Also turn off OPTION_MASK_ABI_X32 for -m16
[official-gcc.git] / gcc / asan.c
blobcf5de275e13b64f26e2e9574208702a4e28ad17d
1 /* AddressSanitizer, a fast memory error detector.
2 Copyright (C) 2012-2014 Free Software Foundation, Inc.
3 Contributed by Kostya Serebryany <kcc@google.com>
5 This file is part of GCC.
7 GCC is free software; you can redistribute it and/or modify it under
8 the terms of the GNU General Public License as published by the Free
9 Software Foundation; either version 3, or (at your option) any later
10 version.
12 GCC is distributed in the hope that it will be useful, but WITHOUT ANY
13 WARRANTY; without even the implied warranty of MERCHANTABILITY or
14 FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
15 for more details.
17 You should have received a copy of the GNU General Public License
18 along with GCC; see the file COPYING3. If not see
19 <http://www.gnu.org/licenses/>. */
22 #include "config.h"
23 #include "system.h"
24 #include "coretypes.h"
25 #include "tree.h"
26 #include "hash-table.h"
27 #include "basic-block.h"
28 #include "tree-ssa-alias.h"
29 #include "internal-fn.h"
30 #include "gimple-expr.h"
31 #include "is-a.h"
32 #include "inchash.h"
33 #include "gimple.h"
34 #include "gimplify.h"
35 #include "gimple-iterator.h"
36 #include "calls.h"
37 #include "varasm.h"
38 #include "stor-layout.h"
39 #include "tree-iterator.h"
40 #include "cgraph.h"
41 #include "stringpool.h"
42 #include "tree-ssanames.h"
43 #include "tree-pass.h"
44 #include "asan.h"
45 #include "gimple-pretty-print.h"
46 #include "target.h"
47 #include "expr.h"
48 #include "optabs.h"
49 #include "output.h"
50 #include "tm_p.h"
51 #include "langhooks.h"
52 #include "alloc-pool.h"
53 #include "cfgloop.h"
54 #include "gimple-builder.h"
55 #include "ubsan.h"
56 #include "predict.h"
57 #include "params.h"
58 #include "builtins.h"
60 /* AddressSanitizer finds out-of-bounds and use-after-free bugs
61 with <2x slowdown on average.
63 The tool consists of two parts:
64 instrumentation module (this file) and a run-time library.
65 The instrumentation module adds a run-time check before every memory insn.
66 For a 8- or 16- byte load accessing address X:
67 ShadowAddr = (X >> 3) + Offset
68 ShadowValue = *(char*)ShadowAddr; // *(short*) for 16-byte access.
69 if (ShadowValue)
70 __asan_report_load8(X);
71 For a load of N bytes (N=1, 2 or 4) from address X:
72 ShadowAddr = (X >> 3) + Offset
73 ShadowValue = *(char*)ShadowAddr;
74 if (ShadowValue)
75 if ((X & 7) + N - 1 > ShadowValue)
76 __asan_report_loadN(X);
77 Stores are instrumented similarly, but using __asan_report_storeN functions.
78 A call too __asan_init_vN() is inserted to the list of module CTORs.
79 N is the version number of the AddressSanitizer API. The changes between the
80 API versions are listed in libsanitizer/asan/asan_interface_internal.h.
82 The run-time library redefines malloc (so that redzone are inserted around
83 the allocated memory) and free (so that reuse of free-ed memory is delayed),
84 provides __asan_report* and __asan_init_vN functions.
86 Read more:
87 http://code.google.com/p/address-sanitizer/wiki/AddressSanitizerAlgorithm
89 The current implementation supports detection of out-of-bounds and
90 use-after-free in the heap, on the stack and for global variables.
92 [Protection of stack variables]
94 To understand how detection of out-of-bounds and use-after-free works
95 for stack variables, lets look at this example on x86_64 where the
96 stack grows downward:
98 int
99 foo ()
101 char a[23] = {0};
102 int b[2] = {0};
104 a[5] = 1;
105 b[1] = 2;
107 return a[5] + b[1];
110 For this function, the stack protected by asan will be organized as
111 follows, from the top of the stack to the bottom:
113 Slot 1/ [red zone of 32 bytes called 'RIGHT RedZone']
115 Slot 2/ [8 bytes of red zone, that adds up to the space of 'a' to make
116 the next slot be 32 bytes aligned; this one is called Partial
117 Redzone; this 32 bytes alignment is an asan constraint]
119 Slot 3/ [24 bytes for variable 'a']
121 Slot 4/ [red zone of 32 bytes called 'Middle RedZone']
123 Slot 5/ [24 bytes of Partial Red Zone (similar to slot 2]
125 Slot 6/ [8 bytes for variable 'b']
127 Slot 7/ [32 bytes of Red Zone at the bottom of the stack, called
128 'LEFT RedZone']
130 The 32 bytes of LEFT red zone at the bottom of the stack can be
131 decomposed as such:
133 1/ The first 8 bytes contain a magical asan number that is always
134 0x41B58AB3.
136 2/ The following 8 bytes contains a pointer to a string (to be
137 parsed at runtime by the runtime asan library), which format is
138 the following:
140 "<function-name> <space> <num-of-variables-on-the-stack>
141 (<32-bytes-aligned-offset-in-bytes-of-variable> <space>
142 <length-of-var-in-bytes> ){n} "
144 where '(...){n}' means the content inside the parenthesis occurs 'n'
145 times, with 'n' being the number of variables on the stack.
147 3/ The following 8 bytes contain the PC of the current function which
148 will be used by the run-time library to print an error message.
150 4/ The following 8 bytes are reserved for internal use by the run-time.
152 The shadow memory for that stack layout is going to look like this:
154 - content of shadow memory 8 bytes for slot 7: 0xF1F1F1F1.
155 The F1 byte pattern is a magic number called
156 ASAN_STACK_MAGIC_LEFT and is a way for the runtime to know that
157 the memory for that shadow byte is part of a the LEFT red zone
158 intended to seat at the bottom of the variables on the stack.
160 - content of shadow memory 8 bytes for slots 6 and 5:
161 0xF4F4F400. The F4 byte pattern is a magic number
162 called ASAN_STACK_MAGIC_PARTIAL. It flags the fact that the
163 memory region for this shadow byte is a PARTIAL red zone
164 intended to pad a variable A, so that the slot following
165 {A,padding} is 32 bytes aligned.
167 Note that the fact that the least significant byte of this
168 shadow memory content is 00 means that 8 bytes of its
169 corresponding memory (which corresponds to the memory of
170 variable 'b') is addressable.
172 - content of shadow memory 8 bytes for slot 4: 0xF2F2F2F2.
173 The F2 byte pattern is a magic number called
174 ASAN_STACK_MAGIC_MIDDLE. It flags the fact that the memory
175 region for this shadow byte is a MIDDLE red zone intended to
176 seat between two 32 aligned slots of {variable,padding}.
178 - content of shadow memory 8 bytes for slot 3 and 2:
179 0xF4000000. This represents is the concatenation of
180 variable 'a' and the partial red zone following it, like what we
181 had for variable 'b'. The least significant 3 bytes being 00
182 means that the 3 bytes of variable 'a' are addressable.
184 - content of shadow memory 8 bytes for slot 1: 0xF3F3F3F3.
185 The F3 byte pattern is a magic number called
186 ASAN_STACK_MAGIC_RIGHT. It flags the fact that the memory
187 region for this shadow byte is a RIGHT red zone intended to seat
188 at the top of the variables of the stack.
190 Note that the real variable layout is done in expand_used_vars in
191 cfgexpand.c. As far as Address Sanitizer is concerned, it lays out
192 stack variables as well as the different red zones, emits some
193 prologue code to populate the shadow memory as to poison (mark as
194 non-accessible) the regions of the red zones and mark the regions of
195 stack variables as accessible, and emit some epilogue code to
196 un-poison (mark as accessible) the regions of red zones right before
197 the function exits.
199 [Protection of global variables]
201 The basic idea is to insert a red zone between two global variables
202 and install a constructor function that calls the asan runtime to do
203 the populating of the relevant shadow memory regions at load time.
205 So the global variables are laid out as to insert a red zone between
206 them. The size of the red zones is so that each variable starts on a
207 32 bytes boundary.
209 Then a constructor function is installed so that, for each global
210 variable, it calls the runtime asan library function
211 __asan_register_globals_with an instance of this type:
213 struct __asan_global
215 // Address of the beginning of the global variable.
216 const void *__beg;
218 // Initial size of the global variable.
219 uptr __size;
221 // Size of the global variable + size of the red zone. This
222 // size is 32 bytes aligned.
223 uptr __size_with_redzone;
225 // Name of the global variable.
226 const void *__name;
228 // Name of the module where the global variable is declared.
229 const void *__module_name;
231 // 1 if it has dynamic initialization, 0 otherwise.
232 uptr __has_dynamic_init;
235 A destructor function that calls the runtime asan library function
236 _asan_unregister_globals is also installed. */
238 alias_set_type asan_shadow_set = -1;
240 /* Pointer types to 1 resp. 2 byte integers in shadow memory. A separate
241 alias set is used for all shadow memory accesses. */
242 static GTY(()) tree shadow_ptr_types[2];
244 /* Decl for __asan_option_detect_stack_use_after_return. */
245 static GTY(()) tree asan_detect_stack_use_after_return;
247 /* Various flags for Asan builtins. */
248 enum asan_check_flags
250 ASAN_CHECK_STORE = 1 << 0,
251 ASAN_CHECK_SCALAR_ACCESS = 1 << 1,
252 ASAN_CHECK_NON_ZERO_LEN = 1 << 2,
253 ASAN_CHECK_START_INSTRUMENTED = 1 << 3,
254 ASAN_CHECK_END_INSTRUMENTED = 1 << 4,
255 ASAN_CHECK_LAST
258 /* Hashtable support for memory references used by gimple
259 statements. */
261 /* This type represents a reference to a memory region. */
262 struct asan_mem_ref
264 /* The expression of the beginning of the memory region. */
265 tree start;
267 /* The size of the access. */
268 HOST_WIDE_INT access_size;
271 static alloc_pool asan_mem_ref_alloc_pool;
273 /* This creates the alloc pool used to store the instances of
274 asan_mem_ref that are stored in the hash table asan_mem_ref_ht. */
276 static alloc_pool
277 asan_mem_ref_get_alloc_pool ()
279 if (asan_mem_ref_alloc_pool == NULL)
280 asan_mem_ref_alloc_pool = create_alloc_pool ("asan_mem_ref",
281 sizeof (asan_mem_ref),
282 10);
283 return asan_mem_ref_alloc_pool;
287 /* Initializes an instance of asan_mem_ref. */
289 static void
290 asan_mem_ref_init (asan_mem_ref *ref, tree start, HOST_WIDE_INT access_size)
292 ref->start = start;
293 ref->access_size = access_size;
296 /* Allocates memory for an instance of asan_mem_ref into the memory
297 pool returned by asan_mem_ref_get_alloc_pool and initialize it.
298 START is the address of (or the expression pointing to) the
299 beginning of memory reference. ACCESS_SIZE is the size of the
300 access to the referenced memory. */
302 static asan_mem_ref*
303 asan_mem_ref_new (tree start, HOST_WIDE_INT access_size)
305 asan_mem_ref *ref =
306 (asan_mem_ref *) pool_alloc (asan_mem_ref_get_alloc_pool ());
308 asan_mem_ref_init (ref, start, access_size);
309 return ref;
312 /* This builds and returns a pointer to the end of the memory region
313 that starts at START and of length LEN. */
315 tree
316 asan_mem_ref_get_end (tree start, tree len)
318 if (len == NULL_TREE || integer_zerop (len))
319 return start;
321 if (!ptrofftype_p (len))
322 len = convert_to_ptrofftype (len);
324 return fold_build2 (POINTER_PLUS_EXPR, TREE_TYPE (start), start, len);
327 /* Return a tree expression that represents the end of the referenced
328 memory region. Beware that this function can actually build a new
329 tree expression. */
331 tree
332 asan_mem_ref_get_end (const asan_mem_ref *ref, tree len)
334 return asan_mem_ref_get_end (ref->start, len);
337 struct asan_mem_ref_hasher
338 : typed_noop_remove <asan_mem_ref>
340 typedef asan_mem_ref value_type;
341 typedef asan_mem_ref compare_type;
343 static inline hashval_t hash (const value_type *);
344 static inline bool equal (const value_type *, const compare_type *);
347 /* Hash a memory reference. */
349 inline hashval_t
350 asan_mem_ref_hasher::hash (const asan_mem_ref *mem_ref)
352 inchash::hash hstate;
353 inchash::add_expr (mem_ref->start, hstate);
354 hstate.add_wide_int (mem_ref->access_size);
355 return hstate.end ();
358 /* Compare two memory references. We accept the length of either
359 memory references to be NULL_TREE. */
361 inline bool
362 asan_mem_ref_hasher::equal (const asan_mem_ref *m1,
363 const asan_mem_ref *m2)
365 return (m1->access_size == m2->access_size
366 && operand_equal_p (m1->start, m2->start, 0));
369 static hash_table<asan_mem_ref_hasher> *asan_mem_ref_ht;
371 /* Returns a reference to the hash table containing memory references.
