Improve max_insns_skipped logic
[official-gcc.git] / gcc / sanopt.c
blobd17c7db3321b37acf1fe3be813425ae3a7850e79
1 /* Optimize and expand sanitizer functions.
2 Copyright (C) 2014-2017 Free Software Foundation, Inc.
3 Contributed by Marek Polacek <polacek@redhat.com>
5 This file is part of GCC.
7 GCC is free software; you can redistribute it and/or modify it under
8 the terms of the GNU General Public License as published by the Free
9 Software Foundation; either version 3, or (at your option) any later
10 version.
12 GCC is distributed in the hope that it will be useful, but WITHOUT ANY
13 WARRANTY; without even the implied warranty of MERCHANTABILITY or
14 FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
15 for more details.
17 You should have received a copy of the GNU General Public License
18 along with GCC; see the file COPYING3. If not see
19 <http://www.gnu.org/licenses/>. */
21 #include "config.h"
22 #include "system.h"
23 #include "coretypes.h"
24 #include "backend.h"
25 #include "tree.h"
26 #include "gimple.h"
27 #include "ssa.h"
28 #include "tree-pass.h"
29 #include "tree-ssa-operands.h"
30 #include "gimple-pretty-print.h"
31 #include "fold-const.h"
32 #include "gimple-iterator.h"
33 #include "stringpool.h"
34 #include "attribs.h"
35 #include "asan.h"
36 #include "ubsan.h"
37 #include "params.h"
38 #include "tree-hash-traits.h"
39 #include "gimple-ssa.h"
40 #include "tree-phinodes.h"
41 #include "ssa-iterators.h"
42 #include "gimplify.h"
43 #include "gimple-iterator.h"
44 #include "gimple-walk.h"
45 #include "cfghooks.h"
46 #include "tree-dfa.h"
47 #include "tree-ssa.h"
49 /* This is used to carry information about basic blocks. It is
50 attached to the AUX field of the standard CFG block. */
52 struct sanopt_info
54 /* True if this BB might call (directly or indirectly) free/munmap
55 or similar operation. */
56 bool has_freeing_call_p;
58 /* True if HAS_FREEING_CALL_P flag has been computed. */
59 bool has_freeing_call_computed_p;
61 /* True if there is a block with HAS_FREEING_CALL_P flag set
62 on any path between an immediate dominator of BB, denoted
63 imm(BB), and BB. */
64 bool imm_dom_path_with_freeing_call_p;
66 /* True if IMM_DOM_PATH_WITH_FREEING_CALL_P has been computed. */
67 bool imm_dom_path_with_freeing_call_computed_p;
69 /* Number of possibly freeing calls encountered in this bb
70 (so far). */
71 uint64_t freeing_call_events;
73 /* True if BB is currently being visited during computation
74 of IMM_DOM_PATH_WITH_FREEING_CALL_P flag. */
75 bool being_visited_p;
77 /* True if this BB has been visited in the dominator walk. */
78 bool visited_p;
81 /* If T has a single definition of form T = T2, return T2. */
83 static tree
84 maybe_get_single_definition (tree t)
86 if (TREE_CODE (t) == SSA_NAME)
88 gimple *g = SSA_NAME_DEF_STMT (t);
89 if (gimple_assign_single_p (g))
90 return gimple_assign_rhs1 (g);
92 return NULL_TREE;
95 /* Tree triplet for vptr_check_map. */
96 struct sanopt_tree_triplet
98 tree t1, t2, t3;
101 /* Traits class for tree triplet hash maps below. */
103 struct sanopt_tree_triplet_hash : typed_noop_remove <sanopt_tree_triplet>
105 typedef sanopt_tree_triplet value_type;
106 typedef sanopt_tree_triplet compare_type;
108 static inline hashval_t
109 hash (const sanopt_tree_triplet &ref)
111 inchash::hash hstate (0);
112 inchash::add_expr (ref.t1, hstate);
113 inchash::add_expr (ref.t2, hstate);
114 inchash::add_expr (ref.t3, hstate);
115 return hstate.end ();
118 static inline bool
119 equal (const sanopt_tree_triplet &ref1, const sanopt_tree_triplet &ref2)
121 return operand_equal_p (ref1.t1, ref2.t1, 0)
122 && operand_equal_p (ref1.t2, ref2.t2, 0)
123 && operand_equal_p (ref1.t3, ref2.t3, 0);
126 static inline void
127 mark_deleted (sanopt_tree_triplet &ref)
129 ref.t1 = reinterpret_cast<tree> (1);
