gcc/ipa-chkp.c

   1 /* Pointer Bounds Checker IPA passes.
   2    Copyright (C) 2014-2015 Free Software Foundation, Inc.
   3    Contributed by Ilya Enkovich (ilya.enkovich@intel.com)
   4
   5 This file is part of GCC.
   6
   7 GCC is free software; you can redistribute it and/or modify it under
   8 the terms of the GNU General Public License as published by the Free
   9 Software Foundation; either version 3, or (at your option) any later
  10 version.
  11
  12 GCC is distributed in the hope that it will be useful, but WITHOUT ANY
  13 WARRANTY; without even the implied warranty of MERCHANTABILITY or
  14 FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  15 for more details.
  16
  17 You should have received a copy of the GNU General Public License
  18 along with GCC; see the file COPYING3.  If not see
  19 <http://www.gnu.org/licenses/>.  */
  20
  21 #include "config.h"
  22 #include "system.h"
  23 #include "coretypes.h"
  24 #include "alias.h"
  25 #include "backend.h"
  26 #include "tree.h"
  27 #include "gimple.h"
  28 #include "hard-reg-set.h"
  29 #include "options.h"
  30 #include "fold-const.h"
  31 #include "stor-layout.h"
  32 #include "tree-pass.h"
  33 #include "stringpool.h"
  34 #include "calls.h"
  35 #include "lto-streamer.h"
  36 #include "cgraph.h"
  37 #include "tree-chkp.h"
  38 #include "tree-inline.h"
  39 #include "ipa-chkp.h"
  40
  41 /*  Pointer Bounds Checker has two IPA passes to support code instrumentation.
  42
  43     In instrumented code each pointer is provided with bounds.  For input
  44     pointer parameters it means we also have bounds passed.  For calls it
  45     means we have additional bounds arguments for pointer arguments.
  46
  47     To have all IPA optimizations working correctly we have to express
  48     dataflow between passed and received bounds explicitly via additional
  49     entries in function declaration arguments list and in function type.
  50     Since we may have both instrumented and not instrumented code at the
  51     same time, we cannot replace all original functions with their
  52     instrumented variants.  Therefore we create clones (versions) instead.
  53
  54     Instrumentation clones creation is a separate IPA pass which is a part
  55     of early local passes.  Clones are created after SSA is built (because
  56     instrumentation pass works on SSA) and before any transformations
  57     which may change pointer flow and therefore lead to incorrect code
  58     instrumentation (possibly causing false bounds check failures).
  59
  60     Instrumentation clones have pointer bounds arguments added right after
  61     pointer arguments.  Clones have assembler name of the original
  62     function with suffix added.  New assembler name is in transparent
  63     alias chain with the original name.  Thus we expect all calls to the
  64     original and instrumented functions look similar in assembler.
  65
  66     During instrumentation versioning pass we create instrumented versions
  67     of all function with body and also for all their aliases and thunks.
  68     Clones for functions with no body are created on demand (usually
  69     during call instrumentation).
  70
  71     Original and instrumented function nodes are connected with IPA
  72     reference IPA_REF_CHKP.  It is mostly done to have reachability
  73     analysis working correctly.  We may have no references to the
  74     instrumented function in the code but it still should be counted
  75     as reachable if the original function is reachable.