372 This function ensures that the hash table is created. Note that
373 this hash table is updated by the function
374 update_mem_ref_hash_table. */
376 static hash_table<asan_mem_ref_hasher> *
377 get_mem_ref_hash_table ()
379 if (!asan_mem_ref_ht)
380 asan_mem_ref_ht = new hash_table<asan_mem_ref_hasher> (10);
382 return asan_mem_ref_ht;
385 /* Clear all entries from the memory references hash table. */
387 static void
388 empty_mem_ref_hash_table ()
390 if (asan_mem_ref_ht)
391 asan_mem_ref_ht->empty ();
394 /* Free the memory references hash table. */
396 static void
397 free_mem_ref_resources ()
399 delete asan_mem_ref_ht;
400 asan_mem_ref_ht = NULL;
402 if (asan_mem_ref_alloc_pool)
404 free_alloc_pool (asan_mem_ref_alloc_pool);
405 asan_mem_ref_alloc_pool = NULL;
409 /* Return true iff the memory reference REF has been instrumented. */
411 static bool
412 has_mem_ref_been_instrumented (tree ref, HOST_WIDE_INT access_size)
414 asan_mem_ref r;
415 asan_mem_ref_init (&r, ref, access_size);
417 return (get_mem_ref_hash_table ()->find (&r) != NULL);
420 /* Return true iff the memory reference REF has been instrumented. */
422 static bool
423 has_mem_ref_been_instrumented (const asan_mem_ref *ref)
425 return has_mem_ref_been_instrumented (ref->start, ref->access_size);
428 /* Return true iff access to memory region starting at REF and of
429 length LEN has been instrumented. */
431 static bool
432 has_mem_ref_been_instrumented (const asan_mem_ref *ref, tree len)
434 /* First let's see if the address of the beginning of REF has been
435 instrumented. */
436 if (!has_mem_ref_been_instrumented (ref))
437 return false;
439 if (len != 0)
441 /* Let's see if the end of the region has been instrumented. */
442 if (!has_mem_ref_been_instrumented (asan_mem_ref_get_end (ref, len),
443 ref->access_size))
444 return false;
446 return true;
449 /* Set REF to the memory reference present in a gimple assignment
450 ASSIGNMENT. Return true upon successful completion, false
451 otherwise. */
453 static bool
454 get_mem_ref_of_assignment (const gimple assignment,
455 asan_mem_ref *ref,
456 bool *ref_is_store)
458 gcc_assert (gimple_assign_single_p (assignment));
460 if (gimple_store_p (assignment)
461 && !gimple_clobber_p (assignment))
463 ref->start = gimple_assign_lhs (assignment);
464 *ref_is_store = true;
466 else if (gimple_assign_load_p (assignment))
468 ref->start = gimple_assign_rhs1 (assignment);
469 *ref_is_store = false;
471 else
472 return false;
474 ref->access_size = int_size_in_bytes (TREE_TYPE (ref->start));
475 return true;
478 /* Return the memory references contained in a gimple statement
479 representing a builtin call that has to do with memory access. */
481 static bool
482 get_mem_refs_of_builtin_call (const gimple call,
483 asan_mem_ref *src0,
484 tree *src0_len,
485 bool *src0_is_store,
486 asan_mem_ref *src1,
487 tree *src1_len,
488 bool *src1_is_store,
489 asan_mem_ref *dst,
490 tree *dst_len,
491 bool *dst_is_store,
492 bool *dest_is_deref)
494 gcc_checking_assert (gimple_call_builtin_p (call, BUILT_IN_NORMAL));
496 tree callee = gimple_call_fndecl (call);
497 tree source0 = NULL_TREE, source1 = NULL_TREE,
498 dest = NULL_TREE, len = NULL_TREE;
499 bool is_store = true, got_reference_p = false;
500 HOST_WIDE_INT access_size = 1;
502 switch (DECL_FUNCTION_CODE (callee))
504 /* (s, s, n) style memops. */
505 case BUILT_IN_BCMP:
506 case BUILT_IN_MEMCMP:
507 source0 = gimple_call_arg (call, 0);
508 source1 = gimple_call_arg (call, 1);
509 len = gimple_call_arg (call, 2);
510 break;
512 /* (src, dest, n) style memops. */
513 case BUILT_IN_BCOPY:
514 source0 = gimple_call_arg (call, 0);
515 dest = gimple_call_arg (call, 1);
516 len = gimple_call_arg (call, 2);
517 break;
519 /* (dest, src, n) style memops. */
520 case BUILT_IN_MEMCPY:
521 case BUILT_IN_MEMCPY_CHK:
522 case BUILT_IN_MEMMOVE:
523 case BUILT_IN_MEMMOVE_CHK:
524 case BUILT_IN_MEMPCPY:
525 case BUILT_IN_MEMPCPY_CHK:
526 dest = gimple_call_arg (call, 0);
527 source0 = gimple_call_arg (call, 1);
528 len = gimple_call_arg (call, 2);
529 break;
531 /* (dest, n) style memops. */
532 case BUILT_IN_BZERO:
533 dest = gimple_call_arg (call, 0);
534 len = gimple_call_arg (call, 1);
535 break;
537 /* (dest, x, n) style memops*/
538 case BUILT_IN_MEMSET:
539 case BUILT_IN_MEMSET_CHK:
540 dest = gimple_call_arg (call, 0);
541 len = gimple_call_arg (call, 2);
542 break;
544 case BUILT_IN_STRLEN:
545 source0 = gimple_call_arg (call, 0);
546 len = gimple_call_lhs (call);
547 break ;
549 /* And now the __atomic* and __sync builtins.
550 These are handled differently from the classical memory memory
551 access builtins above. */
553 case BUILT_IN_ATOMIC_LOAD_1:
554 case BUILT_IN_ATOMIC_LOAD_2:
555 case BUILT_IN_ATOMIC_LOAD_4:
556 case BUILT_IN_ATOMIC_LOAD_8:
557 case BUILT_IN_ATOMIC_LOAD_16:
558 is_store = false;
559 /* fall through. */
561 case BUILT_IN_SYNC_FETCH_AND_ADD_1:
562 case BUILT_IN_SYNC_FETCH_AND_ADD_2:
563 case BUILT_IN_SYNC_FETCH_AND_ADD_4:
564 case BUILT_IN_SYNC_FETCH_AND_ADD_8:
565 case BUILT_IN_SYNC_FETCH_AND_ADD_16:
567 case BUILT_IN_SYNC_FETCH_AND_SUB_1:
568 case BUILT_IN_SYNC_FETCH_AND_SUB_2:
569 case BUILT_IN_SYNC_FETCH_AND_SUB_4:
570 case BUILT_IN_SYNC_FETCH_AND_SUB_8:
571 case BUILT_IN_SYNC_FETCH_AND_SUB_16:
573 case BUILT_IN_SYNC_FETCH_AND_OR_1:
574 case BUILT_IN_SYNC_FETCH_AND_OR_2:
575 case BUILT_IN_SYNC_FETCH_AND_OR_4:
576 case BUILT_IN_SYNC_FETCH_AND_OR_8:
577 case BUILT_IN_SYNC_FETCH_AND_OR_16:
579 case BUILT_IN_SYNC_FETCH_AND_AND_1:
580 case BUILT_IN_SYNC_FETCH_AND_AND_2:
581 case BUILT_IN_SYNC_FETCH_AND_AND_4:
582 case BUILT_IN_SYNC_FETCH_AND_AND_8:
583 case BUILT_IN_SYNC_FETCH_AND_AND_16:
585 case BUILT_IN_SYNC_FETCH_AND_XOR_1:
586 case BUILT_IN_SYNC_FETCH_AND_XOR_2:
587 case BUILT_IN_SYNC_FETCH_AND_XOR_4:
588 case BUILT_IN_SYNC_FETCH_AND_XOR_8:
589 case BUILT_IN_SYNC_FETCH_AND_XOR_16:
591 case BUILT_IN_SYNC_FETCH_AND_NAND_1:
592 case BUILT_IN_SYNC_FETCH_AND_NAND_2:
593 case BUILT_IN_SYNC_FETCH_AND_NAND_4:
594 case BUILT_IN_SYNC_FETCH_AND_NAND_8:
596 case BUILT_IN_SYNC_ADD_AND_FETCH_1:
597 case BUILT_IN_SYNC_ADD_AND_FETCH_2:
598 case BUILT_IN_SYNC_ADD_AND_FETCH_4:
599 case BUILT_IN_SYNC_ADD_AND_FETCH_8:
600 case BUILT_IN_SYNC_ADD_AND_FETCH_16:
602 case BUILT_IN_SYNC_SUB_AND_FETCH_1:
603 case BUILT_IN_SYNC_SUB_AND_FETCH_2:
604 case BUILT_IN_SYNC_SUB_AND_FETCH_4:
605 case BUILT_IN_SYNC_SUB_AND_FETCH_8:
606 case BUILT_IN_SYNC_SUB_AND_FETCH_16:
608 case BUILT_IN_SYNC_OR_AND_FETCH_1:
609 case BUILT_IN_SYNC_OR_AND_FETCH_2:
610 case BUILT_IN_SYNC_OR_AND_FETCH_4:
611 case BUILT_IN_SYNC_OR_AND_FETCH_8:
612 case BUILT_IN_SYNC_OR_AND_FETCH_16:
614 case BUILT_IN_SYNC_AND_AND_FETCH_1:
615 case BUILT_IN_SYNC_AND_AND_FETCH_2:
616 case BUILT_IN_SYNC_AND_AND_FETCH_4:
617 case BUILT_IN_SYNC_AND_AND_FETCH_8:
618 case BUILT_IN_SYNC_AND_AND_FETCH_16:
620 case BUILT_IN_SYNC_XOR_AND_FETCH_1:
621 case BUILT_IN_SYNC_XOR_AND_FETCH_2:
622 case BUILT_IN_SYNC_XOR_AND_FETCH_4:
623 case BUILT_IN_SYNC_XOR_AND_FETCH_8:
624 case BUILT_IN_SYNC_XOR_AND_FETCH_16:
626 case BUILT_IN_SYNC_NAND_AND_FETCH_1:
627 case BUILT_IN_SYNC_NAND_AND_FETCH_2:
628 case BUILT_IN_SYNC_NAND_AND_FETCH_4:
629 case BUILT_IN_SYNC_NAND_AND_FETCH_8:
631 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_1:
632 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_2:
633 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_4:
634 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_8:
635 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_16:
637 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_1:
638 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_2:
639 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_4:
640 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_8:
641 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_16:
643 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_1:
644 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_2:
645 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_4:
646 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_8:
647 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_16:
649 case BUILT_IN_SYNC_LOCK_RELEASE_1:
650 case BUILT_IN_SYNC_LOCK_RELEASE_2:
651 case BUILT_IN_SYNC_LOCK_RELEASE_4:
652 case BUILT_IN_SYNC_LOCK_RELEASE_8:
653 case BUILT_IN_SYNC_LOCK_RELEASE_16:
655 case BUILT_IN_ATOMIC_EXCHANGE_1:
656 case BUILT_IN_ATOMIC_EXCHANGE_2:
657 case BUILT_IN_ATOMIC_EXCHANGE_4:
658 case BUILT_IN_ATOMIC_EXCHANGE_8:
659 case BUILT_IN_ATOMIC_EXCHANGE_16:
661 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_1:
662 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_2:
663 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_4:
664 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_8:
665 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_16:
667 case BUILT_IN_ATOMIC_STORE_1:
668 case BUILT_IN_ATOMIC_STORE_2:
669 case BUILT_IN_ATOMIC_STORE_4:
670 case BUILT_IN_ATOMIC_STORE_8:
671 case BUILT_IN_ATOMIC_STORE_16:
673 case BUILT_IN_ATOMIC_ADD_FETCH_1:
674 case BUILT_IN_ATOMIC_ADD_FETCH_2:
675 case BUILT_IN_ATOMIC_ADD_FETCH_4:
676 case BUILT_IN_ATOMIC_ADD_FETCH_8:
677 case BUILT_IN_ATOMIC_ADD_FETCH_16:
679 case BUILT_IN_ATOMIC_SUB_FETCH_1:
680 case BUILT_IN_ATOMIC_SUB_FETCH_2:
681 case BUILT_IN_ATOMIC_SUB_FETCH_4:
682 case BUILT_IN_ATOMIC_SUB_FETCH_8:
683 case BUILT_IN_ATOMIC_SUB_FETCH_16:
685 case BUILT_IN_ATOMIC_AND_FETCH_1:
686 case BUILT_IN_ATOMIC_AND_FETCH_2:
687 case BUILT_IN_ATOMIC_AND_FETCH_4:
688 case BUILT_IN_ATOMIC_AND_FETCH_8:
689 case BUILT_IN_ATOMIC_AND_FETCH_16:
691 case BUILT_IN_ATOMIC_NAND_FETCH_1:
692 case BUILT_IN_ATOMIC_NAND_FETCH_2:
693 case BUILT_IN_ATOMIC_NAND_FETCH_4:
694 case BUILT_IN_ATOMIC_NAND_FETCH_8:
695 case BUILT_IN_ATOMIC_NAND_FETCH_16:
697 case BUILT_IN_ATOMIC_XOR_FETCH_1:
698 case BUILT_IN_ATOMIC_XOR_FETCH_2:
699 case BUILT_IN_ATOMIC_XOR_FETCH_4:
700 case BUILT_IN_ATOMIC_XOR_FETCH_8:
701 case BUILT_IN_ATOMIC_XOR_FETCH_16:
703 case BUILT_IN_ATOMIC_OR_FETCH_1:
704 case BUILT_IN_ATOMIC_OR_FETCH_2:
705 case BUILT_IN_ATOMIC_OR_FETCH_4:
706 case BUILT_IN_ATOMIC_OR_FETCH_8:
707 case BUILT_IN_ATOMIC_OR_FETCH_16:
709 case BUILT_IN_ATOMIC_FETCH_ADD_1:
710 case BUILT_IN_ATOMIC_FETCH_ADD_2:
711 case BUILT_IN_ATOMIC_FETCH_ADD_4:
712 case BUILT_IN_ATOMIC_FETCH_ADD_8:
713 case BUILT_IN_ATOMIC_FETCH_ADD_16:
715 case BUILT_IN_ATOMIC_FETCH_SUB_1:
716 case BUILT_IN_ATOMIC_FETCH_SUB_2:
717 case BUILT_IN_ATOMIC_FETCH_SUB_4:
718 case BUILT_IN_ATOMIC_FETCH_SUB_8:
719 case BUILT_IN_ATOMIC_FETCH_SUB_16:
721 case BUILT_IN_ATOMIC_FETCH_AND_1:
722 case BUILT_IN_ATOMIC_FETCH_AND_2:
723 case BUILT_IN_ATOMIC_FETCH_AND_4:
724 case BUILT_IN_ATOMIC_FETCH_AND_8:
725 case BUILT_IN_ATOMIC_FETCH_AND_16:
727 case BUILT_IN_ATOMIC_FETCH_NAND_1:
728 case BUILT_IN_ATOMIC_FETCH_NAND_2:
729 case BUILT_IN_ATOMIC_FETCH_NAND_4:
730 case BUILT_IN_ATOMIC_FETCH_NAND_8:
731 case BUILT_IN_ATOMIC_FETCH_NAND_16:
733 case BUILT_IN_ATOMIC_FETCH_XOR_1:
734 case BUILT_IN_ATOMIC_FETCH_XOR_2:
735 case BUILT_IN_ATOMIC_FETCH_XOR_4:
736 case BUILT_IN_ATOMIC_FETCH_XOR_8:
737 case BUILT_IN_ATOMIC_FETCH_XOR_16:
739 case BUILT_IN_ATOMIC_FETCH_OR_1:
740 case BUILT_IN_ATOMIC_FETCH_OR_2:
741 case BUILT_IN_ATOMIC_FETCH_OR_4:
742 case BUILT_IN_ATOMIC_FETCH_OR_8:
743 case BUILT_IN_ATOMIC_FETCH_OR_16:
745 dest = gimple_call_arg (call, 0);
746 /* DEST represents the address of a memory location.
