as a result of operation which
2090 should not create poiunter (e.g. MULT_EXPR). */
2092 chkp_get_invalid_op_bounds (void)
2094 return chkp_get_zero_bounds ();
2097 /* Return bounds to be used for loads of non-pointer values. */
2099 chkp_get_nonpointer_load_bounds (void)
2101 return chkp_get_zero_bounds ();
2104 /* Return 1 if may use bndret call to get bounds for pointer
2105 returned by CALL. */
2107 chkp_call_returns_bounds_p (gcall
*call
)
2109 if (gimple_call_internal_p (call
))
2112 if (gimple_call_builtin_p (call
, BUILT_IN_CHKP_NARROW_PTR_BOUNDS
)
2113 || chkp_gimple_call_builtin_p (call
, BUILT_IN_CHKP_NARROW
))
2116 if (gimple_call_with_bounds_p (call
))
2119 tree fndecl
= gimple_call_fndecl (call
);
2121 if (fndecl
&& DECL_BUILT_IN_CLASS (fndecl
) == BUILT_IN_MD
)
2124 if (fndecl
&& !chkp_instrumentable_p (fndecl
))
2127 if (fndecl
&& DECL_BUILT_IN_CLASS (fndecl
) == BUILT_IN_NORMAL
)
2129 if (chkp_instrument_normal_builtin (fndecl
))
2132 if (!lookup_attribute ("always_inline", DECL_ATTRIBUTES (fndecl
)))
2135 struct cgraph_node
*clone
= chkp_maybe_create_clone (fndecl
);
2136 return (clone
&& gimple_has_body_p (clone
->decl
));
2142 /* Build bounds returned by CALL. */
2144 chkp_build_returned_bound (gcall
*call
)
2146 gimple_stmt_iterator gsi
;
2149 tree fndecl
= gimple_call_fndecl (call
);
2150 unsigned int retflags
;
2152 /* To avoid fixing alloca expands in targets we handle
2155 && DECL_BUILT_IN_CLASS (fndecl
) == BUILT_IN_NORMAL
2156 && (DECL_FUNCTION_CODE (fndecl
) == BUILT_IN_ALLOCA
2157 || DECL_FUNCTION_CODE (fndecl
) == BUILT_IN_ALLOCA_WITH_ALIGN
))
2159 tree size
= gimple_call_arg (call
, 0);
2160 tree lb
= gimple_call_lhs (call
);
2161 gimple_stmt_iterator iter
= gsi_for_stmt (call
);
2162 bounds
= chkp_make_bounds (lb
, size
, &iter
, true);
2164 /* We know bounds returned by set_bounds builtin call. */
2166 && DECL_BUILT_IN_CLASS (fndecl
) == BUILT_IN_NORMAL
2167 && DECL_FUNCTION_CODE (fndecl
) == BUILT_IN_CHKP_SET_PTR_BOUNDS
)
2169 tree lb
= gimple_call_arg (call
, 0);
2170 tree size
= gimple_call_arg (call
, 1);
2171 gimple_stmt_iterator iter
= gsi_for_stmt (call
);
2172 bounds
= chkp_make_bounds (lb
, size
, &iter
, true);
2174 /* Detect bounds initialization calls. */
2176 && DECL_BUILT_IN_CLASS (fndecl
) == BUILT_IN_NORMAL
2177 && DECL_FUNCTION_CODE (fndecl
) == BUILT_IN_CHKP_INIT_PTR_BOUNDS
)
2178 bounds
= chkp_get_zero_bounds ();
2179 /* Detect bounds nullification calls. */
2181 && DECL_BUILT_IN_CLASS (fndecl
) == BUILT_IN_NORMAL
2182 && DECL_FUNCTION_CODE (fndecl
) == BUILT_IN_CHKP_NULL_PTR_BOUNDS
)
2183 bounds
= chkp_get_none_bounds ();
2184 /* Detect bounds copy calls. */
2186 && DECL_BUILT_IN_CLASS (fndecl
) == BUILT_IN_NORMAL
2187 && DECL_FUNCTION_CODE (fndecl
) == BUILT_IN_CHKP_COPY_PTR_BOUNDS
)
2189 gimple_stmt_iterator iter
= gsi_for_stmt (call
);
2190 bounds
= chkp_find_bounds (gimple_call_arg (call
, 1), &iter
);
2192 /* Do not use retbnd when returned bounds are equal to some
2193 of passed bounds. */
2194 else if (((retflags
= gimple_call_return_flags (call
)) & ERF_RETURNS_ARG
)
2195 && (retflags
& ERF_RETURN_ARG_MASK
) < gimple_call_num_args (call
))
2197 gimple_stmt_iterator iter
= gsi_for_stmt (call
);
2198 unsigned int retarg
= retflags
& ERF_RETURN_ARG_MASK
, argno
;
2199 if (gimple_call_with_bounds_p (call
))
2201 for (argno
= 0; argno
< gimple_call_num_args (call
); argno
++)
2202 if (!POINTER_BOUNDS_P (gimple_call_arg (call
, argno
)))
2213 bounds
= chkp_find_bounds (gimple_call_arg (call
, argno
), &iter
);
2215 else if (chkp_call_returns_bounds_p (call
))
2217 gcc_assert (TREE_CODE (gimple_call_lhs (call
)) == SSA_NAME
);
2219 /* In general case build checker builtin call to
2220 obtain returned bounds. */
2221 stmt
= gimple_build_call (chkp_ret_bnd_fndecl
, 1,
2222 gimple_call_lhs (call
));
2223 chkp_mark_stmt (stmt
);
2225 gsi
= gsi_for_stmt (call
);
2226 gsi_insert_after (&gsi
, stmt
, GSI_SAME_STMT
);
2228 bounds
= chkp_get_tmp_reg (stmt
);
2229 gimple_call_set_lhs (stmt
, bounds
);
2234 bounds
= chkp_get_zero_bounds ();
2236 if (dump_file
&& (dump_flags
& TDF_DETAILS
))
2238 fprintf (dump_file
, "Built returned bounds (");
2239 print_generic_expr (dump_file
, bounds
, 0);
2240 fprintf (dump_file
, ") for call: ");
2241 print_gimple_stmt (dump_file
, call
, 0, TDF_VOPS
|TDF_MEMSYMS
);
2244 bounds
= chkp_maybe_copy_and_register_bounds (gimple_call_lhs (call
), bounds
);
2249 /* Return bounds used as returned by call
2250 which produced SSA name VAL. */
2252 chkp_retbnd_call_by_val (tree val
)
2254 if (TREE_CODE (val
) != SSA_NAME
)
2257 gcc_assert (gimple_code (SSA_NAME_DEF_STMT (val
)) == GIMPLE_CALL
);
2259 imm_use_iterator use_iter
;
2260 use_operand_p use_p
;
2261 FOR_EACH_IMM_USE_FAST (use_p
, use_iter
, val
)
2262 if (gimple_code (USE_STMT (use_p
)) == GIMPLE_CALL
2263 && gimple_call_fndecl (USE_STMT (use_p
)) == chkp_ret_bnd_fndecl
)
2264 return as_a
<gcall
*> (USE_STMT (use_p
));
2269 /* Check the next parameter for the given PARM is bounds
2270 and return it's default SSA_NAME (create if required). */
2272 chkp_get_next_bounds_parm (tree parm
)
2274 tree bounds
= TREE_CHAIN (parm
);
2275 gcc_assert (POINTER_BOUNDS_P (bounds
));
2276 bounds
= ssa_default_def (cfun
, bounds
);
2279 bounds
= make_ssa_name (TREE_CHAIN (parm
), gimple_build_nop ());
2280 set_ssa_default_def (cfun
, TREE_CHAIN (parm
), bounds
);
2285 /* Return bounds to be used for input argument PARM. */
2287 chkp_get_bound_for_parm (tree parm
)
2289 tree decl
= SSA_NAME_VAR (parm
);
2292 gcc_assert (TREE_CODE (decl
) == PARM_DECL
);
2294 bounds
= chkp_get_registered_bounds (parm
);
2297 bounds
= chkp_get_registered_bounds (decl
);
2301 tree orig_decl
= cgraph_node::get (cfun
->decl
)->orig_decl
;
2303 /* For static chain param we return zero bounds
2304 because currently we do not check dereferences
2306 if (cfun
->static_chain_decl
== decl
)
2307 bounds
= chkp_get_zero_bounds ();
2308 /* If non instrumented runtime is used then it may be useful
2309 to use zero bounds for input arguments of main
2311 else if (flag_chkp_zero_input_bounds_for_main
2312 && strcmp (IDENTIFIER_POINTER (DECL_ASSEMBLER_NAME (orig_decl
)),
2314 bounds
= chkp_get_zero_bounds ();
2315 else if (BOUNDED_P (parm
))
2317 bounds
= chkp_get_next_bounds_parm (decl
);
2318 bounds
= chkp_maybe_copy_and_register_bounds (decl
, bounds
);
2320 if (dump_file
&& (dump_flags
& TDF_DETAILS
))
2322 fprintf (dump_file
, "Built arg bounds (");
2323 print_generic_expr (dump_file
, bounds
, 0);
2324 fprintf (dump_file
, ") for arg: ");
2325 print_node (dump_file
, "", decl
, 0);
2329 bounds
= chkp_get_zero_bounds ();
2332 if (!chkp_get_registered_bounds (parm
))
2333 bounds
= chkp_maybe_copy_and_register_bounds (parm
, bounds
);
2335 if (dump_file
&& (dump_flags
& TDF_DETAILS
))
2337 fprintf (dump_file
, "Using bounds ");
2338 print_generic_expr (dump_file
, bounds
, 0);
2339 fprintf (dump_file
, " for parm ");
2340 print_generic_expr (dump_file
, parm
, 0);
2341 fprintf (dump_file
, " of type ");
2342 print_generic_expr (dump_file
, TREE_TYPE (parm
), 0);
2343 fprintf (dump_file
, ".\n");
2349 /* Build and return CALL_EXPR for bndstx builtin with specified
2352 chkp_build_bndldx_call (tree addr
, tree ptr
)
2354 tree fn
= build1 (ADDR_EXPR
,
2355 build_pointer_type (TREE_TYPE (chkp_bndldx_fndecl
)),
2356 chkp_bndldx_fndecl
);
2357 tree call
= build_call_nary (TREE_TYPE (TREE_TYPE (chkp_bndldx_fndecl
)),
2359 CALL_WITH_BOUNDS_P (call
) = true;
2363 /* Insert code to load bounds for PTR located by ADDR.