  76
  77     When original function bodies are not needed anymore we release
  78     them and transform functions into a special kind of thunks.  Each
  79     thunk has a call edge to the instrumented version.  These thunks
  80     help to keep externally visible instrumented functions visible
  81     when linker resolution files are used.  Linker has no info about
  82     connection between original and instrumented function and
  83     therefore we may wrongly decide (due to difference in assembler
  84     names) that instrumented function version is local and can be
  85     removed.  */
  86
  87 #define CHKP_BOUNDS_OF_SYMBOL_PREFIX "__chkp_bounds_of_"
  88 #define CHKP_WRAPPER_SYMBOL_PREFIX "__mpx_wrapper_"
  89
  90 /* Return 1 calls to FNDECL should be replaced with
  91    a call to wrapper function.  */
  92 bool
  93 chkp_wrap_function (tree fndecl)
  94 {
  95   if (!flag_chkp_use_wrappers)
  96     return false;
  97
  98   if (DECL_BUILT_IN_CLASS (fndecl) == BUILT_IN_NORMAL)
  99     {
 100       switch (DECL_FUNCTION_CODE (fndecl))
 101         {
 102         case BUILT_IN_STRLEN:
 103         case BUILT_IN_STRCPY:
 104         case BUILT_IN_STRNCPY:
 105         case BUILT_IN_STPCPY:
 106         case BUILT_IN_STPNCPY:
 107         case BUILT_IN_STRCAT:
 108         case BUILT_IN_STRNCAT:
 109         case BUILT_IN_MEMCPY:
 110         case BUILT_IN_MEMPCPY:
 111         case BUILT_IN_MEMSET:
 112         case BUILT_IN_MEMMOVE:
 113         case BUILT_IN_BZERO:
 114         case BUILT_IN_MALLOC:
 115         case BUILT_IN_CALLOC:
 116         case BUILT_IN_REALLOC:
 117           return 1;
 118
 119         default:
 120           return 0;
 121         }
 122     }
 123
 124   return false;
 125 }
 126
 127 static const char *
 128 chkp_wrap_function_name (tree fndecl)
 129 {
 130   gcc_assert (DECL_BUILT_IN_CLASS (fndecl) == BUILT_IN_NORMAL);
 131
 132   switch (DECL_FUNCTION_CODE (fndecl))
 133     {
 134     case BUILT_IN_STRLEN:
 135       return CHKP_WRAPPER_SYMBOL_PREFIX "strlen";
 136     case BUILT_IN_STRCPY:
 137       return CHKP_WRAPPER_SYMBOL_PREFIX "strcpy";
 138     case BUILT_IN_STRNCPY:
 139       return CHKP_WRAPPER_SYMBOL_PREFIX "strncpy";
 140     case BUILT_IN_STPCPY:
 141       return CHKP_WRAPPER_SYMBOL_PREFIX "stpcpy";
 142     case BUILT_IN_STPNCPY:
 143       return CHKP_WRAPPER_SYMBOL_PREFIX "stpncpy";
 144     case BUILT_IN_STRCAT:
 145       return CHKP_WRAPPER_SYMBOL_PREFIX "strcat";
 146     case BUILT_IN_STRNCAT:
 147       return CHKP_WRAPPER_SYMBOL_PREFIX "strncat";
 148     case BUILT_IN_MEMCPY:
 149       return CHKP_WRAPPER_SYMBOL_PREFIX "memcpy";
 150     case BUILT_IN_MEMPCPY:
 151       return CHKP_WRAPPER_SYMBOL_PREFIX "mempcpy";
 152     case BUILT_IN_MEMSET:
 153       return CHKP_WRAPPER_SYMBOL_PREFIX "memset";
 154     case BUILT_IN_MEMMOVE:
 155       return CHKP_WRAPPER_SYMBOL_PREFIX "memmove";
 156     case BUILT_IN_BZERO:
 157       return CHKP_WRAPPER_SYMBOL_PREFIX "bzero";
 158     case BUILT_IN_MALLOC:
 159       return CHKP_WRAPPER_SYMBOL_PREFIX "malloc";
 160     case BUILT_IN_CALLOC:
 161       return CHKP_WRAPPER_SYMBOL_PREFIX "calloc";
 162     case BUILT_IN_REALLOC:
 163       return CHKP_WRAPPER_SYMBOL_PREFIX "realloc";
 164
 165     default:
 166       gcc_unreachable ();
 167     }
 168
 169   return "";
 170 }
 171
 172 /* Build a clone of FNDECL with a modified name.  */
 173
 174 static tree
 175 chkp_build_instrumented_fndecl (tree fndecl)
 176 {
 177   tree new_decl = copy_node (fndecl);
 178   tree new_name;
 179   std::string s;
 180
 181   /* called_as_built_in checks DECL_NAME to identify calls to
 182      builtins.  We want instrumented calls to builtins to be
 183      recognized by called_as_built_in.  Therefore use original
 184      DECL_NAME for cloning with no prefixes.  */
 185   s = IDENTIFIER_POINTER (DECL_NAME (fndecl));
 186   s += ".chkp";
 187   DECL_NAME (new_decl) = get_identifier (s.c_str ());
 188
 189   /* References to the original and to the instrumented version
 190      should look the same in the output assembly.  And we cannot
 191      use the same assembler name for the instrumented version
 192      because it conflicts with decl merging algorithms in LTO.
 193      Achieve the result by using transparent alias name for the
 194      instrumented version.  */
 195   if (chkp_wrap_function(fndecl))
 196     {
 197       new_name = get_identifier (chkp_wrap_function_name (fndecl));
 198       DECL_VISIBILITY (new_decl) = VISIBILITY_DEFAULT;
 199     }
 200   else
 201     {
 202       s = IDENTIFIER_POINTER (DECL_ASSEMBLER_NAME (fndecl));
 203       s += ".chkp";
 204       new_name = get_identifier (s.c_str ());
 205       IDENTIFIER_TRANSPARENT_ALIAS (new_name) = 1;
 206       TREE_CHAIN (new_name) = DECL_ASSEMBLER_NAME (fndecl);
 207     }
 208   SET_DECL_ASSEMBLER_NAME (new_decl, new_name);
 209
 210   /* For functions with body versioning will make a copy of arguments.