132 static inline void
133 mark_empty (sanopt_tree_triplet &ref)
135 ref.t1 = NULL;
138 static inline bool
139 is_deleted (const sanopt_tree_triplet &ref)
141 return ref.t1 == (void *) 1;
144 static inline bool
145 is_empty (const sanopt_tree_triplet &ref)
147 return ref.t1 == NULL;
151 /* This is used to carry various hash maps and variables used
152 in sanopt_optimize_walker. */
154 struct sanopt_ctx
156 /* This map maps a pointer (the first argument of UBSAN_NULL) to
157 a vector of UBSAN_NULL call statements that check this pointer. */
158 hash_map<tree, auto_vec<gimple *> > null_check_map;
160 /* This map maps a pointer (the second argument of ASAN_CHECK) to
161 a vector of ASAN_CHECK call statements that check the access. */
162 hash_map<tree_operand_hash, auto_vec<gimple *> > asan_check_map;
164 /* This map maps a tree triplet (the first, second and fourth argument
165 of UBSAN_VPTR) to a vector of UBSAN_VPTR call statements that check
166 that virtual table pointer. */
167 hash_map<sanopt_tree_triplet_hash, auto_vec<gimple *> > vptr_check_map;
169 /* Number of IFN_ASAN_CHECK statements. */
170 int asan_num_accesses;
172 /* True when the current functions constains an ASAN_MARK. */
173 bool contains_asan_mark;
176 /* Return true if there might be any call to free/munmap operation
177 on any path in between DOM (which should be imm(BB)) and BB. */
179 static bool
180 imm_dom_path_with_freeing_call (basic_block bb, basic_block dom)
182 sanopt_info *info = (sanopt_info *) bb->aux;
183 edge e;
184 edge_iterator ei;
186 if (info->imm_dom_path_with_freeing_call_computed_p)
187 return info->imm_dom_path_with_freeing_call_p;
189 info->being_visited_p = true;
191 FOR_EACH_EDGE (e, ei, bb->preds)
193 sanopt_info *pred_info = (sanopt_info *) e->src->aux;
195 if (e->src == dom)
196 continue;
198 if ((pred_info->imm_dom_path_with_freeing_call_computed_p
199 && pred_info->imm_dom_path_with_freeing_call_p)
200 || (pred_info->has_freeing_call_computed_p
201 && pred_info->has_freeing_call_p))
203 info->imm_dom_path_with_freeing_call_computed_p = true;
204 info->imm_dom_path_with_freeing_call_p = true;
205 info->being_visited_p = false;
206 return true;
210 FOR_EACH_EDGE (e, ei, bb->preds)
212 sanopt_info *pred_info = (sanopt_info *) e->src->aux;
214 if (e->src == dom)
215 continue;
217 if (pred_info->has_freeing_call_computed_p)
218 continue;
220 gimple_stmt_iterator gsi;
221 for (gsi = gsi_start_bb (e->src); !gsi_end_p (gsi); gsi_next (&gsi))
223 gimple *stmt = gsi_stmt (gsi);
224 gasm *asm_stmt;
226 if ((is_gimple_call (stmt) && !nonfreeing_call_p (stmt))
227 || ((asm_stmt = dyn_cast <gasm *> (stmt))
228 && (gimple_asm_clobbers_memory_p (asm_stmt)
229 || gimple_asm_volatile_p (asm_stmt))))
231 pred_info->has_freeing_call_p = true;
232 break;
236 pred_info->has_freeing_call_computed_p = true;
237 if (pred_info->has_freeing_call_p)
239 info->imm_dom_path_with_freeing_call_computed_p = true;
240 info->imm_dom_path_with_freeing_call_p = true;
241 info->being_visited_p = false;
242 return true;
246 FOR_EACH_EDGE (e, ei, bb->preds)
248 if (e->src == dom)
249 continue;
251 basic_block src;
252 for (src = e->src; src != dom; )
254 sanopt_info *pred_info = (sanopt_info *) src->aux;
255 if (pred_info->being_visited_p)
256 break;
257 basic_block imm = get_immediate_dominator (CDI_DOMINATORS, src);
258 if (imm_dom_path_with_freeing_call (src, imm))
260 info->imm_dom_path_with_freeing_call_computed_p = true;
261 info->imm_dom_path_with_freeing_call_p = true;
262 info->being_visited_p = false;
263 return true;
265 src = imm;
269 info->imm_dom_path_with_freeing_call_computed_p = true;
270 info->imm_dom_path_with_freeing_call_p = false;
271 info->being_visited_p = false;
272 return false;
275 /* Get the first dominating check from the list of stored checks.