2364 Code is inserted after position pointed by GSI.
2365 Loaded bounds are returned. */
2367 chkp_build_bndldx (tree addr
, tree ptr
, gimple_stmt_iterator
*gsi
)
2375 addr
= chkp_force_gimple_call_op (addr
, &seq
);
2376 ptr
= chkp_force_gimple_call_op (ptr
, &seq
);
2378 stmt
= gimple_build_call (chkp_bndldx_fndecl
, 2, addr
, ptr
);
2379 chkp_mark_stmt (stmt
);
2380 bounds
= chkp_get_tmp_reg (stmt
);
2381 gimple_call_set_lhs (stmt
, bounds
);
2383 gimple_seq_add_stmt (&seq
, stmt
);
2385 gsi_insert_seq_after (gsi
, seq
, GSI_CONTINUE_LINKING
);
2387 if (dump_file
&& (dump_flags
& TDF_DETAILS
))
2389 fprintf (dump_file
, "Generated bndldx for pointer ");
2390 print_generic_expr (dump_file
, ptr
, 0);
2391 fprintf (dump_file
, ": ");
2392 print_gimple_stmt (dump_file
, stmt
, 0, TDF_VOPS
|TDF_MEMSYMS
);
2398 /* Build and return CALL_EXPR for bndstx builtin with specified
2401 chkp_build_bndstx_call (tree addr
, tree ptr
, tree bounds
)
2403 tree fn
= build1 (ADDR_EXPR
,
2404 build_pointer_type (TREE_TYPE (chkp_bndstx_fndecl
)),
2405 chkp_bndstx_fndecl
);
2406 tree call
= build_call_nary (TREE_TYPE (TREE_TYPE (chkp_bndstx_fndecl
)),
2407 fn
, 3, ptr
, bounds
, addr
);
2408 CALL_WITH_BOUNDS_P (call
) = true;
2412 /* Insert code to store BOUNDS for PTR stored by ADDR.
2413 New statements are inserted after position pointed
2416 chkp_build_bndstx (tree addr
, tree ptr
, tree bounds
,
2417 gimple_stmt_iterator
*gsi
)
2424 addr
= chkp_force_gimple_call_op (addr
, &seq
);
2425 ptr
= chkp_force_gimple_call_op (ptr
, &seq
);
2427 stmt
= gimple_build_call (chkp_bndstx_fndecl
, 3, ptr
, bounds
, addr
);
2428 chkp_mark_stmt (stmt
);
2429 gimple_call_set_with_bounds (stmt
, true);
2431 gimple_seq_add_stmt (&seq
, stmt
);
2433 gsi_insert_seq_after (gsi
, seq
, GSI_CONTINUE_LINKING
);
2435 if (dump_file
&& (dump_flags
& TDF_DETAILS
))
2437 fprintf (dump_file
, "Generated bndstx for pointer store ");
2438 print_gimple_stmt (dump_file
, gsi_stmt (*gsi
), 0, TDF_VOPS
|TDF_MEMSYMS
);
2439 print_gimple_stmt (dump_file
, stmt
, 2, TDF_VOPS
|TDF_MEMSYMS
);
2443 /* Compute bounds for pointer NODE which was assigned in
2444 assignment statement ASSIGN. Return computed bounds. */
2446 chkp_compute_bounds_for_assignment (tree node
, gimple assign
)
2448 enum tree_code rhs_code
= gimple_assign_rhs_code (assign
);
2449 tree rhs1
= gimple_assign_rhs1 (assign
);
2450 tree bounds
= NULL_TREE
;
2451 gimple_stmt_iterator iter
= gsi_for_stmt (assign
);
2453 if (dump_file
&& (dump_flags
& TDF_DETAILS
))
2455 fprintf (dump_file
, "Computing bounds for assignment: ");
2456 print_gimple_stmt (dump_file
, assign
, 0, TDF_VOPS
|TDF_MEMSYMS
);
2462 case TARGET_MEM_REF
:
2465 /* We need to load bounds from the bounds table. */
2466 bounds
= chkp_find_bounds_loaded (node
, rhs1
, &iter
);
2472 case POINTER_PLUS_EXPR
:
2476 /* Bounds are just propagated from RHS. */
2477 bounds
= chkp_find_bounds (rhs1
, &iter
);
2480 case VIEW_CONVERT_EXPR
:
2481 /* Bounds are just propagated from RHS. */
2482 bounds
= chkp_find_bounds (TREE_OPERAND (rhs1
, 0), &iter
);
2486 if (BOUNDED_P (rhs1
))
2488 /* We need to load bounds from the bounds table. */
2489 bounds
= chkp_build_bndldx (chkp_build_addr_expr (rhs1
),
2491 TREE_ADDRESSABLE (rhs1
) = 1;
2494 bounds
= chkp_get_nonpointer_load_bounds ();
2503 tree rhs2
= gimple_assign_rhs2 (assign
);
2504 tree bnd1
= chkp_find_bounds (rhs1
, &iter
);
2505 tree bnd2
= chkp_find_bounds (rhs2
, &iter
);
2507 /* First we try to check types of operands. If it
2508 does not help then look at bound values.
2510 If some bounds are incomplete and other are
2511 not proven to be valid (i.e. also incomplete
2512 or invalid because value is not pointer) then
2513 resulting value is incomplete and will be
2514 recomputed later in chkp_finish_incomplete_bounds. */
2515 if (BOUNDED_P (rhs1
)
2516 && !BOUNDED_P (rhs2
))
2518 else if (BOUNDED_P (rhs2
)
2519 && !BOUNDED_P (rhs1
)
2520 && rhs_code
!= MINUS_EXPR
)
2522 else if (chkp_incomplete_bounds (bnd1
))
2523 if (chkp_valid_bounds (bnd2
) && rhs_code
!= MINUS_EXPR
2524 && !chkp_incomplete_bounds (bnd2
))
2527 bounds
= incomplete_bounds
;
2528 else if (chkp_incomplete_bounds (bnd2
))
2529 if (chkp_valid_bounds (bnd1
)
2530 && !chkp_incomplete_bounds (bnd1
))
2533 bounds
= incomplete_bounds
;
2534 else if (!chkp_valid_bounds (bnd1
))
2535 if (chkp_valid_bounds (bnd2
) && rhs_code
!= MINUS_EXPR
)
2537 else if (bnd2
== chkp_get_zero_bounds ())
2541 else if (!chkp_valid_bounds (bnd2
))
2544 /* Seems both operands may have valid bounds
2545 (e.g. pointer minus pointer). In such case
2546 use default invalid op bounds. */
2547 bounds
= chkp_get_invalid_op_bounds ();
2565 case TRUNC_DIV_EXPR
:
2566 case FLOOR_DIV_EXPR
:
2568 case ROUND_DIV_EXPR
:
2569 case TRUNC_MOD_EXPR
:
2570 case FLOOR_MOD_EXPR
:
2572 case ROUND_MOD_EXPR
:
2573 case EXACT_DIV_EXPR
:
2574 case FIX_TRUNC_EXPR
:
2578 /* No valid bounds may be produced by these exprs. */
2579 bounds
= chkp_get_invalid_op_bounds ();
2584 tree val1
= gimple_assign_rhs2 (assign
);
2585 tree val2
= gimple_assign_rhs3 (assign
);
2586 tree bnd1
= chkp_find_bounds (val1
, &iter
);
2587 tree bnd2
= chkp_find_bounds (val2
, &iter
);
2590 if (chkp_incomplete_bounds (bnd1
) || chkp_incomplete_bounds (bnd2
))
2591 bounds
= incomplete_bounds
;
2592 else if (bnd1
== bnd2
)
2596 rhs1
= unshare_expr (rhs1
);
2598 bounds
= chkp_get_tmp_reg (assign
);
2599 stmt
= gimple_build_assign (bounds
, COND_EXPR
, rhs1
, bnd1
, bnd2
);
2600 gsi_insert_after (&iter
, stmt
, GSI_SAME_STMT
);
2602 if (!chkp_valid_bounds (bnd1
) && !chkp_valid_bounds (bnd2
))
2603 chkp_mark_invalid_bounds (bounds
);
2611 tree rhs2
= gimple_assign_rhs2 (assign
);
2612 tree bnd1
= chkp_find_bounds (rhs1
, &iter
);
2613 tree bnd2
= chkp_find_bounds (rhs2
, &iter
);
2615 if (chkp_incomplete_bounds (bnd1
) || chkp_incomplete_bounds (bnd2
))
2616 bounds
= incomplete_bounds
;
2617 else if (bnd1
== bnd2
)
2622 tree cond
= build2 (rhs_code
== MAX_EXPR
? GT_EXPR
: LT_EXPR
,
2623 boolean_type_node
, rhs1
, rhs2
);
2624 bounds
= chkp_get_tmp_reg (assign
);
2625 stmt
= gimple_build_assign (bounds
, COND_EXPR
, cond
, bnd1
, bnd2
);
2627 gsi_insert_after (&iter
, stmt
, GSI_SAME_STMT
);
2629 if (!chkp_valid_bounds (bnd1
) && !chkp_valid_bounds (bnd2
))
2630 chkp_mark_invalid_bounds (bounds
);
2636 bounds
= chkp_get_zero_bounds ();
2637 warning (0, "pointer bounds were lost due to unexpected expression %s",
2638 get_tree_code_name (rhs_code
));
2641 gcc_assert (bounds
);
2644 bounds
= chkp_maybe_copy_and_register_bounds (node
, bounds
);
2649 /* Compute bounds for ssa name NODE defined by DEF_STMT pointed by ITER.