747 instrument_derefs wants the memory location, so lets
748 dereference the address DEST before handing it to
749 instrument_derefs. */
750 if (TREE_CODE (dest) == ADDR_EXPR)
751 dest = TREE_OPERAND (dest, 0);
752 else if (TREE_CODE (dest) == SSA_NAME || TREE_CODE (dest) == INTEGER_CST)
753 dest = build2 (MEM_REF, TREE_TYPE (TREE_TYPE (dest)),
754 dest, build_int_cst (TREE_TYPE (dest), 0));
755 else
756 gcc_unreachable ();
758 access_size = int_size_in_bytes (TREE_TYPE (dest));
761 default:
762 /* The other builtins memory access are not instrumented in this
763 function because they either don't have any length parameter,
764 or their length parameter is just a limit. */
765 break;
768 if (len != NULL_TREE)
770 if (source0 != NULL_TREE)
772 src0->start = source0;
773 src0->access_size = access_size;
774 *src0_len = len;
775 *src0_is_store = false;
778 if (source1 != NULL_TREE)
780 src1->start = source1;
781 src1->access_size = access_size;
782 *src1_len = len;
783 *src1_is_store = false;
786 if (dest != NULL_TREE)
788 dst->start = dest;
789 dst->access_size = access_size;
790 *dst_len = len;
791 *dst_is_store = true;
794 got_reference_p = true;
796 else if (dest)
798 dst->start = dest;
799 dst->access_size = access_size;
800 *dst_len = NULL_TREE;
801 *dst_is_store = is_store;
802 *dest_is_deref = true;
803 got_reference_p = true;
806 return got_reference_p;
809 /* Return true iff a given gimple statement has been instrumented.
810 Note that the statement is "defined" by the memory references it
811 contains. */
813 static bool
814 has_stmt_been_instrumented_p (gimple stmt)
816 if (gimple_assign_single_p (stmt))
818 bool r_is_store;
819 asan_mem_ref r;
820 asan_mem_ref_init (&r, NULL, 1);
822 if (get_mem_ref_of_assignment (stmt, &r, &r_is_store))
823 return has_mem_ref_been_instrumented (&r);
825 else if (gimple_call_builtin_p (stmt, BUILT_IN_NORMAL))
827 asan_mem_ref src0, src1, dest;
828 asan_mem_ref_init (&src0, NULL, 1);
829 asan_mem_ref_init (&src1, NULL, 1);
830 asan_mem_ref_init (&dest, NULL, 1);
832 tree src0_len = NULL_TREE, src1_len = NULL_TREE, dest_len = NULL_TREE;
833 bool src0_is_store = false, src1_is_store = false,
834 dest_is_store = false, dest_is_deref = false;
835 if (get_mem_refs_of_builtin_call (stmt,
836 &src0, &src0_len, &src0_is_store,
837 &src1, &src1_len, &src1_is_store,
838 &dest, &dest_len, &dest_is_store,
839 &dest_is_deref))
841 if (src0.start != NULL_TREE
842 && !has_mem_ref_been_instrumented (&src0, src0_len))
843 return false;
845 if (src1.start != NULL_TREE
846 && !has_mem_ref_been_instrumented (&src1, src1_len))
847 return false;
849 if (dest.start != NULL_TREE
850 && !has_mem_ref_been_instrumented (&dest, dest_len))
851 return false;
853 return true;
856 return false;
859 /* Insert a memory reference into the hash table. */
861 static void
862 update_mem_ref_hash_table (tree ref, HOST_WIDE_INT access_size)
864 hash_table<asan_mem_ref_hasher> *ht = get_mem_ref_hash_table ();
866 asan_mem_ref r;
867 asan_mem_ref_init (&r, ref, access_size);
869 asan_mem_ref **slot = ht->find_slot (&r, INSERT);
870 if (*slot == NULL)
871 *slot = asan_mem_ref_new (ref, access_size);
874 /* Initialize shadow_ptr_types array. */
876 static void
877 asan_init_shadow_ptr_types (void)
879 asan_shadow_set = new_alias_set ();
880 shadow_ptr_types[0] = build_distinct_type_copy (signed_char_type_node);
881 TYPE_ALIAS_SET (shadow_ptr_types[0]) = asan_shadow_set;
882 shadow_ptr_types[0] = build_pointer_type (shadow_ptr_types[0]);
883 shadow_ptr_types[1] = build_distinct_type_copy (short_integer_type_node);
884 TYPE_ALIAS_SET (shadow_ptr_types[1]) = asan_shadow_set;
885 shadow_ptr_types[1] = build_pointer_type (shadow_ptr_types[1]);
886 initialize_sanitizer_builtins ();
889 /* Create ADDR_EXPR of STRING_CST with the PP pretty printer text. */
891 static tree
892 asan_pp_string (pretty_printer *pp)
894 const char *buf = pp_formatted_text (pp);
895 size_t len = strlen (buf);
896 tree ret = build_string (len + 1, buf);
897 TREE_TYPE (ret)
898 = build_array_type (TREE_TYPE (shadow_ptr_types[0]),
899 build_index_type (size_int (len)));
900 TREE_READONLY (ret) = 1;
901 TREE_STATIC (ret) = 1;
902 return build1 (ADDR_EXPR, shadow_ptr_types[0], ret);
905 /* Return a CONST_INT representing 4 subsequent shadow memory bytes. */
907 static rtx
908 asan_shadow_cst (unsigned char shadow_bytes[4])
910 int i;
911 unsigned HOST_WIDE_INT val = 0;
912 gcc_assert (WORDS_BIG_ENDIAN == BYTES_BIG_ENDIAN);
913 for (i = 0; i < 4; i++)
914 val |= (unsigned HOST_WIDE_INT) shadow_bytes[BYTES_BIG_ENDIAN ? 3 - i : i]
915 << (BITS_PER_UNIT * i);
916 return gen_int_mode (val, SImode);
919 /* Clear shadow memory at SHADOW_MEM, LEN bytes. Can't call a library call here
920 though. */
922 static void
923 asan_clear_shadow (rtx shadow_mem, HOST_WIDE_INT len)
925 rtx_insn *insn, *insns, *jump;
926 rtx_code_label *top_label;
927 rtx end, addr, tmp;
929 start_sequence ();
930 clear_storage (shadow_mem, GEN_INT (len), BLOCK_OP_NORMAL);
931 insns = get_insns ();
932 end_sequence ();
933 for (insn = insns; insn; insn = NEXT_INSN (insn))
934 if (CALL_P (insn))
935 break;
936 if (insn == NULL_RTX)
938 emit_insn (insns);
939 return;
942 gcc_assert ((len & 3) == 0);
943 top_label = gen_label_rtx ();
944 addr = copy_to_mode_reg (Pmode, XEXP (shadow_mem, 0));
945 shadow_mem = adjust_automodify_address (shadow_mem, SImode, addr, 0);
946 end = force_reg (Pmode, plus_constant (Pmode, addr, len));
947 emit_label (top_label);
949 emit_move_insn (shadow_mem, const0_rtx);
950 tmp = expand_simple_binop (Pmode, PLUS, addr, gen_int_mode (4, Pmode), addr,
951 true, OPTAB_LIB_WIDEN);
952 if (tmp != addr)
953 emit_move_insn (addr, tmp);
954 emit_cmp_and_jump_insns (addr, end, LT, NULL_RTX, Pmode, true, top_label);
955 jump = get_last_insn ();
956 gcc_assert (JUMP_P (jump));
957 add_int_reg_note (jump, REG_BR_PROB, REG_BR_PROB_BASE * 80 / 100);
960 void
961 asan_function_start (void)
963 section *fnsec = function_section (current_function_decl);
964 switch_to_section (fnsec);
965 ASM_OUTPUT_DEBUG_LABEL (asm_out_file, "LASANPC",
966 current_function_funcdef_no);
969 /* Insert code to protect stack vars. The prologue sequence should be emitted
970 directly, epilogue sequence returned. BASE is the register holding the
971 stack base, against which OFFSETS array offsets are relative to, OFFSETS
972 array contains pairs of offsets in reverse order, always the end offset
973 of some gap that needs protection followed by starting offset,
974 and DECLS is an array of representative decls for each var partition.
975 LENGTH is the length of the OFFSETS array, DECLS array is LENGTH / 2 - 1
976 elements long (OFFSETS include gap before the first variable as well
977 as gaps after each stack variable). PBASE is, if non-NULL, some pseudo
978 register which stack vars DECL_RTLs are based on. Either BASE should be
979 assigned to PBASE, when not doing use after return protection, or
980 corresponding address based on __asan_stack_malloc* return value. */
982 rtx_insn *
983 asan_emit_stack_protection (rtx base, rtx pbase, unsigned int alignb,
984 HOST_WIDE_INT *offsets, tree *decls, int length)
986 rtx shadow_base, shadow_mem, ret, mem, orig_base;
987 rtx_code_label *lab;
988 rtx_insn *insns;
989 char buf[30];
990 unsigned char shadow_bytes[4];
991 HOST_WIDE_INT base_offset = offsets[length - 1];
992 HOST_WIDE_INT base_align_bias = 0, offset, prev_offset;
993 HOST_WIDE_INT asan_frame_size = offsets[0] - base_offset;
994 HOST_WIDE_INT last_offset, last_size;
995 int l;
996 unsigned char cur_shadow_byte = ASAN_STACK_MAGIC_LEFT;
997 tree str_cst, decl, id;
998 int use_after_return_class = -1;
1000 if (shadow_ptr_types[0] == NULL_TREE)
1001 asan_init_shadow_ptr_types ();
1003 /* First of all, prepare the description string. */
1004 pretty_printer asan_pp;
1006 pp_decimal_int (&asan_pp, length / 2 - 1);
1007 pp_space (&asan_pp);
1008 for (l = length - 2; l; l -= 2)
1010 tree decl = decls[l / 2 - 1];
1011 pp_wide_integer (&asan_pp, offsets[l] - base_offset);
1012 pp_space (&asan_pp);
1013 pp_wide_integer (&asan_pp, offsets[l - 1] - offsets[l]);
1014 pp_space (&asan_pp);
1015 if (DECL_P (decl) && DECL_NAME (decl))
1017 pp_decimal_int (&asan_pp, IDENTIFIER_LENGTH (DECL_NAME (decl)));
1018 pp_space (&asan_pp);
1019 pp_tree_identifier (&asan_pp, DECL_NAME (decl));
1021 else
1022 pp_string (&asan_pp, "9 <unknown>");
1023 pp_space (&asan_pp);
1025 str_cst = asan_pp_string (&asan_pp);
1027 /* Emit the prologue sequence. */
1028 if (asan_frame_size > 32 && asan_frame_size <= 65536 && pbase
1029 && ASAN_USE_AFTER_RETURN)
1031 use_after_return_class = floor_log2 (asan_frame_size - 1) - 5;
1032 /* __asan_stack_malloc_N guarantees alignment
1033 N < 6 ? (64 << N) : 4096 bytes. */
1034 if (alignb > (use_after_return_class < 6
1035 ? (64U << use_after_return_class) : 4096U))
1036 use_after_return_class = -1;
1037 else if (alignb > ASAN_RED_ZONE_SIZE && (asan_frame_size & (alignb - 1)))
1038 base_align_bias = ((asan_frame_size + alignb - 1)
1039 & ~(alignb - HOST_WIDE_INT_1)) - asan_frame_size;
1041 /* Align base if target is STRICT_ALIGNMENT. */
1042 if (STRICT_ALIGNMENT)
1043 base = expand_binop (Pmode, and_optab, base,
1044 gen_int_mode (-((GET_MODE_ALIGNMENT (SImode)
1045 << ASAN_SHADOW_SHIFT)
1046 / BITS_PER_UNIT), Pmode), NULL_RTX,
1047 1, OPTAB_DIRECT);
1049 if (use_after_return_class == -1 && pbase)
1050 emit_move_insn (pbase, base);
1052 base = expand_binop (Pmode, add_optab, base,
1053 gen_int_mode (base_offset - base_align_bias, Pmode),
1054 NULL_RTX, 1, OPTAB_DIRECT);
1055 orig_base = NULL_RTX;
1056 if (use_after_return_class != -1)
1058 if (asan_detect_stack_use_after_return == NULL_TREE)
1060 id = get_identifier ("__asan_option_detect_stack_use_after_return");
1061 decl = build_decl (BUILTINS_LOCATION, VAR_DECL, id,
1062 integer_type_node);
1063 SET_DECL_ASSEMBLER_NAME (decl, id);
1064 TREE_ADDRESSABLE (decl) = 1;
1065 DECL_ARTIFICIAL (decl) = 1;
1066 DECL_IGNORED_P (decl) = 1;
1067 DECL_EXTERNAL (decl) = 1;
1068 TREE_STATIC (decl) = 1;
1069 TREE_PUBLIC (decl) = 1;
1070 TREE_USED (decl) = 1;
1071 asan_detect_stack_use_after_return = decl;
1073 orig_base = gen_reg_rtx (Pmode);
1074 emit_move_insn (orig_base, base);
1075 ret = expand_normal (asan_detect_stack_use_after_return);
1076 lab = gen_label_rtx ();
1077 int very_likely = REG_BR_PROB_BASE - (REG_BR_PROB_BASE / 2000 - 1);
1078 emit_cmp_and_jump_insns (ret, const0_rtx, EQ, NULL_RTX,
1079 VOIDmode, 0, lab, very_likely);
1080 snprintf (buf, sizeof buf, "__asan_stack_malloc_%d",
1081 use_after_return_class);
1082 ret = init_one_libfunc (buf);
1083 rtx addr = convert_memory_address (ptr_mode, base);
1084 ret = emit_library_call_value (ret, NULL_RTX, LCT_NORMAL, ptr_mode, 2,
1085 GEN_INT (asan_frame_size
1086 + base_align_bias),
1087 TYPE_MODE (pointer_sized_int_node),
1088 addr, ptr_mode);