276 Non-dominating checks are silently dropped. */
278 static gimple *
279 maybe_get_dominating_check (auto_vec<gimple *> &v)
281 for (; !v.is_empty (); v.pop ())
283 gimple *g = v.last ();
284 sanopt_info *si = (sanopt_info *) gimple_bb (g)->aux;
285 if (!si->visited_p)
286 /* At this point we shouldn't have any statements
287 that aren't dominating the current BB. */
288 return g;
290 return NULL;
293 /* Optimize away redundant UBSAN_NULL calls. */
295 static bool
296 maybe_optimize_ubsan_null_ifn (struct sanopt_ctx *ctx, gimple *stmt)
298 gcc_assert (gimple_call_num_args (stmt) == 3);
299 tree ptr = gimple_call_arg (stmt, 0);
300 tree cur_align = gimple_call_arg (stmt, 2);
301 gcc_assert (TREE_CODE (cur_align) == INTEGER_CST);
302 bool remove = false;
304 auto_vec<gimple *> &v = ctx->null_check_map.get_or_insert (ptr);
305 gimple *g = maybe_get_dominating_check (v);
306 if (!g)
308 /* For this PTR we don't have any UBSAN_NULL stmts recorded, so there's
309 nothing to optimize yet. */
310 v.safe_push (stmt);
311 return false;
314 /* We already have recorded a UBSAN_NULL check for this pointer. Perhaps we
315 can drop this one. But only if this check doesn't specify stricter
316 alignment. */
318 tree align = gimple_call_arg (g, 2);
319 int kind = tree_to_shwi (gimple_call_arg (g, 1));
320 /* If this is a NULL pointer check where we had segv anyway, we can
321 remove it. */
322 if (integer_zerop (align)
323 && (kind == UBSAN_LOAD_OF
324 || kind == UBSAN_STORE_OF
325 || kind == UBSAN_MEMBER_ACCESS))
326 remove = true;
327 /* Otherwise remove the check in non-recovering mode, or if the
328 stmts have same location. */
329 else if (integer_zerop (align))
330 remove = (flag_sanitize_recover & SANITIZE_NULL) == 0
331 || flag_sanitize_undefined_trap_on_error
332 || gimple_location (g) == gimple_location (stmt);
333 else if (tree_int_cst_le (cur_align, align))
334 remove = (flag_sanitize_recover & SANITIZE_ALIGNMENT) == 0
335 || flag_sanitize_undefined_trap_on_error
336 || gimple_location (g) == gimple_location (stmt);
338 if (!remove && gimple_bb (g) == gimple_bb (stmt)
339 && tree_int_cst_compare (cur_align, align) == 0)
340 v.pop ();
342 if (!remove)
343 v.safe_push (stmt);
344 return remove;
347 /* Optimize away redundant UBSAN_VPTR calls. The second argument
348 is the value loaded from the virtual table, so rely on FRE to find out
349 when we can actually optimize. */
351 static bool
352 maybe_optimize_ubsan_vptr_ifn (struct sanopt_ctx *ctx, gimple *stmt)
354 gcc_assert (gimple_call_num_args (stmt) == 5);
355 sanopt_tree_triplet triplet;
356 triplet.t1 = gimple_call_arg (stmt, 0);
357 triplet.t2 = gimple_call_arg (stmt, 1);
358 triplet.t3 = gimple_call_arg (stmt, 3);
360 auto_vec<gimple *> &v = ctx->vptr_check_map.get_or_insert (triplet);
361 gimple *g = maybe_get_dominating_check (v);
362 if (!g)
364 /* For this PTR we don't have any UBSAN_VPTR stmts recorded, so there's
365 nothing to optimize yet. */
366 v.safe_push (stmt);
367 return false;
370 return true;
373 /* Returns TRUE if ASan check of length LEN in block BB can be removed
374 if preceded by checks in V. */
376 static bool
377 can_remove_asan_check (auto_vec<gimple *> &v, tree len, basic_block bb)
379 unsigned int i;
380 gimple *g;
381 gimple *to_pop = NULL;
382 bool remove = false;
383 basic_block last_bb = bb;
384 bool cleanup = false;
386 FOR_EACH_VEC_ELT_REVERSE (v, i, g)
388 basic_block gbb = gimple_bb (g);
389 sanopt_info *si = (sanopt_info *) gbb->aux;
390 if (gimple_uid (g) < si->freeing_call_events)
392 /* If there is a potentially freeing call after g in gbb, we should
393 remove it from the vector, can't use in optimization. */
394 cleanup = true;
395 continue;
398 tree glen = gimple_call_arg (g, 2);
399 gcc_assert (TREE_CODE (glen) == INTEGER_CST);
401 /* If we've checked only smaller length than we want to check now,
402 we can't remove the current stmt. If g is in the same basic block,
403 we want to remove it though, as the current stmt is better. */
404 if (tree_int_cst_lt (glen, len))
406 if (gbb == bb)
408 to_pop = g;
409 cleanup = true;
411 continue;
414 while (last_bb != gbb)
416 /* Paths from last_bb to bb have been checked before.