2651 There are just few statement codes allowed: NOP (for default ssa names),
2652 ASSIGN, CALL, PHI, ASM.
2654 Return computed bounds. */
2656 chkp_get_bounds_by_definition (tree node
, gimple def_stmt
,
2657 gphi_iterator
*iter
)
2660 enum gimple_code code
= gimple_code (def_stmt
);
2663 if (dump_file
&& (dump_flags
& TDF_DETAILS
))
2665 fprintf (dump_file
, "Searching for bounds for node: ");
2666 print_generic_expr (dump_file
, node
, 0);
2668 fprintf (dump_file
, " using its definition: ");
2669 print_gimple_stmt (dump_file
, def_stmt
, 0, TDF_VOPS
|TDF_MEMSYMS
);
2675 var
= SSA_NAME_VAR (node
);
2676 switch (TREE_CODE (var
))
2679 bounds
= chkp_get_bound_for_parm (node
);
2683 /* For uninitialized pointers use none bounds. */
2684 bounds
= chkp_get_none_bounds ();
2685 bounds
= chkp_maybe_copy_and_register_bounds (node
, bounds
);
2692 gcc_assert (TREE_CODE (TREE_TYPE (node
)) == REFERENCE_TYPE
);
2694 base_type
= TREE_TYPE (TREE_TYPE (node
));
2696 gcc_assert (TYPE_SIZE (base_type
)
2697 && TREE_CODE (TYPE_SIZE (base_type
)) == INTEGER_CST
2698 && tree_to_uhwi (TYPE_SIZE (base_type
)) != 0);
2700 bounds
= chkp_make_bounds (node
, TYPE_SIZE_UNIT (base_type
),
2702 bounds
= chkp_maybe_copy_and_register_bounds (node
, bounds
);
2707 if (dump_file
&& (dump_flags
& TDF_DETAILS
))
2709 fprintf (dump_file
, "Unexpected var with no definition\n");
2710 print_generic_expr (dump_file
, var
, 0);
2712 internal_error ("chkp_get_bounds_by_definition: Unexpected var of type %s",
2713 get_tree_code_name (TREE_CODE (var
)));
2718 bounds
= chkp_compute_bounds_for_assignment (node
, def_stmt
);
2722 bounds
= chkp_build_returned_bound (as_a
<gcall
*> (def_stmt
));
2726 if (SSA_NAME_OCCURS_IN_ABNORMAL_PHI (node
))
2727 if (SSA_NAME_VAR (node
))
2728 var
= chkp_get_bounds_var (SSA_NAME_VAR (node
));
2730 var
= make_temp_ssa_name (pointer_bounds_type_node
,
2731 gimple_build_nop (),
2732 CHKP_BOUND_TMP_NAME
);
2734 var
= chkp_get_tmp_var ();
2735 stmt
= create_phi_node (var
, gimple_bb (def_stmt
));
2736 bounds
= gimple_phi_result (stmt
);
2737 *iter
= gsi_for_phi (stmt
);
2739 bounds
= chkp_maybe_copy_and_register_bounds (node
, bounds
);
2741 /* Created bounds do not have all phi args computed and
2742 therefore we do not know if there is a valid source
2743 of bounds for that node. Therefore we mark bounds
2744 as incomplete and then recompute them when all phi
2745 args are computed. */
2746 chkp_register_incomplete_bounds (bounds
, node
);
2750 bounds
= chkp_get_zero_bounds ();
2751 bounds
= chkp_maybe_copy_and_register_bounds (node
, bounds
);
2755 internal_error ("chkp_get_bounds_by_definition: Unexpected GIMPLE code %s",
2756 gimple_code_name
[code
]);
2762 /* Return CALL_EXPR for bndmk with specified LOWER_BOUND and SIZE. */
2764 chkp_build_make_bounds_call (tree lower_bound
, tree size
)
2766 tree call
= build1 (ADDR_EXPR
,
2767 build_pointer_type (TREE_TYPE (chkp_bndmk_fndecl
)),
2769 return build_call_nary (TREE_TYPE (TREE_TYPE (chkp_bndmk_fndecl
)),
2770 call
, 2, lower_bound
, size
);
2773 /* Create static bounds var of specfified OBJ which is
2774 is either VAR_DECL or string constant. */
2776 chkp_make_static_bounds (tree obj
)
2778 static int string_id
= 1;
2779 static int var_id
= 1;
2781 const char *var_name
;
2785 /* First check if we already have required var. */
2786 if (chkp_static_var_bounds
)
2788 /* For vars we use assembler name as a key in
2789 chkp_static_var_bounds map. It allows to
2790 avoid duplicating bound vars for decls
2791 sharing assembler name. */
2792 if (TREE_CODE (obj
) == VAR_DECL
)
2794 tree name
= DECL_ASSEMBLER_NAME (obj
);
2795 slot
= chkp_static_var_bounds
->get (name
);
2801 slot
= chkp_static_var_bounds
->get (obj
);
2807 /* Build decl for bounds var. */
2808 if (TREE_CODE (obj
) == VAR_DECL
)
2810 if (DECL_IGNORED_P (obj
))
2812 bnd_var_name
= (char *) xmalloc (strlen (CHKP_VAR_BOUNDS_PREFIX
) + 10);
2813 sprintf (bnd_var_name
, "%s%d", CHKP_VAR_BOUNDS_PREFIX
, var_id
++);
2817 var_name
= IDENTIFIER_POINTER (DECL_ASSEMBLER_NAME (obj
));
2819 /* For hidden symbols we want to skip first '*' char. */
2820 if (*var_name
== '*')
2823 bnd_var_name
= (char *) xmalloc (strlen (var_name
)
2824 + strlen (CHKP_BOUNDS_OF_SYMBOL_PREFIX
) + 1);
2825 strcpy (bnd_var_name
, CHKP_BOUNDS_OF_SYMBOL_PREFIX
);
2826 strcat (bnd_var_name
, var_name
);
2829 bnd_var
= build_decl (UNKNOWN_LOCATION
, VAR_DECL
,
2830 get_identifier (bnd_var_name
),
2831 pointer_bounds_type_node
);
2833 /* Address of the obj will be used as lower bound. */
2834 TREE_ADDRESSABLE (obj
) = 1;
2838 bnd_var_name
= (char *) xmalloc (strlen (CHKP_STRING_BOUNDS_PREFIX
) + 10);
2839 sprintf (bnd_var_name
, "%s%d", CHKP_STRING_BOUNDS_PREFIX
, string_id
++);
2841 bnd_var
= build_decl (UNKNOWN_LOCATION
, VAR_DECL
,
2842 get_identifier (bnd_var_name
),
2843 pointer_bounds_type_node
);
2846 TREE_PUBLIC (bnd_var
) = 0;
2847 TREE_USED (bnd_var
) = 1;
2848 TREE_READONLY (bnd_var
) = 0;
2849 TREE_STATIC (bnd_var
) = 1;
2850 TREE_ADDRESSABLE (bnd_var
) = 0;
2851 DECL_ARTIFICIAL (bnd_var
) = 1;
2852 DECL_COMMON (bnd_var
) = 1;
2853 DECL_COMDAT (bnd_var
) = 1;
2854 DECL_READ_P (bnd_var
) = 1;
2855 DECL_INITIAL (bnd_var
) = chkp_build_addr_expr (obj
);
2856 /* Force output similar to constant bounds.
2857 See chkp_make_static_const_bounds. */
2858 varpool_node::get_create (bnd_var
)->force_output
= 1;
2859 /* Mark symbol as requiring bounds initialization. */
2860 varpool_node::get_create (bnd_var
)->need_bounds_init
= 1;
2861 varpool_node::finalize_decl (bnd_var
);
2863 /* Add created var to the map to use it for other references
2865 if (!chkp_static_var_bounds
)
2866 chkp_static_var_bounds
= new hash_map
<tree
, tree
>;
2868 if (TREE_CODE (obj
) == VAR_DECL
)
2870 tree name
= DECL_ASSEMBLER_NAME (obj
);
2871 chkp_static_var_bounds
->put (name
, bnd_var
);
2874 chkp_static_var_bounds
->put (obj
, bnd_var
);
2879 /* When var has incomplete type we cannot get size to
2880 compute its bounds. In such cases we use checker
2881 builtin call which determines object size at runtime. */
2883 chkp_generate_extern_var_bounds (tree var
)
2885 tree bounds
, size_reloc
, lb
, size
, max_size
, cond
;
2886 gimple_stmt_iterator gsi
;
2887 gimple_seq seq
= NULL
;
2890 /* If instrumentation is not enabled for vars having
2891 incomplete type then just return zero bounds to avoid
2892 checks for this var. */
2893 if (!flag_chkp_incomplete_type
)
2894 return chkp_get_zero_bounds ();
2896 if (dump_file
&& (dump_flags
& TDF_DETAILS
))
2898 fprintf (dump_file
, "Generating bounds for extern symbol '");
2899 print_generic_expr (dump_file
, var
, 0);
2900 fprintf (dump_file
, "'\n");
2903 stmt
= gimple_build_call (chkp_sizeof_fndecl
, 1, var
);
2905 size_reloc
= create_tmp_reg (chkp_uintptr_type
, CHKP_SIZE_TMP_NAME
);
2906 gimple_call_set_lhs (stmt
, size_reloc
);
2908 gimple_seq_add_stmt (&seq
, stmt
);
2910 lb
= chkp_build_addr_expr (var
);
2911 size
= make_ssa_name (chkp_get_size_tmp_var (), gimple_build_nop ());
2913 if (flag_chkp_zero_dynamic_size_as_infinite
)
2915 /* We should check that size relocation was resolved.
