gcc/ipa-chkp.c

   1 /* Pointer Bounds Checker IPA passes.
   2    Copyright (C) 2014-2015 Free Software Foundation, Inc.
   3    Contributed by Ilya Enkovich (ilya.enkovich@intel.com)
   4
   5 This file is part of GCC.
   6
   7 GCC is free software; you can redistribute it and/or modify it under
   8 the terms of the GNU General Public License as published by the Free
   9 Software Foundation; either version 3, or (at your option) any later
  10 version.
  11
  12 GCC is distributed in the hope that it will be useful, but WITHOUT ANY
  13 WARRANTY; without even the implied warranty of MERCHANTABILITY or
  14 FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  15 for more details.
  16
  17 You should have received a copy of the GNU General Public License
  18 along with GCC; see the file COPYING3.  If not see
  19 <http://www.gnu.org/licenses/>.  */
  20
  21 #include "config.h"
  22 #include "system.h"
  23 #include "coretypes.h"
  24 #include "hash-set.h"
  25 #include "machmode.h"
  26 #include "vec.h"
  27 #include "double-int.h"
  28 #include "input.h"
  29 #include "alias.h"
  30 #include "symtab.h"
  31 #include "options.h"
  32 #include "wide-int.h"
  33 #include "inchash.h"
  34 #include "tree.h"
  35 #include "fold-const.h"
  36 #include "stor-layout.h"
  37 #include "tree-pass.h"
  38 #include "stringpool.h"
  39 #include "bitmap.h"
  40 #include "gimple-expr.h"
  41 #include "tm.h"
  42 #include "hard-reg-set.h"
  43 #include "function.h"
  44 #include "is-a.h"
  45 #include "tree-ssa-alias.h"
  46 #include "predict.h"
  47 #include "basic-block.h"
  48 #include "gimple.h"
  49 #include "ipa-ref.h"
  50 #include "lto-streamer.h"
  51 #include "cgraph.h"
  52 #include "tree-chkp.h"
  53 #include "tree-inline.h"
  54 #include "ipa-chkp.h"
  55
  56 /*  Pointer Bounds Checker has two IPA passes to support code instrumentation.
  57
  58     In instrumented code each pointer is provided with bounds.  For input
  59     pointer parameters it means we also have bounds passed.  For calls it
  60     means we have additional bounds arguments for pointer arguments.
  61
  62     To have all IPA optimizations working correctly we have to express
  63     dataflow between passed and received bounds explicitly via additional
  64     entries in function declaration arguments list and in function type.
  65     Since we may have both instrumented and not instrumented code at the
  66     same time, we cannot replace all original functions with their
  67     instrumented variants.  Therefore we create clones (versions) instead.
  68
  69     Instrumentation clones creation is a separate IPA pass which is a part
  70     of early local passes.  Clones are created after SSA is built (because
  71     instrumentation pass works on SSA) and before any transformations
  72     which may change pointer flow and therefore lead to incorrect code
  73     instrumentation (possibly causing false bounds check failures).
  74
  75     Instrumentation clones have pointer bounds arguments added right after
  76     pointer arguments.  Clones have assembler name of the original
  77     function with suffix added.  New assembler name is in transparent
  78     alias chain with the original name.  Thus we expect all calls to the
  79     original and instrumented functions look similar in assembler.
  80
  81     During instrumentation versioning pass we create instrumented versions
  82     of all function with body and also for all their aliases and thunks.
  83     Clones for functions with no body are created on demand (usually
  84     during call instrumentation).
  85
  86     Original and instrumented function nodes are connected with IPA
  87     reference IPA_REF_CHKP.  It is mostly done to have reachability
  88     analysis working correctly.  We may have no references to the
  89     instrumented function in the code but it still should be counted
  90     as reachable if the original function is reachable.