417 gbb is necessarily a dominator of last_bb, but not necessarily
418 immediate dominator. */
419 if (((sanopt_info *) last_bb->aux)->freeing_call_events)
420 break;
422 basic_block imm = get_immediate_dominator (CDI_DOMINATORS, last_bb);
423 gcc_assert (imm);
424 if (imm_dom_path_with_freeing_call (last_bb, imm))
425 break;
427 last_bb = imm;
429 if (last_bb == gbb)
430 remove = true;
431 break;
434 if (cleanup)
436 unsigned int j = 0, l = v.length ();
437 for (i = 0; i < l; i++)
438 if (v[i] != to_pop
439 && (gimple_uid (v[i])
440 == ((sanopt_info *)
441 gimple_bb (v[i])->aux)->freeing_call_events))
443 if (i != j)
444 v[j] = v[i];
445 j++;
447 v.truncate (j);
450 return remove;
453 /* Optimize away redundant ASAN_CHECK calls. */
455 static bool
456 maybe_optimize_asan_check_ifn (struct sanopt_ctx *ctx, gimple *stmt)
458 gcc_assert (gimple_call_num_args (stmt) == 4);
459 tree ptr = gimple_call_arg (stmt, 1);
460 tree len = gimple_call_arg (stmt, 2);
461 basic_block bb = gimple_bb (stmt);
462 sanopt_info *info = (sanopt_info *) bb->aux;
464 if (TREE_CODE (len) != INTEGER_CST)
465 return false;
466 if (integer_zerop (len))
467 return false;
469 gimple_set_uid (stmt, info->freeing_call_events);
471 auto_vec<gimple *> *ptr_checks = &ctx->asan_check_map.get_or_insert (ptr);
473 tree base_addr = maybe_get_single_definition (ptr);
474 auto_vec<gimple *> *base_checks = NULL;
475 if (base_addr)
477 base_checks = &ctx->asan_check_map.get_or_insert (base_addr);
478 /* Original pointer might have been invalidated. */
479 ptr_checks = ctx->asan_check_map.get (ptr);
482 gimple *g = maybe_get_dominating_check (*ptr_checks);
483 gimple *g2 = NULL;
485 if (base_checks)
486 /* Try with base address as well. */
487 g2 = maybe_get_dominating_check (*base_checks);
489 if (g == NULL && g2 == NULL)
491 /* For this PTR we don't have any ASAN_CHECK stmts recorded, so there's
492 nothing to optimize yet. */
493 ptr_checks->safe_push (stmt);
494 if (base_checks)
495 base_checks->safe_push (stmt);
496 return false;
499 bool remove = false;
501 if (ptr_checks)
502 remove = can_remove_asan_check (*ptr_checks, len, bb);
504 if (!remove && base_checks)
505 /* Try with base address as well. */
506 remove = can_remove_asan_check (*base_checks, len, bb);
508 if (!remove)
510 ptr_checks->safe_push (stmt);
511 if (base_checks)
512 base_checks->safe_push (stmt);
515 return remove;
518 /* Try to optimize away redundant UBSAN_NULL and ASAN_CHECK calls.
520 We walk blocks in the CFG via a depth first search of the dominator
521 tree; we push unique UBSAN_NULL or ASAN_CHECK statements into a vector
522 in the NULL_CHECK_MAP or ASAN_CHECK_MAP hash maps as we enter the
523 blocks. When leaving a block, we mark the block as visited; then
524 when checking the statements in the vector, we ignore statements that
525 are coming from already visited blocks, because these cannot dominate
526 anything anymore. CTX is a sanopt context. */
528 static void
529 sanopt_optimize_walker (basic_block bb, struct sanopt_ctx *ctx)
531 basic_block son;
532 gimple_stmt_iterator gsi;
533 sanopt_info *info = (sanopt_info *) bb->aux;
534 bool asan_check_optimize = (flag_sanitize & SANITIZE_ADDRESS) != 0;
536 for (gsi = gsi_start_bb (bb); !gsi_end_p (gsi);)
538 gimple *stmt = gsi_stmt (gsi);
539 bool remove = false;
541 if (!is_gimple_call (stmt))
543 /* Handle asm volatile or asm with "memory" clobber
544 the same as potentionally freeing call. */
545 gasm *asm_stmt = dyn_cast <gasm *> (stmt);
546 if (asm_stmt
547 && asan_check_optimize
548 && (gimple_asm_clobbers_memory_p (asm_stmt)
549 || gimple_asm_volatile_p (asm_stmt)))
550 info->freeing_call_events++;
551 gsi_next (&gsi);
552 continue;