1089 ret = convert_memory_address (Pmode, ret);
1090 emit_move_insn (base, ret);
1091 emit_label (lab);
1092 emit_move_insn (pbase, expand_binop (Pmode, add_optab, base,
1093 gen_int_mode (base_align_bias
1094 - base_offset, Pmode),
1095 NULL_RTX, 1, OPTAB_DIRECT));
1097 mem = gen_rtx_MEM (ptr_mode, base);
1098 mem = adjust_address (mem, VOIDmode, base_align_bias);
1099 emit_move_insn (mem, gen_int_mode (ASAN_STACK_FRAME_MAGIC, ptr_mode));
1100 mem = adjust_address (mem, VOIDmode, GET_MODE_SIZE (ptr_mode));
1101 emit_move_insn (mem, expand_normal (str_cst));
1102 mem = adjust_address (mem, VOIDmode, GET_MODE_SIZE (ptr_mode));
1103 ASM_GENERATE_INTERNAL_LABEL (buf, "LASANPC", current_function_funcdef_no);
1104 id = get_identifier (buf);
1105 decl = build_decl (DECL_SOURCE_LOCATION (current_function_decl),
1106 VAR_DECL, id, char_type_node);
1107 SET_DECL_ASSEMBLER_NAME (decl, id);
1108 TREE_ADDRESSABLE (decl) = 1;
1109 TREE_READONLY (decl) = 1;
1110 DECL_ARTIFICIAL (decl) = 1;
1111 DECL_IGNORED_P (decl) = 1;
1112 TREE_STATIC (decl) = 1;
1113 TREE_PUBLIC (decl) = 0;
1114 TREE_USED (decl) = 1;
1115 DECL_INITIAL (decl) = decl;
1116 TREE_ASM_WRITTEN (decl) = 1;
1117 TREE_ASM_WRITTEN (id) = 1;
1118 emit_move_insn (mem, expand_normal (build_fold_addr_expr (decl)));
1119 shadow_base = expand_binop (Pmode, lshr_optab, base,
1120 GEN_INT (ASAN_SHADOW_SHIFT),
1121 NULL_RTX, 1, OPTAB_DIRECT);
1122 shadow_base
1123 = plus_constant (Pmode, shadow_base,
1124 targetm.asan_shadow_offset ()
1125 + (base_align_bias >> ASAN_SHADOW_SHIFT));
1126 gcc_assert (asan_shadow_set != -1
1127 && (ASAN_RED_ZONE_SIZE >> ASAN_SHADOW_SHIFT) == 4);
1128 shadow_mem = gen_rtx_MEM (SImode, shadow_base);
1129 set_mem_alias_set (shadow_mem, asan_shadow_set);
1130 if (STRICT_ALIGNMENT)
1131 set_mem_align (shadow_mem, (GET_MODE_ALIGNMENT (SImode)));
1132 prev_offset = base_offset;
1133 for (l = length; l; l -= 2)
1135 if (l == 2)
1136 cur_shadow_byte = ASAN_STACK_MAGIC_RIGHT;
1137 offset = offsets[l - 1];
1138 if ((offset - base_offset) & (ASAN_RED_ZONE_SIZE - 1))
1140 int i;
1141 HOST_WIDE_INT aoff
1142 = base_offset + ((offset - base_offset)
1143 & ~(ASAN_RED_ZONE_SIZE - HOST_WIDE_INT_1));
1144 shadow_mem = adjust_address (shadow_mem, VOIDmode,
1145 (aoff - prev_offset)
1146 >> ASAN_SHADOW_SHIFT);
1147 prev_offset = aoff;
1148 for (i = 0; i < 4; i++, aoff += (1 << ASAN_SHADOW_SHIFT))
1149 if (aoff < offset)
1151 if (aoff < offset - (1 << ASAN_SHADOW_SHIFT) + 1)
1152 shadow_bytes[i] = 0;
1153 else
1154 shadow_bytes[i] = offset - aoff;
1156 else
1157 shadow_bytes[i] = ASAN_STACK_MAGIC_PARTIAL;
1158 emit_move_insn (shadow_mem, asan_shadow_cst (shadow_bytes));
1159 offset = aoff;
1161 while (offset <= offsets[l - 2] - ASAN_RED_ZONE_SIZE)
1163 shadow_mem = adjust_address (shadow_mem, VOIDmode,
1164 (offset - prev_offset)
1165 >> ASAN_SHADOW_SHIFT);
1166 prev_offset = offset;
1167 memset (shadow_bytes, cur_shadow_byte, 4);
1168 emit_move_insn (shadow_mem, asan_shadow_cst (shadow_bytes));
1169 offset += ASAN_RED_ZONE_SIZE;
1171 cur_shadow_byte = ASAN_STACK_MAGIC_MIDDLE;
1173 do_pending_stack_adjust ();
1175 /* Construct epilogue sequence. */
1176 start_sequence ();
1178 lab = NULL;
1179 if (use_after_return_class != -1)
1181 rtx_code_label *lab2 = gen_label_rtx ();
1182 char c = (char) ASAN_STACK_MAGIC_USE_AFTER_RET;
1183 int very_likely = REG_BR_PROB_BASE - (REG_BR_PROB_BASE / 2000 - 1);
1184 emit_cmp_and_jump_insns (orig_base, base, EQ, NULL_RTX,
1185 VOIDmode, 0, lab2, very_likely);
1186 shadow_mem = gen_rtx_MEM (BLKmode, shadow_base);
1187 set_mem_alias_set (shadow_mem, asan_shadow_set);
1188 mem = gen_rtx_MEM (ptr_mode, base);
1189 mem = adjust_address (mem, VOIDmode, base_align_bias);
1190 emit_move_insn (mem, gen_int_mode (ASAN_STACK_RETIRED_MAGIC, ptr_mode));
1191 unsigned HOST_WIDE_INT sz = asan_frame_size >> ASAN_SHADOW_SHIFT;
1192 if (use_after_return_class < 5
1193 && can_store_by_pieces (sz, builtin_memset_read_str, &c,
1194 BITS_PER_UNIT, true))
1195 store_by_pieces (shadow_mem, sz, builtin_memset_read_str, &c,
1196 BITS_PER_UNIT, true, 0);
1197 else if (use_after_return_class >= 5
1198 || !set_storage_via_setmem (shadow_mem,
1199 GEN_INT (sz),
1200 gen_int_mode (c, QImode),
1201 BITS_PER_UNIT, BITS_PER_UNIT,
1202 -1, sz, sz, sz))
1204 snprintf (buf, sizeof buf, "__asan_stack_free_%d",
1205 use_after_return_class);
1206 ret = init_one_libfunc (buf);
1207 rtx addr = convert_memory_address (ptr_mode, base);
1208 rtx orig_addr = convert_memory_address (ptr_mode, orig_base);
1209 emit_library_call (ret, LCT_NORMAL, ptr_mode, 3, addr, ptr_mode,
1210 GEN_INT (asan_frame_size + base_align_bias),
1211 TYPE_MODE (pointer_sized_int_node),
1212 orig_addr, ptr_mode);
1214 lab = gen_label_rtx ();
1215 emit_jump (lab);
1216 emit_label (lab2);
1219 shadow_mem = gen_rtx_MEM (BLKmode, shadow_base);
1220 set_mem_alias_set (shadow_mem, asan_shadow_set);
1222 if (STRICT_ALIGNMENT)
1223 set_mem_align (shadow_mem, (GET_MODE_ALIGNMENT (SImode)));
1225 prev_offset = base_offset;
1226 last_offset = base_offset;
1227 last_size = 0;
1228 for (l = length; l; l -= 2)
1230 offset = base_offset + ((offsets[l - 1] - base_offset)
1231 & ~(ASAN_RED_ZONE_SIZE - HOST_WIDE_INT_1));
1232 if (last_offset + last_size != offset)
1234 shadow_mem = adjust_address (shadow_mem, VOIDmode,
1235 (last_offset - prev_offset)
1236 >> ASAN_SHADOW_SHIFT);
1237 prev_offset = last_offset;
1238 asan_clear_shadow (shadow_mem, last_size >> ASAN_SHADOW_SHIFT);
1239 last_offset = offset;
1240 last_size = 0;
1242 last_size += base_offset + ((offsets[l - 2] - base_offset)
1243 & ~(ASAN_RED_ZONE_SIZE - HOST_WIDE_INT_1))
1244 - offset;
1246 if (last_size)
1248 shadow_mem = adjust_address (shadow_mem, VOIDmode,
1249 (last_offset - prev_offset)
1250 >> ASAN_SHADOW_SHIFT);
1251 asan_clear_shadow (shadow_mem, last_size >> ASAN_SHADOW_SHIFT);
1254 do_pending_stack_adjust ();
1255 if (lab)
1256 emit_label (lab);
1258 insns = get_insns ();
1259 end_sequence ();
1260 return insns;
1263 /* Return true if DECL, a global var, might be overridden and needs
1264 therefore a local alias. */
1266 static bool
1267 asan_needs_local_alias (tree decl)
1269 return DECL_WEAK (decl) || !targetm.binds_local_p (decl);
1272 /* Return true if DECL is a VAR_DECL that should be protected
1273 by Address Sanitizer, by appending a red zone with protected
1274 shadow memory after it and aligning it to at least
1275 ASAN_RED_ZONE_SIZE bytes. */
1277 bool
1278 asan_protect_global (tree decl)
1280 if (!ASAN_GLOBALS)
1281 return false;
1283 rtx rtl, symbol;
1285 if (TREE_CODE (decl) == STRING_CST)
1287 /* Instrument all STRING_CSTs except those created
1288 by asan_pp_string here. */
1289 if (shadow_ptr_types[0] != NULL_TREE
1290 && TREE_CODE (TREE_TYPE (decl)) == ARRAY_TYPE
1291 && TREE_TYPE (TREE_TYPE (decl)) == TREE_TYPE (shadow_ptr_types[0]))
1292 return false;
1293 return true;
1295 if (TREE_CODE (decl) != VAR_DECL
1296 /* TLS vars aren't statically protectable. */
1297 || DECL_THREAD_LOCAL_P (decl)
1298 /* Externs will be protected elsewhere. */
1299 || DECL_EXTERNAL (decl)
1300 || !DECL_RTL_SET_P (decl)
1301 /* Comdat vars pose an ABI problem, we can't know if
1302 the var that is selected by the linker will have
1303 padding or not. */
1304 || DECL_ONE_ONLY (decl)
1305 /* Similarly for common vars. People can use -fno-common. */
1306 || (DECL_COMMON (decl) && TREE_PUBLIC (decl))
1307 /* Don't protect if using user section, often vars placed
1308 into user section from multiple TUs are then assumed
1309 to be an array of such vars, putting padding in there
1310 breaks this assumption. */
1311 || (DECL_SECTION_NAME (decl) != NULL
1312 && !symtab_node::get (decl)->implicit_section)
1313 || DECL_SIZE (decl) == 0
1314 || ASAN_RED_ZONE_SIZE * BITS_PER_UNIT > MAX_OFILE_ALIGNMENT
1315 || !valid_constant_size_p (DECL_SIZE_UNIT (decl))
1316 || DECL_ALIGN_UNIT (decl) > 2 * ASAN_RED_ZONE_SIZE)
1317 return false;
1319 rtl = DECL_RTL (decl);
1320 if (!MEM_P (rtl) || GET_CODE (XEXP (rtl, 0)) != SYMBOL_REF)
1321 return false;
1322 symbol = XEXP (rtl, 0);
1324 if (CONSTANT_POOL_ADDRESS_P (symbol)
1325 || TREE_CONSTANT_POOL_ADDRESS_P (symbol))
1326 return false;
1328 if (lookup_attribute ("weakref", DECL_ATTRIBUTES (decl)))
1329 return false;
1331 #ifndef ASM_OUTPUT_DEF
1332 if (asan_needs_local_alias (decl))
1333 return false;
1334 #endif
1336 return true;
1339 /* Construct a function tree for __asan_report_{load,store}{1,2,4,8,16,_n}.
1340 IS_STORE is either 1 (for a store) or 0 (for a load). */
1342 static tree
1343 report_error_func (bool is_store, HOST_WIDE_INT size_in_bytes, int *nargs)
1345 static enum built_in_function report[2][6]
1346 = { { BUILT_IN_ASAN_REPORT_LOAD1, BUILT_IN_ASAN_REPORT_LOAD2,
1347 BUILT_IN_ASAN_REPORT_LOAD4, BUILT_IN_ASAN_REPORT_LOAD8,
1348 BUILT_IN_ASAN_REPORT_LOAD16, BUILT_IN_ASAN_REPORT_LOAD_N },
1349 { BUILT_IN_ASAN_REPORT_STORE1, BUILT_IN_ASAN_REPORT_STORE2,
1350 BUILT_IN_ASAN_REPORT_STORE4, BUILT_IN_ASAN_REPORT_STORE8,
1351 BUILT_IN_ASAN_REPORT_STORE16, BUILT_IN_ASAN_REPORT_STORE_N } };
1352 if (size_in_bytes == -1)
1354 *nargs = 2;
1355 return builtin_decl_implicit (report[is_store][5]);
1357 *nargs = 1;
1358 return builtin_decl_implicit (report[is_store][exact_log2 (size_in_bytes)]);
1361 /* Construct a function tree for __asan_{load,store}{1,2,4,8,16,_n}.
1362 IS_STORE is either 1 (for a store) or 0 (for a load). */
1364 static tree
1365 check_func (bool is_store, int size_in_bytes, int *nargs)
1367 static enum built_in_function check[2][6]
1368 = { { BUILT_IN_ASAN_LOAD1, BUILT_IN_ASAN_LOAD2,
1369 BUILT_IN_ASAN_LOAD4, BUILT_IN_ASAN_LOAD8,
1370 BUILT_IN_ASAN_LOAD16, BUILT_IN_ASAN_LOADN },
1371 { BUILT_IN_ASAN_STORE1, BUILT_IN_ASAN_STORE2,
1372 BUILT_IN_ASAN_STORE4, BUILT_IN_ASAN_STORE8,
1373 BUILT_IN_ASAN_STORE16, BUILT_IN_ASAN_STOREN } };
1374 if (size_in_bytes == -1)
1376 *nargs = 2;
1377 return builtin_decl_implicit (check[is_store][5]);
1379 *nargs = 1;
1380 return builtin_decl_implicit (check[is_store][exact_log2 (size_in_bytes)]);
1383 /* Split the current basic block and create a condition statement
1384 insertion point right before or after the statement pointed to by
1385 ITER. Return an iterator to the point at which the caller might
1386 safely insert the condition statement.
1388 THEN_BLOCK must be set to the address of an uninitialized instance
1389 of basic_block. The function will then set *THEN_BLOCK to the
1390 'then block' of the condition statement to be inserted by the
1391 caller.
1393 If CREATE_THEN_FALLTHRU_EDGE is false, no edge will be created from
1394 *THEN_BLOCK to *FALLTHROUGH_BLOCK.
1396 Similarly, the function will set *FALLTRHOUGH_BLOCK to the 'else
1397 block' of the condition statement to be inserted by the caller.
1399 Note that *FALLTHROUGH_BLOCK is a new block that contains the
1400 statements starting from *ITER, and *THEN_BLOCK is a new empty
1401 block.