  91
  92     When original function bodies are not needed anymore we release
  93     them and transform functions into a special kind of thunks.  Each
  94     thunk has a call edge to the instrumented version.  These thunks
  95     help to keep externally visible instrumented functions visible
  96     when linker resolution files are used.  Linker has no info about
  97     connection between original and instrumented function and
  98     therefore we may wrongly decide (due to difference in assembler
  99     names) that instrumented function version is local and can be
 100     removed.  */
 101
 102 #define CHKP_BOUNDS_OF_SYMBOL_PREFIX "__chkp_bounds_of_"
 103 #define CHKP_WRAPPER_SYMBOL_PREFIX "__mpx_wrapper_"
 104
 105 /* Return 1 calls to FNDECL should be replaced with
 106    a call to wrapper function.  */
 107 bool
 108 chkp_wrap_function (tree fndecl)
 109 {
 110   if (!flag_chkp_use_wrappers)
 111     return false;
 112
 113   if (DECL_BUILT_IN_CLASS (fndecl) == BUILT_IN_NORMAL)
 114     {
 115       switch (DECL_FUNCTION_CODE (fndecl))
 116         {
 117         case BUILT_IN_STRLEN:
 118         case BUILT_IN_STRCPY:
 119         case BUILT_IN_STRNCPY:
 120         case BUILT_IN_STPCPY:
 121         case BUILT_IN_STPNCPY:
 122         case BUILT_IN_STRCAT:
 123         case BUILT_IN_STRNCAT:
 124         case BUILT_IN_MEMCPY:
 125         case BUILT_IN_MEMPCPY:
 126         case BUILT_IN_MEMSET:
 127         case BUILT_IN_MEMMOVE:
 128         case BUILT_IN_BZERO:
 129         case BUILT_IN_MALLOC:
 130         case BUILT_IN_CALLOC:
 131         case BUILT_IN_REALLOC:
 132           return 1;
 133
 134         default:
 135           return 0;
 136         }
 137     }
 138
 139   return false;
 140 }
 141
 142 static const char *
 143 chkp_wrap_function_name (tree fndecl)
 144 {
 145   gcc_assert (DECL_BUILT_IN_CLASS (fndecl) == BUILT_IN_NORMAL);
 146
 147   switch (DECL_FUNCTION_CODE (fndecl))
 148     {
 149     case BUILT_IN_STRLEN:
 150       return CHKP_WRAPPER_SYMBOL_PREFIX "strlen";
 151     case BUILT_IN_STRCPY:
 152       return CHKP_WRAPPER_SYMBOL_PREFIX "strcpy";
 153     case BUILT_IN_STRNCPY:
 154       return CHKP_WRAPPER_SYMBOL_PREFIX "strncpy";
 155     case BUILT_IN_STPCPY:
 156       return CHKP_WRAPPER_SYMBOL_PREFIX "stpcpy";
 157     case BUILT_IN_STPNCPY:
 158       return CHKP_WRAPPER_SYMBOL_PREFIX "stpncpy";
 159     case BUILT_IN_STRCAT:
 160       return CHKP_WRAPPER_SYMBOL_PREFIX "strcat";
 161     case BUILT_IN_STRNCAT:
 162       return CHKP_WRAPPER_SYMBOL_PREFIX "strncat";
 163     case BUILT_IN_MEMCPY:
 164       return CHKP_WRAPPER_SYMBOL_PREFIX "memcpy";
 165     case BUILT_IN_MEMPCPY:
 166       return CHKP_WRAPPER_SYMBOL_PREFIX "mempcpy";
 167     case BUILT_IN_MEMSET:
 168       return CHKP_WRAPPER_SYMBOL_PREFIX "memset";
 169     case BUILT_IN_MEMMOVE:
 170       return CHKP_WRAPPER_SYMBOL_PREFIX "memmove";
 171     case BUILT_IN_BZERO:
 172       return CHKP_WRAPPER_SYMBOL_PREFIX "bzero";
 173     case BUILT_IN_MALLOC:
 174       return CHKP_WRAPPER_SYMBOL_PREFIX "malloc";
 175     case BUILT_IN_CALLOC:
 176       return CHKP_WRAPPER_SYMBOL_PREFIX "calloc";
 177     case BUILT_IN_REALLOC:
 178       return CHKP_WRAPPER_SYMBOL_PREFIX "realloc";
 179
 180     default:
 181       gcc_unreachable ();
 182     }
 183
 184   return "";
 185 }
 186
 187 /* Build a clone of FNDECL with a modified name.  */
 188
 189 static tree
 190 chkp_build_instrumented_fndecl (tree fndecl)
 191 {
 192   tree new_decl = copy_node (fndecl);
 193   tree new_name;
 194   std::string s;
 195
 196   /* called_as_built_in checks DECL_NAME to identify calls to
 197      builtins.  We want instrumented calls to builtins to be
 198      recognized by called_as_built_in.  Therefore use original
 199      DECL_NAME for cloning with no prefixes.  */
 200   s = IDENTIFIER_POINTER (DECL_NAME (fndecl));
 201   s += ".chkp";
 202   DECL_NAME (new_decl) = get_identifier (s.c_str ());
 203
 204   /* References to the original and to the instrumented version
 205      should look the same in the output assembly.  And we cannot
 206      use the same assembler name for the instrumented version
 207      because it conflicts with decl merging algorithms in LTO.