 211      For functions with no body we need to do it here.  */
 212   if (!gimple_has_body_p (fndecl))
 213     DECL_ARGUMENTS (new_decl) = copy_list (DECL_ARGUMENTS (fndecl));
 214
 215   /* We are going to modify attributes list and therefore should
 216      make own copy.  */
 217   DECL_ATTRIBUTES (new_decl) = copy_list (DECL_ATTRIBUTES (fndecl));
 218
 219   /* Change builtin function code.  */
 220   if (DECL_BUILT_IN (new_decl))
 221     {
 222       gcc_assert (DECL_BUILT_IN_CLASS (new_decl) == BUILT_IN_NORMAL);
 223       gcc_assert (DECL_FUNCTION_CODE (new_decl) < BEGIN_CHKP_BUILTINS);
 224       DECL_FUNCTION_CODE (new_decl)
 225         = (enum built_in_function)(DECL_FUNCTION_CODE (new_decl)
 226                                    + BEGIN_CHKP_BUILTINS + 1);
 227     }
 228
 229   return new_decl;
 230 }
 231
 232
 233 /* Fix operands of attribute from ATTRS list named ATTR_NAME.
 234    Integer operands are replaced with values according to
 235    INDEXES map having LEN elements.  For operands out of len
 236    we just add DELTA.  */
 237
 238 static void
 239 chkp_map_attr_arg_indexes (tree attrs, const char *attr_name,
 240                            unsigned *indexes, int len, int delta)
 241 {
 242   tree attr = lookup_attribute (attr_name, attrs);
 243   tree op;
 244
 245   if (!attr)
 246     return;
 247
 248   TREE_VALUE (attr) = copy_list (TREE_VALUE (attr));
 249   for (op = TREE_VALUE (attr); op; op = TREE_CHAIN (op))
 250     {
 251       int idx;
 252
 253       if (TREE_CODE (TREE_VALUE (op)) != INTEGER_CST)
 254         continue;
 255
 256       idx = TREE_INT_CST_LOW (TREE_VALUE (op));
 257
 258       /* If idx exceeds indexes length then we just
 259          keep it at the same distance from the last
 260          known arg.  */
 261       if (idx > len)
 262         idx += delta;
 263       else
 264         idx = indexes[idx - 1] + 1;
 265       TREE_VALUE (op) = build_int_cst (TREE_TYPE (TREE_VALUE (op)), idx);
 266     }
 267 }
 268
 269 /* Make a copy of function type ORIG_TYPE adding pointer
 270    bounds as additional arguments.  */
 271
 272 tree
 273 chkp_copy_function_type_adding_bounds (tree orig_type)
 274 {
 275   tree type;
 276   tree arg_type, attrs;
 277   unsigned len = list_length (TYPE_ARG_TYPES (orig_type));
 278   unsigned *indexes = XALLOCAVEC (unsigned, len);
 279   unsigned idx = 0, new_idx = 0;
 280
 281   for (arg_type = TYPE_ARG_TYPES (orig_type);
 282        arg_type;
 283        arg_type = TREE_CHAIN (arg_type))
 284     if (TREE_VALUE (arg_type) == void_type_node)
 285       continue;
 286     else if (BOUNDED_TYPE_P (TREE_VALUE (arg_type))
 287              || pass_by_reference (NULL, TYPE_MODE (TREE_VALUE (arg_type)),
 288                                    TREE_VALUE (arg_type), true)
 289              || chkp_type_has_pointer (TREE_VALUE (arg_type)))
 290       break;
 291
 292   /* We may use original type if there are no bounds passed.  */
 293   if (!arg_type)
 294     return orig_type;
 295
 296   type = build_distinct_type_copy (orig_type);
 297   TYPE_ARG_TYPES (type) = copy_list (TYPE_ARG_TYPES (type));
 298
 299   for (arg_type = TYPE_ARG_TYPES (type);
 300        arg_type;
 301        arg_type = TREE_CHAIN (arg_type))
 302     {
 303       indexes[idx++] = new_idx++;
 304
 305       /* pass_by_reference returns 1 for void type,
 306          so check for it first.  */
 307       if (TREE_VALUE (arg_type) == void_type_node)
 308         continue;
 309       else if (BOUNDED_TYPE_P (TREE_VALUE (arg_type))
 310                || pass_by_reference (NULL, TYPE_MODE (TREE_VALUE (arg_type)),
 311                                      TREE_VALUE (arg_type), true))
 312         {