1403 *ITER is adjusted to point to always point to the first statement
1404 of the basic block * FALLTHROUGH_BLOCK. That statement is the
1405 same as what ITER was pointing to prior to calling this function,
1406 if BEFORE_P is true; otherwise, it is its following statement. */
1408 gimple_stmt_iterator
1409 create_cond_insert_point (gimple_stmt_iterator *iter,
1410 bool before_p,
1411 bool then_more_likely_p,
1412 bool create_then_fallthru_edge,
1413 basic_block *then_block,
1414 basic_block *fallthrough_block)
1416 gimple_stmt_iterator gsi = *iter;
1418 if (!gsi_end_p (gsi) && before_p)
1419 gsi_prev (&gsi);
1421 basic_block cur_bb = gsi_bb (*iter);
1423 edge e = split_block (cur_bb, gsi_stmt (gsi));
1425 /* Get a hold on the 'condition block', the 'then block' and the
1426 'else block'. */
1427 basic_block cond_bb = e->src;
1428 basic_block fallthru_bb = e->dest;
1429 basic_block then_bb = create_empty_bb (cond_bb);
1430 if (current_loops)
1432 add_bb_to_loop (then_bb, cond_bb->loop_father);
1433 loops_state_set (LOOPS_NEED_FIXUP);
1436 /* Set up the newly created 'then block'. */
1437 e = make_edge (cond_bb, then_bb, EDGE_TRUE_VALUE);
1438 int fallthrough_probability
1439 = then_more_likely_p
1440 ? PROB_VERY_UNLIKELY
1441 : PROB_ALWAYS - PROB_VERY_UNLIKELY;
1442 e->probability = PROB_ALWAYS - fallthrough_probability;
1443 if (create_then_fallthru_edge)
1444 make_single_succ_edge (then_bb, fallthru_bb, EDGE_FALLTHRU);
1446 /* Set up the fallthrough basic block. */
1447 e = find_edge (cond_bb, fallthru_bb);
1448 e->flags = EDGE_FALSE_VALUE;
1449 e->count = cond_bb->count;
1450 e->probability = fallthrough_probability;
1452 /* Update dominance info for the newly created then_bb; note that
1453 fallthru_bb's dominance info has already been updated by
1454 split_bock. */
1455 if (dom_info_available_p (CDI_DOMINATORS))
1456 set_immediate_dominator (CDI_DOMINATORS, then_bb, cond_bb);
1458 *then_block = then_bb;
1459 *fallthrough_block = fallthru_bb;
1460 *iter = gsi_start_bb (fallthru_bb);
1462 return gsi_last_bb (cond_bb);
1465 /* Insert an if condition followed by a 'then block' right before the
1466 statement pointed to by ITER. The fallthrough block -- which is the
1467 else block of the condition as well as the destination of the
1468 outcoming edge of the 'then block' -- starts with the statement
1469 pointed to by ITER.
1471 COND is the condition of the if.
1473 If THEN_MORE_LIKELY_P is true, the probability of the edge to the
1474 'then block' is higher than the probability of the edge to the
1475 fallthrough block.
1477 Upon completion of the function, *THEN_BB is set to the newly
1478 inserted 'then block' and similarly, *FALLTHROUGH_BB is set to the
1479 fallthrough block.
1481 *ITER is adjusted to still point to the same statement it was
1482 pointing to initially. */
1484 static void
1485 insert_if_then_before_iter (gimple cond,
1486 gimple_stmt_iterator *iter,
1487 bool then_more_likely_p,
1488 basic_block *then_bb,
1489 basic_block *fallthrough_bb)
1491 gimple_stmt_iterator cond_insert_point =
1492 create_cond_insert_point (iter,
1493 /*before_p=*/true,
1494 then_more_likely_p,
1495 /*create_then_fallthru_edge=*/true,
1496 then_bb,
1497 fallthrough_bb);
1498 gsi_insert_after (&cond_insert_point, cond, GSI_NEW_STMT);
1501 /* Build
1502 (base_addr >> ASAN_SHADOW_SHIFT) + targetm.asan_shadow_offset (). */
1504 static tree
1505 build_shadow_mem_access (gimple_stmt_iterator *gsi, location_t location,
1506 tree base_addr, tree shadow_ptr_type)
1508 tree t, uintptr_type = TREE_TYPE (base_addr);
1509 tree shadow_type = TREE_TYPE (shadow_ptr_type);
1510 gimple g;
1512 t = build_int_cst (uintptr_type, ASAN_SHADOW_SHIFT);
1513 g = gimple_build_assign_with_ops (RSHIFT_EXPR,
1514 make_ssa_name (uintptr_type, NULL),
1515 base_addr, t);
1516 gimple_set_location (g, location);
1517 gsi_insert_after (gsi, g, GSI_NEW_STMT);
1519 t = build_int_cst (uintptr_type, targetm.asan_shadow_offset ());
1520 g = gimple_build_assign_with_ops (PLUS_EXPR,
1521 make_ssa_name (uintptr_type, NULL),
1522 gimple_assign_lhs (g), t);
1523 gimple_set_location (g, location);
1524 gsi_insert_after (gsi, g, GSI_NEW_STMT);
1526 g = gimple_build_assign_with_ops (NOP_EXPR,
1527 make_ssa_name (shadow_ptr_type, NULL),
1528 gimple_assign_lhs (g), NULL_TREE);
1529 gimple_set_location (g, location);
1530 gsi_insert_after (gsi, g, GSI_NEW_STMT);
1532 t = build2 (MEM_REF, shadow_type, gimple_assign_lhs (g),
1533 build_int_cst (shadow_ptr_type, 0));
1534 g = gimple_build_assign_with_ops (MEM_REF,
1535 make_ssa_name (shadow_type, NULL),
1536 t, NULL_TREE);
1537 gimple_set_location (g, location);
1538 gsi_insert_after (gsi, g, GSI_NEW_STMT);
1539 return gimple_assign_lhs (g);
1542 /* BASE can already be an SSA_NAME; in that case, do not create a
1543 new SSA_NAME for it. */
1545 static tree
1546 maybe_create_ssa_name (location_t loc, tree base, gimple_stmt_iterator *iter,
1547 bool before_p)
1549 if (TREE_CODE (base) == SSA_NAME)
1550 return base;
1551 gimple g
1552 = gimple_build_assign_with_ops (TREE_CODE (base),
1553 make_ssa_name (TREE_TYPE (base), NULL),
1554 base, NULL_TREE);
1555 gimple_set_location (g, loc);
1556 if (before_p)
1557 gsi_insert_before (iter, g, GSI_SAME_STMT);
1558 else
1559 gsi_insert_after (iter, g, GSI_NEW_STMT);
1560 return gimple_assign_lhs (g);
1563 /* LEN can already have necessary size and precision;
1564 in that case, do not create a new variable. */
1566 tree
1567 maybe_cast_to_ptrmode (location_t loc, tree len, gimple_stmt_iterator *iter,
1568 bool before_p)
1570 if (ptrofftype_p (len))
1571 return len;
1572 gimple g
1573 = gimple_build_assign_with_ops (NOP_EXPR,
1574 make_ssa_name (pointer_sized_int_node, NULL),
1575 len, NULL);
1576 gimple_set_location (g, loc);
1577 if (before_p)
1578 gsi_insert_before (iter, g, GSI_SAME_STMT);
1579 else
1580 gsi_insert_after (iter, g, GSI_NEW_STMT);
1581 return gimple_assign_lhs (g);
1584 /* Instrument the memory access instruction BASE. Insert new
1585 statements before or after ITER.
1587 Note that the memory access represented by BASE can be either an
1588 SSA_NAME, or a non-SSA expression. LOCATION is the source code
1589 location. IS_STORE is TRUE for a store, FALSE for a load.
1590 BEFORE_P is TRUE for inserting the instrumentation code before
1591 ITER, FALSE for inserting it after ITER. IS_SCALAR_ACCESS is TRUE
1592 for a scalar memory access and FALSE for memory region access.
1593 NON_ZERO_P is TRUE if memory region is guaranteed to have non-zero
1594 length. ALIGN tells alignment of accessed memory object.
1596 START_INSTRUMENTED and END_INSTRUMENTED are TRUE if start/end of
1597 memory region have already been instrumented.
1599 If BEFORE_P is TRUE, *ITER is arranged to still point to the
1600 statement it was pointing to prior to calling this function,
1601 otherwise, it points to the statement logically following it. */
1603 static void
1604 build_check_stmt (location_t loc, tree base, tree len,
1605 HOST_WIDE_INT size_in_bytes, gimple_stmt_iterator *iter,
1606 bool is_non_zero_len, bool before_p, bool is_store,
1607 bool is_scalar_access, unsigned int align = 0,
1608 bool start_instrumented = false,
1609 bool end_instrumented = false)
1611 gimple_stmt_iterator gsi = *iter;
1612 gimple g;
1614 gcc_assert (!(size_in_bytes > 0 && !is_non_zero_len));
1616 if (start_instrumented && end_instrumented)
1618 if (!before_p)
1619 gsi_next (iter);
1620 return;
1623 gsi = *iter;
1625 base = unshare_expr (base);
1626 base = maybe_create_ssa_name (loc, base, &gsi, before_p);
1628 if (len)
1630 len = unshare_expr (len);
1631 len = maybe_cast_to_ptrmode (loc, len, iter, before_p);
1633 else
1635 gcc_assert (size_in_bytes != -1);
1636 len = build_int_cst (pointer_sized_int_node, size_in_bytes);
1639 if (size_in_bytes > 1)
1641 if ((size_in_bytes & (size_in_bytes - 1)) != 0
1642 || size_in_bytes > 16)
1643 is_scalar_access = false;
1644 else if (align && align < size_in_bytes * BITS_PER_UNIT)
1646 /* On non-strict alignment targets, if
1647 16-byte access is just 8-byte aligned,
1648 this will result in misaligned shadow
1649 memory 2 byte load, but otherwise can
1650 be handled using one read. */
1651 if (size_in_bytes != 16
1652 || STRICT_ALIGNMENT
1653 || align < 8 * BITS_PER_UNIT)
1654 is_scalar_access = false;
1658 HOST_WIDE_INT flags = 0;
1659 if (is_store)
1660 flags |= ASAN_CHECK_STORE;
1661 if (is_non_zero_len)
1662 flags |= ASAN_CHECK_NON_ZERO_LEN;
1663 if (is_scalar_access)
1664 flags |= ASAN_CHECK_SCALAR_ACCESS;
1665 if (start_instrumented)
1666 flags |= ASAN_CHECK_START_INSTRUMENTED;
1667 if (end_instrumented)
1668 flags |= ASAN_CHECK_END_INSTRUMENTED;
1670 g = gimple_build_call_internal (IFN_ASAN_CHECK, 3,
1671 build_int_cst (integer_type_node, flags),
1672 base, len);
1673 gimple_set_location (g, loc);
1674 if (before_p)
1675 gsi_insert_before (&gsi, g, GSI_SAME_STMT);
1676 else
1678 gsi_insert_after (&gsi, g, GSI_NEW_STMT);
1679 gsi_next (&gsi);
1680 *iter = gsi;
1684 /* If T represents a memory access, add instrumentation code before ITER.
1685 LOCATION is source code location.
1686 IS_STORE is either TRUE (for a store) or FALSE (for a load). */
1688 static void
1689 instrument_derefs (gimple_stmt_iterator *iter, tree t,
1690 location_t location, bool is_store)
1692 if (is_store && !ASAN_INSTRUMENT_WRITES)
1693 return;
1694 if (!is_store && !ASAN_INSTRUMENT_READS)
1695 return;
1697 tree type, base;
1698 HOST_WIDE_INT size_in_bytes;
1700 type = TREE_TYPE (t);
1701 switch (TREE_CODE (t))
1703 case ARRAY_REF:
1704 case COMPONENT_REF:
1705 case INDIRECT_REF:
1706 case MEM_REF:
1707 case VAR_DECL:
1708 break;
1709 /* FALLTHRU */
1710 default:
1711 return;
1714 size_in_bytes = int_size_in_bytes (type);
1715 if (size_in_bytes <= 0)
1716 return;
1718 HOST_WIDE_INT bitsize, bitpos;
1719 tree offset;
1720 enum machine_mode mode;
1721 int volatilep = 0, unsignedp = 0;
1722 tree inner = get_inner_reference (t, &bitsize, &bitpos, &offset,
1723 &mode, &unsignedp, &volatilep, false);
1725 if (TREE_CODE (t) == COMPONENT_REF
1726 && DECL_BIT_FIELD_REPRESENTATIVE (TREE_OPERAND (t, 1)) != NULL_TREE)
1728 tree repr = DECL_BIT_FIELD_REPRESENTATIVE (TREE_OPERAND (t, 1));
1729 instrument_derefs (iter, build3 (COMPONENT_REF, TREE_TYPE (repr),
1730 TREE_OPERAND (t, 0), repr,
1731 NULL_TREE), location, is_store);
1732 return;
1735 if (bitpos % BITS_PER_UNIT
1736 || bitsize != size_in_bytes * BITS_PER_UNIT)
1737 return;
1739 if (TREE_CODE (inner) == VAR_DECL
1740 && offset == NULL_TREE
1741 && bitpos >= 0
1742 && DECL_SIZE (inner)
1743 && tree_fits_shwi_p (DECL_SIZE (inner))
1744 && bitpos + bitsize <= tree_to_shwi (DECL_SIZE (inner)))
1746 if (DECL_THREAD_LOCAL_P (inner))
1747 return;
1748 if (!TREE_STATIC (inner))
1750 /* Automatic vars in the current function will be always
1751 accessible. */
1752 if (decl_function_context (inner) == current_function_decl)
1753 return;
1755 /* Always instrument external vars, they might be dynamically
1756 initialized. */
1757 else if (!DECL_EXTERNAL (inner))
1759 /* For static vars if they are known not to be dynamically
1760 initialized, they will be always accessible. */
1761 varpool_node *vnode = varpool_node::get (inner);
1762 if (vnode && !vnode->dynamically_initialized)
1763 return;
1767 base = build_fold_addr_expr (t);
1768 if (!has_mem_ref_been_instrumented (base, size_in_bytes))
1770 unsigned int align = get_object_alignment (t);
1771 build_check_stmt (location, base, NULL_TREE, size_in_bytes, iter,
1772 /*is_non_zero_len*/size_in_bytes > 0, /*before_p=*/true,
1773 is_store, /*is_scalar_access*/true, align);
1774 update_mem_ref_hash_table (base, size_in_bytes);
1775 update_mem_ref_hash_table (t, size_in_bytes);
1780 /* Instrument an access to a contiguous memory region that starts at
1781 the address pointed to by BASE, over a length of LEN (expressed in
1782 the sizeof (*BASE) bytes). ITER points to the instruction before
1783 which the instrumentation instructions must be inserted. LOCATION
1784 is the source location that the instrumentation instructions must
1785 have. If IS_STORE is true, then the memory access is a store;
1786 otherwise, it's a load. */
1788 static void
1789 instrument_mem_region_access (tree base, tree len,
1790 gimple_stmt_iterator *iter,
1791 location_t location, bool is_store)
1793 if (!POINTER_TYPE_P (TREE_TYPE (base))
1794 || !INTEGRAL_TYPE_P (TREE_TYPE (len))
1795 || integer_zerop (len))
1796 return;
1798 /* If the beginning of the memory region has already been
1799 instrumented, do not instrument it. */
1800 bool start_instrumented = has_mem_ref_been_instrumented (base, 1);
1802 /* If the end of the memory region has already been instrumented, do
1803 not instrument it. */
1804 tree end = asan_mem_ref_get_end (base, len);
1805 bool end_instrumented = has_mem_ref_been_instrumented (end, 1);
1807 HOST_WIDE_INT size_in_bytes = tree_fits_shwi_p (len) ? tree_to_shwi (len) : -1;
1809 build_check_stmt (location, base, len, size_in_bytes, iter,
1810 /*is_non_zero_len*/size_in_bytes > 0, /*before_p*/true,
1811 is_store, /*is_scalar_access*/false, /*align*/0,
1812 start_instrumented, end_instrumented);
1814 update_mem_ref_hash_table (base, 1);
1815 if (size_in_bytes != -1)
1816 update_mem_ref_hash_table (end, 1);
1818 *iter = gsi_for_stmt (gsi_stmt (*iter));
1821 /* Instrument the call (to the builtin strlen function) pointed to by
1822 ITER.
1824 This function instruments the access to the first byte of the
1825 argument, right before the call. After the call it instruments the
1826 access to the last byte of the argument; it uses the result of the
1827 call to deduce the offset of that last byte.