 208      Achieve the result by using transparent alias name for the
 209      instrumented version.  */
 210   if (chkp_wrap_function(fndecl))
 211     {
 212       new_name = get_identifier (chkp_wrap_function_name (fndecl));
 213       DECL_VISIBILITY (new_decl) = VISIBILITY_DEFAULT;
 214     }
 215   else
 216     {
 217       s = IDENTIFIER_POINTER (DECL_ASSEMBLER_NAME (fndecl));
 218       s += ".chkp";
 219       new_name = get_identifier (s.c_str ());
 220       IDENTIFIER_TRANSPARENT_ALIAS (new_name) = 1;
 221       TREE_CHAIN (new_name) = DECL_ASSEMBLER_NAME (fndecl);
 222     }
 223   SET_DECL_ASSEMBLER_NAME (new_decl, new_name);
 224
 225   /* For functions with body versioning will make a copy of arguments.
 226      For functions with no body we need to do it here.  */
 227   if (!gimple_has_body_p (fndecl))
 228     DECL_ARGUMENTS (new_decl) = copy_list (DECL_ARGUMENTS (fndecl));
 229
 230   /* We are going to modify attributes list and therefore should
 231      make own copy.  */
 232   DECL_ATTRIBUTES (new_decl) = copy_list (DECL_ATTRIBUTES (fndecl));
 233
 234   /* Change builtin function code.  */
 235   if (DECL_BUILT_IN (new_decl))
 236     {
 237       gcc_assert (DECL_BUILT_IN_CLASS (new_decl) == BUILT_IN_NORMAL);
 238       gcc_assert (DECL_FUNCTION_CODE (new_decl) < BEGIN_CHKP_BUILTINS);
 239       DECL_FUNCTION_CODE (new_decl)
 240         = (enum built_in_function)(DECL_FUNCTION_CODE (new_decl)
 241                                    + BEGIN_CHKP_BUILTINS + 1);
 242     }
 243
 244   return new_decl;
 245 }
 246
 247
 248 /* Fix operands of attribute from ATTRS list named ATTR_NAME.
 249    Integer operands are replaced with values according to
 250    INDEXES map having LEN elements.  For operands out of len
 251    we just add DELTA.  */
 252
 253 static void
 254 chkp_map_attr_arg_indexes (tree attrs, const char *attr_name,
 255                            unsigned *indexes, int len, int delta)
 256 {
 257   tree attr = lookup_attribute (attr_name, attrs);
 258   tree op;
 259
 260   if (!attr)
 261     return;
 262
 263   TREE_VALUE (attr) = copy_list (TREE_VALUE (attr));
 264   for (op = TREE_VALUE (attr); op; op = TREE_CHAIN (op))
 265     {
 266       int idx;
 267
 268       if (TREE_CODE (TREE_VALUE (op)) != INTEGER_CST)
 269         continue;
 270
 271       idx = TREE_INT_CST_LOW (TREE_VALUE (op));
 272
 273       /* If idx exceeds indexes length then we just
 274          keep it at the same distance from the last
 275          known arg.  */
 276       if (idx > len)
 277         idx += delta;
 278       else
 279         idx = indexes[idx - 1] + 1;
 280       TREE_VALUE (op) = build_int_cst (TREE_TYPE (TREE_VALUE (op)), idx);
 281     }
 282 }
 283
 284 /* Make a copy of function type ORIG_TYPE adding pointer
 285    bounds as additional arguments.  */
 286
 287 tree
 288 chkp_copy_function_type_adding_bounds (tree orig_type)
 289 {
 290   tree type;
 291   tree arg_type, attrs;
 292   unsigned len = list_length (TYPE_ARG_TYPES (orig_type));
 293   unsigned *indexes = XALLOCAVEC (unsigned, len);
 294   unsigned idx = 0, new_idx = 0;
 295
 296   for (arg_type = TYPE_ARG_TYPES (orig_type);
 297        arg_type;
 298        arg_type = TREE_CHAIN (arg_type))
 299     if (TREE_VALUE (arg_type) == void_type_node)
 300       continue;
 301     else if (BOUNDED_TYPE_P (TREE_VALUE (arg_type))
 302              || pass_by_reference (NULL, TYPE_MODE (TREE_VALUE (arg_type)),
 303                                    TREE_VALUE (arg_type), true)
 304              || chkp_type_has_pointer (TREE_VALUE (arg_type)))
 305       break;
 306
 307   /* We may use original type if there are no bounds passed.  */
 308   if (!arg_type)
 309     return orig_type;
 310
 311   type = build_distinct_type_copy (orig_type);
 312   TYPE_ARG_TYPES (type) = copy_list (TYPE_ARG_TYPES (type));
 313
 314   for (arg_type = TYPE_ARG_TYPES (type);
 315        arg_type;
 316        arg_type = TREE_CHAIN (arg_type))