 313           tree new_type = build_tree_list (NULL_TREE,
 314                                            pointer_bounds_type_node);
 315           TREE_CHAIN (new_type) = TREE_CHAIN (arg_type);
 316           TREE_CHAIN (arg_type) = new_type;
 317
 318           arg_type = TREE_CHAIN (arg_type);
 319           new_idx++;
 320         }
 321       else if (chkp_type_has_pointer (TREE_VALUE (arg_type)))
 322         {
 323           bitmap slots = BITMAP_ALLOC (NULL);
 324           bitmap_iterator bi;
 325           unsigned bnd_no;
 326
 327           chkp_find_bound_slots (TREE_VALUE (arg_type), slots);
 328
 329           EXECUTE_IF_SET_IN_BITMAP (slots, 0, bnd_no, bi)
 330             {
 331               tree new_type = build_tree_list (NULL_TREE,
 332                                                pointer_bounds_type_node);
 333               TREE_CHAIN (new_type) = TREE_CHAIN (arg_type);
 334               TREE_CHAIN (arg_type) = new_type;
 335
 336               arg_type = TREE_CHAIN (arg_type);
 337               new_idx++;
 338             }
 339           BITMAP_FREE (slots);
 340         }
 341     }
 342
 343   /* If function type has attribute with arg indexes then
 344      we have to copy it fixing attribute ops.  Map for
 345      fixing is in indexes array.  */
 346   attrs = TYPE_ATTRIBUTES (type);
 347   if (lookup_attribute ("nonnull", attrs)
 348       || lookup_attribute ("format", attrs)
 349       || lookup_attribute ("format_arg", attrs))
 350     {
 351       int delta = new_idx - len;
 352       attrs = copy_list (TYPE_ATTRIBUTES (type));
 353       chkp_map_attr_arg_indexes (attrs, "nonnull", indexes, len, delta);
 354       chkp_map_attr_arg_indexes (attrs, "format", indexes, len, delta);
 355       chkp_map_attr_arg_indexes (attrs, "format_arg", indexes, len, delta);
 356       TYPE_ATTRIBUTES (type) = attrs;
 357     }
 358
 359   return type;
 360 }
 361
 362 /* For given function FNDECL add bounds arguments to arguments
 363    list.  */
 364
 365 static void
 366 chkp_add_bounds_params_to_function (tree fndecl)
 367 {
 368   tree arg;
 369
 370   for (arg = DECL_ARGUMENTS (fndecl); arg; arg = DECL_CHAIN (arg))
 371     if (BOUNDED_P (arg))
 372       {
 373         std::string new_name = CHKP_BOUNDS_OF_SYMBOL_PREFIX;
 374         tree new_arg;
 375
 376         if (DECL_NAME (arg))
 377           new_name += IDENTIFIER_POINTER (DECL_NAME (arg));
 378         else
 379           {
 380             char uid[25];
 381             snprintf (uid, 25, "D.%u", DECL_UID (arg));
 382             new_name += uid;
 383           }
 384
 385         new_arg = build_decl (DECL_SOURCE_LOCATION (arg), PARM_DECL,
 386                               get_identifier (new_name.c_str ()),
 387                               pointer_bounds_type_node);
 388         DECL_ARG_TYPE (new_arg) = pointer_bounds_type_node;
 389         DECL_CONTEXT (new_arg) = DECL_CONTEXT (arg);
 390         DECL_ARTIFICIAL (new_arg) = 1;
 391         DECL_CHAIN (new_arg) = DECL_CHAIN (arg);
 392         DECL_CHAIN (arg) = new_arg;
 393
 394         arg = DECL_CHAIN (arg);
 395
 396       }
 397     else if (chkp_type_has_pointer (TREE_TYPE (arg)))
 398       {
 399         tree orig_arg = arg;
 400         bitmap slots = BITMAP_ALLOC (NULL);
 401         bitmap_iterator bi;
 402         unsigned bnd_no;
 403
 404         chkp_find_bound_slots (TREE_TYPE (arg), slots);
 405
 406         EXECUTE_IF_SET_IN_BITMAP (slots, 0, bnd_no, bi)
 407           {
 408             std::string new_name = CHKP_BOUNDS_OF_SYMBOL_PREFIX;
 409             tree new_arg;
 410             char offs[25];
 411
 412             if (DECL_NAME (orig_arg))
 413               new_name += IDENTIFIER_POINTER (DECL_NAME (orig_arg));