1829 Upon completion, iff the call has actually been instrumented, this
1830 function returns TRUE and *ITER points to the statement logically
1831 following the built-in strlen function call *ITER was initially
1832 pointing to. Otherwise, the function returns FALSE and *ITER
1833 remains unchanged. */
1835 static bool
1836 instrument_strlen_call (gimple_stmt_iterator *iter)
1838 gimple g;
1839 gimple call = gsi_stmt (*iter);
1840 gcc_assert (is_gimple_call (call));
1842 tree callee = gimple_call_fndecl (call);
1843 gcc_assert (is_builtin_fn (callee)
1844 && DECL_BUILT_IN_CLASS (callee) == BUILT_IN_NORMAL
1845 && DECL_FUNCTION_CODE (callee) == BUILT_IN_STRLEN);
1847 location_t loc = gimple_location (call);
1849 tree len = gimple_call_lhs (call);
1850 if (len == NULL)
1851 /* Some passes might clear the return value of the strlen call;
1852 bail out in that case. Return FALSE as we are not advancing
1853 *ITER. */
1854 return false;
1855 gcc_assert (INTEGRAL_TYPE_P (TREE_TYPE (len)));
1857 len = maybe_cast_to_ptrmode (loc, len, iter, /*before_p*/false);
1859 tree str_arg = gimple_call_arg (call, 0);
1860 bool start_instrumented = has_mem_ref_been_instrumented (str_arg, 1);
1862 tree cptr_type = build_pointer_type (char_type_node);
1863 g = gimple_build_assign_with_ops (NOP_EXPR,
1864 make_ssa_name (cptr_type, NULL),
1865 str_arg, NULL);
1866 gimple_set_location (g, loc);
1867 gsi_insert_before (iter, g, GSI_SAME_STMT);
1868 str_arg = gimple_assign_lhs (g);
1870 build_check_stmt (loc, str_arg, NULL_TREE, 1, iter,
1871 /*is_non_zero_len*/true, /*before_p=*/true,
1872 /*is_store=*/false, /*is_scalar_access*/true, /*align*/0,
1873 start_instrumented, start_instrumented);
1875 g = gimple_build_assign_with_ops (POINTER_PLUS_EXPR,
1876 make_ssa_name (cptr_type, NULL),
1877 str_arg,
1878 len);
1879 gimple_set_location (g, loc);
1880 gsi_insert_after (iter, g, GSI_NEW_STMT);
1882 build_check_stmt (loc, gimple_assign_lhs (g), NULL_TREE, 1, iter,
1883 /*is_non_zero_len*/true, /*before_p=*/false,
1884 /*is_store=*/false, /*is_scalar_access*/true, /*align*/0);
1886 return true;
1889 /* Instrument the call to a built-in memory access function that is
1890 pointed to by the iterator ITER.
1892 Upon completion, return TRUE iff *ITER has been advanced to the
1893 statement following the one it was originally pointing to. */
1895 static bool
1896 instrument_builtin_call (gimple_stmt_iterator *iter)
1898 if (!ASAN_MEMINTRIN)
1899 return false;
1901 bool iter_advanced_p = false;
1902 gimple call = gsi_stmt (*iter);
1904 gcc_checking_assert (gimple_call_builtin_p (call, BUILT_IN_NORMAL));
1906 tree callee = gimple_call_fndecl (call);
1907 location_t loc = gimple_location (call);
1909 if (DECL_FUNCTION_CODE (callee) == BUILT_IN_STRLEN)
1910 iter_advanced_p = instrument_strlen_call (iter);
1911 else
1913 asan_mem_ref src0, src1, dest;
1914 asan_mem_ref_init (&src0, NULL, 1);
1915 asan_mem_ref_init (&src1, NULL, 1);
1916 asan_mem_ref_init (&dest, NULL, 1);
1918 tree src0_len = NULL_TREE, src1_len = NULL_TREE, dest_len = NULL_TREE;
1919 bool src0_is_store = false, src1_is_store = false,
1920 dest_is_store = false, dest_is_deref = false;
1922 if (get_mem_refs_of_builtin_call (call,
1923 &src0, &src0_len, &src0_is_store,
1924 &src1, &src1_len, &src1_is_store,
1925 &dest, &dest_len, &dest_is_store,
1926 &dest_is_deref))
1928 if (dest_is_deref)
1930 instrument_derefs (iter, dest.start, loc, dest_is_store);
1931 gsi_next (iter);
1932 iter_advanced_p = true;
1934 else if (src0_len || src1_len || dest_len)
1936 if (src0.start != NULL_TREE)
1937 instrument_mem_region_access (src0.start, src0_len,
1938 iter, loc, /*is_store=*/false);
1939 if (src1.start != NULL_TREE)
1940 instrument_mem_region_access (src1.start, src1_len,
1941 iter, loc, /*is_store=*/false);
1942 if (dest.start != NULL_TREE)
1943 instrument_mem_region_access (dest.start, dest_len,
1944 iter, loc, /*is_store=*/true);
1945 *iter = gsi_for_stmt (call);
1946 gsi_next (iter);
1947 iter_advanced_p = true;
1951 return iter_advanced_p;
1954 /* Instrument the assignment statement ITER if it is subject to
1955 instrumentation. Return TRUE iff instrumentation actually
1956 happened. In that case, the iterator ITER is advanced to the next
1957 logical expression following the one initially pointed to by ITER,
1958 and the relevant memory reference that which access has been
1959 instrumented is added to the memory references hash table. */
1961 static bool
1962 maybe_instrument_assignment (gimple_stmt_iterator *iter)
1964 gimple s = gsi_stmt (*iter);
1966 gcc_assert (gimple_assign_single_p (s));
1968 tree ref_expr = NULL_TREE;
1969 bool is_store, is_instrumented = false;
1971 if (gimple_store_p (s))
1973 ref_expr = gimple_assign_lhs (s);
1974 is_store = true;
1975 instrument_derefs (iter, ref_expr,
1976 gimple_location (s),
1977 is_store);
1978 is_instrumented = true;
1981 if (gimple_assign_load_p (s))
1983 ref_expr = gimple_assign_rhs1 (s);
1984 is_store = false;
1985 instrument_derefs (iter, ref_expr,
1986 gimple_location (s),
1987 is_store);
1988 is_instrumented = true;
1991 if (is_instrumented)
1992 gsi_next (iter);
1994 return is_instrumented;
1997 /* Instrument the function call pointed to by the iterator ITER, if it
1998 is subject to instrumentation. At the moment, the only function
1999 calls that are instrumented are some built-in functions that access
2000 memory. Look at instrument_builtin_call to learn more.
2002 Upon completion return TRUE iff *ITER was advanced to the statement
2003 following the one it was originally pointing to. */
2005 static bool
2006 maybe_instrument_call (gimple_stmt_iterator *iter)
2008 gimple stmt = gsi_stmt (*iter);
2009 bool is_builtin = gimple_call_builtin_p (stmt, BUILT_IN_NORMAL);
2011 if (is_builtin && instrument_builtin_call (iter))
2012 return true;
2014 if (gimple_call_noreturn_p (stmt))
2016 if (is_builtin)
2018 tree callee = gimple_call_fndecl (stmt);
2019 switch (DECL_FUNCTION_CODE (callee))
2021 case BUILT_IN_UNREACHABLE:
2022 case BUILT_IN_TRAP:
2023 /* Don't instrument these. */
2024 return false;
2027 tree decl = builtin_decl_implicit (BUILT_IN_ASAN_HANDLE_NO_RETURN);
2028 gimple g = gimple_build_call (decl, 0);
2029 gimple_set_location (g, gimple_location (stmt));
2030 gsi_insert_before (iter, g, GSI_SAME_STMT);
2032 return false;
2035 /* Walk each instruction of all basic block and instrument those that
2036 represent memory references: loads, stores, or function calls.
2037 In a given basic block, this function avoids instrumenting memory
2038 references that have already been instrumented. */
2040 static void
2041 transform_statements (void)
2043 basic_block bb, last_bb = NULL;
2044 gimple_stmt_iterator i;
2045 int saved_last_basic_block = last_basic_block_for_fn (cfun);
2047 FOR_EACH_BB_FN (bb, cfun)
2049 basic_block prev_bb = bb;
2051 if (bb->index >= saved_last_basic_block) continue;
2053 /* Flush the mem ref hash table, if current bb doesn't have
2054 exactly one predecessor, or if that predecessor (skipping
2055 over asan created basic blocks) isn't the last processed
2056 basic block. Thus we effectively flush on extended basic
2057 block boundaries. */
2058 while (single_pred_p (prev_bb))
2060 prev_bb = single_pred (prev_bb);
2061 if (prev_bb->index < saved_last_basic_block)
2062 break;
2064 if (prev_bb != last_bb)
2065 empty_mem_ref_hash_table ();
2066 last_bb = bb;
2068 for (i = gsi_start_bb (bb); !gsi_end_p (i);)
2070 gimple s = gsi_stmt (i);
2072 if (has_stmt_been_instrumented_p (s))
2073 gsi_next (&i);
2074 else if (gimple_assign_single_p (s)
2075 && maybe_instrument_assignment (&i))
2076 /* Nothing to do as maybe_instrument_assignment advanced
2077 the iterator I. */;
2078 else if (is_gimple_call (s) && maybe_instrument_call (&i))
2079 /* Nothing to do as maybe_instrument_call
2080 advanced the iterator I. */;
2081 else
2083 /* No instrumentation happened.
2085 If the current instruction is a function call that
2086 might free something, let's forget about the memory
2087 references that got instrumented. Otherwise we might
2088 miss some instrumentation opportunities. */
2089 if (is_gimple_call (s) && !nonfreeing_call_p (s))
2090 empty_mem_ref_hash_table ();
2092 gsi_next (&i);
2096 free_mem_ref_resources ();
2099 /* Build
2100 __asan_before_dynamic_init (module_name)
2102 __asan_after_dynamic_init ()
2103 call. */
2105 tree
2106 asan_dynamic_init_call (bool after_p)
2108 tree fn = builtin_decl_implicit (after_p
2109 ? BUILT_IN_ASAN_AFTER_DYNAMIC_INIT
2110 : BUILT_IN_ASAN_BEFORE_DYNAMIC_INIT);
2111 tree module_name_cst = NULL_TREE;
2112 if (!after_p)
2114 pretty_printer module_name_pp;
2115 pp_string (&module_name_pp, main_input_filename);
2117 if (shadow_ptr_types[0] == NULL_TREE)
2118 asan_init_shadow_ptr_types ();
2119 module_name_cst = asan_pp_string (&module_name_pp);
2120 module_name_cst = fold_convert (const_ptr_type_node,
2121 module_name_cst);
2124 return build_call_expr (fn, after_p ? 0 : 1, module_name_cst);
2127 /* Build
2128 struct __asan_global
2130 const void *__beg;
2131 uptr __size;
2132 uptr __size_with_redzone;
2133 const void *__name;
2134 const void *__module_name;
2135 uptr __has_dynamic_init;
2136 } type. */
2138 static tree
2139 asan_global_struct (void)
2141 static const char *field_names[6]
2142 = { "__beg", "__size", "__size_with_redzone",
2143 "__name", "__module_name", "__has_dynamic_init" };
2144 tree fields[6], ret;
2145 int i;
2147 ret = make_node (RECORD_TYPE);
2148 for (i = 0; i < 6; i++)
2150 fields[i]
2151 = build_decl (UNKNOWN_LOCATION, FIELD_DECL,
2152 get_identifier (field_names[i]),
2153 (i == 0 || i == 3) ? const_ptr_type_node
2154 : pointer_sized_int_node);
2155 DECL_CONTEXT (fields[i]) = ret;
2156 if (i)
2157 DECL_CHAIN (fields[i - 1]) = fields[i];
2159 TYPE_FIELDS (ret) = fields[0];
2160 TYPE_NAME (ret) = get_identifier ("__asan_global");
2161 layout_type (ret);
2162 return ret;
2165 /* Append description of a single global DECL into vector V.