 317     {
 318       indexes[idx++] = new_idx++;
 319
 320       /* pass_by_reference returns 1 for void type,
 321          so check for it first.  */
 322       if (TREE_VALUE (arg_type) == void_type_node)
 323         continue;
 324       else if (BOUNDED_TYPE_P (TREE_VALUE (arg_type))
 325                || pass_by_reference (NULL, TYPE_MODE (TREE_VALUE (arg_type)),
 326                                      TREE_VALUE (arg_type), true))
 327         {
 328           tree new_type = build_tree_list (NULL_TREE,
 329                                            pointer_bounds_type_node);
 330           TREE_CHAIN (new_type) = TREE_CHAIN (arg_type);
 331           TREE_CHAIN (arg_type) = new_type;
 332
 333           arg_type = TREE_CHAIN (arg_type);
 334           new_idx++;
 335         }
 336       else if (chkp_type_has_pointer (TREE_VALUE (arg_type)))
 337         {
 338           bitmap slots = BITMAP_ALLOC (NULL);
 339           bitmap_iterator bi;
 340           unsigned bnd_no;
 341
 342           chkp_find_bound_slots (TREE_VALUE (arg_type), slots);
 343
 344           EXECUTE_IF_SET_IN_BITMAP (slots, 0, bnd_no, bi)
 345             {
 346               tree new_type = build_tree_list (NULL_TREE,
 347                                                pointer_bounds_type_node);
 348               TREE_CHAIN (new_type) = TREE_CHAIN (arg_type);
 349               TREE_CHAIN (arg_type) = new_type;
 350
 351               arg_type = TREE_CHAIN (arg_type);
 352               new_idx++;
 353             }
 354           BITMAP_FREE (slots);
 355         }
 356     }
 357
 358   /* If function type has attribute with arg indexes then
 359      we have to copy it fixing attribute ops.  Map for
 360      fixing is in indexes array.  */
 361   attrs = TYPE_ATTRIBUTES (type);
 362   if (lookup_attribute ("nonnull", attrs)
 363       || lookup_attribute ("format", attrs)
 364       || lookup_attribute ("format_arg", attrs))
 365     {
 366       int delta = new_idx - len;
 367       attrs = copy_list (TYPE_ATTRIBUTES (type));
 368       chkp_map_attr_arg_indexes (attrs, "nonnull", indexes, len, delta);
 369       chkp_map_attr_arg_indexes (attrs, "format", indexes, len, delta);
 370       chkp_map_attr_arg_indexes (attrs, "format_arg", indexes, len, delta);
 371       TYPE_ATTRIBUTES (type) = attrs;
 372     }
 373
 374   return type;
 375 }
 376
 377 /* For given function FNDECL add bounds arguments to arguments
 378    list.  */
 379
 380 static void
 381 chkp_add_bounds_params_to_function (tree fndecl)
 382 {
 383   tree arg;
 384
 385   for (arg = DECL_ARGUMENTS (fndecl); arg; arg = DECL_CHAIN (arg))
 386     if (BOUNDED_P (arg))
 387       {
 388         std::string new_name = CHKP_BOUNDS_OF_SYMBOL_PREFIX;
 389         tree new_arg;
 390
 391         if (DECL_NAME (arg))
 392           new_name += IDENTIFIER_POINTER (DECL_NAME (arg));
 393         else
 394           {
 395             char uid[25];
 396             snprintf (uid, 25, "D.%u", DECL_UID (arg));
 397             new_name += uid;
 398           }
 399
 400         new_arg = build_decl (DECL_SOURCE_LOCATION (arg), PARM_DECL,
 401                               get_identifier (new_name.c_str ()),
 402                               pointer_bounds_type_node);
 403         DECL_ARG_TYPE (new_arg) = pointer_bounds_type_node;
 404         DECL_CONTEXT (new_arg) = DECL_CONTEXT (arg);
 405         DECL_ARTIFICIAL (new_arg) = 1;
 406         DECL_CHAIN (new_arg) = DECL_CHAIN (arg);
 407         DECL_CHAIN (arg) = new_arg;
 408
 409         arg = DECL_CHAIN (arg);
 410
 411       }
 412     else if (chkp_type_has_pointer (TREE_TYPE (arg)))
 413       {
 414         tree orig_arg = arg;
 415         bitmap slots = BITMAP_ALLOC (NULL);
 416         bitmap_iterator bi;
 417         unsigned bnd_no;
 418
 419         chkp_find_bound_slots (TREE_TYPE (arg), slots);
 420
 421         EXECUTE_IF_SET_IN_BITMAP (slots, 0, bnd_no, bi)
 422           {