 414             else
 415               {
 416                 snprintf (offs, 25, "D.%u", DECL_UID (arg));
 417                 new_name += offs;
 418               }
 419             snprintf (offs, 25, "__%u", bnd_no * POINTER_SIZE / BITS_PER_UNIT);
 420
 421             new_arg = build_decl (DECL_SOURCE_LOCATION (orig_arg),
 422                                   PARM_DECL,
 423                                   get_identifier (new_name.c_str ()),
 424                                   pointer_bounds_type_node);
 425             DECL_ARG_TYPE (new_arg) = pointer_bounds_type_node;
 426             DECL_CONTEXT (new_arg) = DECL_CONTEXT (orig_arg);
 427             DECL_ARTIFICIAL (new_arg) = 1;
 428             DECL_CHAIN (new_arg) = DECL_CHAIN (arg);
 429             DECL_CHAIN (arg) = new_arg;
 430
 431             arg = DECL_CHAIN (arg);
 432           }
 433         BITMAP_FREE (slots);
 434       }
 435
 436   TREE_TYPE (fndecl) =
 437     chkp_copy_function_type_adding_bounds (TREE_TYPE (fndecl));
 438 }
 439
 440 /* Return an instrumentation clone for builtin function
 441    FNDECL.  Create one if needed.  */
 442
 443 tree
 444 chkp_maybe_clone_builtin_fndecl (tree fndecl)
 445 {
 446   tree clone;
 447   enum built_in_function fcode = DECL_FUNCTION_CODE (fndecl);
 448
 449   gcc_assert (DECL_BUILT_IN_CLASS (fndecl) == BUILT_IN_NORMAL
 450               && fcode < BEGIN_CHKP_BUILTINS);
 451
 452   fcode = (enum built_in_function) (fcode + BEGIN_CHKP_BUILTINS + 1);
 453   clone = builtin_decl_explicit (fcode);
 454   if (clone)
 455     return clone;
 456
 457   clone = chkp_build_instrumented_fndecl (fndecl);
 458   chkp_add_bounds_params_to_function (clone);
 459
 460   gcc_assert (DECL_FUNCTION_CODE (clone) == fcode);
 461
 462   set_builtin_decl (fcode, clone, false);
 463
 464   return clone;
 465 }
 466
 467 /* Return 1 if function FNDECL should be instrumented.  */
 468
 469 bool
 470 chkp_instrumentable_p (tree fndecl)
 471 {
 472   struct function *fn = DECL_STRUCT_FUNCTION (fndecl);
 473   return (!lookup_attribute ("bnd_legacy", DECL_ATTRIBUTES (fndecl))
 474           && (!flag_chkp_instrument_marked_only
 475               || lookup_attribute ("bnd_instrument", DECL_ATTRIBUTES (fndecl)))
 476           && (!fn || !copy_forbidden (fn, fndecl)));
 477 }
 478
 479 /* Return clone created for instrumentation of NODE or NULL.  */
 480
 481 cgraph_node *
 482 chkp_maybe_create_clone (tree fndecl)
 483 {
 484   cgraph_node *node = cgraph_node::get_create (fndecl);
 485   cgraph_node *clone = node->instrumented_version;
 486
 487   gcc_assert (!node->instrumentation_clone);
 488
 489   if (DECL_BUILT_IN (fndecl)
 490       && (DECL_BUILT_IN_CLASS (fndecl) != BUILT_IN_NORMAL
 491           || DECL_FUNCTION_CODE (fndecl) >= BEGIN_CHKP_BUILTINS))
 492     return NULL;
 493
 494   clone = node->instrumented_version;
 495
 496   /* Some instrumented builtin function calls may be optimized and
 497      cgraph nodes may be removed as unreachable.  Later optimizations
 498      may generate new calls to removed functions and in this case
 499      we have to recreate cgraph node.  FUNCTION_DECL for instrumented
 500      builtin still exists and should be reused in such case.  */
 501   if (DECL_BUILT_IN_CLASS (fndecl) == BUILT_IN_NORMAL
 502       && fndecl == builtin_decl_explicit (DECL_FUNCTION_CODE (fndecl))
 503       && !clone)
 504     {
 505       enum built_in_function fncode = DECL_FUNCTION_CODE (fndecl);
 506       tree new_decl;
 507
 508       fncode = (enum built_in_function) (fncode + BEGIN_CHKP_BUILTINS + 1);
 509       new_decl = builtin_decl_explicit (fncode);
 510
 511       /* We've actually already created an instrumented clone once.