2916 If it was not then use maximum possible size for the var. */
2917 max_size
= build2 (MINUS_EXPR
, chkp_uintptr_type
, integer_zero_node
,
2918 fold_convert (chkp_uintptr_type
, lb
));
2919 max_size
= chkp_force_gimple_call_op (max_size
, &seq
);
2921 cond
= build2 (NE_EXPR
, boolean_type_node
,
2922 size_reloc
, integer_zero_node
);
2923 stmt
= gimple_build_assign (size
, COND_EXPR
, cond
, size_reloc
, max_size
);
2924 gimple_seq_add_stmt (&seq
, stmt
);
2928 stmt
= gimple_build_assign (size
, size_reloc
);
2929 gimple_seq_add_stmt (&seq
, stmt
);
2932 gsi
= gsi_start_bb (chkp_get_entry_block ());
2933 gsi_insert_seq_after (&gsi
, seq
, GSI_CONTINUE_LINKING
);
2935 bounds
= chkp_make_bounds (lb
, size
, &gsi
, true);
2940 /* Return 1 if TYPE has fields with zero size or fields
2941 marked with chkp_variable_size attribute. */
2943 chkp_variable_size_type (tree type
)
2948 if (RECORD_OR_UNION_TYPE_P (type
))
2949 for (field
= TYPE_FIELDS (type
); field
; field
= DECL_CHAIN (field
))
2951 if (TREE_CODE (field
) == FIELD_DECL
)
2953 || lookup_attribute ("bnd_variable_size", DECL_ATTRIBUTES (field
))
2954 || chkp_variable_size_type (TREE_TYPE (field
));
2957 res
= !TYPE_SIZE (type
)
2958 || TREE_CODE (TYPE_SIZE (type
)) != INTEGER_CST
2959 || tree_to_uhwi (TYPE_SIZE (type
)) == 0;
2964 /* Compute and return bounds for address of DECL which is
2965 one of VAR_DECL, PARM_DECL, RESULT_DECL. */
2967 chkp_get_bounds_for_decl_addr (tree decl
)
2971 gcc_assert (TREE_CODE (decl
) == VAR_DECL
2972 || TREE_CODE (decl
) == PARM_DECL
2973 || TREE_CODE (decl
) == RESULT_DECL
);
2975 bounds
= chkp_get_registered_addr_bounds (decl
);
2980 if (dump_file
&& (dump_flags
& TDF_DETAILS
))
2982 fprintf (dump_file
, "Building bounds for address of decl ");
2983 print_generic_expr (dump_file
, decl
, 0);
2984 fprintf (dump_file
, "\n");
2987 /* Use zero bounds if size is unknown and checks for
2988 unknown sizes are restricted. */
2989 if ((!DECL_SIZE (decl
)
2990 || (chkp_variable_size_type (TREE_TYPE (decl
))
2991 && (TREE_STATIC (decl
)
2992 || DECL_EXTERNAL (decl
)
2993 || TREE_PUBLIC (decl
))))
2994 && !flag_chkp_incomplete_type
)
2995 return chkp_get_zero_bounds ();
2997 if (flag_chkp_use_static_bounds
2998 && TREE_CODE (decl
) == VAR_DECL
2999 && (TREE_STATIC (decl
)
3000 || DECL_EXTERNAL (decl
)
3001 || TREE_PUBLIC (decl
))
3002 && !DECL_THREAD_LOCAL_P (decl
))
3004 tree bnd_var
= chkp_make_static_bounds (decl
);
3005 gimple_stmt_iterator gsi
= gsi_start_bb (chkp_get_entry_block ());
3008 bounds
= chkp_get_tmp_reg (gimple_build_nop ());
3009 stmt
= gimple_build_assign (bounds
, bnd_var
);
3010 gsi_insert_before (&gsi
, stmt
, GSI_SAME_STMT
);
3012 else if (!DECL_SIZE (decl
)
3013 || (chkp_variable_size_type (TREE_TYPE (decl
))
3014 && (TREE_STATIC (decl
)
3015 || DECL_EXTERNAL (decl
)
3016 || TREE_PUBLIC (decl
))))
3018 gcc_assert (TREE_CODE (decl
) == VAR_DECL
);
3019 bounds
= chkp_generate_extern_var_bounds (decl
);
3023 tree lb
= chkp_build_addr_expr (decl
);
3024 bounds
= chkp_make_bounds (lb
, DECL_SIZE_UNIT (decl
), NULL
, false);
3030 /* Compute and return bounds for constant string. */
3032 chkp_get_bounds_for_string_cst (tree cst
)
3038 gcc_assert (TREE_CODE (cst
) == STRING_CST
);
3040 bounds
= chkp_get_registered_bounds (cst
);
3045 if ((flag_chkp_use_static_bounds
&& flag_chkp_use_static_const_bounds
)
3046 || flag_chkp_use_static_const_bounds
> 0)
3048 tree bnd_var
= chkp_make_static_bounds (cst
);
3049 gimple_stmt_iterator gsi
= gsi_start_bb (chkp_get_entry_block ());
3052 bounds
= chkp_get_tmp_reg (gimple_build_nop ());
3053 stmt
= gimple_build_assign (bounds
, bnd_var
);
3054 gsi_insert_before (&gsi
, stmt
, GSI_SAME_STMT
);
3058 lb
= chkp_build_addr_expr (cst
);
3059 size
= build_int_cst (chkp_uintptr_type
, TREE_STRING_LENGTH (cst
));
3060 bounds
= chkp_make_bounds (lb
, size
, NULL
, false);
3063 bounds
= chkp_maybe_copy_and_register_bounds (cst
, bounds
);
3068 /* Generate code to instersect bounds BOUNDS1 and BOUNDS2 and
3069 return the result. if ITER is not NULL then Code is inserted
3070 before position pointed by ITER. Otherwise code is added to
3073 chkp_intersect_bounds (tree bounds1
, tree bounds2
, gimple_stmt_iterator
*iter
)
3075 if (!bounds1
|| bounds1
== chkp_get_zero_bounds ())
3076 return bounds2
? bounds2
: bounds1
;
3077 else if (!bounds2
|| bounds2
== chkp_get_zero_bounds ())
3087 stmt
= gimple_build_call (chkp_intersect_fndecl
, 2, bounds1
, bounds2
);
3088 chkp_mark_stmt (stmt
);
3090 bounds
= chkp_get_tmp_reg (stmt
);
3091 gimple_call_set_lhs (stmt
, bounds
);
3093 gimple_seq_add_stmt (&seq
, stmt
);
3095 /* We are probably doing narrowing for constant expression.
3096 In such case iter may be undefined. */
3099 gimple_stmt_iterator gsi
= gsi_last_bb (chkp_get_entry_block ());
3101 gsi_insert_seq_after (iter
, seq
, GSI_SAME_STMT
);
3104 gsi_insert_seq_before (iter
, seq
, GSI_SAME_STMT
);
3106 if (dump_file
&& (dump_flags
& TDF_DETAILS
))
3108 fprintf (dump_file
, "Bounds intersection: ");
3109 print_gimple_stmt (dump_file
, stmt
, 0, TDF_VOPS
|TDF_MEMSYMS
);
3110 fprintf (dump_file
, " inserted before statement: ");
3111 print_gimple_stmt (dump_file
, gsi_stmt (*iter
), 0,
3112 TDF_VOPS
|TDF_MEMSYMS
);
3119 /* Return 1 if we are allowed to narrow bounds for addressed FIELD
3122 chkp_may_narrow_to_field (tree field
)
3124 return DECL_SIZE (field
) && TREE_CODE (DECL_SIZE (field
)) == INTEGER_CST
3125 && tree_to_uhwi (DECL_SIZE (field
)) != 0
3126 && (!DECL_FIELD_OFFSET (field
)
3127 || TREE_CODE (DECL_FIELD_OFFSET (field
)) == INTEGER_CST
)
3128 && (!DECL_FIELD_BIT_OFFSET (field
)
3129 || TREE_CODE (DECL_FIELD_BIT_OFFSET (field
)) == INTEGER_CST
)
3130 && !lookup_attribute ("bnd_variable_size", DECL_ATTRIBUTES (field
))
3131 && !chkp_variable_size_type (TREE_TYPE (field
));
3134 /* Return 1 if bounds for FIELD should be narrowed to
3135 field's own size. */
3137 chkp_narrow_bounds_for_field (tree field
)
3140 HOST_WIDE_INT bit_offs
;
3142 if (!chkp_may_narrow_to_field (field
))
3145 /* Accesse to compiler generated fields should not cause
3146 bounds narrowing. */
3147 if (DECL_ARTIFICIAL (field
))
3150 offs
= tree_to_uhwi (DECL_FIELD_OFFSET (field
));
3151 bit_offs
= tree_to_uhwi (DECL_FIELD_BIT_OFFSET (field
));
3153 return (flag_chkp_narrow_bounds
3154 && (flag_chkp_first_field_has_own_bounds
3159 /* Perform narrowing for BOUNDS using bounds computed for field
3160 access COMPONENT. ITER meaning is the same as for
3161 chkp_intersect_bounds. */
3163 chkp_narrow_bounds_to_field (tree bounds
, tree component
,
3164 gimple_stmt_iterator
*iter
)
3166 tree field
= TREE_OPERAND (component
, 1);
3167 tree size
= DECL_SIZE_UNIT (field
);
3168 tree field_ptr
= chkp_build_addr_expr (component
);
3171 field_bounds
= chkp_make_bounds (field_ptr
, size
, iter
, false);
3173 return chkp_intersect_bounds (field_bounds
, bounds
, iter
);
3176 /* Parse field or array access NODE.