 423             std::string new_name = CHKP_BOUNDS_OF_SYMBOL_PREFIX;
 424             tree new_arg;
 425             char offs[25];
 426
 427             if (DECL_NAME (orig_arg))
 428               new_name += IDENTIFIER_POINTER (DECL_NAME (orig_arg));
 429             else
 430               {
 431                 snprintf (offs, 25, "D.%u", DECL_UID (arg));
 432                 new_name += offs;
 433               }
 434             snprintf (offs, 25, "__%u", bnd_no * POINTER_SIZE / BITS_PER_UNIT);
 435
 436             new_arg = build_decl (DECL_SOURCE_LOCATION (orig_arg),
 437                                   PARM_DECL,
 438                                   get_identifier (new_name.c_str ()),
 439                                   pointer_bounds_type_node);
 440             DECL_ARG_TYPE (new_arg) = pointer_bounds_type_node;
 441             DECL_CONTEXT (new_arg) = DECL_CONTEXT (orig_arg);
 442             DECL_ARTIFICIAL (new_arg) = 1;
 443             DECL_CHAIN (new_arg) = DECL_CHAIN (arg);
 444             DECL_CHAIN (arg) = new_arg;
 445
 446             arg = DECL_CHAIN (arg);
 447           }
 448         BITMAP_FREE (slots);
 449       }
 450
 451   TREE_TYPE (fndecl) =
 452     chkp_copy_function_type_adding_bounds (TREE_TYPE (fndecl));
 453 }
 454
 455 /* Return an instrumentation clone for builtin function
 456    FNDECL.  Create one if needed.  */
 457
 458 tree
 459 chkp_maybe_clone_builtin_fndecl (tree fndecl)
 460 {
 461   tree clone;
 462   enum built_in_function fcode = DECL_FUNCTION_CODE (fndecl);
 463
 464   gcc_assert (DECL_BUILT_IN_CLASS (fndecl) == BUILT_IN_NORMAL
 465               && fcode < BEGIN_CHKP_BUILTINS);
 466
 467   fcode = (enum built_in_function) (fcode + BEGIN_CHKP_BUILTINS + 1);
 468   clone = builtin_decl_explicit (fcode);
 469   if (clone)
 470     return clone;
 471
 472   clone = chkp_build_instrumented_fndecl (fndecl);
 473   chkp_add_bounds_params_to_function (clone);
 474
 475   gcc_assert (DECL_FUNCTION_CODE (clone) == fcode);
 476
 477   set_builtin_decl (fcode, clone, false);
 478
 479   return clone;
 480 }
 481
 482 /* Return 1 if function FNDECL should be instrumented.  */
 483
 484 bool
 485 chkp_instrumentable_p (tree fndecl)
 486 {
 487   struct function *fn = DECL_STRUCT_FUNCTION (fndecl);
 488   return (!lookup_attribute ("bnd_legacy", DECL_ATTRIBUTES (fndecl))
 489           && (!flag_chkp_instrument_marked_only
 490               || lookup_attribute ("bnd_instrument", DECL_ATTRIBUTES (fndecl)))
 491           && (!fn || !copy_forbidden (fn, fndecl)));
 492 }
 493
 494 /* Return clone created for instrumentation of NODE or NULL.  */
 495
 496 cgraph_node *
 497 chkp_maybe_create_clone (tree fndecl)
 498 {
 499   cgraph_node *node = cgraph_node::get_create (fndecl);
 500   cgraph_node *clone = node->instrumented_version;
 501
 502   gcc_assert (!node->instrumentation_clone);
 503
 504   if (DECL_BUILT_IN (fndecl)
 505       && (DECL_BUILT_IN_CLASS (fndecl) != BUILT_IN_NORMAL
 506           || DECL_FUNCTION_CODE (fndecl) >= BEGIN_CHKP_BUILTINS))
 507     return NULL;
 508
 509   clone = node->instrumented_version;
 510
 511   /* Some instrumented builtin function calls may be optimized and
 512      cgraph nodes may be removed as unreachable.  Later optimizations
 513      may generate new calls to removed functions and in this case
 514      we have to recreate cgraph node.  FUNCTION_DECL for instrumented
 515      builtin still exists and should be reused in such case.  */
 516   if (DECL_BUILT_IN_CLASS (fndecl) == BUILT_IN_NORMAL
 517       && fndecl == builtin_decl_explicit (DECL_FUNCTION_CODE (fndecl))
 518       && !clone)
 519     {
 520       enum built_in_function fncode = DECL_FUNCTION_CODE (fndecl);
 521       tree new_decl;
 522
 523       fncode = (enum built_in_function) (fncode + BEGIN_CHKP_BUILTINS + 1);
 524       new_decl = builtin_decl_explicit (fncode);
 525
 526       /* We've actually already created an instrumented clone once.