 512          Restore it.  */
 513       if (new_decl)
 514         {
 515           clone = cgraph_node::get (new_decl);
 516
 517           if (!clone)
 518             {
 519               gcc_assert (!gimple_has_body_p (fndecl));
 520               clone = cgraph_node::get_create (new_decl);
 521               clone->externally_visible = node->externally_visible;
 522               clone->local = node->local;
 523               clone->address_taken = node->address_taken;
 524               clone->thunk = node->thunk;
 525               clone->alias = node->alias;
 526               clone->weakref = node->weakref;
 527               clone->cpp_implicit_alias = node->cpp_implicit_alias;
 528               clone->orig_decl = fndecl;
 529               clone->instrumentation_clone = true;
 530             }
 531
 532           clone->instrumented_version = node;
 533           node->instrumented_version = clone;
 534         }
 535     }
 536
 537   if (!clone)
 538     {
 539       tree new_decl = chkp_build_instrumented_fndecl (fndecl);
 540       struct cgraph_edge *e;
 541       struct ipa_ref *ref;
 542       int i;
 543
 544       clone = node->create_version_clone (new_decl, vNULL, NULL);
 545       clone->externally_visible = node->externally_visible;
 546       clone->local = node->local;
 547       clone->address_taken = node->address_taken;
 548       clone->thunk = node->thunk;
 549       clone->alias = node->alias;
 550       clone->weakref = node->weakref;
 551       clone->cpp_implicit_alias = node->cpp_implicit_alias;
 552       clone->instrumented_version = node;
 553       clone->orig_decl = fndecl;
 554       clone->instrumentation_clone = true;
 555       node->instrumented_version = clone;
 556
 557       if (gimple_has_body_p (fndecl))
 558         {
 559           gcc_assert (chkp_instrumentable_p (fndecl));
 560           tree_function_versioning (fndecl, new_decl, NULL, false,
 561                                     NULL, false, NULL, NULL);
 562           clone->lowered = true;
 563         }
 564
 565       /* New params are inserted after versioning because it
 566          actually copies args list from the original decl.  */
 567       chkp_add_bounds_params_to_function (new_decl);
 568
 569       /* Remember builtin fndecl.  */
 570       if (DECL_BUILT_IN_CLASS (clone->decl) == BUILT_IN_NORMAL
 571           && fndecl == builtin_decl_explicit (DECL_FUNCTION_CODE (fndecl)))
 572         {
 573           gcc_assert (!builtin_decl_explicit (DECL_FUNCTION_CODE (clone->decl)));
 574           set_builtin_decl (DECL_FUNCTION_CODE (clone->decl),
 575                             clone->decl, false);
 576         }
 577
 578       /* Clones have the same comdat group as originals.  */
 579       if (node->same_comdat_group
 580           || (DECL_ONE_ONLY (node->decl)
 581               && !DECL_EXTERNAL (node->decl)))
 582         clone->add_to_same_comdat_group (node);
 583
 584       if (gimple_has_body_p (fndecl))
 585         symtab->call_cgraph_insertion_hooks (clone);
 586
 587       /* Clone all aliases.  */
 588       for (i = 0; node->iterate_direct_aliases (i, ref); i++)
 589         chkp_maybe_create_clone (ref->referring->decl);
 590
 591       /* Clone all thunks.  */
 592       for (e = node->callers; e; e = e->next_caller)
 593         if (e->caller->thunk.thunk_p
 594             && !e->caller->thunk.add_pointer_bounds_args
 595             && !e->caller->instrumentation_clone)
 596           {
 597             struct cgraph_node *thunk
 598               = chkp_maybe_create_clone (e->caller->decl);
 599             /* Redirect thunk clone edge to the node clone.  */
 600             thunk->callees->redirect_callee (clone);
 601           }
 602
 603       /* For aliases and thunks we should make sure target is cloned
 604          to have proper references and edges.  */
 605       if (node->thunk.thunk_p)
 606         chkp_maybe_create_clone (node->callees->callee->decl);
 607       else if (node->alias)
 608         {
 609           struct cgraph_node *target;
 610
 611           ref = node->ref_list.first_reference ();
 612           if (ref)
 613             {