3178 PTR ouput parameter holds a pointer to the outermost
3181 BITFIELD output parameter is set to 1 if bitfield is
3182 accessed and to 0 otherwise. If it is 1 then ELT holds
3183 outer component for accessed bit field.
3185 SAFE outer parameter is set to 1 if access is safe and
3186 checks are not required.
3188 BOUNDS outer parameter holds bounds to be used to check
3189 access (may be NULL).
3191 If INNERMOST_BOUNDS is 1 then try to narrow bounds to the
3192 innermost accessed component. */
3194 chkp_parse_array_and_component_ref (tree node
, tree
*ptr
,
3195 tree
*elt
, bool *safe
,
3198 gimple_stmt_iterator
*iter
,
3199 bool innermost_bounds
)
3201 tree comp_to_narrow
= NULL_TREE
;
3202 tree last_comp
= NULL_TREE
;
3203 bool array_ref_found
= false;
3209 /* Compute tree height for expression. */
3212 while (TREE_CODE (var
) == COMPONENT_REF
3213 || TREE_CODE (var
) == ARRAY_REF
3214 || TREE_CODE (var
) == VIEW_CONVERT_EXPR
)
3216 var
= TREE_OPERAND (var
, 0);
3220 gcc_assert (len
> 1);
3222 /* It is more convenient for us to scan left-to-right,
3223 so walk tree again and put all node to nodes vector
3224 in reversed order. */
3225 nodes
= XALLOCAVEC (tree
, len
);
3226 nodes
[len
- 1] = node
;
3227 for (i
= len
- 2; i
>= 0; i
--)
3228 nodes
[i
] = TREE_OPERAND (nodes
[i
+ 1], 0);
3233 *bitfield
= (TREE_CODE (node
) == COMPONENT_REF
3234 && DECL_BIT_FIELD_TYPE (TREE_OPERAND (node
, 1)));
3235 /* To get bitfield address we will need outer elemnt. */
3237 *elt
= nodes
[len
- 2];
3241 /* If we have indirection in expression then compute
3242 outermost structure bounds. Computed bounds may be
3244 if (TREE_CODE (nodes
[0]) == MEM_REF
|| INDIRECT_REF_P (nodes
[0]))
3247 *ptr
= TREE_OPERAND (nodes
[0], 0);
3249 *bounds
= chkp_find_bounds (*ptr
, iter
);
3253 gcc_assert (TREE_CODE (var
) == VAR_DECL
3254 || TREE_CODE (var
) == PARM_DECL
3255 || TREE_CODE (var
) == RESULT_DECL
3256 || TREE_CODE (var
) == STRING_CST
3257 || TREE_CODE (var
) == SSA_NAME
);
3259 *ptr
= chkp_build_addr_expr (var
);
3262 /* In this loop we are trying to find a field access
3263 requiring narrowing. There are two simple rules
3265 1. Leftmost array_ref is chosen if any.
3266 2. Rightmost suitable component_ref is chosen if innermost
3267 bounds are required and no array_ref exists. */
3268 for (i
= 1; i
< len
; i
++)
3272 if (TREE_CODE (var
) == ARRAY_REF
)
3275 array_ref_found
= true;
3276 if (flag_chkp_narrow_bounds
3277 && !flag_chkp_narrow_to_innermost_arrray
3279 || chkp_may_narrow_to_field (TREE_OPERAND (last_comp
, 1))))
3281 comp_to_narrow
= last_comp
;
3285 else if (TREE_CODE (var
) == COMPONENT_REF
)
3287 tree field
= TREE_OPERAND (var
, 1);
3289 if (innermost_bounds
3291 && chkp_narrow_bounds_for_field (field
))
3292 comp_to_narrow
= var
;
3295 if (flag_chkp_narrow_bounds
3296 && flag_chkp_narrow_to_innermost_arrray
3297 && TREE_CODE (TREE_TYPE (field
)) == ARRAY_TYPE
)
3300 *bounds
= chkp_narrow_bounds_to_field (*bounds
, var
, iter
);
3301 comp_to_narrow
= NULL
;
3304 else if (TREE_CODE (var
) == VIEW_CONVERT_EXPR
)
3305 /* Nothing to do for it. */
3311 if (comp_to_narrow
&& DECL_SIZE (TREE_OPERAND (comp_to_narrow
, 1)) && bounds
)
3312 *bounds
= chkp_narrow_bounds_to_field (*bounds
, comp_to_narrow
, iter
);
3314 if (innermost_bounds
&& bounds
&& !*bounds
)
3315 *bounds
= chkp_find_bounds (*ptr
, iter
);
3318 /* Compute and return bounds for address of OBJ. */
3320 chkp_make_addressed_object_bounds (tree obj
, gimple_stmt_iterator
*iter
)
3322 tree bounds
= chkp_get_registered_addr_bounds (obj
);
3327 switch (TREE_CODE (obj
))
3332 bounds
= chkp_get_bounds_for_decl_addr (obj
);
3336 bounds
= chkp_get_bounds_for_string_cst (obj
);
3347 chkp_parse_array_and_component_ref (obj
, &ptr
, &elt
, &safe
,
3348 &bitfield
, &bounds
, iter
, true);
3350 gcc_assert (bounds
);
3356 bounds
= chkp_get_zero_bounds ();
3360 bounds
= chkp_find_bounds (TREE_OPERAND (obj
, 0), iter
);
3365 bounds
= chkp_make_addressed_object_bounds (TREE_OPERAND (obj
, 0), iter
);
3369 if (dump_file
&& (dump_flags
& TDF_DETAILS
))
3371 fprintf (dump_file
, "chkp_make_addressed_object_bounds: "
3372 "unexpected object of type %s\n",
3373 get_tree_code_name (TREE_CODE (obj
)));
3374 print_node (dump_file
, "", obj
, 0);
3376 internal_error ("chkp_make_addressed_object_bounds: "
3377 "Unexpected tree code %s",
3378 get_tree_code_name (TREE_CODE (obj
)));
3381 chkp_register_addr_bounds (obj
, bounds
);
3386 /* Compute bounds for pointer PTR loaded from PTR_SRC. Generate statements
3387 to compute bounds if required. Computed bounds should be available at
3388 position pointed by ITER.
3390 If PTR_SRC is NULL_TREE then pointer definition is identified.
3392 If PTR_SRC is not NULL_TREE then ITER points to statements which loads
3393 PTR. If PTR is a any memory reference then ITER points to a statement
3394 after which bndldx will be inserterd. In both cases ITER will be updated
3395 to point to the inserted bndldx statement. */
3398 chkp_find_bounds_1 (tree ptr
, tree ptr_src
, gimple_stmt_iterator
*iter
)
3400 tree addr
= NULL_TREE
;
3401 tree bounds
= NULL_TREE
;
3406 bounds
= chkp_get_registered_bounds (ptr_src
);
3411 switch (TREE_CODE (ptr_src
))
3415 if (BOUNDED_P (ptr_src
))
3416 if (TREE_CODE (ptr
) == VAR_DECL
&& DECL_REGISTER (ptr
))
3417 bounds
= chkp_get_zero_bounds ();
3420 addr
= chkp_build_addr_expr (ptr_src
);
3421 bounds
= chkp_build_bndldx (addr
, ptr
, iter
);
3424 bounds
= chkp_get_nonpointer_load_bounds ();
3429 addr
= get_base_address (ptr_src
);
3431 || TREE_CODE (addr
) == MEM_REF
3432 || TREE_CODE (addr
) == TARGET_MEM_REF
)
3434 if (BOUNDED_P (ptr_src
))
3435 if (TREE_CODE (ptr
) == VAR_DECL
&& DECL_REGISTER (ptr
))
3436 bounds
= chkp_get_zero_bounds ();
3439 addr
= chkp_build_addr_expr (ptr_src
);
3440 bounds
= chkp_build_bndldx (addr
, ptr
, iter
);
3443 bounds
= chkp_get_nonpointer_load_bounds ();
3447 gcc_assert (TREE_CODE (addr
) == SSA_NAME
);
3448 bounds
= chkp_find_bounds (addr
, iter
);
3454 bounds
= chkp_get_bound_for_parm (ptr_src
);
3457 case TARGET_MEM_REF
:
3458 addr
= chkp_build_addr_expr (ptr_src
);
3459 bounds
= chkp_build_bndldx (addr
, ptr
, iter
);
3463 bounds
= chkp_get_registered_bounds (ptr_src
);
3466 gimple def_stmt
= SSA_NAME_DEF_STMT (ptr_src
);
3467 gphi_iterator phi_iter
;
3469 bounds
= chkp_get_bounds_by_definition (ptr_src
, def_stmt
, &phi_iter
);
3471 gcc_assert (bounds
);
3473 if (gphi
*def_phi
= dyn_cast
<gphi
*> (def_stmt
))
3477 for (i
= 0; i
< gimple_phi_num_args (def_phi
); i
++)
3479 tree arg
= gimple_phi_arg_def (def_phi
, i
);
3483 arg_bnd
= chkp_find_bounds (arg
, NULL
);
3485 /* chkp_get_bounds_by_definition created new phi
3486 statement and phi_iter points to it.