2166 TYPE is __asan_global struct type as returned by asan_global_struct. */
2168 static void
2169 asan_add_global (tree decl, tree type, vec<constructor_elt, va_gc> *v)
2171 tree init, uptr = TREE_TYPE (DECL_CHAIN (TYPE_FIELDS (type)));
2172 unsigned HOST_WIDE_INT size;
2173 tree str_cst, module_name_cst, refdecl = decl;
2174 vec<constructor_elt, va_gc> *vinner = NULL;
2176 pretty_printer asan_pp, module_name_pp;
2178 if (DECL_NAME (decl))
2179 pp_tree_identifier (&asan_pp, DECL_NAME (decl));
2180 else
2181 pp_string (&asan_pp, "<unknown>");
2182 str_cst = asan_pp_string (&asan_pp);
2184 pp_string (&module_name_pp, main_input_filename);
2185 module_name_cst = asan_pp_string (&module_name_pp);
2187 if (asan_needs_local_alias (decl))
2189 char buf[20];
2190 ASM_GENERATE_INTERNAL_LABEL (buf, "LASAN", vec_safe_length (v) + 1);
2191 refdecl = build_decl (DECL_SOURCE_LOCATION (decl),
2192 VAR_DECL, get_identifier (buf), TREE_TYPE (decl));
2193 TREE_ADDRESSABLE (refdecl) = TREE_ADDRESSABLE (decl);
2194 TREE_READONLY (refdecl) = TREE_READONLY (decl);
2195 TREE_THIS_VOLATILE (refdecl) = TREE_THIS_VOLATILE (decl);
2196 DECL_GIMPLE_REG_P (refdecl) = DECL_GIMPLE_REG_P (decl);
2197 DECL_ARTIFICIAL (refdecl) = DECL_ARTIFICIAL (decl);
2198 DECL_IGNORED_P (refdecl) = DECL_IGNORED_P (decl);
2199 TREE_STATIC (refdecl) = 1;
2200 TREE_PUBLIC (refdecl) = 0;
2201 TREE_USED (refdecl) = 1;
2202 assemble_alias (refdecl, DECL_ASSEMBLER_NAME (decl));
2205 CONSTRUCTOR_APPEND_ELT (vinner, NULL_TREE,
2206 fold_convert (const_ptr_type_node,
2207 build_fold_addr_expr (refdecl)));
2208 size = tree_to_uhwi (DECL_SIZE_UNIT (decl));
2209 CONSTRUCTOR_APPEND_ELT (vinner, NULL_TREE, build_int_cst (uptr, size));
2210 size += asan_red_zone_size (size);
2211 CONSTRUCTOR_APPEND_ELT (vinner, NULL_TREE, build_int_cst (uptr, size));
2212 CONSTRUCTOR_APPEND_ELT (vinner, NULL_TREE,
2213 fold_convert (const_ptr_type_node, str_cst));
2214 CONSTRUCTOR_APPEND_ELT (vinner, NULL_TREE,
2215 fold_convert (const_ptr_type_node, module_name_cst));
2216 varpool_node *vnode = varpool_node::get (decl);
2217 int has_dynamic_init = vnode ? vnode->dynamically_initialized : 0;
2218 CONSTRUCTOR_APPEND_ELT (vinner, NULL_TREE,
2219 build_int_cst (uptr, has_dynamic_init));
2220 init = build_constructor (type, vinner);
2221 CONSTRUCTOR_APPEND_ELT (v, NULL_TREE, init);
2224 /* Initialize sanitizer.def builtins if the FE hasn't initialized them. */
2225 void
2226 initialize_sanitizer_builtins (void)
2228 tree decl;
2230 if (builtin_decl_implicit_p (BUILT_IN_ASAN_INIT))
2231 return;
2233 tree BT_FN_VOID = build_function_type_list (void_type_node, NULL_TREE);
2234 tree BT_FN_VOID_PTR
2235 = build_function_type_list (void_type_node, ptr_type_node, NULL_TREE);
2236 tree BT_FN_VOID_CONST_PTR
2237 = build_function_type_list (void_type_node, const_ptr_type_node, NULL_TREE);
2238 tree BT_FN_VOID_PTR_PTR
2239 = build_function_type_list (void_type_node, ptr_type_node,
2240 ptr_type_node, NULL_TREE);
2241 tree BT_FN_VOID_PTR_PTR_PTR
2242 = build_function_type_list (void_type_node, ptr_type_node,
2243 ptr_type_node, ptr_type_node, NULL_TREE);
2244 tree BT_FN_VOID_PTR_PTRMODE
2245 = build_function_type_list (void_type_node, ptr_type_node,
2246 pointer_sized_int_node, NULL_TREE);
2247 tree BT_FN_VOID_INT
2248 = build_function_type_list (void_type_node, integer_type_node, NULL_TREE);
2249 tree BT_FN_BOOL_VPTR_PTR_IX_INT_INT[5];
2250 tree BT_FN_IX_CONST_VPTR_INT[5];
2251 tree BT_FN_IX_VPTR_IX_INT[5];
2252 tree BT_FN_VOID_VPTR_IX_INT[5];
2253 tree vptr
2254 = build_pointer_type (build_qualified_type (void_type_node,
2255 TYPE_QUAL_VOLATILE));
2256 tree cvptr
2257 = build_pointer_type (build_qualified_type (void_type_node,
2258 TYPE_QUAL_VOLATILE
2259 |TYPE_QUAL_CONST));
2260 tree boolt
2261 = lang_hooks.types.type_for_size (BOOL_TYPE_SIZE, 1);
2262 int i;
2263 for (i = 0; i < 5; i++)
2265 tree ix = build_nonstandard_integer_type (BITS_PER_UNIT * (1 << i), 1);
2266 BT_FN_BOOL_VPTR_PTR_IX_INT_INT[i]
2267 = build_function_type_list (boolt, vptr, ptr_type_node, ix,
2268 integer_type_node, integer_type_node,
2269 NULL_TREE);
2270 BT_FN_IX_CONST_VPTR_INT[i]
2271 = build_function_type_list (ix, cvptr, integer_type_node, NULL_TREE);
2272 BT_FN_IX_VPTR_IX_INT[i]
2273 = build_function_type_list (ix, vptr, ix, integer_type_node,
2274 NULL_TREE);
2275 BT_FN_VOID_VPTR_IX_INT[i]
2276 = build_function_type_list (void_type_node, vptr, ix,
2277 integer_type_node, NULL_TREE);
2279 #define BT_FN_BOOL_VPTR_PTR_I1_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[0]
2280 #define BT_FN_I1_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[0]
2281 #define BT_FN_I1_VPTR_I1_INT BT_FN_IX_VPTR_IX_INT[0]
2282 #define BT_FN_VOID_VPTR_I1_INT BT_FN_VOID_VPTR_IX_INT[0]
2283 #define BT_FN_BOOL_VPTR_PTR_I2_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[1]
2284 #define BT_FN_I2_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[1]
2285 #define BT_FN_I2_VPTR_I2_INT BT_FN_IX_VPTR_IX_INT[1]
2286 #define BT_FN_VOID_VPTR_I2_INT BT_FN_VOID_VPTR_IX_INT[1]
2287 #define BT_FN_BOOL_VPTR_PTR_I4_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[2]
2288 #define BT_FN_I4_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[2]
2289 #define BT_FN_I4_VPTR_I4_INT BT_FN_IX_VPTR_IX_INT[2]
2290 #define BT_FN_VOID_VPTR_I4_INT BT_FN_VOID_VPTR_IX_INT[2]
2291 #define BT_FN_BOOL_VPTR_PTR_I8_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[3]
2292 #define BT_FN_I8_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[3]
2293 #define BT_FN_I8_VPTR_I8_INT BT_FN_IX_VPTR_IX_INT[3]
2294 #define BT_FN_VOID_VPTR_I8_INT BT_FN_VOID_VPTR_IX_INT[3]
2295 #define BT_FN_BOOL_VPTR_PTR_I16_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[4]
2296 #define BT_FN_I16_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[4]
2297 #define BT_FN_I16_VPTR_I16_INT BT_FN_IX_VPTR_IX_INT[4]
2298 #define BT_FN_VOID_VPTR_I16_INT BT_FN_VOID_VPTR_IX_INT[4]
2299 #undef ATTR_NOTHROW_LEAF_LIST
2300 #define ATTR_NOTHROW_LEAF_LIST ECF_NOTHROW | ECF_LEAF
2301 #undef ATTR_TMPURE_NOTHROW_LEAF_LIST
2302 #define ATTR_TMPURE_NOTHROW_LEAF_LIST ECF_TM_PURE | ATTR_NOTHROW_LEAF_LIST
2303 #undef ATTR_NORETURN_NOTHROW_LEAF_LIST
2304 #define ATTR_NORETURN_NOTHROW_LEAF_LIST ECF_NORETURN | ATTR_NOTHROW_LEAF_LIST
2305 #undef ATTR_TMPURE_NORETURN_NOTHROW_LEAF_LIST
2306 #define ATTR_TMPURE_NORETURN_NOTHROW_LEAF_LIST \
2307 ECF_TM_PURE | ATTR_NORETURN_NOTHROW_LEAF_LIST
2308 #undef ATTR_COLD_NOTHROW_LEAF_LIST
2309 #define ATTR_COLD_NOTHROW_LEAF_LIST \
2310 /* ECF_COLD missing */ ATTR_NOTHROW_LEAF_LIST
2311 #undef ATTR_COLD_NORETURN_NOTHROW_LEAF_LIST
2312 #define ATTR_COLD_NORETURN_NOTHROW_LEAF_LIST \
2313 /* ECF_COLD missing */ ATTR_NORETURN_NOTHROW_LEAF_LIST
2314 #undef DEF_SANITIZER_BUILTIN
2315 #define DEF_SANITIZER_BUILTIN(ENUM, NAME, TYPE, ATTRS) \
2316 decl = add_builtin_function ("__builtin_" NAME, TYPE, ENUM, \
2317 BUILT_IN_NORMAL, NAME, NULL_TREE); \
2318 set_call_expr_flags (decl, ATTRS); \
2319 set_builtin_decl (ENUM, decl, true);
2321 #include "sanitizer.def"
2323 #undef DEF_SANITIZER_BUILTIN
2326 /* Called via htab_traverse. Count number of emitted
2327 STRING_CSTs in the constant hash table. */
2329 static int
2330 count_string_csts (void **slot, void *data)
2332 struct constant_descriptor_tree *desc
2333 = (struct constant_descriptor_tree *) *slot;
2334 if (TREE_CODE (desc->value) == STRING_CST
2335 && TREE_ASM_WRITTEN (desc->value)
2336 && asan_protect_global (desc->value))
2337 ++*((unsigned HOST_WIDE_INT *) data);
2338 return 1;
2341 /* Helper structure to pass two parameters to
2342 add_string_csts. */
2344 struct asan_add_string_csts_data
2346 tree type;
2347 vec<constructor_elt, va_gc> *v;
2350 /* Called via htab_traverse. Call asan_add_global
2351 on emitted STRING_CSTs from the constant hash table. */
2353 static int
2354 add_string_csts (void **slot, void *data)
2356 struct constant_descriptor_tree *desc
2357 = (struct constant_descriptor_tree *) *slot;
2358 if (TREE_CODE (desc->value) == STRING_CST
2359 && TREE_ASM_WRITTEN (desc->value)
2360 && asan_protect_global (desc->value))
2362 struct asan_add_string_csts_data *aascd
2363 = (struct asan_add_string_csts_data *) data;
2364 asan_add_global (SYMBOL_REF_DECL (XEXP (desc->rtl, 0)),
2365 aascd->type, aascd->v);
2367 return 1;
2370 /* Needs to be GTY(()), because cgraph_build_static_cdtor may
2371 invoke ggc_collect. */
2372 static GTY(()) tree asan_ctor_statements;
2374 /* Module-level instrumentation.
2375 - Insert __asan_init_vN() into the list of CTORs.
2376 - TODO: insert redzones around globals.
2379 void
2380 asan_finish_file (void)
2382 varpool_node *vnode;
2383 unsigned HOST_WIDE_INT gcount = 0;
2385 if (shadow_ptr_types[0] == NULL_TREE)
2386 asan_init_shadow_ptr_types ();
2387 /* Avoid instrumenting code in the asan ctors/dtors.
2388 We don't need to insert padding after the description strings,
2389 nor after .LASAN* array. */
2390 flag_sanitize &= ~SANITIZE_ADDRESS;
2392 tree fn = builtin_decl_implicit (BUILT_IN_ASAN_INIT);
2393 append_to_statement_list (build_call_expr (fn, 0), &asan_ctor_statements);
2394 FOR_EACH_DEFINED_VARIABLE (vnode)
2395 if (TREE_ASM_WRITTEN (vnode->decl)
2396 && asan_protect_global (vnode->decl))
2397 ++gcount;
2398 htab_t const_desc_htab = constant_pool_htab ();
2399 htab_traverse (const_desc_htab, count_string_csts, &gcount);
2400 if (gcount)
2402 tree type = asan_global_struct (), var, ctor;
2403 tree dtor_statements = NULL_TREE;
2404 vec<constructor_elt, va_gc> *v;
2405 char buf[20];
2407 type = build_array_type_nelts (type, gcount);
2408 ASM_GENERATE_INTERNAL_LABEL (buf, "LASAN", 0);
2409 var = build_decl (UNKNOWN_LOCATION, VAR_DECL, get_identifier (buf),
2410 type);
2411 TREE_STATIC (var) = 1;
2412 TREE_PUBLIC (var) = 0;
2413 DECL_ARTIFICIAL (var) = 1;
2414 DECL_IGNORED_P (var) = 1;
2415 vec_alloc (v, gcount);
2416 FOR_EACH_DEFINED_VARIABLE (vnode)
2417 if (TREE_ASM_WRITTEN (vnode->decl)
2418 && asan_protect_global (vnode->decl))
2419 asan_add_global (vnode->decl, TREE_TYPE (type), v);
2420 struct asan_add_string_csts_data aascd;
2421 aascd.type = TREE_TYPE (type);
2422 aascd.v = v;
2423 htab_traverse (const_desc_htab, add_string_csts, &aascd);
2424 ctor = build_constructor (type, v);
2425 TREE_CONSTANT (ctor) = 1;
2426 TREE_STATIC (ctor) = 1;
2427 DECL_INITIAL (var) = ctor;
2428 varpool_node::finalize_decl (var);
2430 fn = builtin_decl_implicit (BUILT_IN_ASAN_REGISTER_GLOBALS);
2431 tree gcount_tree = build_int_cst (pointer_sized_int_node, gcount);
2432 append_to_statement_list (build_call_expr (fn, 2,
2433 build_fold_addr_expr (var),
2434 gcount_tree),
2435 &asan_ctor_statements);
2437 fn = builtin_decl_implicit (BUILT_IN_ASAN_UNREGISTER_GLOBALS);
2438 append_to_statement_list (build_call_expr (fn, 2,
2439 build_fold_addr_expr (var),
2440 gcount_tree),
2441 &dtor_statements);
2442 cgraph_build_static_cdtor ('D', dtor_statements,
2443 MAX_RESERVED_INIT_PRIORITY - 1);
2445 cgraph_build_static_cdtor ('I', asan_ctor_statements,
2446 MAX_RESERVED_INIT_PRIORITY - 1);
2447 flag_sanitize |= SANITIZE_ADDRESS;
2450 /* Expand the ASAN_{LOAD,STORE} builtins. */
2452 static bool
2453 asan_expand_check_ifn (gimple_stmt_iterator *iter, bool use_calls)
2455 gimple g = gsi_stmt (*iter);
2456 location_t loc = gimple_location (g);
2458 HOST_WIDE_INT flags = tree_to_shwi (gimple_call_arg (g, 0));
2459 gcc_assert (flags < ASAN_CHECK_LAST);
2460 bool is_scalar_access = (flags & ASAN_CHECK_SCALAR_ACCESS) != 0;
2461 bool is_store = (flags & ASAN_CHECK_STORE) != 0;
2462 bool is_non_zero_len = (flags & ASAN_CHECK_NON_ZERO_LEN) != 0;
2463 bool start_instrumented = (flags & ASAN_CHECK_START_INSTRUMENTED) != 0;
2464 bool end_instrumented = (flags & ASAN_CHECK_END_INSTRUMENTED) != 0;
2466 tree base = gimple_call_arg (g, 1);
2467 tree len = gimple_call_arg (g, 2);
2469 HOST_WIDE_INT size_in_bytes
2470 = is_scalar_access && tree_fits_shwi_p (len) ? tree_to_shwi (len) : -1;
2472 if (use_calls)
2474 /* Instrument using callbacks. */
2475 gimple g
2476 = gimple_build_assign_with_ops (NOP_EXPR,
2477 make_ssa_name (pointer_sized_int_node,
2478 NULL),
2479 base, NULL_TREE);
2480 gimple_set_location (g, loc);
2481 gsi_insert_before (iter, g, GSI_SAME_STMT);
2482 tree base_addr = gimple_assign_lhs (g);
2484 int nargs;
2485 tree fun = check_func (is_store, size_in_bytes, &nargs);
2486 if (nargs == 1)
2487 g = gimple_build_call (fun, 1, base_addr);
2488 else
2490 gcc_assert (nargs == 2);
2491 g = gimple_build_assign_with_ops (NOP_EXPR,
2492 make_ssa_name (pointer_sized_int_node,
2493 NULL),
2494 len, NULL_TREE);
2495 gimple_set_location (g, loc);
2496 gsi_insert_before (iter, g, GSI_SAME_STMT);
2497 tree sz_arg = gimple_assign_lhs (g);
2498 g = gimple_build_call (fun, nargs, base_addr, sz_arg);
2500 gimple_set_location (g, loc);
2501 gsi_replace (iter, g, false);
2502 return false;
2505 HOST_WIDE_INT real_size_in_bytes = size_in_bytes == -1 ? 1 : size_in_bytes;
2507 tree shadow_ptr_type = shadow_ptr_types[real_size_in_bytes == 16 ? 1 : 0];
2508 tree shadow_type = TREE_TYPE (shadow_ptr_type);
2510 gimple_stmt_iterator gsi = *iter;
2512 if (!is_non_zero_len)
2514 /* So, the length of the memory area to asan-protect is
2515 non-constant. Let's guard the generated instrumentation code
2516 like:
2518 if (len != 0)
2520 //asan instrumentation code goes here.