 614               target = chkp_maybe_create_clone (ref->referred->decl);
 615               clone->create_reference (target, IPA_REF_ALIAS);
 616             }
 617
 618           if (node->alias_target)
 619             {
 620               if (TREE_CODE (node->alias_target) == FUNCTION_DECL)
 621                 {
 622                   target = chkp_maybe_create_clone (node->alias_target);
 623                   clone->alias_target = target->decl;
 624                 }
 625               else
 626                 clone->alias_target = node->alias_target;
 627             }
 628         }
 629
 630       /* Add IPA reference.  It's main role is to keep instrumented
 631          version reachable while original node is reachable.  */
 632       ref = node->create_reference (clone, IPA_REF_CHKP, NULL);
 633     }
 634
 635   return clone;
 636 }
 637
 638 /* Create clone for all functions to be instrumented.  */
 639
 640 static unsigned int
 641 chkp_versioning (void)
 642 {
 643   struct cgraph_node *node;
 644   const char *reason;
 645
 646   bitmap_obstack_initialize (NULL);
 647
 648   FOR_EACH_DEFINED_FUNCTION (node)
 649     {
 650       if (!node->instrumentation_clone
 651           && !node->instrumented_version
 652           && !node->alias
 653           && !node->thunk.thunk_p
 654           && (!DECL_BUILT_IN (node->decl)
 655               || (DECL_BUILT_IN_CLASS (node->decl) == BUILT_IN_NORMAL
 656                   && DECL_FUNCTION_CODE (node->decl) < BEGIN_CHKP_BUILTINS)))
 657         {
 658           if (chkp_instrumentable_p (node->decl))
 659             chkp_maybe_create_clone (node->decl);
 660           else if ((reason = copy_forbidden (DECL_STRUCT_FUNCTION (node->decl),
 661                                              node->decl)))
 662             {
 663               if (warning_at (DECL_SOURCE_LOCATION (node->decl), OPT_Wchkp,
 664                               "function cannot be instrumented"))
 665                 inform (DECL_SOURCE_LOCATION (node->decl), reason, node->decl);
 666             }
 667         }
 668     }
 669
 670   /* Mark all aliases and thunks of functions with no instrumented
 671      version as legacy function.  */
 672   FOR_EACH_DEFINED_FUNCTION (node)
 673     {
 674       if (!node->instrumentation_clone
 675           && !node->instrumented_version
 676           && (node->alias || node->thunk.thunk_p)
 677           && !lookup_attribute ("bnd_legacy", DECL_ATTRIBUTES (node->decl)))
 678         DECL_ATTRIBUTES (node->decl)
 679           = tree_cons (get_identifier ("bnd_legacy"), NULL,
 680                        DECL_ATTRIBUTES (node->decl));
 681     }
 682
 683   bitmap_obstack_release (NULL);
 684
 685   return 0;
 686 }
 687
 688 /* In this pass we remove bodies of functions having
 689    instrumented version.  Functions with removed bodies
 690    become a special kind of thunks to provide a connection
 691    between calls to the original version and instrumented
 692    function.  */
 693
 694 static unsigned int
 695 chkp_produce_thunks (bool early)
 696 {
 697   struct cgraph_node *node;
 698
 699   FOR_EACH_DEFINED_FUNCTION (node)
 700     {
 701       if (!node->instrumentation_clone
 702           && node->instrumented_version
 703           && gimple_has_body_p (node->decl)
 704           && gimple_has_body_p (node->instrumented_version->decl)
 705           && (!lookup_attribute ("always_inline", DECL_ATTRIBUTES (node->decl))
 706               || !early))
 707         {
 708           node->release_body ();
 709           node->remove_callees ();
 710           node->remove_all_references ();
 711
 712           node->thunk.thunk_p = true;
 713           node->thunk.add_pointer_bounds_args = true;
 714           node->create_edge (node->instrumented_version, NULL,
 715                              0, CGRAPH_FREQ_BASE);
 716           node->create_reference (node->instrumented_version,
 717                                IPA_REF_CHKP, NULL);
 718           /* Thunk shouldn't be a cdtor.  */
 719           DECL_STATIC_CONSTRUCTOR (node->decl) = 0;
 720           DECL_STATIC_DESTRUCTOR (node->decl) = 0;
 721         }
 722     }
 723