3488 Previous call to chkp_find_bounds could create
3489 new basic block and therefore change phi statement
3490 phi_iter points to. */
3491 phi_bnd
= phi_iter
.phi ();
3493 add_phi_arg (phi_bnd
, arg_bnd
,
3494 gimple_phi_arg_edge (def_phi
, i
),
3498 /* If all bound phi nodes have their arg computed
3499 then we may finish its computation. See
3500 chkp_finish_incomplete_bounds for more details. */
3501 if (chkp_may_finish_incomplete_bounds ())
3502 chkp_finish_incomplete_bounds ();
3505 gcc_assert (bounds
== chkp_get_registered_bounds (ptr_src
)
3506 || chkp_incomplete_bounds (bounds
));
3511 bounds
= chkp_make_addressed_object_bounds (TREE_OPERAND (ptr_src
, 0), iter
);
3515 if (integer_zerop (ptr_src
))
3516 bounds
= chkp_get_none_bounds ();
3518 bounds
= chkp_get_invalid_op_bounds ();
3522 if (dump_file
&& (dump_flags
& TDF_DETAILS
))
3524 fprintf (dump_file
, "chkp_find_bounds: unexpected ptr of type %s\n",
3525 get_tree_code_name (TREE_CODE (ptr_src
)));
3526 print_node (dump_file
, "", ptr_src
, 0);
3528 internal_error ("chkp_find_bounds: Unexpected tree code %s",
3529 get_tree_code_name (TREE_CODE (ptr_src
)));
3534 if (dump_file
&& (dump_flags
& TDF_DETAILS
))
3536 fprintf (stderr
, "chkp_find_bounds: cannot find bounds for pointer\n");
3537 print_node (dump_file
, "", ptr_src
, 0);
3539 internal_error ("chkp_find_bounds: Cannot find bounds for pointer");
3545 /* Normal case for bounds search without forced narrowing. */
3547 chkp_find_bounds (tree ptr
, gimple_stmt_iterator
*iter
)
3549 return chkp_find_bounds_1 (ptr
, NULL_TREE
, iter
);
3552 /* Search bounds for pointer PTR loaded from PTR_SRC
3553 by statement *ITER points to. */
3555 chkp_find_bounds_loaded (tree ptr
, tree ptr_src
, gimple_stmt_iterator
*iter
)
3557 return chkp_find_bounds_1 (ptr
, ptr_src
, iter
);
3560 /* Helper function which checks type of RHS and finds all pointers in
3561 it. For each found pointer we build it's accesses in LHS and RHS
3562 objects and then call HANDLER for them. Function is used to copy
3563 or initilize bounds for copied object. */
3565 chkp_walk_pointer_assignments (tree lhs
, tree rhs
, void *arg
,
3566 assign_handler handler
)
3568 tree type
= TREE_TYPE (lhs
);
3570 /* We have nothing to do with clobbers. */
3571 if (TREE_CLOBBER_P (rhs
))
3574 if (BOUNDED_TYPE_P (type
))
3575 handler (lhs
, rhs
, arg
);
3576 else if (RECORD_OR_UNION_TYPE_P (type
))
3580 if (TREE_CODE (rhs
) == CONSTRUCTOR
)
3582 unsigned HOST_WIDE_INT cnt
;
3585 FOR_EACH_CONSTRUCTOR_ELT (CONSTRUCTOR_ELTS (rhs
), cnt
, field
, val
)
3587 if (chkp_type_has_pointer (TREE_TYPE (field
)))
3589 tree lhs_field
= chkp_build_component_ref (lhs
, field
);
3590 chkp_walk_pointer_assignments (lhs_field
, val
, arg
, handler
);
3595 for (field
= TYPE_FIELDS (type
); field
; field
= DECL_CHAIN (field
))
3596 if (TREE_CODE (field
) == FIELD_DECL
3597 && chkp_type_has_pointer (TREE_TYPE (field
)))
3599 tree rhs_field
= chkp_build_component_ref (rhs
, field
);
3600 tree lhs_field
= chkp_build_component_ref (lhs
, field
);
3601 chkp_walk_pointer_assignments (lhs_field
, rhs_field
, arg
, handler
);
3604 else if (TREE_CODE (type
) == ARRAY_TYPE
)
3606 unsigned HOST_WIDE_INT cur
= 0;
3607 tree maxval
= TYPE_MAX_VALUE (TYPE_DOMAIN (type
));
3608 tree etype
= TREE_TYPE (type
);
3609 tree esize
= TYPE_SIZE (etype
);
3611 if (TREE_CODE (rhs
) == CONSTRUCTOR
)
3613 unsigned HOST_WIDE_INT cnt
;
3614 tree purp
, val
, lhs_elem
;
3616 FOR_EACH_CONSTRUCTOR_ELT (CONSTRUCTOR_ELTS (rhs
), cnt
, purp
, val
)
3618 if (purp
&& TREE_CODE (purp
) == RANGE_EXPR
)
3620 tree lo_index
= TREE_OPERAND (purp
, 0);
3621 tree hi_index
= TREE_OPERAND (purp
, 1);
3623 for (cur
= (unsigned)tree_to_uhwi (lo_index
);
3624 cur
<= (unsigned)tree_to_uhwi (hi_index
);
3627 lhs_elem
= chkp_build_array_ref (lhs
, etype
, esize
, cur
);
3628 chkp_walk_pointer_assignments (lhs_elem
, val
, arg
, handler
);
3635 gcc_assert (TREE_CODE (purp
) == INTEGER_CST
);
3636 cur
= tree_to_uhwi (purp
);
3639 lhs_elem
= chkp_build_array_ref (lhs
, etype
, esize
, cur
++);
3641 chkp_walk_pointer_assignments (lhs_elem
, val
, arg
, handler
);
3645 /* Copy array only when size is known. */
3646 else if (maxval
&& !integer_minus_onep (maxval
))
3647 for (cur
= 0; cur
<= TREE_INT_CST_LOW (maxval
); cur
++)
3649 tree lhs_elem
= chkp_build_array_ref (lhs
, etype
, esize
, cur
);
3650 tree rhs_elem
= chkp_build_array_ref (rhs
, etype
, esize
, cur
);
3651 chkp_walk_pointer_assignments (lhs_elem
, rhs_elem
, arg
, handler
);
3655 internal_error("chkp_walk_pointer_assignments: unexpected RHS type: %s",
3656 get_tree_code_name (TREE_CODE (type
)));
3659 /* Add code to copy bounds for assignment of RHS to LHS.
3660 ARG is an iterator pointing ne code position. */
3662 chkp_copy_bounds_for_elem (tree lhs
, tree rhs
, void *arg
)
3664 gimple_stmt_iterator
*iter
= (gimple_stmt_iterator
*)arg
;
3665 tree bounds
= chkp_find_bounds (rhs
, iter
);
3666 tree addr
= chkp_build_addr_expr(lhs
);
3668 chkp_build_bndstx (addr
, rhs
, bounds
, iter
);
3671 /* Emit static bound initilizers and size vars. */
3673 chkp_finish_file (void)
3675 struct varpool_node
*node
;
3676 struct chkp_ctor_stmt_list stmts
;
3681 /* Iterate through varpool and generate bounds initialization
3682 constructors for all statically initialized pointers. */
3683 stmts
.avail
= MAX_STMTS_IN_STATIC_CHKP_CTOR
;
3685 FOR_EACH_VARIABLE (node
)
3686 /* Check that var is actually emitted and we need and may initialize
3688 if (node
->need_bounds_init
3689 && !POINTER_BOUNDS_P (node
->decl
)
3690 && DECL_RTL (node
->decl
)
3691 && MEM_P (DECL_RTL (node
->decl
))
3692 && TREE_ASM_WRITTEN (node
->decl
))
3694 chkp_walk_pointer_assignments (node
->decl
,
3695 DECL_INITIAL (node
->decl
),
3697 chkp_add_modification_to_stmt_list
);
3699 if (stmts
.avail
<= 0)
3701 cgraph_build_static_cdtor ('P', stmts
.stmts
,
3702 MAX_RESERVED_INIT_PRIORITY
+ 3);
3703 stmts
.avail
= MAX_STMTS_IN_STATIC_CHKP_CTOR
;
3709 cgraph_build_static_cdtor ('P', stmts
.stmts
,
3710 MAX_RESERVED_INIT_PRIORITY
+ 3);
3712 /* Iterate through varpool and generate bounds initialization
3713 constructors for all static bounds vars. */
3714 stmts
.avail
= MAX_STMTS_IN_STATIC_CHKP_CTOR
;
3716 FOR_EACH_VARIABLE (node
)
3717 if (node
->need_bounds_init
3718 && POINTER_BOUNDS_P (node
->decl
)
3719 && TREE_ASM_WRITTEN (node
->decl
))
3721 tree bnd
= node
->decl
;
3724 gcc_assert (DECL_INITIAL (bnd
)
3725 && TREE_CODE (DECL_INITIAL (bnd
)) == ADDR_EXPR
);
3727 var
= TREE_OPERAND (DECL_INITIAL (bnd
), 0);
3728 chkp_output_static_bounds (bnd
, var
, &stmts
);
3732 cgraph_build_static_cdtor ('B', stmts
.stmts
,
3733 MAX_RESERVED_INIT_PRIORITY
+ 2);
3735 delete chkp_static_var_bounds
;
3736 delete chkp_bounds_map
;
3739 /* An instrumentation function which is called for each statement
3740 having memory access we want to instrument. It inserts check
3741 code and bounds copy code.