555 if (asan_check_optimize && !nonfreeing_call_p (stmt))
556 info->freeing_call_events++;
558 /* If __asan_before_dynamic_init ("module"); is followed by
559 __asan_after_dynamic_init (); without intervening memory loads/stores,
560 there is nothing to guard, so optimize both away. */
561 if (asan_check_optimize
562 && gimple_call_builtin_p (stmt, BUILT_IN_ASAN_BEFORE_DYNAMIC_INIT))
564 use_operand_p use;
565 gimple *use_stmt;
566 if (single_imm_use (gimple_vdef (stmt), &use, &use_stmt))
568 if (is_gimple_call (use_stmt)
569 && gimple_call_builtin_p (use_stmt,
570 BUILT_IN_ASAN_AFTER_DYNAMIC_INIT))
572 unlink_stmt_vdef (use_stmt);
573 gimple_stmt_iterator gsi2 = gsi_for_stmt (use_stmt);
574 gsi_remove (&gsi2, true);
575 remove = true;
580 if (gimple_call_internal_p (stmt))
581 switch (gimple_call_internal_fn (stmt))
583 case IFN_UBSAN_NULL:
584 remove = maybe_optimize_ubsan_null_ifn (ctx, stmt);
585 break;
586 case IFN_UBSAN_VPTR:
587 remove = maybe_optimize_ubsan_vptr_ifn (ctx, stmt);
588 break;
589 case IFN_ASAN_CHECK:
590 if (asan_check_optimize)
591 remove = maybe_optimize_asan_check_ifn (ctx, stmt);
592 if (!remove)
593 ctx->asan_num_accesses++;
594 break;
595 case IFN_ASAN_MARK:
596 ctx->contains_asan_mark = true;
597 break;
598 default:
599 break;
602 if (remove)
604 /* Drop this check. */
605 if (dump_file && (dump_flags & TDF_DETAILS))
607 fprintf (dump_file, "Optimizing out\n ");
608 print_gimple_stmt (dump_file, stmt, 0, dump_flags);
609 fprintf (dump_file, "\n");
611 unlink_stmt_vdef (stmt);
612 gsi_remove (&gsi, true);
614 else
615 gsi_next (&gsi);
618 if (asan_check_optimize)
620 info->has_freeing_call_p = info->freeing_call_events != 0;
621 info->has_freeing_call_computed_p = true;
624 for (son = first_dom_son (CDI_DOMINATORS, bb);
625 son;
626 son = next_dom_son (CDI_DOMINATORS, son))
627 sanopt_optimize_walker (son, ctx);
629 /* We're leaving this BB, so mark it to that effect. */
630 info->visited_p = true;
633 /* Try to remove redundant sanitizer checks in function FUN. */
635 static int
636 sanopt_optimize (function *fun, bool *contains_asan_mark)
638 struct sanopt_ctx ctx;
639 ctx.asan_num_accesses = 0;
640 ctx.contains_asan_mark = false;
642 /* Set up block info for each basic block. */
643 alloc_aux_for_blocks (sizeof (sanopt_info));
645 /* We're going to do a dominator walk, so ensure that we have
646 dominance information. */
647 calculate_dominance_info (CDI_DOMINATORS);
649 /* Recursively walk the dominator tree optimizing away
650 redundant checks. */
651 sanopt_optimize_walker (ENTRY_BLOCK_PTR_FOR_FN (fun), &ctx);
653 free_aux_for_blocks ();
655 *contains_asan_mark = ctx.contains_asan_mark;
656 return ctx.asan_num_accesses;
659 /* Perform optimization of sanitize functions. */
661 namespace {
663 const pass_data pass_data_sanopt =
665 GIMPLE_PASS, /* type */
666 "sanopt", /* name */
667 OPTGROUP_NONE, /* optinfo_flags */
668 TV_NONE, /* tv_id */
669 ( PROP_ssa | PROP_cfg | PROP_gimple_leh ), /* properties_required */
670 0, /* properties_provided */
671 0, /* properties_destroyed */
672 0, /* todo_flags_start */
673 TODO_update_ssa, /* todo_flags_finish */
676 class pass_sanopt : public gimple_opt_pass
678 public:
679 pass_sanopt (gcc::context *ctxt)
680 : gimple_opt_pass (pass_data_sanopt, ctxt)
683 /* opt_pass methods: */
684 virtual bool gate (function *) { return flag_sanitize; }
685 virtual unsigned int execute (function *);
687 }; // class pass_sanopt
689 /* Sanitize all ASAN_MARK unpoison calls that are not reachable by a BB
690 that contains an ASAN_MARK poison. All these ASAN_MARK unpoison call
691 can be removed as all variables are unpoisoned in a function prologue. */
693 static void