 724   /* Mark instrumentation clones created for aliases and thunks
 725      as insttrumented so they could be removed as unreachable
 726      now.  */
 727   if (!early)
 728     {
 729       FOR_EACH_DEFINED_FUNCTION (node)
 730       {
 731         if (node->instrumentation_clone
 732             && (node->alias || node->thunk.thunk_p)
 733             && !chkp_function_instrumented_p (node->decl))
 734           chkp_function_mark_instrumented (node->decl);
 735       }
 736     }
 737
 738   return TODO_remove_functions;
 739 }
 740
 741 const pass_data pass_data_ipa_chkp_versioning =
 742 {
 743   SIMPLE_IPA_PASS, /* type */
 744   "chkp_versioning", /* name */
 745   OPTGROUP_NONE, /* optinfo_flags */
 746   TV_NONE, /* tv_id */
 747   0, /* properties_required */
 748   0, /* properties_provided */
 749   0, /* properties_destroyed */
 750   0, /* todo_flags_start */
 751   0 /* todo_flags_finish */
 752 };
 753
 754 const pass_data pass_data_ipa_chkp_early_produce_thunks =
 755 {
 756   SIMPLE_IPA_PASS, /* type */
 757   "chkp_ecleanup", /* name */
 758   OPTGROUP_NONE, /* optinfo_flags */
 759   TV_NONE, /* tv_id */
 760   0, /* properties_required */
 761   0, /* properties_provided */
 762   0, /* properties_destroyed */
 763   0, /* todo_flags_start */
 764   0 /* todo_flags_finish */
 765 };
 766
 767 const pass_data pass_data_ipa_chkp_produce_thunks =
 768 {
 769   SIMPLE_IPA_PASS, /* type */
 770   "chkp_cleanup", /* name */
 771   OPTGROUP_NONE, /* optinfo_flags */
 772   TV_NONE, /* tv_id */
 773   0, /* properties_required */
 774   0, /* properties_provided */
 775   0, /* properties_destroyed */
 776   0, /* todo_flags_start */
 777   0 /* todo_flags_finish */
 778 };
 779
 780 class pass_ipa_chkp_versioning : public simple_ipa_opt_pass
 781 {
 782 public:
 783   pass_ipa_chkp_versioning (gcc::context *ctxt)
 784     : simple_ipa_opt_pass (pass_data_ipa_chkp_versioning, ctxt)
 785   {}
 786
 787   /* opt_pass methods: */
 788   virtual opt_pass * clone ()
 789     {
 790       return new pass_ipa_chkp_versioning (m_ctxt);
 791     }
 792
 793   virtual bool gate (function *)
 794     {
 795       return flag_check_pointer_bounds;
 796     }
 797
 798   virtual unsigned int execute (function *)
 799     {
 800       return chkp_versioning ();
 801     }
 802
 803 }; // class pass_ipa_chkp_versioning
 804
 805 class pass_ipa_chkp_early_produce_thunks : public simple_ipa_opt_pass
 806 {
 807 public:
 808   pass_ipa_chkp_early_produce_thunks (gcc::context *ctxt)
 809     : simple_ipa_opt_pass (pass_data_ipa_chkp_early_produce_thunks, ctxt)
 810   {}
 811
 812   /* opt_pass methods: */
 813   virtual opt_pass * clone ()
 814     {
 815       return new pass_ipa_chkp_early_produce_thunks (m_ctxt);
 816     }
 817
 818   virtual bool gate (function *)
 819     {
 820       return flag_check_pointer_bounds;
 821     }
 822
 823   virtual unsigned int execute (function *)
 824     {
 825       return chkp_produce_thunks (true);
 826     }
 827
 828 }; // class pass_chkp_produce_thunks
 829
 830 class pass_ipa_chkp_produce_thunks : public simple_ipa_opt_pass
 831 {
 832 public:
 833   pass_ipa_chkp_produce_thunks (gcc::context *ctxt)
 834     : simple_ipa_opt_pass (pass_data_ipa_chkp_produce_thunks, ctxt)
 835   {}
 836
 837   /* opt_pass methods: */
 838   virtual opt_pass * clone ()
 839     {
 840       return new pass_ipa_chkp_produce_thunks (m_ctxt);
 841     }
 842
 843   virtual bool gate (function *)
 844     {
 845       return flag_check_pointer_bounds;
 846     }
 847
 848   virtual unsigned int execute (function *)
 849     {
 850       return chkp_produce_thunks (false);
 851     }
 852
 853 }; // class pass_chkp_produce_thunks
 854
 855 simple_ipa_opt_pass *
 856 make_pass_ipa_chkp_versioning (gcc::context *ctxt)
 857 {
 858   return new pass_ipa_chkp_versioning (ctxt);
 859 }
 860
 861 simple_ipa_opt_pass *
 862 make_pass_ipa_chkp_early_produce_thunks (gcc::context *ctxt)
 863 {
 864   return new pass_ipa_chkp_early_produce_thunks (ctxt);
 865 }
 866
 867 simple_ipa_opt_pass *
 868 make_pass_ipa_chkp_produce_thunks (gcc::context *ctxt)
 869 {
 870   return new pass_ipa_chkp_produce_thunks (ctxt);
 871 }