2522 // falltrough instructions, starting with *ITER. */
2524 g = gimple_build_cond (NE_EXPR,
2525 len,
2526 build_int_cst (TREE_TYPE (len), 0),
2527 NULL_TREE, NULL_TREE);
2528 gimple_set_location (g, loc);
2530 basic_block then_bb, fallthrough_bb;
2531 insert_if_then_before_iter (g, iter, /*then_more_likely_p=*/true,
2532 &then_bb, &fallthrough_bb);
2533 /* Note that fallthrough_bb starts with the statement that was
2534 pointed to by ITER. */
2536 /* The 'then block' of the 'if (len != 0) condition is where
2537 we'll generate the asan instrumentation code now. */
2538 gsi = gsi_last_bb (then_bb);
2541 /* Get an iterator on the point where we can add the condition
2542 statement for the instrumentation. */
2543 basic_block then_bb, else_bb;
2544 gsi = create_cond_insert_point (&gsi, /*before_p*/false,
2545 /*then_more_likely_p=*/false,
2546 /*create_then_fallthru_edge=*/false,
2547 &then_bb,
2548 &else_bb);
2550 g = gimple_build_assign_with_ops (NOP_EXPR,
2551 make_ssa_name (pointer_sized_int_node,
2552 NULL),
2553 base, NULL_TREE);
2554 gimple_set_location (g, loc);
2555 gsi_insert_before (&gsi, g, GSI_NEW_STMT);
2556 tree base_addr = gimple_assign_lhs (g);
2558 tree t = NULL_TREE;
2559 if (real_size_in_bytes >= 8)
2561 tree shadow = build_shadow_mem_access (&gsi, loc, base_addr,
2562 shadow_ptr_type);
2563 t = shadow;
2565 else
2567 /* Slow path for 1, 2 and 4 byte accesses. */
2569 if (!start_instrumented)
2571 /* Test (shadow != 0)
2572 & ((base_addr & 7) + (real_size_in_bytes - 1)) >= shadow). */
2573 tree shadow = build_shadow_mem_access (&gsi, loc, base_addr,
2574 shadow_ptr_type);
2575 gimple shadow_test = build_assign (NE_EXPR, shadow, 0);
2576 gimple_seq seq = NULL;
2577 gimple_seq_add_stmt (&seq, shadow_test);
2578 gimple_seq_add_stmt (&seq, build_assign (BIT_AND_EXPR, base_addr, 7));
2579 gimple_seq_add_stmt (&seq, build_type_cast (shadow_type,
2580 gimple_seq_last (seq)));
2581 if (real_size_in_bytes > 1)
2582 gimple_seq_add_stmt (&seq,
2583 build_assign (PLUS_EXPR, gimple_seq_last (seq),
2584 real_size_in_bytes - 1));
2585 gimple_seq_add_stmt (&seq, build_assign (GE_EXPR,
2586 gimple_seq_last (seq),
2587 shadow));
2588 gimple_seq_add_stmt (&seq, build_assign (BIT_AND_EXPR, shadow_test,
2589 gimple_seq_last (seq)));
2590 t = gimple_assign_lhs (gimple_seq_last (seq));
2591 gimple_seq_set_location (seq, loc);
2592 gsi_insert_seq_after (&gsi, seq, GSI_CONTINUE_LINKING);
2595 /* For non-constant, misaligned or otherwise weird access sizes,
2596 check first and last byte. */
2597 if (size_in_bytes == -1 && !end_instrumented)
2599 g = gimple_build_assign_with_ops (MINUS_EXPR,
2600 make_ssa_name (pointer_sized_int_node, NULL),
2601 len,
2602 build_int_cst (pointer_sized_int_node, 1));
2603 gimple_set_location (g, loc);
2604 gsi_insert_after (&gsi, g, GSI_NEW_STMT);
2605 tree last = gimple_assign_lhs (g);
2606 g = gimple_build_assign_with_ops (PLUS_EXPR,
2607 make_ssa_name (pointer_sized_int_node, NULL),
2608 base_addr,
2609 last);
2610 gimple_set_location (g, loc);
2611 gsi_insert_after (&gsi, g, GSI_NEW_STMT);
2612 tree base_end_addr = gimple_assign_lhs (g);
2614 tree shadow = build_shadow_mem_access (&gsi, loc, base_end_addr,
2615 shadow_ptr_type);
2616 gimple shadow_test = build_assign (NE_EXPR, shadow, 0);
2617 gimple_seq seq = NULL;
2618 gimple_seq_add_stmt (&seq, shadow_test);
2619 gimple_seq_add_stmt (&seq, build_assign (BIT_AND_EXPR,
2620 base_end_addr, 7));
2621 gimple_seq_add_stmt (&seq, build_type_cast (shadow_type,
2622 gimple_seq_last (seq)));
2623 gimple_seq_add_stmt (&seq, build_assign (GE_EXPR,
2624 gimple_seq_last (seq),
2625 shadow));
2626 gimple_seq_add_stmt (&seq, build_assign (BIT_AND_EXPR, shadow_test,
2627 gimple_seq_last (seq)));
2628 if (!start_instrumented)
2629 gimple_seq_add_stmt (&seq, build_assign (BIT_IOR_EXPR, t,
2630 gimple_seq_last (seq)));
2631 t = gimple_assign_lhs (gimple_seq_last (seq));
2632 gimple_seq_set_location (seq, loc);
2633 gsi_insert_seq_after (&gsi, seq, GSI_CONTINUE_LINKING);
2637 g = gimple_build_cond (NE_EXPR, t, build_int_cst (TREE_TYPE (t), 0),
2638 NULL_TREE, NULL_TREE);
2639 gimple_set_location (g, loc);
2640 gsi_insert_after (&gsi, g, GSI_NEW_STMT);
2642 /* Generate call to the run-time library (e.g. __asan_report_load8). */
2643 gsi = gsi_start_bb (then_bb);
2644 int nargs;
2645 tree fun = report_error_func (is_store, size_in_bytes, &nargs);
2646 g = gimple_build_call (fun, nargs, base_addr, len);
2647 gimple_set_location (g, loc);
2648 gsi_insert_after (&gsi, g, GSI_NEW_STMT);
2650 gsi_remove (iter, true);
2651 *iter = gsi_start_bb (else_bb);
2653 return true;
2656 /* Instrument the current function. */
2658 static unsigned int
2659 asan_instrument (void)
2661 if (shadow_ptr_types[0] == NULL_TREE)
2662 asan_init_shadow_ptr_types ();
2663 transform_statements ();
2664 return 0;
2667 static bool
2668 gate_asan (void)
2670 return (flag_sanitize & SANITIZE_ADDRESS) != 0
2671 && !lookup_attribute ("no_sanitize_address",
2672 DECL_ATTRIBUTES (current_function_decl));
2675 namespace {
2677 const pass_data pass_data_asan =
2679 GIMPLE_PASS, /* type */
2680 "asan", /* name */
2681 OPTGROUP_NONE, /* optinfo_flags */
2682 TV_NONE, /* tv_id */
2683 ( PROP_ssa | PROP_cfg | PROP_gimple_leh ), /* properties_required */
2684 0, /* properties_provided */
2685 0, /* properties_destroyed */
2686 0, /* todo_flags_start */
2687 TODO_update_ssa, /* todo_flags_finish */
2690 class pass_asan : public gimple_opt_pass
2692 public:
2693 pass_asan (gcc::context *ctxt)
2694 : gimple_opt_pass (pass_data_asan, ctxt)
2697 /* opt_pass methods: */
2698 opt_pass * clone () { return new pass_asan (m_ctxt); }
2699 virtual bool gate (function *) { return gate_asan (); }
2700 virtual unsigned int execute (function *) { return asan_instrument (); }
2702 }; // class pass_asan
2704 } // anon namespace
2706 gimple_opt_pass *
2707 make_pass_asan (gcc::context *ctxt)
2709 return new pass_asan (ctxt);
2712 namespace {
2714 const pass_data pass_data_asan_O0 =
2716 GIMPLE_PASS, /* type */
2717 "asan0", /* name */
2718 OPTGROUP_NONE, /* optinfo_flags */
2719 TV_NONE, /* tv_id */
2720 ( PROP_ssa | PROP_cfg | PROP_gimple_leh ), /* properties_required */
2721 0, /* properties_provided */
2722 0, /* properties_destroyed */
2723 0, /* todo_flags_start */
2724 TODO_update_ssa, /* todo_flags_finish */
2727 class pass_asan_O0 : public gimple_opt_pass
2729 public:
2730 pass_asan_O0 (gcc::context *ctxt)
2731 : gimple_opt_pass (pass_data_asan_O0, ctxt)
2734 /* opt_pass methods: */
2735 virtual bool gate (function *) { return !optimize && gate_asan (); }
2736 virtual unsigned int execute (function *) { return asan_instrument (); }
2738 }; // class pass_asan_O0
2740 } // anon namespace
2742 gimple_opt_pass *
2743 make_pass_asan_O0 (gcc::context *ctxt)
2745 return new pass_asan_O0 (ctxt);
2748 /* Perform optimization of sanitize functions. */
2750 namespace {
2752 const pass_data pass_data_sanopt =
2754 GIMPLE_PASS, /* type */
2755 "sanopt", /* name */
2756 OPTGROUP_NONE, /* optinfo_flags */
2757 TV_NONE, /* tv_id */
2758 ( PROP_ssa | PROP_cfg | PROP_gimple_leh ), /* properties_required */
2759 0, /* properties_provided */
2760 0, /* properties_destroyed */
2761 0, /* todo_flags_start */
2762 TODO_update_ssa, /* todo_flags_finish */
2765 class pass_sanopt : public gimple_opt_pass
2767 public:
2768 pass_sanopt (gcc::context *ctxt)
2769 : gimple_opt_pass (pass_data_sanopt, ctxt)
2772 /* opt_pass methods: */
2773 virtual bool gate (function *) { return flag_sanitize; }
2774 virtual unsigned int execute (function *);
2776 }; // class pass_sanopt
2778 unsigned int
2779 pass_sanopt::execute (function *fun)
2781 basic_block bb;
2783 int asan_num_accesses = 0;
2784 if (flag_sanitize & SANITIZE_ADDRESS)
2786 gimple_stmt_iterator gsi;
2787 FOR_EACH_BB_FN (bb, fun)
2788 for (gsi = gsi_start_bb (bb); !gsi_end_p (gsi); gsi_next (&gsi))
2790 gimple stmt = gsi_stmt (gsi);
2791 if (is_gimple_call (stmt) && gimple_call_internal_p (stmt)
2792 && gimple_call_internal_fn (stmt) == IFN_ASAN_CHECK)
2793 ++asan_num_accesses;
2797 bool use_calls = ASAN_INSTRUMENTATION_WITH_CALL_THRESHOLD < INT_MAX
2798 && asan_num_accesses >= ASAN_INSTRUMENTATION_WITH_CALL_THRESHOLD;
2800 FOR_EACH_BB_FN (bb, fun)
2802 gimple_stmt_iterator gsi;
2803 for (gsi = gsi_start_bb (bb); !gsi_end_p (gsi); )
2805 gimple stmt = gsi_stmt (gsi);
2806 bool no_next = false;
2808 if (!is_gimple_call (stmt))
2810 gsi_next (&gsi);
2811 continue;
2814 if (gimple_call_internal_p (stmt))
2816 enum internal_fn ifn = gimple_call_internal_fn (stmt);
2817 switch (ifn)
2819 case IFN_UBSAN_NULL:
2820 no_next = ubsan_expand_null_ifn (&gsi);
2821 break;
2822 case IFN_UBSAN_BOUNDS:
2823 no_next = ubsan_expand_bounds_ifn (&gsi);
2824 break;
2825 case IFN_ASAN_CHECK:
2827 no_next = asan_expand_check_ifn (&gsi, use_calls);
2828 break;
2830 default:
2831 break;
2835 if (dump_file && (dump_flags & TDF_DETAILS))
2837 fprintf (dump_file, "Optimized\n ");
2838 print_gimple_stmt (dump_file, stmt, 0, dump_flags);
2839 fprintf (dump_file, "\n");
2842 if (!no_next)
2843 gsi_next (&gsi);
2846 return 0;
2849 } // anon namespace
2851 gimple_opt_pass *
2852 make_pass_sanopt (gcc::context *ctxt)
2854 return new pass_sanopt (ctxt);
2857 #include "gt-asan.h"