694 sanitize_asan_mark_unpoison (void)
696 /* 1) Find all BBs that contain an ASAN_MARK poison call. */
697 auto_sbitmap with_poison (last_basic_block_for_fn (cfun) + 1);
698 bitmap_clear (with_poison);
699 basic_block bb;
701 FOR_EACH_BB_FN (bb, cfun)
703 if (bitmap_bit_p (with_poison, bb->index))
704 continue;
706 gimple_stmt_iterator gsi;
707 for (gsi = gsi_last_bb (bb); !gsi_end_p (gsi); gsi_prev (&gsi))
709 gimple *stmt = gsi_stmt (gsi);
710 if (asan_mark_p (stmt, ASAN_MARK_POISON))
712 bitmap_set_bit (with_poison, bb->index);
713 break;
718 auto_sbitmap poisoned (last_basic_block_for_fn (cfun) + 1);
719 bitmap_clear (poisoned);
720 auto_sbitmap worklist (last_basic_block_for_fn (cfun) + 1);
721 bitmap_copy (worklist, with_poison);
723 /* 2) Propagate the information to all reachable blocks. */
724 while (!bitmap_empty_p (worklist))
726 unsigned i = bitmap_first_set_bit (worklist);
727 bitmap_clear_bit (worklist, i);
728 basic_block bb = BASIC_BLOCK_FOR_FN (cfun, i);
729 gcc_assert (bb);
731 edge e;
732 edge_iterator ei;
733 FOR_EACH_EDGE (e, ei, bb->succs)
734 if (!bitmap_bit_p (poisoned, e->dest->index))
736 bitmap_set_bit (poisoned, e->dest->index);
737 bitmap_set_bit (worklist, e->dest->index);
741 /* 3) Iterate all BBs not included in POISONED BBs and remove unpoison
742 ASAN_MARK preceding an ASAN_MARK poison (which can still happen). */
743 FOR_EACH_BB_FN (bb, cfun)
745 if (bitmap_bit_p (poisoned, bb->index))
746 continue;
748 gimple_stmt_iterator gsi;
749 for (gsi = gsi_start_bb (bb); !gsi_end_p (gsi);)
751 gimple *stmt = gsi_stmt (gsi);
752 if (gimple_call_internal_p (stmt, IFN_ASAN_MARK))
754 if (asan_mark_p (stmt, ASAN_MARK_POISON))
755 break;
756 else
758 if (dump_file)
759 fprintf (dump_file, "Removing ASAN_MARK unpoison\n");
760 unlink_stmt_vdef (stmt);
761 release_defs (stmt);
762 gsi_remove (&gsi, true);
763 continue;
767 gsi_next (&gsi);
772 /* Return true when STMT is either ASAN_CHECK call or a call of a function
773 that can contain an ASAN_CHECK. */
775 static bool
776 maybe_contains_asan_check (gimple *stmt)
778 if (is_gimple_call (stmt))
780 if (gimple_call_internal_p (stmt, IFN_ASAN_MARK))
781 return false;
782 else
783 return !(gimple_call_flags (stmt) & ECF_CONST);
785 else if (is_a<gasm *> (stmt))
786 return true;
788 return false;
791 /* Sanitize all ASAN_MARK poison calls that are not followed by an ASAN_CHECK
792 call. These calls can be removed. */
794 static void
795 sanitize_asan_mark_poison (void)
797 /* 1) Find all BBs that possibly contain an ASAN_CHECK. */
798 auto_sbitmap with_check (last_basic_block_for_fn (cfun) + 1);
799 bitmap_clear (with_check);
800 basic_block bb;
802 FOR_EACH_BB_FN (bb, cfun)
804 gimple_stmt_iterator gsi;
805 for (gsi = gsi_last_bb (bb); !gsi_end_p (gsi); gsi_prev (&gsi))
807 gimple *stmt = gsi_stmt (gsi);
808 if (maybe_contains_asan_check (stmt))
810 bitmap_set_bit (with_check, bb->index);
811 break;
816 auto_sbitmap can_reach_check (last_basic_block_for_fn (cfun) + 1);
817 bitmap_clear (can_reach_check);
818 auto_sbitmap worklist (last_basic_block_for_fn (cfun) + 1);
819 bitmap_copy (worklist, with_check);
821 /* 2) Propagate the information to all definitions blocks. */
822 while (!bitmap_empty_p (worklist))
824 unsigned i = bitmap_first_set_bit (worklist);
825 bitmap_clear_bit (worklist, i);
826 basic_block bb = BASIC_BLOCK_FOR_FN (cfun, i);
827 gcc_assert (bb);
829 edge e;
830 edge_iterator ei;
831 FOR_EACH_EDGE (e, ei, bb->preds)
832 if (!bitmap_bit_p (can_reach_check, e->src->index))
834 bitmap_set_bit (can_reach_check, e->src->index);
835 bitmap_set_bit (worklist, e->src->index);
839 /* 3) Iterate all BBs not included in CAN_REACH_CHECK BBs and remove poison