 527          Restore it.  */
 528       if (new_decl)
 529         {
 530           clone = cgraph_node::get (new_decl);
 531
 532           if (!clone)
 533             {
 534               gcc_assert (!gimple_has_body_p (fndecl));
 535               clone = cgraph_node::get_create (new_decl);
 536               clone->externally_visible = node->externally_visible;
 537               clone->local = node->local;
 538               clone->address_taken = node->address_taken;
 539               clone->thunk = node->thunk;
 540               clone->alias = node->alias;
 541               clone->weakref = node->weakref;
 542               clone->cpp_implicit_alias = node->cpp_implicit_alias;
 543               clone->orig_decl = fndecl;
 544               clone->instrumentation_clone = true;
 545             }
 546
 547           clone->instrumented_version = node;
 548           node->instrumented_version = clone;
 549         }
 550     }
 551
 552   if (!clone)
 553     {
 554       tree new_decl = chkp_build_instrumented_fndecl (fndecl);
 555       struct cgraph_edge *e;
 556       struct ipa_ref *ref;
 557       int i;
 558
 559       clone = node->create_version_clone (new_decl, vNULL, NULL);
 560       clone->externally_visible = node->externally_visible;
 561       clone->local = node->local;
 562       clone->address_taken = node->address_taken;
 563       clone->thunk = node->thunk;
 564       clone->alias = node->alias;
 565       clone->weakref = node->weakref;
 566       clone->cpp_implicit_alias = node->cpp_implicit_alias;
 567       clone->instrumented_version = node;
 568       clone->orig_decl = fndecl;
 569       clone->instrumentation_clone = true;
 570       node->instrumented_version = clone;
 571
 572       if (gimple_has_body_p (fndecl))
 573         {
 574           /* If function will not be instrumented, then it's instrumented
 575              version is a thunk for the original.  */
 576           if (!chkp_instrumentable_p (fndecl))
 577             {
 578               clone->remove_callees ();
 579               clone->remove_all_references ();
 580               clone->thunk.thunk_p = true;
 581               clone->thunk.add_pointer_bounds_args = true;
 582               clone->create_edge (node, NULL, 0, CGRAPH_FREQ_BASE);
 583               /* Thunk shouldn't be a cdtor.  */
 584               DECL_STATIC_CONSTRUCTOR (clone->decl) = 0;
 585               DECL_STATIC_DESTRUCTOR (clone->decl) = 0;
 586             }
 587           else
 588             {
 589               tree_function_versioning (fndecl, new_decl, NULL, false,
 590                                         NULL, false, NULL, NULL);
 591               clone->lowered = true;
 592             }
 593         }
 594
 595       /* New params are inserted after versioning because it
 596          actually copies args list from the original decl.  */
 597       chkp_add_bounds_params_to_function (new_decl);
 598
 599       /* Remember builtin fndecl.  */
 600       if (DECL_BUILT_IN_CLASS (clone->decl) == BUILT_IN_NORMAL
 601           && fndecl == builtin_decl_explicit (DECL_FUNCTION_CODE (fndecl)))
 602         {
 603           gcc_assert (!builtin_decl_explicit (DECL_FUNCTION_CODE (clone->decl)));
 604           set_builtin_decl (DECL_FUNCTION_CODE (clone->decl),
 605                             clone->decl, false);
 606         }
 607
 608       /* Clones have the same comdat group as originals.  */
 609       if (node->same_comdat_group
 610           || (DECL_ONE_ONLY (node->decl)
 611               && !DECL_EXTERNAL (node->decl)))
 612         clone->add_to_same_comdat_group (node);
 613
 614       if (gimple_has_body_p (fndecl))
 615         symtab->call_cgraph_insertion_hooks (clone);
 616
 617       /* Clone all aliases.  */
 618       for (i = 0; node->iterate_direct_aliases (i, ref); i++)
 619         {
 620           struct cgraph_node *alias = dyn_cast <cgraph_node *> (ref->referring);
 621           struct cgraph_node *chkp_alias
 622             = chkp_maybe_create_clone (alias->decl);
 623           chkp_alias->create_reference (clone, IPA_REF_ALIAS, NULL);
 624         }
 625
 626       /* Clone all thunks.  */
 627       for (e = node->callers; e; e = e->next_caller)
 628         if (e->caller->thunk.thunk_p
 629             && !e->caller->thunk.add_pointer_bounds_args
 630             && !e->caller->instrumentation_clone)
 631           {
 632             struct cgraph_node *thunk