3743 ITER points to statement to instrument.
3745 NODE holds memory access in statement to check.
3747 LOC holds the location information for statement.
3749 DIRFLAGS determines whether access is read or write.
3751 ACCESS_OFFS should be added to address used in NODE
3754 ACCESS_SIZE holds size of checked access.
3756 SAFE indicates if NODE access is safe and should not be
3759 chkp_process_stmt (gimple_stmt_iterator
*iter
, tree node
,
3760 location_t loc
, tree dirflag
,
3761 tree access_offs
, tree access_size
,
3764 tree node_type
= TREE_TYPE (node
);
3765 tree size
= access_size
? access_size
: TYPE_SIZE_UNIT (node_type
);
3766 tree addr_first
= NULL_TREE
; /* address of the first accessed byte */
3767 tree addr_last
= NULL_TREE
; /* address of the last accessed byte */
3768 tree ptr
= NULL_TREE
; /* a pointer used for dereference */
3769 tree bounds
= NULL_TREE
;
3771 /* We do not need instrumentation for clobbers. */
3772 if (dirflag
== integer_one_node
3773 && gimple_code (gsi_stmt (*iter
)) == GIMPLE_ASSIGN
3774 && TREE_CLOBBER_P (gimple_assign_rhs1 (gsi_stmt (*iter
))))
3777 switch (TREE_CODE (node
))
3787 /* We are not going to generate any checks, so do not
3788 generate bounds as well. */
3789 addr_first
= chkp_build_addr_expr (node
);
3793 chkp_parse_array_and_component_ref (node
, &ptr
, &elt
, &safe
,
3794 &bitfield
, &bounds
, iter
, false);
3796 /* Break if there is no dereference and operation is safe. */
3800 tree field
= TREE_OPERAND (node
, 1);
3802 if (TREE_CODE (DECL_SIZE_UNIT (field
)) == INTEGER_CST
)
3803 size
= DECL_SIZE_UNIT (field
);
3806 elt
= chkp_build_addr_expr (elt
);
3807 addr_first
= fold_convert_loc (loc
, ptr_type_node
, elt
? elt
: ptr
);
3808 addr_first
= fold_build_pointer_plus_loc (loc
,
3810 byte_position (field
));
3813 addr_first
= chkp_build_addr_expr (node
);
3818 ptr
= TREE_OPERAND (node
, 0);
3823 ptr
= TREE_OPERAND (node
, 0);
3824 addr_first
= chkp_build_addr_expr (node
);
3827 case TARGET_MEM_REF
:
3828 ptr
= TMR_BASE (node
);
3829 addr_first
= chkp_build_addr_expr (node
);
3832 case ARRAY_RANGE_REF
:
3833 printf("ARRAY_RANGE_REF\n");
3834 debug_gimple_stmt(gsi_stmt(*iter
));
3841 tree offs
, rem
, bpu
;
3843 gcc_assert (!access_offs
);
3844 gcc_assert (!access_size
);
3846 bpu
= fold_convert (size_type_node
, bitsize_int (BITS_PER_UNIT
));
3847 offs
= fold_convert (size_type_node
, TREE_OPERAND (node
, 2));
3848 rem
= size_binop_loc (loc
, TRUNC_MOD_EXPR
, offs
, bpu
);
3849 offs
= size_binop_loc (loc
, TRUNC_DIV_EXPR
, offs
, bpu
);
3851 size
= fold_convert (size_type_node
, TREE_OPERAND (node
, 1));
3852 size
= size_binop_loc (loc
, PLUS_EXPR
, size
, rem
);
3853 size
= size_binop_loc (loc
, CEIL_DIV_EXPR
, size
, bpu
);
3854 size
= fold_convert (size_type_node
, size
);
3856 chkp_process_stmt (iter
, TREE_OPERAND (node
, 0), loc
,
3857 dirflag
, offs
, size
, safe
);
3865 if (dirflag
!= integer_one_node
3866 || DECL_REGISTER (node
))
3870 addr_first
= chkp_build_addr_expr (node
);
3877 /* If addr_last was not computed then use (addr_first + size - 1)
3878 expression to compute it. */
3881 addr_last
= fold_build_pointer_plus_loc (loc
, addr_first
, size
);
3882 addr_last
= fold_build_pointer_plus_hwi_loc (loc
, addr_last
, -1);
3885 /* Shift both first_addr and last_addr by access_offs if specified. */
3888 addr_first
= fold_build_pointer_plus_loc (loc
, addr_first
, access_offs
);
3889 addr_last
= fold_build_pointer_plus_loc (loc
, addr_last
, access_offs
);
3892 /* Generate bndcl/bndcu checks if memory access is not safe. */
3895 gimple_stmt_iterator stmt_iter
= *iter
;
3898 bounds
= chkp_find_bounds (ptr
, iter
);
3900 chkp_check_mem_access (addr_first
, addr_last
, bounds
,
3901 stmt_iter
, loc
, dirflag
);
3904 /* We need to store bounds in case pointer is stored. */
3905 if (dirflag
== integer_one_node
3906 && chkp_type_has_pointer (node_type
)
3907 && flag_chkp_store_bounds
)
3909 gimple stmt
= gsi_stmt (*iter
);
3910 tree rhs1
= gimple_assign_rhs1 (stmt
);
3911 enum tree_code rhs_code
= gimple_assign_rhs_code (stmt
);
3913 if (get_gimple_rhs_class (rhs_code
) == GIMPLE_SINGLE_RHS
)
3914 chkp_walk_pointer_assignments (node
, rhs1
, iter
,
3915 chkp_copy_bounds_for_elem
);
3918 bounds
= chkp_compute_bounds_for_assignment (NULL_TREE
, stmt
);
3919 chkp_build_bndstx (addr_first
, rhs1
, bounds
, iter
);
3924 /* Add code to copy bounds for all pointers copied
3925 in ASSIGN created during inline of EDGE. */
3927 chkp_copy_bounds_for_assign (gimple assign
, struct cgraph_edge
*edge
)
3929 tree lhs
= gimple_assign_lhs (assign
);
3930 tree rhs
= gimple_assign_rhs1 (assign
);
3931 gimple_stmt_iterator iter
= gsi_for_stmt (assign
);
3933 if (!flag_chkp_store_bounds
)
3936 chkp_walk_pointer_assignments (lhs
, rhs
, &iter
, chkp_copy_bounds_for_elem
);
3938 /* We should create edges for all created calls to bndldx and bndstx. */
3939 while (gsi_stmt (iter
) != assign
)
3941 gimple stmt
= gsi_stmt (iter
);
3942 if (gimple_code (stmt
) == GIMPLE_CALL
)
3944 tree fndecl
= gimple_call_fndecl (stmt
);
3945 struct cgraph_node
*callee
= cgraph_node::get_create (fndecl
);
3946 struct cgraph_edge
*new_edge
;
3948 gcc_assert (fndecl
== chkp_bndstx_fndecl
3949 || fndecl
== chkp_bndldx_fndecl
3950 || fndecl
== chkp_ret_bnd_fndecl
);
3952 new_edge
= edge
->caller
->create_edge (callee
,
3953 as_a
<gcall
*> (stmt
),
3956 new_edge
->frequency
= compute_call_stmt_bb_frequency
3957 (edge
->caller
->decl
, gimple_bb (stmt
));
3963 /* Some code transformation made during instrumentation pass
3964 may put code into inconsistent state. Here we find and fix
3970 gimple_stmt_iterator i
;
3972 /* We could insert some code right after stmt which ends bb.
3973 We wanted to put this code on fallthru edge but did not
3974 add new edges from the beginning because it may cause new
3975 phi node creation which may be incorrect due to incomplete
3977 FOR_ALL_BB_FN (bb
, cfun
)
3978 for (i
= gsi_start_bb (bb
); !gsi_end_p (i
); gsi_next (&i
))
3980 gimple stmt
= gsi_stmt (i
);
3981 gimple_stmt_iterator next
= i
;
3985 if (stmt_ends_bb_p (stmt
)
3986 && !gsi_end_p (next
))
3988 edge fall
= find_fallthru_edge (bb
->succs
);
3989 basic_block dest
= NULL
;
3994 /* We cannot split abnormal edge. Therefore we
3995 store its params, make it regular and then
3996 rebuild abnormal edge after split. */
3997 if (fall
->flags
& EDGE_ABNORMAL
)
3999 flags
= fall
->flags
& ~EDGE_FALLTHRU
;
4002 fall
->flags
&= ~EDGE_COMPLEX
;
4005 while (!gsi_end_p (next
))
4007 gimple next_stmt
= gsi_stmt (next
);
4008 gsi_remove (&next
, false);
4009 gsi_insert_on_edge (fall
, next_stmt
);
4012 gsi_commit_edge_inserts ();
4014 /* Re-create abnormal edge. */
4016 make_edge (bb
, dest
, flags
);
4021 /* Walker callback for chkp_replace_function_pointers. Replaces
4022 function pointer in the specified operand with pointer to the
4023 instrumented function version. */
4025 chkp_replace_function_pointer (tree
*op
, int *walk_subtrees
,
4026 void *data ATTRIBUTE_UNUSED
)
4028 if (TREE_CODE (*op
) == FUNCTION_DECL
4029 && !lookup_attribute ("bnd_legacy", DECL_ATTRIBUTES (*op
))
4030 && (DECL_BUILT_IN_CLASS (*op
) == NOT_BUILT_IN
4031 /* For builtins we replace pointers only for selected
4032 function and functions having definitions. */
4033 || (DECL_BUILT_IN_CLASS (*op
) == BUILT_IN_NORMAL
4034 && (chkp_instrument_normal_builtin (*op
)
4035 || gimple_has_body_p (*op
)))))
4037 struct cgraph_node
*node
= cgraph_node::get_create (*op
);
4038 struct cgraph_node
*clone
= NULL
;
4040 if (!node
->instrumentation_clone
)
4041 clone
= chkp_maybe_create_clone (*op
);
4051 /* This function searches for function pointers in statement
4052 pointed by GSI and replaces them with pointers to instrumented