840 ASAN_MARK not followed by a call to function having an ASAN_CHECK. */
841 FOR_EACH_BB_FN (bb, cfun)
843 if (bitmap_bit_p (can_reach_check, bb->index))
844 continue;
846 gimple_stmt_iterator gsi;
847 for (gsi = gsi_last_bb (bb); !gsi_end_p (gsi);)
849 gimple *stmt = gsi_stmt (gsi);
850 if (maybe_contains_asan_check (stmt))
851 break;
852 else if (asan_mark_p (stmt, ASAN_MARK_POISON))
854 if (dump_file)
855 fprintf (dump_file, "Removing ASAN_MARK poison\n");
856 unlink_stmt_vdef (stmt);
857 release_defs (stmt);
858 gimple_stmt_iterator gsi2 = gsi;
859 gsi_prev (&gsi);
860 gsi_remove (&gsi2, true);
861 continue;
864 gsi_prev (&gsi);
869 /* Rewrite all usages of tree OP which is a PARM_DECL with a VAR_DECL
870 that is it's DECL_VALUE_EXPR. */
872 static tree
873 rewrite_usage_of_param (tree *op, int *walk_subtrees, void *)
875 if (TREE_CODE (*op) == PARM_DECL && DECL_HAS_VALUE_EXPR_P (*op))
877 *op = DECL_VALUE_EXPR (*op);
878 *walk_subtrees = 0;
881 return NULL;
884 /* For a given function FUN, rewrite all addressable parameters so that
885 a new automatic variable is introduced. Right after function entry
886 a parameter is assigned to the variable. */
888 static void
889 sanitize_rewrite_addressable_params (function *fun)
891 gimple *g;
892 gimple_seq stmts = NULL;
893 bool has_any_addressable_param = false;
894 auto_vec<tree> clear_value_expr_list;
896 for (tree arg = DECL_ARGUMENTS (current_function_decl);
897 arg; arg = DECL_CHAIN (arg))
899 tree type = TREE_TYPE (arg);
900 if (TREE_ADDRESSABLE (arg) && !TREE_ADDRESSABLE (type)
901 && TREE_CODE (TYPE_SIZE (type)) == INTEGER_CST)
903 TREE_ADDRESSABLE (arg) = 0;
904 /* The parameter is no longer addressable. */
905 has_any_addressable_param = true;
907 /* Create a new automatic variable. */
908 tree var = build_decl (DECL_SOURCE_LOCATION (arg),
909 VAR_DECL, DECL_NAME (arg), type);
910 TREE_ADDRESSABLE (var) = 1;
911 DECL_IGNORED_P (var) = 1;
913 gimple_add_tmp_var (var);
915 if (dump_file)
916 fprintf (dump_file,
917 "Rewriting parameter whose address is taken: %s\n",
918 IDENTIFIER_POINTER (DECL_NAME (arg)));
920 gcc_assert (!DECL_HAS_VALUE_EXPR_P (arg));
922 SET_DECL_PT_UID (var, DECL_PT_UID (arg));
924 /* Assign value of parameter to newly created variable. */
925 if ((TREE_CODE (type) == COMPLEX_TYPE
926 || TREE_CODE (type) == VECTOR_TYPE))
928 /* We need to create a SSA name that will be used for the
929 assignment. */
930 DECL_GIMPLE_REG_P (arg) = 1;
931 tree tmp = get_or_create_ssa_default_def (cfun, arg);
932 g = gimple_build_assign (var, tmp);
933 gimple_set_location (g, DECL_SOURCE_LOCATION (arg));
934 gimple_seq_add_stmt (&stmts, g);
936 else
938 g = gimple_build_assign (var, arg);
939 gimple_set_location (g, DECL_SOURCE_LOCATION (arg));
940 gimple_seq_add_stmt (&stmts, g);
943 if (target_for_debug_bind (arg))
945 g = gimple_build_debug_bind (arg, var, NULL);
946 gimple_seq_add_stmt (&stmts, g);
947 clear_value_expr_list.safe_push (arg);
950 DECL_HAS_VALUE_EXPR_P (arg) = 1;
951 SET_DECL_VALUE_EXPR (arg, var);
955 if (!has_any_addressable_param)
956 return;
958 /* Replace all usages of PARM_DECLs with the newly
959 created variable VAR. */
960 basic_block bb;
961 FOR_EACH_BB_FN (bb, fun)
963 gimple_stmt_iterator gsi;
964 for (gsi = gsi_start_bb (bb); !gsi_end_p (gsi); gsi_next (&gsi))
966 gimple *stmt = gsi_stmt (gsi);
967 gimple_stmt_iterator it = gsi_for_stmt (stmt);
968 walk_gimple_stmt (&it, NULL, rewrite_usage_of_param, NULL);
970 for (gsi = gsi_start_phis (bb); !gsi_end_p (gsi); gsi_next (&gsi))
972 gphi *phi = dyn_cast<gphi *> (gsi_stmt (gsi));
973 for (unsigned i = 0; i < gimple_phi_num_args (phi); ++i)
975 hash_set<tree> visited_nodes;
976 walk_tree (gimple_phi_arg_def_ptr (phi, i),