 633               = chkp_maybe_create_clone (e->caller->decl);
 634             /* Redirect thunk clone edge to the node clone.  */
 635             thunk->callees->redirect_callee (clone);
 636           }
 637
 638       /* For aliases and thunks we should make sure target is cloned
 639          to have proper references and edges.  */
 640       if (node->thunk.thunk_p)
 641         chkp_maybe_create_clone (node->callees->callee->decl);
 642       else if (node->alias)
 643         {
 644           struct cgraph_node *target;
 645
 646           ref = node->ref_list.first_reference ();
 647           if (ref)
 648             chkp_maybe_create_clone (ref->referred->decl);
 649
 650           if (node->alias_target)
 651             {
 652               if (TREE_CODE (node->alias_target) == FUNCTION_DECL)
 653                 {
 654                   target = chkp_maybe_create_clone (node->alias_target);
 655                   clone->alias_target = target->decl;
 656                 }
 657               else
 658                 clone->alias_target = node->alias_target;
 659             }
 660         }
 661
 662       /* Add IPA reference.  It's main role is to keep instrumented
 663          version reachable while original node is reachable.  */
 664       ref = node->create_reference (clone, IPA_REF_CHKP, NULL);
 665     }
 666
 667   return clone;
 668 }
 669
 670 /* Create clone for all functions to be instrumented.  */
 671
 672 static unsigned int
 673 chkp_versioning (void)
 674 {
 675   struct cgraph_node *node;
 676   const char *reason;
 677
 678   bitmap_obstack_initialize (NULL);
 679
 680   FOR_EACH_DEFINED_FUNCTION (node)
 681     {
 682       if (!node->instrumentation_clone
 683           && !node->instrumented_version
 684           && !node->alias
 685           && !node->thunk.thunk_p
 686           && (!DECL_BUILT_IN (node->decl)
 687               || (DECL_BUILT_IN_CLASS (node->decl) == BUILT_IN_NORMAL
 688                   && DECL_FUNCTION_CODE (node->decl) < BEGIN_CHKP_BUILTINS)))
 689         {
 690           if (chkp_instrumentable_p (node->decl))
 691             chkp_maybe_create_clone (node->decl);
 692           else if ((reason = copy_forbidden (DECL_STRUCT_FUNCTION (node->decl),
 693                                              node->decl)))
 694             {
 695               if (warning_at (DECL_SOURCE_LOCATION (node->decl), OPT_Wchkp,
 696                               "function cannot be instrumented"))
 697                 inform (DECL_SOURCE_LOCATION (node->decl), reason, node->decl);
 698             }
 699         }
 700     }
 701
 702   /* Mark all aliases and thunks of functions with no instrumented
 703      version as legacy function.  */
 704   FOR_EACH_DEFINED_FUNCTION (node)
 705     {
 706       if (!node->instrumentation_clone
 707           && !node->instrumented_version
 708           && (node->alias || node->thunk.thunk_p)
 709           && !lookup_attribute ("bnd_legacy", DECL_ATTRIBUTES (node->decl)))
 710         DECL_ATTRIBUTES (node->decl)
 711           = tree_cons (get_identifier ("bnd_legacy"), NULL,
 712                        DECL_ATTRIBUTES (node->decl));
 713     }
 714
 715   bitmap_obstack_release (NULL);
 716
 717   return 0;
 718 }
 719
 720 /* In this pass we remove bodies of functions having
 721    instrumented version.  Functions with removed bodies
 722    become a special kind of thunks to provide a connection
 723    between calls to the original version and instrumented
 724    function.  */
 725
 726 static unsigned int
 727 chkp_produce_thunks (bool early)
 728 {
 729   struct cgraph_node *node;
 730
 731   FOR_EACH_DEFINED_FUNCTION (node)
 732     {
 733       if (!node->instrumentation_clone
 734           && node->instrumented_version
 735           && gimple_has_body_p (node->decl)
 736           && gimple_has_body_p (node->instrumented_version->decl)
 737           && (!lookup_attribute ("always_inline", DECL_ATTRIBUTES (node->decl))
 738               || !early))
 739         {
 740           node->release_body ();
 741           node->remove_callees ();
 742           node->remove_all_references ();
 743
 744           node->thunk.thunk_p = true;
 745           node->thunk.add_pointer_bounds_args = true;
 746           node->create_edge (node->instrumented_version, NULL,
 747                              0, CGRAPH_FREQ_BASE);
 748           node->create_reference (node->instrumented_version,