4053 function versions. */
4055 chkp_replace_function_pointers (gimple_stmt_iterator
*gsi
)
4057 gimple stmt
= gsi_stmt (*gsi
);
4058 /* For calls we want to walk call args only. */
4059 if (gimple_code (stmt
) == GIMPLE_CALL
)
4062 for (i
= 0; i
< gimple_call_num_args (stmt
); i
++)
4063 walk_tree (gimple_call_arg_ptr (stmt
, i
),
4064 chkp_replace_function_pointer
, NULL
, NULL
);
4067 walk_gimple_stmt (gsi
, NULL
, chkp_replace_function_pointer
, NULL
);
4070 /* This function instruments all statements working with memory,
4073 It also removes excess statements from static initializers. */
4075 chkp_instrument_function (void)
4077 basic_block bb
, next
;
4078 gimple_stmt_iterator i
;
4079 enum gimple_rhs_class grhs_class
;
4080 bool safe
= lookup_attribute ("chkp ctor", DECL_ATTRIBUTES (cfun
->decl
));
4082 bb
= ENTRY_BLOCK_PTR_FOR_FN (cfun
)->next_bb
;
4086 for (i
= gsi_start_bb (bb
); !gsi_end_p (i
); )
4088 gimple s
= gsi_stmt (i
);
4090 /* Skip statement marked to not be instrumented. */
4091 if (chkp_marked_stmt_p (s
))
4097 chkp_replace_function_pointers (&i
);
4099 switch (gimple_code (s
))
4102 chkp_process_stmt (&i
, gimple_assign_lhs (s
),
4103 gimple_location (s
), integer_one_node
,
4104 NULL_TREE
, NULL_TREE
, safe
);
4105 chkp_process_stmt (&i
, gimple_assign_rhs1 (s
),
4106 gimple_location (s
), integer_zero_node
,
4107 NULL_TREE
, NULL_TREE
, safe
);
4108 grhs_class
= get_gimple_rhs_class (gimple_assign_rhs_code (s
));
4109 if (grhs_class
== GIMPLE_BINARY_RHS
)
4110 chkp_process_stmt (&i
, gimple_assign_rhs2 (s
),
4111 gimple_location (s
), integer_zero_node
,
4112 NULL_TREE
, NULL_TREE
, safe
);
4117 greturn
*r
= as_a
<greturn
*> (s
);
4118 if (gimple_return_retval (r
) != NULL_TREE
)
4120 chkp_process_stmt (&i
, gimple_return_retval (r
),
4121 gimple_location (r
),
4123 NULL_TREE
, NULL_TREE
, safe
);
4125 /* Additionally we need to add bounds
4126 to return statement. */
4127 chkp_add_bounds_to_ret_stmt (&i
);
4133 chkp_add_bounds_to_call_stmt (&i
);
4142 /* We do not need any actual pointer stores in checker
4143 static initializer. */
4144 if (lookup_attribute ("chkp ctor", DECL_ATTRIBUTES (cfun
->decl
))
4145 && gimple_code (s
) == GIMPLE_ASSIGN
4146 && gimple_store_p (s
))
4148 gimple_stmt_iterator del_iter
= gsi_for_stmt (s
);
4149 gsi_remove (&del_iter
, true);
4150 unlink_stmt_vdef (s
);
4158 /* Some input params may have bounds and be address taken. In this case
4159 we should store incoming bounds into bounds table. */
4161 if (flag_chkp_store_bounds
)
4162 for (arg
= DECL_ARGUMENTS (cfun
->decl
); arg
; arg
= DECL_CHAIN (arg
))
4163 if (TREE_ADDRESSABLE (arg
))
4165 if (BOUNDED_P (arg
))
4167 tree bounds
= chkp_get_next_bounds_parm (arg
);
4168 tree def_ptr
= ssa_default_def (cfun
, arg
);
4169 gimple_stmt_iterator iter
4170 = gsi_start_bb (chkp_get_entry_block ());
4171 chkp_build_bndstx (chkp_build_addr_expr (arg
),
4172 def_ptr
? def_ptr
: arg
,
4175 /* Skip bounds arg. */
4176 arg
= TREE_CHAIN (arg
);
4178 else if (chkp_type_has_pointer (TREE_TYPE (arg
)))
4180 tree orig_arg
= arg
;
4181 bitmap slots
= BITMAP_ALLOC (NULL
);
4182 gimple_stmt_iterator iter
4183 = gsi_start_bb (chkp_get_entry_block ());
4187 chkp_find_bound_slots (TREE_TYPE (arg
), slots
);
4189 EXECUTE_IF_SET_IN_BITMAP (slots
, 0, bnd_no
, bi
)
4191 tree bounds
= chkp_get_next_bounds_parm (arg
);
4192 HOST_WIDE_INT offs
= bnd_no
* POINTER_SIZE
/ BITS_PER_UNIT
;
4193 tree addr
= chkp_build_addr_expr (orig_arg
);
4194 tree ptr
= build2 (MEM_REF
, ptr_type_node
, addr
,
4195 build_int_cst (ptr_type_node
, offs
));
4196 chkp_build_bndstx (chkp_build_addr_expr (ptr
), ptr
,
4199 arg
= DECL_CHAIN (arg
);
4201 BITMAP_FREE (slots
);
4206 /* Find init/null/copy_ptr_bounds calls and replace them
4207 with assignments. It should allow better code
4211 chkp_remove_useless_builtins ()
4214 gimple_stmt_iterator gsi
;
4216 FOR_EACH_BB_FN (bb
, cfun
)
4218 for (gsi
= gsi_start_bb (bb
); !gsi_end_p (gsi
); gsi_next (&gsi
))
4220 gimple stmt
= gsi_stmt (gsi
);
4222 enum built_in_function fcode
;
4224 /* Find builtins returning first arg and replace
4225 them with assignments. */
4226 if (gimple_code (stmt
) == GIMPLE_CALL
4227 && (fndecl
= gimple_call_fndecl (stmt
))
4228 && DECL_BUILT_IN_CLASS (fndecl
) == BUILT_IN_NORMAL
4229 && (fcode
= DECL_FUNCTION_CODE (fndecl
))
4230 && (fcode
== BUILT_IN_CHKP_INIT_PTR_BOUNDS
4231 || fcode
== BUILT_IN_CHKP_NULL_PTR_BOUNDS
4232 || fcode
== BUILT_IN_CHKP_COPY_PTR_BOUNDS
4233 || fcode
== BUILT_IN_CHKP_SET_PTR_BOUNDS
))
4235 tree res
= gimple_call_arg (stmt
, 0);
4236 update_call_from_tree (&gsi
, res
);
4237 stmt
= gsi_stmt (gsi
);
4244 /* Initialize pass. */
4249 gimple_stmt_iterator i
;
4251 in_chkp_pass
= true;
4253 for (bb
= ENTRY_BLOCK_PTR_FOR_FN (cfun
)->next_bb
; bb
; bb
= bb
->next_bb
)
4254 for (i
= gsi_start_bb (bb
); !gsi_end_p (i
); gsi_next (&i
))
4255 chkp_unmark_stmt (gsi_stmt (i
));
4257 chkp_invalid_bounds
= new hash_set
<tree
>;
4258 chkp_completed_bounds_set
= new hash_set
<tree
>;
4259 delete chkp_reg_bounds
;
4260 chkp_reg_bounds
= new hash_map
<tree
, tree
>;
4261 delete chkp_bound_vars
;
4262 chkp_bound_vars
= new hash_map
<tree
, tree
>;
4263 chkp_reg_addr_bounds
= new hash_map
<tree
, tree
>;
4264 chkp_incomplete_bounds_map
= new hash_map
<tree
, tree
>;
4265 delete chkp_bounds_map
;
4266 chkp_bounds_map
= new hash_map
<tree
, tree
>;
4267 chkp_abnormal_copies
= BITMAP_GGC_ALLOC ();
4270 zero_bounds
= NULL_TREE
;
4271 none_bounds
= NULL_TREE
;
4272 incomplete_bounds
= integer_zero_node
;
4273 tmp_var
= NULL_TREE
;
4274 size_tmp_var
= NULL_TREE
;
4276 chkp_uintptr_type
= lang_hooks
.types
.type_for_mode (ptr_mode
, true);
4278 /* We create these constant bounds once for each object file.
4279 These symbols go to comdat section and result in single copy
4280 of each one in the final binary. */
4281 chkp_get_zero_bounds_var ();
4282 chkp_get_none_bounds_var ();
4284 calculate_dominance_info (CDI_DOMINATORS
);
4285 calculate_dominance_info (CDI_POST_DOMINATORS
);
4287 bitmap_obstack_initialize (NULL
);
4290 /* Finalize instrumentation pass. */
4294 in_chkp_pass
= false;
4296 delete chkp_invalid_bounds
;
4297 delete chkp_completed_bounds_set
;
4298 delete chkp_reg_addr_bounds
;
4299 delete chkp_incomplete_bounds_map
;
4301 free_dominance_info (CDI_DOMINATORS
);
4302 free_dominance_info (CDI_POST_DOMINATORS
);
4304 bitmap_obstack_release (NULL
);
4307 zero_bounds
= NULL_TREE
;
4308 none_bounds
= NULL_TREE
;
4311 /* Main instrumentation pass function. */
4317 chkp_instrument_function ();
4319 chkp_remove_useless_builtins ();
4321 chkp_function_mark_instrumented (cfun
->decl
);
4330 /* Instrumentation pass gate. */
4334 cgraph_node
*node
= cgraph_node::get (cfun
->decl
);
4335 return ((node
!= NULL
4336 && node
->instrumentation_clone
)
4337 || lookup_attribute ("chkp ctor", DECL_ATTRIBUTES (cfun
->decl
)));
4342 const pass_data pass_data_chkp
=
4344 GIMPLE_PASS
, /* type */
4346 OPTGROUP_NONE
, /* optinfo_flags */
4347 TV_NONE
, /* tv_id */
4348 PROP_ssa
| PROP_cfg
, /* properties_required */
4349 0, /* properties_provided */
4350 0, /* properties_destroyed */
4351 0, /* todo_flags_start */
4353 | TODO_update_ssa
/* todo_flags_finish */
4356 class pass_chkp
: public gimple_opt_pass
4359 pass_chkp (gcc::context
*ctxt
)
4360 : gimple_opt_pass (pass_data_chkp
, ctxt
)
4363 /* opt_pass methods: */
4364 virtual opt_pass
* clone ()
4366 return new pass_chkp (m_ctxt
);
4369 virtual bool gate (function
*)
4371 return chkp_gate ();
4374 virtual unsigned int execute (function
*)
4376 return chkp_execute ();
4379 }; // class pass_chkp
4384 make_pass_chkp (gcc::context
*ctxt
)
4386 return new pass_chkp (ctxt
);
4389 #include "gt-tree-chkp.h"