977 rewrite_usage_of_param, NULL, &visited_nodes);
982 /* Unset value expr for parameters for which we created debug bind
983 expressions. */
984 unsigned i;
985 tree arg;
986 FOR_EACH_VEC_ELT (clear_value_expr_list, i, arg)
988 DECL_HAS_VALUE_EXPR_P (arg) = 0;
989 SET_DECL_VALUE_EXPR (arg, NULL_TREE);
992 /* Insert default assignments at the beginning of a function. */
993 basic_block entry_bb = ENTRY_BLOCK_PTR_FOR_FN (fun);
994 entry_bb = split_edge (single_succ_edge (entry_bb));
996 gimple_stmt_iterator gsi = gsi_start_bb (entry_bb);
997 gsi_insert_seq_before (&gsi, stmts, GSI_NEW_STMT);
1000 unsigned int
1001 pass_sanopt::execute (function *fun)
1003 basic_block bb;
1004 int asan_num_accesses = 0;
1005 bool contains_asan_mark = false;
1007 /* Try to remove redundant checks. */
1008 if (optimize
1009 && (flag_sanitize
1010 & (SANITIZE_NULL | SANITIZE_ALIGNMENT
1011 | SANITIZE_ADDRESS | SANITIZE_VPTR)))
1012 asan_num_accesses = sanopt_optimize (fun, &contains_asan_mark);
1013 else if (flag_sanitize & SANITIZE_ADDRESS)
1015 gimple_stmt_iterator gsi;
1016 FOR_EACH_BB_FN (bb, fun)
1017 for (gsi = gsi_start_bb (bb); !gsi_end_p (gsi); gsi_next (&gsi))
1019 gimple *stmt = gsi_stmt (gsi);
1020 if (gimple_call_internal_p (stmt, IFN_ASAN_CHECK))
1021 ++asan_num_accesses;
1022 else if (gimple_call_internal_p (stmt, IFN_ASAN_MARK))
1023 contains_asan_mark = true;
1027 if (contains_asan_mark)
1029 sanitize_asan_mark_unpoison ();
1030 sanitize_asan_mark_poison ();
1033 if (asan_sanitize_stack_p ())
1034 sanitize_rewrite_addressable_params (fun);
1036 bool use_calls = ASAN_INSTRUMENTATION_WITH_CALL_THRESHOLD < INT_MAX
1037 && asan_num_accesses >= ASAN_INSTRUMENTATION_WITH_CALL_THRESHOLD;
1039 hash_map<tree, tree> shadow_vars_mapping;
1040 bool need_commit_edge_insert = false;
1041 FOR_EACH_BB_FN (bb, fun)
1043 gimple_stmt_iterator gsi;
1044 for (gsi = gsi_start_bb (bb); !gsi_end_p (gsi); )
1046 gimple *stmt = gsi_stmt (gsi);
1047 bool no_next = false;
1049 if (!is_gimple_call (stmt))
1051 gsi_next (&gsi);
1052 continue;
1055 if (gimple_call_internal_p (stmt))
1057 enum internal_fn ifn = gimple_call_internal_fn (stmt);
1058 switch (ifn)
1060 case IFN_UBSAN_NULL:
1061 no_next = ubsan_expand_null_ifn (&gsi);
1062 break;
1063 case IFN_UBSAN_BOUNDS:
1064 no_next = ubsan_expand_bounds_ifn (&gsi);
1065 break;
1066 case IFN_UBSAN_OBJECT_SIZE:
1067 no_next = ubsan_expand_objsize_ifn (&gsi);
1068 break;
1069 case IFN_UBSAN_PTR:
1070 no_next = ubsan_expand_ptr_ifn (&gsi);
1071 break;
1072 case IFN_UBSAN_VPTR:
1073 no_next = ubsan_expand_vptr_ifn (&gsi);
1074 break;
1075 case IFN_ASAN_CHECK:
1076 no_next = asan_expand_check_ifn (&gsi, use_calls);
1077 break;
1078 case IFN_ASAN_MARK:
1079 no_next = asan_expand_mark_ifn (&gsi);
1080 break;
1081 case IFN_ASAN_POISON:
1082 no_next = asan_expand_poison_ifn (&gsi,
1083 &need_commit_edge_insert,
1084 shadow_vars_mapping);
1085 break;
1086 default:
1087 break;
1090 else if (gimple_call_builtin_p (stmt, BUILT_IN_NORMAL))
1092 tree callee = gimple_call_fndecl (stmt);
1093 switch (DECL_FUNCTION_CODE (callee))
1095 case BUILT_IN_UNREACHABLE:
1096 if (sanitize_flags_p (SANITIZE_UNREACHABLE))
1097 no_next = ubsan_instrument_unreachable (&gsi);
1098 break;
1099 default:
1100 break;
1104 if (dump_file && (dump_flags & TDF_DETAILS))
1106 fprintf (dump_file, "Expanded\n ");
1107 print_gimple_stmt (dump_file, stmt, 0, dump_flags);
1108 fprintf (dump_file, "\n");
1111 if (!no_next)
1112 gsi_next (&gsi);
1116 if (need_commit_edge_insert)
1117 gsi_commit_edge_inserts ();
1119 return 0;
1122 } // anon namespace
1124 gimple_opt_pass *
1125 make_pass_sanopt (gcc::context *ctxt)
1127 return new pass_sanopt (ctxt);