 749                                IPA_REF_CHKP, NULL);
 750           /* Thunk shouldn't be a cdtor.  */
 751           DECL_STATIC_CONSTRUCTOR (node->decl) = 0;
 752           DECL_STATIC_DESTRUCTOR (node->decl) = 0;
 753         }
 754     }
 755
 756   /* Mark instrumentation clones created for aliases and thunks
 757      as insttrumented so they could be removed as unreachable
 758      now.  */
 759   if (!early)
 760     {
 761       FOR_EACH_DEFINED_FUNCTION (node)
 762       {
 763         if (node->instrumentation_clone
 764             && (node->alias || node->thunk.thunk_p)
 765             && !chkp_function_instrumented_p (node->decl))
 766           chkp_function_mark_instrumented (node->decl);
 767       }
 768     }
 769
 770   return TODO_remove_functions;
 771 }
 772
 773 const pass_data pass_data_ipa_chkp_versioning =
 774 {
 775   SIMPLE_IPA_PASS, /* type */
 776   "chkp_versioning", /* name */
 777   OPTGROUP_NONE, /* optinfo_flags */
 778   TV_NONE, /* tv_id */
 779   0, /* properties_required */
 780   0, /* properties_provided */
 781   0, /* properties_destroyed */
 782   0, /* todo_flags_start */
 783   0 /* todo_flags_finish */
 784 };
 785
 786 const pass_data pass_data_ipa_chkp_early_produce_thunks =
 787 {
 788   SIMPLE_IPA_PASS, /* type */
 789   "chkp_ecleanup", /* name */
 790   OPTGROUP_NONE, /* optinfo_flags */
 791   TV_NONE, /* tv_id */
 792   0, /* properties_required */
 793   0, /* properties_provided */
 794   0, /* properties_destroyed */
 795   0, /* todo_flags_start */
 796   0 /* todo_flags_finish */
 797 };
 798
 799 const pass_data pass_data_ipa_chkp_produce_thunks =
 800 {
 801   SIMPLE_IPA_PASS, /* type */
 802   "chkp_cleanup", /* name */
 803   OPTGROUP_NONE, /* optinfo_flags */
 804   TV_NONE, /* tv_id */
 805   0, /* properties_required */
 806   0, /* properties_provided */
 807   0, /* properties_destroyed */
 808   0, /* todo_flags_start */
 809   0 /* todo_flags_finish */
 810 };
 811
 812 class pass_ipa_chkp_versioning : public simple_ipa_opt_pass
 813 {
 814 public:
 815   pass_ipa_chkp_versioning (gcc::context *ctxt)
 816     : simple_ipa_opt_pass (pass_data_ipa_chkp_versioning, ctxt)
 817   {}
 818
 819   /* opt_pass methods: */
 820   virtual opt_pass * clone ()
 821     {
 822       return new pass_ipa_chkp_versioning (m_ctxt);
 823     }
 824
 825   virtual bool gate (function *)
 826     {
 827       return flag_check_pointer_bounds;
 828     }
 829
 830   virtual unsigned int execute (function *)
 831     {
 832       return chkp_versioning ();
 833     }
 834
 835 }; // class pass_ipa_chkp_versioning
 836
 837 class pass_ipa_chkp_early_produce_thunks : public simple_ipa_opt_pass
 838 {
 839 public:
 840   pass_ipa_chkp_early_produce_thunks (gcc::context *ctxt)
 841     : simple_ipa_opt_pass (pass_data_ipa_chkp_early_produce_thunks, ctxt)
 842   {}
 843
 844   /* opt_pass methods: */
 845   virtual opt_pass * clone ()
 846     {
 847       return new pass_ipa_chkp_early_produce_thunks (m_ctxt);
 848     }
 849
 850   virtual bool gate (function *)
 851     {
 852       return flag_check_pointer_bounds;
 853     }
 854
 855   virtual unsigned int execute (function *)
 856     {
 857       return chkp_produce_thunks (true);
 858     }
 859
 860 }; // class pass_chkp_produce_thunks
 861
 862 class pass_ipa_chkp_produce_thunks : public simple_ipa_opt_pass
 863 {
 864 public:
 865   pass_ipa_chkp_produce_thunks (gcc::context *ctxt)
 866     : simple_ipa_opt_pass (pass_data_ipa_chkp_produce_thunks, ctxt)
 867   {}
 868
 869   /* opt_pass methods: */
 870   virtual opt_pass * clone ()
 871     {
 872       return new pass_ipa_chkp_produce_thunks (m_ctxt);
 873     }
 874
 875   virtual bool gate (function *)
 876     {
 877       return flag_check_pointer_bounds;
 878     }
 879
 880   virtual unsigned int execute (function *)
 881     {
 882       return chkp_produce_thunks (false);
 883     }
 884
 885 }; // class pass_chkp_produce_thunks
 886
 887 simple_ipa_opt_pass *
 888 make_pass_ipa_chkp_versioning (gcc::context *ctxt)
 889 {
 890   return new pass_ipa_chkp_versioning (ctxt);
 891 }
 892
 893 simple_ipa_opt_pass *
 894 make_pass_ipa_chkp_early_produce_thunks (gcc::context *ctxt)
 895 {
 896   return new pass_ipa_chkp_early_produce_thunks (ctxt);
 897 }
 898
 899 simple_ipa_opt_pass *
 900 make_pass_ipa_chkp_produce_thunks (gcc::context *ctxt)
 901 {
 902   return new pass_ipa_chkp_produce_thunks (ctxt);
 903 }